minimal-vibe-coding-kit 0.4.1 → 0.4.2

package/.grok/skills/visual-design-loop/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: visual-design-loop
+description: Run an iterative visual design improvement loop for UI/product polish tasks. Use when a request involves screenshots, rendering, visual review, frontend polish, layout/typography/color refinement, design QA, or a Claude/Codex loop goal that touches a visible product surface.
+---
+
+# Visual Design Loop
+
+Use this skill to improve a visible UI through controlled render-review-fix loops. Keep the brief and existing project conventions as the source of truth; do not add new product requirements just because a screen could be enhanced.
+
+## Contract
+
+Before editing, resolve and state:
+
+- Goal.
+- Target surface: route, page, component, flow, or supplied screenshot.
+- Source of truth: current brief plus repo instructions, design system, nearby UI, and `backbone.yml` when present.
+- Render method: local URL, app command, Storybook story, preview command, static file, or supplied screenshot.
+- Screenshot method: browser screenshot, Playwright, in-app browser, provided image, or equivalent.
+- Editable paths.
+- Protected paths.
+- Budget: default 3 loops.
+- Timeout: default 10 minutes per loop.
+- Log path: `/tmp/design-{project_slug}.md`.
+
+If render or screenshot capture is missing and cannot be inferred safely, ask for the missing command, URL, or image before editing.
+
+## Baseline
+
+1. Render the target surface.
+2. Capture or inspect the baseline screenshot.
+3. Review visible issues only; do not invent findings.
+4. Create or update `/tmp/design-{project_slug}.md`.
+5. Log the baseline screenshot, visual score, main issues, and any render constraints.
+
+Derive `project_slug` from `backbone.yml` `project.name` when available; otherwise use the repository directory name.
+
+## Visual rubric
+
+Score screenshots from 1 to 5 using:
+
+- Visual hierarchy: primary content and action are obvious.
+- Layout and spacing: alignment, rhythm, density, whitespace.
+- Typography: scale, contrast, readability, consistency.
+- Color and contrast: accessible, intentional, not noisy.
+- Component consistency: matches nearby UI and design system.
+- Responsiveness: works at relevant viewport sizes.
+- Interaction states: hover, focus, disabled, empty, loading, and error states when relevant.
+- Product fit: improves the brief without adding unnecessary features.
+
+## Loop
+
+For each loop:
+
+1. Review the latest screenshot.
+2. Identify the highest-impact visual issue.
+3. Form one small hypothesis.
+4. Apply one targeted fix inside editable paths only.
+5. Render again.
+6. Capture the after screenshot.
+7. Compare before and after.
+8. Keep the change only if quality improves, or if quality is equal with simpler and safer implementation.
+9. Revert only your own loop changes if the result is worse.
+10. Run the repo validation command when code changed.
+11. Append the loop result to `/tmp/design-{project_slug}.md`.
+
+Each loop entry must include:
+
+- Loop number.
+- Screenshot reviewed.
+- Issue found.
+- Hypothesis.
+- Fix applied.
+- Before/after judgment.
+- Rubric score before.
+- Rubric score after.
+- Validation result.
+- Remaining concerns.
+- Stop/continue decision.
+
+## Stop criteria
+
+Stop when:
+
+- The design is polished enough for the brief.
+- The latest loop gives no meaningful improvement.
+- Further changes would be subjective or overworked.
+- Budget is reached.
+- Validation fails for a non-trivial reason.
+- A product or design decision is required from the user.
+- Render or screenshot tooling is unavailable.
+
+## Final report
+
+Report:
+
+- Baseline score.
+- Final score.
+- Screenshots reviewed.
+- Changes kept.
+- Changes discarded, if any.
+- Validation result.
+- Remaining risks or design decisions.
+- Log path.

package/.grok/skills/visual-design-loop/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Visual Design Loop"
+  short_description: "Iterative screenshot-based UI polish loop"
+  default_prompt: "Use $visual-design-loop to render, screenshot, review, and improve this UI until it is polished but not overworked."

package/.vibekit/docs/BACKBONE_REFERENCE.md

@@ -10,7 +10,7 @@
 - `conventions`: user-reviewed project rules inferred from existing code.
 - `commands`: install, test, lint, typecheck, build, validate.
 - `policy`: branch, commit, editable paths, protected paths.
-- `agent_surfaces`: Claude, Cursor, Codex, shared skills, shared commands.
+- `agent_surfaces`: Claude, Cursor, Codex, Grok, shared skills, shared commands.
 - `automation`: autoresearch, daily enhance, finalize (graduation cleanup), security.
 
 ## Init status

package/.vibekit/docs/INSTALL.md

@@ -26,9 +26,10 @@ node .vibekit/scripts/mvck.mjs install /path/to/project --profile all
 
 Profiles:
 
-- `claude`: `CLAUDE.md`, `.claude/`, Claude skills, agents, commands, rules.
-- `cursor`: `.cursor/rules`, `.cursor/commands`, Cursor skill entrypoints.
-- `codex`: `AGENTS.md`, `.agents/skills`, `.codex-plugin`, `.codex` examples.
+- `claude`: `CLAUDE.md`, `.claude/`, Claude skills, agents, commands, rules, deny-list settings.
+- `cursor`: `.cursor/rules`, `.cursor/commands`, `.cursor/cli.json` CLI permissions, Cursor skill entrypoints.
+- `codex`: `AGENTS.md`, `.agents/skills`, `.codex/rules` execution-policy rules, `.codex-plugin`, `.codex` examples.
+- `grok`: `AGENTS.md`, `.grok/rules`, `.grok/skills`, `.grok/config.toml` permission rules, user config example.
 - `all`: every profile.
 
 ## Safe behavior
@@ -59,7 +60,7 @@ node /path/to/kit/.vibekit/scripts/mvck.mjs update /path/to/project
 
 The updater:
 
-- refreshes kit-owned surfaces (`.vibekit/skills/`, `.vibekit/commands/`, `.vibekit/scripts/`, `.vibekit/docs/`, and the `.claude/`, `.cursor/`, `.agents/`, `.codex*` mirrors) and adds any new kit skills;
+- refreshes kit-owned surfaces (`.vibekit/skills/`, `.vibekit/commands/`, `.vibekit/scripts/`, `.vibekit/docs/`, and the `.claude/`, `.cursor/`, `.agents/`, `.grok/`, `.codex*` mirrors) and adds any new kit skills;
 - never overwrites `backbone.yml`, `CLAUDE.md`, `AGENTS.md` content outside the managed block, or `settings.json` files — those are seeded only if missing;
 - backs up every replaced kit file to `.vibekit/update-backup/<timestamp>/` (disable with `--no-backup`);
 - never deletes files you added, and skips re-seeding one-time files after `mvck finalize`;
@@ -114,7 +115,7 @@ node .vibekit/scripts/mvck.mjs doctor . --write-report
 
 ## Native reasoning skills
 
-The installer includes three flexible custom reasoning skills across Claude, Codex, and Cursor. These install as full skill folders, including examples and references for progressive disclosure:
+The installer includes three flexible custom reasoning skills across Claude, Codex, Cursor, and Grok. These install as full skill folders, including examples and references for progressive disclosure:
 
 - `clearthought`: clarify ambiguous tasks and choose a reasoning mode.
 - `sequential-thinking`: split complex work into ordered implementation steps.
@@ -122,11 +123,12 @@ The installer includes three flexible custom reasoning skills across Claude, Cod
 
 ## Visual design loop skill
 
-The installer also includes `visual-design-loop` for Claude and Codex surfaces. Use it when a loop goal touches UI polish, screenshots, rendering, visual QA, or visible frontend behavior.
+The installer also includes `visual-design-loop` for Claude, Codex, and Grok surfaces. Use it when a loop goal touches UI polish, screenshots, rendering, visual QA, or visible frontend behavior.
 
 ## User-invoked utility skills
 
-Two user-invoked skills install across Claude, Codex, and Cursor surfaces:
+Three user-invoked skills install across Claude, Codex, Cursor, and Grok surfaces:
 
 - `memento`: write a `MEMENTO.md` working note before closing a multi-day task (`/memento`), then resume from it in the next session (`/memento resume`).
 - `coding-level`: set the explanation register from 0 (ELI5) to 5 (expert peer) with `/coding-level N`; stays active until reinvoked.
+- `prompt-sharpener`: sharpen a rough prompt into a precise one with `/prompt-sharpener <rough prompt>`, then execute the sharpened version immediately in the same turn.

package/.vibekit/docs/SECURITY_MODEL.md

@@ -5,7 +5,7 @@
 Review these before merging changes:
 
 - `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`
-- `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`
+- `.claude/**`, `.cursor/**`, `.agents/**`, `.grok/**`, `.codex-plugin/**`
 - `.vibekit/skills/**`, `.vibekit/commands/**`, `.vibekit/scripts/**`, `hooks/**`
 - `.mcp.json`, `mcp.json`, `mcp-configs/**`
 - installer scripts and CI workflows

package/.vibekit/docs/TOOLING_GUIDE.md

@@ -12,11 +12,16 @@ Use `.cursor/rules/*.mdc`. The kit creates always-on core rules plus scoped rule
 
 Use `AGENTS.md` for repo instructions and `.agents/skills/*/SKILL.md` for skills. The kit also includes `.codex-plugin/plugin.json` so the shared skills can be packaged as a plugin.
 
+## Grok
+
+Grok Build reads `AGENTS.md` natively plus every `*.md` rule in `.grok/rules/`, and repository skills from `.grok/skills/*/SKILL.md` (user-invocable skills appear as `/<skill-name>` slash commands). Permission deny rules are user-level only: see `.grok/config.example.toml` for the `~/.grok/config.toml` setup.
+
 ## Shared skill strategy
 
 Canonical skill bodies live in `.vibekit/skills/<skill-name>/`. Harness-specific folders contain small shims:
 
 - `.claude/skills/<skill-name>/SKILL.md`
 - `.agents/skills/<skill-name>/SKILL.md`
+- `.grok/skills/<skill-name>/SKILL.md`
 
 This reduces drift while still giving each tool the path it expects.

package/.vibekit/docs/templates/CONTEXT_TEMPLATE.md

@@ -1,7 +1,7 @@
 # Project context
 
 > Scaffolded by Minimal Vibe Coding Kit. A short, shared glossary and map so any
-> agent (Claude, Cursor, Codex) navigates this project with less back-and-forth.
+> agent (Claude, Cursor, Codex, Grok) navigates this project with less back-and-forth.
 > Keep it current and terse — definitions, not prose.
 
 ## Domain glossary

package/.vibekit/init/CLAUDE-template.md

@@ -17,6 +17,7 @@ This file is intentionally small. Shared rules live in `AGENTS.md`, project fact
 - `/security-scan` - run AgentShield-style review.
 - `/daily-enhance` - propose rule, skill, and workflow improvements.
 - `/coding-level N` - set explanation depth 0-5; the project default lives in `backbone.yml` `conventions.custom_rules`.
+- `/prompt-sharpener <rough prompt>` - sharpen a rough prompt into a precise one, then execute it in the same turn.
 
 ## Hard rules
 

package/.vibekit/init/FIRST_PROMPT.md

@@ -36,7 +36,7 @@ Use the autoresearch-coding skill.
 Goal: improve this Minimal Vibe Coding Kit for existing projects in any language.
 Metric command: node .vibekit/scripts/validate-kit.mjs .
 Direction: higher.
-Editable paths: README.md .vibekit/docs .vibekit/scripts skills .vibekit/commands .claude .cursor .agents .codex-plugin .github backbone.yml AGENTS.md .vibekit/init/CLAUDE-template.md .vibekit/init/FIRST_TIME_INIT.md package.json install.sh install.ps1.
+Editable paths: README.md .vibekit/docs .vibekit/scripts skills .vibekit/commands .claude .cursor .agents .grok .codex-plugin .github backbone.yml AGENTS.md .vibekit/init/CLAUDE-template.md .vibekit/init/FIRST_TIME_INIT.md package.json install.sh install.ps1.
 Protected paths: .git .env* node_modules vendor secrets lockfiles.
 Budget: 3.
 ```

package/.vibekit/init/FIRST_TIME_INIT.md

@@ -1,6 +1,6 @@
 # .vibekit/init/FIRST_TIME_INIT.md - bootstrap runbook
 
-Audience: Claude, Cursor, Codex, or any AI coding agent in a repo that just received Minimal Vibe Coding Kit.
+Audience: Claude, Cursor, Codex, Grok, or any AI coding agent in a repo that just received Minimal Vibe Coding Kit.
 
 Keep this flow short. Detailed schema notes live in `.vibekit/docs/BACKBONE_REFERENCE.md`.
 
@@ -11,7 +11,7 @@ Before writing anything, print this checklist and mark each item as found, missi
 1. `backbone.yml` exists.
 2. `AGENTS.md` exists or will be created/merged.
 3. `CLAUDE.md` exists or will be created from `.vibekit/init/CLAUDE-template.md` when Claude support is installed.
-4. At least one harness folder exists: `.claude/`, `.cursor/`, `.agents/`, or `.codex-plugin/`.
+4. At least one harness folder exists: `.claude/`, `.cursor/`, `.agents/`, `.grok/`, or `.codex-plugin/`.
 5. Git status is known. If user changes exist, do not overwrite them.
 6. A validation command is inferred or set to `node .vibekit/scripts/validate-kit.mjs .` for the kit itself.
 7. Protected paths include `.env*`, secrets, lockfiles, generated files, build output, migrations, and infra unless the user says otherwise.

package/.vibekit/scripts/doctor.mjs

@@ -170,7 +170,8 @@ const surfaces = {
   agents: exists('AGENTS.md'),
   claude: exists('CLAUDE.md') || exists('.vibekit/init/CLAUDE-template.md') || exists('.claude'),
   cursor: exists('.cursor/rules'),
-  codex: exists('.agents') || exists('.codex-plugin/plugin.json')
+  codex: exists('.agents') || exists('.codex-plugin/plugin.json'),
+  grok: exists('.grok')
 };
 const managedBlocks = {
   AGENTS: countManaged('AGENTS.md'),
@@ -190,7 +191,8 @@ const nativeSkillSurfaces = {
   shared: '.vibekit/skills',
   claude: '.claude/skills',
   codex: '.agents/skills',
-  cursor: '.cursor/skills'
+  cursor: '.cursor/skills',
+  grok: '.grok/skills'
 };
 const missingNativeSkills = [];
 for (const [surface, dir] of Object.entries(nativeSkillSurfaces)) {
@@ -257,7 +259,9 @@ const report = {
     claudeSkills: listFiles('.claude/skills').filter((f) => f.endsWith('SKILL.md')).length,
     codexSkills: listFiles('.agents/skills').filter((f) => f.endsWith('SKILL.md')).length,
     cursorSkills: listFiles('.cursor/skills').filter((f) => f.endsWith('SKILL.md')).length,
-    cursorRules: listFiles('.cursor/rules').filter((f) => f.endsWith('.mdc')).length
+    cursorRules: listFiles('.cursor/rules').filter((f) => f.endsWith('.mdc')).length,
+    grokSkills: listFiles('.grok/skills').filter((f) => f.endsWith('SKILL.md')).length,
+    grokRules: listFiles('.grok/rules').filter((f) => f.endsWith('.md')).length
   },
   recommendedFirstPrompt: 'Read AGENTS.md and backbone.yml, run mvck doctor ., then propose a small safe plan before editing.',
   knownRisks: risks
@@ -308,15 +312,18 @@ ${(data.protectedPaths.length ? data.protectedPaths : ['not declared']).map((ite
 - Claude surface: ${data.agentSurfaces.claude ? 'yes' : 'no'}
 - Cursor surface: ${data.agentSurfaces.cursor ? 'yes' : 'no'}
 - Codex surface: ${data.agentSurfaces.codex ? 'yes' : 'no'}
+- Grok surface: ${data.agentSurfaces.grok ? 'yes' : 'no'}
 - Shared skills: ${data.aiRulesLoaded.sharedSkills}
 - Claude skills: ${data.aiRulesLoaded.claudeSkills}
 - Codex skills: ${data.aiRulesLoaded.codexSkills}
 - Cursor skills: ${data.aiRulesLoaded.cursorSkills}
 - Cursor rules: ${data.aiRulesLoaded.cursorRules}
+- Grok skills: ${data.aiRulesLoaded.grokSkills}
+- Grok rules: ${data.aiRulesLoaded.grokRules}
 
 ## Native reasoning skills
 
-${data.nativeReasoningSkills.names.map((skill) => `- ${skill}: ${data.nativeReasoningSkills.missing.some((item) => item.endsWith(`:${skill}`)) ? 'missing on one or more surfaces' : 'available on shared, Claude, Codex, and Cursor'}`).join('\n')}
+${data.nativeReasoningSkills.names.map((skill) => `- ${skill}: ${data.nativeReasoningSkills.missing.some((item) => item.endsWith(`:${skill}`)) ? 'missing on one or more surfaces' : 'available on shared, Claude, Codex, Cursor, and Grok'}`).join('\n')}
 
 ## Recommended first prompt
 

package/.vibekit/scripts/mvck.mjs

@@ -13,8 +13,8 @@ function usage() {
   console.log(`Minimal Vibe Coding Kit
 
 Usage:
-  mvck install [target] [--profile all|claude,cursor,codex] [--force] [--dry-run] [--json]
-  mvck update [target] [--profile all|claude,cursor,codex] [--dry-run] [--json] [--no-backup]
+  mvck install [target] [--profile all|claude,cursor,codex,grok] [--force] [--dry-run] [--json]
+  mvck update [target] [--profile all|claude,cursor,codex,grok] [--dry-run] [--json] [--no-backup]
   mvck init [target] [--propose|--write --yes] [--preset nextjs|wordpress|python|laravel|docker]
   mvck validate [target]
   mvck doctor [target] [--write-report] [--json]
@@ -158,23 +158,24 @@ const KIT_SCRIPTS = [
   '.vibekit/scripts/mvck.mjs', '.vibekit/scripts/init-backbone.mjs', '.vibekit/scripts/daily-enhance.mjs', '.vibekit/scripts/validate-kit.mjs',
   '.vibekit/scripts/doctor.mjs', '.vibekit/scripts/agentshield-probe.mjs', '.vibekit/scripts/vibekit-finalize.mjs'
 ];
-const VALID_PROFILES = new Set(['claude', 'cursor', 'codex']);
+const VALID_PROFILES = new Set(['claude', 'cursor', 'codex', 'grok']);
 
 function parseProfiles(profileRaw) {
-  const profiles = new Set(profileRaw === 'all' ? ['claude', 'cursor', 'codex'] : profileRaw.split(',').map((x) => x.trim()).filter(Boolean));
+  const profiles = new Set(profileRaw === 'all' ? ['claude', 'cursor', 'codex', 'grok'] : profileRaw.split(',').map((x) => x.trim()).filter(Boolean));
   for (const p of profiles) {
-    if (!VALID_PROFILES.has(p)) throw new Error(`Unknown profile: ${p}. Valid values: all, claude, cursor, codex (comma-separated).`);
+    if (!VALID_PROFILES.has(p)) throw new Error(`Unknown profile: ${p}. Valid values: all, claude, cursor, codex, grok (comma-separated).`);
   }
   return profiles;
 }
 const CLAUDE_DIRS = ['.claude/agents', '.claude/commands', '.claude/rules'];
 const CLAUDE_SKILLS = [
   'autoresearch-coding', 'agentshield-security-review', 'daily-workflow-curator', 'vibekit-init', 'visual-design-loop',
-  'clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis'
+  'clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis', 'prompt-sharpener'
 ];
 const CURSOR_DIRS = ['.cursor/rules', '.cursor/commands'];
-const CURSOR_SKILLS = ['clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis'];
+const CURSOR_SKILLS = ['clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis', 'prompt-sharpener'];
 const CODEX_DIRS = ['.agents', '.codex', '.codex-plugin'];
+const GROK_DIRS = ['.grok'];
 const GITIGNORE_BLOCK = `# BEGIN: minimal-vibe-coding-kit\n.autoresearch/\nresults.tsv\n.vibekit/INIT_DONE\n.vibekit/FINALIZE_DONE\n.vibekit/reports/\n.vibekit/update-backup/\n_vibekit-cleanup/\nCLAUDE.local.md\n# END: minimal-vibe-coding-kit`;
 
 function kitVersion() {
@@ -258,12 +259,18 @@ function install() {
       actions.push(copyDirSafe(`.cursor/skills/${skill}`, `.cursor/skills/${skill}`, target, opts));
     }
     actions.push(copyFileSafe('.cursor/settings.json', '.cursor/settings.json', target, opts));
+    actions.push(copyFileSafe('.cursor/cli.json', '.cursor/cli.json', target, opts));
   }
   if (profiles.has('codex')) {
     for (const dir of CODEX_DIRS) {
       actions.push(copyDirSafe(dir, dir, target, opts));
     }
   }
+  if (profiles.has('grok')) {
+    for (const dir of GROK_DIRS) {
+      actions.push(copyDirSafe(dir, dir, target, opts));
+    }
+  }
 
   applyManagedBlocks(target, profiles, actions, { dryRun });
   writeKitVersion(target, dryRun);
@@ -398,13 +405,21 @@ function update() {
   if (profiles.has('codex')) {
     for (const dir of CODEX_DIRS) actions.push(...updateDirSafe(dir, target, opts));
   }
+  if (profiles.has('grok')) {
+    // .grok/config.toml holds user-editable permission rules; seed it below instead of overwriting.
+    for (const dir of GROK_DIRS) actions.push(...updateDirSafe(dir, target, dir === '.grok' ? { ...opts, exclude: ['config.toml'] } : opts));
+  }
 
   // User-owned files: seed only when missing, never overwrite. Finalized
   // projects removed the one-time files on purpose, so skip re-seeding them.
   const seedFiles = finalized ? ['backbone.yml'] : KIT_SEED_FILES;
   for (const file of seedFiles) actions.push(copyFileSafe(file, file, target, { force: false, dryRun }));
   if (profiles.has('claude')) actions.push(copyFileSafe('.claude/settings.json', '.claude/settings.json', target, { force: false, dryRun }));
-  if (profiles.has('cursor')) actions.push(copyFileSafe('.cursor/settings.json', '.cursor/settings.json', target, { force: false, dryRun }));
+  if (profiles.has('cursor')) {
+    actions.push(copyFileSafe('.cursor/settings.json', '.cursor/settings.json', target, { force: false, dryRun }));
+    actions.push(copyFileSafe('.cursor/cli.json', '.cursor/cli.json', target, { force: false, dryRun }));
+  }
+  if (profiles.has('grok')) actions.push(copyFileSafe('.grok/config.toml', '.grok/config.toml', target, { force: false, dryRun }));
 
   applyManagedBlocks(target, profiles, actions, { dryRun });
   writeKitVersion(target, dryRun);
@@ -412,7 +427,7 @@ function update() {
   const summary = { add: 0, update: 0, unchanged: 0, skip: 0, 'managed-block': 0 };
   for (const a of actions) summary[a.action] = (summary[a.action] || 0) + 1;
   const backupInfo = backup && backup.count > 0 ? path.relative(target, backup.dir) : null;
-  const preserved = ['backbone.yml', 'CLAUDE.md', 'AGENTS.md content outside the managed block', '.claude/settings.json', '.cursor/settings.json'];
+  const preserved = ['backbone.yml', 'CLAUDE.md', 'AGENTS.md content outside the managed block', '.claude/settings.json', '.cursor/settings.json', '.cursor/cli.json', '.grok/config.toml'];
 
   const legacyPaths = detectLegacyLayout(target);
   if (json) {

package/.vibekit/scripts/test-install.mjs

@@ -120,6 +120,14 @@ try {
   const updParsed = JSON.parse(updPlan.stdout);
   assert(updParsed.status === 'dry-run' && typeof updParsed.toVersion === 'string', 'update --dry-run --json returns machine-readable plan');
 
+  // Single-profile installs must pass validation on their own.
+  for (const profile of ['claude', 'cursor', 'codex', 'grok']) {
+    const solo = tempDir(`profile-${profile}`);
+    run(['.vibekit/scripts/mvck.mjs', 'install', solo, '--profile', profile]);
+    run(['.vibekit/scripts/validate-kit.mjs', solo]);
+    assert(true, `${profile}-only install passes validation`);
+  }
+
   console.log('\nInstall behavior tests passed.');
 } finally {
   if (!keep) {

package/.vibekit/scripts/validate-kit.mjs

@@ -33,30 +33,53 @@ function listFiles(rel) {
   return out.sort();
 }
 
+// Surface presence: end-user repos may install only some profiles, so
+// per-surface files are required only when that surface is installed.
+// The kit source repo always validates every surface.
+const isKitSourceRepo = readJson('package.json')?.name === 'minimal-vibe-coding-kit';
+const surfacePresent = {
+  claude: isKitSourceRepo || exists('.claude'),
+  cursor: isKitSourceRepo || exists('.cursor'),
+  codex: isKitSourceRepo || exists('.agents') || exists('.codex') || exists('.codex-plugin'),
+  grok: isKitSourceRepo || exists('.grok')
+};
+for (const [surface, present] of Object.entries(surfacePresent)) {
+  if (!present) console.log(`INFO surface ${surface} not installed; skipping its checks`);
+}
+
+const KIT_SKILLS = [
+  'autoresearch-coding', 'agentshield-security-review', 'daily-workflow-curator', 'vibekit-init',
+  'clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'visual-design-loop',
+  'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis', 'prompt-sharpener'
+];
+const CURSOR_KIT_SKILLS = [
+  'clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety',
+  'memento', 'coding-level', 'parallel-analysis', 'prompt-sharpener'
+];
+
 const required = [
   'AGENTS.md', '.vibekit/init/CLAUDE-template.md', '.vibekit/init/FIRST_TIME_INIT.md', '.vibekit/init/FIRST_PROMPT.md', 'backbone.yml',
   '.vibekit/scripts/mvck.mjs', '.vibekit/scripts/init-backbone.mjs', '.vibekit/scripts/daily-enhance.mjs', '.vibekit/scripts/validate-kit.mjs',
   '.vibekit/scripts/doctor.mjs', '.vibekit/scripts/agentshield-probe.mjs', '.vibekit/scripts/vibekit-finalize.mjs',
-  '.vibekit/skills/autoresearch-coding/SKILL.md', '.vibekit/skills/agentshield-security-review/SKILL.md', '.vibekit/skills/daily-workflow-curator/SKILL.md', '.vibekit/skills/vibekit-init/SKILL.md',
-  '.vibekit/skills/clearthought/SKILL.md', '.vibekit/skills/sequential-thinking/SKILL.md', '.vibekit/skills/reviewing-4p-priorities/SKILL.md', '.vibekit/skills/visual-design-loop/SKILL.md',
-  '.vibekit/skills/path-sensitive-shell-safety/SKILL.md', '.vibekit/skills/memento/SKILL.md', '.vibekit/skills/coding-level/SKILL.md', '.vibekit/skills/parallel-analysis/SKILL.md',
-  '.vibekit/docs/templates/PRD_TEMPLATE.md', '.vibekit/docs/templates/CONTEXT_TEMPLATE.md',
-  '.codex/README.md', '.codex/config.example.toml',
-  '.claude/skills/autoresearch-coding/SKILL.md', '.claude/skills/agentshield-security-review/SKILL.md',
-  '.claude/skills/daily-workflow-curator/SKILL.md', '.claude/skills/vibekit-init/SKILL.md',
-  '.claude/skills/clearthought/SKILL.md', '.claude/skills/sequential-thinking/SKILL.md', '.claude/skills/reviewing-4p-priorities/SKILL.md', '.claude/skills/visual-design-loop/SKILL.md',
-  '.claude/skills/path-sensitive-shell-safety/SKILL.md', '.claude/skills/memento/SKILL.md', '.claude/skills/coding-level/SKILL.md',
-  '.claude/skills/parallel-analysis/SKILL.md',
-  '.cursor/rules/001-vibe-core.mdc', '.cursor/skills/clearthought/SKILL.md', '.cursor/skills/sequential-thinking/SKILL.md', '.cursor/skills/reviewing-4p-priorities/SKILL.md',
-  '.cursor/skills/path-sensitive-shell-safety/SKILL.md',
-  '.cursor/skills/memento/SKILL.md', '.cursor/skills/coding-level/SKILL.md', '.cursor/skills/parallel-analysis/SKILL.md',
-  '.agents/skills/autoresearch-coding/SKILL.md', '.agents/skills/agentshield-security-review/SKILL.md',
-  '.agents/skills/daily-workflow-curator/SKILL.md', '.agents/skills/vibekit-init/SKILL.md',
-  '.agents/skills/clearthought/SKILL.md', '.agents/skills/sequential-thinking/SKILL.md', '.agents/skills/reviewing-4p-priorities/SKILL.md', '.agents/skills/visual-design-loop/SKILL.md',
-  '.agents/skills/path-sensitive-shell-safety/SKILL.md', '.agents/skills/memento/SKILL.md', '.agents/skills/coding-level/SKILL.md',
-  '.agents/skills/parallel-analysis/SKILL.md',
-  '.codex-plugin/plugin.json'
+  ...KIT_SKILLS.map((skill) => `.vibekit/skills/${skill}/SKILL.md`),
+  '.vibekit/docs/templates/PRD_TEMPLATE.md', '.vibekit/docs/templates/CONTEXT_TEMPLATE.md'
 ];
+if (surfacePresent.claude) {
+  required.push(...KIT_SKILLS.map((skill) => `.claude/skills/${skill}/SKILL.md`));
+}
+if (surfacePresent.cursor) {
+  required.push('.cursor/rules/001-vibe-core.mdc', '.cursor/cli.json',
+    ...CURSOR_KIT_SKILLS.map((skill) => `.cursor/skills/${skill}/SKILL.md`));
+}
+if (surfacePresent.codex) {
+  required.push('.codex/README.md', '.codex/config.example.toml', '.codex/rules/vibekit.rules', '.codex-plugin/plugin.json',
+    ...KIT_SKILLS.map((skill) => `.agents/skills/${skill}/SKILL.md`));
+}
+if (surfacePresent.grok) {
+  required.push('.grok/README.md', '.grok/config.example.toml', '.grok/config.toml',
+    '.grok/rules/vibe-core.md', '.grok/rules/security.md', '.grok/rules/safe-delete.md',
+    ...KIT_SKILLS.map((skill) => `.grok/skills/${skill}/SKILL.md`));
+}
 
 const reasoningSkillResources = {
   'clearthought': [
@@ -83,7 +106,12 @@ const reasoningSkillResources = {
   ]
 };
 
-for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
+const reasoningSurfaceDirs = ['.vibekit/skills'];
+if (surfacePresent.claude) reasoningSurfaceDirs.push('.claude/skills');
+if (surfacePresent.cursor) reasoningSurfaceDirs.push('.cursor/skills');
+if (surfacePresent.codex) reasoningSurfaceDirs.push('.agents/skills');
+if (surfacePresent.grok) reasoningSurfaceDirs.push('.grok/skills');
+for (const surface of reasoningSurfaceDirs) {
   for (const [skill, files] of Object.entries(reasoningSkillResources)) {
     for (const file of files) required.push(`${surface}/${skill}/${file}`);
   }
@@ -94,7 +122,6 @@ if (exists('README.md')) ok('optional README.md present');
 else console.log('INFO optional README.md not present in target project');
 
 // Kit-maintainer files: required in the kit source repo, intentionally absent in end-user installs.
-const isKitSourceRepo = readJson('package.json')?.name === 'minimal-vibe-coding-kit';
 if (isKitSourceRepo) {
   for (const rel of ['.vibekit/scripts/test-install.mjs', '.vibekit/scripts/pack-dry-run.mjs', '.vibekit/docs/RESEARCH_NOTES.md', '.vibekit/docs/AUTORESEARCH_LEDGER.md']) {
     exists(rel) ? ok(`kit-source file ${rel}`) : fail(`missing kit-source file ${rel}`);
@@ -116,18 +143,19 @@ if (exists('.vibekit/docs/AUTORESEARCH_LEDGER.md')) {
 }
 
 const skillMirrors = {
-  'autoresearch-coding': ['.claude/skills/autoresearch-coding', '.agents/skills/autoresearch-coding'],
-  'agentshield-security-review': ['.claude/skills/agentshield-security-review', '.agents/skills/agentshield-security-review'],
-  'daily-workflow-curator': ['.claude/skills/daily-workflow-curator', '.agents/skills/daily-workflow-curator'],
-  'vibekit-init': ['.claude/skills/vibekit-init', '.agents/skills/vibekit-init'],
-  'clearthought': ['.claude/skills/clearthought', '.cursor/skills/clearthought', '.agents/skills/clearthought'],
-  'sequential-thinking': ['.claude/skills/sequential-thinking', '.cursor/skills/sequential-thinking', '.agents/skills/sequential-thinking'],
-  'reviewing-4p-priorities': ['.claude/skills/reviewing-4p-priorities', '.cursor/skills/reviewing-4p-priorities', '.agents/skills/reviewing-4p-priorities'],
-  'path-sensitive-shell-safety': ['.claude/skills/path-sensitive-shell-safety', '.cursor/skills/path-sensitive-shell-safety', '.agents/skills/path-sensitive-shell-safety'],
-  'visual-design-loop': ['.claude/skills/visual-design-loop', '.agents/skills/visual-design-loop'],
-  'memento': ['.claude/skills/memento', '.cursor/skills/memento', '.agents/skills/memento'],
-  'coding-level': ['.claude/skills/coding-level', '.cursor/skills/coding-level', '.agents/skills/coding-level'],
-  'parallel-analysis': ['.claude/skills/parallel-analysis', '.cursor/skills/parallel-analysis', '.agents/skills/parallel-analysis']
+  'autoresearch-coding': ['.claude/skills/autoresearch-coding', '.agents/skills/autoresearch-coding', '.grok/skills/autoresearch-coding'],
+  'agentshield-security-review': ['.claude/skills/agentshield-security-review', '.agents/skills/agentshield-security-review', '.grok/skills/agentshield-security-review'],
+  'daily-workflow-curator': ['.claude/skills/daily-workflow-curator', '.agents/skills/daily-workflow-curator', '.grok/skills/daily-workflow-curator'],
+  'vibekit-init': ['.claude/skills/vibekit-init', '.agents/skills/vibekit-init', '.grok/skills/vibekit-init'],
+  'clearthought': ['.claude/skills/clearthought', '.cursor/skills/clearthought', '.agents/skills/clearthought', '.grok/skills/clearthought'],
+  'sequential-thinking': ['.claude/skills/sequential-thinking', '.cursor/skills/sequential-thinking', '.agents/skills/sequential-thinking', '.grok/skills/sequential-thinking'],
+  'reviewing-4p-priorities': ['.claude/skills/reviewing-4p-priorities', '.cursor/skills/reviewing-4p-priorities', '.agents/skills/reviewing-4p-priorities', '.grok/skills/reviewing-4p-priorities'],
+  'path-sensitive-shell-safety': ['.claude/skills/path-sensitive-shell-safety', '.cursor/skills/path-sensitive-shell-safety', '.agents/skills/path-sensitive-shell-safety', '.grok/skills/path-sensitive-shell-safety'],
+  'visual-design-loop': ['.claude/skills/visual-design-loop', '.agents/skills/visual-design-loop', '.grok/skills/visual-design-loop'],
+  'memento': ['.claude/skills/memento', '.cursor/skills/memento', '.agents/skills/memento', '.grok/skills/memento'],
+  'coding-level': ['.claude/skills/coding-level', '.cursor/skills/coding-level', '.agents/skills/coding-level', '.grok/skills/coding-level'],
+  'parallel-analysis': ['.claude/skills/parallel-analysis', '.cursor/skills/parallel-analysis', '.agents/skills/parallel-analysis', '.grok/skills/parallel-analysis'],
+  'prompt-sharpener': ['.claude/skills/prompt-sharpener', '.cursor/skills/prompt-sharpener', '.agents/skills/prompt-sharpener', '.grok/skills/prompt-sharpener']
 };
 
 function validateSkillMirror(sourceRel, mirrorRel) {
@@ -164,8 +192,15 @@ function validateSkillMirror(sourceRel, mirrorRel) {
   if (mismatches === 0) ok(`skill mirror ${mirrorRel} matches ${sourceRel} (${sourceFiles.length} files)`);
 }
 
+const mirrorSurface = (mirror) => mirror.startsWith('.claude/') ? 'claude'
+  : mirror.startsWith('.cursor/') ? 'cursor'
+  : mirror.startsWith('.agents/') ? 'codex'
+  : 'grok';
 for (const [skill, mirrors] of Object.entries(skillMirrors)) {
-  for (const mirror of mirrors) validateSkillMirror(`.vibekit/skills/${skill}`, mirror);
+  for (const mirror of mirrors) {
+    if (!surfacePresent[mirrorSurface(mirror)]) continue;
+    validateSkillMirror(`.vibekit/skills/${skill}`, mirror);
+  }
 }
 
 function parseFrontmatter(text) {
@@ -179,7 +214,7 @@ function parseFrontmatter(text) {
   return fields;
 }
 
-for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills']) {
+for (const surface of ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills', '.grok/skills']) {
   if (!exists(surface)) continue;
   for (const file of listFiles(surface).filter((f) => f.endsWith('SKILL.md'))) {
     const rel = `${surface}/${file}`;
@@ -198,7 +233,9 @@ function stripFrontmatter(text) {
 
 if (exists('.vibekit/commands')) {
   const canonicalCmds = listFiles('.vibekit/commands').filter((f) => f.endsWith('.md'));
-  const cmdMirrors = { '.claude/commands': true, '.cursor/commands': true };
+  const cmdMirrors = {};
+  if (surfacePresent.claude) cmdMirrors['.claude/commands'] = true;
+  if (surfacePresent.cursor) cmdMirrors['.cursor/commands'] = true;
   for (const [mirrorDir, stripFm] of Object.entries(cmdMirrors)) {
     if (!exists(mirrorDir)) { warn(`command mirror dir missing: ${mirrorDir}`); continue; }
     for (const file of canonicalCmds) {
@@ -213,7 +250,7 @@ if (exists('.vibekit/commands')) {
   }
 }
 
-for (const rel of ['package.json', '.claude/settings.json', '.cursor/settings.json', '.codex-plugin/plugin.json']) {
+for (const rel of ['package.json', '.claude/settings.json', '.cursor/settings.json', '.cursor/cli.json', '.codex-plugin/plugin.json']) {
   if (!exists(rel)) continue;
   try { JSON.parse(read(rel)); ok(`valid JSON ${rel}`); } catch (error) { fail(`invalid JSON ${rel}: ${error.message}`); }
 }
@@ -271,6 +308,33 @@ if (claudeSettings?.permissions?.deny && cursorSettings?.permissions?.deny) {
   if (parity) ok(`deny list category parity across .claude and .cursor (${claudeCats.size} categories)`);
 }
 
+// Guardrail lint: catches known-dead deny patterns at the syntax level. It does
+// not replace native checks — verify semantics with each tool's own validator
+// (e.g. `codex execpolicy check`, `grok inspect`).
+for (const [rel, settings] of [['.claude/settings.json', claudeSettings], ['.cursor/settings.json', cursorSettings]]) {
+  const deny = settings?.permissions?.deny;
+  if (!Array.isArray(deny)) continue;
+  const piped = deny.filter((rule) => rule.includes('|'));
+  piped.length === 0
+    ? ok(`${rel} deny rules avoid pipe-spanning patterns (subcommands are matched independently)`)
+    : fail(`${rel} deny rules span a pipe and never match: ${piped.join(', ')}`);
+  const yesFirst = deny.some((rule) => rule.startsWith('Bash(npx --yes') || rule.startsWith('Bash(npx -y'));
+  yesFirst
+    ? ok(`${rel} denies leading npx --yes/-y forms`)
+    : fail(`${rel} missing deny for leading npx --yes/-y forms`);
+}
+if (surfacePresent.cursor && exists('.cursor/cli.json')) {
+  const cursorCli = readJson('.cursor/cli.json');
+  Array.isArray(cursorCli?.permissions?.deny) && cursorCli.permissions.deny.includes('Shell(rm)')
+    ? ok('.cursor/cli.json denies Shell(rm)')
+    : fail('.cursor/cli.json missing permissions.deny entry Shell(rm)');
+}
+if (surfacePresent.codex) requireText('.codex/rules/vibekit.rules', 'decision = "forbidden"', 'Codex rules include forbidden decisions');
+if (surfacePresent.grok) {
+  requireText('.grok/config.toml', '[permission]', 'Grok project config declares [permission] rules');
+  requireText('.grok/config.toml', '"Bash(rm *)"', 'Grok project config denies rm');
+}
+
 if (pkg?.name === 'minimal-vibe-coding-kit') {
   for (const rel of ['SECURITY.md', 'CONTRIBUTING.md', 'CODE_OF_CONDUCT.md', '.github/dependabot.yml', '.github/workflows/vibekit-validate.yml', '.vibekit/docs/backbone.schema.json']) {
     exists(rel) ? ok(`release safety file ${rel}`) : fail(`missing release safety file ${rel}`);
@@ -381,7 +445,8 @@ function validateBackboneSchema(text) {
     if (!surfacePath || surfacePath === 'null') continue;
     const cleanPath = surfacePath.replace(/^["']|["']$/g, '');
     if (exists(cleanPath)) ok(`agent_surfaces path exists: ${cleanPath}`);
-    else fail(`agent_surfaces path missing: ${cleanPath}`);
+    else if (isKitSourceRepo) fail(`agent_surfaces path missing: ${cleanPath}`);
+    else warn(`agent_surfaces path missing: ${cleanPath} (profile-scoped install?)`);
   }
 }
 
@@ -401,7 +466,7 @@ const riskyPatterns = [
   { pattern: 'ignore previous' + ' instructions', message: 'prompt injection phrase' }
 ];
 
-const scanDirs = ['.claude', '.cursor', '.agents', '.codex-plugin', '.vibekit/skills', '.vibekit/commands', '.vibekit/scripts', 'AGENTS.md', '.vibekit/init/CLAUDE-template.md'];
+const scanDirs = ['.claude', '.cursor', '.agents', '.grok', '.codex-plugin', '.vibekit/skills', '.vibekit/commands', '.vibekit/scripts', 'AGENTS.md', '.vibekit/init/CLAUDE-template.md'];
 function walk(item) {
   const p = path.join(root, item);
   if (!fs.existsSync(p)) return [];