@vyuhlabs/dxkit 2.5.0 → 2.5.1

package/templates/AGENTS.md.template

@@ -0,0 +1,137 @@
+# {{PROJECT_NAME}}
+
+{{PROJECT_DESCRIPTION}}
+
+## How to use this file
+
+`AGENTS.md` is the open-standard project-context file read by AI coding agents (Claude Code, Codex, Cursor, Aider, …). It describes what this project is, how to run common commands, and the safety rules that apply.
+
+For agent-specific config, see the editor-specific files alongside this one — `CLAUDE.md` (Claude Code), `.cursor/rules` (Cursor), etc. — which point back here for shared context.
+
+## What dxkit does in this repo
+
+This repo is managed by [`@vyuhlabs/dxkit`](https://github.com/vyuh-labs/dxkit). dxkit measures code health across 6 dimensions, captures a per-finding baseline, and gates PRs on net-new regressions.
+
+Six skills are installed under `.claude/skills/` (Claude Code auto-discovers via skill frontmatter):
+
+- **dxkit-learn** — explains dxkit concepts (baselines, dimensions, scanners)
+- **dxkit-init** — interactive setup walkthrough
+- **dxkit-config** — edit `.dxkit-ignore`, `.vyuh-dxkit.json`, policy
+- **dxkit-hooks** — install / troubleshoot git hooks
+- **dxkit-reports** — run analyzers, explain output, dashboard
+- **dxkit-action** — prioritize + fix + verify + re-baseline
+
+Reach for the relevant skill when working in this repo. They wrap the `vyuh-dxkit` CLI with workflow guidance.
+
+{{#IF_PYTHON}}
+## Python {{PYTHON_VERSION}}
+
+- **Tests**: `pytest`
+- **Lint/format**: `ruff check .` / `ruff format .`
+- **Type check**: `mypy src/`
+- **Package config**: `pyproject.toml`
+{{/IF_PYTHON}}
+
+{{#IF_GO}}
+## Go {{GO_VERSION}}
+
+- **Tests**: `go test ./...`
+- **Lint**: `golangci-lint run`
+- **Format**: `gofmt -w .` / `goimports -w .`
+- **Module**: `go.mod`
+{{/IF_GO}}
+
+{{#IF_NODE}}
+## Node.js {{NODE_VERSION}}
+
+- **Tests**: `npm test`
+- **Build**: `npm run build`
+- **Lint/format**: `npx eslint .` / `npx prettier --write .`
+- **Package config**: `package.json`, `tsconfig.json`
+{{/IF_NODE}}
+
+{{#IF_NEXTJS}}
+## Next.js
+
+- **Directory**: `frontend/`
+- **Dev server**: `cd frontend && npm run dev`
+- **Build**: `cd frontend && npm run build`
+- **Lint**: `cd frontend && npm run lint`
+{{/IF_NEXTJS}}
+
+{{#IF_RUST}}
+## Rust {{RUST_VERSION}}
+
+- **Tests**: `cargo test`
+- **Build**: `cargo build` / `cargo build --release`
+- **Lint**: `cargo clippy`
+- **Format**: `cargo fmt`
+- **Package**: `Cargo.toml`
+{{/IF_RUST}}
+
+{{#IF_CSHARP}}
+## C# {{CSHARP_VERSION}}
+
+- **Tests**: `dotnet test`
+- **Build**: `dotnet build` / `dotnet publish -c Release`
+- **Format**: `dotnet format`
+- **Solution**: `*.sln`, projects under `*.csproj`
+{{/IF_CSHARP}}
+
+{{#IF_KOTLIN}}
+## Kotlin {{KOTLIN_VERSION}}
+
+- **Tests**: `./gradlew test`
+- **Build**: `./gradlew build`
+- **Lint**: `detekt`
+- **Package**: `build.gradle.kts` / `settings.gradle.kts`
+{{/IF_KOTLIN}}
+
+{{#IF_JAVA}}
+## Java {{JAVA_VERSION}}
+
+- **Tests**: `mvn test` / `./gradlew test`
+- **Build**: `mvn package` / `./gradlew build`
+- **Lint**: `pmd`
+- **Package**: `pom.xml` / `build.gradle`
+{{/IF_JAVA}}
+
+{{#IF_RUBY}}
+## Ruby {{RUBY_VERSION}}
+
+- **Tests**: `bundle exec rspec` / `bundle exec rails test`
+- **Lint**: `bundle exec rubocop`
+- **Coverage**: SimpleCov (loaded from `spec_helper.rb`)
+- **Package**: `Gemfile`
+{{/IF_RUBY}}
+
+## dxkit commands
+
+| Purpose | Command |
+|---|---|
+| Overall health (6 dimensions) | `npx vyuh-dxkit health` |
+| Deep security scan | `npx vyuh-dxkit vulnerabilities` |
+| Test coverage gaps | `npx vyuh-dxkit test-gaps` |
+| Code quality + slop | `npx vyuh-dxkit quality` |
+| Bill of materials | `npx vyuh-dxkit bom` |
+| Dashboard (HTML) | `npx vyuh-dxkit dashboard` |
+| Guardrail check (baseline diff) | `npx vyuh-dxkit guardrail check` |
+| Doctor (verify setup) | `npx vyuh-dxkit doctor` |
+
+The pre-push hook runs `guardrail check` automatically — blocks net-new regressions before they leave your machine.
+
+## Security rules — never violate
+
+1. **Never output, log, or commit secrets** — no API keys, tokens, passwords, or credentials in code, commits, or files Claude writes
+2. **Never read `.env` directly** — to confirm a variable exists, grep for the variable name only
+3. **Never pass secrets as CLI arguments** — they appear in process lists and shell history
+4. **Never include secrets in build args or Dockerfiles**
+5. **Sensitive files are gitignored**: `.env`, `.env.*`, `.env.secrets`, `.claude/settings.local.json`
+6. **Before committing**: verify no secrets in staged files (`git diff --cached`)
+
+## Conventions
+
+- Run `npx vyuh-dxkit health` before opening a PR
+- For changes to risky areas (auth, payments, data mutations), write tests first
+- Capture surprising behaviors as comments in `.dxkit-ignore` or the relevant skill file
+- Pre-push hook will block net-new regressions — fix them in the same PR or accept-as-baseline with a commit message explaining why

package/templates/CLAUDE.md.template

@@ -1,121 +1,26 @@
-# {{PROJECT_NAME}}
+# {{PROJECT_NAME}} — Claude Code config
 
-{{PROJECT_DESCRIPTION}}
+Project context lives in [`AGENTS.md`](./AGENTS.md) (open-standard, read by every coding agent). This file is Claude-Code-specific config that points at it.
 
-## How to use this file
+Whenever Claude Code starts a session in this repo, it reads BOTH files: this one (Claude-specific shortcuts) and `AGENTS.md` (project prose).
 
-This file is loaded by Claude Code at the start of every session in this repo. It tells the agent what this project is, how to run common commands, and what safety rules to follow.
+## dxkit skills
 
-The rest of `.claude/` extends this:
-- **Skills** (`.claude/skills/`) — domain context loaded on demand
-- **Commands** (`.claude/commands/`) — slash commands for common workflows
-- **Agents** (`.claude/agents/`) — specialists Claude delegates to automatically
-- **Rules** (`.claude/rules/`) — language-specific conventions
+Six dxkit-specific skills are installed under `.claude/skills/`. Claude Code auto-discovers them via their frontmatter `description` fields:
 
-Run `/help` for the full list.
+- `dxkit-learn` — explain what dxkit does, what scores mean, what scanners run
+- `dxkit-init` — walk through `vyuh-dxkit init` flag choices
+- `dxkit-config` — edit `.dxkit-ignore` / `.vyuh-dxkit.json` / policy
+- `dxkit-hooks` — install / troubleshoot git hooks
+- `dxkit-reports` — run analyzers + read output
+- `dxkit-action` — prioritize + fix + verify + re-baseline
 
-{{#IF_PYTHON}}
-## Python {{PYTHON_VERSION}}
+When the user asks about dxkit concepts or wants to run an analyzer, reach for the matching skill before improvising.
 
-- **Tests**: `pytest`
-- **Lint/format**: `ruff check .` / `ruff format .`
-- **Type check**: `mypy src/`
-- **Package config**: `pyproject.toml`
-{{/IF_PYTHON}}
+## Per-language rules
 
-{{#IF_GO}}
-## Go {{GO_VERSION}}
+`.claude/rules/<lang>.md` files carry per-language conventions for any active language pack. They're loaded automatically.
 
-- **Tests**: `go test ./...`
-- **Lint**: `golangci-lint run`
-- **Format**: `gofmt -w .` / `goimports -w .`
-- **Module**: `go.mod`
-{{/IF_GO}}
+## Security rules + per-language commands
 
-{{#IF_NODE}}
-## Node.js {{NODE_VERSION}}
-
-- **Tests**: `npm test`
-- **Build**: `npm run build`
-- **Lint/format**: `npx eslint .` / `npx prettier --write .`
-- **Package config**: `package.json`, `tsconfig.json`
-{{/IF_NODE}}
-
-{{#IF_NEXTJS}}
-## Next.js
-
-- **Directory**: `frontend/`
-- **Dev server**: `cd frontend && npm run dev`
-- **Build**: `cd frontend && npm run build`
-- **Lint**: `cd frontend && npm run lint`
-{{/IF_NEXTJS}}
-
-{{#IF_RUST}}
-## Rust {{RUST_VERSION}}
-
-- **Tests**: `cargo test`
-- **Build**: `cargo build` / `cargo build --release`
-- **Lint**: `cargo clippy`
-- **Format**: `cargo fmt`
-- **Package**: `Cargo.toml`
-{{/IF_RUST}}
-
-{{#IF_CSHARP}}
-## C# {{CSHARP_VERSION}}
-
-- **Tests**: `dotnet test`
-- **Build**: `dotnet build` / `dotnet publish -c Release`
-- **Format**: `dotnet format`
-- **Solution**: `*.sln`, projects under `*.csproj`
-{{/IF_CSHARP}}
-
-{{#IF_GCLOUD}}
-## Google Cloud
-
-- **Auth**: `gcloud auth login`
-- **Project**: set via `gcloud config set project <id>` or `GOOGLE_CLOUD_PROJECT` env var
-{{/IF_GCLOUD}}
-
-{{#IF_PULUMI}}
-## Pulumi
-
-- **Auth**: `pulumi login`
-- **Workflow**: always `pulumi preview` before `pulumi up`
-- **Secrets**: `pulumi config set --secret` for sensitive values
-{{/IF_PULUMI}}
-
-## Common slash commands
-
-- `/health` — full codebase health audit (6 dimensions)
-- `/vulnerabilities` — scan dependencies + code for security issues
-- `/test-gaps` — find critical untested code paths
-- `/quality` — code quality + slop analysis
-- `/dev-report` — team activity from git history
-- `/ask <question>` — natural-language Q&A against the codebase
-- `/explore-codebase` — deep architecture exploration (run once on a new repo)
-- `/setup-hooks` — install git pre-commit/pre-push hooks
-- `/learn` — capture a gotcha or convention from the current conversation
-
-Run `/help` for the full list of commands and agents.
-
-## Security rules — never violate
-
-1. **Never output, log, or commit secrets** — no API keys, tokens, passwords, or credentials in code, commits, checkpoints, or skill files
-2. **Never read `.env` directly** — if you need to confirm a value exists, grep for the variable name only
-3. **Never pass secrets as CLI arguments** — they appear in process lists and shell history
-4. **Never include secrets in build args or Dockerfiles**
-5. **Sensitive files are gitignored**: `.env`, `.env.*`, `.env.secrets`, `.claude/settings.local.json`
-6. **Before committing**: verify no secrets in staged files (`git diff --cached`)
-{{#IF_INFISICAL}}
-7. **Infisical tokens**: never output `INFISICAL_TOKEN` values
-{{/IF_INFISICAL}}
-{{#IF_GCLOUD}}
-8. **GCP credentials**: never output `gcloud auth print-access-token` or service account JSON keys
-{{/IF_GCLOUD}}
-
-## Conventions
-
-- Run `/quality` and `/test` before committing
-- For changes to risky areas (auth, payments, data mutations), write tests first
-- Capture surprising behaviors via `/learn` so the next session inherits them
-- Check `/help` for available commands and agents
+See [`AGENTS.md`](./AGENTS.md). All shared project context lives there so other agents (Codex / Cursor / Aider) get the same instructions Claude does.

package/dist/codebase-scanner.d.ts

@@ -1,36 +0,0 @@
-export interface CodebaseAnalysis {
-    entryPoints: {
-        file: string;
-        type: string;
-    }[];
-    directories: {
-        path: string;
-        purpose: string;
-    }[];
-    testPatterns: {
-        framework: string;
-        location: string;
-        pattern: string;
-    }[];
-    apiEndpoints: {
-        method: string;
-        path: string;
-        file: string;
-    }[];
-    configFiles: {
-        file: string;
-        purpose: string;
-    }[];
-    conventions: {
-        pattern: string;
-        description: string;
-    }[];
-    fileCount: number;
-    testFileCount: number;
-    sourceFileCount: number;
-    languageBreakdown: Record<string, number>;
-}
-export declare function scanCodebase(cwd: string): CodebaseAnalysis;
-export declare function renderCodebaseSkill(analysis: CodebaseAnalysis): string;
-export declare function renderArchitectureRef(analysis: CodebaseAnalysis): string;
-//# sourceMappingURL=codebase-scanner.d.ts.map

package/dist/codebase-scanner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"codebase-scanner.d.ts","sourceRoot":"","sources":["../src/codebase-scanner.ts"],"names":[],"mappings":"AAoDA,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjD,YAAY,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzE,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/D,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjD,WAAW,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AA4eD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAmD1D;AAID,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAgGtE;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAmDxE"}