minimal-vibe-coding-kit 0.4.0 → 0.4.2

package/.vibekit/scripts/validate-kit.mjs

@@ -33,30 +33,53 @@ function listFiles(rel) {
   return out.sort();
 }
 
+// Surface presence: end-user repos may install only some profiles, so
+// per-surface files are required only when that surface is installed.
+// The kit source repo always validates every surface.
+const isKitSourceRepo = readJson('package.json')?.name === 'minimal-vibe-coding-kit';
+const surfacePresent = {
+  claude: isKitSourceRepo || exists('.claude'),
+  cursor: isKitSourceRepo || exists('.cursor'),
+  codex: isKitSourceRepo || exists('.agents') || exists('.codex') || exists('.codex-plugin'),
+  grok: isKitSourceRepo || exists('.grok')
+};
+for (const [surface, present] of Object.entries(surfacePresent)) {
+  if (!present) console.log(`INFO surface ${surface} not installed; skipping its checks`);
+}
+
+const KIT_SKILLS = [
+  'autoresearch-coding', 'agentshield-security-review', 'daily-workflow-curator', 'vibekit-init',
+  'clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'visual-design-loop',
+  'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis', 'prompt-sharpener'
+];
+const CURSOR_KIT_SKILLS = [
+  'clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety',
+  'memento', 'coding-level', 'parallel-analysis', 'prompt-sharpener'
+];
+
 const required = [
   'AGENTS.md', '.vibekit/init/CLAUDE-template.md', '.vibekit/init/FIRST_TIME_INIT.md', '.vibekit/init/FIRST_PROMPT.md', 'backbone.yml',
   '.vibekit/scripts/mvck.mjs', '.vibekit/scripts/init-backbone.mjs', '.vibekit/scripts/daily-enhance.mjs', '.vibekit/scripts/validate-kit.mjs',
   '.vibekit/scripts/doctor.mjs', '.vibekit/scripts/agentshield-probe.mjs', '.vibekit/scripts/vibekit-finalize.mjs',
-  '.vibekit/skills/autoresearch-coding/SKILL.md', '.vibekit/skills/agentshield-security-review/SKILL.md', '.vibekit/skills/daily-workflow-curator/SKILL.md', '.vibekit/skills/vibekit-init/SKILL.md',
-  '.vibekit/skills/clearthought/SKILL.md', '.vibekit/skills/sequential-thinking/SKILL.md', '.vibekit/skills/reviewing-4p-priorities/SKILL.md', '.vibekit/skills/visual-design-loop/SKILL.md',
-  '.vibekit/skills/path-sensitive-shell-safety/SKILL.md', '.vibekit/skills/memento/SKILL.md', '.vibekit/skills/coding-level/SKILL.md', '.vibekit/skills/parallel-analysis/SKILL.md',
-  '.vibekit/docs/templates/PRD_TEMPLATE.md', '.vibekit/docs/templates/CONTEXT_TEMPLATE.md',
-  '.codex/README.md', '.codex/config.example.toml',
-  '.claude/skills/autoresearch-coding/SKILL.md', '.claude/skills/agentshield-security-review/SKILL.md',
-  '.claude/skills/daily-workflow-curator/SKILL.md', '.claude/skills/vibekit-init/SKILL.md',
-  '.claude/skills/clearthought/SKILL.md', '.claude/skills/sequential-thinking/SKILL.md', '.claude/skills/reviewing-4p-priorities/SKILL.md', '.claude/skills/visual-design-loop/SKILL.md',
-  '.claude/skills/path-sensitive-shell-safety/SKILL.md', '.claude/skills/memento/SKILL.md', '.claude/skills/coding-level/SKILL.md',
-  '.claude/skills/parallel-analysis/SKILL.md',
-  '.cursor/rules/001-vibe-core.mdc', '.cursor/skills/clearthought/SKILL.md', '.cursor/skills/sequential-thinking/SKILL.md', '.cursor/skills/reviewing-4p-priorities/SKILL.md',
-  '.cursor/skills/path-sensitive-shell-safety/SKILL.md',
-  '.cursor/skills/memento/SKILL.md', '.cursor/skills/coding-level/SKILL.md', '.cursor/skills/parallel-analysis/SKILL.md',
-  '.agents/skills/autoresearch-coding/SKILL.md', '.agents/skills/agentshield-security-review/SKILL.md',
-  '.agents/skills/daily-workflow-curator/SKILL.md', '.agents/skills/vibekit-init/SKILL.md',
-  '.agents/skills/clearthought/SKILL.md', '.agents/skills/sequential-thinking/SKILL.md', '.agents/skills/reviewing-4p-priorities/SKILL.md', '.agents/skills/visual-design-loop/SKILL.md',
-  '.agents/skills/path-sensitive-shell-safety/SKILL.md', '.agents/skills/memento/SKILL.md', '.agents/skills/coding-level/SKILL.md',
-  '.agents/skills/parallel-analysis/SKILL.md',
-  '.codex-plugin/plugin.json'
+  ...KIT_SKILLS.map((skill) => `.vibekit/skills/${skill}/SKILL.md`),
+  '.vibekit/docs/templates/PRD_TEMPLATE.md', '.vibekit/docs/templates/CONTEXT_TEMPLATE.md'
 ];
+if (surfacePresent.claude) {
+  required.push(...KIT_SKILLS.map((skill) => `.claude/skills/${skill}/SKILL.md`));
+}
+if (surfacePresent.cursor) {
+  required.push('.cursor/rules/001-vibe-core.mdc', '.cursor/cli.json',
+    ...CURSOR_KIT_SKILLS.map((skill) => `.cursor/skills/${skill}/SKILL.md`));
+}
+if (surfacePresent.codex) {
+  required.push('.codex/README.md', '.codex/config.example.toml', '.codex/rules/vibekit.rules', '.codex-plugin/plugin.json',
+    ...KIT_SKILLS.map((skill) => `.agents/skills/${skill}/SKILL.md`));
+}
+if (surfacePresent.grok) {
+  required.push('.grok/README.md', '.grok/config.example.toml', '.grok/config.toml',
+    '.grok/rules/vibe-core.md', '.grok/rules/security.md', '.grok/rules/safe-delete.md',
+    ...KIT_SKILLS.map((skill) => `.grok/skills/${skill}/SKILL.md`));
+}
 
 const reasoningSkillResources = {
   'clearthought': [
@@ -83,7 +106,12 @@ const reasoningSkillResources = {
   ]
 };
 
-for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
+const reasoningSurfaceDirs = ['.vibekit/skills'];
+if (surfacePresent.claude) reasoningSurfaceDirs.push('.claude/skills');
+if (surfacePresent.cursor) reasoningSurfaceDirs.push('.cursor/skills');
+if (surfacePresent.codex) reasoningSurfaceDirs.push('.agents/skills');
+if (surfacePresent.grok) reasoningSurfaceDirs.push('.grok/skills');
+for (const surface of reasoningSurfaceDirs) {
   for (const [skill, files] of Object.entries(reasoningSkillResources)) {
     for (const file of files) required.push(`${surface}/${skill}/${file}`);
   }
@@ -94,7 +122,6 @@ if (exists('README.md')) ok('optional README.md present');
 else console.log('INFO optional README.md not present in target project');
 
 // Kit-maintainer files: required in the kit source repo, intentionally absent in end-user installs.
-const isKitSourceRepo = readJson('package.json')?.name === 'minimal-vibe-coding-kit';
 if (isKitSourceRepo) {
   for (const rel of ['.vibekit/scripts/test-install.mjs', '.vibekit/scripts/pack-dry-run.mjs', '.vibekit/docs/RESEARCH_NOTES.md', '.vibekit/docs/AUTORESEARCH_LEDGER.md']) {
     exists(rel) ? ok(`kit-source file ${rel}`) : fail(`missing kit-source file ${rel}`);
@@ -116,18 +143,19 @@ if (exists('.vibekit/docs/AUTORESEARCH_LEDGER.md')) {
 }
 
 const skillMirrors = {
-  'autoresearch-coding': ['.claude/skills/autoresearch-coding', '.agents/skills/autoresearch-coding'],
-  'agentshield-security-review': ['.claude/skills/agentshield-security-review', '.agents/skills/agentshield-security-review'],
-  'daily-workflow-curator': ['.claude/skills/daily-workflow-curator', '.agents/skills/daily-workflow-curator'],
-  'vibekit-init': ['.claude/skills/vibekit-init', '.agents/skills/vibekit-init'],
-  'clearthought': ['.claude/skills/clearthought', '.cursor/skills/clearthought', '.agents/skills/clearthought'],
-  'sequential-thinking': ['.claude/skills/sequential-thinking', '.cursor/skills/sequential-thinking', '.agents/skills/sequential-thinking'],
-  'reviewing-4p-priorities': ['.claude/skills/reviewing-4p-priorities', '.cursor/skills/reviewing-4p-priorities', '.agents/skills/reviewing-4p-priorities'],
-  'path-sensitive-shell-safety': ['.claude/skills/path-sensitive-shell-safety', '.cursor/skills/path-sensitive-shell-safety', '.agents/skills/path-sensitive-shell-safety'],
-  'visual-design-loop': ['.claude/skills/visual-design-loop', '.agents/skills/visual-design-loop'],
-  'memento': ['.claude/skills/memento', '.cursor/skills/memento', '.agents/skills/memento'],
-  'coding-level': ['.claude/skills/coding-level', '.cursor/skills/coding-level', '.agents/skills/coding-level'],
-  'parallel-analysis': ['.claude/skills/parallel-analysis', '.cursor/skills/parallel-analysis', '.agents/skills/parallel-analysis']
+  'autoresearch-coding': ['.claude/skills/autoresearch-coding', '.agents/skills/autoresearch-coding', '.grok/skills/autoresearch-coding'],
+  'agentshield-security-review': ['.claude/skills/agentshield-security-review', '.agents/skills/agentshield-security-review', '.grok/skills/agentshield-security-review'],
+  'daily-workflow-curator': ['.claude/skills/daily-workflow-curator', '.agents/skills/daily-workflow-curator', '.grok/skills/daily-workflow-curator'],
+  'vibekit-init': ['.claude/skills/vibekit-init', '.agents/skills/vibekit-init', '.grok/skills/vibekit-init'],
+  'clearthought': ['.claude/skills/clearthought', '.cursor/skills/clearthought', '.agents/skills/clearthought', '.grok/skills/clearthought'],
+  'sequential-thinking': ['.claude/skills/sequential-thinking', '.cursor/skills/sequential-thinking', '.agents/skills/sequential-thinking', '.grok/skills/sequential-thinking'],
+  'reviewing-4p-priorities': ['.claude/skills/reviewing-4p-priorities', '.cursor/skills/reviewing-4p-priorities', '.agents/skills/reviewing-4p-priorities', '.grok/skills/reviewing-4p-priorities'],
+  'path-sensitive-shell-safety': ['.claude/skills/path-sensitive-shell-safety', '.cursor/skills/path-sensitive-shell-safety', '.agents/skills/path-sensitive-shell-safety', '.grok/skills/path-sensitive-shell-safety'],
+  'visual-design-loop': ['.claude/skills/visual-design-loop', '.agents/skills/visual-design-loop', '.grok/skills/visual-design-loop'],
+  'memento': ['.claude/skills/memento', '.cursor/skills/memento', '.agents/skills/memento', '.grok/skills/memento'],
+  'coding-level': ['.claude/skills/coding-level', '.cursor/skills/coding-level', '.agents/skills/coding-level', '.grok/skills/coding-level'],
+  'parallel-analysis': ['.claude/skills/parallel-analysis', '.cursor/skills/parallel-analysis', '.agents/skills/parallel-analysis', '.grok/skills/parallel-analysis'],
+  'prompt-sharpener': ['.claude/skills/prompt-sharpener', '.cursor/skills/prompt-sharpener', '.agents/skills/prompt-sharpener', '.grok/skills/prompt-sharpener']
 };
 
 function validateSkillMirror(sourceRel, mirrorRel) {
@@ -164,8 +192,15 @@ function validateSkillMirror(sourceRel, mirrorRel) {
   if (mismatches === 0) ok(`skill mirror ${mirrorRel} matches ${sourceRel} (${sourceFiles.length} files)`);
 }
 
+const mirrorSurface = (mirror) => mirror.startsWith('.claude/') ? 'claude'
+  : mirror.startsWith('.cursor/') ? 'cursor'
+  : mirror.startsWith('.agents/') ? 'codex'
+  : 'grok';
 for (const [skill, mirrors] of Object.entries(skillMirrors)) {
-  for (const mirror of mirrors) validateSkillMirror(`.vibekit/skills/${skill}`, mirror);
+  for (const mirror of mirrors) {
+    if (!surfacePresent[mirrorSurface(mirror)]) continue;
+    validateSkillMirror(`.vibekit/skills/${skill}`, mirror);
+  }
 }
 
 function parseFrontmatter(text) {
@@ -179,7 +214,7 @@ function parseFrontmatter(text) {
   return fields;
 }
 
-for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
+for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills', '.grok/skills']) {
   if (!exists(surface)) continue;
   for (const file of listFiles(surface).filter((f) => f.endsWith('SKILL.md'))) {
     const rel = `${surface}/${file}`;
@@ -198,7 +233,9 @@ function stripFrontmatter(text) {
 
 if (exists('.vibekit/commands')) {
   const canonicalCmds = listFiles('.vibekit/commands').filter((f) => f.endsWith('.md'));
-  const cmdMirrors = { '.claude/commands': true, '.cursor/commands': true };
+  const cmdMirrors = {};
+  if (surfacePresent.claude) cmdMirrors['.claude/commands'] = true;
+  if (surfacePresent.cursor) cmdMirrors['.cursor/commands'] = true;
   for (const [mirrorDir, stripFm] of Object.entries(cmdMirrors)) {
     if (!exists(mirrorDir)) { warn(`command mirror dir missing: ${mirrorDir}`); continue; }
     for (const file of canonicalCmds) {
@@ -213,7 +250,7 @@ if (exists('.vibekit/commands')) {
   }
 }
 
-for (const rel of ['package.json', '.claude/settings.json', '.cursor/settings.json', '.codex-plugin/plugin.json']) {
+for (const rel of ['package.json', '.claude/settings.json', '.cursor/settings.json', '.cursor/cli.json', '.codex-plugin/plugin.json']) {
   if (!exists(rel)) continue;
   try { JSON.parse(read(rel)); ok(`valid JSON ${rel}`); } catch (error) { fail(`invalid JSON ${rel}: ${error.message}`); }
 }
@@ -271,6 +308,33 @@ if (claudeSettings?.permissions?.deny && cursorSettings?.permissions?.deny) {
   if (parity) ok(`deny list category parity across .claude and .cursor (${claudeCats.size} categories)`);
 }
 
+// Guardrail lint: catches known-dead deny patterns at the syntax level. It does
+// not replace native checks — verify semantics with each tool's own validator
+// (e.g. `codex execpolicy check`, `grok inspect`).
+for (const [rel, settings] of [['.claude/settings.json', claudeSettings], ['.cursor/settings.json', cursorSettings]]) {
+  const deny = settings?.permissions?.deny;
+  if (!Array.isArray(deny)) continue;
+  const piped = deny.filter((rule) => rule.includes('|'));
+  piped.length === 0
+    ? ok(`${rel} deny rules avoid pipe-spanning patterns (subcommands are matched independently)`)
+    : fail(`${rel} deny rules span a pipe and never match: ${piped.join(', ')}`);
+  const yesFirst = deny.some((rule) => rule.startsWith('Bash(npx --yes') || rule.startsWith('Bash(npx -y'));
+  yesFirst
+    ? ok(`${rel} denies leading npx --yes/-y forms`)
+    : fail(`${rel} missing deny for leading npx --yes/-y forms`);
+}
+if (surfacePresent.cursor && exists('.cursor/cli.json')) {
+  const cursorCli = readJson('.cursor/cli.json');
+  Array.isArray(cursorCli?.permissions?.deny) && cursorCli.permissions.deny.includes('Shell(rm)')
+    ? ok('.cursor/cli.json denies Shell(rm)')
+    : fail('.cursor/cli.json missing permissions.deny entry Shell(rm)');
+}
+if (surfacePresent.codex) requireText('.codex/rules/vibekit.rules', 'decision = "forbidden"', 'Codex rules include forbidden decisions');
+if (surfacePresent.grok) {
+  requireText('.grok/config.toml', '[permission]', 'Grok project config declares [permission] rules');
+  requireText('.grok/config.toml', '"Bash(rm *)"', 'Grok project config denies rm');
+}
+
 if (pkg?.name === 'minimal-vibe-coding-kit') {
   for (const rel of ['SECURITY.md', 'CONTRIBUTING.md', 'CODE_OF_CONDUCT.md', '.github/dependabot.yml', '.github/workflows/vibekit-validate.yml', '.vibekit/docs/backbone.schema.json']) {
     exists(rel) ? ok(`release safety file ${rel}`) : fail(`missing release safety file ${rel}`);
@@ -381,7 +445,8 @@ function validateBackboneSchema(text) {
     if (!surfacePath || surfacePath === 'null') continue;
     const cleanPath = surfacePath.replace(/^["']|["']$/g, '');
     if (exists(cleanPath)) ok(`agent_surfaces path exists: ${cleanPath}`);
-    else fail(`agent_surfaces path missing: ${cleanPath}`);
+    else if (isKitSourceRepo) fail(`agent_surfaces path missing: ${cleanPath}`);
+    else warn(`agent_surfaces path missing: ${cleanPath} (profile-scoped install?)`);
   }
 }
 
@@ -401,7 +466,7 @@ const riskyPatterns = [
   { pattern: 'ignore previous' + ' instructions', message: 'prompt injection phrase' }
 ];
 
-const scanDirs = ['.claude', '.cursor', '.agents', '.codex-plugin', '.vibekit/skills', '.vibekit/commands', '.vibekit/scripts', 'AGENTS.md', '.vibekit/init/CLAUDE-template.md'];
+const scanDirs = ['.claude', '.cursor', '.agents', '.grok', '.codex-plugin', '.vibekit/skills', '.vibekit/commands', '.vibekit/scripts', 'AGENTS.md', '.vibekit/init/CLAUDE-template.md'];
 function walk(item) {
   const p = path.join(root, item);
   if (!fs.existsSync(p)) return [];

package/.vibekit/skills/agentshield-security-review/scripts/agentshield_repo_probe.py

@@ -15,10 +15,11 @@ PATTERNS = {
     "repo_instructions": ["CLAUDE.md", "AGENTS.md", ".github/copilot-instructions.md"],
     "claude": [".claude", ".claude-plugin", "agents"],
     "codex": [".codex", ".codex-plugin"],
-    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", "skills"],
+    "grok": [".grok"],
+    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", ".grok/skills", "skills"],
     "shared_commands": [".vibekit/commands"],
     "kit_scripts": [".vibekit/scripts"],
-    "hooks": ["hooks", ".claude/hooks", ".agents/hooks"],
+    "hooks": ["hooks", ".claude/hooks", ".agents/hooks", ".grok/hooks"],
     "mcp": [".mcp.json", "mcp.json", "mcp-configs"],
     "ci": [".github/workflows"],
 }
@@ -55,6 +56,27 @@ def safe_read(path: Path, limit: int = 200_000) -> str:
         return ""
 
 
+def deny_block_lines(text: str) -> set[int]:
+    """Line indexes inside a permissions deny array (JSON `"deny": [` or TOML `deny = [`).
+
+    Deny rules quote dangerous patterns in order to block them, so a marker on
+    those lines is defensive, not suspicious. Allow/ask blocks are still scanned.
+    """
+    covered: set[int] = set()
+    inside = False
+    for idx, line in enumerate(text.splitlines()):
+        stripped = line.strip()
+        if not inside and "[" in stripped and ('"deny"' in stripped or stripped.startswith("deny =") or stripped.startswith("deny=")):
+            covered.add(idx)
+            inside = "]" not in stripped.split("[", 1)[1]
+            continue
+        if inside:
+            covered.add(idx)
+            if "]" in stripped:
+                inside = False
+    return covered
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description="Inventory Claude/Codex AgentShield surfaces")
     parser.add_argument("path", nargs="?", default=".", help="Repository root")
@@ -77,8 +99,11 @@ def main() -> int:
                     if file_path.suffix.lower() not in {".md", ".json", ".toml", ".yaml", ".yml", ".sh", ".js", ".ts"}:
                         continue
                     text = safe_read(file_path)
+                    skip_lines = deny_block_lines(text)
+                    lines = text.splitlines()
                     for marker in SUSPICIOUS_TEXT:
-                        if marker in text:
+                        hits = [idx for idx, line in enumerate(lines) if marker in line]
+                        if any(idx not in skip_lines for idx in hits):
                             suspicious.append({
                                 "path": str(file_path.relative_to(root)),
                                 "marker": marker,

package/.vibekit/skills/coding-level/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coding-level
-description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked.
+description: Set the coding-explanation register. /coding-level N (0=ELI5, 1=Junior, 2=Mid, 3=Senior, 4=Tech Lead, 5=God); active until reinvoked. A project default may be recorded in backbone.yml conventions.custom_rules.
 disable-model-invocation: true
 argument-hint: "[0-5]"
 ---
@@ -20,6 +20,13 @@ argument-hint: "[0-5]"
 
 1. Read `$ARGUMENTS` as N. If N is not an integer 0–5, reply with the table above and ask for a valid N.
 2. Read `references/level-<N>.md`, state once which level is now active, and apply that persona to every reply until `/coding-level` is invoked again.
+3. Ask once: "Save level N as the project default?" If yes, add or update the `Default coding level: N` entry in `backbone.yml` `conventions.custom_rules` (show the diff and wait for approval, per kit rules).
+
+## Project default
+
+- First-time init records a default as a `backbone.yml` `conventions.custom_rules` entry: `Default coding level: N (<Register>)`.
+- Sessions without an explicit `/coding-level` start from that default level.
+- `/coding-level N` overrides the default for the current session only, unless the user saves it in step 3.
 
 ## Scope
 

package/.vibekit/skills/path-sensitive-shell-safety/SKILL.md

@@ -48,6 +48,7 @@ No empty, unset, broad, symlinked, or unintended path may reach a destructive co
 
 ## Required outcomes
 
+- Prefer a recoverable delete (`trash`) over permanent `rm` for user files; permanent deletion requires explicit confirmation of the exact paths. If `trash` is missing, recommend installing it (macOS 14+ built-in; older macOS `brew install trash`; Linux `sudo apt install trash-cli`; any OS with Node `npm i -g trash-cli`).
 - A blank branch may follow the documented default-branch fallback policy.
 - An explicit branch must fail if missing; never silently deploy another branch.
 - A blank folder/base value must fail before any `rm`, `mv`, `cp`, `rsync`, `find`, Docker, or Git cleanup command runs.

package/.vibekit/skills/prompt-sharpener/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: prompt-sharpener
+description: Sharpen a rough prompt into a precise one — same intent, sharper not longer — then execute the sharpened version immediately in the same turn.
+argument-hint: "the rough prompt to sharpen and execute"
+disable-model-invocation: true
+---
+
+# Prompt Sharpener
+
+The text the user types after the invocation is the **raw prompt**. Upgrade it into a prompt that is **sharper, not longer** — keep the original intent, constraints, and language — then execute the upgraded version immediately in the same turn. No text after the invocation → ask the user what they want and stop.
+
+## Step 1 — Diagnose the raw prompt
+
+Scan for every ailment below; each ailment found gets its cure applied directly in the upgraded prompt. Cure silently; call out a cure only when it could shift the user's intent.
+
+- Vague verbs or adjectives ("help me", "make it nicer") → concrete, measurable operations and parameters.
+- Two tasks in one prompt → split into an explicit execution order.
+- No success criteria → add a binary pass/fail `Done when`.
+- Emotional description ("everything is broken") → extract the specific technical symptom.
+- "The whole app" scope → pin exact files/functions/directories; coding tasks always get a **scope lock** (edit only inside X, leave the rest untouched).
+- Relies on memory of an old session → copy the decisions already settled in this conversation (stack, architecture, what was tried and failed) into the `Context` block.
+- Invitation to fabricate ("what do experts say about X?") → anchor grounding: state only what can be verified; when unsure, say so explicitly.
+- No output format → fix the structure and length; when the format is hard to describe in words, include 2-3 sample examples (including an edge case) in the `Output Contract`.
+
+Done when: the raw prompt has been checked against the full list and no ailment is left without its cure in the upgraded prompt.
+
+## Step 2 — Build the upgraded prompt
+
+Classify the task (coding / research / writing / analysis / planning / review), then assemble blocks in this order — add a block only when it raises precision; small tasks need just 2-3 blocks:
+
+`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`
+
+Focus per task type:
+
+- Coding: scope lock, smallest correct change, validation after the edit — default to the `validate` command in `backbone.yml` when the repo has one.
+- Research: source quality, citations, explicit uncertainty.
+- Writing: audience, voice, length.
+- Review: group findings by severity, name the failure mode.
+
+Construction rules:
+
+- Write constraints with the strongest signal words: MUST instead of "should", NEVER instead of "avoid".
+- Missing information → state the assumption in `Context` and keep going; stop to ask only when the task is destructive or irreversible.
+- Say _what_ to verify; let the model regulate its own depth of thought.
+- Repo work MUST respect `backbone.yml` conventions and protected paths; when the upgraded task is a large decomposition or a risky decision, its `Work Style` block may direct Step 3 to open with the `sequential-thinking` or `clearthought` skill.
+- Closing audit: reread every sentence; if cutting it would not change the output, cut it — every remaining word is **load-bearing**.
+
+Done when the upgraded prompt scores on all 6 points: intent preserved — ambiguity reduced — right depth — clear output — has verification — has a stopping point.
+
+## Step 3 — Present and execute
+
+Print the upgraded prompt in a single code block, with at most 2 sentences on the key changes. Then treat it as the user's official request: start executing immediately in the same turn, researching and editing according to its own `Tool Rules`.
+
+Done when the upgraded prompt's `Done Criteria` are satisfied.

package/.vibekit/skills/vibekit-init/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: vibekit-init
-description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, or Codex skill setup. Always show requirements and a diff before writing.
+description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, Codex skill setup, or Grok setup. Always show requirements and a diff before writing.
 disable-model-invocation: true
-argument-hint: target path; profiles claude,cursor,codex; write yes/no
+argument-hint: target path; profiles claude,cursor,codex,grok; write yes/no
 ---
 
 # Vibe Kit Init

package/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Shared instructions for Claude, Cursor, Codex, and other coding agents.
+Shared instructions for Claude, Cursor, Codex, Grok, and other coding agents.
 
 <!-- BEGIN: minimal-vibe-coding-kit -->
 ## Minimal Vibe Coding Kit
@@ -31,10 +31,11 @@ Track every loop in `/tmp/design-{project_slug}.md`. Each loop entry must includ
 ### Safety
 
 - Never print full secrets.
+- Prefer `trash` over `rm` for deletions so they stay recoverable. Check `command -v trash` first; if missing, recommend installing it (macOS 14+ built-in; older macOS `brew install trash`; Linux `sudo apt install trash-cli`; any OS with Node `npm i -g trash-cli`) instead of falling back to `rm`. Permanent deletes require explicit user approval of the exact paths.
 - Do not run untrusted hooks, MCP servers, deploy scripts, package lifecycle scripts, migrations, or destructive shell commands just to inspect a repo.
 - Do not modify protected paths from `backbone.yml` without explicit approval.
 - Before editing or approving shell/deploy/installer/repair logic that uses path variables or destructive commands (`rm`, `mv`, `cp -a`, `rsync --delete`, `find -delete`, `git clean`, checkout replacement), use `path-sensitive-shell-safety` and prove base/folder/repo values are non-empty, contained, quoted, and not broad system paths.
-- If a task changes agent surfaces (`CLAUDE.md`, `AGENTS.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, `.vibekit/skills/**`, `.vibekit/commands/**`, `.vibekit/scripts/**`, hooks, MCP config), run the AgentShield probe or explain why it was skipped.
+- If a task changes agent surfaces (`CLAUDE.md`, `AGENTS.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.grok/**`, `.codex-plugin/**`, `.vibekit/skills/**`, `.vibekit/commands/**`, `.vibekit/scripts/**`, hooks, MCP config), run the AgentShield probe or explain why it was skipped.
 
 ### Skills to prefer
 

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.4.2 — 2026-07-18
+
+- Added a Grok Build (Grok CLI) surface across the kit: `.grok/rules/` (always-on, every `*.md` loaded), `.grok/skills/` (all 13 kit skills, user-invocable as `/<skill-name>`), `.grok/README.md`, and project-scoped `[permission]` deny rules in `.grok/config.toml` mirroring the kit's dangerous-command deny list; `config.example.toml` documents the user-level `~/.grok/config.toml` settings. Added a `grok` install/update profile to `mvck.mjs` (included in `all`) and registered Grok everywhere Claude/Cursor/Codex already were: `validate-kit.mjs`, npm package files, `backbone.yml` `agent_surfaces`, `AGENTS.md`, the AgentShield probe, both READMEs, `INSTALL.md`, `BACKBONE_REFERENCE.md`, `CONTEXT_TEMPLATE.md`, `FIRST_TIME_INIT.md`, and `vibekit-init`.
+- Added `prompt-sharpener` skill (shared + Claude/Cursor/Codex/Grok mirrors), an English rewrite of a collected `sharpen` skill: `/prompt-sharpener <rough prompt>` diagnoses a raw prompt against a defect checklist (vague verbs, mixed tasks, missing success criteria, unbounded scope, missing output format), rebuilds it as a sharper prompt (`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`), prints it in one code block, then executes it in the same turn.
+- Corrected the dangerous-command guardrails after a cross-tool documentation review. Removed the pipe-spanning `curl *|*sh` / `wget *|*sh` deny rules from `.claude/settings.json` and `.cursor/settings.json` — Claude Code evaluates each piped subcommand independently, so they never matched — in favor of denying bare shell interpreters (`sh`, `bash`, `zsh`, and their `-` stdin forms, which is what `curl ... | sh` actually executes), and fixed the `npx` rules to also cover the common leading `--yes`/`-y` forms.
+- Added each tool's actual documented project-level permission mechanism, since only Claude Code and Cursor's Claude-schema file had one before: `.cursor/cli.json` with `Shell(...)` rules for Cursor CLI (the real mechanism Cursor reads; the Claude-schema `settings.json` is kept only as reference), experimental `.codex/rules/vibekit.rules` execution-policy rules for Codex (`forbidden` decisions with `match`/`not_match` fixtures, active once the project `.codex/` layer is trusted), and the `.grok/config.toml` rules above.
+- `validate-kit` now lints deny lists for pipe-spanning patterns and missing leading `npx --yes`/`-y` coverage, and is profile-aware: per-surface files are required only when that surface is installed (the kit source repo still validates everything), so a `claude`-only or `grok`-only install passes its own validation; `test-install` runs an install+validate cycle for each single profile.
+- `mvck update` treats `.cursor/cli.json` and `.grok/config.toml` as user-owned (seeded once, never overwritten). The AgentShield probe's suspicious-marker scan now skips lines inside permission `deny` arrays, so the kit's own deny rules no longer flag themselves as suspicious; allow/ask blocks are still scanned.
+- Synced version to 0.4.2 in `package.json`, both README badges, and `.codex-plugin/plugin.json`.
+
+## 0.4.1 — 2026-07-17
+
+- Added a safe-delete guardrail across all three surfaces: new `.claude/rules/safe-delete.md` and `.cursor/rules/040-safe-delete.mdc` (always-on), a `### Safety` bullet in the `AGENTS.md` managed block for Codex, and a trash-first outcome in the `path-sensitive-shell-safety` skill (all mirrors). Agents prefer the recoverable `trash` command over `rm`, check `command -v trash` first, and recommend an install when missing (macOS 14+ built-in; older macOS `brew install trash`; Linux `sudo apt install trash-cli`; any OS with Node `npm i -g trash-cli`). `rm` was already deny-listed for Claude Code and Cursor in the kit settings.
+- First-time init now asks two setup preferences and records them in `backbone.yml` `conventions.custom_rules`: use `trash` instead of `rm` (with availability detection and install hints), and a default coding level chosen from a 0–5 table with one-line descriptions. Mirrored in the `init-backbone.mjs --propose` interview output.
+- `coding-level` skill (all mirrors): sessions now start from the `Default coding level: N` entry in `backbone.yml` when present; `/coding-level N` still overrides per session and can save a new default with approval. `CLAUDE-template.md` now lists `/coding-level` and the safe-delete rule.
+- `mvck doctor` reports a new safe-delete check: whether the `trash` command is available, with the per-OS install hint when it is not.
+- Fixed the npm package page rendering the Vietnamese README: moved `README.vi.md` to `docs/README.vi.md` so npm's readme detection always picks `README.md`.
+- Added an "Install from npm" section to `README.md`, `docs/README.vi.md`, and `.vibekit/docs/INSTALL.md`: one-shot `npx --yes minimal-vibe-coding-kit@latest install <path>`, or `npm i -D minimal-vibe-coding-kit` followed by `npx mvck install .`, with a note that files in `node_modules/` stay inactive until `mvck install` copies them into the repo root.
+- Switched README install/update/profile examples to the published npm package; the `github:` form and local `install.sh` remain documented as alternatives.
+- Synced version to 0.4.1 in `package.json`, both README badges, and `.codex-plugin/plugin.json`; added an npm badge.
+
 ## 0.4.0 — 2026-07-16
 
 - Trimmed the end-user install payload: `mvck install`/`update` no longer copy kit-maintainer files (`test-install.mjs`, `pack-dry-run.mjs`, `.vibekit/docs/RESEARCH_NOTES.md`, `.vibekit/docs/AUTORESEARCH_LEDGER.md`); `validate-kit` requires them only in the kit source repo.

package/README.md

@@ -1,18 +1,20 @@
 <div align="center">
 
-**Read in:** **English** · [Tiếng Việt](README.vi.md)
+**Read in:** **English** · [Tiếng Việt](docs/README.vi.md)
 
 # Minimal Vibe Coding Kit
 
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-0.4.0-2ea44f.svg)](CHANGELOG.md)
+[![npm](https://img.shields.io/badge/npm-minimal--vibe--coding--kit-cb3837?logo=npm)](https://www.npmjs.com/package/minimal-vibe-coding-kit)
+[![Version](https://img.shields.io/badge/version-0.4.2-2ea44f.svg)](CHANGELOG.md)
 ![Claude](https://img.shields.io/badge/Claude%20Code-Commands%20%26%20Skills-111111)
 ![Cursor](https://img.shields.io/badge/Cursor-Rules%20%26%20Commands-1f6feb)
 ![Codex](https://img.shields.io/badge/Codex-AGENTS.md%20%26%20Plugin-6f42c1)
+![Grok](https://img.shields.io/badge/Grok-Rules%20%26%20Skills-000000)
 ![AgentShield](https://img.shields.io/badge/Security-AgentShield-d62828)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js&logoColor=white)
 
-**One installable AI-coding workflow kit for Claude Code, Cursor, and Codex — any repo, any language.**
+**One installable AI-coding workflow kit for Claude Code, Cursor, Codex, and Grok — any repo, any language.**
 
 Install → paste one prompt → approve the proposal → code with guardrails.
 
@@ -22,11 +24,13 @@ Install → paste one prompt → approve the proposal → code with guardrails.
 
 ## What is this?
 
-A small kit of shared **rules**, **skills**, and **commands**, plus one **`backbone.yml`** manifest, so Claude Code, Cursor, and Codex all understand your project the same way.
+A small kit of shared **rules**, **skills**, and **commands**, plus one **`backbone.yml`** manifest, so Claude Code, Cursor, Codex, and Grok all understand your project the same way.
 
 - Never overwrites your existing `CLAUDE.md` / `AGENTS.md` — it only adds managed blocks.
 - Every setup write waits for your explicit approval.
 - Security review of agent surfaces (AgentShield) is part of the normal workflow.
+- Safe deletes by default: all agents prefer the recoverable `trash` command (init checks it and recommends an install if missing), backed by each tool's documented guardrail config — Claude Code deny rules (`.claude/settings.json`), Cursor CLI permissions (`.cursor/cli.json`), Codex execution-policy rules (`.codex/rules/`, experimental, active once the project is trusted), and Grok project permission rules (`.grok/config.toml`).
+- First-time init asks two setup preferences — use `trash` instead of `rm`, and your default explanation level (0–5, changeable anytime with `/coding-level N`) — and records both in `backbone.yml`.
 
 ## Quick Start
 
@@ -35,12 +39,12 @@ Three steps, about two minutes.
 **1. Install into your project** (no clone needed):
 
 ```bash
-npx github:giang6283623/minimal-vibe-coding-kit install /path/to/your-project
+npx --yes minimal-vibe-coding-kit@latest install /path/to/your-project
 ```
 
-From a local clone instead: `./install.sh /path/to/your-project` (Windows: `./install.ps1 -Target C:\path\to\your-project`).
+Already ran `npm i minimal-vibe-coding-kit`, or prefer GitHub or a local clone? See [Install from npm](#install-from-npm).
 
-**2. Open the project in Claude Code, Cursor, or Codex and paste:**
+**2. Open the project in Claude Code, Cursor, Codex, or Grok and paste:**
 
 ```text
 Read .vibekit/init/FIRST_TIME_INIT.md and initialize this repo with Minimal Vibe Coding Kit.
@@ -58,6 +62,39 @@ Optional health check any time:
 node .vibekit/scripts/mvck.mjs doctor .
 ```
 
+## Install from npm
+
+The kit is published on npm as [`minimal-vibe-coding-kit`](https://www.npmjs.com/package/minimal-vibe-coding-kit). It is a **scaffolding CLI, not a library** — files sitting in `node_modules/` do nothing by themselves. Running `install` once copies the kit into your repo root, exactly like the GitHub installer does.
+
+**Option A — one-shot (recommended).** Nothing is added to your project's dependencies:
+
+```bash
+npx --yes minimal-vibe-coding-kit@latest install /path/to/your-project
+```
+
+**Option B — as a dependency.** If the package is (or will be) in your `package.json`, one more command is required:
+
+```bash
+npm i -D minimal-vibe-coding-kit
+npx mvck install .        # required — copies the kit out of node_modules into your repo
+```
+
+> **Important:** `npm i` alone only downloads the kit into `node_modules/` — nothing is active yet.
+> `mvck install` is the step that copies `.claude/`, `.cursor/`, `.agents/`, `.vibekit/`, and `backbone.yml` into your repo root.
+
+Either way, the short `mvck` command (alias: `vibe-kit`) is then available via `npx`:
+
+| Short command | What it does |
+| --- | --- |
+| `npx mvck install .` | Copy the kit into the repo (`--profile`, `--dry-run`, `--force`) |
+| `npx mvck update .` | Refresh kit-owned files after a new kit release |
+| `npx mvck doctor .` | Read-only health check |
+| `npx mvck validate .` | Structure validation |
+
+Then continue with **step 2** of the Quick Start (paste the init prompt).
+
+Other install paths: `npx github:giang6283623/minimal-vibe-coding-kit install /path/to/your-project`, or from a local clone `./install.sh /path/to/your-project` (Windows: `./install.ps1 -Target C:\path\to\your-project`).
+
 ## What lands in your repo
 
 Install adds exactly this — nothing else in your project is touched:
@@ -72,6 +109,7 @@ your-project/
 ├── .cursor/                  ← Cursor: rules, commands, skills
 ├── .agents/                  ← Codex / portable skills
 ├── .codex/  .codex-plugin/   ← Codex config example + plugin manifest
+├── .grok/                    ← Grok Build: rules, skills, config example
 └── .vibekit/                 ← everything kit-owned, in ONE folder
     ├── skills/               ← canonical shared skills (mirrored to the harness dirs)
     ├── commands/             ← shared command prompts
@@ -85,7 +123,7 @@ Existing files are never replaced — the kit merges managed blocks (`BEGIN/END:
 ## How the pieces connect
 
 ```text
-You (prompt) ──▶ Claude Code / Cursor / Codex
+You (prompt) ──▶ Claude Code / Cursor / Codex / Grok
                       │  reads first
                       ▼
         backbone.yml  +  AGENTS.md / CLAUDE.md  +  rules
@@ -106,11 +144,12 @@ You (prompt) ──▶ Claude Code / Cursor / Codex
 
 1. **Just code.** Ask for features and fixes normally; the agent follows `backbone.yml` conventions and keeps diffs small.
 2. **Big or vague task?** Start with the `clearthought` or `sequential-thinking` skill to get a plan first.
-3. **Repo-wide question or big review?** Use `parallel-analysis` — it fans out read-only analysis lanes and verifies the merged result.
-4. **Changed `.claude/`, skills, hooks, or installer scripts?** Run `/security-scan` before merging.
-5. **Want measurable improvements?** Run `/autoresearch-coding` with a metric and budget.
-6. **Keep the setup sharp:** `/daily-enhance` proposes improvements — it never applies them silently.
-7. **Onboarding finished for good?** `/vibe-finalize` moves one-time bootstrap files out.
+3. **Complex task but only a rough prompt?** `/prompt-sharpener <rough prompt>` sharpens it into a precise prompt and executes it in the same turn.
+4. **Repo-wide question or big review?** Use `parallel-analysis` — it fans out read-only analysis lanes and verifies the merged result.
+5. **Changed `.claude/`, skills, hooks, or installer scripts?** Run `/security-scan` before merging.
+6. **Want measurable improvements?** Run `/autoresearch-coding` with a metric and budget.
+7. **Keep the setup sharp:** `/daily-enhance` proposes improvements — it never applies them silently.
+8. **Onboarding finished for good?** `/vibe-finalize` moves one-time bootstrap files out.
 
 ## Commands
 
@@ -125,7 +164,7 @@ You (prompt) ──▶ Claude Code / Cursor / Codex
 
 ## Skills
 
-All 12 skills live in `.vibekit/skills/` and are mirrored for each tool. Invoke them by name ("Use the X skill…") or via the commands above.
+All 13 skills live in `.vibekit/skills/` and are mirrored for each tool. Invoke them by name ("Use the X skill…") or via the commands above.
 
 | Skill | Use it when | Example prompt |
 | --- | --- | --- |
@@ -141,6 +180,7 @@ All 12 skills live in `.vibekit/skills/` and are mirrored for each tool. Invoke
 | `reviewing-4p-priorities` | Triaging bugs/findings into P0–P4 fix order. | "Use reviewing-4p-priorities. Classify these findings and give a fix sequence." |
 | `memento` | Multi-day tasks: save context before stopping, resume next session. | "/memento — write MEMENTO.md with Goal, Done, Stuck, Next." |
 | `coding-level` | Setting how detailed explanations should be (0 = ELI5 … 5 = expert). | "/coding-level 2" |
+| `prompt-sharpener` | A complex task but only a rough prompt: sharpen it, then execute it in the same turn. | "/prompt-sharpener make the settings page load faster" |
 
 ## Advanced
 
@@ -149,9 +189,10 @@ All 12 skills live in `.vibekit/skills/` and are mirrored for each tool. Invoke
 Install only the surfaces you use (default is `all`):
 
 ```bash
-npx github:giang6283623/minimal-vibe-coding-kit install . --profile claude          # Claude Code only
-npx github:giang6283623/minimal-vibe-coding-kit install . --profile claude,cursor   # Claude + Cursor
-npx github:giang6283623/minimal-vibe-coding-kit install . --profile codex           # Codex / AGENTS.md agents
+npx --yes minimal-vibe-coding-kit@latest install . --profile claude          # Claude Code only
+npx --yes minimal-vibe-coding-kit@latest install . --profile claude,cursor   # Claude + Cursor
+npx --yes minimal-vibe-coding-kit@latest install . --profile codex           # Codex / AGENTS.md agents
+npx --yes minimal-vibe-coding-kit@latest install . --profile grok            # Grok Build CLI
 ```
 
 Flags: `--force` (overwrite existing kit files), `--dry-run` (preview), `--json` (machine-readable plan).
@@ -161,8 +202,8 @@ Flags: `--force` (overwrite existing kit files), `--dry-run` (preview), `--json`
 Run inside your project when the kit ships new skills or scripts:
 
 ```bash
-npx github:giang6283623/minimal-vibe-coding-kit update . --dry-run   # preview
-npx github:giang6283623/minimal-vibe-coding-kit update .             # apply
+npx --yes minimal-vibe-coding-kit@latest update . --dry-run   # preview
+npx --yes minimal-vibe-coding-kit@latest update .             # apply
 ```
 
 `update` refreshes **kit-owned files only**, never touches `backbone.yml` or your own content, updates managed blocks in place, and backs up changed files to `.vibekit/update-backup/<timestamp>/`. Details: [.vibekit/docs/INSTALL.md](.vibekit/docs/INSTALL.md).