minimal-vibe-coding-kit 0.4.1 → 0.5.0

package/.grok/skills/vibekit-init/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: vibekit-init
+description: Initialize or repair Minimal Vibe Coding Kit in an existing project. Use for first prompt, backbone.yml setup, CLAUDE.md merge, AGENTS.md merge, Cursor rules setup, Codex skill setup, or Grok setup. Always show requirements and a diff before writing.
+disable-model-invocation: true
+argument-hint: target path; profiles claude,cursor,codex,grok; write yes/no
+---
+
+# Vibe Kit Init
+
+Initialize the kit safely.
+
+## Required behavior
+
+1. Print the requirements checklist from `.vibekit/init/FIRST_TIME_INIT.md`.
+2. Run or emulate detection, including repo-specific conventions, project mode, and PRD presence:
+
+```bash
+node .vibekit/scripts/init-backbone.mjs . --propose
+```
+
+3. Run the project-understanding step below.
+4. Propose a unified diff for `backbone.yml`, its `conventions` rules, managed blocks, and any new `.vibekit/docs/PRD.md`.
+5. Ask: `Apply this proposed backbone and convention rules? Reply yes, edit, or abort.`
+6. Write only after explicit `yes`.
+7. Validate after writing.
+
+## Project understanding (PRD)
+
+Detection reports `project.mode` (`greenfield` = no source yet, `brownfield` = existing code) and whether a PRD exists.
+
+- Always offer a short interview, regardless of whether docs already exist: what the project is and who it is for, the core problem and primary focus now, what success looks like, key constraints/non-goals, and (brownfield) which area to improve first.
+- If no PRD is found, propose creating `.vibekit/docs/PRD.md` from `.vibekit/docs/templates/PRD_TEMPLATE.md` using the answers, and set `project.prd` to that path.
+- If a PRD exists, read it, link it in `project.prd`, and offer to refresh it without overwriting unapproved content.
+- Keep the PRD short; it captures intent, not a full spec. Record domain terms in `.vibekit/docs/CONTEXT.md` (scaffold from `.vibekit/docs/templates/CONTEXT_TEMPLATE.md`) and link it in `project.context`.
+
+## Convention detection
+
+- Infer naming, directory layout, architecture, shared resource access, localization/message access, generated definitions, and per-app/package differences from existing files.
+- Prefer existing constants, registries, generated APIs, and helper modules over hardcoded literals when the repo already has them.
+- If no convention is clear, mark it as not detected and ask before introducing a broad new pattern.
+- Store confirmed project rules in `backbone.yml` under `conventions`; later work must follow those rules unless the user edits them.
+
+## Merge policy
+
+- Never overwrite existing `CLAUDE.md` or `AGENTS.md`.
+- Replace only content between Minimal Vibe managed markers.
+- Preserve user content outside managed markers.
+- Keep `CLAUDE.md` and `AGENTS.md` concise.
+
+## Completion
+
+Report initialized status, validation command, validation result, PRD path, and next recommended skill. Once the user confirms setup is complete, offer graduation (`node .vibekit/scripts/vibekit-finalize.mjs . --propose`) to move one-time bootstrap files into the cleanup folder.

package/.grok/skills/visual-design-loop/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: visual-design-loop
+description: Run an iterative visual design improvement loop for UI/product polish tasks. Use when a request involves screenshots, rendering, visual review, frontend polish, layout/typography/color refinement, design QA, or a Claude/Codex loop goal that touches a visible product surface.
+---
+
+# Visual Design Loop
+
+Use this skill to improve a visible UI through controlled render-review-fix loops. Keep the brief and existing project conventions as the source of truth; do not add new product requirements just because a screen could be enhanced.
+
+## Contract
+
+Before editing, resolve and state:
+
+- Goal.
+- Target surface: route, page, component, flow, or supplied screenshot.
+- Source of truth: current brief plus repo instructions, design system, nearby UI, and `backbone.yml` when present.
+- Render method: local URL, app command, Storybook story, preview command, static file, or supplied screenshot.
+- Screenshot method: browser screenshot, Playwright, in-app browser, provided image, or equivalent.
+- Editable paths.
+- Protected paths.
+- Budget: default 3 loops.
+- Timeout: default 10 minutes per loop.
+- Log path: `/tmp/design-{project_slug}.md`.
+
+If render or screenshot capture is missing and cannot be inferred safely, ask for the missing command, URL, or image before editing.
+
+## Baseline
+
+1. Render the target surface.
+2. Capture or inspect the baseline screenshot.
+3. Review visible issues only; do not invent findings.
+4. Create or update `/tmp/design-{project_slug}.md`.
+5. Log the baseline screenshot, visual score, main issues, and any render constraints.
+
+Derive `project_slug` from `backbone.yml` `project.name` when available; otherwise use the repository directory name.
+
+## Visual rubric
+
+Score screenshots from 1 to 5 using:
+
+- Visual hierarchy: primary content and action are obvious.
+- Layout and spacing: alignment, rhythm, density, whitespace.
+- Typography: scale, contrast, readability, consistency.
+- Color and contrast: accessible, intentional, not noisy.
+- Component consistency: matches nearby UI and design system.
+- Responsiveness: works at relevant viewport sizes.
+- Interaction states: hover, focus, disabled, empty, loading, and error states when relevant.
+- Product fit: improves the brief without adding unnecessary features.
+
+## Loop
+
+For each loop:
+
+1. Review the latest screenshot.
+2. Identify the highest-impact visual issue.
+3. Form one small hypothesis.
+4. Apply one targeted fix inside editable paths only.
+5. Render again.
+6. Capture the after screenshot.
+7. Compare before and after.
+8. Keep the change only if quality improves, or if quality is equal with simpler and safer implementation.
+9. Revert only your own loop changes if the result is worse.
+10. Run the repo validation command when code changed.
+11. Append the loop result to `/tmp/design-{project_slug}.md`.
+
+Each loop entry must include:
+
+- Loop number.
+- Screenshot reviewed.
+- Issue found.
+- Hypothesis.
+- Fix applied.
+- Before/after judgment.
+- Rubric score before.
+- Rubric score after.
+- Validation result.
+- Remaining concerns.
+- Stop/continue decision.
+
+## Stop criteria
+
+Stop when:
+
+- The design is polished enough for the brief.
+- The latest loop gives no meaningful improvement.
+- Further changes would be subjective or overworked.
+- Budget is reached.
+- Validation fails for a non-trivial reason.
+- A product or design decision is required from the user.
+- Render or screenshot tooling is unavailable.
+
+## Final report
+
+Report:
+
+- Baseline score.
+- Final score.
+- Screenshots reviewed.
+- Changes kept.
+- Changes discarded, if any.
+- Validation result.
+- Remaining risks or design decisions.
+- Log path.

package/.grok/skills/visual-design-loop/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Visual Design Loop"
+  short_description: "Iterative screenshot-based UI polish loop"
+  default_prompt: "Use $visual-design-loop to render, screenshot, review, and improve this UI until it is polished but not overworked."

package/.vibekit/docs/BACKBONE_REFERENCE.md

@@ -10,7 +10,7 @@
 - `conventions`: user-reviewed project rules inferred from existing code.
 - `commands`: install, test, lint, typecheck, build, validate.
 - `policy`: branch, commit, editable paths, protected paths.
-- `agent_surfaces`: Claude, Cursor, Codex, shared skills, shared commands.
+- `agent_surfaces`: Claude, Cursor, Codex, Grok, shared skills, shared commands.
 - `automation`: autoresearch, daily enhance, finalize (graduation cleanup), security.
 
 ## Init status
@@ -40,6 +40,8 @@ If no command is known, leave `validate` as a safe echo and ask the user to fill
 
 The `conventions` section is created during first-time init and must be reviewed before writing. It should capture repo-specific rules with evidence, not a fixed framework template.
 
+`conventions.review_required_before_write: true` means: before writing to agent surfaces or instruction files — rules, skills, workflows, commands, root instruction files, and `backbone.yml` itself — the agent must show the proposed diff and wait for explicit approval. It does not gate ordinary code edits inside `policy.editable_paths`. Skills that offer a "clean, proceed in the same turn" path (for example `claim`) must downgrade to propose-and-wait for writes this flag covers.
+
 Include:
 
 - Naming style for files, directories, and symbols.

package/.vibekit/docs/INSTALL.md

@@ -26,9 +26,10 @@ node .vibekit/scripts/mvck.mjs install /path/to/project --profile all
 
 Profiles:
 
-- `claude`: `CLAUDE.md`, `.claude/`, Claude skills, agents, commands, rules.
-- `cursor`: `.cursor/rules`, `.cursor/commands`, Cursor skill entrypoints.
-- `codex`: `AGENTS.md`, `.agents/skills`, `.codex-plugin`, `.codex` examples.
+- `claude`: `CLAUDE.md`, `.claude/`, Claude skills, agents, commands, rules, deny-list settings.
+- `cursor`: `.cursor/rules`, `.cursor/commands`, `.cursor/cli.json` CLI permissions, Cursor skill entrypoints.
+- `codex`: `AGENTS.md`, `.agents/skills`, `.codex/rules` execution-policy rules, `.codex-plugin`, `.codex` examples.
+- `grok`: `AGENTS.md`, `.grok/rules`, `.grok/skills`, `.grok/config.toml` permission rules, user config example.
 - `all`: every profile.
 
 ## Safe behavior
@@ -59,7 +60,7 @@ node /path/to/kit/.vibekit/scripts/mvck.mjs update /path/to/project
 
 The updater:
 
-- refreshes kit-owned surfaces (`.vibekit/skills/`, `.vibekit/commands/`, `.vibekit/scripts/`, `.vibekit/docs/`, and the `.claude/`, `.cursor/`, `.agents/`, `.codex*` mirrors) and adds any new kit skills;
+- refreshes kit-owned surfaces (`.vibekit/skills/`, `.vibekit/commands/`, `.vibekit/scripts/`, `.vibekit/docs/`, and the `.claude/`, `.cursor/`, `.agents/`, `.grok/`, `.codex*` mirrors) and adds any new kit skills;
 - never overwrites `backbone.yml`, `CLAUDE.md`, `AGENTS.md` content outside the managed block, or `settings.json` files — those are seeded only if missing;
 - backs up every replaced kit file to `.vibekit/update-backup/<timestamp>/` (disable with `--no-backup`);
 - never deletes files you added, and skips re-seeding one-time files after `mvck finalize`;
@@ -114,7 +115,7 @@ node .vibekit/scripts/mvck.mjs doctor . --write-report
 
 ## Native reasoning skills
 
-The installer includes three flexible custom reasoning skills across Claude, Codex, and Cursor. These install as full skill folders, including examples and references for progressive disclosure:
+The installer includes three flexible custom reasoning skills across Claude, Codex, Cursor, and Grok. These install as full skill folders, including examples and references for progressive disclosure:
 
 - `clearthought`: clarify ambiguous tasks and choose a reasoning mode.
 - `sequential-thinking`: split complex work into ordered implementation steps.
@@ -122,11 +123,14 @@ The installer includes three flexible custom reasoning skills across Claude, Cod
 
 ## Visual design loop skill
 
-The installer also includes `visual-design-loop` for Claude and Codex surfaces. Use it when a loop goal touches UI polish, screenshots, rendering, visual QA, or visible frontend behavior.
+The installer also includes `visual-design-loop` for Claude, Codex, and Grok surfaces. Use it when a loop goal touches UI polish, screenshots, rendering, visual QA, or visible frontend behavior.
 
 ## User-invoked utility skills
 
-Two user-invoked skills install across Claude, Codex, and Cursor surfaces:
+Five user-invoked skills install across Claude, Codex, Cursor, and Grok surfaces:
 
 - `memento`: write a `MEMENTO.md` working note before closing a multi-day task (`/memento`), then resume from it in the next session (`/memento resume`).
 - `coding-level`: set the explanation register from 0 (ELI5) to 5 (expert peer) with `/coding-level N`; stays active until reinvoked.
+- `prompt-sharpener`: sharpen a rough prompt into a precise one with `/prompt-sharpener <rough prompt>`, then execute the sharpened version immediately in the same turn.
+- `claim`: vet a request to bring something new into the repo with `/claim <request>` — validate URLs and references against official sources, check fit with existing rules and skills, confirm anything unclear, then integrate and document it.
+- `tutien`: turn Git history and explicitly supplied AI-chat exports into a private, funny xianxia "cultivation" report with `/tutien` (realm, token use, workflow habits, evidence-bound suggestions); read-only, aggregate-only by default, and `/tutien off` disables the mode.

package/.vibekit/docs/SECURITY_MODEL.md

@@ -5,7 +5,7 @@
 Review these before merging changes:
 
 - `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`
-- `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`
+- `.claude/**`, `.cursor/**`, `.agents/**`, `.grok/**`, `.codex-plugin/**`
 - `.vibekit/skills/**`, `.vibekit/commands/**`, `.vibekit/scripts/**`, `hooks/**`
 - `.mcp.json`, `mcp.json`, `mcp-configs/**`
 - installer scripts and CI workflows

package/.vibekit/docs/TOOLING_GUIDE.md

@@ -12,11 +12,16 @@ Use `.cursor/rules/*.mdc`. The kit creates always-on core rules plus scoped rule
 
 Use `AGENTS.md` for repo instructions and `.agents/skills/*/SKILL.md` for skills. The kit also includes `.codex-plugin/plugin.json` so the shared skills can be packaged as a plugin.
 
+## Grok
+
+Grok Build reads `AGENTS.md` natively plus every `*.md` rule in `.grok/rules/`, and repository skills from `.grok/skills/*/SKILL.md` (user-invocable skills appear as `/<skill-name>` slash commands). Permission deny rules are user-level only: see `.grok/config.example.toml` for the `~/.grok/config.toml` setup.
+
 ## Shared skill strategy
 
 Canonical skill bodies live in `.vibekit/skills/<skill-name>/`. Harness-specific folders contain small shims:
 
 - `.claude/skills/<skill-name>/SKILL.md`
 - `.agents/skills/<skill-name>/SKILL.md`
+- `.grok/skills/<skill-name>/SKILL.md`
 
 This reduces drift while still giving each tool the path it expects.

package/.vibekit/docs/templates/CONTEXT_TEMPLATE.md

@@ -1,7 +1,7 @@
 # Project context
 
 > Scaffolded by Minimal Vibe Coding Kit. A short, shared glossary and map so any
-> agent (Claude, Cursor, Codex) navigates this project with less back-and-forth.
+> agent (Claude, Cursor, Codex, Grok) navigates this project with less back-and-forth.
 > Keep it current and terse — definitions, not prose.
 
 ## Domain glossary

package/.vibekit/init/CLAUDE-template.md

@@ -17,6 +17,9 @@ This file is intentionally small. Shared rules live in `AGENTS.md`, project fact
 - `/security-scan` - run AgentShield-style review.
 - `/daily-enhance` - propose rule, skill, and workflow improvements.
 - `/coding-level N` - set explanation depth 0-5; the project default lives in `backbone.yml` `conventions.custom_rules`.
+- `/prompt-sharpener <rough prompt>` - sharpen a rough prompt into a precise one, then execute it in the same turn.
+- `/claim <request>` - vet a request to bring something new into the repo (validate sources, fit-check, confirm, integrate, document).
+- `/tutien` - private, funny xianxia "cultivation" progress report from Git history + supplied AI-chat exports; `/tutien off` disables it.
 
 ## Hard rules
 

package/.vibekit/init/FIRST_PROMPT.md

@@ -36,7 +36,7 @@ Use the autoresearch-coding skill.
 Goal: improve this Minimal Vibe Coding Kit for existing projects in any language.
 Metric command: node .vibekit/scripts/validate-kit.mjs .
 Direction: higher.
-Editable paths: README.md .vibekit/docs .vibekit/scripts skills .vibekit/commands .claude .cursor .agents .codex-plugin .github backbone.yml AGENTS.md .vibekit/init/CLAUDE-template.md .vibekit/init/FIRST_TIME_INIT.md package.json install.sh install.ps1.
+Editable paths: README.md .vibekit/docs .vibekit/scripts skills .vibekit/commands .claude .cursor .agents .grok .codex-plugin .github backbone.yml AGENTS.md .vibekit/init/CLAUDE-template.md .vibekit/init/FIRST_TIME_INIT.md package.json install.sh install.ps1.
 Protected paths: .git .env* node_modules vendor secrets lockfiles.
 Budget: 3.
 ```

package/.vibekit/init/FIRST_TIME_INIT.md

@@ -1,6 +1,6 @@
 # .vibekit/init/FIRST_TIME_INIT.md - bootstrap runbook
 
-Audience: Claude, Cursor, Codex, or any AI coding agent in a repo that just received Minimal Vibe Coding Kit.
+Audience: Claude, Cursor, Codex, Grok, or any AI coding agent in a repo that just received Minimal Vibe Coding Kit.
 
 Keep this flow short. Detailed schema notes live in `.vibekit/docs/BACKBONE_REFERENCE.md`.
 
@@ -11,7 +11,7 @@ Before writing anything, print this checklist and mark each item as found, missi
 1. `backbone.yml` exists.
 2. `AGENTS.md` exists or will be created/merged.
 3. `CLAUDE.md` exists or will be created from `.vibekit/init/CLAUDE-template.md` when Claude support is installed.
-4. At least one harness folder exists: `.claude/`, `.cursor/`, `.agents/`, or `.codex-plugin/`.
+4. At least one harness folder exists: `.claude/`, `.cursor/`, `.agents/`, `.grok/`, or `.codex-plugin/`.
 5. Git status is known. If user changes exist, do not overwrite them.
 6. A validation command is inferred or set to `node .vibekit/scripts/validate-kit.mjs .` for the kit itself.
 7. Protected paths include `.env*`, secrets, lockfiles, generated files, build output, migrations, and infra unless the user says otherwise.

package/.vibekit/scripts/doctor.mjs

@@ -170,7 +170,8 @@ const surfaces = {
   agents: exists('AGENTS.md'),
   claude: exists('CLAUDE.md') || exists('.vibekit/init/CLAUDE-template.md') || exists('.claude'),
   cursor: exists('.cursor/rules'),
-  codex: exists('.agents') || exists('.codex-plugin/plugin.json')
+  codex: exists('.agents') || exists('.codex-plugin/plugin.json'),
+  grok: exists('.grok')
 };
 const managedBlocks = {
   AGENTS: countManaged('AGENTS.md'),
@@ -190,7 +191,8 @@ const nativeSkillSurfaces = {
   shared: '.vibekit/skills',
   claude: '.claude/skills',
   codex: '.agents/skills',
-  cursor: '.cursor/skills'
+  cursor: '.cursor/skills',
+  grok: '.grok/skills'
 };
 const missingNativeSkills = [];
 for (const [surface, dir] of Object.entries(nativeSkillSurfaces)) {
@@ -257,7 +259,9 @@ const report = {
     claudeSkills: listFiles('.claude/skills').filter((f) => f.endsWith('SKILL.md')).length,
     codexSkills: listFiles('.agents/skills').filter((f) => f.endsWith('SKILL.md')).length,
     cursorSkills: listFiles('.cursor/skills').filter((f) => f.endsWith('SKILL.md')).length,
-    cursorRules: listFiles('.cursor/rules').filter((f) => f.endsWith('.mdc')).length
+    cursorRules: listFiles('.cursor/rules').filter((f) => f.endsWith('.mdc')).length,
+    grokSkills: listFiles('.grok/skills').filter((f) => f.endsWith('SKILL.md')).length,
+    grokRules: listFiles('.grok/rules').filter((f) => f.endsWith('.md')).length
   },
   recommendedFirstPrompt: 'Read AGENTS.md and backbone.yml, run mvck doctor ., then propose a small safe plan before editing.',
   knownRisks: risks
@@ -308,15 +312,18 @@ ${(data.protectedPaths.length ? data.protectedPaths : ['not declared']).map((ite
 - Claude surface: ${data.agentSurfaces.claude ? 'yes' : 'no'}
 - Cursor surface: ${data.agentSurfaces.cursor ? 'yes' : 'no'}
 - Codex surface: ${data.agentSurfaces.codex ? 'yes' : 'no'}
+- Grok surface: ${data.agentSurfaces.grok ? 'yes' : 'no'}
 - Shared skills: ${data.aiRulesLoaded.sharedSkills}
 - Claude skills: ${data.aiRulesLoaded.claudeSkills}
 - Codex skills: ${data.aiRulesLoaded.codexSkills}
 - Cursor skills: ${data.aiRulesLoaded.cursorSkills}
 - Cursor rules: ${data.aiRulesLoaded.cursorRules}
+- Grok skills: ${data.aiRulesLoaded.grokSkills}
+- Grok rules: ${data.aiRulesLoaded.grokRules}
 
 ## Native reasoning skills
 
-${data.nativeReasoningSkills.names.map((skill) => `- ${skill}: ${data.nativeReasoningSkills.missing.some((item) => item.endsWith(`:${skill}`)) ? 'missing on one or more surfaces' : 'available on shared, Claude, Codex, and Cursor'}`).join('\n')}
+${data.nativeReasoningSkills.names.map((skill) => `- ${skill}: ${data.nativeReasoningSkills.missing.some((item) => item.endsWith(`:${skill}`)) ? 'missing on one or more surfaces' : 'available on shared, Claude, Codex, Cursor, and Grok'}`).join('\n')}
 
 ## Recommended first prompt
 

package/.vibekit/scripts/mvck.mjs

@@ -13,8 +13,8 @@ function usage() {
   console.log(`Minimal Vibe Coding Kit
 
 Usage:
-  mvck install [target] [--profile all|claude,cursor,codex] [--force] [--dry-run] [--json]
-  mvck update [target] [--profile all|claude,cursor,codex] [--dry-run] [--json] [--no-backup]
+  mvck install [target] [--profile all|claude,cursor,codex,grok] [--force] [--dry-run] [--json]
+  mvck update [target] [--profile all|claude,cursor,codex,grok] [--dry-run] [--json] [--no-backup]
   mvck init [target] [--propose|--write --yes] [--preset nextjs|wordpress|python|laravel|docker]
   mvck validate [target]
   mvck doctor [target] [--write-report] [--json]
@@ -158,23 +158,24 @@ const KIT_SCRIPTS = [
   '.vibekit/scripts/mvck.mjs', '.vibekit/scripts/init-backbone.mjs', '.vibekit/scripts/daily-enhance.mjs', '.vibekit/scripts/validate-kit.mjs',
   '.vibekit/scripts/doctor.mjs', '.vibekit/scripts/agentshield-probe.mjs', '.vibekit/scripts/vibekit-finalize.mjs'
 ];
-const VALID_PROFILES = new Set(['claude', 'cursor', 'codex']);
+const VALID_PROFILES = new Set(['claude', 'cursor', 'codex', 'grok']);
 
 function parseProfiles(profileRaw) {
-  const profiles = new Set(profileRaw === 'all' ? ['claude', 'cursor', 'codex'] : profileRaw.split(',').map((x) => x.trim()).filter(Boolean));
+  const profiles = new Set(profileRaw === 'all' ? ['claude', 'cursor', 'codex', 'grok'] : profileRaw.split(',').map((x) => x.trim()).filter(Boolean));
   for (const p of profiles) {
-    if (!VALID_PROFILES.has(p)) throw new Error(`Unknown profile: ${p}. Valid values: all, claude, cursor, codex (comma-separated).`);
+    if (!VALID_PROFILES.has(p)) throw new Error(`Unknown profile: ${p}. Valid values: all, claude, cursor, codex, grok (comma-separated).`);
   }
   return profiles;
 }
 const CLAUDE_DIRS = ['.claude/agents', '.claude/commands', '.claude/rules'];
-const CLAUDE_SKILLS = [
-  'autoresearch-coding', 'agentshield-security-review', 'daily-workflow-curator', 'vibekit-init', 'visual-design-loop',
-  'clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis'
-];
+// Skill registries come from the central distribution manifest so the
+// installer and the validator cannot drift apart.
+const skillsManifest = JSON.parse(fs.readFileSync(path.join(kitRoot, '.vibekit/skills/skills-manifest.json'), 'utf8'));
+const CLAUDE_SKILLS = skillsManifest.skills.map((s) => s.name);
 const CURSOR_DIRS = ['.cursor/rules', '.cursor/commands'];
-const CURSOR_SKILLS = ['clearthought', 'sequential-thinking', 'reviewing-4p-priorities', 'path-sensitive-shell-safety', 'memento', 'coding-level', 'parallel-analysis'];
+const CURSOR_SKILLS = skillsManifest.skills.filter((s) => (s.surfaces || []).includes('cursor')).map((s) => s.name);
 const CODEX_DIRS = ['.agents', '.codex', '.codex-plugin'];
+const GROK_DIRS = ['.grok'];
 const GITIGNORE_BLOCK = `# BEGIN: minimal-vibe-coding-kit\n.autoresearch/\nresults.tsv\n.vibekit/INIT_DONE\n.vibekit/FINALIZE_DONE\n.vibekit/reports/\n.vibekit/update-backup/\n_vibekit-cleanup/\nCLAUDE.local.md\n# END: minimal-vibe-coding-kit`;
 
 function kitVersion() {
@@ -258,12 +259,18 @@ function install() {
       actions.push(copyDirSafe(`.cursor/skills/${skill}`, `.cursor/skills/${skill}`, target, opts));
     }
     actions.push(copyFileSafe('.cursor/settings.json', '.cursor/settings.json', target, opts));
+    actions.push(copyFileSafe('.cursor/cli.json', '.cursor/cli.json', target, opts));
   }
   if (profiles.has('codex')) {
     for (const dir of CODEX_DIRS) {
       actions.push(copyDirSafe(dir, dir, target, opts));
     }
   }
+  if (profiles.has('grok')) {
+    for (const dir of GROK_DIRS) {
+      actions.push(copyDirSafe(dir, dir, target, opts));
+    }
+  }
 
   applyManagedBlocks(target, profiles, actions, { dryRun });
   writeKitVersion(target, dryRun);
@@ -398,13 +405,21 @@ function update() {
   if (profiles.has('codex')) {
     for (const dir of CODEX_DIRS) actions.push(...updateDirSafe(dir, target, opts));
   }
+  if (profiles.has('grok')) {
+    // .grok/config.toml holds user-editable permission rules; seed it below instead of overwriting.
+    for (const dir of GROK_DIRS) actions.push(...updateDirSafe(dir, target, dir === '.grok' ? { ...opts, exclude: ['config.toml'] } : opts));
+  }
 
   // User-owned files: seed only when missing, never overwrite. Finalized
   // projects removed the one-time files on purpose, so skip re-seeding them.
   const seedFiles = finalized ? ['backbone.yml'] : KIT_SEED_FILES;
   for (const file of seedFiles) actions.push(copyFileSafe(file, file, target, { force: false, dryRun }));
   if (profiles.has('claude')) actions.push(copyFileSafe('.claude/settings.json', '.claude/settings.json', target, { force: false, dryRun }));
-  if (profiles.has('cursor')) actions.push(copyFileSafe('.cursor/settings.json', '.cursor/settings.json', target, { force: false, dryRun }));
+  if (profiles.has('cursor')) {
+    actions.push(copyFileSafe('.cursor/settings.json', '.cursor/settings.json', target, { force: false, dryRun }));
+    actions.push(copyFileSafe('.cursor/cli.json', '.cursor/cli.json', target, { force: false, dryRun }));
+  }
+  if (profiles.has('grok')) actions.push(copyFileSafe('.grok/config.toml', '.grok/config.toml', target, { force: false, dryRun }));
 
   applyManagedBlocks(target, profiles, actions, { dryRun });
   writeKitVersion(target, dryRun);
@@ -412,7 +427,7 @@ function update() {
   const summary = { add: 0, update: 0, unchanged: 0, skip: 0, 'managed-block': 0 };
   for (const a of actions) summary[a.action] = (summary[a.action] || 0) + 1;
   const backupInfo = backup && backup.count > 0 ? path.relative(target, backup.dir) : null;
-  const preserved = ['backbone.yml', 'CLAUDE.md', 'AGENTS.md content outside the managed block', '.claude/settings.json', '.cursor/settings.json'];
+  const preserved = ['backbone.yml', 'CLAUDE.md', 'AGENTS.md content outside the managed block', '.claude/settings.json', '.cursor/settings.json', '.cursor/cli.json', '.grok/config.toml'];
 
   const legacyPaths = detectLegacyLayout(target);
   if (json) {

package/.vibekit/scripts/pack-dry-run.mjs

@@ -1,16 +1,51 @@
 #!/usr/bin/env node
+import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 
 const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 const cache = process.env.MVCK_NPM_CACHE || path.join(os.tmpdir(), 'mvck-npm-cache');
-const result = spawnSync(npm, ['pack', '--dry-run'], {
-  stdio: 'inherit',
+const result = spawnSync(npm, ['pack', '--dry-run', '--json'], {
+  encoding: 'utf8',
   env: {
     ...process.env,
     npm_config_cache: cache
   }
 });
 
-process.exit(result.status ?? 1);
+if (result.status !== 0) {
+  process.stderr.write(result.stderr || '');
+  process.exit(result.status ?? 1);
+}
+
+let packed;
+try {
+  packed = new Set(JSON.parse(result.stdout)[0].files.map((file) => file.path));
+} catch (err) {
+  console.error(`FAIL could not parse npm pack --dry-run --json output: ${err.message}`);
+  process.exit(1);
+}
+
+// Every skill file present on disk must ship in the tarball. A skill directory
+// added without its package.json `files` entry fails here with the missing path.
+const skillRoots = ['.vibekit/skills', '.claude/skills', '.cursor/skills', '.agents/skills', '.grok/skills'];
+const expected = [];
+function walk(dir) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const rel = path.posix.join(dir, entry.name);
+    if (entry.isDirectory()) walk(rel);
+    else expected.push(rel);
+  }
+}
+for (const root of skillRoots) {
+  if (fs.existsSync(root)) walk(root);
+}
+
+const missing = expected.filter((rel) => !packed.has(rel));
+for (const rel of missing) console.error(`FAIL packaged tarball is missing ${rel}`);
+if (missing.length > 0) {
+  console.error(`Pack dry-run: ${missing.length} of ${expected.length} on-disk skill files are not packaged.`);
+  process.exit(1);
+}
+console.log(`PASS pack dry-run: all ${expected.length} on-disk skill files are packaged (${packed.size} files in tarball)`);

package/.vibekit/scripts/test-install.mjs

@@ -120,6 +120,14 @@ try {
   const updParsed = JSON.parse(updPlan.stdout);
   assert(updParsed.status === 'dry-run' && typeof updParsed.toVersion === 'string', 'update --dry-run --json returns machine-readable plan');
 
+  // Single-profile installs must pass validation on their own.
+  for (const profile of ['claude', 'cursor', 'codex', 'grok']) {
+    const solo = tempDir(`profile-${profile}`);
+    run(['.vibekit/scripts/mvck.mjs', 'install', solo, '--profile', profile]);
+    run(['.vibekit/scripts/validate-kit.mjs', solo]);
+    assert(true, `${profile}-only install passes validation`);
+  }
+
   console.log('\nInstall behavior tests passed.');
 } finally {
   if (!keep) {