minimal-vibe-coding-kit 0.3.0 → 0.4.0

package/.agents/skills/agentshield-security-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agentshield-security-review
-description: repository-native security review workflow for Claude Code and Codex projects using the AgentShield concept. Use when auditing or hardening agent configuration, skills, prompts, hooks, MCP servers, permissions, slash commands, Codex plugin files, Claude plugin files, AGENTS.md, CLAUDE.md, or repository-level AI coding-agent surfaces. Prefer this skill before merging changes to .claude, .codex, .codex-plugin, .claude-plugin, .agents, skills, .vbkit-commands, .vbkit-scripts, hooks, mcp configs, or generated code that touches agent execution.
+description: repository-native security review workflow for Claude Code and Codex projects using the AgentShield concept. Use when auditing or hardening agent configuration, skills, prompts, hooks, MCP servers, permissions, slash commands, Codex plugin files, Claude plugin files, AGENTS.md, CLAUDE.md, or repository-level AI coding-agent surfaces. Prefer this skill before merging changes to .claude, .codex, .codex-plugin, .claude-plugin, .agents, .vibekit/skills, .vibekit/commands, .vibekit/scripts, hooks, mcp configs, or generated code that touches agent execution.
 ---
 
 # AgentShield Security Review
@@ -14,7 +14,7 @@ Do not invent findings. Prefer deterministic scanner output when available, then
 ## Standard workflow
 
 1. Identify the repo root and active harness surfaces.
-2. Run `node .vbkit-scripts/agentshield-probe.mjs .` to inventory Claude, Codex, shared skills, hooks, MCP, commands, and repo instruction files.
+2. Run `node .vibekit/scripts/agentshield-probe.mjs .` to inventory Claude, Codex, shared skills, hooks, MCP, commands, and repo instruction files.
 3. If Node/npm is available, run AgentShield from the repo root:
    ```bash
    npx ecc-agentshield scan --path . --format text
@@ -34,9 +34,9 @@ Do not invent findings. Prefer deterministic scanner output when available, then
 
 Use a shared root skill where possible:
 
-- `skills/agentshield-security-review/SKILL.md` is the canonical workflow.
-- Claude Code may add a slash-command shim in `.vbkit-commands/security-scan.md` or `.claude/commands/security-scan.md`.
-- Codex should consume the same root `skills/` directory through `.codex-plugin/plugin.json` or the repo's native skill/plugin mechanism.
+- `.vibekit/skills/agentshield-security-review/SKILL.md` is the canonical workflow.
+- Claude Code may add a slash-command shim in `.vibekit/commands/security-scan.md` or `.claude/commands/security-scan.md`.
+- Codex should consume the same root `.vibekit/skills/` directory through `.codex-plugin/plugin.json` or the repo's native skill/plugin mechanism.
 - Do not duplicate divergent Claude and Codex skill bodies. Duplication causes drift.
 
 See `references/native-install.md` for copy-ready Claude and Codex snippets.
@@ -48,7 +48,7 @@ Prioritize runtime-active files over examples and docs:
 1. `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`
 2. `.claude/settings.json`, `.claude/settings.local.json`, `.claude/agents/*.md`, `.claude/commands/*.md`
 3. `.codex/config.toml`, `.codex/`, `.codex-plugin/plugin.json`
-4. `.agents/`, `agents/`, `skills/`, `.vbkit-commands/`, `.vbkit-scripts/`, `hooks/`
+4. `.agents/`, `agents/`, `.vibekit/skills/`, `.vibekit/commands/`, `.vibekit/scripts/`, `hooks/`
 5. `.mcp.json`, `mcp.json`, `mcp-configs/*.json`
 6. installer scripts, CI workflows, package scripts, and generated plugin manifests
 

package/.agents/skills/agentshield-security-review/references/native-install.md

@@ -7,18 +7,18 @@ Keep one canonical skill and add thin harness adapters.
 Recommended repo layout:
 
 ```text
-skills/agentshield-security-review/SKILL.md
-skills/agentshield-security-review/references/review-checklist.md
-skills/agentshield-security-review/references/report-template.md
-skills/agentshield-security-review/scripts/agentshield_repo_probe.py
-.vbkit-commands/security-scan.md
+.vibekit/skills/agentshield-security-review/SKILL.md
+.vibekit/skills/agentshield-security-review/references/review-checklist.md
+.vibekit/skills/agentshield-security-review/references/report-template.md
+.vibekit/skills/agentshield-security-review/scripts/agentshield_repo_probe.py
+.vibekit/commands/security-scan.md
 .codex-plugin/plugin.json
 .claude-plugin/plugin.json
 ```
 
 ## Claude Code command shim
 
-Create `.vbkit-commands/security-scan.md` or `.claude/commands/security-scan.md`:
+Create `.vibekit/commands/security-scan.md` or `.claude/commands/security-scan.md`:
 
 ```markdown
 ---
@@ -48,7 +48,7 @@ Return grade, score, severity counts, active paths, critical/high findings, and
 
 ## Codex plugin pointer
 
-Use the repo-level Codex plugin manifest to point Codex at the same `skills/` directory. Exact schema may vary by Codex plugin version, so preserve the existing repo schema and ensure it references root skills rather than a copied skill body.
+Use the repo-level Codex plugin manifest to point Codex at the same `.vibekit/skills/` directory. Exact schema may vary by Codex plugin version, so preserve the existing repo schema and ensure it references the canonical `.vibekit/skills/` directory rather than a copied skill body.
 
 Example intent:
 
@@ -56,7 +56,7 @@ Example intent:
 {
   "name": "your-repo",
   "version": "0.1.0",
-  "skills": "./skills",
+  "skills": "./.vibekit/skills",
   "mcp": "./.mcp.json"
 }
 ```
@@ -78,8 +78,8 @@ on:
       - ".claude-plugin/**"
       - ".agents/**"
       - "agents/**"
-      - "skills/**"
-      - ".vbkit-commands/**"
+      - ".vibekit/skills/**"
+      - ".vibekit/commands/**"
       - "hooks/**"
       - ".mcp.json"
       - "mcp-configs/**"

package/.agents/skills/agentshield-security-review/references/report-template.md

@@ -34,7 +34,7 @@ Use this structure for final reports.
 
 ## Medium/low findings
 
-Group by theme: permissions, hooks, MCP, prompts, skills, .vbkit-docs/examples.
+Group by theme: permissions, hooks, MCP, prompts, skills, .vibekit/docs/examples.
 
 ## Remediation order
 

package/.agents/skills/agentshield-security-review/scripts/agentshield_repo_probe.py

@@ -15,9 +15,9 @@ PATTERNS = {
     "repo_instructions": ["CLAUDE.md", "AGENTS.md", ".github/copilot-instructions.md"],
     "claude": [".claude", ".claude-plugin", "agents"],
     "codex": [".codex", ".codex-plugin"],
-    "shared_skills": ["skills", ".agents/skills"],
-    "shared_commands": [".vbkit-commands"],
-    "kit_scripts": [".vbkit-scripts"],
+    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", "skills"],
+    "shared_commands": [".vibekit/commands"],
+    "kit_scripts": [".vibekit/scripts"],
     "hooks": ["hooks", ".claude/hooks", ".agents/hooks"],
     "mcp": [".mcp.json", "mcp.json", "mcp-configs"],
     "ci": [".github/workflows"],

package/.agents/skills/autoresearch-coding/README.md

@@ -11,5 +11,5 @@ Example:
 For this kit:
 
 ```text
-/autoresearch-coding goal: improve the kit; metric command: node .vbkit-scripts/validate-kit.mjs .; direction: higher; editable paths: .vbkit-docs .vbkit-scripts skills .vbkit-commands .claude .cursor .agents .codex-plugin; budget: 3
+/autoresearch-coding goal: improve the kit; metric command: node .vibekit/scripts/validate-kit.mjs .; direction: higher; editable paths: .vibekit/docs .vibekit/scripts .vibekit/skills .vibekit/commands .claude .cursor .agents .codex-plugin; budget: 3
 ```

package/.agents/skills/autoresearch-coding/SKILL.md

@@ -28,16 +28,16 @@ For this kit itself, use:
 
 ```text
 goal: improve Minimal Vibe Coding Kit quality
-metric command: node .vbkit-scripts/validate-kit.mjs .
+metric command: node .vibekit/scripts/validate-kit.mjs .
 direction: higher
-editable paths: .vbkit-docs .vbkit-scripts skills .vbkit-commands .claude .cursor .agents .codex-plugin .github README.md AGENTS.md CLAUDE-template.md FIRST_TIME_INIT.md FIRST_PROMPT.md backbone.yml package.json install.sh install.ps1
+editable paths: .vibekit/docs .vibekit/scripts .vibekit/skills .vibekit/commands .claude .cursor .agents .codex-plugin .github README.md AGENTS.md .vibekit/init/CLAUDE-template.md .vibekit/init/FIRST_TIME_INIT.md .vibekit/init/FIRST_PROMPT.md backbone.yml package.json install.sh install.ps1
 protected paths: .git .env* node_modules vendor secrets lockfiles
 budget: 3
 ```
 
 ## Setup
 
-1. Read `backbone.yml`. If `meta.template_status` is `uninitialized`, follow `FIRST_TIME_INIT.md` and wait for explicit approval before experiment edits.
+1. Read `backbone.yml`. If `meta.template_status` is `uninitialized`, follow `.vibekit/init/FIRST_TIME_INIT.md` and wait for explicit approval before experiment edits.
 2. Inspect `git status --short`.
 3. If user changes exist, stop unless the user permits dirty-state experimentation.
 4. Create or switch to an experiment branch named `autoresearch/<date>-<slug>` when a git repo is available. If branch creation is blocked by permissions, ask for approval once and record any approved fallback.
@@ -78,7 +78,7 @@ For each experiment:
 7. Keep good changes; revert discarded or crashed changes.
 8. If a crash is from a trivial patch mistake, fix once and rerun.
 
-If a kept change touches agent surfaces such as `AGENTS.md`, `CLAUDE.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, `skills/**`, `.vbkit-commands/**`, `.vbkit-scripts/**`, hooks, or MCP config, run the AgentShield probe before final reporting.
+If a kept change touches agent surfaces such as `AGENTS.md`, `CLAUDE.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, `.vibekit/skills/**`, `.vibekit/commands/**`, `.vibekit/scripts/**`, hooks, or MCP config, run the AgentShield probe before final reporting.
 
 ## Delegation
 

package/.agents/skills/daily-workflow-curator/SKILL.md

@@ -14,19 +14,19 @@ Run a daily improvement pass that proposes changes, not silent edits.
 2. Run:
 
 ```bash
-node .vbkit-scripts/daily-enhance.mjs . --write-report
+node .vibekit/scripts/daily-enhance.mjs . --write-report
 ```
 
 3. Run validation:
 
 ```bash
-node .vbkit-scripts/validate-kit.mjs .
+node .vibekit/scripts/validate-kit.mjs .
 ```
 
 4. Run AgentShield read-only probe if present:
 
 ```bash
-node .vbkit-scripts/agentshield-probe.mjs .
+node .vibekit/scripts/agentshield-probe.mjs .
 ```
 
 5. Identify stale, duplicated, or overly broad rules.

package/.agents/skills/parallel-analysis/SKILL.md

@@ -0,0 +1,160 @@
+---
+name: parallel-analysis
+description: Fan out 2-5 independent read-only analysis lanes across the repo using your configured executor (Cursor CLI Composer, Claude subagents, or Codex CLI), then merge the lane reports and verify them with a refutation pass. Use for repo-wide questions, large uncommitted-diff reviews, multi-doc reading, impact analysis, or consistency audits. On first use it asks which provider/model to use and saves the answer so it never asks again.
+argument-hint: "<analysis question, diff, or review target>"
+user-invocable: true
+effort: medium
+---
+
+# Parallel Analysis (Multi-Agent Fan-Out)
+
+Split a large analysis into independent read-only lanes, run them concurrently
+with the configured executor, merge the lane reports, and verify merged claims
+with a skeptical refutation pass. One round of parallel lanes replaces slow
+serial reading; the verification lane replaces manual double-checking.
+
+This skill is project-agnostic: it works in any repo where the kit is
+installed, using that repo's `backbone.yml` (if present) for boundaries.
+
+## Best Use
+
+- Repo-wide questions ("where is X handled, what depends on Y").
+- Reviewing a large uncommitted diff by concern (backend vs frontend vs i18n
+  vs scripts).
+- Reading several large docs, plans, or reference trees at once.
+- Pre-change impact analysis across packages/apps listed in `backbone.yml`
+  `paths.apps`.
+- Consistency audits (docs vs code, rules vs skills, config vs actual layout).
+
+Do NOT use for single-file questions or quick lookups; direct reads are faster.
+
+## Executor Setup (first use only)
+
+Lane execution is delegated to ONE configured executor. The choice is stored
+in `.vibekit/parallel-analysis.json`; while that file exists and its preflight
+passes, NEVER ask again.
+
+1. **If `.vibekit/parallel-analysis.json` exists**: read it, run the matching
+   preflight below, and proceed silently on success. If preflight fails
+   (binary missing, logged out), tell the user what broke, offer to re-run
+   setup, and update the file with their answer.
+2. **If it does not exist**: detect what is available, then ask the user ONE
+   question — "Which provider should run parallel analysis lanes?" — using the
+   harness-native prompt (AskUserQuestion in Claude Code; a plain chat
+   question in Cursor/Codex). Offer, in this order:
+   - **Cursor CLI + Composer 2.5 Fast (recommended)** — fastest lane executor;
+     requires `cursor-agent` installed and logged in.
+   - **Claude subagents** — no extra install; lanes run as read-only Claude
+     Code subagents (Explore/general-purpose). Choose this automatically if
+     the user declines external CLIs.
+   - **Codex CLI** — lanes run via `codex exec` in a read-only sandbox with
+     the best available Codex model.
+3. **Resolve the model** for the chosen provider (see per-executor notes),
+   confirm the resolved value in one line, and write the config file. Include
+   a fallback executor so lanes still run when the primary is unavailable.
+
+### Preflights and model resolution
+
+- `cursor-cli`: `cursor-agent status` must report logged in (otherwise the
+  user runs `cursor-agent login` once). Resolve the model with
+  `cursor-agent --list-models` and prefer the Composer 2.5 fast variant
+  (e.g. `composer-2.5-fast`); if absent, use the newest Composer model and
+  record what was picked.
+- `claude-subagents`: available whenever running inside Claude Code; no
+  binary needed. Use read-only subagent types only.
+- `codex-cli`: `codex --version` must succeed. Use the CLI's default/best
+  coding model unless the user names one; record the resolved model.
+
+### Config file — `.vibekit/parallel-analysis.json`
+
+```json
+{
+  "executor": "cursor-cli",
+  "model": "composer-2.5-fast",
+  "fallback": "claude-subagents",
+  "configuredAt": "2026-07-16T07:30:00Z"
+}
+```
+
+`executor` is one of `cursor-cli` | `claude-subagents` | `codex-cli`. The file
+is local state (gitignored by default); a team may commit it deliberately to
+share a default. To change the choice later, delete the file or ask for
+"parallel-analysis setup" again.
+
+## Running a lane (per executor)
+
+Every lane is READ-ONLY: search, read, summarize — never edit files, execute
+project binaries, run hooks, or trigger installs/deploys/migrations.
+
+- `cursor-cli`:
+
+  ```sh
+  cursor-agent -p --mode ask --output-format text \
+    --model "<configured-model>" \
+    --workspace "<repo-root>" \
+    "<lane brief>"
+  ```
+
+  Never pass `--force` or `--yolo`; `--mode ask` keeps Composer read-only.
+  One workspace per lane; a question spanning multiple repos becomes one lane
+  per repo.
+- `claude-subagents`: launch each lane as a read-only subagent with the lane
+  brief as its prompt, all lanes in ONE message so they run concurrently.
+- `codex-cli`:
+
+  ```sh
+  codex exec --sandbox read-only -C "<repo-root>" "<lane brief>"
+  ```
+
+If the harness cannot run lanes concurrently (plain CLI loop), run them
+back-to-back without changing the briefs — merge and verification stay the
+same.
+
+## Workflow
+
+1. **Scope.** State the question in one sentence. Split it into 2-5 lanes that
+   are independent of each other (by directory, package, concern, or doc set).
+   If lanes would depend on each other's output, merge them or run two rounds.
+2. **Brief.** Give each lane a numbered brief: exact paths, the questions to
+   answer, and the required return format ("facts only, numbered sections,
+   findings as `file:line — issue — why it matters`").
+3. **Launch all lanes at once** with the configured executor.
+4. **Prepare while waiting.** Build the merge skeleton; do not duplicate lane
+   work.
+5. **Merge.** Combine lane reports into one findings list. Mark conflicts
+   between lanes and unknowns explicitly — never average away a disagreement.
+6. **Verify.** Run one verification lane that receives the merged claims (not
+   the reasoning) with the instruction: "Default-skeptical: confirm or refute
+   each claim against the repo with file:line evidence." Drop or re-investigate
+   every refuted claim; never silently keep one.
+7. **Deliver.** Report merged findings, what was verified, and remaining
+   unknowns. For issue triage, classify surviving findings with the
+   `reviewing-4p-priorities` skill (P0-P4). Decisions and edits stay in the
+   main session under the repo's normal review rules.
+
+## Lane brief template
+
+```text
+Lane <n>: <one-line purpose>
+Workspace: <repo root>
+Paths: <exact dirs/files>
+Read-only. Do not modify anything or execute binaries/scripts.
+Questions:
+1. <specific question>
+2. <specific question>
+Return: numbered sections matching the questions, facts only,
+findings as file:line — issue — why it matters.
+```
+
+## Guardrails
+
+- 2-5 lanes per round; needing more means the question is under-scoped.
+- Lanes are read-only; only the main session edits files. Agent-surface edits
+  (`backbone.yml`, `AGENTS.md`, `CLAUDE.md`, `.claude/**`, `.cursor/**`,
+  `.agents/**`, `.codex/**`, kit skills/commands) additionally require the
+  `agentshield-security-review` skill afterwards.
+- Respect `backbone.yml` `policy.protected_paths` in every lane brief.
+- Never put secrets in lane briefs or executor prompts: no `.env*` contents,
+  credentials, tokens, private keys, or customer data.
+- This skill produces analysis, not decisions; a lane may not conclude
+  "therefore change X" without main-session review.

package/.agents/skills/path-sensitive-shell-safety/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: path-sensitive-shell-safety
+description: Guardrail workflow for shell changes that use path variables, remote base directories, repo folders, checkout repair, or destructive filesystem commands such as rm, mv, cp, rsync, find -delete, git clean, or git reset.
+argument-hint: "<script path, command, or safety review target>"
+user-invocable: true
+effort: medium
+---
+
+# Path-Sensitive Shell Safety
+
+Use this skill before editing or reviewing shell, deploy, installer, cleanup, or repair logic that builds filesystem paths from variables or touches remote repositories.
+
+Common triggers:
+
+- Path variables such as `remote_base`, `repo_dir`, `repo_folder`, `target_dir`, `backup_dir`, `worktree`, `site`, `app`, or user-entered folder names.
+- Destructive or path-sensitive commands: `rm`, `mv`, `cp -a`, `rsync --delete`, `find -delete`, `docker volume rm`, `git clean`, `git reset`, checkout repair, clone replacement, or symlink-sensitive copy.
+- Git sync that decides which branch or remote checkout will be deployed.
+
+## Safety objective
+
+No empty, unset, broad, symlinked, or unintended path may reach a destructive command. Validate values before joining paths, validate the joined path before use, and validate containment immediately before the command.
+
+## Required workflow
+
+1. Identify the command with the highest blast radius.
+2. List every variable that contributes to its path or repository target.
+3. Classify each variable:
+   - trusted constant;
+   - config value;
+   - remote/server value;
+   - user/operator input;
+   - derived path.
+4. Validate raw inputs before joining:
+   - required and non-empty;
+   - expected shape: absolute base path or safe single folder segment;
+   - no traversal, newlines, glob metacharacters, leading option dash, or control characters;
+   - explicit allowlist for server roots when possible.
+5. Join paths with quoted expansions only. Do not use `eval`.
+6. Canonicalize existing paths with physical resolution (`pwd -P` or `realpath`) before destructive work.
+7. Assert containment:
+   - target is inside the approved base;
+   - target is not `/`, `.`, `..`, `$HOME`, the base root itself, or another broad system directory;
+   - target is not a symlink unless the operation explicitly supports symlinks.
+8. Put the final guard directly next to the dangerous command.
+9. Use command terminators and quoting: `-- "$path"` where supported.
+10. For Git sync, verify expected origin, selected branch policy, fetch success, clean worktree, fast-forward state, and final `HEAD == origin/<branch>` before build/deploy.
+11. Run the repo validation command and AgentShield probe when this changes agent surfaces or automation rules.
+
+## Required outcomes
+
+- A blank branch may follow the documented default-branch fallback policy.
+- An explicit branch must fail if missing; never silently deploy another branch.
+- A blank folder/base value must fail before any `rm`, `mv`, `cp`, `rsync`, `find`, Docker, or Git cleanup command runs.
+- A repair flow may move an unusable checkout to a timestamped backup only after a verified replacement exists.
+- No automatic cleanup should delete backups, locks, runtime data, uploads, volumes, databases, or environment files without separate explicit confirmation.
+
+## Review priority
+
+Use `reviewing-4p-priorities` if triage is needed:
+
+- P0: unsafe path command already caused data loss or can expose/delete secrets in the active environment.
+- P1: unchecked empty/broad variable can reach destructive commands in deploy/repair/install paths.
+- P2: guard exists but misses edge cases such as symlinks, traversal, explicit branch fallback, or wrong origin.
+- P3/P4: documentation clarity or minor naming improvements after the safety invariant is already enforced.
+
+## Reference
+
+Use `references/workflow.md` for copy-ready guard patterns and review checklist.

package/.agents/skills/path-sensitive-shell-safety/references/workflow.md

@@ -0,0 +1,127 @@
+# Path-Sensitive Shell Safety Reference
+
+This reference gives reusable guard patterns for shell scripts. Adapt names and allowlists to the repo, but keep the invariant: validate raw input, validate the joined path, then guard immediately before the dangerous command.
+
+## Baseline guard functions
+
+```bash
+die() {
+  printf 'ERROR: %s\n' "$*" >&2
+  exit 1
+}
+
+require_nonempty() {
+  local name="${1:?missing name}"
+  local value="${2-}"
+  [[ -n "$value" ]] || die "$name is required"
+  [[ "$value" != *$'\n'* && "$value" != *$'\r'* ]] || die "$name contains a newline"
+}
+
+validate_abs_base_path() {
+  local name="${1:?missing name}"
+  local value="${2-}"
+  require_nonempty "$name" "$value"
+  [[ "$value" == /* ]] || die "$name must be an absolute path: $value"
+  [[ "$value" != "/" && "$value" != "." && "$value" != ".." ]] || die "$name is too broad: $value"
+  [[ "$value" != *"/../"* && "$value" != *"/./"* && "$value" != *"//"* ]] || die "$name contains unsafe traversal: $value"
+  case "$value" in
+    /bin|/boot|/dev|/etc|/home|/lib|/lib64|/opt|/private|/root|/sbin|/srv|/sys|/tmp|/usr|/var)
+      die "$name points at a broad system directory: $value"
+      ;;
+  esac
+}
+
+validate_folder_segment() {
+  local name="${1:?missing name}"
+  local value="${2-}"
+  require_nonempty "$name" "$value"
+  [[ "$value" != -* ]] || die "$name must not start with '-': $value"
+  [[ "$value" != "." && "$value" != ".." ]] || die "$name is unsafe: $value"
+  [[ "$value" != */* && "$value" != *\\* ]] || die "$name must be one folder segment: $value"
+  [[ "$value" =~ ^[A-Za-z0-9._#@+=:-]+$ ]] || die "$name contains unsupported characters: $value"
+}
+
+join_child_path() {
+  local base="${1:?missing base}"
+  local child="${2:?missing child}"
+  printf '%s/%s\n' "${base%/}" "$child"
+}
+```
+
+## Containment guard
+
+```bash
+canonical_existing_dir() {
+  local path_value="${1:?missing path}"
+  [[ -d "$path_value" ]] || die "not a directory: $path_value"
+  [[ ! -L "$path_value" ]] || die "refusing symlink directory: $path_value"
+  (cd -P -- "$path_value" && pwd) || die "cannot resolve directory: $path_value"
+}
+
+assert_child_under_parent() {
+  local parent="${1:?missing parent}"
+  local child="${2:?missing child}"
+  [[ "$child" != "$parent" ]] || die "refusing to operate on parent directory itself: $child"
+  case "$child" in
+    "$parent"/*) ;;
+    *) die "path escapes parent: child=$child parent=$parent" ;;
+  esac
+}
+```
+
+## Safer remove wrapper
+
+Use a wrapper instead of inline deletion when a path contains variables.
+
+```bash
+safe_rm_rf_dir() {
+  local label="${1:?missing label}"
+  local target="${2-}"
+  local allowed_parent="${3-}"
+
+  validate_abs_base_path "$label target" "$target"
+  validate_abs_base_path "$label allowed parent" "$allowed_parent"
+
+  [[ -d "$target" ]] || die "$label target is not an existing directory: $target"
+  [[ ! -L "$target" ]] || die "$label target is a symlink: $target"
+
+  local parent_real
+  parent_real="$(canonical_existing_dir "$allowed_parent")"
+
+  local target_real
+  target_real="$(canonical_existing_dir "$target")"
+
+  assert_child_under_parent "$parent_real" "$target_real"
+  rm -rf -- "$target_real"
+}
+```
+
+Never call the wrapper with a broad parent such as `/`, `/opt`, `/var`, `/tmp`, or `$HOME`. Use the narrowest app-owned parent.
+
+## Git sync guard checklist
+
+- Validate the checkout directory is inside the approved app base.
+- Validate the origin URL or host matches the expected repository.
+- Fetch with bounded timeout and non-interactive credentials.
+- Explicit branch:
+  - require the exact remote branch;
+  - fail with an actionable message if it is missing.
+- Blank branch:
+  - current valid upstream;
+  - remote default branch;
+  - `main`;
+  - `master`.
+- Refuse dirty, local-ahead, or diverged worktrees unless the operator chooses a guided repair command.
+- After sync, verify `git rev-parse HEAD` equals `git rev-parse "origin/<branch>"`.
+- Build or deploy only after the equality check passes.
+
+## Review checklist
+
+- Are all path variables checked with `[[ -n "$value" ]]` or a stronger helper before use?
+- Are folder names validated as segments before joining?
+- Is the final path canonicalized or otherwise proven inside the base?
+- Is the destructive command adjacent to its guard?
+- Does the command use quoted expansions and `--` where available?
+- Does the code fail closed for missing explicit branches?
+- Does repair preserve runtime data and keep backups instead of deleting them?
+- Does validation cover empty values, traversal, symlink, wrong origin, dirty checkout, branch with `#`, and missing branch?

package/.agents/skills/vibekit-init/SKILL.md

@@ -11,15 +11,15 @@ Initialize the kit safely.
 
 ## Required behavior
 
-1. Print the requirements checklist from `FIRST_TIME_INIT.md`.
+1. Print the requirements checklist from `.vibekit/init/FIRST_TIME_INIT.md`.
 2. Run or emulate detection, including repo-specific conventions, project mode, and PRD presence:
 
 ```bash
-node .vbkit-scripts/init-backbone.mjs . --propose
+node .vibekit/scripts/init-backbone.mjs . --propose
 ```
 
 3. Run the project-understanding step below.
-4. Propose a unified diff for `backbone.yml`, its `conventions` rules, managed blocks, and any new `.vbkit-docs/PRD.md`.
+4. Propose a unified diff for `backbone.yml`, its `conventions` rules, managed blocks, and any new `.vibekit/docs/PRD.md`.
 5. Ask: `Apply this proposed backbone and convention rules? Reply yes, edit, or abort.`
 6. Write only after explicit `yes`.
 7. Validate after writing.
@@ -29,9 +29,9 @@ node .vbkit-scripts/init-backbone.mjs . --propose
 Detection reports `project.mode` (`greenfield` = no source yet, `brownfield` = existing code) and whether a PRD exists.
 
 - Always offer a short interview, regardless of whether docs already exist: what the project is and who it is for, the core problem and primary focus now, what success looks like, key constraints/non-goals, and (brownfield) which area to improve first.
-- If no PRD is found, propose creating `.vbkit-docs/PRD.md` from `.vbkit-docs/templates/PRD_TEMPLATE.md` using the answers, and set `project.prd` to that path.
+- If no PRD is found, propose creating `.vibekit/docs/PRD.md` from `.vibekit/docs/templates/PRD_TEMPLATE.md` using the answers, and set `project.prd` to that path.
 - If a PRD exists, read it, link it in `project.prd`, and offer to refresh it without overwriting unapproved content.
-- Keep the PRD short; it captures intent, not a full spec. Record domain terms in `.vbkit-docs/CONTEXT.md` (scaffold from `.vbkit-docs/templates/CONTEXT_TEMPLATE.md`) and link it in `project.context`.
+- Keep the PRD short; it captures intent, not a full spec. Record domain terms in `.vibekit/docs/CONTEXT.md` (scaffold from `.vibekit/docs/templates/CONTEXT_TEMPLATE.md`) and link it in `project.context`.
 
 ## Convention detection
 
@@ -49,4 +49,4 @@ Detection reports `project.mode` (`greenfield` = no source yet, `brownfield` = e
 
 ## Completion
 
-Report initialized status, validation command, validation result, PRD path, and next recommended skill. Once the user confirms setup is complete, offer graduation (`node .vbkit-scripts/vibekit-finalize.mjs . --propose`) to move one-time bootstrap files into the cleanup folder.
+Report initialized status, validation command, validation result, PRD path, and next recommended skill. Once the user confirms setup is complete, offer graduation (`node .vibekit/scripts/vibekit-finalize.mjs . --propose`) to move one-time bootstrap files into the cleanup folder.

package/.claude/commands/vibe-finalize.md

@@ -4,4 +4,4 @@ description: Graduate the project after init — move one-time bootstrap files i
 
 # vibe-finalize
 
-Graduate this project once init and the first prompt are complete. Run `node .vbkit-scripts/vibekit-finalize.mjs . --propose` to preview, then `--write --yes` to move one-time bootstrap files (FIRST_TIME_INIT.md, FIRST_PROMPT.md, PUSH_TO_GITHUB.md, CLAUDE-template.md) into `_vibekit-cleanup/` for deletion. It refuses to run on the kit source repo and is reversible with `--restore --write`.
+Graduate this project once init and the first prompt are complete. Run `node .vibekit/scripts/vibekit-finalize.mjs . --propose` to preview, then `--write --yes` to move one-time bootstrap files (.vibekit/init/FIRST_TIME_INIT.md, .vibekit/init/FIRST_PROMPT.md, .vibekit/init/PUSH_TO_GITHUB.md, .vibekit/init/CLAUDE-template.md) into `_vibekit-cleanup/` for deletion. It refuses to run on the kit source repo and is reversible with `--restore --write`.

package/.claude/rules/security.md

@@ -1,3 +1,5 @@
 # Security rules
 
 Run `/security-scan` for changes to agent surfaces, commands, hooks, MCP, skills, or installer scripts. Do not run untrusted hooks, MCP servers, deploys, migrations, or remote installers during review.
+
+Use the `path-sensitive-shell-safety` skill before changing shell/deploy/installer/repair logic that builds paths from variables or can delete, move, copy, replace, clean, or reset files.

package/.claude/rules/tooling.md

@@ -1,6 +1,6 @@
 # Tooling rules
 
 - Claude skills live in `.claude/skills/<name>/SKILL.md`.
-- Shared canonical skills live in `skills/<name>/`.
+- Shared canonical skills live in `.vibekit/skills/<name>/`.
 - Keep root `CLAUDE.md` concise; import `AGENTS.md` when possible.
 - Put path-specific guidance in `.claude/rules/` rather than the root file.

package/.claude/skills/agentshield-security-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agentshield-security-review
-description: repository-native security review workflow for Claude Code and Codex projects using the AgentShield concept. Use when auditing or hardening agent configuration, skills, prompts, hooks, MCP servers, permissions, slash commands, Codex plugin files, Claude plugin files, AGENTS.md, CLAUDE.md, or repository-level AI coding-agent surfaces. Prefer this skill before merging changes to .claude, .codex, .codex-plugin, .claude-plugin, .agents, skills, .vbkit-commands, .vbkit-scripts, hooks, mcp configs, or generated code that touches agent execution.
+description: repository-native security review workflow for Claude Code and Codex projects using the AgentShield concept. Use when auditing or hardening agent configuration, skills, prompts, hooks, MCP servers, permissions, slash commands, Codex plugin files, Claude plugin files, AGENTS.md, CLAUDE.md, or repository-level AI coding-agent surfaces. Prefer this skill before merging changes to .claude, .codex, .codex-plugin, .claude-plugin, .agents, .vibekit/skills, .vibekit/commands, .vibekit/scripts, hooks, mcp configs, or generated code that touches agent execution.
 ---
 
 # AgentShield Security Review
@@ -14,7 +14,7 @@ Do not invent findings. Prefer deterministic scanner output when available, then
 ## Standard workflow
 
 1. Identify the repo root and active harness surfaces.
-2. Run `node .vbkit-scripts/agentshield-probe.mjs .` to inventory Claude, Codex, shared skills, hooks, MCP, commands, and repo instruction files.
+2. Run `node .vibekit/scripts/agentshield-probe.mjs .` to inventory Claude, Codex, shared skills, hooks, MCP, commands, and repo instruction files.
 3. If Node/npm is available, run AgentShield from the repo root:
    ```bash
    npx ecc-agentshield scan --path . --format text
@@ -34,9 +34,9 @@ Do not invent findings. Prefer deterministic scanner output when available, then
 
 Use a shared root skill where possible:
 
-- `skills/agentshield-security-review/SKILL.md` is the canonical workflow.
-- Claude Code may add a slash-command shim in `.vbkit-commands/security-scan.md` or `.claude/commands/security-scan.md`.
-- Codex should consume the same root `skills/` directory through `.codex-plugin/plugin.json` or the repo's native skill/plugin mechanism.
+- `.vibekit/skills/agentshield-security-review/SKILL.md` is the canonical workflow.
+- Claude Code may add a slash-command shim in `.vibekit/commands/security-scan.md` or `.claude/commands/security-scan.md`.
+- Codex should consume the same root `.vibekit/skills/` directory through `.codex-plugin/plugin.json` or the repo's native skill/plugin mechanism.
 - Do not duplicate divergent Claude and Codex skill bodies. Duplication causes drift.
 
 See `references/native-install.md` for copy-ready Claude and Codex snippets.
@@ -48,7 +48,7 @@ Prioritize runtime-active files over examples and docs:
 1. `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`
 2. `.claude/settings.json`, `.claude/settings.local.json`, `.claude/agents/*.md`, `.claude/commands/*.md`
 3. `.codex/config.toml`, `.codex/`, `.codex-plugin/plugin.json`
-4. `.agents/`, `agents/`, `skills/`, `.vbkit-commands/`, `.vbkit-scripts/`, `hooks/`
+4. `.agents/`, `agents/`, `.vibekit/skills/`, `.vibekit/commands/`, `.vibekit/scripts/`, `hooks/`
 5. `.mcp.json`, `mcp.json`, `mcp-configs/*.json`
 6. installer scripts, CI workflows, package scripts, and generated plugin manifests