minimal-vibe-coding-kit 0.3.0 → 0.4.0

package/{FIRST_TIME_INIT.md → .vibekit/init/FIRST_TIME_INIT.md}

@@ -1,8 +1,8 @@
-# FIRST_TIME_INIT.md - bootstrap runbook
+# .vibekit/init/FIRST_TIME_INIT.md - bootstrap runbook
 
 Audience: Claude, Cursor, Codex, or any AI coding agent in a repo that just received Minimal Vibe Coding Kit.
 
-Keep this flow short. Detailed schema notes live in `.vbkit-docs/BACKBONE_REFERENCE.md`.
+Keep this flow short. Detailed schema notes live in `.vibekit/docs/BACKBONE_REFERENCE.md`.
 
 ## Requirements to print before starting
 
@@ -10,17 +10,17 @@ Before writing anything, print this checklist and mark each item as found, missi
 
 1. `backbone.yml` exists.
 2. `AGENTS.md` exists or will be created/merged.
-3. `CLAUDE.md` exists or will be created from `CLAUDE-template.md` when Claude support is installed.
+3. `CLAUDE.md` exists or will be created from `.vibekit/init/CLAUDE-template.md` when Claude support is installed.
 4. At least one harness folder exists: `.claude/`, `.cursor/`, `.agents/`, or `.codex-plugin/`.
 5. Git status is known. If user changes exist, do not overwrite them.
-6. A validation command is inferred or set to `node .vbkit-scripts/validate-kit.mjs .` for the kit itself.
+6. A validation command is inferred or set to `node .vibekit/scripts/validate-kit.mjs .` for the kit itself.
 7. Protected paths include `.env*`, secrets, lockfiles, generated files, build output, migrations, and infra unless the user says otherwise.
 8. Existing naming, architecture, resource, and localization conventions are scanned or marked missing.
 
 ## Canonical prompt
 
 ```text
-Read FIRST_TIME_INIT.md and initialize this repo with Minimal Vibe Coding Kit.
+Read .vibekit/init/FIRST_TIME_INIT.md and initialize this repo with Minimal Vibe Coding Kit.
 First print the requirements you will check. Then run detection, propose one diff for backbone.yml and managed instruction blocks, and wait for my yes before writing.
 Include inferred project conventions for naming, architecture, resources, localization, generated definitions, and per-app/package differences.
 After approval, write the files, run validation, and summarize what changed.
@@ -64,9 +64,9 @@ Ask (keep it short):
 
 Then:
 
-- If `project.prd` is `none`, propose creating `.vbkit-docs/PRD.md` from `.vbkit-docs/templates/PRD_TEMPLATE.md` using the answers, and set `project.prd` to that path in the same diff.
+- If `project.prd` is `none`, propose creating `.vibekit/docs/PRD.md` from `.vibekit/docs/templates/PRD_TEMPLATE.md` using the answers, and set `project.prd` to that path in the same diff.
 - If a PRD already exists, read it, link it in `project.prd`, and offer to refresh it without overwriting unapproved content.
-- Record domain terms and acronyms in `.vbkit-docs/CONTEXT.md` (scaffold from `.vbkit-docs/templates/CONTEXT_TEMPLATE.md`) and link it in `project.context`, so future agents stay concise.
+- Record domain terms and acronyms in `.vibekit/docs/CONTEXT.md` (scaffold from `.vibekit/docs/templates/CONTEXT_TEMPLATE.md`) and link it in `project.context`, so future agents stay concise.
 - Keep the PRD short: it captures intent and focus, not a full specification.
 
 ## FIRST_TIME_INIT_RULES
@@ -85,7 +85,7 @@ Create project rules from evidence in the existing repo, not from a fixed langua
 Optional helper:
 
 ```bash
-node .vbkit-scripts/init-backbone.mjs . --propose
+node .vibekit/scripts/init-backbone.mjs . --propose
 ```
 
 ## Propose before writing
@@ -117,14 +117,14 @@ Apply this proposed backbone and convention rules? Reply yes, edit, or abort.
 CLI helper after approval:
 
 ```bash
-node .vbkit-scripts/init-backbone.mjs . --write --yes
+node .vibekit/scripts/init-backbone.mjs . --write --yes
 ```
 
 ## Merge rules
 
 ### CLAUDE.md
 
-- If no `CLAUDE.md` exists, copy `CLAUDE-template.md` to `CLAUDE.md`.
+- If no `CLAUDE.md` exists, copy `.vibekit/init/CLAUDE-template.md` to `CLAUDE.md`.
 - If `CLAUDE.md` exists, append or replace only this managed block:
 
 ```markdown
@@ -134,7 +134,7 @@ node .vbkit-scripts/init-backbone.mjs . --write --yes
 ## Minimal Vibe Coding Kit
 
 - Read `backbone.yml` before changing code.
-- If `meta.template_status` is `uninitialized`, follow `FIRST_TIME_INIT.md` and wait for approval before writing.
+- If `meta.template_status` is `uninitialized`, follow `.vibekit/init/FIRST_TIME_INIT.md` and wait for approval before writing.
 - After init, follow `backbone.yml` `conventions` before adding new project patterns.
 - Prefer project skills for multi-step workflows: `/autoresearch-coding`, `/security-scan`, `/daily-enhance`.
 <!-- END: minimal-vibe-coding-kit -->
@@ -150,10 +150,10 @@ node .vbkit-scripts/init-backbone.mjs . --write --yes
 
 Once init is `initialized` and the first prompt is complete, the bootstrap files are no longer needed in the project. Offer to graduate them so the repo stays clean.
 
-- Preview: `node .vbkit-scripts/vibekit-finalize.mjs . --propose`
-- Apply after the user agrees: `node .vbkit-scripts/vibekit-finalize.mjs . --write --yes`
+- Preview: `node .vibekit/scripts/vibekit-finalize.mjs . --propose`
+- Apply after the user agrees: `node .vibekit/scripts/vibekit-finalize.mjs . --write --yes`
 
-This moves one-time files (`FIRST_TIME_INIT.md`, `FIRST_PROMPT.md`, `PUSH_TO_GITHUB.md`, `CLAUDE-template.md` once `CLAUDE.md` exists) into the folder named by `automation.finalize.cleanup_dir` (default `_vibekit-cleanup/`), writes a `RESTORE.md`, and sets `automation.finalize.marker`. It is idempotent, reversible with `--restore --write`, and refuses to run on the kit source repo. The durable project map is `backbone.yml`; none of the graduated files are needed to keep working. Delete the cleanup folder when satisfied.
+This moves one-time files (`.vibekit/init/FIRST_TIME_INIT.md`, `.vibekit/init/FIRST_PROMPT.md`, `.vibekit/init/PUSH_TO_GITHUB.md`, `.vibekit/init/CLAUDE-template.md` once `CLAUDE.md` exists) into the folder named by `automation.finalize.cleanup_dir` (default `_vibekit-cleanup/`), writes a `RESTORE.md`, and sets `automation.finalize.marker`. It is idempotent, reversible with `--restore --write`, and refuses to run on the kit source repo. The durable project map is `backbone.yml`; none of the graduated files are needed to keep working. Delete the cleanup folder when satisfied.
 
 ## Guardrails
 

package/{.vbkit-scripts → .vibekit/scripts}/agentshield-probe.mjs

@@ -5,7 +5,7 @@ import { spawnSync } from 'node:child_process';
 
 const target = path.resolve(process.argv[2] || process.cwd());
 const extra = process.argv.slice(3);
-const probe = path.join(target, 'skills/agentshield-security-review/scripts/agentshield_repo_probe.py');
+const probe = path.join(target, '.vibekit/skills/agentshield-security-review/scripts/agentshield_repo_probe.py');
 
 if (!fs.existsSync(probe)) {
   console.error(`AgentShield probe not found: ${path.relative(target, probe)}`);

package/{.vbkit-scripts → .vibekit/scripts}/daily-enhance.mjs

@@ -25,17 +25,17 @@ function list(dir) {
 }
 
 const checks = [];
-for (const rel of ['backbone.yml', 'AGENTS.md', 'FIRST_TIME_INIT.md', 'skills/autoresearch-coding/SKILL.md', 'skills/agentshield-security-review/SKILL.md']) {
+for (const rel of ['backbone.yml', 'AGENTS.md', '.vibekit/init/FIRST_TIME_INIT.md', '.vibekit/skills/autoresearch-coding/SKILL.md', '.vibekit/skills/agentshield-security-review/SKILL.md']) {
   checks.push(`- ${rel}: ${exists(rel) ? 'found' : 'missing'}`);
 }
 
-const skills = list('skills').filter((f) => f.endsWith('SKILL.md'));
+const skills = list('.vibekit/skills').filter((f) => f.endsWith('SKILL.md'));
 const claudeSkills = list('.claude/skills').filter((f) => f.endsWith('SKILL.md'));
 const codexSkills = list('.agents/skills').filter((f) => f.endsWith('SKILL.md'));
 const cursorRules = list('.cursor/rules').filter((f) => f.endsWith('.mdc'));
 
 let validation = 'not run';
-const validator = path.join(target, '.vbkit-scripts/validate-kit.mjs');
+const validator = path.join(target, '.vibekit/scripts/validate-kit.mjs');
 if (fs.existsSync(validator)) {
   const result = spawnSync(process.execPath, [validator, target], { encoding: 'utf8' });
   validation = result.stdout.trim() || result.stderr.trim() || `exit ${result.status}`;

package/{.vbkit-scripts → .vibekit/scripts}/doctor.mjs

@@ -122,7 +122,7 @@ function runNodeScript(rel, extra = []) {
 }
 
 function runProbe() {
-  const nodeProbeRel = '.vbkit-scripts/agentshield-probe.mjs';
+  const nodeProbeRel = '.vibekit/scripts/agentshield-probe.mjs';
   const nodeProbe = path.join(target, nodeProbeRel);
   if (fs.existsSync(nodeProbe)) {
     const result = spawnSync(process.execPath, [nodeProbe, target, '--json'], { encoding: 'utf8' });
@@ -134,7 +134,7 @@ function runProbe() {
     };
   }
 
-  const probe = path.join(target, 'skills/agentshield-security-review/scripts/agentshield_repo_probe.py');
+  const probe = path.join(target, '.vibekit/skills/agentshield-security-review/scripts/agentshield_repo_probe.py');
   if (!fs.existsSync(probe)) return { found: false, status: null, output: 'missing' };
   for (const python of ['python', 'python3']) {
     const result = spawnSync(python, [probe, target, '--json'], { encoding: 'utf8' });
@@ -161,7 +161,7 @@ const kitVersion = isKitTemplate
   : exists('.vibekit/KIT_VERSION') ? read('.vibekit/KIT_VERSION').trim() : 'unknown';
 const surfaces = {
   agents: exists('AGENTS.md'),
-  claude: exists('CLAUDE.md') || exists('CLAUDE-template.md') || exists('.claude'),
+  claude: exists('CLAUDE.md') || exists('.vibekit/init/CLAUDE-template.md') || exists('.claude'),
   cursor: exists('.cursor/rules'),
   codex: exists('.agents') || exists('.codex-plugin/plugin.json')
 };
@@ -180,7 +180,7 @@ const legacySurfaces = [
 ].filter(exists);
 const nativeReasoningSkills = ['clearthought', 'sequential-thinking', 'reviewing-4p-priorities'];
 const nativeSkillSurfaces = {
-  shared: 'skills',
+  shared: '.vibekit/skills',
   claude: '.claude/skills',
   codex: '.agents/skills',
   cursor: '.cursor/skills'
@@ -192,7 +192,7 @@ for (const [surface, dir] of Object.entries(nativeSkillSurfaces)) {
   }
 }
 const commands = commandMap();
-const validation = runNodeScript('.vbkit-scripts/validate-kit.mjs');
+const validation = runNodeScript('.vibekit/scripts/validate-kit.mjs');
 const probe = runProbe();
 const risks = [];
 
@@ -239,7 +239,7 @@ const report = {
     status: probe.status
   },
   aiRulesLoaded: {
-    sharedSkills: listFiles('skills').filter((f) => f.endsWith('SKILL.md')).length,
+    sharedSkills: listFiles('.vibekit/skills').filter((f) => f.endsWith('SKILL.md')).length,
     claudeSkills: listFiles('.claude/skills').filter((f) => f.endsWith('SKILL.md')).length,
     codexSkills: listFiles('.agents/skills').filter((f) => f.endsWith('SKILL.md')).length,
     cursorSkills: listFiles('.cursor/skills').filter((f) => f.endsWith('SKILL.md')).length,

package/{.vbkit-scripts → .vibekit/scripts}/init-backbone.mjs

@@ -92,22 +92,22 @@ function cleanName(name) {
 }
 
 function isKitManagedPath(file) {
-  const managedRoots = new Set(['.claude', '.cursor', '.agents', '.codex', '.codex-plugin', 'skills', '.vbkit-commands', '.vbkit-docs', '.vbkit-scripts']);
+  const managedRoots = new Set(['.claude', '.cursor', '.agents', '.codex', '.codex-plugin', '.vibekit']);
   const managedFiles = new Set([
     'AGENTS.md',
-    'CLAUDE-template.md',
-    'FIRST_PROMPT.md',
-    'FIRST_TIME_INIT.md',
+    '.vibekit/init/CLAUDE-template.md',
+    '.vibekit/init/FIRST_PROMPT.md',
+    '.vibekit/init/FIRST_TIME_INIT.md',
     'backbone.yml',
-    '.vbkit-scripts/mvck.mjs',
-    '.vbkit-scripts/init-backbone.mjs',
-    '.vbkit-scripts/daily-enhance.mjs',
-    '.vbkit-scripts/validate-kit.mjs',
-    '.vbkit-scripts/doctor.mjs',
-    '.vbkit-scripts/test-install.mjs',
-    '.vbkit-scripts/agentshield-probe.mjs',
-    '.vbkit-scripts/pack-dry-run.mjs',
-    '.vbkit-scripts/vibekit-finalize.mjs'
+    '.vibekit/scripts/mvck.mjs',
+    '.vibekit/scripts/init-backbone.mjs',
+    '.vibekit/scripts/daily-enhance.mjs',
+    '.vibekit/scripts/validate-kit.mjs',
+    '.vibekit/scripts/doctor.mjs',
+    '.vibekit/scripts/test-install.mjs',
+    '.vibekit/scripts/agentshield-probe.mjs',
+    '.vibekit/scripts/pack-dry-run.mjs',
+    '.vibekit/scripts/vibekit-finalize.mjs'
   ]);
   const root = file.split('/')[0];
   return managedRoots.has(root) || managedFiles.has(file);
@@ -514,10 +514,10 @@ function detectConventions(files, type) {
 }
 
 const PRD_CANDIDATES = [
-  'PRD.md', '.vbkit-docs/PRD.md', 'prd.md', '.vbkit-docs/prd.md',
-  'REQUIREMENTS.md', '.vbkit-docs/REQUIREMENTS.md',
-  'SPEC.md', '.vbkit-docs/SPEC.md', '.vbkit-docs/spec.md',
-  'PRODUCT.md', '.vbkit-docs/PRODUCT.md'
+  'PRD.md', '.vibekit/docs/PRD.md', 'prd.md', '.vibekit/docs/prd.md',
+  'REQUIREMENTS.md', '.vibekit/docs/REQUIREMENTS.md',
+  'SPEC.md', '.vibekit/docs/SPEC.md', '.vibekit/docs/spec.md',
+  'PRODUCT.md', '.vibekit/docs/PRODUCT.md'
 ];
 
 function countCodeFiles(files) {
@@ -538,7 +538,7 @@ function detectPrd(files) {
 }
 
 function detectContext() {
-  for (const candidate of ['.vbkit-docs/CONTEXT.md', 'CONTEXT.md', '.vbkit-docs/context.md']) {
+  for (const candidate of ['.vibekit/docs/CONTEXT.md', 'CONTEXT.md', '.vibekit/docs/context.md']) {
     if (fileExists(candidate)) return candidate;
   }
   return 'none';
@@ -547,7 +547,7 @@ function detectContext() {
 function render(data) {
   const cmd = data.commands;
   const rules = data.conventions;
-  return `# Minimal Vibe Coding Kit backbone. See .vbkit-docs/BACKBONE_REFERENCE.md for details.\nversion: 2\nmeta:\n  template_status: initialized\n  initialized_at: ${yamlString(data.initializedAt)}\n  template_source: minimal-vibe-coding-kit\n  schema_version: 3\n  init_runbook: FIRST_TIME_INIT.md\n  init_done_marker: .vibekit/INIT_DONE\n\nproject:\n  name: ${yamlString(data.name)}\n  description: ${yamlString(data.description)}\n  type: ${data.type}\n  primary_language: ${data.language}\n  package_manager: ${data.packageManager}\n  mode: ${data.mode}\n  prd: ${yamlString(data.prd)}\n  context: ${yamlString(data.context)}\n\npaths:\n  root: .\n  apps:${yamlList(data.appPaths, 4)}\n  source: ${JSON.stringify(data.sourcePaths)}\n  tests: ${JSON.stringify(data.testPaths)}\n  docs: [README.md, .vbkit-docs/]\n  generated: [node_modules/, dist/, build/, coverage/]\n\nconventions:\n  review_required_before_write: true\n  scope: ${yamlString(rules.scope)}\n  naming:\n    files: ${yamlString(rules.naming.files)}\n    directories: ${yamlString(rules.naming.directories)}\n    symbols: follow existing language and framework conventions in nearby code\n    evidence:${yamlList(rules.naming.evidence, 6)}\n  architecture:\n    detected:${yamlList(rules.architecture.detected, 6)}\n    rule: ${yamlString(rules.architecture.rule)}\n  resources:\n    detected_asset_roots:${yamlList(rules.resources.assetRoots, 6)}\n    detected_registries:${yamlList(rules.resources.registries, 6)}\n    rule: ${yamlString(rules.resources.rule)}\n  localization:\n    detected_catalogs:${yamlList(rules.localization.catalogs, 6)}\n    detected_accessors:${yamlList(rules.localization.accessors, 6)}\n    rule: ${yamlString(rules.localization.rule)}\n  custom_rules:\n    - Add team-specific rules here during init review; future agents must follow them.\n\ncommands:\n  install: ${yamlString(cmd.install)}\n  test: ${yamlString(cmd.test)}\n  lint: ${yamlString(cmd.lint)}\n  typecheck: ${yamlString(cmd.typecheck)}\n  build: ${yamlString(cmd.build)}\n  validate: ${yamlString(cmd.validate)}\n\npolicy:\n  default_branch: main\n  branch_naming: "feat/<short-topic>"\n  commit_style: conventional\n  editable_paths: [.]\n  protected_paths:\n    - .git/\n    - .env*\n    - "**/*secret*"\n    - "**/*token*"\n    - "**/migrations/**"\n    - "**/node_modules/**"\n    - "**/dist/**"\n    - "**/build/**"\n    - "**/coverage/**"\n    - "**/*lock*"\n\nagent_surfaces:\n  claude: .claude/\n  cursor: .cursor/\n  codex: .agents/\n  codex_plugin: .codex-plugin/plugin.json\n  shared_skills: skills/\n  shared_commands: .vbkit-commands/\n\nautomation:\n  autoresearch:\n    results_file: results.tsv\n    logs_dir: .autoresearch/logs\n    default_budget: 3\n    default_timeout_seconds: 600\n  daily_enhance:\n    report_dir: .vibekit/reports\n    write_mode: propose_only\n  finalize:\n    cleanup_dir: _vibekit-cleanup\n    marker: .vibekit/FINALIZE_DONE\n    one_time_files: [FIRST_TIME_INIT.md, FIRST_PROMPT.md, PUSH_TO_GITHUB.md, CLAUDE-template.md]\n  security:\n    probe: node .vbkit-scripts/agentshield-probe.mjs .\n    scan: npx ecc-agentshield scan --path . --format text --min-severity medium\n`;
+  return `# Minimal Vibe Coding Kit backbone. See .vibekit/docs/BACKBONE_REFERENCE.md for details.\nversion: 2\nmeta:\n  template_status: initialized\n  initialized_at: ${yamlString(data.initializedAt)}\n  template_source: minimal-vibe-coding-kit\n  schema_version: 3\n  init_runbook: .vibekit/init/FIRST_TIME_INIT.md\n  init_done_marker: .vibekit/INIT_DONE\n\nproject:\n  name: ${yamlString(data.name)}\n  description: ${yamlString(data.description)}\n  type: ${data.type}\n  primary_language: ${data.language}\n  package_manager: ${data.packageManager}\n  mode: ${data.mode}\n  prd: ${yamlString(data.prd)}\n  context: ${yamlString(data.context)}\n\npaths:\n  root: .\n  apps:${yamlList(data.appPaths, 4)}\n  source: ${JSON.stringify(data.sourcePaths)}\n  tests: ${JSON.stringify(data.testPaths)}\n  docs: [README.md, .vibekit/docs/]\n  generated: [node_modules/, dist/, build/, coverage/]\n\nconventions:\n  review_required_before_write: true\n  scope: ${yamlString(rules.scope)}\n  naming:\n    files: ${yamlString(rules.naming.files)}\n    directories: ${yamlString(rules.naming.directories)}\n    symbols: follow existing language and framework conventions in nearby code\n    evidence:${yamlList(rules.naming.evidence, 6)}\n  architecture:\n    detected:${yamlList(rules.architecture.detected, 6)}\n    rule: ${yamlString(rules.architecture.rule)}\n  resources:\n    detected_asset_roots:${yamlList(rules.resources.assetRoots, 6)}\n    detected_registries:${yamlList(rules.resources.registries, 6)}\n    rule: ${yamlString(rules.resources.rule)}\n  localization:\n    detected_catalogs:${yamlList(rules.localization.catalogs, 6)}\n    detected_accessors:${yamlList(rules.localization.accessors, 6)}\n    rule: ${yamlString(rules.localization.rule)}\n  custom_rules:\n    - Add team-specific rules here during init review; future agents must follow them.\n\ncommands:\n  install: ${yamlString(cmd.install)}\n  test: ${yamlString(cmd.test)}\n  lint: ${yamlString(cmd.lint)}\n  typecheck: ${yamlString(cmd.typecheck)}\n  build: ${yamlString(cmd.build)}\n  validate: ${yamlString(cmd.validate)}\n\npolicy:\n  default_branch: main\n  branch_naming: "feat/<short-topic>"\n  commit_style: conventional\n  editable_paths: [.]\n  protected_paths:\n    - .git/\n    - .env*\n    - "**/*secret*"\n    - "**/*token*"\n    - "**/migrations/**"\n    - "**/node_modules/**"\n    - "**/dist/**"\n    - "**/build/**"\n    - "**/coverage/**"\n    - "**/*lock*"\n\nagent_surfaces:\n  claude: .claude/\n  cursor: .cursor/\n  codex: .agents/\n  codex_plugin: .codex-plugin/plugin.json\n  shared_skills: .vibekit/skills/\n  shared_commands: .vibekit/commands/\n\nautomation:\n  autoresearch:\n    results_file: results.tsv\n    logs_dir: .autoresearch/logs\n    default_budget: 3\n    default_timeout_seconds: 600\n  daily_enhance:\n    report_dir: .vibekit/reports\n    write_mode: propose_only\n  finalize:\n    cleanup_dir: _vibekit-cleanup\n    marker: .vibekit/FINALIZE_DONE\n    one_time_files: [.vibekit/init/FIRST_TIME_INIT.md, .vibekit/init/FIRST_PROMPT.md, .vibekit/init/PUSH_TO_GITHUB.md, .vibekit/init/CLAUDE-template.md]\n  security:\n    probe: node .vibekit/scripts/agentshield-probe.mjs .\n    scan: npx ecc-agentshield scan --path . --format text --min-severity medium\n`;
 }
 
 function inferPaths(files) {
@@ -614,15 +614,15 @@ if (shouldWrite) {
   console.log('- What are the key constraints or non-goals?');
   if (inferred.mode === 'brownfield') console.log('- Which existing area should we focus on improving first?');
   console.log(inferred.prd === 'none'
-    ? '- Offer to create .vbkit-docs/PRD.md from .vbkit-docs/templates/PRD_TEMPLATE.md using the answers.'
+    ? '- Offer to create .vibekit/docs/PRD.md from .vibekit/docs/templates/PRD_TEMPLATE.md using the answers.'
     : `- Offer to refresh ${inferred.prd} with the answers; do not overwrite without approval.`);
   console.log(inferred.context === 'none'
-    ? '- Offer to create .vbkit-docs/CONTEXT.md (glossary) from .vbkit-docs/templates/CONTEXT_TEMPLATE.md.'
+    ? '- Offer to create .vibekit/docs/CONTEXT.md (glossary) from .vibekit/docs/templates/CONTEXT_TEMPLATE.md.'
     : `- CONTEXT glossary found at ${inferred.context}; keep it current.`);
   console.log('\nConvention review questions:');
   for (const question of inferred.conventions.reviewQuestions) console.log(`- ${question}`);
   console.log('\nProposed backbone.yml:\n');
   console.log(out);
   console.log('Apply this proposed backbone and convention rules? Reply yes, edit, or abort.');
-  console.log('To write it after approval, run: node .vbkit-scripts/init-backbone.mjs . --write --yes');
+  console.log('To write it after approval, run: node .vibekit/scripts/init-backbone.mjs . --write --yes');
 }

package/{.vbkit-scripts → .vibekit/scripts}/mvck.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from 'node:child_process';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-const kitRoot = path.resolve(__dirname, '..');
+const kitRoot = path.resolve(__dirname, '..', '..');
 const args = process.argv.slice(2);
 
 function usage() {
@@ -22,12 +22,12 @@ Usage:
   mvck finalize [target] [--write --yes] [--restore] [--json]
 
 Examples:
-  node .vbkit-scripts/mvck.mjs install ~/work/my-repo --profile all
+  node .vibekit/scripts/mvck.mjs install ~/work/my-repo --profile all
   npx --yes minimal-vibe-coding-kit@latest update .
-  node .vbkit-scripts/mvck.mjs init . --propose
-  node .vbkit-scripts/mvck.mjs doctor .
-  node .vbkit-scripts/mvck.mjs validate .
-  node .vbkit-scripts/mvck.mjs finalize .
+  node .vibekit/scripts/mvck.mjs init . --propose
+  node .vibekit/scripts/mvck.mjs doctor .
+  node .vibekit/scripts/mvck.mjs validate .
+  node .vibekit/scripts/mvck.mjs finalize .
 
 update refreshes kit-owned files (skills, commands, rules, scripts, docs, agent
 mirrors) to the running kit version. It never overwrites user-owned files
@@ -98,13 +98,14 @@ function copyFileSafe(srcRel, destRel, target, { force = false, dryRun = false }
   return { action: fs.existsSync(dest) && force ? 'replace' : 'copy', path: destRel ?? srcRel };
 }
 
-function copyDirSafe(srcRel, destRel, target, { force = false, dryRun = false } = {}) {
+function copyDirSafe(srcRel, destRel, target, { force = false, dryRun = false, exclude = [] } = {}) {
   const src = path.join(kitRoot, srcRel);
   const destRoot = path.join(target, destRel ?? srcRel);
   if (!fs.existsSync(src)) throw new Error(`Missing source dir: ${srcRel}`);
   let copied = 0;
   let skipped = 0;
   function copyRecursive(from, to) {
+    if (exclude.includes(path.relative(src, from).replaceAll(path.sep, '/'))) return;
     const stat = fs.statSync(from);
     if (stat.isDirectory()) {
       if (!dryRun) fs.mkdirSync(to, { recursive: true });
@@ -149,19 +150,30 @@ function managedBlockFromTemplate(block, begin, end) {
   return `${begin}\n${block.trim()}\n${end}`;
 }
 
-const KIT_SEED_FILES = ['FIRST_TIME_INIT.md', 'FIRST_PROMPT.md', 'CLAUDE-template.md', 'backbone.yml'];
-const KIT_SHARED_DIRS = ['skills', '.vbkit-commands', '.vbkit-docs'];
+const KIT_SEED_FILES = ['.vibekit/init/FIRST_TIME_INIT.md', '.vibekit/init/FIRST_PROMPT.md', '.vibekit/init/CLAUDE-template.md', 'backbone.yml'];
+const KIT_SHARED_DIRS = ['.vibekit/skills', '.vibekit/commands', '.vibekit/docs'];
+// Kit-maintainer files that end-user repos do not need; never copied by install/update.
+const KIT_DOC_EXCLUDES = ['RESEARCH_NOTES.md', 'AUTORESEARCH_LEDGER.md'];
 const KIT_SCRIPTS = [
-  '.vbkit-scripts/mvck.mjs', '.vbkit-scripts/init-backbone.mjs', '.vbkit-scripts/daily-enhance.mjs', '.vbkit-scripts/validate-kit.mjs',
-  '.vbkit-scripts/doctor.mjs', '.vbkit-scripts/test-install.mjs', '.vbkit-scripts/agentshield-probe.mjs', '.vbkit-scripts/pack-dry-run.mjs', '.vbkit-scripts/vibekit-finalize.mjs'
+  '.vibekit/scripts/mvck.mjs', '.vibekit/scripts/init-backbone.mjs', '.vibekit/scripts/daily-enhance.mjs', '.vibekit/scripts/validate-kit.mjs',
+  '.vibekit/scripts/doctor.mjs', '.vibekit/scripts/agentshield-probe.mjs', '.vibekit/scripts/vibekit-finalize.mjs'
 ];
+const VALID_PROFILES = new Set(['claude', 'cursor', 'codex']);
+
+function parseProfiles(profileRaw) {
+  const profiles = new Set(profileRaw === 'all' ? ['claude', 'cursor', 'codex'] : profileRaw.split(',').map((x) => x.trim()).filter(Boolean));
+  for (const p of profiles) {
+    if (!VALID_PROFILES.has(p)) throw new Error(`Unknown profile: ${p}. Valid values: all, claude, cursor, codex (comma-separated).`);
+  }
+  return profiles;
+}
 const CLAUDE_DIRS = ['.claude/agents', '.claude/commands', '.claude/rules'];
 const CLAUDE_SKILLS = [
   'autoresearch-coding', 'agentshield-security-review', 'daily-workflow-curator', 'vibekit-init', 'visual-design-loop',
-  'clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'memento', 'coding-level'
+  'clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis'
 ];
 const CURSOR_DIRS = ['.cursor/rules', '.cursor/commands'];
-const CURSOR_SKILLS = ['clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'memento', 'coding-level'];
+const CURSOR_SKILLS = ['clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis'];
 const CODEX_DIRS = ['.agents', '.codex', '.codex-plugin'];
 const GITIGNORE_BLOCK = `# BEGIN: minimal-vibe-coding-kit\n.autoresearch/\nresults.tsv\n.vibekit/INIT_DONE\n.vibekit/FINALIZE_DONE\n.vibekit/reports/\n.vibekit/update-backup/\n_vibekit-cleanup/\nCLAUDE.local.md\n# END: minimal-vibe-coding-kit`;
 
@@ -187,9 +199,9 @@ function applyManagedBlocks(target, profiles, actions, { dryRun = false } = {})
   if (profiles.has('claude')) {
     const claudeTarget = path.join(target, 'CLAUDE.md');
     if (!fs.existsSync(claudeTarget)) {
-      actions.push(copyFileSafe('CLAUDE-template.md', 'CLAUDE.md', target, { force: false, dryRun }));
+      actions.push(copyFileSafe('.vibekit/init/CLAUDE-template.md', 'CLAUDE.md', target, { force: false, dryRun }));
     } else {
-      const block = `<!-- BEGIN: minimal-vibe-coding-kit -->\n@AGENTS.md\n\n## Minimal Vibe Coding Kit\n\n- Read \`backbone.yml\` before changing code.\n- If \`meta.template_status\` is \`uninitialized\`, follow \`FIRST_TIME_INIT.md\` and wait for approval before writing.\n- After init, follow \`backbone.yml\` \`conventions\` before adding new project patterns.\n- Prefer project skills for multi-step workflows: \`/autoresearch-coding\`, \`/security-scan\`, \`/daily-enhance\`.\n<!-- END: minimal-vibe-coding-kit -->`;
+      const block = `<!-- BEGIN: minimal-vibe-coding-kit -->\n@AGENTS.md\n\n## Minimal Vibe Coding Kit\n\n- Read \`backbone.yml\` before changing code.\n- If \`meta.template_status\` is \`uninitialized\`, follow \`.vibekit/init/FIRST_TIME_INIT.md\` and wait for approval before writing.\n- After init, follow \`backbone.yml\` \`conventions\` before adding new project patterns.\n- Prefer project skills for multi-step workflows: \`/autoresearch-coding\`, \`/security-scan\`, \`/daily-enhance\`.\n<!-- END: minimal-vibe-coding-kit -->`;
       appendManagedBlock(claudeTarget, block, '<!-- BEGIN: minimal-vibe-coding-kit -->', '<!-- END: minimal-vibe-coding-kit -->', { dryRun });
       actions.push({ action: 'managed-block', path: 'CLAUDE.md' });
     }
@@ -213,8 +225,7 @@ function install() {
   const dryRun = hasFlag('--dry-run');
   const json = hasFlag('--json');
   const target = parseTargetAndFlags('install', { valueFlags: ['--profile'] }).target;
-  const profileRaw = optionValue('--profile', 'all');
-  const profiles = new Set(profileRaw === 'all' ? ['claude', 'cursor', 'codex'] : profileRaw.split(',').map((x) => x.trim()).filter(Boolean));
+  const profiles = parseProfiles(optionValue('--profile', 'all'));
 
   if (!fs.existsSync(target)) throw new Error(`Target does not exist: ${target}`);
   const actions = [];
@@ -224,7 +235,7 @@ function install() {
     actions.push(copyFileSafe(file, file, target, opts));
   }
   for (const dir of KIT_SHARED_DIRS) {
-    actions.push(copyDirSafe(dir, dir, target, opts));
+    actions.push(copyDirSafe(dir, dir, target, dir === '.vibekit/docs' ? { ...opts, exclude: KIT_DOC_EXCLUDES } : opts));
   }
   for (const file of KIT_SCRIPTS) {
     actions.push(copyFileSafe(file, file, target, opts));
@@ -258,7 +269,8 @@ function install() {
   writeKitVersion(target, dryRun);
   actions.push({ action: 'version-marker', path: '.vibekit/KIT_VERSION' });
 
-  const nextPrompt = 'Read FIRST_TIME_INIT.md and initialize this repo with Minimal Vibe Coding Kit. Print requirements first, infer project conventions, propose a diff, and wait for my yes before writing.';
+  const nextPrompt = 'Read .vibekit/init/FIRST_TIME_INIT.md and initialize this repo with Minimal Vibe Coding Kit. Print requirements first, infer project conventions, propose a diff, and wait for my yes before writing.';
+  const legacyPaths = detectLegacyLayout(target);
   if (json) {
     console.log(JSON.stringify({
       status: dryRun ? 'dry-run' : 'installed',
@@ -267,6 +279,7 @@ function install() {
       force,
       dryRun,
       actions,
+      legacyPaths,
       nextPrompt
     }, null, 2));
     return;
@@ -274,10 +287,29 @@ function install() {
 
   console.log(dryRun ? 'Dry-run install plan:' : 'Install complete:');
   for (const a of actions) console.log(`- ${a.action}: ${a.path}`);
+  printLegacyLayoutNote(legacyPaths);
   console.log('\nNext prompt:');
   console.log(nextPrompt);
 }
 
+// Pre-0.4 installs placed kit dirs at the target root. Detection is advisory
+// only: nothing is deleted automatically, and a root `skills/` dir is flagged
+// only when it contains a known kit skill (it may be the user's own folder).
+function detectLegacyLayout(target) {
+  const legacy = ['.vbkit-scripts', '.vbkit-commands', '.vbkit-docs',
+    'FIRST_TIME_INIT.md', 'FIRST_PROMPT.md', 'CLAUDE-template.md', 'PUSH_TO_GITHUB.md']
+    .filter((rel) => fs.existsSync(path.join(target, rel)));
+  if (fs.existsSync(path.join(target, 'skills', 'vibekit-init', 'SKILL.md'))) legacy.push('skills');
+  return legacy;
+}
+
+function printLegacyLayoutNote(legacy) {
+  if (!legacy.length) return;
+  console.log('\nLegacy kit layout detected (pre-0.4). Kit files now live under .vibekit/.');
+  console.log('After verifying the new .vibekit/ copies, remove or `git mv` these leftovers:');
+  for (const rel of legacy) console.log(`- ${rel}`);
+}
+
 function updateFileSafe(srcRel, destRel, target, { dryRun = false, backup = null } = {}) {
   const src = path.join(kitRoot, srcRel);
   const dest = path.join(target, destRel ?? srcRel);
@@ -312,10 +344,12 @@ function updateFileSafe(srcRel, destRel, target, { dryRun = false, backup = null
 function updateDirSafe(srcRel, target, opts) {
   const src = path.join(kitRoot, srcRel);
   if (!fs.existsSync(src)) throw new Error(`Missing source dir: ${srcRel}`);
+  const exclude = opts.exclude ?? [];
   const results = [];
   function walk(current) {
     for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
       const child = path.join(current, entry.name);
+      if (exclude.includes(path.relative(src, child).replaceAll(path.sep, '/'))) continue;
       if (entry.isDirectory()) walk(child);
       else {
         const rel = path.join(srcRel, path.relative(src, child)).replaceAll(path.sep, '/');
@@ -332,15 +366,14 @@ function update() {
   const json = hasFlag('--json');
   const noBackup = hasFlag('--no-backup');
   const target = parseTargetAndFlags('update', { valueFlags: ['--profile'] }).target;
-  const profileRaw = optionValue('--profile', 'all');
-  const profiles = new Set(profileRaw === 'all' ? ['claude', 'cursor', 'codex'] : profileRaw.split(',').map((x) => x.trim()).filter(Boolean));
+  const profiles = parseProfiles(optionValue('--profile', 'all'));
 
   if (!fs.existsSync(target)) throw new Error(`Target does not exist: ${target}`);
   if (fs.realpathSync(kitRoot) === fs.realpathSync(target)) {
     throw new Error('Update source and target are the same directory. Run the update from a newer kit, e.g.: npx --yes minimal-vibe-coding-kit@latest update .');
   }
-  if (!fs.existsSync(path.join(target, 'backbone.yml')) && !fs.existsSync(path.join(target, '.vbkit-scripts'))) {
-    throw new Error('Kit not detected in target (no backbone.yml or .vbkit-scripts). Run mvck install first.');
+  if (!fs.existsSync(path.join(target, 'backbone.yml')) && !fs.existsSync(path.join(target, '.vibekit/scripts'))) {
+    throw new Error('Kit not detected in target (no backbone.yml or .vibekit/scripts). Run mvck install first.');
   }
 
   const previousVersionFile = path.join(target, '.vibekit', 'KIT_VERSION');
@@ -352,7 +385,7 @@ function update() {
   const actions = [];
 
   // Kit-owned surfaces: refresh to the running kit version, never delete extras.
-  for (const dir of KIT_SHARED_DIRS) actions.push(...updateDirSafe(dir, target, opts));
+  for (const dir of KIT_SHARED_DIRS) actions.push(...updateDirSafe(dir, target, dir === '.vibekit/docs' ? { ...opts, exclude: KIT_DOC_EXCLUDES } : opts));
   for (const file of KIT_SCRIPTS) actions.push(updateFileSafe(file, file, target, opts));
   if (profiles.has('claude')) {
     for (const dir of CLAUDE_DIRS) actions.push(...updateDirSafe(dir, target, opts));
@@ -381,6 +414,7 @@ function update() {
   const backupInfo = backup && backup.count > 0 ? path.relative(target, backup.dir) : null;
   const preserved = ['backbone.yml', 'CLAUDE.md', 'AGENTS.md content outside the managed block', '.claude/settings.json', '.cursor/settings.json'];
 
+  const legacyPaths = detectLegacyLayout(target);
   if (json) {
     console.log(JSON.stringify({
       status: dryRun ? 'dry-run' : 'updated',
@@ -391,6 +425,7 @@ function update() {
       summary,
       backupDir: backupInfo,
       preserved,
+      legacyPaths,
       actions: actions.filter((a) => a.action !== 'unchanged')
     }, null, 2));
     return;
@@ -405,11 +440,12 @@ function update() {
   console.log(`\nSummary: ${summary.add} added, ${summary.update} updated, ${summary.unchanged} unchanged.`);
   if (backupInfo) console.log(`Backups of replaced files: ${backupInfo}/`);
   console.log(`Preserved (never overwritten by update): ${preserved.join(', ')}.`);
+  printLegacyLayoutNote(legacyPaths);
 }
 
 function delegate(scriptName, { valueFlags = [] } = {}) {
   const { target, flags } = parseTargetAndFlags(args[0], { valueFlags });
-  const script = path.join(kitRoot, '.vbkit-scripts', scriptName);
+  const script = path.join(kitRoot, '.vibekit/scripts', scriptName);
   const childArgs = [script, target, ...flags];
   const result = spawnSync(process.execPath, childArgs, { stdio: 'inherit' });
   process.exit(result.status ?? 1);

package/{.vbkit-scripts → .vibekit/scripts}/test-install.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
 const __filename = fileURLToPath(import.meta.url);
-const kitRoot = path.resolve(path.dirname(__filename), '..');
+const kitRoot = path.resolve(path.dirname(__filename), '..', '..');
 const node = process.execPath;
 const keep = process.argv.includes('--keep');
 const temps = [];
@@ -44,21 +44,35 @@ function count(text, marker) {
 
 try {
   const clean = tempDir('clean');
-  run(['.vbkit-scripts/mvck.mjs', 'install', clean, '--profile', 'all']);
-  run(['.vbkit-scripts/validate-kit.mjs', clean]);
+  run(['.vibekit/scripts/mvck.mjs', 'install', clean, '--profile', 'all']);
+  run(['.vibekit/scripts/validate-kit.mjs', clean]);
   assert(fs.existsSync(path.join(clean, 'AGENTS.md')), 'clean install creates AGENTS.md');
-  assert(fs.existsSync(path.join(clean, '.vbkit-commands')), 'clean install creates .vbkit-commands');
-  assert(fs.existsSync(path.join(clean, '.vbkit-scripts')), 'clean install creates .vbkit-scripts');
-  assert(fs.existsSync(path.join(clean, '.vbkit-docs')), 'clean install creates .vbkit-docs');
+  assert(fs.existsSync(path.join(clean, '.vibekit/commands')), 'clean install creates .vibekit/commands');
+  assert(fs.existsSync(path.join(clean, '.vibekit/scripts')), 'clean install creates .vibekit/scripts');
+  assert(fs.existsSync(path.join(clean, '.vibekit/docs')), 'clean install creates .vibekit/docs');
   assert(!fs.existsSync(path.join(clean, 'commands')), 'clean install does not create root commands');
   assert(!fs.existsSync(path.join(clean, 'scripts')), 'clean install does not create root scripts');
   assert(!fs.existsSync(path.join(clean, 'docs')), 'clean install does not create root docs');
+  assert(fs.existsSync(path.join(clean, '.vibekit/skills/vibekit-init/SKILL.md')), 'clean install creates .vibekit/skills');
+  assert(fs.existsSync(path.join(clean, '.vibekit/init/FIRST_TIME_INIT.md')), 'clean install seeds init files under .vibekit/init');
+  assert(!fs.existsSync(path.join(clean, 'skills')), 'clean install does not create root skills');
+  assert(!fs.existsSync(path.join(clean, '.vbkit-scripts')), 'clean install does not create legacy .vbkit-scripts');
+  assert(!fs.existsSync(path.join(clean, '.vbkit-commands')), 'clean install does not create legacy .vbkit-commands');
+  assert(!fs.existsSync(path.join(clean, '.vbkit-docs')), 'clean install does not create legacy .vbkit-docs');
+  assert(!fs.existsSync(path.join(clean, 'FIRST_TIME_INIT.md')), 'clean install does not seed root FIRST_TIME_INIT.md');
+  assert(!fs.existsSync(path.join(clean, '.vibekit/scripts/test-install.mjs')), 'clean install omits kit-dev test-install.mjs');
+  assert(!fs.existsSync(path.join(clean, '.vibekit/scripts/pack-dry-run.mjs')), 'clean install omits kit-dev pack-dry-run.mjs');
+  assert(!fs.existsSync(path.join(clean, '.vibekit/docs/RESEARCH_NOTES.md')), 'clean install omits maintainer RESEARCH_NOTES.md');
+  assert(!fs.existsSync(path.join(clean, '.vibekit/docs/AUTORESEARCH_LEDGER.md')), 'clean install omits maintainer AUTORESEARCH_LEDGER.md');
+  assert(fs.existsSync(path.join(clean, '.vibekit/docs/INSTALL.md')), 'clean install keeps end-user docs like INSTALL.md');
+  run(['.vibekit/scripts/mvck.mjs', 'install', clean, '--profile', 'bogus'], { expect: 1 });
+  assert(true, 'install rejects an unknown --profile value');
 
   const existing = tempDir('existing');
   fs.writeFileSync(path.join(existing, 'AGENTS.md'), '# Existing\n');
   fs.writeFileSync(path.join(existing, 'CLAUDE.md'), '# Existing Claude\n');
-  run(['.vbkit-scripts/mvck.mjs', 'install', existing, '--profile', 'all']);
-  run(['.vbkit-scripts/mvck.mjs', 'install', existing, '--profile', 'all']);
+  run(['.vibekit/scripts/mvck.mjs', 'install', existing, '--profile', 'all']);
+  run(['.vibekit/scripts/mvck.mjs', 'install', existing, '--profile', 'all']);
 
   const agents = fs.readFileSync(path.join(existing, 'AGENTS.md'), 'utf8');
   const claude = fs.readFileSync(path.join(existing, 'CLAUDE.md'), 'utf8');
@@ -70,39 +84,39 @@ try {
   assert(count(claude, 'END: minimal-vibe-coding-kit') === 1, 'CLAUDE.md has one managed end marker');
 
   const cwdTarget = tempDir('cwd-target');
-  run([path.join(kitRoot, '.vbkit-scripts/mvck.mjs'), 'install', '--profile', 'all'], { cwd: cwdTarget });
+  run([path.join(kitRoot, '.vibekit/scripts/mvck.mjs'), 'install', '--profile', 'all'], { cwd: cwdTarget });
   assert(fs.existsSync(path.join(cwdTarget, 'backbone.yml')), 'install without target uses current working directory');
 
-  const proposed = run([path.join(kitRoot, '.vbkit-scripts/mvck.mjs'), 'init', '--propose'], { cwd: cwdTarget });
+  const proposed = run([path.join(kitRoot, '.vibekit/scripts/mvck.mjs'), 'init', '--propose'], { cwd: cwdTarget });
   assert(proposed.stdout.includes('Proposed backbone.yml'), 'init --propose without target preserves flag');
 
-  const jsonPlan = run(['.vbkit-scripts/mvck.mjs', 'install', clean, '--dry-run', '--json']);
+  const jsonPlan = run(['.vibekit/scripts/mvck.mjs', 'install', clean, '--dry-run', '--json']);
   const parsed = JSON.parse(jsonPlan.stdout);
   assert(parsed.status === 'dry-run' && parsed.dryRun === true, 'install --dry-run --json returns machine-readable plan');
 
   const upd = tempDir('update');
-  run(['.vbkit-scripts/mvck.mjs', 'install', upd, '--profile', 'all']);
+  run(['.vibekit/scripts/mvck.mjs', 'install', upd, '--profile', 'all']);
   assert(fs.existsSync(path.join(upd, '.vibekit/KIT_VERSION')), 'install stamps .vibekit/KIT_VERSION');
   fs.appendFileSync(path.join(upd, 'backbone.yml'), '# user-custom-line\n');
-  fs.writeFileSync(path.join(upd, 'skills/memento/SKILL.md'), '# stale kit file\n');
+  fs.writeFileSync(path.join(upd, '.vibekit/skills/memento/SKILL.md'), '# stale kit file\n');
   fs.rmSync(path.join(upd, '.claude/skills/coding-level'), { recursive: true, force: true });
 
-  run(['.vbkit-scripts/mvck.mjs', 'update', upd]);
-  assert(fs.readFileSync(path.join(upd, 'skills/memento/SKILL.md'), 'utf8').includes('name: memento'), 'update refreshes stale kit files');
+  run(['.vibekit/scripts/mvck.mjs', 'update', upd]);
+  assert(fs.readFileSync(path.join(upd, '.vibekit/skills/memento/SKILL.md'), 'utf8').includes('name: memento'), 'update refreshes stale kit files');
   assert(fs.existsSync(path.join(upd, '.claude/skills/coding-level/SKILL.md')), 'update re-adds missing kit skill mirrors');
   assert(fs.readFileSync(path.join(upd, 'backbone.yml'), 'utf8').includes('# user-custom-line'), 'update preserves user-modified backbone.yml');
   const backupRoot = path.join(upd, '.vibekit', 'update-backup');
   assert(fs.existsSync(backupRoot) && fs.readdirSync(backupRoot).length >= 1, 'update backs up replaced kit files');
-  run(['.vbkit-scripts/validate-kit.mjs', upd]);
+  run(['.vibekit/scripts/validate-kit.mjs', upd]);
 
   const updAgents = fs.readFileSync(path.join(upd, 'AGENTS.md'), 'utf8');
   assert(count(updAgents, 'BEGIN: minimal-vibe-coding-kit') === 1, 'update keeps one managed begin marker in AGENTS.md');
 
   const emptyTarget = tempDir('update-empty');
-  run(['.vbkit-scripts/mvck.mjs', 'update', emptyTarget], { expect: 1 });
+  run(['.vibekit/scripts/mvck.mjs', 'update', emptyTarget], { expect: 1 });
   assert(true, 'update refuses a target without the kit installed');
 
-  const updPlan = run(['.vbkit-scripts/mvck.mjs', 'update', upd, '--dry-run', '--json']);
+  const updPlan = run(['.vibekit/scripts/mvck.mjs', 'update', upd, '--dry-run', '--json']);
   const updParsed = JSON.parse(updPlan.stdout);
   assert(updParsed.status === 'dry-run' && typeof updParsed.toVersion === 'string', 'update --dry-run --json returns machine-readable plan');