@vyuhlabs/dxkit 2.13.0 → 2.13.2

package/CHANGELOG.md

@@ -7,6 +7,70 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.13.2] - 2026-06-22
+
+### Fixed
+
+- `init` and `update` now gitignore `.dxkit/loop/`, so the loop pack's runtime
+  output (the ledger and the last-guardrail snapshot) is no longer committed by
+  repos that use the Stop-gate. Latent since the loop pack shipped in 2.13.0.
+
+### Changed
+
+- `loop doctor` now validates the **actual** registered Stop hook command. It
+  understands both the `npx vyuh-dxkit` / installed-binary form (the binary must
+  resolve) and a local-build `node <script>` form (the script must exist),
+  instead of only the npx form. This lets a repo dogfood the gate against its own
+  build, and gives a correct verdict for any custom hook command.
+
+## [2.13.1] - 2026-06-21
+
+### Fixed — the loop Stop hook could fail on every stop when dxkit was not installed
+
+The loop Stop hook (and the `.claude` PreToolUse context hook) invoke the
+dxkit CLI as `npx vyuh-dxkit …`. That only resolves when dxkit is installed
+in the repo (a devDependency or a global). When the loop was wired with a
+pure-`npx @vyuhlabs/dxkit init --claude-loop` flow — no install — the hook
+hit `npm error 404 'vyuh-dxkit' is not in this registry` on every stop,
+because `vyuh-dxkit` is a binary name, not a package. `loop doctor` reported
+the hook as wired even though it could not run.
+
+- **`init --claude-loop` and `update` now declare `@vyuhlabs/dxkit` as a
+  devDependency** whenever they install an artifact that invokes the CLI (the
+  Stop hook, the context hook, the pre-push guardrail, or the CI guardrail),
+  so `npx vyuh-dxkit` resolves to a project-local binary. Skipped for
+  non-Node repos and when the dependency is already declared.
+- **`loop doctor` now verifies the CLI actually resolves**, not just that the
+  hook string is present, and tells you to install dxkit when it does not.
+- **The recommended loop setup installs dxkit first** via
+  `npm init @vyuhlabs/dxkit -- --claude-loop --yes`, which adds the
+  devDependency and registers the hook in one step.
+
+### Changed — one canonical CLI invocation, one registry of self-invoking surfaces
+
+Every generated artifact that runs the dxkit CLI now builds its command from
+a single helper, and every such artifact is listed in one registry that
+drives the devDependency wire-up and the doctor checks. Adding a new
+auto-running surface can no longer silently skip either. Enforced by an
+architecture check and a registry-injection test.
+
+### Changed — positioning aligned to the Stop-gate
+
+The package description, CLI banner, npm keywords, and the docs now lead with
+the deterministic Stop-gate framing. The README loop quickstart installs
+dxkit first, and the demo command is pinned to `@latest` so a stale global or
+npx cache cannot run an older version that lacks the command.
+
+### Changed — `demo loop-guardrail` now runs a real sandbox scan
+
+The demo no longer prints a scripted scenario. When gitleaks is available it
+generates a throwaway git repo, runs the real `baseline create`, introduces a
+real hardcoded secret, and runs the real `guardrail check` — the same commands
+a user runs — so the block→repair→clean walkthrough is an actual scan, not a
+mock. Your repo is never touched. The fabricated "agent" dialogue is gone; when
+gitleaks is absent it shows a clearly-labelled illustration and how to run the
+real sandbox.
+
 ## [2.13.0] - 2026-06-18
 
 ### Loop pack — a deterministic Stop-gate for autonomous coding loops

package/README.md

@@ -16,6 +16,7 @@ finding, and the agent repaired before stopping clean.
 <p align="center">
   <img src=".github/assets/loop-stop-gate-demo.gif" width="820" alt="dxkit's Stop-gate blocks a coding-agent loop on a net-new critical dependency vulnerability, the agent bumps the version, and the gate goes clean." />
 </p>
+<p align="center"><sub>Recorded from a real run on a synthetic repo, shortened for readability. Blocked and repaired inside the same warm loop.</sub></p>
 
 dxkit does not reinvent detection. It runs trusted open source scanners
 (gitleaks, Semgrep, OSV, npm audit, and more), and it can ingest results from
@@ -24,13 +25,17 @@ deterministic check, on every stop, of whether this change introduced a new
 finding compared with a baseline.
 
 ```bash
-npx -y @vyuhlabs/dxkit demo loop-guardrail   # see it in 5 seconds, no API key, no setup
+npm init @vyuhlabs/dxkit -- --claude-loop --yes   # install dxkit + register the Claude Code Stop hook
+npx vyuh-dxkit baseline create                    # grandfather today's findings
+npx vyuh-dxkit loop doctor                         # verify the gate is wired
 ```
 
-Local. Offline. No model in the gate. Existing debt stays grandfathered. Only
-net-new regressions block.
+The gate runs locally with no model: same input, same verdict, in seconds.
+Existing debt stays grandfathered; only net-new regressions block. Want to
+watch the flow first, on a sandbox dxkit creates? See the
+[walkthrough](#see-it-without-touching-your-repo).
 
-[Watch it block and repair](#watch-it-block-and-repair) · [Read the benchmark](docs/benchmarks.md) · [Try it on your repo](#try-it-locally)
+[Read the benchmark](docs/benchmarks.md) · [Try it on your repo](#try-it-on-your-repo)
 
 <p>
   <a href="https://www.npmjs.com/package/@vyuhlabs/dxkit"><img alt="npm" src="https://img.shields.io/npm/v/@vyuhlabs/dxkit"></a>
@@ -76,12 +81,23 @@ Use dxkit if you let coding agents:
 ## Built on tools you already trust
 
 dxkit is an orchestration and enforcement layer, not another scanner. It runs
-established open source tools and treats their output as one stream:
+established open source tools and treats their output as one stream. Which tools
+run depends on the languages in your repo — dxkit covers **8 ecosystems**
+(TypeScript / JavaScript, Python, Go, Rust, C# / .NET, Java, Kotlin, Ruby).
+
+Universal, on every repo:
 
 - secrets: gitleaks
 - code patterns: Semgrep
-- dependency vulnerabilities: OSV and npm audit
-- duplication, size, and the code graph: jscpd, cloc, and graphify
+- dependency advisories: OSV.dev
+- size, duplication, and the code graph: cloc, jscpd, graphify
+
+Per language, dxkit adds that ecosystem's own linter and audit tool — for
+example npm audit + ESLint (JS / TS), pip-audit + ruff (Python), govulncheck +
+golangci-lint (Go), cargo-audit + clippy (Rust), `dotnet list --vulnerable`
+(C#), osv-scanner + PMD (Java), osv-scanner + detekt (Kotlin), and
+bundler-audit + RuboCop (Ruby). The full per-language matrix is in **Per-pack
+capabilities** below.
 
 For deep interprocedural analysis, it ingests findings from **Snyk Code** and
 **CodeQL** (or any SARIF file), fingerprints them the same way as native
@@ -95,42 +111,38 @@ and inside the agent loop.
 | dxkit     | baseline, fingerprint matcher, Stop-gate, loop ledger  | Decide whether this change introduced something net-new |
 | Agent     | Claude Code or another coding loop                     | Repair the exact finding and try to stop again          |
 
-## Watch it block and repair
-
-```text
-checkout-service · loop behind the dxkit Stop-gate
-  task: add a debounce helper using lodash 4.17.4
-  claude ▸ Added a debounce helper using lodash 4.17.4. Done.
-  ✗ dxkit Stop-gate ▸ BLOCKED: 1 net-new finding
-       lodash 4.17.4: critical dependency vuln (GHSA-JF85-CPCP-J695)
-  claude ▸ Bumped lodash to 4.17.21 and re-checked. Done.
-  ✓ dxkit Stop-gate ▸ CLEAN  the loop may stop.
-```
-
-Recorded from a real run on a synthetic repo, shortened for readability.
-Blocked and repaired inside the same warm loop.
-
-## Try it locally
+## Try it on your repo
 
-See the gate with no API key, no Claude Code, and no setup:
+The Stop hook runs dxkit on every stop, so install dxkit into the repo. This
+one command adds it as a devDependency and registers the hook additively — your
+existing `.claude` settings are preserved:
 
 ```bash
-npx -y @vyuhlabs/dxkit demo loop-guardrail
+npm init @vyuhlabs/dxkit -- --claude-loop --yes
+npx vyuh-dxkit baseline create      # grandfather today's findings
+npx vyuh-dxkit loop doctor          # verify the gate is wired safely and dxkit resolves
+# then run Claude Code as you normally would. The Stop-gate fires on every stop.
+npx vyuh-dxkit loop ledger summarize  # afterwards: blocked vs allowed, repaired-after-block
 ```
 
-It runs the real gate over an example finding and shows what it feeds the
-agent: block, repair, clean.
+When the agent tries to stop, dxkit runs the net-new gate against the baseline.
+Existing findings are grandfathered; only findings this change introduced block.
+
+## See it without touching your repo
 
-Wire it into your real Claude Code loop:
+Want the flow first, on a sandbox dxkit creates?
 
 ```bash
-npx @vyuhlabs/dxkit init --claude-loop   # registers the Stop hook (additive: your settings are kept)
-npx @vyuhlabs/dxkit baseline create      # grandfather today's findings
-npx @vyuhlabs/dxkit loop doctor          # verify the gate is wired safely
-# then run Claude Code as you normally would. The Stop-gate fires on every stop.
-npx @vyuhlabs/dxkit loop ledger summarize  # afterwards: blocked vs allowed, repaired-after-block
+npx -y @vyuhlabs/dxkit@latest demo loop-guardrail
 ```
 
+This runs the **real** gate on a temporary fixture repo: baseline → introduce a
+net-new secret → BLOCK → repair → CLEAN, then it tears the fixture down. No API
+key and no Claude Code, and your own repo is never touched. It needs gitleaks
+installed and takes about 20 seconds; without gitleaks it shows a clearly
+labelled illustration instead. (It does a one-time `npx` download, so it is not
+fully offline — the gate itself is.)
+
 ### Presets: what blocks the loop
 
 ```text
@@ -141,25 +153,39 @@ full-debt      (opt-in)   also gates test gaps and maintainability regressions.
 The default is `security-only`. The headline escape-rate benchmark used
 `full-debt` (it gated both the secret trap and the test-gap trap); the default
 install starts narrower so a first run does not trap users in expensive
-test-generation loops. Switch with `init --claude-loop --loop-preset full-debt`.
-
-## Graph context: reducing the exploration tail
-
-The Stop-gate controls what the loop is allowed to ship. The code graph helps
-control how far the loop wanders. When dxkit scaffolds a repo, it builds a code
-graph and feeds the agent structural context: callers, callees, and blast
-radius. The agent gets a map before it starts grepping through unfamiliar code.
-
-The honest result from our benchmarks is predictable spend, not guaranteed
-cheaper spend. On a large repo the median was roughly tied, but the worst-case
-session used about **57% fewer tokens** and the variance was **roughly halved**.
-On a small repo the overhead was about zero. The graph caps the expensive tail.
-It does not promise a lower average.
+test-generation loops. Switch with
+`npm init @vyuhlabs/dxkit -- --claude-loop --loop-preset full-debt`.
+
+## Give the agent a map, not just a gate
+
+The Stop-gate controls what a loop is allowed to ship. The code graph controls
+how the agent does the work in between. When dxkit scaffolds a repo it builds a
+code graph and installs skills that drive real development off it, so the agent
+orients by querying structure instead of grepping and re-reading whole files.
+
+- **Build a feature** (`dxkit-feature` skill): query the graph for where the
+  feature plugs in, what patterns already exist, and what the change will
+  touch, then implement against those patterns and run the analyzers on the
+  result before it stops.
+- **Fix a finding** (`dxkit-action` skill): take a flagged finding, pull its
+  callers, callees, and blast radius from the graph, repair it, and confirm the
+  change did not introduce something net-new.
+
+The agent gets callers, callees, and blast radius up front as a budget-bounded
+slice, not a pile of file reads. It is the same graph, the same baseline, and
+the same identity contract the gate already uses.
+
+What the benchmarks actually show is predictable spend, not guaranteed cheaper
+spend. On a large repo the median was roughly tied, the worst-case session used
+about **57% fewer tokens**, and the variance was **roughly halved**. On a small
+repo the overhead was about zero. The graph caps the expensive tail. It does
+not promise a lower average, and it does not make the agent write better code on
+its own.
 
 This is a different axis from detection. Snyk, SonarQube, and CodeQL tell you
 what is wrong. They do not give the agent a map of the code or bound how much it
 spends finding its way around. dxkit does both: the gate bounds what the loop
-ships, the graph bounds what the loop costs.
+ships, the graph bounds how the loop works.
 
 ## The numbers
 
@@ -178,7 +204,7 @@ predictable.
 > dxkit catches every possible bug. The claim is narrower: for findings the
 > detector observes, dxkit gives the loop a deterministic net-new stop decision.
 
-Full methodology, raw artifacts, and the rest of the caveats are in
+Full methodology, reproducibility notes, artifact status, and caveats are in
 **[docs/benchmarks.md](docs/benchmarks.md)**.
 
 ## What dxkit is, and is not
@@ -219,11 +245,28 @@ at the speed of the agent loop.
 The same deterministic core powers the rest of dxkit: pre-push and CI
 guardrails, brownfield baselines, durable finding identity, SARIF, CodeQL, and
 Snyk ingest, a six-dimension health report, code-graph context, and a set of
-Claude Code skills. It covers TypeScript / JavaScript, Python, Go, Rust, C# /
-.NET, Java, Kotlin, and Ruby. See **[the docs](docs/README.md)**.
+Claude Code skills. See **[the docs](docs/README.md)**.
+
+## Languages
+
+dxkit covers 8 ecosystems. Detection is automatic from your manifests and
+source; each language brings its own native linter, dependency-audit tool, and
+coverage parser, layered on the universal scanners (gitleaks, Semgrep, OSV,
+cloc, jscpd, graphify).
+
+| Language                | Detected by                 | Native linter + audit                     |
+| ----------------------- | --------------------------- | ----------------------------------------- |
+| TypeScript / JavaScript | `package.json`              | ESLint, npm audit                         |
+| Python                  | `pyproject.toml`, `*.py`    | ruff, pip-audit                           |
+| Go                      | `go.mod`                    | golangci-lint, govulncheck                |
+| Rust                    | `Cargo.toml`                | clippy, cargo-audit                       |
+| C# / .NET               | `*.csproj`, `*.sln`         | dotnet-format, `dotnet list --vulnerable` |
+| Java                    | `pom.xml`, `src/main/java/` | PMD, osv-scanner                          |
+| Kotlin                  | `*.gradle{.kts,}`, `*.kt`   | detekt, osv-scanner                       |
+| Ruby                    | `Gemfile`, `*.rb`           | RuboCop, bundler-audit                    |
 
 <details>
-<summary><strong>Per-pack capabilities</strong> (click to expand)</summary>
+<summary><strong>Per-pack capabilities</strong> — coverage import, import-graph, severity tiers (click to expand)</summary>
 
 | Language | Detection                             | Coverage import     | Import-graph                                 | Native tools                        | Lint severity tiers    | Vuln severity tiers                           |
 | -------- | ------------------------------------- | ------------------- | -------------------------------------------- | ----------------------------------- | ---------------------- | --------------------------------------------- |
@@ -248,18 +291,21 @@ so it does not inflate the Code Quality score.
 
 </details>
 
-## Reproduce the benchmark
+## Reproduce the deterministic tier
 
-The deterministic tier runs offline, so you do not have to trust our numbers:
+The deterministic results — the net-new gate decision and the finding-identity
+matcher — reproduce offline, so you do not have to trust our numbers. This is
+separate from the agentic benchmark, which requires running real agent sessions.
+The harnesses live in `benchmarks/`:
 
 ```bash
-npx @vyuhlabs/dxkit demo loop-guardrail   # the gate, end to end, no API key
-npx @vyuhlabs/dxkit init --claude-loop
-npx @vyuhlabs/dxkit baseline create
-npx @vyuhlabs/dxkit loop doctor
+node benchmarks/bench-guardrail.mjs config.json        # block/allow on seeded findings
+node benchmarks/bench-netnew-isolation.mjs config.json # net-new isolation under churn
+node benchmarks/bench-matcher.mjs config.json          # false net-new on line shifts + renames
 ```
 
-Methodology and raw artifacts: **[docs/benchmarks.md](docs/benchmarks.md)**.
+See `benchmarks/README.md` to point them at a repo, and the full methodology,
+caveats, and artifact status in **[docs/benchmarks.md](docs/benchmarks.md)**.
 
 ## Credits
 

package/dist/allowlist/hint.d.ts

@@ -11,7 +11,7 @@
  *   2. **Inline example** — the exact annotation comment to paste
  *      when the finding has a stable single-line attachment point
  *      and the chosen category is inline-compatible.
- *   3. **CLI command** — the exact `npx vyuh-dxkit allowlist add`
+ *   3. **CLI command** — the exact `vyuh-dxkit allowlist add`
  *      invocation that handles the mutation without the developer
  *      typing annotation syntax.
  *

package/dist/allowlist/hint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hint.d.ts","sourceRoot":"","sources":["../../src/allowlist/hint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGxE,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAStB,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;oBAEgB;IAChB,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC5D;;;mCAG+B;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;4CAGwC;IACxC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;2DACuD;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAyB3F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CAsFlE"}
+{"version":3,"file":"hint.d.ts","sourceRoot":"","sources":["../../src/allowlist/hint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGxE,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAUtB,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;oBAEgB;IAChB,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC5D;;;mCAG+B;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;4CAGwC;IACxC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;2DACuD;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAyB3F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CAwFlE"}

package/dist/allowlist/hint.js

@@ -12,7 +12,7 @@
  *   2. **Inline example** — the exact annotation comment to paste
  *      when the finding has a stable single-line attachment point
  *      and the chosen category is inline-compatible.
- *   3. **CLI command** — the exact `npx vyuh-dxkit allowlist add`
+ *   3. **CLI command** — the exact `vyuh-dxkit allowlist add`
  *      invocation that handles the mutation without the developer
  *      typing annotation syntax.
  *
@@ -75,11 +75,12 @@ const sanitize_1 = require("../baseline/sanitize");
 const languages_1 = require("../languages");
 const categories_1 = require("./categories");
 const inline_1 = require("./inline");
+const self_invocation_1 = require("../self-invocation");
 /**
  * Subcommand string used in every `cliCommand` rendered by this
  * module. One place to update if the subcommand ever renames.
  */
-const ALLOWLIST_ADD_CMD = 'npx vyuh-dxkit allowlist add';
+const ALLOWLIST_ADD_CMD = (0, self_invocation_1.dxkitCli)('allowlist add');
 /**
  * Build the structured block-time hint from a baseline entry.
  * Pure function — no IO, no side effects. The caller renders the
@@ -135,7 +136,9 @@ function remediationFor(kind) {
                 'possible rather than in source.');
         case 'dep-vuln':
             return ('Upgrade the vulnerable dependency to the patched version. Run ' +
-                '`npx vyuh-dxkit vulnerabilities` to see the suggested install command ' +
+                '`' +
+                (0, self_invocation_1.dxkitCli)('vulnerabilities') +
+                '` to see the suggested install command ' +
                 'for this ecosystem.');
         case 'duplication':
             return ('Extract the duplicated logic into a shared helper or accept the ' +

package/dist/allowlist/hint.js.map

@@ -1 +1 @@
-{"version":3,"file":"hint.js","sourceRoot":"","sources":["../../src/allowlist/hint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDH,0CAyBC;AAQD,wCAsFC;AA9KD,2CAA6B;AAC7B,mDAAmD;AAEnD,4CAAyC;AAEzC,6CAMsB;AACtB,qCAA4C;AAE5C;;;GAGG;AACH,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AA0BzD;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,KAAoB,EAAE,QAA0B;IAC9E,MAAM,oBAAoB,GAAG,+BAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACnE,yCAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,CACpC,CAAC;IACF,MAAM,aAAa,GACjB,CAAC,oCAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,MAAM,KAAK,CAAC,CAAC;IAEtF,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IAE/D,kEAAkE;IAClE,wDAAwD;IACxD,KAAK,QAAQ,CAAC;IAEd,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACvC,oBAAoB;QACpB,aAAa;QACb,UAAU;QACV,aAAa;QACb,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,IAA2B;IACxD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,CACL,8EAA8E;gBAC9E,4EAA4E;gBAC5E,qEAAqE,CACtE,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,CACL,6EAA6E;gBAC7E,6EAA6E;gBAC7E,wDAAwD,CACzD,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,CACL,+DAA+D;gBAC/D,oEAAoE;gBACpE,uEAAuE;gBACvE,iCAAiC,CAClC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,gEAAgE;gBAChE,wEAAwE;gBACxE,qBAAqB,CACtB,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO,CACL,kEAAkE;gBAClE,uDAAuD;gBACvD,wEAAwE,CACzE,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,CACL,gEAAgE;gBAChE,sEAAsE;gBACtE,kEAAkE,CACnE,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,sEAAsE;gBACtE,iEAAiE;gBACjE,sCAAsC,CACvC,CAAC;QACJ,KAAK,uBAAuB;YAC1B,OAAO,CACL,0EAA0E;gBAC1E,yEAAyE;gBACzE,0DAA0D,CAC3D,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,CACL,uEAAuE;gBACvE,0EAA0E;gBAC1E,yEAAyE;gBACzE,+BAA+B,CAChC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,yEAAyE;gBACzE,uEAAuE;gBACvE,yEAAyE;gBACzE,+BAA+B,CAChC,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,CACL,+DAA+D;gBAC/D,gEAAgE;gBAChE,uDAAuD,CACxD,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,CACL,wEAAwE;gBACxE,wEAAwE;gBACxE,+CAA+C,CAChD,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO,CACL,iEAAiE;gBACjE,mEAAmE;gBACnE,sEAAsE;gBACtE,mCAAmC,CACpC,CAAC;IACN,CAAC;AACH,CAAC;AAED,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,KAAoB;IACxC,IAAI,IAAA,sBAAW,EAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAChD,KAAK,cAAc,CAAC;QACpB,KAAK,UAAU,CAAC;QAChB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,aAAa,CAAC;QACnB,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa;YAChB,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,qBAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAoB,EACpB,mBAAkD;IAElD,IAAI,CAAC,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,CAAC,oCAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,IAAA,yBAAgB,EAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CACtB,KAAoB,EACpB,oBAAkD;IAElD,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,6BAA6B,CAAC;IAChD,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,cAAc,aAAa,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAC5F,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhC,oEAAoE;IACpE,oEAAoE;IACpE,EAAE;IACF,qEAAqE;IACrE,kEAAkE;IAClE,qDAAqD;IACrD,iEAAiE;IACjE,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,oCAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClF,OAAO,GAAG,iBAAiB,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,iBAAiB,kBAAkB,KAAK,CAAC,EAAE,WAAW,KAAK,CAAC,IAAI,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;AAC3G,CAAC;AAED,SAAS,kBAAkB,CACzB,oBAAkD;IAElD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,CACL,2EAA2E;QAC3E,iFAAiF;QACjF,yCAAyC,CAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hint.js","sourceRoot":"","sources":["../../src/allowlist/hint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DH,0CAyBC;AAQD,wCAwFC;AAjLD,2CAA6B;AAC7B,mDAAmD;AAEnD,4CAAyC;AAEzC,6CAMsB;AACtB,qCAA4C;AAC5C,wDAA8C;AAE9C;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAA,0BAAQ,EAAC,eAAe,CAAC,CAAC;AA0BpD;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,KAAoB,EAAE,QAA0B;IAC9E,MAAM,oBAAoB,GAAG,+BAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACnE,yCAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,CACpC,CAAC;IACF,MAAM,aAAa,GACjB,CAAC,oCAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,MAAM,KAAK,CAAC,CAAC;IAEtF,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IAE/D,kEAAkE;IAClE,wDAAwD;IACxD,KAAK,QAAQ,CAAC;IAEd,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QACvC,oBAAoB;QACpB,aAAa;QACb,UAAU;QACV,aAAa;QACb,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,IAA2B;IACxD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,CACL,8EAA8E;gBAC9E,4EAA4E;gBAC5E,qEAAqE,CACtE,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,CACL,6EAA6E;gBAC7E,6EAA6E;gBAC7E,wDAAwD,CACzD,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,CACL,+DAA+D;gBAC/D,oEAAoE;gBACpE,uEAAuE;gBACvE,iCAAiC,CAClC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,gEAAgE;gBAChE,GAAG;gBACH,IAAA,0BAAQ,EAAC,iBAAiB,CAAC;gBAC3B,yCAAyC;gBACzC,qBAAqB,CACtB,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO,CACL,kEAAkE;gBAClE,uDAAuD;gBACvD,wEAAwE,CACzE,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,CACL,gEAAgE;gBAChE,sEAAsE;gBACtE,kEAAkE,CACnE,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,sEAAsE;gBACtE,iEAAiE;gBACjE,sCAAsC,CACvC,CAAC;QACJ,KAAK,uBAAuB;YAC1B,OAAO,CACL,0EAA0E;gBAC1E,yEAAyE;gBACzE,0DAA0D,CAC3D,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,CACL,uEAAuE;gBACvE,0EAA0E;gBAC1E,yEAAyE;gBACzE,+BAA+B,CAChC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,yEAAyE;gBACzE,uEAAuE;gBACvE,yEAAyE;gBACzE,+BAA+B,CAChC,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,CACL,+DAA+D;gBAC/D,gEAAgE;gBAChE,uDAAuD,CACxD,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,CACL,wEAAwE;gBACxE,wEAAwE;gBACxE,+CAA+C,CAChD,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO,CACL,iEAAiE;gBACjE,mEAAmE;gBACnE,sEAAsE;gBACtE,mCAAmC,CACpC,CAAC;IACN,CAAC;AACH,CAAC;AAED,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,KAAoB;IACxC,IAAI,IAAA,sBAAW,EAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAChD,KAAK,cAAc,CAAC;QACpB,KAAK,UAAU,CAAC;QAChB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,aAAa,CAAC;QACnB,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa;YAChB,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,qBAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAoB,EACpB,mBAAkD;IAElD,IAAI,CAAC,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,CAAC,oCAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,IAAA,yBAAgB,EAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CACtB,KAAoB,EACpB,oBAAkD;IAElD,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,6BAA6B,CAAC;IAChD,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,cAAc,aAAa,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAC5F,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhC,oEAAoE;IACpE,oEAAoE;IACpE,EAAE;IACF,qEAAqE;IACrE,kEAAkE;IAClE,qDAAqD;IACrD,iEAAiE;IACjE,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,oCAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClF,OAAO,GAAG,iBAAiB,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,iBAAiB,kBAAkB,KAAK,CAAC,EAAE,WAAW,KAAK,CAAC,IAAI,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;AAC3G,CAAC;AAED,SAAS,kBAAkB,CACzB,oBAAkD;IAElD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,CACL,2EAA2E;QAC3E,iFAAiF;QACjF,yCAAyC,CAC1C,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA6RA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAi4DvD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA8RA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAy4DvD"}

package/dist/cli.js

@@ -49,6 +49,7 @@ const report_date_1 = require("./analyzers/tools/report-date");
 const fail_on_1 = require("./fail-on");
 const report_schema_1 = require("./report-schema");
 const ship_installers_1 = require("./ship-installers");
+const self_invocation_1 = require("./self-invocation");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 // process.stdout.write returns false when the OS pipe buffer is full
@@ -136,7 +137,7 @@ function applyFailOnSeverity(raw, counts, countsLabel) {
 }
 function printUsage() {
     console.log(`
-  ${logger.bold('vyuh-dxkit')} v${constants_1.VERSION} — AI-native developer experience toolkit for any codebase
+  ${logger.bold('vyuh-dxkit')} v${constants_1.VERSION} — a Stop-gate for autonomous coding loops that blocks net-new findings
 
   ${logger.bold('Usage:')}
     vyuh-dxkit init [options]    Install dxkit agent DX in this repo
@@ -277,11 +278,11 @@ function printUsage() {
                       Applies to: vulnerabilities, bom.
 
   ${logger.bold('Examples:')}
-    npx vyuh-dxkit init                  # Interactive
-    npx vyuh-dxkit init --detect         # Auto-detect, just DX
-    npx vyuh-dxkit init --full --yes     # Everything, no prompts
-    npx vyuh-dxkit init --detect --stealth  # Local-only, not committed
-    npx vyuh-dxkit update                # Re-generate from manifest
+    ${(0, self_invocation_1.dxkitCli)('init')}                  # Interactive
+    ${(0, self_invocation_1.dxkitCli)('init --detect')}         # Auto-detect, just DX
+    ${(0, self_invocation_1.dxkitCli)('init --full --yes')}     # Everything, no prompts
+    ${(0, self_invocation_1.dxkitCli)('init --detect --stealth')}  # Local-only, not committed
+    ${(0, self_invocation_1.dxkitCli)('update')}                # Re-generate from manifest
 `);
 }
 async function run(argv) {
@@ -545,12 +546,18 @@ async function run(argv) {
                     result: (0, ship_installers_1.installCiDeepSastRefresh)(cwd, { force: !!values.force }),
                 });
             }
-            // dxkit must resolve project-locally for the hooks + CI guardrail
-            // to run a pinned version (both prefer ./node_modules/.bin over a
-            // global). Add it to devDependencies whenever a surface that
-            // invokes it is installed. No-ops for non-Node repos and when the
-            // consumer already declares the dep.
-            if (wantHooks || wantCi) {
+            // dxkit must resolve project-locally so every installed self-invocation
+            // surface (Stop hook, context-hook, pre-push + CI guardrail) can run a
+            // pinned dxkit instead of 404-ing. The set of surfaces that imply this
+            // is derived from the one registry in src/self-invocation.ts — never a
+            // hand-maintained flag chain, which is what once dropped the loop Stop
+            // hook. No-ops for non-Node repos and when the dep is already declared.
+            if ((0, self_invocation_1.requiresResolvableCli)({
+                claudeSettings: wantDxkitAgents,
+                claudeLoop: wantClaudeLoop,
+                gitHooks: wantHooks,
+                ciGuardrails: wantCi,
+            })) {
                 shipResults.push({
                     label: 'dxkit devDependency',
                     result: (0, ship_installers_1.installDxkitDevDependency)(cwd, { force: !!values.force }),
@@ -1554,7 +1561,7 @@ async function run(argv) {
                 if (missing.length > 0) {
                     logger.warn(`${missing.length} scanner(s) not detected: ${missing.map((m) => m.tool).join(', ')}`);
                     logger.dim('  Findings in these categories will NOT be captured in the baseline.');
-                    logger.dim('  Install with `npx vyuh-dxkit tools install`, or if a tool IS installed but');
+                    logger.dim('  Install with `' + (0, self_invocation_1.dxkitCli)('tools install') + '`, or if a tool IS installed but');
                     logger.dim('  not detected, point dxkit at it via .dxkit/tools.json (ask Claude: "fix dxkit").');
                     // `--force` is an explicit "overwrite, non-interactive, I know
                     // what I'm doing" signal — and the shipped baseline-refresh