minimal-vibe-coding-kit 0.3.0 → 0.4.1

package/{.vbkit-scripts → .vibekit/scripts}/test-install.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
 const __filename = fileURLToPath(import.meta.url);
-const kitRoot = path.resolve(path.dirname(__filename), '..');
+const kitRoot = path.resolve(path.dirname(__filename), '..', '..');
 const node = process.execPath;
 const keep = process.argv.includes('--keep');
 const temps = [];
@@ -44,21 +44,35 @@ function count(text, marker) {
 
 try {
   const clean = tempDir('clean');
-  run(['.vbkit-scripts/mvck.mjs', 'install', clean, '--profile', 'all']);
-  run(['.vbkit-scripts/validate-kit.mjs', clean]);
+  run(['.vibekit/scripts/mvck.mjs', 'install', clean, '--profile', 'all']);
+  run(['.vibekit/scripts/validate-kit.mjs', clean]);
   assert(fs.existsSync(path.join(clean, 'AGENTS.md')), 'clean install creates AGENTS.md');
-  assert(fs.existsSync(path.join(clean, '.vbkit-commands')), 'clean install creates .vbkit-commands');
-  assert(fs.existsSync(path.join(clean, '.vbkit-scripts')), 'clean install creates .vbkit-scripts');
-  assert(fs.existsSync(path.join(clean, '.vbkit-docs')), 'clean install creates .vbkit-docs');
+  assert(fs.existsSync(path.join(clean, '.vibekit/commands')), 'clean install creates .vibekit/commands');
+  assert(fs.existsSync(path.join(clean, '.vibekit/scripts')), 'clean install creates .vibekit/scripts');
+  assert(fs.existsSync(path.join(clean, '.vibekit/docs')), 'clean install creates .vibekit/docs');
   assert(!fs.existsSync(path.join(clean, 'commands')), 'clean install does not create root commands');
   assert(!fs.existsSync(path.join(clean, 'scripts')), 'clean install does not create root scripts');
   assert(!fs.existsSync(path.join(clean, 'docs')), 'clean install does not create root docs');
+  assert(fs.existsSync(path.join(clean, '.vibekit/skills/vibekit-init/SKILL.md')), 'clean install creates .vibekit/skills');
+  assert(fs.existsSync(path.join(clean, '.vibekit/init/FIRST_TIME_INIT.md')), 'clean install seeds init files under .vibekit/init');
+  assert(!fs.existsSync(path.join(clean, 'skills')), 'clean install does not create root skills');
+  assert(!fs.existsSync(path.join(clean, '.vbkit-scripts')), 'clean install does not create legacy .vbkit-scripts');
+  assert(!fs.existsSync(path.join(clean, '.vbkit-commands')), 'clean install does not create legacy .vbkit-commands');
+  assert(!fs.existsSync(path.join(clean, '.vbkit-docs')), 'clean install does not create legacy .vbkit-docs');
+  assert(!fs.existsSync(path.join(clean, 'FIRST_TIME_INIT.md')), 'clean install does not seed root FIRST_TIME_INIT.md');
+  assert(!fs.existsSync(path.join(clean, '.vibekit/scripts/test-install.mjs')), 'clean install omits kit-dev test-install.mjs');
+  assert(!fs.existsSync(path.join(clean, '.vibekit/scripts/pack-dry-run.mjs')), 'clean install omits kit-dev pack-dry-run.mjs');
+  assert(!fs.existsSync(path.join(clean, '.vibekit/docs/RESEARCH_NOTES.md')), 'clean install omits maintainer RESEARCH_NOTES.md');
+  assert(!fs.existsSync(path.join(clean, '.vibekit/docs/AUTORESEARCH_LEDGER.md')), 'clean install omits maintainer AUTORESEARCH_LEDGER.md');
+  assert(fs.existsSync(path.join(clean, '.vibekit/docs/INSTALL.md')), 'clean install keeps end-user docs like INSTALL.md');
+  run(['.vibekit/scripts/mvck.mjs', 'install', clean, '--profile', 'bogus'], { expect: 1 });
+  assert(true, 'install rejects an unknown --profile value');
 
   const existing = tempDir('existing');
   fs.writeFileSync(path.join(existing, 'AGENTS.md'), '# Existing\n');
   fs.writeFileSync(path.join(existing, 'CLAUDE.md'), '# Existing Claude\n');
-  run(['.vbkit-scripts/mvck.mjs', 'install', existing, '--profile', 'all']);
-  run(['.vbkit-scripts/mvck.mjs', 'install', existing, '--profile', 'all']);
+  run(['.vibekit/scripts/mvck.mjs', 'install', existing, '--profile', 'all']);
+  run(['.vibekit/scripts/mvck.mjs', 'install', existing, '--profile', 'all']);
 
   const agents = fs.readFileSync(path.join(existing, 'AGENTS.md'), 'utf8');
   const claude = fs.readFileSync(path.join(existing, 'CLAUDE.md'), 'utf8');
@@ -70,39 +84,39 @@ try {
   assert(count(claude, 'END: minimal-vibe-coding-kit') === 1, 'CLAUDE.md has one managed end marker');
 
   const cwdTarget = tempDir('cwd-target');
-  run([path.join(kitRoot, '.vbkit-scripts/mvck.mjs'), 'install', '--profile', 'all'], { cwd: cwdTarget });
+  run([path.join(kitRoot, '.vibekit/scripts/mvck.mjs'), 'install', '--profile', 'all'], { cwd: cwdTarget });
   assert(fs.existsSync(path.join(cwdTarget, 'backbone.yml')), 'install without target uses current working directory');
 
-  const proposed = run([path.join(kitRoot, '.vbkit-scripts/mvck.mjs'), 'init', '--propose'], { cwd: cwdTarget });
+  const proposed = run([path.join(kitRoot, '.vibekit/scripts/mvck.mjs'), 'init', '--propose'], { cwd: cwdTarget });
   assert(proposed.stdout.includes('Proposed backbone.yml'), 'init --propose without target preserves flag');
 
-  const jsonPlan = run(['.vbkit-scripts/mvck.mjs', 'install', clean, '--dry-run', '--json']);
+  const jsonPlan = run(['.vibekit/scripts/mvck.mjs', 'install', clean, '--dry-run', '--json']);
   const parsed = JSON.parse(jsonPlan.stdout);
   assert(parsed.status === 'dry-run' && parsed.dryRun === true, 'install --dry-run --json returns machine-readable plan');
 
   const upd = tempDir('update');
-  run(['.vbkit-scripts/mvck.mjs', 'install', upd, '--profile', 'all']);
+  run(['.vibekit/scripts/mvck.mjs', 'install', upd, '--profile', 'all']);
   assert(fs.existsSync(path.join(upd, '.vibekit/KIT_VERSION')), 'install stamps .vibekit/KIT_VERSION');
   fs.appendFileSync(path.join(upd, 'backbone.yml'), '# user-custom-line\n');
-  fs.writeFileSync(path.join(upd, 'skills/memento/SKILL.md'), '# stale kit file\n');
+  fs.writeFileSync(path.join(upd, '.vibekit/skills/memento/SKILL.md'), '# stale kit file\n');
   fs.rmSync(path.join(upd, '.claude/skills/coding-level'), { recursive: true, force: true });
 
-  run(['.vbkit-scripts/mvck.mjs', 'update', upd]);
-  assert(fs.readFileSync(path.join(upd, 'skills/memento/SKILL.md'), 'utf8').includes('name: memento'), 'update refreshes stale kit files');
+  run(['.vibekit/scripts/mvck.mjs', 'update', upd]);
+  assert(fs.readFileSync(path.join(upd, '.vibekit/skills/memento/SKILL.md'), 'utf8').includes('name: memento'), 'update refreshes stale kit files');
   assert(fs.existsSync(path.join(upd, '.claude/skills/coding-level/SKILL.md')), 'update re-adds missing kit skill mirrors');
   assert(fs.readFileSync(path.join(upd, 'backbone.yml'), 'utf8').includes('# user-custom-line'), 'update preserves user-modified backbone.yml');
   const backupRoot = path.join(upd, '.vibekit', 'update-backup');
   assert(fs.existsSync(backupRoot) && fs.readdirSync(backupRoot).length >= 1, 'update backs up replaced kit files');
-  run(['.vbkit-scripts/validate-kit.mjs', upd]);
+  run(['.vibekit/scripts/validate-kit.mjs', upd]);
 
   const updAgents = fs.readFileSync(path.join(upd, 'AGENTS.md'), 'utf8');
   assert(count(updAgents, 'BEGIN: minimal-vibe-coding-kit') === 1, 'update keeps one managed begin marker in AGENTS.md');
 
   const emptyTarget = tempDir('update-empty');
-  run(['.vbkit-scripts/mvck.mjs', 'update', emptyTarget], { expect: 1 });
+  run(['.vibekit/scripts/mvck.mjs', 'update', emptyTarget], { expect: 1 });
   assert(true, 'update refuses a target without the kit installed');
 
-  const updPlan = run(['.vbkit-scripts/mvck.mjs', 'update', upd, '--dry-run', '--json']);
+  const updPlan = run(['.vibekit/scripts/mvck.mjs', 'update', upd, '--dry-run', '--json']);
   const updParsed = JSON.parse(updPlan.stdout);
   assert(updParsed.status === 'dry-run' && typeof updParsed.toVersion === 'string', 'update --dry-run --json returns machine-readable plan');
 

package/{.vbkit-scripts → .vibekit/scripts}/validate-kit.mjs

@@ -34,24 +34,27 @@ function listFiles(rel) {
 }
 
 const required = [
-  'AGENTS.md', 'CLAUDE-template.md', 'FIRST_TIME_INIT.md', 'FIRST_PROMPT.md', 'backbone.yml',
-  '.vbkit-scripts/mvck.mjs', '.vbkit-scripts/init-backbone.mjs', '.vbkit-scripts/daily-enhance.mjs', '.vbkit-scripts/validate-kit.mjs',
-  '.vbkit-scripts/doctor.mjs', '.vbkit-scripts/test-install.mjs', '.vbkit-scripts/agentshield-probe.mjs', '.vbkit-scripts/pack-dry-run.mjs', '.vbkit-scripts/vibekit-finalize.mjs',
-  'skills/autoresearch-coding/SKILL.md', 'skills/agentshield-security-review/SKILL.md', 'skills/daily-workflow-curator/SKILL.md', 'skills/vibekit-init/SKILL.md',
-  'skills/clearthought/SKILL.md', 'skills/sequential-thinking/SKILL.md', 'skills/reviewing-4p-priorities/SKILL.md', 'skills/visual-design-loop/SKILL.md',
-  'skills/memento/SKILL.md', 'skills/coding-level/SKILL.md',
-  '.vbkit-docs/templates/PRD_TEMPLATE.md', '.vbkit-docs/templates/CONTEXT_TEMPLATE.md',
+  'AGENTS.md', '.vibekit/init/CLAUDE-template.md', '.vibekit/init/FIRST_TIME_INIT.md', '.vibekit/init/FIRST_PROMPT.md', 'backbone.yml',
+  '.vibekit/scripts/mvck.mjs', '.vibekit/scripts/init-backbone.mjs', '.vibekit/scripts/daily-enhance.mjs', '.vibekit/scripts/validate-kit.mjs',
+  '.vibekit/scripts/doctor.mjs', '.vibekit/scripts/agentshield-probe.mjs', '.vibekit/scripts/vibekit-finalize.mjs',
+  '.vibekit/skills/autoresearch-coding/SKILL.md', '.vibekit/skills/agentshield-security-review/SKILL.md', '.vibekit/skills/daily-workflow-curator/SKILL.md', '.vibekit/skills/vibekit-init/SKILL.md',
+  '.vibekit/skills/clearthought/SKILL.md', '.vibekit/skills/sequential-thinking/SKILL.md', '.vibekit/skills/reviewing-4p-priorities/SKILL.md', '.vibekit/skills/visual-design-loop/SKILL.md',
+  '.vibekit/skills/path-sensitive-shell-safety/SKILL.md', '.vibekit/skills/memento/SKILL.md', '.vibekit/skills/coding-level/SKILL.md', '.vibekit/skills/parallel-analysis/SKILL.md',
+  '.vibekit/docs/templates/PRD_TEMPLATE.md', '.vibekit/docs/templates/CONTEXT_TEMPLATE.md',
   '.codex/README.md', '.codex/config.example.toml',
   '.claude/skills/autoresearch-coding/SKILL.md', '.claude/skills/agentshield-security-review/SKILL.md',
   '.claude/skills/daily-workflow-curator/SKILL.md', '.claude/skills/vibekit-init/SKILL.md',
   '.claude/skills/clearthought/SKILL.md', '.claude/skills/sequential-thinking/SKILL.md', '.claude/skills/reviewing-4p-priorities/SKILL.md', '.claude/skills/visual-design-loop/SKILL.md',
-  '.claude/skills/memento/SKILL.md', '.claude/skills/coding-level/SKILL.md',
+  '.claude/skills/path-sensitive-shell-safety/SKILL.md', '.claude/skills/memento/SKILL.md', '.claude/skills/coding-level/SKILL.md',
+  '.claude/skills/parallel-analysis/SKILL.md',
   '.cursor/rules/001-vibe-core.mdc', '.cursor/skills/clearthought/SKILL.md', '.cursor/skills/sequential-thinking/SKILL.md', '.cursor/skills/reviewing-4p-priorities/SKILL.md',
-  '.cursor/skills/memento/SKILL.md', '.cursor/skills/coding-level/SKILL.md',
+  '.cursor/skills/path-sensitive-shell-safety/SKILL.md',
+  '.cursor/skills/memento/SKILL.md', '.cursor/skills/coding-level/SKILL.md', '.cursor/skills/parallel-analysis/SKILL.md',
   '.agents/skills/autoresearch-coding/SKILL.md', '.agents/skills/agentshield-security-review/SKILL.md',
   '.agents/skills/daily-workflow-curator/SKILL.md', '.agents/skills/vibekit-init/SKILL.md',
   '.agents/skills/clearthought/SKILL.md', '.agents/skills/sequential-thinking/SKILL.md', '.agents/skills/reviewing-4p-priorities/SKILL.md', '.agents/skills/visual-design-loop/SKILL.md',
-  '.agents/skills/memento/SKILL.md', '.agents/skills/coding-level/SKILL.md',
+  '.agents/skills/path-sensitive-shell-safety/SKILL.md', '.agents/skills/memento/SKILL.md', '.agents/skills/coding-level/SKILL.md',
+  '.agents/skills/parallel-analysis/SKILL.md',
   '.codex-plugin/plugin.json'
 ];
 
@@ -74,10 +77,13 @@ const reasoningSkillResources = {
   ],
   'reviewing-4p-priorities': [
     'examples.md'
+  ],
+  'path-sensitive-shell-safety': [
+    'references/workflow.md'
   ]
 };
 
-for (const surface of ['skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
+for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
   for (const [skill, files] of Object.entries(reasoningSkillResources)) {
     for (const file of files) required.push(`${surface}/${skill}/${file}`);
   }
@@ -87,18 +93,26 @@ for (const rel of required) exists(rel) ? ok(`required file ${rel}`) : fail(`mis
 if (exists('README.md')) ok('optional README.md present');
 else console.log('INFO optional README.md not present in target project');
 
+// Kit-maintainer files: required in the kit source repo, intentionally absent in end-user installs.
+const isKitSourceRepo = readJson('package.json')?.name === 'minimal-vibe-coding-kit';
+if (isKitSourceRepo) {
+  for (const rel of ['.vibekit/scripts/test-install.mjs', '.vibekit/scripts/pack-dry-run.mjs', '.vibekit/docs/RESEARCH_NOTES.md', '.vibekit/docs/AUTORESEARCH_LEDGER.md']) {
+    exists(rel) ? ok(`kit-source file ${rel}`) : fail(`missing kit-source file ${rel}`);
+  }
+}
+
 requireText('.github/workflows/vibekit-validate.yml', 'npm test', 'CI workflow runs npm test');
 requireText('.github/workflows/vibekit-validate.yml', 'npm run security:probe', 'CI workflow runs AgentShield probe');
 requireText('.github/workflows/vibekit-validate.yml', 'npm run pack:dry-run', 'CI workflow verifies npm package contents');
-requireText('.vbkit-docs/AUTORESEARCH_LEDGER.md', 'node .vbkit-scripts/validate-kit.mjs .', 'autoresearch ledger documents validation command');
-requireText('.cursor/rules/020-security-agentshield.mdc', 'node .vbkit-scripts/agentshield-probe.mjs .', 'Cursor security rule uses Node AgentShield probe wrapper');
-requireText('.vbkit-scripts/doctor.mjs', '.vbkit-scripts/agentshield-probe.mjs', 'doctor uses Node AgentShield probe wrapper');
+requireText('.vibekit/docs/AUTORESEARCH_LEDGER.md', 'node .vibekit/scripts/validate-kit.mjs .', 'autoresearch ledger documents validation command');
+requireText('.cursor/rules/020-security-agentshield.mdc', 'node .vibekit/scripts/agentshield-probe.mjs .', 'Cursor security rule uses Node AgentShield probe wrapper');
+requireText('.vibekit/scripts/doctor.mjs', '.vibekit/scripts/agentshield-probe.mjs', 'doctor uses Node AgentShield probe wrapper');
 
-if (exists('.vbkit-docs/AUTORESEARCH_LEDGER.md')) {
-  const ledgerText = read('.vbkit-docs/AUTORESEARCH_LEDGER.md');
+if (exists('.vibekit/docs/AUTORESEARCH_LEDGER.md')) {
+  const ledgerText = read('.vibekit/docs/AUTORESEARCH_LEDGER.md');
   const stalePhrases = ['pending during build', 'BUILD_REPORT.md'];
   const stalePhrase = stalePhrases.find((phrase) => ledgerText.includes(phrase));
-  stalePhrase ? fail(`.vbkit-docs/AUTORESEARCH_LEDGER.md contains stale phrase: ${stalePhrase}`) : ok('autoresearch ledger has no stale build placeholders');
+  stalePhrase ? fail(`.vibekit/docs/AUTORESEARCH_LEDGER.md contains stale phrase: ${stalePhrase}`) : ok('autoresearch ledger has no stale build placeholders');
 }
 
 const skillMirrors = {
@@ -109,9 +123,11 @@ const skillMirrors = {
   'clearthought': ['.claude/skills/clearthought', '.cursor/skills/clearthought', '.agents/skills/clearthought'],
   'sequential-thinking': ['.claude/skills/sequential-thinking', '.cursor/skills/sequential-thinking', '.agents/skills/sequential-thinking'],
   'reviewing-4p-priorities': ['.claude/skills/reviewing-4p-priorities', '.cursor/skills/reviewing-4p-priorities', '.agents/skills/reviewing-4p-priorities'],
+  'path-sensitive-shell-safety': ['.claude/skills/path-sensitive-shell-safety', '.cursor/skills/path-sensitive-shell-safety', '.agents/skills/path-sensitive-shell-safety'],
   'visual-design-loop': ['.claude/skills/visual-design-loop', '.agents/skills/visual-design-loop'],
   'memento': ['.claude/skills/memento', '.cursor/skills/memento', '.agents/skills/memento'],
-  'coding-level': ['.claude/skills/coding-level', '.cursor/skills/coding-level', '.agents/skills/coding-level']
+  'coding-level': ['.claude/skills/coding-level', '.cursor/skills/coding-level', '.agents/skills/coding-level'],
+  'parallel-analysis': ['.claude/skills/parallel-analysis', '.cursor/skills/parallel-analysis', '.agents/skills/parallel-analysis']
 };
 
 function validateSkillMirror(sourceRel, mirrorRel) {
@@ -149,7 +165,7 @@ function validateSkillMirror(sourceRel, mirrorRel) {
 }
 
 for (const [skill, mirrors] of Object.entries(skillMirrors)) {
-  for (const mirror of mirrors) validateSkillMirror(`skills/${skill}`, mirror);
+  for (const mirror of mirrors) validateSkillMirror(`.vibekit/skills/${skill}`, mirror);
 }
 
 function parseFrontmatter(text) {
@@ -163,7 +179,7 @@ function parseFrontmatter(text) {
   return fields;
 }
 
-for (const surface of ['skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
+for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
   if (!exists(surface)) continue;
   for (const file of listFiles(surface).filter((f) => f.endsWith('SKILL.md'))) {
     const rel = `${surface}/${file}`;
@@ -180,13 +196,13 @@ function stripFrontmatter(text) {
   return text.replace(/^---\n[\s\S]*?\n---\n?/, '').trim();
 }
 
-if (exists('.vbkit-commands')) {
-  const canonicalCmds = listFiles('.vbkit-commands').filter((f) => f.endsWith('.md'));
+if (exists('.vibekit/commands')) {
+  const canonicalCmds = listFiles('.vibekit/commands').filter((f) => f.endsWith('.md'));
   const cmdMirrors = { '.claude/commands': true, '.cursor/commands': true };
   for (const [mirrorDir, stripFm] of Object.entries(cmdMirrors)) {
     if (!exists(mirrorDir)) { warn(`command mirror dir missing: ${mirrorDir}`); continue; }
     for (const file of canonicalCmds) {
-      const srcRel = `.vbkit-commands/${file}`;
+      const srcRel = `.vibekit/commands/${file}`;
       const mirRel = `${mirrorDir}/${file}`;
       if (!exists(mirRel)) { fail(`command mirror ${mirRel} missing`); continue; }
       const srcText = read(srcRel).trim();
@@ -219,7 +235,7 @@ if (Array.isArray(pkg?.files)) {
 }
 
 if (pkg?.scripts && typeof pkg.scripts === 'object') {
-  const scriptTargetRe = /node\s+(?:--check\s+)?((?:\.\/)?(?:\.vbkit-scripts|bin)\/[A-Za-z0-9._-]+\.(?:mjs|js))/g;
+  const scriptTargetRe = /node\s+(?:--check\s+)?((?:\.\/)?(?:\.vibekit\/scripts|bin)\/[A-Za-z0-9._-]+\.(?:mjs|js))/g;
   const targets = new Set();
   for (const command of Object.values(pkg.scripts)) {
     if (typeof command !== 'string') continue;
@@ -256,15 +272,15 @@ if (claudeSettings?.permissions?.deny && cursorSettings?.permissions?.deny) {
 }
 
 if (pkg?.name === 'minimal-vibe-coding-kit') {
-  for (const rel of ['SECURITY.md', 'CONTRIBUTING.md', 'CODE_OF_CONDUCT.md', '.github/dependabot.yml', '.github/workflows/vibekit-validate.yml', '.vbkit-docs/backbone.schema.json']) {
+  for (const rel of ['SECURITY.md', 'CONTRIBUTING.md', 'CODE_OF_CONDUCT.md', '.github/dependabot.yml', '.github/workflows/vibekit-validate.yml', '.vibekit/docs/backbone.schema.json']) {
     exists(rel) ? ok(`release safety file ${rel}`) : fail(`missing release safety file ${rel}`);
   }
 }
 
-if (exists('CLAUDE-template.md')) {
-  const lines = read('CLAUDE-template.md').split(/\r?\n/).length;
-  if (lines <= 120) ok(`CLAUDE-template.md is concise (${lines} lines)`);
-  else warn(`CLAUDE-template.md is long (${lines} lines); target <= 120`);
+if (exists('.vibekit/init/CLAUDE-template.md')) {
+  const lines = read('.vibekit/init/CLAUDE-template.md').split(/\r?\n/).length;
+  if (lines <= 120) ok(`.vibekit/init/CLAUDE-template.md is concise (${lines} lines)`);
+  else warn(`.vibekit/init/CLAUDE-template.md is long (${lines} lines); target <= 120`);
 }
 
 if (exists('backbone.yml')) {
@@ -385,7 +401,7 @@ const riskyPatterns = [
   { pattern: 'ignore previous' + ' instructions', message: 'prompt injection phrase' }
 ];
 
-const scanDirs = ['.claude', '.cursor', '.agents', '.codex-plugin', 'skills', '.vbkit-commands', '.vbkit-scripts', 'AGENTS.md', 'CLAUDE-template.md'];
+const scanDirs = ['.claude', '.cursor', '.agents', '.codex-plugin', '.vibekit/skills', '.vibekit/commands', '.vibekit/scripts', 'AGENTS.md', '.vibekit/init/CLAUDE-template.md'];
 function walk(item) {
   const p = path.join(root, item);
   if (!fs.existsSync(p)) return [];
@@ -408,7 +424,7 @@ for (const file of scanDirs.flatMap(walk)) {
   }
 }
 
-const probe = path.join(root, '.vbkit-scripts/agentshield-probe.mjs');
+const probe = path.join(root, '.vibekit/scripts/agentshield-probe.mjs');
 if (fs.existsSync(probe)) {
   const result = spawnSync(process.execPath, [probe, root, '--json'], { encoding: 'utf8' });
   if (result.status === 0) ok('AgentShield repo probe runs');

package/{.vbkit-scripts → .vibekit/scripts}/vibekit-finalize.mjs

@@ -2,7 +2,7 @@
 // Graduate a consumer project: move one-time bootstrap files into a cleanup
 // folder once init and the first prompt are complete. Safe, idempotent, and
 // reversible. Refuses to run on the kit source repo so it never deletes the
-// kit's own bootstrap files (and never breaks .vbkit-scripts/validate-kit.mjs).
+// kit's own bootstrap files (and never breaks .vibekit/scripts/validate-kit.mjs).
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -16,8 +16,8 @@ const json = args.includes('--json');
 const DEFAULTS = {
   cleanupDir: '_vibekit-cleanup',
   marker: '.vibekit/FINALIZE_DONE',
-  // CLAUDE-template.md is only graduated once CLAUDE.md exists (see below).
-  oneTimeFiles: ['FIRST_TIME_INIT.md', 'FIRST_PROMPT.md', 'PUSH_TO_GITHUB.md', 'CLAUDE-template.md']
+  // .vibekit/init/CLAUDE-template.md is only graduated once CLAUDE.md exists (see below).
+  oneTimeFiles: ['.vibekit/init/FIRST_TIME_INIT.md', '.vibekit/init/FIRST_PROMPT.md', '.vibekit/init/PUSH_TO_GITHUB.md', '.vibekit/init/CLAUDE-template.md']
 };
 
 function exists(rel) { return fs.existsSync(path.join(target, rel)); }
@@ -72,7 +72,7 @@ if (pkg?.name === 'minimal-vibe-coding-kit') {
 if (!exists('backbone.yml')) fail('backbone.yml is missing. Install the kit first.');
 const status = backboneValue(read('backbone.yml'), 'template_status');
 if (status !== 'initialized' && !restore) {
-  fail(`backbone.yml template_status is "${status || 'unknown'}". Run init (FIRST_TIME_INIT.md) before graduating.`);
+  fail(`backbone.yml template_status is "${status || 'unknown'}". Run init (.vibekit/init/FIRST_TIME_INIT.md) before graduating.`);
 }
 
 const cfg = loadConfig();
@@ -80,7 +80,7 @@ const cleanupRoot = path.join(target, cfg.cleanupDir);
 const markerPath = path.join(target, cfg.marker);
 
 function graduateFile(rel) {
-  if (rel === 'CLAUDE-template.md' && !exists('CLAUDE.md')) return false;
+  if (rel === '.vibekit/init/CLAUDE-template.md' && !exists('CLAUDE.md')) return false;
   return exists(rel);
 }
 
@@ -132,7 +132,7 @@ if (!shouldWrite) {
     console.log(`These one-time bootstrap files would move into ${cfg.cleanupDir}/ (then you delete that folder):`);
     for (const f of planned) console.log(`- ${f}`);
     if (!planned.length) console.log('- (none found; nothing to graduate)');
-    console.log(`\nApply with: node .vbkit-scripts/vibekit-finalize.mjs ${args[0] && !args[0].startsWith('--') ? args[0] : '.'} --write --yes`);
+    console.log(`\nApply with: node .vibekit/scripts/vibekit-finalize.mjs ${args[0] && !args[0].startsWith('--') ? args[0] : '.'} --write --yes`);
     console.log('Undo later with: --restore --write');
   }
   process.exit(0);
@@ -167,7 +167,7 @@ ${moved.map((m) => `- ${m}`).join('\n')}
 - Or restore everything to the repo root:
 
 \`\`\`bash
-node .vbkit-scripts/vibekit-finalize.mjs . --restore --write
+node .vibekit/scripts/vibekit-finalize.mjs . --restore --write
 \`\`\`
 
 The durable project map is \`backbone.yml\`; you do not need these files to keep working.

package/{skills → .vibekit/skills}/agentshield-security-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agentshield-security-review
-description: repository-native security review workflow for Claude Code and Codex projects using the AgentShield concept. Use when auditing or hardening agent configuration, skills, prompts, hooks, MCP servers, permissions, slash commands, Codex plugin files, Claude plugin files, AGENTS.md, CLAUDE.md, or repository-level AI coding-agent surfaces. Prefer this skill before merging changes to .claude, .codex, .codex-plugin, .claude-plugin, .agents, skills, .vbkit-commands, .vbkit-scripts, hooks, mcp configs, or generated code that touches agent execution.
+description: repository-native security review workflow for Claude Code and Codex projects using the AgentShield concept. Use when auditing or hardening agent configuration, skills, prompts, hooks, MCP servers, permissions, slash commands, Codex plugin files, Claude plugin files, AGENTS.md, CLAUDE.md, or repository-level AI coding-agent surfaces. Prefer this skill before merging changes to .claude, .codex, .codex-plugin, .claude-plugin, .agents, .vibekit/skills, .vibekit/commands, .vibekit/scripts, hooks, mcp configs, or generated code that touches agent execution.
 ---
 
 # AgentShield Security Review
@@ -14,7 +14,7 @@ Do not invent findings. Prefer deterministic scanner output when available, then
 ## Standard workflow
 
 1. Identify the repo root and active harness surfaces.
-2. Run `node .vbkit-scripts/agentshield-probe.mjs .` to inventory Claude, Codex, shared skills, hooks, MCP, commands, and repo instruction files.
+2. Run `node .vibekit/scripts/agentshield-probe.mjs .` to inventory Claude, Codex, shared skills, hooks, MCP, commands, and repo instruction files.
 3. If Node/npm is available, run AgentShield from the repo root:
    ```bash
    npx ecc-agentshield scan --path . --format text
@@ -34,9 +34,9 @@ Do not invent findings. Prefer deterministic scanner output when available, then
 
 Use a shared root skill where possible:
 
-- `skills/agentshield-security-review/SKILL.md` is the canonical workflow.
-- Claude Code may add a slash-command shim in `.vbkit-commands/security-scan.md` or `.claude/commands/security-scan.md`.
-- Codex should consume the same root `skills/` directory through `.codex-plugin/plugin.json` or the repo's native skill/plugin mechanism.
+- `.vibekit/skills/agentshield-security-review/SKILL.md` is the canonical workflow.
+- Claude Code may add a slash-command shim in `.vibekit/commands/security-scan.md` or `.claude/commands/security-scan.md`.
+- Codex should consume the same root `.vibekit/skills/` directory through `.codex-plugin/plugin.json` or the repo's native skill/plugin mechanism.
 - Do not duplicate divergent Claude and Codex skill bodies. Duplication causes drift.
 
 See `references/native-install.md` for copy-ready Claude and Codex snippets.
@@ -48,7 +48,7 @@ Prioritize runtime-active files over examples and docs:
 1. `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`
 2. `.claude/settings.json`, `.claude/settings.local.json`, `.claude/agents/*.md`, `.claude/commands/*.md`
 3. `.codex/config.toml`, `.codex/`, `.codex-plugin/plugin.json`
-4. `.agents/`, `agents/`, `skills/`, `.vbkit-commands/`, `.vbkit-scripts/`, `hooks/`
+4. `.agents/`, `agents/`, `.vibekit/skills/`, `.vibekit/commands/`, `.vibekit/scripts/`, `hooks/`
 5. `.mcp.json`, `mcp.json`, `mcp-configs/*.json`
 6. installer scripts, CI workflows, package scripts, and generated plugin manifests
 

package/{skills → .vibekit/skills}/agentshield-security-review/references/native-install.md

@@ -7,18 +7,18 @@ Keep one canonical skill and add thin harness adapters.
 Recommended repo layout:
 
 ```text
-skills/agentshield-security-review/SKILL.md
-skills/agentshield-security-review/references/review-checklist.md
-skills/agentshield-security-review/references/report-template.md
-skills/agentshield-security-review/scripts/agentshield_repo_probe.py
-.vbkit-commands/security-scan.md
+.vibekit/skills/agentshield-security-review/SKILL.md
+.vibekit/skills/agentshield-security-review/references/review-checklist.md
+.vibekit/skills/agentshield-security-review/references/report-template.md
+.vibekit/skills/agentshield-security-review/scripts/agentshield_repo_probe.py
+.vibekit/commands/security-scan.md
 .codex-plugin/plugin.json
 .claude-plugin/plugin.json
 ```
 
 ## Claude Code command shim
 
-Create `.vbkit-commands/security-scan.md` or `.claude/commands/security-scan.md`:
+Create `.vibekit/commands/security-scan.md` or `.claude/commands/security-scan.md`:
 
 ```markdown
 ---
@@ -48,7 +48,7 @@ Return grade, score, severity counts, active paths, critical/high findings, and
 
 ## Codex plugin pointer
 
-Use the repo-level Codex plugin manifest to point Codex at the same `skills/` directory. Exact schema may vary by Codex plugin version, so preserve the existing repo schema and ensure it references root skills rather than a copied skill body.
+Use the repo-level Codex plugin manifest to point Codex at the same `.vibekit/skills/` directory. Exact schema may vary by Codex plugin version, so preserve the existing repo schema and ensure it references the canonical `.vibekit/skills/` directory rather than a copied skill body.
 
 Example intent:
 
@@ -56,7 +56,7 @@ Example intent:
 {
   "name": "your-repo",
   "version": "0.1.0",
-  "skills": "./skills",
+  "skills": "./.vibekit/skills",
   "mcp": "./.mcp.json"
 }
 ```
@@ -78,8 +78,8 @@ on:
       - ".claude-plugin/**"
       - ".agents/**"
       - "agents/**"
-      - "skills/**"
-      - ".vbkit-commands/**"
+      - ".vibekit/skills/**"
+      - ".vibekit/commands/**"
       - "hooks/**"
       - ".mcp.json"
       - "mcp-configs/**"

package/{skills → .vibekit/skills}/agentshield-security-review/references/report-template.md

@@ -34,7 +34,7 @@ Use this structure for final reports.
 
 ## Medium/low findings
 
-Group by theme: permissions, hooks, MCP, prompts, skills, .vbkit-docs/examples.
+Group by theme: permissions, hooks, MCP, prompts, skills, .vibekit/docs/examples.
 
 ## Remediation order
 

package/{skills → .vibekit/skills}/agentshield-security-review/scripts/agentshield_repo_probe.py

@@ -15,9 +15,9 @@ PATTERNS = {
     "repo_instructions": ["CLAUDE.md", "AGENTS.md", ".github/copilot-instructions.md"],
     "claude": [".claude", ".claude-plugin", "agents"],
     "codex": [".codex", ".codex-plugin"],
-    "shared_skills": ["skills", ".agents/skills"],
-    "shared_commands": [".vbkit-commands"],
-    "kit_scripts": [".vbkit-scripts"],
+    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", "skills"],
+    "shared_commands": [".vibekit/commands"],
+    "kit_scripts": [".vibekit/scripts"],
     "hooks": ["hooks", ".claude/hooks", ".agents/hooks"],
     "mcp": [".mcp.json", "mcp.json", "mcp-configs"],
     "ci": [".github/workflows"],

package/{skills → .vibekit/skills}/autoresearch-coding/README.md

@@ -11,5 +11,5 @@ Example:
 For this kit:
 
 ```text
-/autoresearch-coding goal: improve the kit; metric command: node .vbkit-scripts/validate-kit.mjs .; direction: higher; editable paths: .vbkit-docs .vbkit-scripts skills .vbkit-commands .claude .cursor .agents .codex-plugin; budget: 3
+/autoresearch-coding goal: improve the kit; metric command: node .vibekit/scripts/validate-kit.mjs .; direction: higher; editable paths: .vibekit/docs .vibekit/scripts .vibekit/skills .vibekit/commands .claude .cursor .agents .codex-plugin; budget: 3
 ```

package/{skills → .vibekit/skills}/autoresearch-coding/SKILL.md

@@ -28,16 +28,16 @@ For this kit itself, use:
 
 ```text
 goal: improve Minimal Vibe Coding Kit quality
-metric command: node .vbkit-scripts/validate-kit.mjs .
+metric command: node .vibekit/scripts/validate-kit.mjs .
 direction: higher
-editable paths: .vbkit-docs .vbkit-scripts skills .vbkit-commands .claude .cursor .agents .codex-plugin .github README.md AGENTS.md CLAUDE-template.md FIRST_TIME_INIT.md FIRST_PROMPT.md backbone.yml package.json install.sh install.ps1
+editable paths: .vibekit/docs .vibekit/scripts .vibekit/skills .vibekit/commands .claude .cursor .agents .codex-plugin .github README.md AGENTS.md .vibekit/init/CLAUDE-template.md .vibekit/init/FIRST_TIME_INIT.md .vibekit/init/FIRST_PROMPT.md backbone.yml package.json install.sh install.ps1
 protected paths: .git .env* node_modules vendor secrets lockfiles
 budget: 3
 ```
 
 ## Setup
 
-1. Read `backbone.yml`. If `meta.template_status` is `uninitialized`, follow `FIRST_TIME_INIT.md` and wait for explicit approval before experiment edits.
+1. Read `backbone.yml`. If `meta.template_status` is `uninitialized`, follow `.vibekit/init/FIRST_TIME_INIT.md` and wait for explicit approval before experiment edits.
 2. Inspect `git status --short`.
 3. If user changes exist, stop unless the user permits dirty-state experimentation.
 4. Create or switch to an experiment branch named `autoresearch/<date>-<slug>` when a git repo is available. If branch creation is blocked by permissions, ask for approval once and record any approved fallback.
@@ -78,7 +78,7 @@ For each experiment:
 7. Keep good changes; revert discarded or crashed changes.
 8. If a crash is from a trivial patch mistake, fix once and rerun.
 
-If a kept change touches agent surfaces such as `AGENTS.md`, `CLAUDE.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, `skills/**`, `.vbkit-commands/**`, `.vbkit-scripts/**`, hooks, or MCP config, run the AgentShield probe before final reporting.
+If a kept change touches agent surfaces such as `AGENTS.md`, `CLAUDE.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, `.vibekit/skills/**`, `.vibekit/commands/**`, `.vibekit/scripts/**`, hooks, or MCP config, run the AgentShield probe before final reporting.
 
 ## Delegation
 

package/{skills → .vibekit/skills}/coding-level/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coding-level
-description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked.
+description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked. A project default may be recorded in backbone.yml conventions.custom_rules.
 disable-model-invocation: true
 argument-hint: "[0-5]"
 ---
@@ -20,6 +20,13 @@ argument-hint: "[0-5]"
 
 1. Read `$ARGUMENTS` as N. If N is not an integer 0–5, reply with the table above and ask for a valid N.
 2. Read `references/level-<N>.md`, state once which level is now active, and apply that persona to every reply until `/coding-level` is invoked again.
+3. Ask once: "Save level N as the project default?" If yes, add or update the `Default coding level: N` entry in `backbone.yml` `conventions.custom_rules` (show the diff and wait for approval, per kit rules).
+
+## Project default
+
+- First-time init records a default as a `backbone.yml` `conventions.custom_rules` entry: `Default coding level: N (<Register>)`.
+- Sessions without an explicit `/coding-level` start from that default level.
+- `/coding-level N` overrides the default for the current session only, unless the user saves it in step 3.
 
 ## Scope
 

package/{skills → .vibekit/skills}/daily-workflow-curator/SKILL.md

@@ -14,19 +14,19 @@ Run a daily improvement pass that proposes changes, not silent edits.
 2. Run:
 
 ```bash
-node .vbkit-scripts/daily-enhance.mjs . --write-report
+node .vibekit/scripts/daily-enhance.mjs . --write-report
 ```
 
 3. Run validation:
 
 ```bash
-node .vbkit-scripts/validate-kit.mjs .
+node .vibekit/scripts/validate-kit.mjs .
 ```
 
 4. Run AgentShield read-only probe if present:
 
 ```bash
-node .vbkit-scripts/agentshield-probe.mjs .
+node .vibekit/scripts/agentshield-probe.mjs .
 ```
 
 5. Identify stale, duplicated, or overly broad rules.