@vyuhlabs/dxkit 2.5.0 → 2.5.1

package/templates/.claude/commands/help.md

@@ -1,36 +0,0 @@
----
-description: List all available project commands and agents
----
-
-List all available commands and agents for this project.
-
-## Available Commands
-
-!`ls .claude/commands/`
-
-## Active Agents
-
-!`ls .claude/agents/ 2>/dev/null`
-
-## Dormant Agents
-
-!`ls .claude/agents-available/ 2>/dev/null`
-
-## How Agents Work
-
-- **Active agents** (`.claude/agents/`) — Claude automatically delegates matching questions to them. No action needed.
-- **Dormant agents** (`.claude/agents-available/`) — Must be activated first: `/enable-agent <name>`
-- Agents run in an **isolated context** with restricted tools (typically read-only).
-- Deactivate an agent by removing it from `.claude/agents/`.
-
-## Quick Start
-
-- **Start a session**: `/session-start`
-- **Ask about the codebase**: `/ask How does X work?` (or just ask naturally — knowledge-bot auto-triggers)
-- **Run quality checks**: `/quality`
-- **Explore architecture**: `/explore-codebase`
-- **Generate onboarding guide**: `/onboarding`
-- **Enable an agent**: `/enable-agent <name>`
-- **End session**: `/session-end`
-
-For each command and agent file listed above, read its `.md` file to get the description from frontmatter, then present everything in a clean, readable format. Strip the `.md` extension when displaying command names.

package/templates/.claude/commands/learn.md

@@ -1,48 +0,0 @@
----
-description: Capture a learning from this conversation (gotcha, convention, or thing to avoid)
----
-
-Review this conversation and capture any learnings. If the user provided specific input, use that:
-
-$ARGUMENTS
-
-## What to Capture
-
-Look for:
-1. **Gotchas** — something surprising, broke unexpectedly, or took time to debug
-2. **Conventions** — a pattern or approach that worked well and should be repeated
-3. **Deny recommendations** — a dangerous command that should be avoided
-
-## Where to Write
-
-First read the existing files to avoid duplicates. Then append (never overwrite) to the appropriate file:
-
-- **Gotchas** → `.claude/skills/learned/references/gotchas.md`
-  ```
-  ## YYYY-MM-DD - Category / Title
-  **Problem:** What went wrong
-  **Resolution:** How it was fixed
-  **Prevention:** How to avoid it next time
-  ```
-
-- **Conventions** → `.claude/skills/learned/references/conventions.md`
-  ```
-  ## Category - Convention Name
-  **Pattern:** What to do
-  **Rationale:** Why this works
-  ```
-
-- **Deny recommendations** → `.claude/skills/learned/references/deny-recommendations.md`
-  ```
-  ## Command / Pattern to Avoid
-  **Risk:** What could go wrong
-  **Alternative:** Safer approach
-  ```
-
-## Rules
-
-- Only capture things that are **non-obvious** and useful for future sessions
-- Don't repeat what's already in the files
-- Be concise — future sessions will read these
-- **NEVER include secrets, tokens, or credentials**
-- Tell the user what you captured and where

package/templates/.claude/commands/onboarding.md

@@ -1,21 +0,0 @@
----
-description: Start interactive onboarding for a new developer
----
-
-The **onboarding** agent is active and will help you get started with this project.
-
-It can:
-- Give you a project overview and architecture walkthrough
-- Walk you through local setup step by step
-- Explain how any part of the codebase works
-- Point out gotchas and conventions before you hit them
-- Suggest what to read first based on what area you'll work on
-
-Just start asking questions — for example:
-- "What does this project do?"
-- "How do I set up my local environment?"
-- "Where are the API endpoints defined?"
-- "What should I read first?"
-- "How does authentication work?"
-
-$ARGUMENTS

package/templates/.claude/commands/plan.md

@@ -1,20 +0,0 @@
----
-description: Generate improvement plans with KPIs from reports (or list existing plans)
----
-
-Delegate to the **strategic-planner** agent. It reads all reports in `.dxkit/reports/`, proposes measurable KPIs, and generates actionable plans in `.ai/plans/`.
-
-If reports don't exist yet, it will tell you which commands to run first (`/health`, `/vulnerabilities`, `/test-gaps`, etc.).
-
-Examples:
-- `/plan` — Analyze all reports and generate full improvement roadmap
-- `/plan security` — Generate a security-focused plan only
-- `/plan test-coverage` — Generate a test coverage plan only
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/quality.md.template

@@ -1,65 +0,0 @@
----
-description: Run code quality analysis with slop detection
----
-
-## Step 1: Check for Existing Report
-
-```bash
-ls .dxkit/reports/quality-review-*.md 2>/dev/null | tail -1
-```
-
-**If a report exists**: Read it. The slop score, duplication %, and metrics are deterministic. Skip to Step 3.
-
-**If no report exists**: Proceed to Step 2.
-
-## Step 2: Generate Deterministic Report
-
-```bash
-npx vyuh-dxkit quality . --json 2>/dev/null
-```
-
-**If the command succeeds**: Read the saved report. Proceed to Step 3.
-
-**If the command fails**: Run linters and checks manually:
-{{#IF_NODE}}
-1. `npx eslint . --format json` — Lint
-2. `npx tsc --noEmit` — Type check
-{{/IF_NODE}}
-{{#IF_PYTHON}}
-1. `ruff check .` — Lint
-2. `ruff format --check .` — Format check
-{{/IF_PYTHON}}
-{{#IF_GO}}
-1. `golangci-lint run ./...` — Lint
-2. `go vet ./...` — Vet
-{{/IF_GO}}
-{{#IF_CSHARP}}
-1. `dotnet format --verify-no-changes` — Format check
-{{/IF_CSHARP}}
-{{#IF_RUST}}
-1. `cargo fmt --check` — Format check
-2. `cargo clippy -- -D warnings` — Lint
-{{/IF_RUST}}
-Then analyze code for duplication, dead code, TODO/FIXME density, comment ratio. Note: "Metrics are AI-estimated. Install `@vyuhlabs/dxkit` for deterministic quality analysis with jscpd + graphify."
-
-## Step 3: Enrich with Narrative
-
-Using the quality metrics, add:
-
-- **Duplication hotspots** — which files/functions are copy-pasted, and how to extract shared code
-- **God file remediation** — how to break up files with >50 functions (suggest module boundaries)
-- **Dead code cleanup** — which orphan modules and dead imports to remove
-- **Slop indicators** — if comment ratio >40% or TODO count is high, suggest cleanup priorities
-- **Lint fix plan** — group lint errors by rule, suggest auto-fixable vs manual
-
-**Do not change the slop score, duplication %, or metric counts from the deterministic report.**
-
-Save to `.dxkit/reports/quality-review-YYYY-MM-DD.md`.
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/session-end.md

@@ -1,40 +0,0 @@
----
-description: End session and create checkpoint with skill evolution
----
-
-Ending the current development session.
-
-## Session Info
-
-Determine the developer name from `git config user.name` and today's date. Create the session directory at `.ai/sessions/<developer>/<date>/` if it doesn't exist. Find the next session number by checking existing `session-*.md` files. Also check recent git commits and uncommitted changes.
-
-## Create Checkpoint
-
-Create a comprehensive checkpoint at `.ai/sessions/<developer>/<date>/session-<N>.md`. Include:
-
-### Required Sections
-- **Session Goal** — What we set out to do
-- **Accomplished** — Specific items completed (not vague — include file paths, counts)
-- **Files Created/Modified** — Every file with description
-- **Key Decisions** — What we decided, why, alternatives considered
-- **Implementation Details** — How things work, patterns used
-- **Testing Status** — Tests added, coverage, passing status
-- **Next Session** — Clear, actionable steps for next session
-- **Context for AI** — Detailed context for the next session's agent
-- **Blockers / Considerations** — Issues, tech debt, dependencies
-
-## Skill Evolution
-
-After creating the checkpoint, review this session for learnings:
-
-1. **Gotchas** — Append to `.claude/skills/learned/references/gotchas.md`
-   Format: `## YYYY-MM-DD - Category / Title` + description + resolution
-
-2. **Conventions** — Append to `.claude/skills/learned/references/conventions.md`
-   Format: `## Category - Convention Name` + description + rationale
-
-3. **Deny recommendations** — If a dangerous command was nearly executed, append to `.claude/skills/learned/references/deny-recommendations.md`
-
-4. **New skills** — If a distinct new domain emerged, create `.claude/skills/<name>/SKILL.md`
-
-**NEVER include secret values, tokens, or credentials in checkpoints or skill files.**

package/templates/.claude/commands/session-start.md

@@ -1,30 +0,0 @@
----
-description: Start an AI-assisted development session
----
-
-Starting a new development session.
-
-## Session Info
-
-Determine the developer name from `git config user.name` and today's date. Check `.ai/sessions/` for previous checkpoints from this developer.
-
-## Before Planning
-
-Check Claude Code skills for relevant context:
-- Read `.claude/skills/codebase/SKILL.md` if it exists (run `/explore-codebase` if missing)
-- Read `.claude/skills/learned/references/gotchas.md` for known project gotchas
-- Read `.claude/skills/learned/references/conventions.md` for team conventions
-
-## Plan This Session
-
-Before coding, let's plan:
-
-1. What files will we need to create/modify?
-2. What are the key components/functions?
-3. What dependencies or external services do we need?
-4. What tests should we write?
-5. Can we complete this in one session?
-6. Does this align with our architecture?
-7. Are there relevant gotchas or conventions in `.claude/skills/` to be aware of?
-
-Once we have a solid plan, I'll proceed step by step — explaining WHAT, WHY, and HOW before each change.

package/templates/.claude/commands/setup-hooks.md

@@ -1,18 +0,0 @@
----
-description: Configure git hooks (quality, test, vulnerability) — consistent with DXKit reports
----
-
-Delegate to the **hooks-configurator** agent. It will:
-
-1. Ask which checks to enable (quality, test, vulnerability)
-2. Read your existing `/quality`, `/test`, and `/vulnerabilities` commands to ensure hooks run the **exact same tools** as your reports
-3. Generate scoped hooks (staged files for commit, changed files for push, full suite for PR)
-4. Optionally enable stealth mode (gitignore DXKit files, keep hooks committed)
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/stealth-mode.md

@@ -1,17 +0,0 @@
----
-description: Configure DXKit as local-only (gitignore all generated files) + install git hooks
----
-
-Delegate to the **hooks-configurator** agent with stealth mode enabled.
-
-This will:
-1. Add all DXKit files to `.gitignore` (`.claude/`, `.ai/`, `.dxkit/`, `CLAUDE.md`, `.vyuh-dxkit.json`)
-2. Ask which hooks to enable (quality, test, vulnerability)
-3. Generate `.githooks/` directory (committed — all devs get the hooks)
-4. Install hooks with `git config core.hooksPath .githooks`
-
-Result: DXKit AI features are local-only, but quality/test/security hooks run for everyone.
-
-**Enable stealth mode: yes**
-
-$ARGUMENTS

package/templates/.claude/commands/test-gaps.md

@@ -1,49 +0,0 @@
----
-description: Find critical code paths that lack test coverage
----
-
-## Step 1: Check for Existing Report
-
-```bash
-ls .dxkit/reports/test-gaps-*.md 2>/dev/null | tail -1
-```
-
-**If a report exists**: Read it. The file counts, coverage %, and risk tiers are deterministic. Skip to Step 3.
-
-**If no report exists**: Proceed to Step 2.
-
-## Step 2: Generate Deterministic Report
-
-```bash
-npx vyuh-dxkit test-gaps . --json 2>/dev/null
-```
-
-**If the command succeeds**: Read the saved report. Proceed to Step 3.
-
-**If the command fails**: Analyze manually — find test files, check if they have active assertions or are commented out, map source files to test files, identify critical untested code (auth, crypto, payments). Note: "Coverage is AI-estimated. Install `@vyuhlabs/dxkit` for deterministic gap analysis."
-
-## Step 3: Enrich with Narrative
-
-Using the gap analysis, add for each priority tier (CRITICAL/HIGH/MEDIUM/LOW):
-
-- **Why this file is critical** — what breaks if this code has a bug (data loss, auth bypass, etc.)
-- **What to test** — specific test scenarios and assertions
-- **Effort estimate** — rough developer-days per file
-- **Dependencies** — what test infrastructure is needed first (fixtures, mocks, test DB)
-
-Add a **Test Infrastructure Setup** section if tests are at 0%:
-- Which test framework to use
-- How to configure coverage reporting
-- First 5 test files to write (highest impact)
-
-**Do not change coverage %, file counts, or risk classifications from the deterministic report.**
-
-Save to `.dxkit/reports/test-gaps-YYYY-MM-DD.md`.
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/commands/test.md.template

@@ -1,40 +0,0 @@
----
-description: Run tests with coverage reporting
----
-
-Run tests with coverage. Enforce minimum coverage threshold.
-
-{{#IF_NODE}}
-## Node / TypeScript ({{TEST_FRAMEWORK}})
-Run: `{{TEST_COMMAND}}`
-{{#ELSE}}
-{{#IF_PYTHON}}
-## Python
-Run: `pytest --cov --cov-report=term-missing --cov-fail-under={{COVERAGE_THRESHOLD}}`
-{{/IF_PYTHON}}
-{{#IF_GO}}
-## Go
-Run: `go test -coverprofile=coverage.out -covermode=atomic ./...`
-Then: `go tool cover -func=coverage.out`
-Check that total coverage is at least **{{COVERAGE_THRESHOLD}}%**.
-{{/IF_GO}}
-{{#IF_CSHARP}}
-## C#
-Run: `dotnet test --collect:"XPlat Code Coverage"`
-{{/IF_CSHARP}}
-{{#IF_RUST}}
-## Rust
-Run: `cargo test`
-{{/IF_RUST}}
-{{/IF_NODE}}
-
-**Coverage threshold: {{COVERAGE_THRESHOLD}}%**
-
-## Report
-
-Summarize:
-- Total tests: passed / failed / skipped
-- Coverage: X% (threshold: {{COVERAGE_THRESHOLD}}%)
-- Uncovered critical files (if any)
-
-If coverage is below threshold, list the files with lowest coverage that should be prioritized.

package/templates/.claude/commands/vulnerabilities.md

@@ -1,49 +0,0 @@
----
-description: Scan dependencies and code for security vulnerabilities
----
-
-## Step 1: Check for Existing Report
-
-```bash
-ls .dxkit/reports/vulnerability-scan-*.md 2>/dev/null | tail -1
-```
-
-**If a report exists**: Read it. The findings and severity counts are deterministic — do not change them. Skip to Step 3.
-
-**If no report exists**: Proceed to Step 2.
-
-## Step 2: Generate Deterministic Report
-
-```bash
-npx vyuh-dxkit vulnerabilities . --json 2>/dev/null
-```
-
-**If the command succeeds**: Read the saved report from `.dxkit/reports/vulnerability-scan-YYYY-MM-DD.md`. Proceed to Step 3.
-
-**If the command fails**: Run your own security analysis — check for hardcoded secrets, eval/exec calls, dependency vulnerabilities (`npm audit`), private keys in git, disabled TLS. Note: "Findings are AI-estimated. Install `@vyuhlabs/dxkit` for deterministic scanning with gitleaks + semgrep."
-
-## Step 3: Enrich with Narrative
-
-Using the findings, add for each vulnerability:
-
-- **Risk explanation** — what an attacker could do with this
-- **Exploitation context** — is it remotely exploitable? requires repo access?
-- **Remediation steps** — specific code changes, commands, or migrations needed
-- **Priority rationale** — why fix this before others
-
-Add a **Remediation Plan** section:
-- Immediate (today) — rotate compromised credentials, remove private keys from git
-- This week — fix critical code vulnerabilities (eval, exec, TLS)
-- This sprint — address high/medium dependency CVEs
-
-**Do not change severity counts or finding details from the deterministic report.**
-
-Save to `.dxkit/reports/vulnerability-scan-YYYY-MM-DD.md`.
-
-**IMPORTANT: End the report with this exact footer:**
-```
----
-*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
-```
-
-$ARGUMENTS

package/templates/.claude/skills/build/SKILL.md.template

@@ -1,90 +0,0 @@
----
-name: build
-description: Build code, compile binaries, install dependencies, clean artifacts. Use when asked to build, compile, install, or clean the project.
----
-
-# Build
-
-{{#IF_PYTHON}}
-## Python
-
-Editable installs for development:
-```bash
-pip install -e <package-dir>/
-```
-
-Build checks:
-- Syntax: `python3 -m py_compile <file>`
-- Types: `mypy src/`
-- Package: `python3 -m build` (if `pyproject.toml` has `build-system`)
-{{/IF_PYTHON}}
-
-{{#IF_GO}}
-## Go
-
-```bash
-go build ./...           # build everything
-go build -o bin/<name>   # build a specific binary to bin/
-```
-
-Build flags:
-- `CGO_ENABLED=0` for static binaries (container-friendly)
-- `-ldflags="-s -w"` to strip debug info
-- `GOOS=linux GOARCH=amd64` for cross-compilation
-{{/IF_GO}}
-
-{{#IF_NODE}}
-## Node.js
-
-```bash
-npm install              # install dependencies
-npm run build            # compile TypeScript / bundle
-```
-{{/IF_NODE}}
-
-{{#IF_NEXTJS}}
-## Next.js
-
-```bash
-cd frontend
-npm install
-npm run build            # production build (catches TS + import errors)
-npm run dev              # development server
-```
-{{/IF_NEXTJS}}
-
-{{#IF_RUST}}
-## Rust
-
-```bash
-cargo build              # debug
-cargo build --release    # optimized
-```
-{{/IF_RUST}}
-
-{{#IF_CSHARP}}
-## C#
-
-```bash
-dotnet restore                       # NuGet packages
-dotnet build                         # debug
-dotnet build --configuration Release # release
-dotnet publish -c Release -o out/    # publish for deployment
-```
-{{/IF_CSHARP}}
-
-{{#IF_DOCKER}}
-## Docker
-
-```bash
-docker-compose build              # build all services
-docker-compose build <service>    # build specific service
-docker-compose up --build         # rebuild and start
-```
-{{/IF_DOCKER}}
-
-## Security
-
-- **Never include secrets in build args or Dockerfiles**
-- Use multi-stage builds to avoid leaking build-time dependencies
-- Don't copy `.env` files into Docker images

package/templates/.claude/skills/deploy/SKILL.md.template

@@ -1,111 +0,0 @@
----
-name: deploy
-description: Deploy services, release to production, push to cloud. Use when asked about deployment, releases, shipping to production, or CI/CD.
----
-
-# Deployment
-
-## Pre-deployment checklist
-
-- [ ] `/quality` and `/test` pass
-- [ ] All changes committed and pushed
-- [ ] PR reviewed and approved
-- [ ] No hardcoded secrets in code or config
-
-## Deployment safety
-
-**CRITICAL: Never auto-approve destructive deployment operations.**
-
-- Always preview/dry-run before applying changes
-- Require explicit user confirmation for production deployments
-- Never force-push or skip CI checks before deploying
-- Never pass secrets as CLI arguments — use environment variables or secret managers
-
-{{#IF_GCLOUD}}
-## Google Cloud Deployment
-
-### Cloud Run
-```bash
-# Build and push container
-gcloud builds submit --tag gcr.io/$PROJECT_ID/<service-name>
-
-# Deploy (ALWAYS review before confirming)
-gcloud run deploy <service-name> \
-  --image gcr.io/$PROJECT_ID/<service-name> \
-  --region <region> \
-  --platform managed
-```
-
-### GKE
-```bash
-# Build image
-docker build -t gcr.io/$PROJECT_ID/<service-name> .
-docker push gcr.io/$PROJECT_ID/<service-name>
-
-# Apply manifests (review first)
-kubectl apply -f k8s/ --dry-run=client  # preview
-kubectl apply -f k8s/                    # apply
-```
-
-**Security:** Use Workload Identity for GCP auth in production — never embed service account keys.
-{{/IF_GCLOUD}}
-
-{{#IF_PULUMI}}
-## Pulumi Deployment
-
-```bash
-# ALWAYS preview first
-pulumi preview
-
-# Review the diff carefully, then apply
-pulumi up
-
-# Check outputs
-pulumi stack output
-```
-
-**Security:** Use `pulumi config set --secret` for sensitive config — never plain-text.
-
-**Never run `pulumi destroy` without explicit confirmation** — it deletes all resources.
-{{/IF_PULUMI}}
-
-{{#IF_DOCKER}}
-## Docker Deployment
-
-```bash
-# Build images
-docker-compose build
-
-# Push to registry
-docker-compose push
-
-# Deploy (depends on orchestration platform)
-docker-compose -f docker-compose.prod.yml up -d
-```
-
-**Security:** Never copy `.env` files into Docker images. Use runtime environment variables.
-{{/IF_DOCKER}}
-
-{{#IF_CSHARP}}
-## C# Deployment
-
-```bash
-# Framework-dependent (requires .NET runtime on target)
-dotnet publish -c Release -o out/ --self-contained false
-
-# Self-contained (no runtime needed on target)
-dotnet publish -c Release -r linux-x64 --self-contained true
-```
-
-For Docker, use multi-stage builds:
-- Build stage: `mcr.microsoft.com/dotnet/sdk:{{CSHARP_VERSION}}`
-- Runtime stage: `mcr.microsoft.com/dotnet/aspnet:{{CSHARP_VERSION}}`
-{{/IF_CSHARP}}
-
-## CI/CD
-
-Set up the project's CI pipeline so it runs the same checks as `/quality` and `/test` on every PR.
-
-## Gotchas
-
-See [references/gotchas.md](references/gotchas.md) for known deployment issues.

package/templates/.claude/skills/deploy/references/gotchas.md

@@ -1,5 +0,0 @@
-# Deployment Gotchas
-
-<!-- This file grows over time. Each entry is added during session-end. -->
-<!-- Format: date, category, description, resolution -->
-<!-- NEVER include secret values, tokens, or credentials here -->

package/templates/.claude/skills/doctor/SKILL.md

@@ -1,31 +0,0 @@
----
-name: doctor
-description: Diagnose and fix development environment issues. Use when setup fails, tools are missing, the environment is broken, or something is misconfigured.
----
-
-# Doctor
-
-## Diagnose
-
-Walk through this checklist when something feels off:
-
-1. **Git**: `git --version`, working tree clean?
-2. **Language toolchains** (only for languages present in this repo):
-   - Node: `node --version` / `npm --version`; `node_modules/` populated?
-   - Python: `python3 --version`; virtual env activated? deps installed?
-   - Go: `go version`; modules downloaded?
-   - .NET: `dotnet --version`
-   - Rust: `rustc --version` / `cargo --version`
-3. **Docker** (if `docker-compose.yml` present): `docker --version`; daemon running?
-4. **dxkit health**: `npx vyuh-dxkit doctor` — verifies dxkit-managed tools (gitleaks, semgrep, cloc, etc.) and the `.claude/` install
-5. **Hooks active**: `git config core.hooksPath` should report `.githooks` if hooks are installed
-
-## Fix
-
-- Missing dxkit tools: `npx vyuh-dxkit tools install`
-- Stale `node_modules/`: `rm -rf node_modules && npm install`
-- Hooks not firing: `git config core.hooksPath .githooks`
-
-## Environment
-
-If the repo has `.devcontainer/`, the canonical environment is the container — open in a devcontainer-aware editor (VS Code "Reopen in Container", Codespaces) instead of fighting host-machine setup.