minimal-vibe-coding-kit 0.4.0 → 0.4.2

package/.agents/skills/agentshield-security-review/scripts/agentshield_repo_probe.py

@@ -15,10 +15,11 @@ PATTERNS = {
     "repo_instructions": ["CLAUDE.md", "AGENTS.md", ".github/copilot-instructions.md"],
     "claude": [".claude", ".claude-plugin", "agents"],
     "codex": [".codex", ".codex-plugin"],
-    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", "skills"],
+    "grok": [".grok"],
+    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", ".grok/skills", "skills"],
     "shared_commands": [".vibekit/commands"],
     "kit_scripts": [".vibekit/scripts"],
-    "hooks": ["hooks", ".claude/hooks", ".agents/hooks"],
+    "hooks": ["hooks", ".claude/hooks", ".agents/hooks", ".grok/hooks"],
     "mcp": [".mcp.json", "mcp.json", "mcp-configs"],
     "ci": [".github/workflows"],
 }
@@ -55,6 +56,27 @@ def safe_read(path: Path, limit: int = 200_000) -> str:
         return ""
 
 
+def deny_block_lines(text: str) -> set[int]:
+    """Line indexes inside a permissions deny array (JSON `"deny": [` or TOML `deny = [`).
+
+    Deny rules quote dangerous patterns in order to block them, so a marker on
+    those lines is defensive, not suspicious. Allow/ask blocks are still scanned.
+    """
+    covered: set[int] = set()
+    inside = False
+    for idx, line in enumerate(text.splitlines()):
+        stripped = line.strip()
+        if not inside and "[" in stripped and ('"deny"' in stripped or stripped.startswith("deny =") or stripped.startswith("deny=")):
+            covered.add(idx)
+            inside = "]" not in stripped.split("[", 1)[1]
+            continue
+        if inside:
+            covered.add(idx)
+            if "]" in stripped:
+                inside = False
+    return covered
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description="Inventory Claude/Codex AgentShield surfaces")
     parser.add_argument("path", nargs="?", default=".", help="Repository root")
@@ -77,8 +99,11 @@ def main() -> int:
                     if file_path.suffix.lower() not in {".md", ".json", ".toml", ".yaml", ".yml", ".sh", ".js", ".ts"}:
                         continue
                     text = safe_read(file_path)
+                    skip_lines = deny_block_lines(text)
+                    lines = text.splitlines()
                     for marker in SUSPICIOUS_TEXT:
-                        if marker in text:
+                        hits = [idx for idx, line in enumerate(lines) if marker in line]
+                        if any(idx not in skip_lines for idx in hits):
                             suspicious.append({
                                 "path": str(file_path.relative_to(root)),
                                 "marker": marker,

package/.agents/skills/coding-level/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coding-level
-description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked.
+description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked. A project default may be recorded in backbone.yml conventions.custom_rules.
 disable-model-invocation: true
 argument-hint: "[0-5]"
 ---
@@ -20,6 +20,13 @@ argument-hint: "[0-5]"
 
 1. Read `$ARGUMENTS` as N. If N is not an integer 0–5, reply with the table above and ask for a valid N.
 2. Read `references/level-<N>.md`, state once which level is now active, and apply that persona to every reply until `/coding-level` is invoked again.
+3. Ask once: "Save level N as the project default?" If yes, add or update the `Default coding level: N` entry in `backbone.yml` `conventions.custom_rules` (show the diff and wait for approval, per kit rules).
+
+## Project default
+
+- First-time init records a default as a `backbone.yml` `conventions.custom_rules` entry: `Default coding level: N (<Register>)`.
+- Sessions without an explicit `/coding-level` start from that default level.
+- `/coding-level N` overrides the default for the current session only, unless the user saves it in step 3.
 
 ## Scope
 

package/.agents/skills/path-sensitive-shell-safety/SKILL.md

@@ -48,6 +48,7 @@ No empty, unset, broad, symlinked, or unintended path may reach a destructive co
 
 ## Required outcomes
 
+- Prefer a recoverable delete (`trash`) over permanent `rm` for user files; permanent deletion requires explicit confirmation of the exact paths. If `trash` is missing, recommend installing it (macOS 14+ built-in; older macOS `brew install trash`; Linux `sudo apt install trash-cli`; any OS with Node `npm i -g trash-cli`).
 - A blank branch may follow the documented default-branch fallback policy.
 - An explicit branch must fail if missing; never silently deploy another branch.
 - A blank folder/base value must fail before any `rm`, `mv`, `cp`, `rsync`, `find`, Docker, or Git cleanup command runs.

package/.agents/skills/prompt-sharpener/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: prompt-sharpener
+description: Sharpen a rough prompt into a precise one — same intent, sharper not longer — then execute the sharpened version immediately in the same turn.
+argument-hint: "the rough prompt to sharpen and execute"
+disable-model-invocation: true
+---
+
+# Prompt Sharpener
+
+The text the user types after the invocation is the **raw prompt**. Upgrade it into a prompt that is **sharper, not longer** — keep the original intent, constraints, and language — then execute the upgraded version immediately in the same turn. No text after the invocation → ask the user what they want and stop.
+
+## Step 1 — Diagnose the raw prompt
+
+Scan for every ailment below; each ailment found gets its cure applied directly in the upgraded prompt. Cure silently; call out a cure only when it could shift the user's intent.
+
+- Vague verbs or adjectives ("help me", "make it nicer") → concrete, measurable operations and parameters.
+- Two tasks in one prompt → split into an explicit execution order.
+- No success criteria → add a binary pass/fail `Done when`.
+- Emotional description ("everything is broken") → extract the specific technical symptom.
+- "The whole app" scope → pin exact files/functions/directories; coding tasks always get a **scope lock** (edit only inside X, leave the rest untouched).
+- Relies on memory of an old session → copy the decisions already settled in this conversation (stack, architecture, what was tried and failed) into the `Context` block.
+- Invitation to fabricate ("what do experts say about X?") → anchor grounding: state only what can be verified; when unsure, say so explicitly.
+- No output format → fix the structure and length; when the format is hard to describe in words, include 2-3 sample examples (including an edge case) in the `Output Contract`.
+
+Done when: the raw prompt has been checked against the full list and no ailment is left without its cure in the upgraded prompt.
+
+## Step 2 — Build the upgraded prompt
+
+Classify the task (coding / research / writing / analysis / planning / review), then assemble blocks in this order — add a block only when it raises precision; small tasks need just 2-3 blocks:
+
+`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`
+
+Focus per task type:
+
+- Coding: scope lock, smallest correct change, validation after the edit — default to the `validate` command in `backbone.yml` when the repo has one.
+- Research: source quality, citations, explicit uncertainty.
+- Writing: audience, voice, length.
+- Review: group findings by severity, name the failure mode.
+
+Construction rules:
+
+- Write constraints with the strongest signal words: MUST instead of "should", NEVER instead of "avoid".
+- Missing information → state the assumption in `Context` and keep going; stop to ask only when the task is destructive or irreversible.
+- Say _what_ to verify; let the model regulate its own depth of thought.
+- Repo work MUST respect `backbone.yml` conventions and protected paths; when the upgraded task is a large decomposition or a risky decision, its `Work Style` block may direct Step 3 to open with the `sequential-thinking` or `clearthought` skill.
+- Closing audit: reread every sentence; if cutting it would not change the output, cut it — every remaining word is **load-bearing**.
+
+Done when the upgraded prompt scores on all 6 points: intent preserved — ambiguity reduced — right depth — clear output — has verification — has a stopping point.
+
+## Step 3 — Present and execute
+
+Print the upgraded prompt in a single code block, with at most 2 sentences on the key changes. Then treat it as the user's official request: start executing immediately in the same turn, researching and editing according to its own `Tool Rules`.
+
+Done when the upgraded prompt's `Done Criteria` are satisfied.

package/.agents/skills/vibekit-init/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: vibekit-init
-description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, or Codex skill setup. Always show requirements and a diff before writing.
+description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, Codex skill setup, or Grok setup. Always show requirements and a diff before writing.
 disable-model-invocation: true
-argument-hint: target path; profiles claude,cursor,codex; write yes/no
+argument-hint: target path; profiles claude,cursor,codex,grok; write yes/no
 ---
 
 # Vibe Kit Init

package/.claude/rules/safe-delete.md

@@ -0,0 +1,11 @@
+# Safe delete rules
+
+- Never delete permanently by default. Prefer `trash` over `rm`, `rm -rf`, `rmdir`, and `find -delete` so deletions stay recoverable.
+- Before deleting, check availability with `command -v trash`. If available, use `trash <path>`.
+- If `trash` is missing, recommend installing it instead of falling back to `rm`:
+  - macOS 14 or newer: built in at `/usr/bin/trash`, nothing to install.
+  - Older macOS: `brew install trash` (https://formulae.brew.sh/formula/trash).
+  - Linux: `sudo apt install trash-cli` or `pip install trash-cli` (https://github.com/andreafrancia/trash-cli).
+  - Any OS with Node.js: `npm install --global trash-cli` (https://github.com/sindresorhus/trash-cli).
+- Permanent deletion requires the user's explicit approval of the exact paths, and the `path-sensitive-shell-safety` skill first when paths come from variables.
+- Honor the deletion preference recorded in `backbone.yml` `conventions.custom_rules` during first-time init.

package/.claude/settings.json

@@ -6,10 +6,17 @@
       "Bash(git push:*)",
       "Bash(git push --force:*)",
       "Bash(git reset --hard:*)",
-      "Bash(curl *|*sh:*)",
-      "Bash(wget *|*sh:*)",
+      "Bash(sh)",
+      "Bash(sh -)",
+      "Bash(bash)",
+      "Bash(bash -)",
+      "Bash(zsh)",
+      "Bash(zsh -)",
+      "Bash(npx --yes *)",
+      "Bash(npx -y *)",
+      "Bash(npx * --yes *)",
+      "Bash(npx * -y *)",
       "Bash(npm publish:*)",
-      "Bash(npx * --yes:*)",
       "Bash(migrate *)",
       "Bash(docker compose up*)",
       "Bash(docker-compose up*)"

package/.claude/skills/agentshield-security-review/scripts/agentshield_repo_probe.py

@@ -15,10 +15,11 @@ PATTERNS = {
     "repo_instructions": ["CLAUDE.md", "AGENTS.md", ".github/copilot-instructions.md"],
     "claude": [".claude", ".claude-plugin", "agents"],
     "codex": [".codex", ".codex-plugin"],
-    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", "skills"],
+    "grok": [".grok"],
+    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", ".grok/skills", "skills"],
     "shared_commands": [".vibekit/commands"],
     "kit_scripts": [".vibekit/scripts"],
-    "hooks": ["hooks", ".claude/hooks", ".agents/hooks"],
+    "hooks": ["hooks", ".claude/hooks", ".agents/hooks", ".grok/hooks"],
     "mcp": [".mcp.json", "mcp.json", "mcp-configs"],
     "ci": [".github/workflows"],
 }
@@ -55,6 +56,27 @@ def safe_read(path: Path, limit: int = 200_000) -> str:
         return ""
 
 
+def deny_block_lines(text: str) -> set[int]:
+    """Line indexes inside a permissions deny array (JSON `"deny": [` or TOML `deny = [`).
+
+    Deny rules quote dangerous patterns in order to block them, so a marker on
+    those lines is defensive, not suspicious. Allow/ask blocks are still scanned.
+    """
+    covered: set[int] = set()
+    inside = False
+    for idx, line in enumerate(text.splitlines()):
+        stripped = line.strip()
+        if not inside and "[" in stripped and ('"deny"' in stripped or stripped.startswith("deny =") or stripped.startswith("deny=")):
+            covered.add(idx)
+            inside = "]" not in stripped.split("[", 1)[1]
+            continue
+        if inside:
+            covered.add(idx)
+            if "]" in stripped:
+                inside = False
+    return covered
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description="Inventory Claude/Codex AgentShield surfaces")
     parser.add_argument("path", nargs="?", default=".", help="Repository root")
@@ -77,8 +99,11 @@ def main() -> int:
                     if file_path.suffix.lower() not in {".md", ".json", ".toml", ".yaml", ".yml", ".sh", ".js", ".ts"}:
                         continue
                     text = safe_read(file_path)
+                    skip_lines = deny_block_lines(text)
+                    lines = text.splitlines()
                     for marker in SUSPICIOUS_TEXT:
-                        if marker in text:
+                        hits = [idx for idx, line in enumerate(lines) if marker in line]
+                        if any(idx not in skip_lines for idx in hits):
                             suspicious.append({
                                 "path": str(file_path.relative_to(root)),
                                 "marker": marker,

package/.claude/skills/coding-level/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coding-level
-description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked.
+description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked. A project default may be recorded in backbone.yml conventions.custom_rules.
 disable-model-invocation: true
 argument-hint: "[0-5]"
 ---
@@ -20,6 +20,13 @@ argument-hint: "[0-5]"
 
 1. Read `$ARGUMENTS` as N. If N is not an integer 0–5, reply with the table above and ask for a valid N.
 2. Read `references/level-<N>.md`, state once which level is now active, and apply that persona to every reply until `/coding-level` is invoked again.
+3. Ask once: "Save level N as the project default?" If yes, add or update the `Default coding level: N` entry in `backbone.yml` `conventions.custom_rules` (show the diff and wait for approval, per kit rules).
+
+## Project default
+
+- First-time init records a default as a `backbone.yml` `conventions.custom_rules` entry: `Default coding level: N (<Register>)`.
+- Sessions without an explicit `/coding-level` start from that default level.
+- `/coding-level N` overrides the default for the current session only, unless the user saves it in step 3.
 
 ## Scope
 

package/.claude/skills/path-sensitive-shell-safety/SKILL.md

@@ -48,6 +48,7 @@ No empty, unset, broad, symlinked, or unintended path may reach a destructive co
 
 ## Required outcomes
 
+- Prefer a recoverable delete (`trash`) over permanent `rm` for user files; permanent deletion requires explicit confirmation of the exact paths. If `trash` is missing, recommend installing it (macOS 14+ built-in; older macOS `brew install trash`; Linux `sudo apt install trash-cli`; any OS with Node `npm i -g trash-cli`).
 - A blank branch may follow the documented default-branch fallback policy.
 - An explicit branch must fail if missing; never silently deploy another branch.
 - A blank folder/base value must fail before any `rm`, `mv`, `cp`, `rsync`, `find`, Docker, or Git cleanup command runs.

package/.claude/skills/prompt-sharpener/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: prompt-sharpener
+description: Sharpen a rough prompt into a precise one — same intent, sharper not longer — then execute the sharpened version immediately in the same turn.
+argument-hint: "the rough prompt to sharpen and execute"
+disable-model-invocation: true
+---
+
+# Prompt Sharpener
+
+The text the user types after the invocation is the **raw prompt**. Upgrade it into a prompt that is **sharper, not longer** — keep the original intent, constraints, and language — then execute the upgraded version immediately in the same turn. No text after the invocation → ask the user what they want and stop.
+
+## Step 1 — Diagnose the raw prompt
+
+Scan for every ailment below; each ailment found gets its cure applied directly in the upgraded prompt. Cure silently; call out a cure only when it could shift the user's intent.
+
+- Vague verbs or adjectives ("help me", "make it nicer") → concrete, measurable operations and parameters.
+- Two tasks in one prompt → split into an explicit execution order.
+- No success criteria → add a binary pass/fail `Done when`.
+- Emotional description ("everything is broken") → extract the specific technical symptom.
+- "The whole app" scope → pin exact files/functions/directories; coding tasks always get a **scope lock** (edit only inside X, leave the rest untouched).
+- Relies on memory of an old session → copy the decisions already settled in this conversation (stack, architecture, what was tried and failed) into the `Context` block.
+- Invitation to fabricate ("what do experts say about X?") → anchor grounding: state only what can be verified; when unsure, say so explicitly.
+- No output format → fix the structure and length; when the format is hard to describe in words, include 2-3 sample examples (including an edge case) in the `Output Contract`.
+
+Done when: the raw prompt has been checked against the full list and no ailment is left without its cure in the upgraded prompt.
+
+## Step 2 — Build the upgraded prompt
+
+Classify the task (coding / research / writing / analysis / planning / review), then assemble blocks in this order — add a block only when it raises precision; small tasks need just 2-3 blocks:
+
+`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`
+
+Focus per task type:
+
+- Coding: scope lock, smallest correct change, validation after the edit — default to the `validate` command in `backbone.yml` when the repo has one.
+- Research: source quality, citations, explicit uncertainty.
+- Writing: audience, voice, length.
+- Review: group findings by severity, name the failure mode.
+
+Construction rules:
+
+- Write constraints with the strongest signal words: MUST instead of "should", NEVER instead of "avoid".
+- Missing information → state the assumption in `Context` and keep going; stop to ask only when the task is destructive or irreversible.
+- Say _what_ to verify; let the model regulate its own depth of thought.
+- Repo work MUST respect `backbone.yml` conventions and protected paths; when the upgraded task is a large decomposition or a risky decision, its `Work Style` block may direct Step 3 to open with the `sequential-thinking` or `clearthought` skill.
+- Closing audit: reread every sentence; if cutting it would not change the output, cut it — every remaining word is **load-bearing**.
+
+Done when the upgraded prompt scores on all 6 points: intent preserved — ambiguity reduced — right depth — clear output — has verification — has a stopping point.
+
+## Step 3 — Present and execute
+
+Print the upgraded prompt in a single code block, with at most 2 sentences on the key changes. Then treat it as the user's official request: start executing immediately in the same turn, researching and editing according to its own `Tool Rules`.
+
+Done when the upgraded prompt's `Done Criteria` are satisfied.

package/.claude/skills/vibekit-init/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: vibekit-init
-description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, or Codex skill setup. Always show requirements and a diff before writing.
+description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, Codex skill setup, or Grok setup. Always show requirements and a diff before writing.
 disable-model-invocation: true
-argument-hint: target path; profiles claude,cursor,codex; write yes/no
+argument-hint: target path; profiles claude,cursor,codex,grok; write yes/no
 ---
 
 # Vibe Kit Init

package/.codex/rules/vibekit.rules

@@ -0,0 +1,77 @@
+# Minimal Vibe Coding Kit guardrails for Codex.
+# Codex rules are experimental. Project-local rules load only when the
+# project .codex/ layer is trusted, and they govern commands that request
+# execution outside the sandbox. Verify a rule with:
+#   codex execpolicy check --pretty --rules .codex/rules/vibekit.rules -- git push origin main
+
+prefix_rule(
+    pattern = ["rm"],
+    decision = "forbidden",
+    justification = "Use `trash` instead of `rm` so deletions stay recoverable.",
+    match = ["rm -rf build", "rm notes.txt"],
+    not_match = ["trash notes.txt"],
+)
+
+prefix_rule(
+    pattern = ["git", "push"],
+    decision = "forbidden",
+    justification = "Pushing needs explicit user approval.",
+    match = ["git push", "git push --force origin main"],
+    not_match = ["git status"],
+)
+
+prefix_rule(
+    pattern = ["git", "reset", "--hard"],
+    decision = "forbidden",
+    justification = "Hard resets discard work; ask the user first.",
+    match = ["git reset --hard origin/main"],
+    not_match = ["git reset --soft HEAD~1"],
+)
+
+prefix_rule(
+    pattern = [["sh", "bash", "zsh"]],
+    decision = "forbidden",
+    justification = "Blocks `curl ... | sh` style remote installers; run vetted scripts by path instead.",
+    match = ["sh -c ls", "bash install.sh"],
+    not_match = ["shellcheck install.sh"],
+)
+
+prefix_rule(
+    pattern = ["npx", ["--yes", "-y"]],
+    decision = "forbidden",
+    justification = "Auto-confirmed npx executes arbitrary packages; drop the --yes/-y flag so the run is reviewed.",
+    match = ["npx --yes some-package", "npx -y some-package"],
+    not_match = ["npx vitest run"],
+)
+
+prefix_rule(
+    pattern = ["npm", "publish"],
+    decision = "forbidden",
+    justification = "Publishing needs explicit user approval.",
+    match = ["npm publish", "npm publish --access public"],
+    not_match = ["npm pack"],
+)
+
+prefix_rule(
+    pattern = ["migrate"],
+    decision = "forbidden",
+    justification = "Database migrations need explicit user approval.",
+    match = ["migrate up"],
+    not_match = ["npm run migrate"],
+)
+
+prefix_rule(
+    pattern = ["docker", "compose", "up"],
+    decision = "forbidden",
+    justification = "Starting service stacks needs explicit user approval.",
+    match = ["docker compose up -d"],
+    not_match = ["docker compose ps"],
+)
+
+prefix_rule(
+    pattern = ["docker-compose", "up"],
+    decision = "forbidden",
+    justification = "Starting service stacks needs explicit user approval.",
+    match = ["docker-compose up -d"],
+    not_match = ["docker-compose ps"],
+)

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "minimal-vibe-coding-kit",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Reusable vibe coding skills and workflows for Codex-compatible repositories.",
   "author": {
     "name": "Minimal Vibe Coding Kit"

package/.cursor/cli.json

@@ -0,0 +1,18 @@
+{
+  "permissions": {
+    "deny": [
+      "Shell(rm)",
+      "Shell(sh)",
+      "Shell(bash)",
+      "Shell(zsh)",
+      "Shell(git:push*)",
+      "Shell(git:reset --hard*)",
+      "Shell(npx:--yes*)",
+      "Shell(npx:-y*)",
+      "Shell(npm:publish*)",
+      "Shell(migrate)",
+      "Shell(docker:compose up*)",
+      "Shell(docker-compose:up*)"
+    ]
+  }
+}

package/.cursor/rules/040-safe-delete.mdc

@@ -0,0 +1,16 @@
+---
+description: Safe-delete guardrail - prefer trash over rm so deletions stay recoverable.
+alwaysApply: true
+---
+
+# Safe delete rules
+
+- Never delete permanently by default. Prefer `trash` over `rm`, `rm -rf`, `rmdir`, and `find -delete` so deletions stay recoverable.
+- Before deleting, check availability with `command -v trash`. If available, use `trash <path>`.
+- If `trash` is missing, recommend installing it instead of falling back to `rm`:
+  - macOS 14 or newer: built in at `/usr/bin/trash`, nothing to install.
+  - Older macOS: `brew install trash` (https://formulae.brew.sh/formula/trash).
+  - Linux: `sudo apt install trash-cli` or `pip install trash-cli` (https://github.com/andreafrancia/trash-cli).
+  - Any OS with Node.js: `npm install --global trash-cli` (https://github.com/sindresorhus/trash-cli).
+- Permanent deletion requires the user's explicit approval of the exact paths, and the `path-sensitive-shell-safety` skill first when paths come from variables.
+- Honor the deletion preference recorded in `backbone.yml` `conventions.custom_rules` during first-time init.

package/.cursor/settings.json

@@ -2,15 +2,22 @@
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "permissions": {
     "deny": [
-      "Bash(rm -rf *)",
+      "Bash(rm -rf:*)",
       "Bash(rm:*)",
-      "Bash(git push *)",
-      "Bash(git push --force*)",
-      "Bash(git reset --hard*)",
-      "Bash(curl *|*sh*)",
-      "Bash(wget *|*sh*)",
-      "Bash(npm publish*)",
-      "Bash(npx * --yes*)",
+      "Bash(git push:*)",
+      "Bash(git push --force:*)",
+      "Bash(git reset --hard:*)",
+      "Bash(sh)",
+      "Bash(sh -)",
+      "Bash(bash)",
+      "Bash(bash -)",
+      "Bash(zsh)",
+      "Bash(zsh -)",
+      "Bash(npx --yes *)",
+      "Bash(npx -y *)",
+      "Bash(npx * --yes *)",
+      "Bash(npx * -y *)",
+      "Bash(npm publish:*)",
       "Bash(migrate *)",
       "Bash(docker compose up*)",
       "Bash(docker-compose up*)"

package/.cursor/skills/coding-level/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coding-level
-description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked.
+description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked. A project default may be recorded in backbone.yml conventions.custom_rules.
 disable-model-invocation: true
 argument-hint: "[0-5]"
 ---
@@ -20,6 +20,13 @@ argument-hint: "[0-5]"
 
 1. Read `$ARGUMENTS` as N. If N is not an integer 0–5, reply with the table above and ask for a valid N.
 2. Read `references/level-<N>.md`, state once which level is now active, and apply that persona to every reply until `/coding-level` is invoked again.
+3. Ask once: "Save level N as the project default?" If yes, add or update the `Default coding level: N` entry in `backbone.yml` `conventions.custom_rules` (show the diff and wait for approval, per kit rules).
+
+## Project default
+
+- First-time init records a default as a `backbone.yml` `conventions.custom_rules` entry: `Default coding level: N (<Register>)`.
+- Sessions without an explicit `/coding-level` start from that default level.
+- `/coding-level N` overrides the default for the current session only, unless the user saves it in step 3.
 
 ## Scope
 

package/.cursor/skills/path-sensitive-shell-safety/SKILL.md

@@ -48,6 +48,7 @@ No empty, unset, broad, symlinked, or unintended path may reach a destructive co
 
 ## Required outcomes
 
+- Prefer a recoverable delete (`trash`) over permanent `rm` for user files; permanent deletion requires explicit confirmation of the exact paths. If `trash` is missing, recommend installing it (macOS 14+ built-in; older macOS `brew install trash`; Linux `sudo apt install trash-cli`; any OS with Node `npm i -g trash-cli`).
 - A blank branch may follow the documented default-branch fallback policy.
 - An explicit branch must fail if missing; never silently deploy another branch.
 - A blank folder/base value must fail before any `rm`, `mv`, `cp`, `rsync`, `find`, Docker, or Git cleanup command runs.

package/.cursor/skills/prompt-sharpener/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: prompt-sharpener
+description: Sharpen a rough prompt into a precise one — same intent, sharper not longer — then execute the sharpened version immediately in the same turn.
+argument-hint: "the rough prompt to sharpen and execute"
+disable-model-invocation: true
+---
+
+# Prompt Sharpener
+
+The text the user types after the invocation is the **raw prompt**. Upgrade it into a prompt that is **sharper, not longer** — keep the original intent, constraints, and language — then execute the upgraded version immediately in the same turn. No text after the invocation → ask the user what they want and stop.
+
+## Step 1 — Diagnose the raw prompt
+
+Scan for every ailment below; each ailment found gets its cure applied directly in the upgraded prompt. Cure silently; call out a cure only when it could shift the user's intent.
+
+- Vague verbs or adjectives ("help me", "make it nicer") → concrete, measurable operations and parameters.
+- Two tasks in one prompt → split into an explicit execution order.
+- No success criteria → add a binary pass/fail `Done when`.
+- Emotional description ("everything is broken") → extract the specific technical symptom.
+- "The whole app" scope → pin exact files/functions/directories; coding tasks always get a **scope lock** (edit only inside X, leave the rest untouched).
+- Relies on memory of an old session → copy the decisions already settled in this conversation (stack, architecture, what was tried and failed) into the `Context` block.
+- Invitation to fabricate ("what do experts say about X?") → anchor grounding: state only what can be verified; when unsure, say so explicitly.
+- No output format → fix the structure and length; when the format is hard to describe in words, include 2-3 sample examples (including an edge case) in the `Output Contract`.
+
+Done when: the raw prompt has been checked against the full list and no ailment is left without its cure in the upgraded prompt.
+
+## Step 2 — Build the upgraded prompt
+
+Classify the task (coding / research / writing / analysis / planning / review), then assemble blocks in this order — add a block only when it raises precision; small tasks need just 2-3 blocks:
+
+`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`
+
+Focus per task type:
+
+- Coding: scope lock, smallest correct change, validation after the edit — default to the `validate` command in `backbone.yml` when the repo has one.
+- Research: source quality, citations, explicit uncertainty.
+- Writing: audience, voice, length.
+- Review: group findings by severity, name the failure mode.
+
+Construction rules:
+
+- Write constraints with the strongest signal words: MUST instead of "should", NEVER instead of "avoid".
+- Missing information → state the assumption in `Context` and keep going; stop to ask only when the task is destructive or irreversible.
+- Say _what_ to verify; let the model regulate its own depth of thought.
+- Repo work MUST respect `backbone.yml` conventions and protected paths; when the upgraded task is a large decomposition or a risky decision, its `Work Style` block may direct Step 3 to open with the `sequential-thinking` or `clearthought` skill.
+- Closing audit: reread every sentence; if cutting it would not change the output, cut it — every remaining word is **load-bearing**.
+
+Done when the upgraded prompt scores on all 6 points: intent preserved — ambiguity reduced — right depth — clear output — has verification — has a stopping point.
+
+## Step 3 — Present and execute
+
+Print the upgraded prompt in a single code block, with at most 2 sentences on the key changes. Then treat it as the user's official request: start executing immediately in the same turn, researching and editing according to its own `Tool Rules`.
+
+Done when the upgraded prompt's `Done Criteria` are satisfied.

package/.grok/README.md

@@ -0,0 +1,13 @@
+# Grok notes
+
+Grok Build (the `grok` CLI) reads `AGENTS.md` from the repo root down to the working directory (Codex-style), plus every `*.md` rule in `.grok/rules/`, and repository skills from `.grok/skills/`. User-invocable skills also appear as slash commands, for example `/memento` or `/prompt-sharpener`.
+
+Useful built-ins include `/plan`, `/skills`, `/plugins`, `/hooks`, `/mcps`, and `/model`; `grok inspect` lists the config sources, instructions, skills, plugins, hooks, and MCP servers discovered for the current directory, and `grok -p "<prompt>"` runs headless.
+
+Guardrails ship in two layers. This repo's `.grok/config.toml` carries project-scoped `[permission]` deny rules for dangerous commands — project configs support MCP servers, plugins, and permission rules. User preferences such as `[ui] permission_mode` are user-scoped only and belong in `~/.grok/config.toml`; see `config.example.toml`. Project `.grok/hooks/` require `/hooks-trust` before they run.
+
+Native custom reasoning skills:
+
+- `clearthought`: structured reasoning for broad or ambiguous coding tasks.
+- `sequential-thinking`: step-by-step task splitting with revisions and branches.
+- `reviewing-4p-priorities`: P0-P4 review triage and fix ordering.

package/.grok/config.example.toml

@@ -0,0 +1,13 @@
+# Example user-level settings. Copy the relevant parts into ~/.grok/config.toml.
+# Project-scoped guardrails already ship in this repo's .grok/config.toml
+# ([permission] deny rules for dangerous commands); Grok merges both layers.
+
+# Keep the default ask-before-run permission mode; do not enable always-approve.
+# permission_mode is user-scoped and is ignored in project configs.
+[ui]
+permission_mode = "ask"
+
+# One-off deny on the CLI: grok --deny 'Bash(rm -rf *)'
+# Enterprise-managed policy belongs in /etc/grok/requirements.toml (fail-closed;
+# it cannot be overridden by user or project config).
+# References: https://docs.x.ai/build/settings and https://docs.x.ai/build/enterprise