@vyuhlabs/dxkit 2.4.8 → 2.5.1

package/templates/.claude/commands/learn.md

@@ -1,48 +0,0 @@
----
-description: Capture a learning from this conversation (gotcha, convention, or thing to avoid)
----
-
-Review this conversation and capture any learnings. If the user provided specific input, use that:
-
-$ARGUMENTS
-
-## What to Capture
-
-Look for:
-1. **Gotchas** — something surprising, broke unexpectedly, or took time to debug
-2. **Conventions** — a pattern or approach that worked well and should be repeated
-3. **Deny recommendations** — a dangerous command that should be avoided
-
-## Where to Write
-
-First read the existing files to avoid duplicates. Then append (never overwrite) to the appropriate file:
-
-- **Gotchas** → `.claude/skills/learned/references/gotchas.md`
-  ```
-  ## YYYY-MM-DD - Category / Title
-  **Problem:** What went wrong
-  **Resolution:** How it was fixed
-  **Prevention:** How to avoid it next time
-  ```
-
-- **Conventions** → `.claude/skills/learned/references/conventions.md`
-  ```
-  ## Category - Convention Name
-  **Pattern:** What to do
-  **Rationale:** Why this works
-  ```
-
-- **Deny recommendations** → `.claude/skills/learned/references/deny-recommendations.md`
-  ```
-  ## Command / Pattern to Avoid
-  **Risk:** What could go wrong
-  **Alternative:** Safer approach
-  ```
-
-## Rules
-
-- Only capture things that are **non-obvious** and useful for future sessions
-- Don't repeat what's already in the files
-- Be concise — future sessions will read these
-- **NEVER include secrets, tokens, or credentials**
-- Tell the user what you captured and where

package/templates/.claude/commands/onboarding.md

@@ -1,21 +0,0 @@
----
-description: Start interactive onboarding for a new developer
----
-
-The **onboarding** agent is active and will help you get started with this project.
-
-It can:
-- Give you a project overview and architecture walkthrough
-- Walk you through local setup step by step
-- Explain how any part of the codebase works
-- Point out gotchas and conventions before you hit them
-- Suggest what to read first based on what area you'll work on
-
-Just start asking questions — for example:
-- "What does this project do?"
-- "How do I set up my local environment?"
-- "Where are the API endpoints defined?"
-- "What should I read first?"
-- "How does authentication work?"
-
-$ARGUMENTS

package/templates/.claude/commands/plan.md

@@ -1,20 +0,0 @@
----
-description: Generate improvement plans with KPIs from reports (or list existing plans)
----
-
-Delegate to the **strategic-planner** agent. It reads all reports in `.dxkit/reports/`, proposes measurable KPIs, and generates actionable plans in `.ai/plans/`.
-
-If reports don't exist yet, it will tell you which commands to run first (`/health`, `/vulnerabilities`, `/test-gaps`, etc.).
-
-Examples:
-- `/plan` — Analyze all reports and generate full improvement roadmap
-- `/plan security` — Generate a security-focused plan only
-- `/plan test-coverage` — Generate a test coverage plan only
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/quality.md.template

@@ -1,65 +0,0 @@
----
-description: Run code quality analysis with slop detection
----
-
-## Step 1: Check for Existing Report
-
-```bash
-ls .dxkit/reports/quality-review-*.md 2>/dev/null | tail -1
-```
-
-**If a report exists**: Read it. The slop score, duplication %, and metrics are deterministic. Skip to Step 3.
-
-**If no report exists**: Proceed to Step 2.
-
-## Step 2: Generate Deterministic Report
-
-```bash
-npx vyuh-dxkit quality . --json 2>/dev/null
-```
-
-**If the command succeeds**: Read the saved report. Proceed to Step 3.
-
-**If the command fails**: Run linters and checks manually:
-{{#IF_NODE}}
-1. `npx eslint . --format json` — Lint
-2. `npx tsc --noEmit` — Type check
-{{/IF_NODE}}
-{{#IF_PYTHON}}
-1. `ruff check .` — Lint
-2. `ruff format --check .` — Format check
-{{/IF_PYTHON}}
-{{#IF_GO}}
-1. `golangci-lint run ./...` — Lint
-2. `go vet ./...` — Vet
-{{/IF_GO}}
-{{#IF_CSHARP}}
-1. `dotnet format --verify-no-changes` — Format check
-{{/IF_CSHARP}}
-{{#IF_RUST}}
-1. `cargo fmt --check` — Format check
-2. `cargo clippy -- -D warnings` — Lint
-{{/IF_RUST}}
-Then analyze code for duplication, dead code, TODO/FIXME density, comment ratio. Note: "Metrics are AI-estimated. Install `@vyuhlabs/dxkit` for deterministic quality analysis with jscpd + graphify."
-
-## Step 3: Enrich with Narrative
-
-Using the quality metrics, add:
-
-- **Duplication hotspots** — which files/functions are copy-pasted, and how to extract shared code
-- **God file remediation** — how to break up files with >50 functions (suggest module boundaries)
-- **Dead code cleanup** — which orphan modules and dead imports to remove
-- **Slop indicators** — if comment ratio >40% or TODO count is high, suggest cleanup priorities
-- **Lint fix plan** — group lint errors by rule, suggest auto-fixable vs manual
-
-**Do not change the slop score, duplication %, or metric counts from the deterministic report.**
-
-Save to `.dxkit/reports/quality-review-YYYY-MM-DD.md`.
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/session-end.md

@@ -1,40 +0,0 @@
----
-description: End session and create checkpoint with skill evolution
----
-
-Ending the current development session.
-
-## Session Info
-
-Determine the developer name from `git config user.name` and today's date. Create the session directory at `.ai/sessions/<developer>/<date>/` if it doesn't exist. Find the next session number by checking existing `session-*.md` files. Also check recent git commits and uncommitted changes.
-
-## Create Checkpoint
-
-Create a comprehensive checkpoint at `.ai/sessions/<developer>/<date>/session-<N>.md`. Include:
-
-### Required Sections
-- **Session Goal** — What we set out to do
-- **Accomplished** — Specific items completed (not vague — include file paths, counts)
-- **Files Created/Modified** — Every file with description
-- **Key Decisions** — What we decided, why, alternatives considered
-- **Implementation Details** — How things work, patterns used
-- **Testing Status** — Tests added, coverage, passing status
-- **Next Session** — Clear, actionable steps for next session
-- **Context for AI** — Detailed context for the next session's agent
-- **Blockers / Considerations** — Issues, tech debt, dependencies
-
-## Skill Evolution
-
-After creating the checkpoint, review this session for learnings:
-
-1. **Gotchas** — Append to `.claude/skills/learned/references/gotchas.md`
-   Format: `## YYYY-MM-DD - Category / Title` + description + resolution
-
-2. **Conventions** — Append to `.claude/skills/learned/references/conventions.md`
-   Format: `## Category - Convention Name` + description + rationale
-
-3. **Deny recommendations** — If a dangerous command was nearly executed, append to `.claude/skills/learned/references/deny-recommendations.md`
-
-4. **New skills** — If a distinct new domain emerged, create `.claude/skills/<name>/SKILL.md`
-
-**NEVER include secret values, tokens, or credentials in checkpoints or skill files.**

package/templates/.claude/commands/session-start.md

@@ -1,30 +0,0 @@
----
-description: Start an AI-assisted development session
----
-
-Starting a new development session.
-
-## Session Info
-
-Determine the developer name from `git config user.name` and today's date. Check `.ai/sessions/` for previous checkpoints from this developer.
-
-## Before Planning
-
-Check Claude Code skills for relevant context:
-- Read `.claude/skills/codebase/SKILL.md` if it exists (run `/explore-codebase` if missing)
-- Read `.claude/skills/learned/references/gotchas.md` for known project gotchas
-- Read `.claude/skills/learned/references/conventions.md` for team conventions
-
-## Plan This Session
-
-Before coding, let's plan:
-
-1. What files will we need to create/modify?
-2. What are the key components/functions?
-3. What dependencies or external services do we need?
-4. What tests should we write?
-5. Can we complete this in one session?
-6. Does this align with our architecture?
-7. Are there relevant gotchas or conventions in `.claude/skills/` to be aware of?
-
-Once we have a solid plan, I'll proceed step by step — explaining WHAT, WHY, and HOW before each change.

package/templates/.claude/commands/setup-hooks.md

@@ -1,18 +0,0 @@
----
-description: Configure git hooks (quality, test, vulnerability) — consistent with DXKit reports
----
-
-Delegate to the **hooks-configurator** agent. It will:
-
-1. Ask which checks to enable (quality, test, vulnerability)
-2. Read your existing `/quality`, `/test`, and `/vulnerabilities` commands to ensure hooks run the **exact same tools** as your reports
-3. Generate scoped hooks (staged files for commit, changed files for push, full suite for PR)
-4. Optionally enable stealth mode (gitignore DXKit files, keep hooks committed)
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/setup-pr-review.md

@@ -1,72 +0,0 @@
----
-description: Set up automated PR review with Claude Code
----
-
-Set up a GitHub Action that automatically reviews pull requests using Claude Code.
-
-## What to Create
-
-Create `.github/workflows/pr-review.yml` with this content:
-
-```yaml
-name: PR Review
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  review:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install Claude Code
-        run: npm install -g @anthropic-ai/claude-code
-
-      - name: Review PR
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-        run: |
-          # Get the diff
-          git diff origin/${{ github.base_ref }}...HEAD > /tmp/pr-diff.txt
-
-          # Run Claude Code in non-interactive mode
-          claude -p "Review this pull request diff for bugs, security issues, and code quality problems. Focus on:
-          1. Logic errors and edge cases
-          2. Security vulnerabilities (hardcoded secrets, injection, auth gaps)
-          3. Error handling gaps
-          4. Breaking changes
-
-          Be specific: reference file:line numbers. Rate each issue as critical/warning/suggestion.
-          Only flag real issues — not style (linters handle that).
-
-          The diff:
-          $(cat /tmp/pr-diff.txt)" > /tmp/review.md
-
-      - name: Post Review Comment
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const fs = require('fs');
-            const review = fs.readFileSync('/tmp/review.md', 'utf8');
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: `## 🤖 Claude Code Review\n\n${review}\n\n---\n*Automated review by Claude Code*`
-            });
-```
-
-## After Creating
-
-Tell the user:
-1. Add `ANTHROPIC_API_KEY` to the repo's GitHub Secrets (Settings → Secrets → Actions)
-2. The workflow will run automatically on every PR
-3. Reviews appear as PR comments

package/templates/.claude/commands/stealth-mode.md

@@ -1,17 +0,0 @@
----
-description: Configure DXKit as local-only (gitignore all generated files) + install git hooks
----
-
-Delegate to the **hooks-configurator** agent with stealth mode enabled.
-
-This will:
-1. Add all DXKit files to `.gitignore` (`.claude/`, `.ai/`, `.dxkit/`, `CLAUDE.md`, `.vyuh-dxkit.json`)
-2. Ask which hooks to enable (quality, test, vulnerability)
-3. Generate `.githooks/` directory (committed — all devs get the hooks)
-4. Install hooks with `git config core.hooksPath .githooks`
-
-Result: DXKit AI features are local-only, but quality/test/security hooks run for everyone.
-
-**Enable stealth mode: yes**
-
-$ARGUMENTS

package/templates/.claude/commands/test-gaps.md

@@ -1,49 +0,0 @@
----
-description: Find critical code paths that lack test coverage
----
-
-## Step 1: Check for Existing Report
-
-```bash
-ls .dxkit/reports/test-gaps-*.md 2>/dev/null | tail -1
-```
-
-**If a report exists**: Read it. The file counts, coverage %, and risk tiers are deterministic. Skip to Step 3.
-
-**If no report exists**: Proceed to Step 2.
-
-## Step 2: Generate Deterministic Report
-
-```bash
-npx vyuh-dxkit test-gaps . --json 2>/dev/null
-```
-
-**If the command succeeds**: Read the saved report. Proceed to Step 3.
-
-**If the command fails**: Analyze manually — find test files, check if they have active assertions or are commented out, map source files to test files, identify critical untested code (auth, crypto, payments). Note: "Coverage is AI-estimated. Install `@vyuhlabs/dxkit` for deterministic gap analysis."
-
-## Step 3: Enrich with Narrative
-
-Using the gap analysis, add for each priority tier (CRITICAL/HIGH/MEDIUM/LOW):
-
-- **Why this file is critical** — what breaks if this code has a bug (data loss, auth bypass, etc.)
-- **What to test** — specific test scenarios and assertions
-- **Effort estimate** — rough developer-days per file
-- **Dependencies** — what test infrastructure is needed first (fixtures, mocks, test DB)
-
-Add a **Test Infrastructure Setup** section if tests are at 0%:
-- Which test framework to use
-- How to configure coverage reporting
-- First 5 test files to write (highest impact)
-
-**Do not change coverage %, file counts, or risk classifications from the deterministic report.**
-
-Save to `.dxkit/reports/test-gaps-YYYY-MM-DD.md`.
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/test.md.template

@@ -1,40 +0,0 @@
----
-description: Run tests with coverage reporting
----
-
-Run tests with coverage. Enforce minimum coverage threshold.
-
-{{#IF_NODE}}
-## Node / TypeScript ({{TEST_FRAMEWORK}})
-Run: `{{TEST_COMMAND}}`
-{{#ELSE}}
-{{#IF_PYTHON}}
-## Python
-Run: `pytest --cov --cov-report=term-missing --cov-fail-under={{COVERAGE_THRESHOLD}}`
-{{/IF_PYTHON}}
-{{#IF_GO}}
-## Go
-Run: `go test -coverprofile=coverage.out -covermode=atomic ./...`
-Then: `go tool cover -func=coverage.out`
-Check that total coverage is at least **{{COVERAGE_THRESHOLD}}%**.
-{{/IF_GO}}
-{{#IF_CSHARP}}
-## C#
-Run: `dotnet test --collect:"XPlat Code Coverage"`
-{{/IF_CSHARP}}
-{{#IF_RUST}}
-## Rust
-Run: `cargo test`
-{{/IF_RUST}}
-{{/IF_NODE}}
-
-**Coverage threshold: {{COVERAGE_THRESHOLD}}%**
-
-## Report
-
-Summarize:
-- Total tests: passed / failed / skipped
-- Coverage: X% (threshold: {{COVERAGE_THRESHOLD}}%)
-- Uncovered critical files (if any)
-
-If coverage is below threshold, list the files with lowest coverage that should be prioritized.

package/templates/.claude/commands/vulnerabilities.md

@@ -1,49 +0,0 @@
----
-description: Scan dependencies and code for security vulnerabilities
----
-
-## Step 1: Check for Existing Report
-
-```bash
-ls .dxkit/reports/vulnerability-scan-*.md 2>/dev/null | tail -1
-```
-
-**If a report exists**: Read it. The findings and severity counts are deterministic — do not change them. Skip to Step 3.
-
-**If no report exists**: Proceed to Step 2.
-
-## Step 2: Generate Deterministic Report
-
-```bash
-npx vyuh-dxkit vulnerabilities . --json 2>/dev/null
-```
-
-**If the command succeeds**: Read the saved report from `.dxkit/reports/vulnerability-scan-YYYY-MM-DD.md`. Proceed to Step 3.
-
-**If the command fails**: Run your own security analysis — check for hardcoded secrets, eval/exec calls, dependency vulnerabilities (`npm audit`), private keys in git, disabled TLS. Note: "Findings are AI-estimated. Install `@vyuhlabs/dxkit` for deterministic scanning with gitleaks + semgrep."
-
-## Step 3: Enrich with Narrative
-
-Using the findings, add for each vulnerability:
-
-- **Risk explanation** — what an attacker could do with this
-- **Exploitation context** — is it remotely exploitable? requires repo access?
-- **Remediation steps** — specific code changes, commands, or migrations needed
-- **Priority rationale** — why fix this before others
-
-Add a **Remediation Plan** section:
-- Immediate (today) — rotate compromised credentials, remove private keys from git
-- This week — fix critical code vulnerabilities (eval, exec, TLS)
-- This sprint — address high/medium dependency CVEs
-
-**Do not change severity counts or finding details from the deterministic report.**
-
-Save to `.dxkit/reports/vulnerability-scan-YYYY-MM-DD.md`.
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/skills/build/SKILL.md.template

@@ -1,98 +0,0 @@
----
-name: build
-description: Build code, compile binaries, install dependencies, clean artifacts. Use when asked to build, compile, install, or clean the project.
----
-
-# Build
-
-## Commands
-- `make build` - Build all services
-- `make clean` - Remove build artifacts (bin/, pyc, coverage, tmp/)
-- `make dev` - Start all services (docker-compose up)
-- `make stop` - Stop all services (docker-compose down)
-
-{{#IF_PYTHON}}
-## Python Build
-
-Python services use editable installs:
-```bash
-pip install -e services/python/<service-name>/
-```
-
-Build checks:
-- Syntax: `python3 -m py_compile <file>`
-- Types: `mypy src/`
-- Package: `python3 -m build` (if pyproject.toml has build-system)
-{{/IF_PYTHON}}
-
-{{#IF_GO}}
-## Go Build
-
-Go services compile to `bin/`:
-```bash
-go build -o bin/<service-name> ./services/go/<service-name>/
-```
-
-Build flags:
-- `CGO_ENABLED=0` for static binaries (container-friendly)
-- `-ldflags="-s -w"` to strip debug info (smaller binary)
-- `GOOS=linux GOARCH=amd64` for cross-compilation
-{{/IF_GO}}
-
-{{#IF_NODE}}
-## Node.js Build
-
-```bash
-npm install          # install dependencies
-npm run build        # compile TypeScript / bundle
-```
-{{/IF_NODE}}
-
-{{#IF_NEXTJS}}
-## Next.js Build
-
-```bash
-cd frontend
-npm install
-npm run build        # production build (checks for errors)
-npm run dev          # development server
-```
-
-The build step catches TypeScript errors and missing imports — run it before deploying.
-{{/IF_NEXTJS}}
-
-{{#IF_RUST}}
-## Rust Build
-
-```bash
-cargo build              # debug build
-cargo build --release    # optimized build
-```
-{{/IF_RUST}}
-
-{{#IF_CSHARP}}
-## C# Build
-
-```bash
-dotnet restore                       # restore NuGet packages
-dotnet build                         # debug build
-dotnet build --configuration Release # release build
-dotnet publish -c Release -o out/    # publish for deployment
-```
-{{/IF_CSHARP}}
-
-{{#IF_DOCKER}}
-## Docker Build
-
-```bash
-docker-compose build              # build all services
-docker-compose build <service>    # build specific service
-docker-compose up --build         # rebuild and start
-```
-{{/IF_DOCKER}}
-
-## Security
-
-- **Never include secrets in build args or Dockerfiles**
-- Use multi-stage builds to avoid leaking build-time dependencies
-- Don't copy `.env` files into Docker images