@vyuhlabs/dxkit 2.5.0 → 2.5.1

package/templates/.claude/agents-available/vulnerability-scanner.md

@@ -1,173 +0,0 @@
----
-name: vulnerability-scanner
-description: Comprehensive security vulnerability scanner — dependencies (with CWE classification), code patterns, file uploads, decompression bombs, recursion depth, native modules, resource limits. Use when asked about vulnerabilities, "is this secure?", "audit dependencies", or "security scan". Saves report to .dxkit/reports/.
-model: sonnet
-tools: Read, Grep, Glob, Bash, Write
----
-
-You are a security vulnerability analyst. Your job is to comprehensively scan dependencies and code for security issues, classify findings by CWE, and produce an actionable report.
-
-## Phase 1: Dependency Vulnerabilities with CWE Classification
-
-### Node.js
-Run `npm audit --json 2>/dev/null` and parse the full output:
-1. Extract severity counts (critical/high/medium/low)
-2. **Extract CWE fields** from each advisory's `via` entries (skip string entries — those are transitive refs)
-3. Group findings by CWE category using this mapping:
-
-| CWE | Name |
-|-----|------|
-| CWE-22 | Directory Traversal |
-| CWE-78 | Command Injection |
-| CWE-94 | Arbitrary Code Injection |
-| CWE-120 | Buffer Overflow |
-| CWE-248 | Uncaught Exception |
-| CWE-352 | Cross-Site Request Forgery |
-| CWE-400 | Uncontrolled Resource Consumption |
-| CWE-407 | Inefficient Algorithmic Complexity |
-| CWE-409 | Decompression Bomb |
-| CWE-434 | Arbitrary File Upload |
-| CWE-674 | Uncontrolled Recursion |
-| CWE-770 | Allocation Without Limits |
-| CWE-772 | Missing Resource Release |
-| CWE-835 | Infinite Loop |
-| CWE-918 | Server-Side Request Forgery |
-| CWE-1321 | Prototype Pollution |
-| CWE-1333 | ReDoS |
-
-Also run `npm outdated --json 2>/dev/null` for outdated packages.
-
-### Python
-- Run `pip audit 2>/dev/null` or `safety check 2>/dev/null` if available
-- Check for pinned vs unpinned versions in `requirements.txt` / `pyproject.toml`
-
-### Go / Rust / C#
-- Run `govulncheck ./... 2>/dev/null`, `cargo audit 2>/dev/null`, `dotnet list package --vulnerable 2>/dev/null`
-
-## Phase 2: Code-Level Vulnerability Scan
-
-### Injection (CWE-78, CWE-89, CWE-79)
-- **Command injection**: `exec(`, `child_process`, `os.system(`, `subprocess.call(` — flag if input could be user-controlled
-- **SQL injection**: string concatenation in queries, template literals with user input
-- **XSS**: `dangerouslySetInnerHTML`, `v-html`, unescaped output in templates
-
-### Authentication & Secrets (CWE-798, CWE-327)
-- Hardcoded secrets: `password\s*=\s*['"]`, `apiKey`, `secret\s*=`, `token\s*=\s*['"]`
-- Weak crypto: `md5`, `sha1` for passwords, `Math.random` for tokens
-- JWT issues: `algorithm.*none`, missing expiry, hardcoded signing keys
-
-### Decompression Bomb (CWE-409)
-- `zlib.createGunzip()`, `createInflate()`, `createUnzip()` — flag if no `maxOutputLength`
-- `tar.extract()`, `tar.x()` — flag if no `maxReadSize` or size filter
-- `require('decompress')`, `require('unzipper')`, `require('adm-zip')` — flag on user-uploaded files
-- `express.json()`, `bodyParser.json()` — flag if no `limit` option
-
-### Uncontrolled Recursion (CWE-674)
-- `JSON.parse(` on user input without depth validation
-- XML parsers (`fast-xml-parser`, `xml2js`, `@xmldom/xmldom`) — flag if no `maxDepth`
-- `yaml.load()` instead of `yaml.safeLoad()`, no schema restriction
-- Custom recursive functions processing user data without depth guards
-
-### Arbitrary File Upload (CWE-434)
-- `multer` — flag if no `fileFilter`, no `limits.fileSize`, storage in web-accessible dir
-- `formidable` — flag if no `maxFileSize`, no type validation
-- `busboy` — flag if no `limits` option
-- `fs.writeFile`/`createWriteStream` with user-controlled path — flag if no extension/MIME validation
-
-### Resource Allocation Without Limits (CWE-770)
-- No rate limiting middleware (`express-rate-limit`, `RateLimiter`)
-- `express.json()`/`bodyParser` without `limit` option
-- WebSocket without `maxPayload`: `socket.on('message'`, `ws.on('message'`
-- Database queries without `.limit()` or pagination on user-facing endpoints
-
-### Data Exposure
-- Sensitive data in logs: `console.log.*password`, `print.*secret`
-- Debug mode: `DEBUG=true`, `debug: true` in production config
-- Exposed stack traces in error handlers
-- CORS wildcard: `Access-Control-Allow-Origin: *`
-
-## Phase 3: Native Module Audit (CWE-120)
-
-Run these checks:
-```bash
-find node_modules -name "*.node" -type f 2>/dev/null | head -20
-find node_modules -name "binding.gyp" -maxdepth 3 2>/dev/null | head -20
-```
-
-Known native packages with historical buffer overflow CVEs:
-- `sharp` (libvips), `bcrypt` (OpenSSL), `node-canvas` (cairo), `sqlite3`, `grpc`, `bufferutil`
-
-Flag native modules not covered by npm audit for manual review.
-
-## Phase 4: Dependency Chain Risk
-
-- Count total dependencies (direct + transitive)
-- Identify largest dependency trees (supply chain risk)
-- Check for abandoned packages (>2yr no update)
-- Count native modules in tree
-
-## Phase 5: Generate Report
-
-Save to `.dxkit/reports/vulnerability-scan-YYYY-MM-DD.md`:
-
-```markdown
-## Vulnerability Scan Report
-
-### Summary
-| Severity | Dependency Issues | Code Issues | Total |
-|----------|------------------|-------------|-------|
-| Critical | X | X | X |
-| High | X | X | X |
-| Medium | X | X | X |
-| Low | X | X | X |
-
-### Findings by CWE Category
-| CWE | Category | Dep. Issues | Code Issues | Severity |
-|-----|----------|-------------|-------------|----------|
-| CWE-78 | Command Injection | 0 | 2 | Critical |
-| CWE-770 | Allocation Without Limits | 4 | 1 | High |
-| CWE-835 | Infinite Loop | 2 | 0 | High |
-| CWE-409 | Decompression Bomb | 0 | 1 | High |
-| CWE-674 | Uncontrolled Recursion | 1 | 0 | Medium |
-| CWE-434 | Arbitrary File Upload | 0 | 1 | Medium |
-
-### Dependency Vulnerabilities
-| Package | Severity | CWE | Description | Fix |
-|---------|----------|-----|-------------|-----|
-| tar@6.1.11 | High | CWE-409 | Decompression bomb | Upgrade to 6.2.0 |
-
-### Code Vulnerabilities
-| File:Line | Severity | CWE | Type | Description |
-|-----------|----------|-----|------|-------------|
-| src/auth.ts:42 | Critical | CWE-798 | Hardcoded secret | JWT key in source |
-| src/upload.ts:10 | High | CWE-434 | File upload | multer without fileFilter |
-
-### Native Modules
-| Package | Type | Has Advisories | Notes |
-|---------|------|----------------|-------|
-| sharp@0.32.1 | binding.gyp | Yes (2 high) | Image processing |
-| bcrypt@5.1.0 | binding.gyp | No | Manual review recommended |
-
-### Dependency Health
-- Total dependencies: X (direct: Y, transitive: Z)
-- Native modules: X
-- Outdated: X packages
-- Abandoned (>2yr no update): X packages
-
-### Recommendations (prioritized)
-1. [Critical fix with exact steps]
-2. ...
-
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit) vulnerability-scanner agent*
-```
-
-## Rules
-
-- **Run real tools** — don't guess, run `npm audit --json`, `pip audit`, etc.
-- **Classify by CWE** — every finding should have a CWE number
-- **Be specific** — exact package versions, file:line references, CVE/GHSA numbers
-- **Prioritize by exploitability** — a reachable RCE is worse than a theoretical DoS
-- **Include fix instructions** — "upgrade X to Y" or "replace pattern A with B"
-- **Never output actual secret values** — say "hardcoded secret found at file:line", don't print it
-- Save the report to `.dxkit/reports/vulnerability-scan-YYYY-MM-DD.md`

package/templates/.claude/commands/ask.md

@@ -1,7 +0,0 @@
----
-description: Ask a question about the codebase (e.g., "How does auth work?", "Where are payments handled?")
----
-
-Delegate this question to the **knowledge-bot** agent. It will search the code, read relevant files, trace execution paths, and return a specific answer with file references.
-
-Question: $ARGUMENTS

package/templates/.claude/commands/build-feature.md

@@ -1,26 +0,0 @@
----
-description: Build a feature from a feature-planner plan
-argument-hint: "[feature-slug or empty to list]"
----
-
-Delegate to the **feature-builder** agent. It executes a feature plan from `.ai/features/` task by task with:
-- Tests written alongside (or before) implementation
-- Conventions matched to existing codebase patterns
-- Session checkpoints after each task
-- Progress tracking in `.ai/features/progress/`
-- Skill evolution (conventions and gotchas captured)
-
-Examples:
-- `/build-feature` — List available feature plans
-- `/build-feature user-roles` — Start building from `.ai/features/user-roles.md`
-- `/build-feature webhook-notifications` — Resume in-progress feature
-
-The builder follows the plan, runs the same quality/test tools as your reports, and checkpoints at natural boundaries.
-
-**IMPORTANT: End with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/build.md.template

@@ -1,30 +0,0 @@
----
-description: Build the project
----
-
-Build the project. Run these commands:
-
-{{#IF_NODE}}
-## Node / TypeScript
-1. `npm install` — Install dependencies (if node_modules is missing)
-2. `npm run build` — Build/compile
-{{/IF_NODE}}
-{{#IF_PYTHON}}
-## Python
-1. `pip install -e .` — Install in development mode (if not already)
-{{/IF_PYTHON}}
-{{#IF_GO}}
-## Go
-1. `go build ./...` — Build all packages
-{{/IF_GO}}
-{{#IF_CSHARP}}
-## C#
-1. `dotnet restore` — Restore dependencies
-2. `dotnet build` — Build
-{{/IF_CSHARP}}
-{{#IF_RUST}}
-## Rust
-1. `cargo build` — Build
-{{/IF_RUST}}
-
-Report build results. If there are errors, diagnose and suggest fixes.

package/templates/.claude/commands/check.md.template

@@ -1,43 +0,0 @@
----
-description: Full pre-commit validation (quality + tests + coverage)
----
-
-Run full pre-commit validation. All steps must pass before committing.
-
-## Step 1: Linters
-
-{{#IF_NODE}}
-- `npx eslint .`
-- `npx tsc --noEmit`
-{{/IF_NODE}}
-{{#IF_PYTHON}}
-- `ruff check .`
-- `ruff format --check .`
-- `mypy .`
-{{/IF_PYTHON}}
-{{#IF_GO}}
-- `golangci-lint run ./...`
-- `go vet ./...`
-{{/IF_GO}}
-{{#IF_CSHARP}}
-- `dotnet format --verify-no-changes`
-- `dotnet build --no-restore -warnaserror`
-{{/IF_CSHARP}}
-{{#IF_RUST}}
-- `cargo fmt --check`
-- `cargo clippy -- -D warnings`
-{{/IF_RUST}}
-
-## Step 2: Tests
-
-Run: `{{TEST_COMMAND}}`
-
-Coverage threshold: **{{COVERAGE_THRESHOLD}}%**
-
-## Step 3: AI Review
-
-Delegate to the **quality-reviewer** agent to review changed files for issues linters miss.
-
-## Verdict
-
-Report: **PASS** (safe to commit) or **FAIL** (list what needs fixing).

package/templates/.claude/commands/dashboard.md

@@ -1,28 +0,0 @@
----
-description: Generate a self-contained HTML dashboard from all dxkit reports
----
-
-Run the deterministic CLI to render `.dxkit/reports/*` into
-`.dxkit/reports/dashboard.html`. No LLM templating — the HTML is a
-pure function of the report markdowns and their JSON envelopes.
-
-```bash
-npx vyuh-dxkit dashboard . 2>/dev/null
-```
-
-The dashboard features:
-- Dark theme with modern design
-- Sidebar navigation grouped by report type with color-coded badges
-- Overview tab synthesizing health score, dimension breakdown, key
-  metrics, and the top critical issues
-- Full markdown rendering with styled tables, code blocks, headings
-- Responsive layout (works on mobile)
-- Print-friendly styles
-
-If `vyuh-dxkit dashboard` isn't available (older dxkit version), fall
-back to the `dashboard-builder` agent. The agent is also the right
-tool when the user asks for natural-language narrative on top of the
-dashboard (e.g., "explain the highest-priority items" or "summarize
-this for an exec").
-
-$ARGUMENTS

package/templates/.claude/commands/deps.md

@@ -1,15 +0,0 @@
----
-description: Map dependencies — "what depends on X?" or "what breaks if I change Y?"
----
-
-Delegate to the **dependency-mapper** agent. It will trace import chains and show what depends on what.
-
-**Save the report to `.dxkit/reports/dependency-map-YYYY-MM-DD.md`** (use today's date).
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/dev-report.md

@@ -1,50 +0,0 @@
----
-description: Generate developer activity and code quality report from git history
----
-
-## Step 1: Check for Existing Report
-
-```bash
-ls .dxkit/reports/developer-report-*.md 2>/dev/null | tail -1
-```
-
-**If a report exists**: Read it. The commit counts, contributor stats, and velocity data are deterministic. Skip to Step 3.
-
-**If no report exists**: Proceed to Step 2.
-
-## Step 2: Generate Deterministic Report
-
-```bash
-npx vyuh-dxkit dev-report . --json 2>/dev/null
-```
-
-**If the command succeeds**: Read the saved report. Proceed to Step 3.
-
-**If the command fails**: Analyze git history manually using `git log`, `git shortlog -sn`, `git log --numstat`. Note: "Stats are AI-estimated. Install `@vyuhlabs/dxkit` for deterministic developer reports."
-
-## Step 3: Enrich with Narrative
-
-Using the git data, add:
-
-- **Team dynamics** — who are the key contributors, bus factor risk, merge/review patterns
-- **Code ownership** — who owns which areas, based on commit frequency per directory
-- **Hot file analysis** — why the most-changed files change so often (feature churn? bug magnet? poor abstraction?)
-- **Commit quality insights** — if conventional commit % is low, explain the benefits (changelogs, bisecting, CI automation)
-- **Velocity interpretation** — is the trend healthy? are there spikes/drops that correlate with releases or incidents?
-- **Identity consolidation** — flag likely duplicates (same person, different git configs)
-
-**Do not change commit counts, contributor stats, or velocity numbers from the deterministic report.**
-
-Save to `.dxkit/reports/developer-report-YYYY-MM-DD.md`.
-
-Examples:
-- `/dev-report` — Team overview (last 3 months)
-- `/dev-report --since 2025-01-01` — Custom time range
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/docs.md

@@ -1,21 +0,0 @@
----
-description: Audit documentation gaps or write/improve docs
----
-
-Delegate to the **doc-writer** agent. It can audit documentation quality, identify gaps, and help write or improve docs.
-
-When auditing, **save the report to `.dxkit/reports/docs-audit-YYYY-MM-DD.md`** (use today's date).
-
-Examples:
-- `/docs audit` — Assess documentation quality and list gaps
-- `/docs improve README` — Improve the README
-- `/docs add api` — Generate API documentation
-- `/docs add jsdoc src/services/` — Add JSDoc to service files
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/doctor.md

@@ -1,29 +0,0 @@
----
-description: Diagnose development environment issues
----
-
-Diagnose this development environment.
-
-## Step 1: dxkit doctor
-
-Run dxkit's own health check first — it covers tool availability (gitleaks, semgrep, cloc, etc.), `.claude/` install state, and hook configuration:
-
-```bash
-npx vyuh-dxkit doctor 2>/dev/null
-```
-
-If the command isn't available, fall back to Step 2.
-
-## Step 2: Environment checks
-
-1. **Git**: `git --version` and `git status`
-2. **Node** (if `package.json`): `node --version` / `npm --version`; is `node_modules/` populated?
-3. **Python** (if `pyproject.toml`): `python3 --version`; virtual env activated? deps installed?
-4. **Go** (if `go.mod`): `go version`; modules downloaded?
-5. **.NET** (if `*.csproj`): `dotnet --version`
-6. **Rust** (if `Cargo.toml`): `rustc --version` / `cargo --version`
-7. **Docker** (if `docker-compose.yml`): `docker --version`; daemon running?
-8. **Hooks active**: `git config core.hooksPath` should report `.githooks` if dxkit hooks are installed
-9. **dxkit install**: `.claude/`, `CLAUDE.md`, `.vyuh-dxkit.json` present?
-
-Report any issues found and provide remediation steps.

package/templates/.claude/commands/enable-agent.md

@@ -1,12 +0,0 @@
----
-description: Activate an available agent (or list all available agents)
-argument-hint: "[agent-name or 'list']"
----
-
-List the contents of `.claude/agents-available/` to show available agents and `.claude/agents/` to show active agents.
-
-If the user provided an agent name, copy it from `agents-available/` to `agents/` to activate it:
-- Argument: `$ARGUMENTS`
-- If "list" or empty, just list both directories.
-- If a valid agent name, run: `cp .claude/agents-available/$ARGUMENTS.md .claude/agents/$ARGUMENTS.md`
-- Then confirm activation and briefly describe what the agent does (read the agent file for its description).

package/templates/.claude/commands/execute-plan.md

@@ -1,25 +0,0 @@
----
-description: Execute an improvement plan task by task with session management
-argument-hint: "[plan-name or empty to list plans]"
----
-
-Delegate to the **plan-executor** agent. It works through a plan from `.ai/plans/`, executing tasks one at a time with:
-- Session checkpoints after each task
-- Progress tracking in `.ai/plans/progress/`
-- KPI measurement before and after
-- Skill evolution (gotchas, conventions captured)
-
-Examples:
-- `/execute-plan` — List available plans
-- `/execute-plan test-coverage` — Start working on test coverage plan
-- `/execute-plan security` — Start working on security fixes
-
-The executor follows the plan exactly, runs the same quality/test tools as your reports, and checkpoints at natural boundaries.
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/explore-codebase.md

@@ -1,12 +0,0 @@
----
-description: Deep-explore the codebase and generate architecture documentation
----
-
-Delegate this to the **codebase-explorer** agent. It will deeply analyze the codebase and generate:
-
-1. `.claude/skills/codebase/SKILL.md` — Concise architecture and navigation guide
-2. `.claude/skills/codebase/references/architecture.md` — Detailed reference
-
-Focus on non-obvious things — gotchas, conventions, and architectural decisions that aren't apparent from file names alone.
-
-**NEVER include secret values, tokens, or credentials in the output.**

package/templates/.claude/commands/export-pdf.md

@@ -1,30 +0,0 @@
----
-description: Convert a markdown report to PDF
-argument-hint: "[file-path or 'all' for all reports]"
----
-
-Convert markdown report(s) to PDF.
-
-## Arguments
-- `$ARGUMENTS`
-- If empty or "all", convert all reports in `.dxkit/reports/`
-- If a file path, convert that specific file
-
-## How to Convert
-
-Try these tools in order (use whichever is available):
-
-1. **md-to-pdf** (Node.js): `npx md-to-pdf <file.md>` — creates `<file.pdf>` alongside it
-2. **pandoc**: `pandoc <file.md> -o <file.pdf> --pdf-engine=wkhtmltopdf`
-3. **If neither is available**, install md-to-pdf: `npx md-to-pdf <file.md>`
-
-## For "all" reports
-```
-for f in .dxkit/reports/*.md; do
-  npx md-to-pdf "$f"
-done
-```
-
-## Output
-- PDFs are saved alongside the markdown files in `.dxkit/reports/`
-- Report which files were converted and their paths

package/templates/.claude/commands/feature.md

@@ -1,25 +0,0 @@
----
-description: Design and plan a new feature with implementation breakdown
-argument-hint: "[feature description]"
----
-
-Delegate to the **feature-planner** agent. It will:
-1. Read existing codebase patterns from the codebase skill
-2. Find similar features to model after
-3. Design data, service, API, and test layers
-4. Generate a detailed plan in `.ai/features/<slug>.md`
-
-Examples:
-- `/feature add user roles and permissions`
-- `/feature webhook notifications for package events`
-- `/feature export datapack to CSV`
-
-The plan includes: acceptance criteria, API contract, files to create/modify, implementation order with estimates, conventions to follow, and verification steps.
-
-**IMPORTANT: End with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/fix-issue.md

@@ -1,12 +0,0 @@
----
-description: Investigate and fix a GitHub issue
-argument-hint: "[issue-number]"
----
-
-Investigate and fix GitHub issue #$ARGUMENTS.
-
-1. Fetch the issue: run `gh issue view $ARGUMENTS` (if `gh` is not installed, ask the user to describe it)
-2. Delegate root cause analysis to the **debugger** agent
-3. Fix the issue — make the minimal change needed
-4. Write tests for the fix
-5. Run `/quality` and `/test` before considering it done

package/templates/.claude/commands/fix.md.template

@@ -1,32 +0,0 @@
----
-description: Auto-fix all quality and formatting issues
----
-
-Auto-fix quality and formatting issues.
-
-{{#IF_NODE}}
-## Node / TypeScript
-1. `npx eslint . --fix` — Fix lint issues
-2. `npx prettier --write .` — Format
-{{/IF_NODE}}
-{{#IF_PYTHON}}
-## Python
-1. `ruff check . --fix` — Fix lint issues
-2. `ruff format .` — Format
-{{/IF_PYTHON}}
-{{#IF_GO}}
-## Go
-1. `gofmt -w .` — Format
-2. `goimports -w .` — Fix imports
-{{/IF_GO}}
-{{#IF_CSHARP}}
-## C#
-1. `dotnet format` — Format and fix
-{{/IF_CSHARP}}
-{{#IF_RUST}}
-## Rust
-1. `cargo fmt` — Format
-2. `cargo clippy --fix --allow-dirty` — Fix lint issues
-{{/IF_RUST}}
-
-Report what was fixed. If any issues remain, provide manual fix instructions.

package/templates/.claude/commands/health.md

@@ -1,58 +0,0 @@
----
-description: Run a comprehensive codebase health audit (tests, quality, docs, security, DX)
----
-
-## Step 1: Check for Existing Report
-
-Check if a deterministic report already exists:
-
-```bash
-ls .dxkit/reports/health-audit-*.md 2>/dev/null | tail -1
-```
-
-**If a report exists**: Read it. The scores and metrics are deterministic ground truth — do not change them. Skip to Step 3.
-
-**If no report exists**: Proceed to Step 2.
-
-## Step 2: Generate Deterministic Report
-
-Try the DXKit CLI first:
-
-```bash
-npx vyuh-dxkit health . --json 2>/dev/null
-```
-
-**If the command succeeds** (returns JSON with `summary.overallScore`):
-- The CLI saves a report to `.dxkit/reports/health-audit-YYYY-MM-DD.md`
-- Read that report. Proceed to Step 3.
-
-**If the command fails** (not installed or errors):
-- Run your own analysis: read source files, count tests, check for security issues, review documentation
-- Score each dimension 0-100 using your best judgment
-- Note in the report: "Scores are AI-estimated. Install `@vyuhlabs/dxkit` for deterministic reproducible scores."
-- Proceed to Step 3.
-
-## Step 3: Enrich with Narrative
-
-Using the metrics (from the existing report, CLI, or your own analysis), add to each dimension section:
-
-- **Strengths** — what's working (cite specific files and counts from the report)
-- **Weaknesses** — what needs attention (cite specific files and counts)
-- **Recommendations** — actionable fixes, ordered by urgency (Critical → High → Medium → Low)
-
-Add a **Prioritized Action Items** section at the end:
-- Immediate (week 1) — critical security and testing gaps
-- Short-term (weeks 2-4) — quality and documentation
-- Medium-term (months 2-3) — architecture and maintainability
-
-**If you have deterministic scores: keep all numbers exactly as reported. Add context and explanations only — do not re-score.**
-
-Save the enriched report to `.dxkit/reports/health-audit-YYYY-MM-DD.md`.
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS