minimal-vibe-coding-kit 0.3.0 → 0.4.0

package/{.vbkit-scripts → .vibekit/scripts}/validate-kit.mjs

@@ -34,24 +34,27 @@ function listFiles(rel) {
 }
 
 const required = [
-  'AGENTS.md', 'CLAUDE-template.md', 'FIRST_TIME_INIT.md', 'FIRST_PROMPT.md', 'backbone.yml',
-  '.vbkit-scripts/mvck.mjs', '.vbkit-scripts/init-backbone.mjs', '.vbkit-scripts/daily-enhance.mjs', '.vbkit-scripts/validate-kit.mjs',
-  '.vbkit-scripts/doctor.mjs', '.vbkit-scripts/test-install.mjs', '.vbkit-scripts/agentshield-probe.mjs', '.vbkit-scripts/pack-dry-run.mjs', '.vbkit-scripts/vibekit-finalize.mjs',
-  'skills/autoresearch-coding/SKILL.md', 'skills/agentshield-security-review/SKILL.md', 'skills/daily-workflow-curator/SKILL.md', 'skills/vibekit-init/SKILL.md',
-  'skills/clearthought/SKILL.md', 'skills/sequential-thinking/SKILL.md', 'skills/reviewing-4p-priorities/SKILL.md', 'skills/visual-design-loop/SKILL.md',
-  'skills/memento/SKILL.md', 'skills/coding-level/SKILL.md',
-  '.vbkit-docs/templates/PRD_TEMPLATE.md', '.vbkit-docs/templates/CONTEXT_TEMPLATE.md',
+  'AGENTS.md', '.vibekit/init/CLAUDE-template.md', '.vibekit/init/FIRST_TIME_INIT.md', '.vibekit/init/FIRST_PROMPT.md', 'backbone.yml',
+  '.vibekit/scripts/mvck.mjs', '.vibekit/scripts/init-backbone.mjs', '.vibekit/scripts/daily-enhance.mjs', '.vibekit/scripts/validate-kit.mjs',
+  '.vibekit/scripts/doctor.mjs', '.vibekit/scripts/agentshield-probe.mjs', '.vibekit/scripts/vibekit-finalize.mjs',
+  '.vibekit/skills/autoresearch-coding/SKILL.md', '.vibekit/skills/agentshield-security-review/SKILL.md', '.vibekit/skills/daily-workflow-curator/SKILL.md', '.vibekit/skills/vibekit-init/SKILL.md',
+  '.vibekit/skills/clearthought/SKILL.md', '.vibekit/skills/sequential-thinking/SKILL.md', '.vibekit/skills/reviewing-4p-priorities/SKILL.md', '.vibekit/skills/visual-design-loop/SKILL.md',
+  '.vibekit/skills/path-sensitive-shell-safety/SKILL.md', '.vibekit/skills/memento/SKILL.md', '.vibekit/skills/coding-level/SKILL.md', '.vibekit/skills/parallel-analysis/SKILL.md',
+  '.vibekit/docs/templates/PRD_TEMPLATE.md', '.vibekit/docs/templates/CONTEXT_TEMPLATE.md',
   '.codex/README.md', '.codex/config.example.toml',
   '.claude/skills/autoresearch-coding/SKILL.md', '.claude/skills/agentshield-security-review/SKILL.md',
   '.claude/skills/daily-workflow-curator/SKILL.md', '.claude/skills/vibekit-init/SKILL.md',
   '.claude/skills/clearthought/SKILL.md', '.claude/skills/sequential-thinking/SKILL.md', '.claude/skills/reviewing-4p-priorities/SKILL.md', '.claude/skills/visual-design-loop/SKILL.md',
-  '.claude/skills/memento/SKILL.md', '.claude/skills/coding-level/SKILL.md',
+  '.claude/skills/path-sensitive-shell-safety/SKILL.md', '.claude/skills/memento/SKILL.md', '.claude/skills/coding-level/SKILL.md',
+  '.claude/skills/parallel-analysis/SKILL.md',
   '.cursor/rules/001-vibe-core.mdc', '.cursor/skills/clearthought/SKILL.md', '.cursor/skills/sequential-thinking/SKILL.md', '.cursor/skills/reviewing-4p-priorities/SKILL.md',
-  '.cursor/skills/memento/SKILL.md', '.cursor/skills/coding-level/SKILL.md',
+  '.cursor/skills/path-sensitive-shell-safety/SKILL.md',
+  '.cursor/skills/memento/SKILL.md', '.cursor/skills/coding-level/SKILL.md', '.cursor/skills/parallel-analysis/SKILL.md',
   '.agents/skills/autoresearch-coding/SKILL.md', '.agents/skills/agentshield-security-review/SKILL.md',
   '.agents/skills/daily-workflow-curator/SKILL.md', '.agents/skills/vibekit-init/SKILL.md',
   '.agents/skills/clearthought/SKILL.md', '.agents/skills/sequential-thinking/SKILL.md', '.agents/skills/reviewing-4p-priorities/SKILL.md', '.agents/skills/visual-design-loop/SKILL.md',
-  '.agents/skills/memento/SKILL.md', '.agents/skills/coding-level/SKILL.md',
+  '.agents/skills/path-sensitive-shell-safety/SKILL.md', '.agents/skills/memento/SKILL.md', '.agents/skills/coding-level/SKILL.md',
+  '.agents/skills/parallel-analysis/SKILL.md',
   '.codex-plugin/plugin.json'
 ];
 
@@ -74,10 +77,13 @@ const reasoningSkillResources = {
   ],
   'reviewing-4p-priorities': [
     'examples.md'
+  ],
+  'path-sensitive-shell-safety': [
+    'references/workflow.md'
   ]
 };
 
-for (const surface of ['skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
+for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
   for (const [skill, files] of Object.entries(reasoningSkillResources)) {
     for (const file of files) required.push(`${surface}/${skill}/${file}`);
   }
@@ -87,18 +93,26 @@ for (const rel of required) exists(rel) ? ok(`required file ${rel}`) : fail(`mis
 if (exists('README.md')) ok('optional README.md present');
 else console.log('INFO optional README.md not present in target project');
 
+// Kit-maintainer files: required in the kit source repo, intentionally absent in end-user installs.
+const isKitSourceRepo = readJson('package.json')?.name === 'minimal-vibe-coding-kit';
+if (isKitSourceRepo) {
+  for (const rel of ['.vibekit/scripts/test-install.mjs', '.vibekit/scripts/pack-dry-run.mjs', '.vibekit/docs/RESEARCH_NOTES.md', '.vibekit/docs/AUTORESEARCH_LEDGER.md']) {
+    exists(rel) ? ok(`kit-source file ${rel}`) : fail(`missing kit-source file ${rel}`);
+  }
+}
+
 requireText('.github/workflows/vibekit-validate.yml', 'npm test', 'CI workflow runs npm test');
 requireText('.github/workflows/vibekit-validate.yml', 'npm run security:probe', 'CI workflow runs AgentShield probe');
 requireText('.github/workflows/vibekit-validate.yml', 'npm run pack:dry-run', 'CI workflow verifies npm package contents');
-requireText('.vbkit-docs/AUTORESEARCH_LEDGER.md', 'node .vbkit-scripts/validate-kit.mjs .', 'autoresearch ledger documents validation command');
-requireText('.cursor/rules/020-security-agentshield.mdc', 'node .vbkit-scripts/agentshield-probe.mjs .', 'Cursor security rule uses Node AgentShield probe wrapper');
-requireText('.vbkit-scripts/doctor.mjs', '.vbkit-scripts/agentshield-probe.mjs', 'doctor uses Node AgentShield probe wrapper');
+requireText('.vibekit/docs/AUTORESEARCH_LEDGER.md', 'node .vibekit/scripts/validate-kit.mjs .', 'autoresearch ledger documents validation command');
+requireText('.cursor/rules/020-security-agentshield.mdc', 'node .vibekit/scripts/agentshield-probe.mjs .', 'Cursor security rule uses Node AgentShield probe wrapper');
+requireText('.vibekit/scripts/doctor.mjs', '.vibekit/scripts/agentshield-probe.mjs', 'doctor uses Node AgentShield probe wrapper');
 
-if (exists('.vbkit-docs/AUTORESEARCH_LEDGER.md')) {
-  const ledgerText = read('.vbkit-docs/AUTORESEARCH_LEDGER.md');
+if (exists('.vibekit/docs/AUTORESEARCH_LEDGER.md')) {
+  const ledgerText = read('.vibekit/docs/AUTORESEARCH_LEDGER.md');
   const stalePhrases = ['pending during build', 'BUILD_REPORT.md'];
   const stalePhrase = stalePhrases.find((phrase) => ledgerText.includes(phrase));
-  stalePhrase ? fail(`.vbkit-docs/AUTORESEARCH_LEDGER.md contains stale phrase: ${stalePhrase}`) : ok('autoresearch ledger has no stale build placeholders');
+  stalePhrase ? fail(`.vibekit/docs/AUTORESEARCH_LEDGER.md contains stale phrase: ${stalePhrase}`) : ok('autoresearch ledger has no stale build placeholders');
 }
 
 const skillMirrors = {
@@ -109,9 +123,11 @@ const skillMirrors = {
   'clearthought': ['.claude/skills/clearthought', '.cursor/skills/clearthought', '.agents/skills/clearthought'],
   'sequential-thinking': ['.claude/skills/sequential-thinking', '.cursor/skills/sequential-thinking', '.agents/skills/sequential-thinking'],
   'reviewing-4p-priorities': ['.claude/skills/reviewing-4p-priorities', '.cursor/skills/reviewing-4p-priorities', '.agents/skills/reviewing-4p-priorities'],
+  'path-sensitive-shell-safety': ['.claude/skills/path-sensitive-shell-safety', '.cursor/skills/path-sensitive-shell-safety', '.agents/skills/path-sensitive-shell-safety'],
   'visual-design-loop': ['.claude/skills/visual-design-loop', '.agents/skills/visual-design-loop'],
   'memento': ['.claude/skills/memento', '.cursor/skills/memento', '.agents/skills/memento'],
-  'coding-level': ['.claude/skills/coding-level', '.cursor/skills/coding-level', '.agents/skills/coding-level']
+  'coding-level': ['.claude/skills/coding-level', '.cursor/skills/coding-level', '.agents/skills/coding-level'],
+  'parallel-analysis': ['.claude/skills/parallel-analysis', '.cursor/skills/parallel-analysis', '.agents/skills/parallel-analysis']
 };
 
 function validateSkillMirror(sourceRel, mirrorRel) {
@@ -149,7 +165,7 @@ function validateSkillMirror(sourceRel, mirrorRel) {
 }
 
 for (const [skill, mirrors] of Object.entries(skillMirrors)) {
-  for (const mirror of mirrors) validateSkillMirror(`skills/${skill}`, mirror);
+  for (const mirror of mirrors) validateSkillMirror(`.vibekit/skills/${skill}`, mirror);
 }
 
 function parseFrontmatter(text) {
@@ -163,7 +179,7 @@ function parseFrontmatter(text) {
   return fields;
 }
 
-for (const surface of ['skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
+for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
   if (!exists(surface)) continue;
   for (const file of listFiles(surface).filter((f) => f.endsWith('SKILL.md'))) {
     const rel = `${surface}/${file}`;
@@ -180,13 +196,13 @@ function stripFrontmatter(text) {
   return text.replace(/^---\n[\s\S]*?\n---\n?/, '').trim();
 }
 
-if (exists('.vbkit-commands')) {
-  const canonicalCmds = listFiles('.vbkit-commands').filter((f) => f.endsWith('.md'));
+if (exists('.vibekit/commands')) {
+  const canonicalCmds = listFiles('.vibekit/commands').filter((f) => f.endsWith('.md'));
   const cmdMirrors = { '.claude/commands': true, '.cursor/commands': true };
   for (const [mirrorDir, stripFm] of Object.entries(cmdMirrors)) {
     if (!exists(mirrorDir)) { warn(`command mirror dir missing: ${mirrorDir}`); continue; }
     for (const file of canonicalCmds) {
-      const srcRel = `.vbkit-commands/${file}`;
+      const srcRel = `.vibekit/commands/${file}`;
       const mirRel = `${mirrorDir}/${file}`;
       if (!exists(mirRel)) { fail(`command mirror ${mirRel} missing`); continue; }
       const srcText = read(srcRel).trim();
@@ -219,7 +235,7 @@ if (Array.isArray(pkg?.files)) {
 }
 
 if (pkg?.scripts && typeof pkg.scripts === 'object') {
-  const scriptTargetRe = /node\s+(?:--check\s+)?((?:\.\/)?(?:\.vbkit-scripts|bin)\/[A-Za-z0-9._-]+\.(?:mjs|js))/g;
+  const scriptTargetRe = /node\s+(?:--check\s+)?((?:\.\/)?(?:\.vibekit\/scripts|bin)\/[A-Za-z0-9._-]+\.(?:mjs|js))/g;
   const targets = new Set();
   for (const command of Object.values(pkg.scripts)) {
     if (typeof command !== 'string') continue;
@@ -256,15 +272,15 @@ if (claudeSettings?.permissions?.deny && cursorSettings?.permissions?.deny) {
 }
 
 if (pkg?.name === 'minimal-vibe-coding-kit') {
-  for (const rel of ['SECURITY.md', 'CONTRIBUTING.md', 'CODE_OF_CONDUCT.md', '.github/dependabot.yml', '.github/workflows/vibekit-validate.yml', '.vbkit-docs/backbone.schema.json']) {
+  for (const rel of ['SECURITY.md', 'CONTRIBUTING.md', 'CODE_OF_CONDUCT.md', '.github/dependabot.yml', '.github/workflows/vibekit-validate.yml', '.vibekit/docs/backbone.schema.json']) {
     exists(rel) ? ok(`release safety file ${rel}`) : fail(`missing release safety file ${rel}`);
   }
 }
 
-if (exists('CLAUDE-template.md')) {
-  const lines = read('CLAUDE-template.md').split(/\r?\n/).length;
-  if (lines <= 120) ok(`CLAUDE-template.md is concise (${lines} lines)`);
-  else warn(`CLAUDE-template.md is long (${lines} lines); target <= 120`);
+if (exists('.vibekit/init/CLAUDE-template.md')) {
+  const lines = read('.vibekit/init/CLAUDE-template.md').split(/\r?\n/).length;
+  if (lines <= 120) ok(`.vibekit/init/CLAUDE-template.md is concise (${lines} lines)`);
+  else warn(`.vibekit/init/CLAUDE-template.md is long (${lines} lines); target <= 120`);
 }
 
 if (exists('backbone.yml')) {
@@ -385,7 +401,7 @@ const riskyPatterns = [
   { pattern: 'ignore previous' + ' instructions', message: 'prompt injection phrase' }
 ];
 
-const scanDirs = ['.claude', '.cursor', '.agents', '.codex-plugin', 'skills', '.vbkit-commands', '.vbkit-scripts', 'AGENTS.md', 'CLAUDE-template.md'];
+const scanDirs = ['.claude', '.cursor', '.agents', '.codex-plugin', '.vibekit/skills', '.vibekit/commands', '.vibekit/scripts', 'AGENTS.md', '.vibekit/init/CLAUDE-template.md'];
 function walk(item) {
   const p = path.join(root, item);
   if (!fs.existsSync(p)) return [];
@@ -408,7 +424,7 @@ for (const file of scanDirs.flatMap(walk)) {
   }
 }
 
-const probe = path.join(root, '.vbkit-scripts/agentshield-probe.mjs');
+const probe = path.join(root, '.vibekit/scripts/agentshield-probe.mjs');
 if (fs.existsSync(probe)) {
   const result = spawnSync(process.execPath, [probe, root, '--json'], { encoding: 'utf8' });
   if (result.status === 0) ok('AgentShield repo probe runs');

package/{.vbkit-scripts → .vibekit/scripts}/vibekit-finalize.mjs

@@ -2,7 +2,7 @@
 // Graduate a consumer project: move one-time bootstrap files into a cleanup
 // folder once init and the first prompt are complete. Safe, idempotent, and
 // reversible. Refuses to run on the kit source repo so it never deletes the
-// kit's own bootstrap files (and never breaks .vbkit-scripts/validate-kit.mjs).
+// kit's own bootstrap files (and never breaks .vibekit/scripts/validate-kit.mjs).
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -16,8 +16,8 @@ const json = args.includes('--json');
 const DEFAULTS = {
   cleanupDir: '_vibekit-cleanup',
   marker: '.vibekit/FINALIZE_DONE',
-  // CLAUDE-template.md is only graduated once CLAUDE.md exists (see below).
-  oneTimeFiles: ['FIRST_TIME_INIT.md', 'FIRST_PROMPT.md', 'PUSH_TO_GITHUB.md', 'CLAUDE-template.md']
+  // .vibekit/init/CLAUDE-template.md is only graduated once CLAUDE.md exists (see below).
+  oneTimeFiles: ['.vibekit/init/FIRST_TIME_INIT.md', '.vibekit/init/FIRST_PROMPT.md', '.vibekit/init/PUSH_TO_GITHUB.md', '.vibekit/init/CLAUDE-template.md']
 };
 
 function exists(rel) { return fs.existsSync(path.join(target, rel)); }
@@ -72,7 +72,7 @@ if (pkg?.name === 'minimal-vibe-coding-kit') {
 if (!exists('backbone.yml')) fail('backbone.yml is missing. Install the kit first.');
 const status = backboneValue(read('backbone.yml'), 'template_status');
 if (status !== 'initialized' && !restore) {
-  fail(`backbone.yml template_status is "${status || 'unknown'}". Run init (FIRST_TIME_INIT.md) before graduating.`);
+  fail(`backbone.yml template_status is "${status || 'unknown'}". Run init (.vibekit/init/FIRST_TIME_INIT.md) before graduating.`);
 }
 
 const cfg = loadConfig();
@@ -80,7 +80,7 @@ const cleanupRoot = path.join(target, cfg.cleanupDir);
 const markerPath = path.join(target, cfg.marker);
 
 function graduateFile(rel) {
-  if (rel === 'CLAUDE-template.md' && !exists('CLAUDE.md')) return false;
+  if (rel === '.vibekit/init/CLAUDE-template.md' && !exists('CLAUDE.md')) return false;
   return exists(rel);
 }
 
@@ -132,7 +132,7 @@ if (!shouldWrite) {
     console.log(`These one-time bootstrap files would move into ${cfg.cleanupDir}/ (then you delete that folder):`);
     for (const f of planned) console.log(`- ${f}`);
     if (!planned.length) console.log('- (none found; nothing to graduate)');
-    console.log(`\nApply with: node .vbkit-scripts/vibekit-finalize.mjs ${args[0] && !args[0].startsWith('--') ? args[0] : '.'} --write --yes`);
+    console.log(`\nApply with: node .vibekit/scripts/vibekit-finalize.mjs ${args[0] && !args[0].startsWith('--') ? args[0] : '.'} --write --yes`);
     console.log('Undo later with: --restore --write');
   }
   process.exit(0);
@@ -167,7 +167,7 @@ ${moved.map((m) => `- ${m}`).join('\n')}
 - Or restore everything to the repo root:
 
 \`\`\`bash
-node .vbkit-scripts/vibekit-finalize.mjs . --restore --write
+node .vibekit/scripts/vibekit-finalize.mjs . --restore --write
 \`\`\`
 
 The durable project map is \`backbone.yml\`; you do not need these files to keep working.

package/{skills → .vibekit/skills}/agentshield-security-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agentshield-security-review
-description: repository-native security review workflow for Claude Code and Codex projects using the AgentShield concept. Use when auditing or hardening agent configuration, skills, prompts, hooks, MCP servers, permissions, slash commands, Codex plugin files, Claude plugin files, AGENTS.md, CLAUDE.md, or repository-level AI coding-agent surfaces. Prefer this skill before merging changes to .claude, .codex, .codex-plugin, .claude-plugin, .agents, skills, .vbkit-commands, .vbkit-scripts, hooks, mcp configs, or generated code that touches agent execution.
+description: repository-native security review workflow for Claude Code and Codex projects using the AgentShield concept. Use when auditing or hardening agent configuration, skills, prompts, hooks, MCP servers, permissions, slash commands, Codex plugin files, Claude plugin files, AGENTS.md, CLAUDE.md, or repository-level AI coding-agent surfaces. Prefer this skill before merging changes to .claude, .codex, .codex-plugin, .claude-plugin, .agents, .vibekit/skills, .vibekit/commands, .vibekit/scripts, hooks, mcp configs, or generated code that touches agent execution.
 ---
 
 # AgentShield Security Review
@@ -14,7 +14,7 @@ Do not invent findings. Prefer deterministic scanner output when available, then
 ## Standard workflow
 
 1. Identify the repo root and active harness surfaces.
-2. Run `node .vbkit-scripts/agentshield-probe.mjs .` to inventory Claude, Codex, shared skills, hooks, MCP, commands, and repo instruction files.
+2. Run `node .vibekit/scripts/agentshield-probe.mjs .` to inventory Claude, Codex, shared skills, hooks, MCP, commands, and repo instruction files.
 3. If Node/npm is available, run AgentShield from the repo root:
    ```bash
    npx ecc-agentshield scan --path . --format text
@@ -34,9 +34,9 @@ Do not invent findings. Prefer deterministic scanner output when available, then
 
 Use a shared root skill where possible:
 
-- `skills/agentshield-security-review/SKILL.md` is the canonical workflow.
-- Claude Code may add a slash-command shim in `.vbkit-commands/security-scan.md` or `.claude/commands/security-scan.md`.
-- Codex should consume the same root `skills/` directory through `.codex-plugin/plugin.json` or the repo's native skill/plugin mechanism.
+- `.vibekit/skills/agentshield-security-review/SKILL.md` is the canonical workflow.
+- Claude Code may add a slash-command shim in `.vibekit/commands/security-scan.md` or `.claude/commands/security-scan.md`.
+- Codex should consume the same root `.vibekit/skills/` directory through `.codex-plugin/plugin.json` or the repo's native skill/plugin mechanism.
 - Do not duplicate divergent Claude and Codex skill bodies. Duplication causes drift.
 
 See `references/native-install.md` for copy-ready Claude and Codex snippets.
@@ -48,7 +48,7 @@ Prioritize runtime-active files over examples and docs:
 1. `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`
 2. `.claude/settings.json`, `.claude/settings.local.json`, `.claude/agents/*.md`, `.claude/commands/*.md`
 3. `.codex/config.toml`, `.codex/`, `.codex-plugin/plugin.json`
-4. `.agents/`, `agents/`, `skills/`, `.vbkit-commands/`, `.vbkit-scripts/`, `hooks/`
+4. `.agents/`, `agents/`, `.vibekit/skills/`, `.vibekit/commands/`, `.vibekit/scripts/`, `hooks/`
 5. `.mcp.json`, `mcp.json`, `mcp-configs/*.json`
 6. installer scripts, CI workflows, package scripts, and generated plugin manifests
 

package/{skills → .vibekit/skills}/agentshield-security-review/references/native-install.md

@@ -7,18 +7,18 @@ Keep one canonical skill and add thin harness adapters.
 Recommended repo layout:
 
 ```text
-skills/agentshield-security-review/SKILL.md
-skills/agentshield-security-review/references/review-checklist.md
-skills/agentshield-security-review/references/report-template.md
-skills/agentshield-security-review/scripts/agentshield_repo_probe.py
-.vbkit-commands/security-scan.md
+.vibekit/skills/agentshield-security-review/SKILL.md
+.vibekit/skills/agentshield-security-review/references/review-checklist.md
+.vibekit/skills/agentshield-security-review/references/report-template.md
+.vibekit/skills/agentshield-security-review/scripts/agentshield_repo_probe.py
+.vibekit/commands/security-scan.md
 .codex-plugin/plugin.json
 .claude-plugin/plugin.json
 ```
 
 ## Claude Code command shim
 
-Create `.vbkit-commands/security-scan.md` or `.claude/commands/security-scan.md`:
+Create `.vibekit/commands/security-scan.md` or `.claude/commands/security-scan.md`:
 
 ```markdown
 ---
@@ -48,7 +48,7 @@ Return grade, score, severity counts, active paths, critical/high findings, and
 
 ## Codex plugin pointer
 
-Use the repo-level Codex plugin manifest to point Codex at the same `skills/` directory. Exact schema may vary by Codex plugin version, so preserve the existing repo schema and ensure it references root skills rather than a copied skill body.
+Use the repo-level Codex plugin manifest to point Codex at the same `.vibekit/skills/` directory. Exact schema may vary by Codex plugin version, so preserve the existing repo schema and ensure it references the canonical `.vibekit/skills/` directory rather than a copied skill body.
 
 Example intent:
 
@@ -56,7 +56,7 @@ Example intent:
 {
   "name": "your-repo",
   "version": "0.1.0",
-  "skills": "./skills",
+  "skills": "./.vibekit/skills",
   "mcp": "./.mcp.json"
 }
 ```
@@ -78,8 +78,8 @@ on:
       - ".claude-plugin/**"
       - ".agents/**"
       - "agents/**"
-      - "skills/**"
-      - ".vbkit-commands/**"
+      - ".vibekit/skills/**"
+      - ".vibekit/commands/**"
       - "hooks/**"
       - ".mcp.json"
       - "mcp-configs/**"

package/{skills → .vibekit/skills}/agentshield-security-review/references/report-template.md

@@ -34,7 +34,7 @@ Use this structure for final reports.
 
 ## Medium/low findings
 
-Group by theme: permissions, hooks, MCP, prompts, skills, .vbkit-docs/examples.
+Group by theme: permissions, hooks, MCP, prompts, skills, .vibekit/docs/examples.
 
 ## Remediation order
 

package/{skills → .vibekit/skills}/agentshield-security-review/scripts/agentshield_repo_probe.py

@@ -15,9 +15,9 @@ PATTERNS = {
     "repo_instructions": ["CLAUDE.md", "AGENTS.md", ".github/copilot-instructions.md"],
     "claude": [".claude", ".claude-plugin", "agents"],
     "codex": [".codex", ".codex-plugin"],
-    "shared_skills": ["skills", ".agents/skills"],
-    "shared_commands": [".vbkit-commands"],
-    "kit_scripts": [".vbkit-scripts"],
+    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", "skills"],
+    "shared_commands": [".vibekit/commands"],
+    "kit_scripts": [".vibekit/scripts"],
     "hooks": ["hooks", ".claude/hooks", ".agents/hooks"],
     "mcp": [".mcp.json", "mcp.json", "mcp-configs"],
     "ci": [".github/workflows"],

package/{skills → .vibekit/skills}/autoresearch-coding/README.md

@@ -11,5 +11,5 @@ Example:
 For this kit:
 
 ```text
-/autoresearch-coding goal: improve the kit; metric command: node .vbkit-scripts/validate-kit.mjs .; direction: higher; editable paths: .vbkit-docs .vbkit-scripts skills .vbkit-commands .claude .cursor .agents .codex-plugin; budget: 3
+/autoresearch-coding goal: improve the kit; metric command: node .vibekit/scripts/validate-kit.mjs .; direction: higher; editable paths: .vibekit/docs .vibekit/scripts .vibekit/skills .vibekit/commands .claude .cursor .agents .codex-plugin; budget: 3
 ```

package/{skills → .vibekit/skills}/autoresearch-coding/SKILL.md

@@ -28,16 +28,16 @@ For this kit itself, use:
 
 ```text
 goal: improve Minimal Vibe Coding Kit quality
-metric command: node .vbkit-scripts/validate-kit.mjs .
+metric command: node .vibekit/scripts/validate-kit.mjs .
 direction: higher
-editable paths: .vbkit-docs .vbkit-scripts skills .vbkit-commands .claude .cursor .agents .codex-plugin .github README.md AGENTS.md CLAUDE-template.md FIRST_TIME_INIT.md FIRST_PROMPT.md backbone.yml package.json install.sh install.ps1
+editable paths: .vibekit/docs .vibekit/scripts .vibekit/skills .vibekit/commands .claude .cursor .agents .codex-plugin .github README.md AGENTS.md .vibekit/init/CLAUDE-template.md .vibekit/init/FIRST_TIME_INIT.md .vibekit/init/FIRST_PROMPT.md backbone.yml package.json install.sh install.ps1
 protected paths: .git .env* node_modules vendor secrets lockfiles
 budget: 3
 ```
 
 ## Setup
 
-1. Read `backbone.yml`. If `meta.template_status` is `uninitialized`, follow `FIRST_TIME_INIT.md` and wait for explicit approval before experiment edits.
+1. Read `backbone.yml`. If `meta.template_status` is `uninitialized`, follow `.vibekit/init/FIRST_TIME_INIT.md` and wait for explicit approval before experiment edits.
 2. Inspect `git status --short`.
 3. If user changes exist, stop unless the user permits dirty-state experimentation.
 4. Create or switch to an experiment branch named `autoresearch/<date>-<slug>` when a git repo is available. If branch creation is blocked by permissions, ask for approval once and record any approved fallback.
@@ -78,7 +78,7 @@ For each experiment:
 7. Keep good changes; revert discarded or crashed changes.
 8. If a crash is from a trivial patch mistake, fix once and rerun.
 
-If a kept change touches agent surfaces such as `AGENTS.md`, `CLAUDE.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, `skills/**`, `.vbkit-commands/**`, `.vbkit-scripts/**`, hooks, or MCP config, run the AgentShield probe before final reporting.
+If a kept change touches agent surfaces such as `AGENTS.md`, `CLAUDE.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, `.vibekit/skills/**`, `.vibekit/commands/**`, `.vibekit/scripts/**`, hooks, or MCP config, run the AgentShield probe before final reporting.
 
 ## Delegation
 

package/{skills → .vibekit/skills}/daily-workflow-curator/SKILL.md

@@ -14,19 +14,19 @@ Run a daily improvement pass that proposes changes, not silent edits.
 2. Run:
 
 ```bash
-node .vbkit-scripts/daily-enhance.mjs . --write-report
+node .vibekit/scripts/daily-enhance.mjs . --write-report
 ```
 
 3. Run validation:
 
 ```bash
-node .vbkit-scripts/validate-kit.mjs .
+node .vibekit/scripts/validate-kit.mjs .
 ```
 
 4. Run AgentShield read-only probe if present:
 
 ```bash
-node .vbkit-scripts/agentshield-probe.mjs .
+node .vibekit/scripts/agentshield-probe.mjs .
 ```
 
 5. Identify stale, duplicated, or overly broad rules.

package/.vibekit/skills/parallel-analysis/SKILL.md

@@ -0,0 +1,160 @@
+---
+name: parallel-analysis
+description: Fan out 2-5 independent read-only analysis lanes across the repo using your configured executor (Cursor CLI Composer, Claude subagents, or Codex CLI), then merge the lane reports and verify them with a refutation pass. Use for repo-wide questions, large uncommitted-diff reviews, multi-doc reading, impact analysis, or consistency audits. On first use it asks which provider/model to use and saves the answer so it never asks again.
+argument-hint: "<analysis question, diff, or review target>"
+user-invocable: true
+effort: medium
+---
+
+# Parallel Analysis (Multi-Agent Fan-Out)
+
+Split a large analysis into independent read-only lanes, run them concurrently
+with the configured executor, merge the lane reports, and verify merged claims
+with a skeptical refutation pass. One round of parallel lanes replaces slow
+serial reading; the verification lane replaces manual double-checking.
+
+This skill is project-agnostic: it works in any repo where the kit is
+installed, using that repo's `backbone.yml` (if present) for boundaries.
+
+## Best Use
+
+- Repo-wide questions ("where is X handled, what depends on Y").
+- Reviewing a large uncommitted diff by concern (backend vs frontend vs i18n
+  vs scripts).
+- Reading several large docs, plans, or reference trees at once.
+- Pre-change impact analysis across packages/apps listed in `backbone.yml`
+  `paths.apps`.
+- Consistency audits (docs vs code, rules vs skills, config vs actual layout).
+
+Do NOT use for single-file questions or quick lookups; direct reads are faster.
+
+## Executor Setup (first use only)
+
+Lane execution is delegated to ONE configured executor. The choice is stored
+in `.vibekit/parallel-analysis.json`; while that file exists and its preflight
+passes, NEVER ask again.
+
+1. **If `.vibekit/parallel-analysis.json` exists**: read it, run the matching
+   preflight below, and proceed silently on success. If preflight fails
+   (binary missing, logged out), tell the user what broke, offer to re-run
+   setup, and update the file with their answer.
+2. **If it does not exist**: detect what is available, then ask the user ONE
+   question — "Which provider should run parallel analysis lanes?" — using the
+   harness-native prompt (AskUserQuestion in Claude Code; a plain chat
+   question in Cursor/Codex). Offer, in this order:
+   - **Cursor CLI + Composer 2.5 Fast (recommended)** — fastest lane executor;
+     requires `cursor-agent` installed and logged in.
+   - **Claude subagents** — no extra install; lanes run as read-only Claude
+     Code subagents (Explore/general-purpose). Choose this automatically if
+     the user declines external CLIs.
+   - **Codex CLI** — lanes run via `codex exec` in a read-only sandbox with
+     the best available Codex model.
+3. **Resolve the model** for the chosen provider (see per-executor notes),
+   confirm the resolved value in one line, and write the config file. Include
+   a fallback executor so lanes still run when the primary is unavailable.
+
+### Preflights and model resolution
+
+- `cursor-cli`: `cursor-agent status` must report logged in (otherwise the
+  user runs `cursor-agent login` once). Resolve the model with
+  `cursor-agent --list-models` and prefer the Composer 2.5 fast variant
+  (e.g. `composer-2.5-fast`); if absent, use the newest Composer model and
+  record what was picked.
+- `claude-subagents`: available whenever running inside Claude Code; no
+  binary needed. Use read-only subagent types only.
+- `codex-cli`: `codex --version` must succeed. Use the CLI's default/best
+  coding model unless the user names one; record the resolved model.
+
+### Config file — `.vibekit/parallel-analysis.json`
+
+```json
+{
+  "executor": "cursor-cli",
+  "model": "composer-2.5-fast",
+  "fallback": "claude-subagents",
+  "configuredAt": "2026-07-16T07:30:00Z"
+}
+```
+
+`executor` is one of `cursor-cli` | `claude-subagents` | `codex-cli`. The file
+is local state (gitignored by default); a team may commit it deliberately to
+share a default. To change the choice later, delete the file or ask for
+"parallel-analysis setup" again.
+
+## Running a lane (per executor)
+
+Every lane is READ-ONLY: search, read, summarize — never edit files, execute
+project binaries, run hooks, or trigger installs/deploys/migrations.
+
+- `cursor-cli`:
+
+  ```sh
+  cursor-agent -p --mode ask --output-format text \
+    --model "<configured-model>" \
+    --workspace "<repo-root>" \
+    "<lane brief>"
+  ```
+
+  Never pass `--force` or `--yolo`; `--mode ask` keeps Composer read-only.
+  One workspace per lane; a question spanning multiple repos becomes one lane
+  per repo.
+- `claude-subagents`: launch each lane as a read-only subagent with the lane
+  brief as its prompt, all lanes in ONE message so they run concurrently.
+- `codex-cli`:
+
+  ```sh
+  codex exec --sandbox read-only -C "<repo-root>" "<lane brief>"
+  ```
+
+If the harness cannot run lanes concurrently (plain CLI loop), run them
+back-to-back without changing the briefs — merge and verification stay the
+same.
+
+## Workflow
+
+1. **Scope.** State the question in one sentence. Split it into 2-5 lanes that
+   are independent of each other (by directory, package, concern, or doc set).
+   If lanes would depend on each other's output, merge them or run two rounds.
+2. **Brief.** Give each lane a numbered brief: exact paths, the questions to
+   answer, and the required return format ("facts only, numbered sections,
+   findings as `file:line — issue — why it matters`").
+3. **Launch all lanes at once** with the configured executor.
+4. **Prepare while waiting.** Build the merge skeleton; do not duplicate lane
+   work.
+5. **Merge.** Combine lane reports into one findings list. Mark conflicts
+   between lanes and unknowns explicitly — never average away a disagreement.
+6. **Verify.** Run one verification lane that receives the merged claims (not
+   the reasoning) with the instruction: "Default-skeptical: confirm or refute
+   each claim against the repo with file:line evidence." Drop or re-investigate
+   every refuted claim; never silently keep one.
+7. **Deliver.** Report merged findings, what was verified, and remaining
+   unknowns. For issue triage, classify surviving findings with the
+   `reviewing-4p-priorities` skill (P0-P4). Decisions and edits stay in the
+   main session under the repo's normal review rules.
+
+## Lane brief template
+
+```text
+Lane <n>: <one-line purpose>
+Workspace: <repo root>
+Paths: <exact dirs/files>
+Read-only. Do not modify anything or execute binaries/scripts.
+Questions:
+1. <specific question>
+2. <specific question>
+Return: numbered sections matching the questions, facts only,
+findings as file:line — issue — why it matters.
+```
+
+## Guardrails
+
+- 2-5 lanes per round; needing more means the question is under-scoped.
+- Lanes are read-only; only the main session edits files. Agent-surface edits
+  (`backbone.yml`, `AGENTS.md`, `CLAUDE.md`, `.claude/**`, `.cursor/**`,
+  `.agents/**`, `.codex/**`, kit skills/commands) additionally require the
+  `agentshield-security-review` skill afterwards.
+- Respect `backbone.yml` `policy.protected_paths` in every lane brief.
+- Never put secrets in lane briefs or executor prompts: no `.env*` contents,
+  credentials, tokens, private keys, or customer data.
+- This skill produces analysis, not decisions; a lane may not conclude
+  "therefore change X" without main-session review.