minimal-vibe-coding-kit 0.4.1 → 0.4.2

package/.vibekit/skills/agentshield-security-review/scripts/agentshield_repo_probe.py

@@ -15,10 +15,11 @@ PATTERNS = {
     "repo_instructions": ["CLAUDE.md", "AGENTS.md", ".github/copilot-instructions.md"],
     "claude": [".claude", ".claude-plugin", "agents"],
     "codex": [".codex", ".codex-plugin"],
-    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", "skills"],
+    "grok": [".grok"],
+    "shared_skills": [".vibekit/skills", ".claude/skills", ".cursor/skills", ".agents/skills", ".grok/skills", "skills"],
     "shared_commands": [".vibekit/commands"],
     "kit_scripts": [".vibekit/scripts"],
-    "hooks": ["hooks", ".claude/hooks", ".agents/hooks"],
+    "hooks": ["hooks", ".claude/hooks", ".agents/hooks", ".grok/hooks"],
     "mcp": [".mcp.json", "mcp.json", "mcp-configs"],
     "ci": [".github/workflows"],
 }
@@ -55,6 +56,27 @@ def safe_read(path: Path, limit: int = 200_000) -> str:
         return ""
 
 
+def deny_block_lines(text: str) -> set[int]:
+    """Line indexes inside a permissions deny array (JSON `"deny": [` or TOML `deny = [`).
+
+    Deny rules quote dangerous patterns in order to block them, so a marker on
+    those lines is defensive, not suspicious. Allow/ask blocks are still scanned.
+    """
+    covered: set[int] = set()
+    inside = False
+    for idx, line in enumerate(text.splitlines()):
+        stripped = line.strip()
+        if not inside and "[" in stripped and ('"deny"' in stripped or stripped.startswith("deny =") or stripped.startswith("deny=")):
+            covered.add(idx)
+            inside = "]" not in stripped.split("[", 1)[1]
+            continue
+        if inside:
+            covered.add(idx)
+            if "]" in stripped:
+                inside = False
+    return covered
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description="Inventory Claude/Codex AgentShield surfaces")
     parser.add_argument("path", nargs="?", default=".", help="Repository root")
@@ -77,8 +99,11 @@ def main() -> int:
                     if file_path.suffix.lower() not in {".md", ".json", ".toml", ".yaml", ".yml", ".sh", ".js", ".ts"}:
                         continue
                     text = safe_read(file_path)
+                    skip_lines = deny_block_lines(text)
+                    lines = text.splitlines()
                     for marker in SUSPICIOUS_TEXT:
-                        if marker in text:
+                        hits = [idx for idx, line in enumerate(lines) if marker in line]
+                        if any(idx not in skip_lines for idx in hits):
                             suspicious.append({
                                 "path": str(file_path.relative_to(root)),
                                 "marker": marker,

package/.vibekit/skills/prompt-sharpener/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: prompt-sharpener
+description: Sharpen a rough prompt into a precise one — same intent, sharper not longer — then execute the sharpened version immediately in the same turn.
+argument-hint: "the rough prompt to sharpen and execute"
+disable-model-invocation: true
+---
+
+# Prompt Sharpener
+
+The text the user types after the invocation is the **raw prompt**. Upgrade it into a prompt that is **sharper, not longer** — keep the original intent, constraints, and language — then execute the upgraded version immediately in the same turn. No text after the invocation → ask the user what they want and stop.
+
+## Step 1 — Diagnose the raw prompt
+
+Scan for every ailment below; each ailment found gets its cure applied directly in the upgraded prompt. Cure silently; call out a cure only when it could shift the user's intent.
+
+- Vague verbs or adjectives ("help me", "make it nicer") → concrete, measurable operations and parameters.
+- Two tasks in one prompt → split into an explicit execution order.
+- No success criteria → add a binary pass/fail `Done when`.
+- Emotional description ("everything is broken") → extract the specific technical symptom.
+- "The whole app" scope → pin exact files/functions/directories; coding tasks always get a **scope lock** (edit only inside X, leave the rest untouched).
+- Relies on memory of an old session → copy the decisions already settled in this conversation (stack, architecture, what was tried and failed) into the `Context` block.
+- Invitation to fabricate ("what do experts say about X?") → anchor grounding: state only what can be verified; when unsure, say so explicitly.
+- No output format → fix the structure and length; when the format is hard to describe in words, include 2-3 sample examples (including an edge case) in the `Output Contract`.
+
+Done when: the raw prompt has been checked against the full list and no ailment is left without its cure in the upgraded prompt.
+
+## Step 2 — Build the upgraded prompt
+
+Classify the task (coding / research / writing / analysis / planning / review), then assemble blocks in this order — add a block only when it raises precision; small tasks need just 2-3 blocks:
+
+`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`
+
+Focus per task type:
+
+- Coding: scope lock, smallest correct change, validation after the edit — default to the `validate` command in `backbone.yml` when the repo has one.
+- Research: source quality, citations, explicit uncertainty.
+- Writing: audience, voice, length.
+- Review: group findings by severity, name the failure mode.
+
+Construction rules:
+
+- Write constraints with the strongest signal words: MUST instead of "should", NEVER instead of "avoid".
+- Missing information → state the assumption in `Context` and keep going; stop to ask only when the task is destructive or irreversible.
+- Say _what_ to verify; let the model regulate its own depth of thought.
+- Repo work MUST respect `backbone.yml` conventions and protected paths; when the upgraded task is a large decomposition or a risky decision, its `Work Style` block may direct Step 3 to open with the `sequential-thinking` or `clearthought` skill.
+- Closing audit: reread every sentence; if cutting it would not change the output, cut it — every remaining word is **load-bearing**.
+
+Done when the upgraded prompt scores on all 6 points: intent preserved — ambiguity reduced — right depth — clear output — has verification — has a stopping point.
+
+## Step 3 — Present and execute
+
+Print the upgraded prompt in a single code block, with at most 2 sentences on the key changes. Then treat it as the user's official request: start executing immediately in the same turn, researching and editing according to its own `Tool Rules`.
+
+Done when the upgraded prompt's `Done Criteria` are satisfied.

package/.vibekit/skills/vibekit-init/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: vibekit-init
-description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, or Codex skill setup. Always show requirements and a diff before writing.
+description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, Codex skill setup, or Grok setup. Always show requirements and a diff before writing.
 disable-model-invocation: true
-argument-hint: target path; profiles claude,cursor,codex; write yes/no
+argument-hint: target path; profiles claude,cursor,codex,grok; write yes/no
 ---
 
 # Vibe Kit Init

package/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Shared instructions for Claude, Cursor, Codex, and other coding agents.
+Shared instructions for Claude, Cursor, Codex, Grok, and other coding agents.
 
 <!-- BEGIN: minimal-vibe-coding-kit -->
 ## Minimal Vibe Coding Kit
@@ -35,7 +35,7 @@ Track every loop in `/tmp/design-{project_slug}.md`. Each loop entry must includ
 - Do not run untrusted hooks, MCP servers, deploy scripts, package lifecycle scripts, migrations, or destructive shell commands just to inspect a repo.
 - Do not modify protected paths from `backbone.yml` without explicit approval.
 - Before editing or approving shell/deploy/installer/repair logic that uses path variables or destructive commands (`rm`, `mv`, `cp -a`, `rsync --delete`, `find -delete`, `git clean`, checkout replacement), use `path-sensitive-shell-safety` and prove base/folder/repo values are non-empty, contained, quoted, and not broad system paths.
-- If a task changes agent surfaces (`CLAUDE.md`, `AGENTS.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, `.vibekit/skills/**`, `.vibekit/commands/**`, `.vibekit/scripts/**`, hooks, MCP config), run the AgentShield probe or explain why it was skipped.
+- If a task changes agent surfaces (`CLAUDE.md`, `AGENTS.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.grok/**`, `.codex-plugin/**`, `.vibekit/skills/**`, `.vibekit/commands/**`, `.vibekit/scripts/**`, hooks, MCP config), run the AgentShield probe or explain why it was skipped.
 
 ### Skills to prefer
 

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.4.2 — 2026-07-18
+
+- Added a Grok Build (Grok CLI) surface across the kit: `.grok/rules/` (always-on, every `*.md` loaded), `.grok/skills/` (all 13 kit skills, user-invocable as `/<skill-name>`), `.grok/README.md`, and project-scoped `[permission]` deny rules in `.grok/config.toml` mirroring the kit's dangerous-command deny list; `config.example.toml` documents the user-level `~/.grok/config.toml` settings. Added a `grok` install/update profile to `mvck.mjs` (included in `all`) and registered Grok everywhere Claude/Cursor/Codex already were: `validate-kit.mjs`, npm package files, `backbone.yml` `agent_surfaces`, `AGENTS.md`, the AgentShield probe, both READMEs, `INSTALL.md`, `BACKBONE_REFERENCE.md`, `CONTEXT_TEMPLATE.md`, `FIRST_TIME_INIT.md`, and `vibekit-init`.
+- Added `prompt-sharpener` skill (shared + Claude/Cursor/Codex/Grok mirrors), an English rewrite of a collected `sharpen` skill: `/prompt-sharpener <rough prompt>` diagnoses a raw prompt against a defect checklist (vague verbs, mixed tasks, missing success criteria, unbounded scope, missing output format), rebuilds it as a sharper prompt (`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`), prints it in one code block, then executes it in the same turn.
+- Corrected the dangerous-command guardrails after a cross-tool documentation review. Removed the pipe-spanning `curl *|*sh` / `wget *|*sh` deny rules from `.claude/settings.json` and `.cursor/settings.json` — Claude Code evaluates each piped subcommand independently, so they never matched — in favor of denying bare shell interpreters (`sh`, `bash`, `zsh`, and their `-` stdin forms, which is what `curl ... | sh` actually executes), and fixed the `npx` rules to also cover the common leading `--yes`/`-y` forms.
+- Added each tool's actual documented project-level permission mechanism, since only Claude Code and Cursor's Claude-schema file had one before: `.cursor/cli.json` with `Shell(...)` rules for Cursor CLI (the real mechanism Cursor reads; the Claude-schema `settings.json` is kept only as reference), experimental `.codex/rules/vibekit.rules` execution-policy rules for Codex (`forbidden` decisions with `match`/`not_match` fixtures, active once the project `.codex/` layer is trusted), and the `.grok/config.toml` rules above.
+- `validate-kit` now lints deny lists for pipe-spanning patterns and missing leading `npx --yes`/`-y` coverage, and is profile-aware: per-surface files are required only when that surface is installed (the kit source repo still validates everything), so a `claude`-only or `grok`-only install passes its own validation; `test-install` runs an install+validate cycle for each single profile.
+- `mvck update` treats `.cursor/cli.json` and `.grok/config.toml` as user-owned (seeded once, never overwritten). The AgentShield probe's suspicious-marker scan now skips lines inside permission `deny` arrays, so the kit's own deny rules no longer flag themselves as suspicious; allow/ask blocks are still scanned.
+- Synced version to 0.4.2 in `package.json`, both README badges, and `.codex-plugin/plugin.json`.
+
 ## 0.4.1 — 2026-07-17
 
 - Added a safe-delete guardrail across all three surfaces: new `.claude/rules/safe-delete.md` and `.cursor/rules/040-safe-delete.mdc` (always-on), a `### Safety` bullet in the `AGENTS.md` managed block for Codex, and a trash-first outcome in the `path-sensitive-shell-safety` skill (all mirrors). Agents prefer the recoverable `trash` command over `rm`, check `command -v trash` first, and recommend an install when missing (macOS 14+ built-in; older macOS `brew install trash`; Linux `sudo apt install trash-cli`; any OS with Node `npm i -g trash-cli`). `rm` was already deny-listed for Claude Code and Cursor in the kit settings.

package/README.md

@@ -6,14 +6,15 @@
 
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![npm](https://img.shields.io/badge/npm-minimal--vibe--coding--kit-cb3837?logo=npm)](https://www.npmjs.com/package/minimal-vibe-coding-kit)
-[![Version](https://img.shields.io/badge/version-0.4.1-2ea44f.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.4.2-2ea44f.svg)](CHANGELOG.md)
 ![Claude](https://img.shields.io/badge/Claude%20Code-Commands%20%26%20Skills-111111)
 ![Cursor](https://img.shields.io/badge/Cursor-Rules%20%26%20Commands-1f6feb)
 ![Codex](https://img.shields.io/badge/Codex-AGENTS.md%20%26%20Plugin-6f42c1)
+![Grok](https://img.shields.io/badge/Grok-Rules%20%26%20Skills-000000)
 ![AgentShield](https://img.shields.io/badge/Security-AgentShield-d62828)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js&logoColor=white)
 
-**One installable AI-coding workflow kit for Claude Code, Cursor, and Codex — any repo, any language.**
+**One installable AI-coding workflow kit for Claude Code, Cursor, Codex, and Grok — any repo, any language.**
 
 Install → paste one prompt → approve the proposal → code with guardrails.
 
@@ -23,12 +24,12 @@ Install → paste one prompt → approve the proposal → code with guardrails.
 
 ## What is this?
 
-A small kit of shared **rules**, **skills**, and **commands**, plus one **`backbone.yml`** manifest, so Claude Code, Cursor, and Codex all understand your project the same way.
+A small kit of shared **rules**, **skills**, and **commands**, plus one **`backbone.yml`** manifest, so Claude Code, Cursor, Codex, and Grok all understand your project the same way.
 
 - Never overwrites your existing `CLAUDE.md` / `AGENTS.md` — it only adds managed blocks.
 - Every setup write waits for your explicit approval.
 - Security review of agent surfaces (AgentShield) is part of the normal workflow.
-- Safe deletes by default: `rm` is deny-listed for Claude Code and Cursor, and all agents prefer the recoverable `trash` command (init checks it and recommends an install if missing).
+- Safe deletes by default: all agents prefer the recoverable `trash` command (init checks it and recommends an install if missing), backed by each tool's documented guardrail config — Claude Code deny rules (`.claude/settings.json`), Cursor CLI permissions (`.cursor/cli.json`), Codex execution-policy rules (`.codex/rules/`, experimental, active once the project is trusted), and Grok project permission rules (`.grok/config.toml`).
 - First-time init asks two setup preferences — use `trash` instead of `rm`, and your default explanation level (0–5, changeable anytime with `/coding-level N`) — and records both in `backbone.yml`.
 
 ## Quick Start
@@ -43,7 +44,7 @@ npx --yes minimal-vibe-coding-kit@latest install /path/to/your-project
 
 Already ran `npm i minimal-vibe-coding-kit`, or prefer GitHub or a local clone? See [Install from npm](#install-from-npm).
 
-**2. Open the project in Claude Code, Cursor, or Codex and paste:**
+**2. Open the project in Claude Code, Cursor, Codex, or Grok and paste:**
 
 ```text
 Read .vibekit/init/FIRST_TIME_INIT.md and initialize this repo with Minimal Vibe Coding Kit.
@@ -108,6 +109,7 @@ your-project/
 ├── .cursor/                  ← Cursor: rules, commands, skills
 ├── .agents/                  ← Codex / portable skills
 ├── .codex/  .codex-plugin/   ← Codex config example + plugin manifest
+├── .grok/                    ← Grok Build: rules, skills, config example
 └── .vibekit/                 ← everything kit-owned, in ONE folder
     ├── skills/               ← canonical shared skills (mirrored to the harness dirs)
     ├── commands/             ← shared command prompts
@@ -121,7 +123,7 @@ Existing files are never replaced — the kit merges managed blocks (`BEGIN/END:
 ## How the pieces connect
 
 ```text
-You (prompt) ──▶ Claude Code / Cursor / Codex
+You (prompt) ──▶ Claude Code / Cursor / Codex / Grok
                       │  reads first
                       ▼
         backbone.yml  +  AGENTS.md / CLAUDE.md  +  rules
@@ -142,11 +144,12 @@ You (prompt) ──▶ Claude Code / Cursor / Codex
 
 1. **Just code.** Ask for features and fixes normally; the agent follows `backbone.yml` conventions and keeps diffs small.
 2. **Big or vague task?** Start with the `clearthought` or `sequential-thinking` skill to get a plan first.
-3. **Repo-wide question or big review?** Use `parallel-analysis` — it fans out read-only analysis lanes and verifies the merged result.
-4. **Changed `.claude/`, skills, hooks, or installer scripts?** Run `/security-scan` before merging.
-5. **Want measurable improvements?** Run `/autoresearch-coding` with a metric and budget.
-6. **Keep the setup sharp:** `/daily-enhance` proposes improvements — it never applies them silently.
-7. **Onboarding finished for good?** `/vibe-finalize` moves one-time bootstrap files out.
+3. **Complex task but only a rough prompt?** `/prompt-sharpener <rough prompt>` sharpens it into a precise prompt and executes it in the same turn.
+4. **Repo-wide question or big review?** Use `parallel-analysis` — it fans out read-only analysis lanes and verifies the merged result.
+5. **Changed `.claude/`, skills, hooks, or installer scripts?** Run `/security-scan` before merging.
+6. **Want measurable improvements?** Run `/autoresearch-coding` with a metric and budget.
+7. **Keep the setup sharp:** `/daily-enhance` proposes improvements — it never applies them silently.
+8. **Onboarding finished for good?** `/vibe-finalize` moves one-time bootstrap files out.
 
 ## Commands
 
@@ -161,7 +164,7 @@ You (prompt) ──▶ Claude Code / Cursor / Codex
 
 ## Skills
 
-All 12 skills live in `.vibekit/skills/` and are mirrored for each tool. Invoke them by name ("Use the X skill…") or via the commands above.
+All 13 skills live in `.vibekit/skills/` and are mirrored for each tool. Invoke them by name ("Use the X skill…") or via the commands above.
 
 | Skill | Use it when | Example prompt |
 | --- | --- | --- |
@@ -177,6 +180,7 @@ All 12 skills live in `.vibekit/skills/` and are mirrored for each tool. Invoke
 | `reviewing-4p-priorities` | Triaging bugs/findings into P0–P4 fix order. | "Use reviewing-4p-priorities. Classify these findings and give a fix sequence." |
 | `memento` | Multi-day tasks: save context before stopping, resume next session. | "/memento — write MEMENTO.md with Goal, Done, Stuck, Next." |
 | `coding-level` | Setting how detailed explanations should be (0 = ELI5 … 5 = expert). | "/coding-level 2" |
+| `prompt-sharpener` | A complex task but only a rough prompt: sharpen it, then execute it in the same turn. | "/prompt-sharpener make the settings page load faster" |
 
 ## Advanced
 
@@ -188,6 +192,7 @@ Install only the surfaces you use (default is `all`):
 npx --yes minimal-vibe-coding-kit@latest install . --profile claude          # Claude Code only
 npx --yes minimal-vibe-coding-kit@latest install . --profile claude,cursor   # Claude + Cursor
 npx --yes minimal-vibe-coding-kit@latest install . --profile codex           # Codex / AGENTS.md agents
+npx --yes minimal-vibe-coding-kit@latest install . --profile grok            # Grok Build CLI
 ```
 
 Flags: `--force` (overwrite existing kit files), `--dry-run` (preview), `--json` (machine-readable plan).

package/backbone.yml

@@ -10,7 +10,7 @@ meta:
 
 project:
   name: minimal-vibe-coding-kit
-  description: "Project-agnostic AI coding workflow kit for Claude Code, Cursor, and Codex with AgentShield security review."
+  description: "Project-agnostic AI coding workflow kit for Claude Code, Cursor, Codex, and Grok with AgentShield security review."
   type: single-repo
   primary_language: js
   package_manager: npm
@@ -83,6 +83,7 @@ agent_surfaces:
   cursor: .cursor/
   codex: .agents/
   codex_plugin: .codex-plugin/plugin.json
+  grok: .grok/
   shared_skills: .vibekit/skills/
   shared_commands: .vibekit/commands/
 

package/docs/README.vi.md

@@ -6,14 +6,15 @@
 
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](../LICENSE)
 [![npm](https://img.shields.io/badge/npm-minimal--vibe--coding--kit-cb3837?logo=npm)](https://www.npmjs.com/package/minimal-vibe-coding-kit)
-[![Version](https://img.shields.io/badge/version-0.4.1-2ea44f.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.4.2-2ea44f.svg)](../CHANGELOG.md)
 ![Claude](https://img.shields.io/badge/Claude%20Code-Commands%20%26%20Skills-111111)
 ![Cursor](https://img.shields.io/badge/Cursor-Rules%20%26%20Commands-1f6feb)
 ![Codex](https://img.shields.io/badge/Codex-AGENTS.md%20%26%20Plugin-6f42c1)
+![Grok](https://img.shields.io/badge/Grok-Rules%20%26%20Skills-000000)
 ![AgentShield](https://img.shields.io/badge/Security-AgentShield-d62828)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js&logoColor=white)
 
-**Một bộ kit AI-coding cài một lần cho Claude Code, Cursor và Codex — mọi repo, mọi ngôn ngữ.**
+**Một bộ kit AI-coding cài một lần cho Claude Code, Cursor, Codex và Grok — mọi repo, mọi ngôn ngữ.**
 
 Cài đặt → dán một prompt → duyệt đề xuất → code với guardrails.
 
@@ -23,12 +24,12 @@ Cài đặt → dán một prompt → duyệt đề xuất → code với guardr
 
 ## Bộ kit này là gì?
 
-Một bộ kit nhỏ gồm **rules**, **skills**, **commands** dùng chung, cộng một manifest **`backbone.yml`**, giúp Claude Code, Cursor và Codex hiểu project của bạn theo cùng một cách.
+Một bộ kit nhỏ gồm **rules**, **skills**, **commands** dùng chung, cộng một manifest **`backbone.yml`**, giúp Claude Code, Cursor, Codex và Grok hiểu project của bạn theo cùng một cách.
 
 - Không bao giờ ghi đè `CLAUDE.md` / `AGENTS.md` sẵn có — chỉ thêm managed block.
 - Mọi thao tác ghi khi setup đều chờ bạn duyệt.
 - Rà soát bảo mật bề mặt agent (AgentShield) là một phần của workflow bình thường.
-- Xóa an toàn mặc định: `rm` bị deny-list cho Claude Code và Cursor, mọi agent ưu tiên lệnh `trash` (khôi phục được; init sẽ kiểm tra và gợi ý cách cài nếu thiếu).
+- Xóa an toàn mặc định: mọi agent ưu tiên lệnh `trash` (khôi phục được; init sẽ kiểm tra và gợi ý cách cài nếu thiếu), kèm guardrail config đúng chuẩn từng tool — deny rules cho Claude Code (`.claude/settings.json`), CLI permissions cho Cursor (`.cursor/cli.json`), execution-policy rules cho Codex (`.codex/rules/`, experimental, chỉ chạy khi project được trust), và permission rules cấp project cho Grok (`.grok/config.toml`).
 - Init lần đầu hỏi hai tùy chọn — dùng `trash` thay `rm`, và mức giải thích mặc định (0–5, đổi bất cứ lúc nào với `/coding-level N`) — rồi lưu cả hai vào `backbone.yml`.
 
 ## Bắt đầu nhanh
@@ -43,7 +44,7 @@ npx --yes minimal-vibe-coding-kit@latest install /path/to/your-project
 
 Đã chạy `npm i minimal-vibe-coding-kit`, hoặc muốn cài từ GitHub / bản clone? Xem [Cài từ npm](#cài-từ-npm).
 
-**2. Mở project trong Claude Code, Cursor hoặc Codex và dán:**
+**2. Mở project trong Claude Code, Cursor, Codex hoặc Grok và dán:**
 
 ```text
 Read .vibekit/init/FIRST_TIME_INIT.md and initialize this repo with Minimal Vibe Coding Kit.
@@ -83,12 +84,12 @@ npx mvck install .        # bắt buộc — copy kit từ node_modules ra repo
 
 Sau đó, lệnh ngắn `mvck` (alias: `vibe-kit`) dùng được qua `npx`:
 
-| Lệnh ngắn | Chức năng |
-| --- | --- |
-| `npx mvck install .` | Copy kit vào repo (`--profile`, `--dry-run`, `--force`) |
-| `npx mvck update .` | Làm mới file thuộc kit khi có bản phát hành mới |
-| `npx mvck doctor .` | Health check chỉ-đọc |
-| `npx mvck validate .` | Validate cấu trúc |
+| Lệnh ngắn             | Chức năng                                               |
+| --------------------- | ------------------------------------------------------- |
+| `npx mvck install .`  | Copy kit vào repo (`--profile`, `--dry-run`, `--force`) |
+| `npx mvck update .`   | Làm mới file thuộc kit khi có bản phát hành mới         |
+| `npx mvck doctor .`   | Health check chỉ-đọc                                    |
+| `npx mvck validate .` | Validate cấu trúc                                       |
 
 Rồi tiếp tục **bước 2** của Bắt đầu nhanh (dán prompt init).
 
@@ -108,6 +109,7 @@ your-project/
 ├── .cursor/                  ← Cursor: rules, commands, skills
 ├── .agents/                  ← skills cho Codex / portable
 ├── .codex/  .codex-plugin/   ← config mẫu Codex + plugin manifest
+├── .grok/                    ← Grok Build: rules, skills, config mẫu
 └── .vibekit/                 ← mọi thứ thuộc kit, trong MỘT thư mục
     ├── skills/               ← shared skills canonical (mirror sang các harness)
     ├── commands/             ← prompt command dùng chung
@@ -121,7 +123,7 @@ File sẵn có không bao giờ bị thay thế — kit chỉ merge managed bloc
 ## Các mảnh ghép kết nối thế nào
 
 ```text
-Bạn (prompt) ──▶ Claude Code / Cursor / Codex
+Bạn (prompt) ──▶ Claude Code / Cursor / Codex / Grok
                       │  đọc đầu tiên
                       ▼
         backbone.yml  +  AGENTS.md / CLAUDE.md  +  rules
@@ -142,41 +144,43 @@ Bạn (prompt) ──▶ Claude Code / Cursor / Codex
 
 1. **Cứ code bình thường.** Yêu cầu feature/fix như thường lệ; agent theo quy ước trong `backbone.yml` và giữ diff nhỏ.
 2. **Task lớn hoặc mơ hồ?** Bắt đầu với skill `clearthought` hoặc `sequential-thinking` để có kế hoạch trước.
-3. **Câu hỏi toàn repo hoặc review lớn?** Dùng `parallel-analysis` — chia các lane phân tích chỉ-đọc chạy song song rồi xác minh kết quả gộp.
-4. **Đã sửa `.claude/`, skills, hooks, hoặc script installer?** Chạy `/security-scan` trước khi merge.
-5. **Muốn cải tiến đo được?** Chạy `/autoresearch-coding` với metric và budget.
-6. **Giữ setup luôn sắc bén:** `/daily-enhance` đề xuất cải tiến — không bao giờ tự áp dụng.
-7. **Onboarding xong hẳn?** `/vibe-finalize` dọn các file bootstrap một lần.
+3. **Task phức tạp nhưng prompt mù mờ?** `/prompt-sharpener <prompt mù mờ>` cải thiện prompt thành bản rõ ràng rồi thực thi ngay trong cùng lượt.
+4. **Câu hỏi toàn repo hoặc review lớn?** Dùng `parallel-analysis` — chia các lane phân tích chỉ-đọc chạy song song rồi xác minh kết quả gộp.
+5. **Đã sửa `.claude/`, skills, hooks, hoặc script installer?** Chạy `/security-scan` trước khi merge.
+6. **Muốn cải tiến đo được?** Chạy `/autoresearch-coding` với metric và budget.
+7. **Giữ setup luôn sắc bén:** `/daily-enhance` đề xuất cải tiến — không bao giờ tự áp dụng.
+8. **Onboarding xong hẳn?** `/vibe-finalize` dọn các file bootstrap một lần.
 
 ## Commands
 
-| Command | Chức năng | Ví dụ |
-| --- | --- | --- |
-| `/init-vibe` | Init lần đầu hoặc sửa chữa: đề xuất một diff, chờ duyệt. | `/init-vibe` — review diff rồi trả lời `yes`. |
-| `/security-scan` | AgentShield probe chỉ-đọc + scanner tùy chọn cho bề mặt agent. | `/security-scan` trước khi merge thay đổi `.claude/**` hoặc skills. |
-| `/daily-enhance` | Báo cáo chỉ-đề-xuất để cải tiến rules, skills, workflows. | `/daily-enhance` — review diff đề xuất rồi duyệt. |
-| `/autoresearch-coding` | Vòng lặp thử nghiệm theo metric với baseline và budget. | `/autoresearch-coding` Goal: giảm lỗi lint. Budget: 3. |
-| `/council` | Phối hợp các agent reviewer/researcher/analyst thành một kế hoạch gộp. | `/council` trên diff của branch này. |
-| `/vibe-finalize` | Tốt nghiệp project: chuyển file bootstrap một lần vào `_vibekit-cleanup/`. | `/vibe-finalize` — xem trước, áp dụng sau khi duyệt. |
+| Command                | Chức năng                                                                  | Ví dụ                                                               |
+| ---------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------- |
+| `/init-vibe`           | Init lần đầu hoặc sửa chữa: đề xuất một diff, chờ duyệt.                   | `/init-vibe` — review diff rồi trả lời `yes`.                       |
+| `/security-scan`       | AgentShield probe chỉ-đọc + scanner tùy chọn cho bề mặt agent.             | `/security-scan` trước khi merge thay đổi `.claude/**` hoặc skills. |
+| `/daily-enhance`       | Báo cáo chỉ-đề-xuất để cải tiến rules, skills, workflows.                  | `/daily-enhance` — review diff đề xuất rồi duyệt.                   |
+| `/autoresearch-coding` | Vòng lặp thử nghiệm theo metric với baseline và budget.                    | `/autoresearch-coding` Goal: giảm lỗi lint. Budget: 3.              |
+| `/council`             | Phối hợp các agent reviewer/researcher/analyst thành một kế hoạch gộp.     | `/council` trên diff của branch này.                                |
+| `/vibe-finalize`       | Tốt nghiệp project: chuyển file bootstrap một lần vào `_vibekit-cleanup/`. | `/vibe-finalize` — xem trước, áp dụng sau khi duyệt.                |
 
 ## Skills
 
-Cả 12 skill nằm trong `.vibekit/skills/` và được mirror cho từng tool. Gọi bằng tên ("Use the X skill…") hoặc qua các command ở trên.
-
-| Skill | Dùng khi | Prompt ví dụ |
-| --- | --- | --- |
-| `vibekit-init` | Setup lần đầu, hoặc `backbone.yml` / managed blocks cần sửa. | "Use the vibekit-init skill. Propose one diff and wait for my yes." |
-| `parallel-analysis` | Câu hỏi toàn repo, review diff lớn, audit tính nhất quán. | "Use parallel-analysis: where is auth handled and what depends on it?" |
-| `agentshield-security-review` | Audit config agent, skills, hooks, MCP, commands trước khi merge. | "Use agentshield-security-review on .claude/** and .vibekit/skills/**." |
-| `autoresearch-coding` | Cải tiến repo qua các thử nghiệm đo được. | "Use autoresearch-coding. Metric: `npm test`. Direction: higher. Budget: 3." |
-| `daily-workflow-curator` | Tune-up định kỳ cho rules, skills, workflows (chỉ đề xuất). | "Use daily-workflow-curator and propose today's improvements." |
-| `path-sensitive-shell-safety` | Trước khi sửa logic shell/installer/deploy có biến path hoặc `rm`/`mv`/`rsync`. | "Use path-sensitive-shell-safety before changing this cleanup script." |
-| `visual-design-loop` | Polish UI: render → screenshot → review → fix, theo vòng lặp. | "Use visual-design-loop on /dashboard. Budget 3 loops." |
-| `clearthought` | Yêu cầu mơ hồ, tradeoff thiết kế, quyết định rủi ro. | "Use clearthought. Operation: implementation_plan. Split this feature into safe tasks." |
-| `sequential-thinking` | Chia nhỏ công việc phức tạp theo từng bước. | "Use sequential-thinking. Break this refactor into ordered steps with tests." |
-| `reviewing-4p-priorities` | Triage bug/finding theo thứ tự fix P0–P4. | "Use reviewing-4p-priorities. Classify these findings and give a fix sequence." |
-| `memento` | Task nhiều ngày: lưu ngữ cảnh trước khi dừng, resume phiên sau. | "/memento — write MEMENTO.md with Goal, Done, Stuck, Next." |
-| `coding-level` | Chỉnh độ chi tiết khi giải thích (0 = ELI5 … 5 = chuyên gia). | "/coding-level 2" |
+Cả 13 skill nằm trong `.vibekit/skills/` và được mirror cho từng tool. Gọi bằng tên ("Use the X skill…") hoặc qua các command ở trên.
+
+| Skill                         | Dùng khi                                                                              | Prompt ví dụ                                                                            |
+| ----------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
+| `vibekit-init`                | Setup lần đầu, hoặc `backbone.yml` / managed blocks cần sửa.                          | "Use the vibekit-init skill. Propose one diff and wait for my yes."                     |
+| `parallel-analysis`           | Câu hỏi toàn repo, review diff lớn, audit tính nhất quán.                             | "Use parallel-analysis: where is auth handled and what depends on it?"                  |
+| `agentshield-security-review` | Audit config agent, skills, hooks, MCP, commands trước khi merge.                     | "Use agentshield-security-review on .claude/** and .vibekit/skills/**."                 |
+| `autoresearch-coding`         | Cải tiến repo qua các thử nghiệm đo được.                                             | "Use autoresearch-coding. Metric: `npm test`. Direction: higher. Budget: 3."            |
+| `daily-workflow-curator`      | Tune-up định kỳ cho rules, skills, workflows (chỉ đề xuất).                           | "Use daily-workflow-curator and propose today's improvements."                          |
+| `path-sensitive-shell-safety` | Trước khi sửa logic shell/installer/deploy có biến path hoặc `rm`/`mv`/`rsync`.       | "Use path-sensitive-shell-safety before changing this cleanup script."                  |
+| `visual-design-loop`          | Polish UI: render → screenshot → review → fix, theo vòng lặp.                         | "Use visual-design-loop on /dashboard. Budget 3 loops."                                 |
+| `clearthought`                | Yêu cầu mơ hồ, tradeoff thiết kế, quyết định rủi ro.                                  | "Use clearthought. Operation: implementation_plan. Split this feature into safe tasks." |
+| `sequential-thinking`         | Chia nhỏ công việc phức tạp theo từng bước.                                           | "Use sequential-thinking. Break this refactor into ordered steps with tests."           |
+| `reviewing-4p-priorities`     | Triage bug/finding theo thứ tự fix P0–P4.                                             | "Use reviewing-4p-priorities. Classify these findings and give a fix sequence."         |
+| `memento`                     | Task nhiều ngày: lưu ngữ cảnh trước khi dừng, resume phiên sau.                       | "/memento — write MEMENTO.md with Goal, Done, Stuck, Next."                             |
+| `coding-level`                | Chỉnh độ chi tiết khi giải thích (0 = ELI5 … 5 = chuyên gia).                         | "/coding-level 2"                                                                       |
+| `prompt-sharpener`            | Task phức tạp nhưng prompt mù mờ: cải thiện prompt rồi thực thi ngay trong cùng lượt. | "/prompt-sharpener make the settings page load faster"                                  |
 
 ## Nâng cao
 
@@ -188,6 +192,7 @@ Chỉ cài các bề mặt bạn dùng (mặc định là `all`):
 npx --yes minimal-vibe-coding-kit@latest install . --profile claude          # chỉ Claude Code
 npx --yes minimal-vibe-coding-kit@latest install . --profile claude,cursor   # Claude + Cursor
 npx --yes minimal-vibe-coding-kit@latest install . --profile codex           # Codex / agent dùng AGENTS.md
+npx --yes minimal-vibe-coding-kit@latest install . --profile grok            # Grok Build CLI
 ```
 
 Cờ: `--force` (ghi đè file kit sẵn có), `--dry-run` (xem trước), `--json` (kế hoạch dạng máy đọc).
@@ -221,7 +226,7 @@ node .vibekit/scripts/agentshield-probe.mjs .                          # probe c
 npx ecc-agentshield scan --path . --format text --min-severity medium  # scan đầy đủ, tùy chọn
 ```
 
-Mọi thay đổi tới `CLAUDE.md`, `AGENTS.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, hoặc `.vibekit/skills|commands|scripts/**` đều nên kích hoạt review. Mô hình: [.vibekit/docs/SECURITY_MODEL.md](../.vibekit/docs/SECURITY_MODEL.md).
+Mọi thay đổi tới `CLAUDE.md`, `AGENTS.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.grok/**`, `.codex-plugin/**`, hoặc `.vibekit/skills|commands|scripts/**` đều nên kích hoạt review. Mô hình: [.vibekit/docs/SECURITY_MODEL.md](../.vibekit/docs/SECURITY_MODEL.md).
 
 ### Doctor và báo cáo
 
@@ -243,14 +248,14 @@ Checklist publish: [.vibekit/init/PUSH_TO_GITHUB.md](../.vibekit/init/PUSH_TO_GI
 <details>
 <summary><strong>Khắc phục sự cố</strong></summary>
 
-| Triệu chứng | Cách xử lý |
-| --- | --- |
-| Agent bỏ qua luồng init | Chạy lại installer, hoặc copy [.vibekit/init/CLAUDE-template.md](../.vibekit/init/CLAUDE-template.md) thành `CLAUDE.md`. |
-| Agent hỏi init lại mỗi phiên | Chạy init và duyệt; xác nhận `meta.template_status: initialized` trong `backbone.yml`. |
-| Dò sai stack | Xóa lockfile cũ, hoặc sửa `backbone.yml` trực tiếp. |
-| Agent chạm path không nên | Thêm path vào `policy.protected_paths` trong `backbone.yml` (hỗ trợ glob). |
-| AgentShield probe cảnh báo | Cài Python 3, hoặc bỏ qua — là warning, không phải failure. |
-| Thiếu script sau khi cài | Chạy lại install với `--force`, hoặc copy thủ công `.vibekit/scripts/`. |
+| Triệu chứng                  | Cách xử lý                                                                                                               |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| Agent bỏ qua luồng init      | Chạy lại installer, hoặc copy [.vibekit/init/CLAUDE-template.md](../.vibekit/init/CLAUDE-template.md) thành `CLAUDE.md`. |
+| Agent hỏi init lại mỗi phiên | Chạy init và duyệt; xác nhận `meta.template_status: initialized` trong `backbone.yml`.                                   |
+| Dò sai stack                 | Xóa lockfile cũ, hoặc sửa `backbone.yml` trực tiếp.                                                                      |
+| Agent chạm path không nên    | Thêm path vào `policy.protected_paths` trong `backbone.yml` (hỗ trợ glob).                                               |
+| AgentShield probe cảnh báo   | Cài Python 3, hoặc bỏ qua — là warning, không phải failure.                                                              |
+| Thiếu script sau khi cài     | Chạy lại install với `--force`, hoặc copy thủ công `.vibekit/scripts/`.                                                  |
 
 </details>
 
@@ -265,4 +270,4 @@ Issue và PR luôn welcome tại [`giang6283623/minimal-vibe-coding-kit`](https:
 
 MIT. Xem [LICENSE](../LICENSE).
 
-> 🇻🇳 *Nếu bạn yêu Việt Nam và con người Việt Nam, bạn hoàn toàn được dùng miễn phí mọi thứ trong đây.*
+> 🇻🇳 _Nếu bạn yêu Việt Nam và con người Việt Nam, bạn hoàn toàn được dùng miễn phí mọi thứ trong đây._

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "minimal-vibe-coding-kit",
-  "version": "0.4.1",
-  "description": "Project-agnostic AI coding workflow kit for Claude Code, Cursor, and Codex with AgentShield security review.",
+  "version": "0.4.2",
+  "description": "Project-agnostic AI coding workflow kit for Claude Code, Cursor, Codex, and Grok with AgentShield security review.",
   "type": "module",
   "bin": {
     "minimal-vibe-coding-kit": "./bin/mvck.js",
@@ -27,6 +27,7 @@
     "claude-code",
     "cursor",
     "codex",
+    "grok",
     "agents",
     "skills",
     "agentshield"
@@ -56,9 +57,11 @@
     ".claude/skills/memento/",
     ".claude/skills/coding-level/",
     ".claude/skills/parallel-analysis/",
+    ".claude/skills/prompt-sharpener/",
     ".cursor/rules/",
     ".cursor/commands/",
     ".cursor/settings.json",
+    ".cursor/cli.json",
     ".cursor/skills/clearthought/",
     ".cursor/skills/sequential-thinking/",
     ".cursor/skills/reviewing-4p-priorities/",
@@ -66,7 +69,9 @@
     ".cursor/skills/memento/",
     ".cursor/skills/coding-level/",
     ".cursor/skills/parallel-analysis/",
+    ".cursor/skills/prompt-sharpener/",
     ".agents/",
+    ".grok/",
     ".codex/",
     ".codex-plugin/",
     ".vibekit/docs/",