minimal-vibe-coding-kit 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## Unreleased
+
+## 0.5.0 — 2026-07-20
+
+### Added
+
+- Added `/claim <request>` across Claude Code, Cursor, Codex, and Grok. It validates official sources, rejects unsafe or misleading URLs, checks new ideas against `backbone.yml` and existing repository conventions, stops for decisions when approval is required, and integrates only the smallest reviewed change with an evidence ledger.
+- Added `/tutien`, a private, user-invoked xianxia coding-classification game built from Git history and explicitly supplied conversation exports. It provides deterministic vi/en reports, ten cultivation realms, evidence-bound workflow coaching, optional aggregate snapshots, progress comparisons, and opt-in antagonists that challenge workflow patterns rather than the person.
+- Added `/tutien classify` with independent Dao faction, affiliation, and technical-path axes; a cultivation-knowledge taxonomy linked to real kit skills; and seven deterministic, token-independent progression metrics.
+- Added complete Simplified Chinese documentation (`docs/README.zh-CN.md`) alongside English and Vietnamese, with synchronized language navigation and npm package inclusion.
+
+### Changed
+
+- Refined `/tutien` with the cross-model namespace `tutien-coding-cultivation-v1`, calm `serene`/`spirited` narration, plain evidence beneath the lore, and reliable English/Vietnamese stop requests that restore the kit's normal writing style. Legacy `gentle`/`spicy` tone values remain compatible.
+- Centralized skill distribution in `.vibekit/skills/skills-manifest.json`, keeping canonical skills, tool mirrors, installer registries, validator registries, package contents, documentation, and per-profile tests synchronized.
+- Strengthened `/claim` with canonical redirect validation, HTTPS-only remote evidence, private-host and confusable-domain rejection, untrusted-content handling, explicit approval states, separate approval for integration-time execution, and a complete distribution checklist.
+- Strengthened `/tutien` with one fail-closed policy state shared by rendering and persistence, idempotent event progression, boundary-aware path matching, metadata-only classification scope, and explicit authorization handling for legitimate dual-use security work.
+
+### Security and privacy
+
+- `/tutien` remains offline and read-only during analysis. Raw prompts, secrets, author names, email addresses, and commit subjects do not enter reports or snapshots; stored history uses salted digests and aggregate evidence.
+- Ambiguous, unauthorized, or declared-stop classifications suppress scores, realms, villains, recommendations, and positive progression. The game evaluates workflow evidence—not a person's identity, worth, health, or wellbeing—and stays isolated from unrelated support or companion modes.
+- `/claim` treats fetched pages as untrusted data and never runs remote installers, lifecycle scripts, or source-provided commands during research.
+
+### Validation
+
+- Expanded `/tutien` coverage to **133 deterministic, offline checks**, including adversarial privacy, token-integrity, policy-state, replay-idempotency, namespace-isolation, natural stop-request, and end-to-end approval-boundary cases.
+- `pack-dry-run.mjs` now parses `npm pack --dry-run --json` and fails with the exact missing path when an on-disk skill file is absent from the package.
+- Synchronized the release version to `0.5.0` in `package.json`, `.codex-plugin/plugin.json`, and both README badges.
+
+## 0.4.2 — 2026-07-18
+
+- Added a Grok Build (Grok CLI) surface across the kit: `.grok/rules/` (always-on, every `*.md` loaded), `.grok/skills/` (all 13 kit skills, user-invocable as `/<skill-name>`), `.grok/README.md`, and project-scoped `[permission]` deny rules in `.grok/config.toml` mirroring the kit's dangerous-command deny list; `config.example.toml` documents the user-level `~/.grok/config.toml` settings. Added a `grok` install/update profile to `mvck.mjs` (included in `all`) and registered Grok everywhere Claude/Cursor/Codex already were: `validate-kit.mjs`, npm package files, `backbone.yml` `agent_surfaces`, `AGENTS.md`, the AgentShield probe, both READMEs, `INSTALL.md`, `BACKBONE_REFERENCE.md`, `CONTEXT_TEMPLATE.md`, `FIRST_TIME_INIT.md`, and `vibekit-init`.
+- Added `prompt-sharpener` skill (shared + Claude/Cursor/Codex/Grok mirrors), an English rewrite of a collected `sharpen` skill: `/prompt-sharpener <rough prompt>` diagnoses a raw prompt against a defect checklist (vague verbs, mixed tasks, missing success criteria, unbounded scope, missing output format), rebuilds it as a sharper prompt (`Objective` → `Context` → `Work Style` → `Tool Rules` → `Output Contract` → `Verification` → `Done Criteria`), prints it in one code block, then executes it in the same turn.
+- Corrected the dangerous-command guardrails after a cross-tool documentation review. Removed the pipe-spanning `curl *|*sh` / `wget *|*sh` deny rules from `.claude/settings.json` and `.cursor/settings.json` — Claude Code evaluates each piped subcommand independently, so they never matched — in favor of denying bare shell interpreters (`sh`, `bash`, `zsh`, and their `-` stdin forms, which is what `curl ... | sh` actually executes), and fixed the `npx` rules to also cover the common leading `--yes`/`-y` forms.
+- Added each tool's actual documented project-level permission mechanism, since only Claude Code and Cursor's Claude-schema file had one before: `.cursor/cli.json` with `Shell(...)` rules for Cursor CLI (the real mechanism Cursor reads; the Claude-schema `settings.json` is kept only as reference), experimental `.codex/rules/vibekit.rules` execution-policy rules for Codex (`forbidden` decisions with `match`/`not_match` fixtures, active once the project `.codex/` layer is trusted), and the `.grok/config.toml` rules above.
+- `validate-kit` now lints deny lists for pipe-spanning patterns and missing leading `npx --yes`/`-y` coverage, and is profile-aware: per-surface files are required only when that surface is installed (the kit source repo still validates everything), so a `claude`-only or `grok`-only install passes its own validation; `test-install` runs an install+validate cycle for each single profile.
+- `mvck update` treats `.cursor/cli.json` and `.grok/config.toml` as user-owned (seeded once, never overwritten). The AgentShield probe's suspicious-marker scan now skips lines inside permission `deny` arrays, so the kit's own deny rules no longer flag themselves as suspicious; allow/ask blocks are still scanned.
+- Synced version to 0.4.2 in `package.json`, both README badges, and `.codex-plugin/plugin.json`.
+
 ## 0.4.1 — 2026-07-17
 
 - Added a safe-delete guardrail across all three surfaces: new `.claude/rules/safe-delete.md` and `.cursor/rules/040-safe-delete.mdc` (always-on), a `### Safety` bullet in the `AGENTS.md` managed block for Codex, and a trash-first outcome in the `path-sensitive-shell-safety` skill (all mirrors). Agents prefer the recoverable `trash` command over `rm`, check `command -v trash` first, and recommend an install when missing (macOS 14+ built-in; older macOS `brew install trash`; Linux `sudo apt install trash-cli`; any OS with Node `npm i -g trash-cli`). `rm` was already deny-listed for Claude Code and Cursor in the kit settings.

package/README.md

@@ -1,19 +1,20 @@
 <div align="center">
 
-**Read in:** **English** · [Tiếng Việt](docs/README.vi.md)
+**Read in:** **English** · [Tiếng Việt](docs/README.vi.md) · [简体中文](docs/README.zh-CN.md)
 
 # Minimal Vibe Coding Kit
 
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![npm](https://img.shields.io/badge/npm-minimal--vibe--coding--kit-cb3837?logo=npm)](https://www.npmjs.com/package/minimal-vibe-coding-kit)
-[![Version](https://img.shields.io/badge/version-0.4.1-2ea44f.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.5.0-2ea44f.svg)](CHANGELOG.md)
 ![Claude](https://img.shields.io/badge/Claude%20Code-Commands%20%26%20Skills-111111)
 ![Cursor](https://img.shields.io/badge/Cursor-Rules%20%26%20Commands-1f6feb)
 ![Codex](https://img.shields.io/badge/Codex-AGENTS.md%20%26%20Plugin-6f42c1)
+![Grok](https://img.shields.io/badge/Grok-Rules%20%26%20Skills-000000)
 ![AgentShield](https://img.shields.io/badge/Security-AgentShield-d62828)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js&logoColor=white)
 
-**One installable AI-coding workflow kit for Claude Code, Cursor, and Codex — any repo, any language.**
+**One installable AI-coding workflow kit for Claude Code, Cursor, Codex, and Grok — any repo, any language.**
 
 Install → paste one prompt → approve the proposal → code with guardrails.
 
@@ -23,12 +24,12 @@ Install → paste one prompt → approve the proposal → code with guardrails.
 
 ## What is this?
 
-A small kit of shared **rules**, **skills**, and **commands**, plus one **`backbone.yml`** manifest, so Claude Code, Cursor, and Codex all understand your project the same way.
+A small kit of shared **rules**, **skills**, and **commands**, plus one **`backbone.yml`** manifest, so Claude Code, Cursor, Codex, and Grok all understand your project the same way.
 
 - Never overwrites your existing `CLAUDE.md` / `AGENTS.md` — it only adds managed blocks.
 - Every setup write waits for your explicit approval.
 - Security review of agent surfaces (AgentShield) is part of the normal workflow.
-- Safe deletes by default: `rm` is deny-listed for Claude Code and Cursor, and all agents prefer the recoverable `trash` command (init checks it and recommends an install if missing).
+- Safe deletes by default: all agents prefer the recoverable `trash` command (init checks it and recommends an install if missing), backed by each tool's documented guardrail config — Claude Code deny rules (`.claude/settings.json`), Cursor CLI permissions (`.cursor/cli.json`), Codex execution-policy rules (`.codex/rules/`, experimental, active once the project is trusted), and Grok project permission rules (`.grok/config.toml`).
 - First-time init asks two setup preferences — use `trash` instead of `rm`, and your default explanation level (0–5, changeable anytime with `/coding-level N`) — and records both in `backbone.yml`.
 
 ## Quick Start
@@ -43,7 +44,7 @@ npx --yes minimal-vibe-coding-kit@latest install /path/to/your-project
 
 Already ran `npm i minimal-vibe-coding-kit`, or prefer GitHub or a local clone? See [Install from npm](#install-from-npm).
 
-**2. Open the project in Claude Code, Cursor, or Codex and paste:**
+**2. Open the project in Claude Code, Cursor, Codex, or Grok and paste:**
 
 ```text
 Read .vibekit/init/FIRST_TIME_INIT.md and initialize this repo with Minimal Vibe Coding Kit.
@@ -83,12 +84,12 @@ npx mvck install .        # required — copies the kit out of node_modules into
 
 Either way, the short `mvck` command (alias: `vibe-kit`) is then available via `npx`:
 
-| Short command | What it does |
-| --- | --- |
-| `npx mvck install .` | Copy the kit into the repo (`--profile`, `--dry-run`, `--force`) |
-| `npx mvck update .` | Refresh kit-owned files after a new kit release |
-| `npx mvck doctor .` | Read-only health check |
-| `npx mvck validate .` | Structure validation |
+| Short command         | What it does                                                     |
+| --------------------- | ---------------------------------------------------------------- |
+| `npx mvck install .`  | Copy the kit into the repo (`--profile`, `--dry-run`, `--force`) |
+| `npx mvck update .`   | Refresh kit-owned files after a new kit release                  |
+| `npx mvck doctor .`   | Read-only health check                                           |
+| `npx mvck validate .` | Structure validation                                             |
 
 Then continue with **step 2** of the Quick Start (paste the init prompt).
 
@@ -108,6 +109,7 @@ your-project/
 ├── .cursor/                  ← Cursor: rules, commands, skills
 ├── .agents/                  ← Codex / portable skills
 ├── .codex/  .codex-plugin/   ← Codex config example + plugin manifest
+├── .grok/                    ← Grok Build: rules, skills, config example
 └── .vibekit/                 ← everything kit-owned, in ONE folder
     ├── skills/               ← canonical shared skills (mirrored to the harness dirs)
     ├── commands/             ← shared command prompts
@@ -121,7 +123,7 @@ Existing files are never replaced — the kit merges managed blocks (`BEGIN/END:
 ## How the pieces connect
 
 ```text
-You (prompt) ──▶ Claude Code / Cursor / Codex
+You (prompt) ──▶ Claude Code / Cursor / Codex / Grok
                       │  reads first
                       ▼
         backbone.yml  +  AGENTS.md / CLAUDE.md  +  rules
@@ -142,41 +144,47 @@ You (prompt) ──▶ Claude Code / Cursor / Codex
 
 1. **Just code.** Ask for features and fixes normally; the agent follows `backbone.yml` conventions and keeps diffs small.
 2. **Big or vague task?** Start with the `clearthought` or `sequential-thinking` skill to get a plan first.
-3. **Repo-wide question or big review?** Use `parallel-analysis` — it fans out read-only analysis lanes and verifies the merged result.
-4. **Changed `.claude/`, skills, hooks, or installer scripts?** Run `/security-scan` before merging.
-5. **Want measurable improvements?** Run `/autoresearch-coding` with a metric and budget.
-6. **Keep the setup sharp:** `/daily-enhance` proposes improvements — it never applies them silently.
-7. **Onboarding finished for good?** `/vibe-finalize` moves one-time bootstrap files out.
+3. **Complex task but only a rough prompt?** `/prompt-sharpener <rough prompt>` sharpens it into a precise prompt and executes it in the same turn.
+4. **Found a skill, rule, or tool you want to bring in?** `/claim <request + links>` validates the sources against official docs, checks fit with your repo, asks when unclear, then integrates and documents it.
+5. **Want a quiet reset while reviewing progress?** `/tutien` is a private, wholesome xianxia classification game over Git history + supplied AI-chat exports. It uses a refined mystical voice to reflect on realms, token use, and workflow habits without changing the evidence; `/tutien off` restores the kit's normal writing style.
+6. **Repo-wide question or big review?** Use `parallel-analysis` — it fans out read-only analysis lanes and verifies the merged result.
+7. **Changed `.claude/`, skills, hooks, or installer scripts?** Run `/security-scan` before merging.
+8. **Want measurable improvements?** Run `/autoresearch-coding` with a metric and budget.
+9. **Keep the setup sharp:** `/daily-enhance` proposes improvements — it never applies them silently.
+10. **Onboarding finished for good?** `/vibe-finalize` moves one-time bootstrap files out.
 
 ## Commands
 
-| Command | What it does | Example |
-| --- | --- | --- |
-| `/init-vibe` | First-time init or repair: propose one diff, wait for approval. | `/init-vibe` — then review the diff and answer `yes`. |
-| `/security-scan` | Read-only AgentShield probe + optional scanner over agent surfaces. | `/security-scan` before merging changes to `.claude/**` or skills. |
-| `/daily-enhance` | Propose-only report to improve rules, skills, and workflows. | `/daily-enhance` — review the proposed diff, then approve. |
-| `/autoresearch-coding` | Metric-driven experiment loop with baseline and budget. | `/autoresearch-coding` Goal: fewer lint errors. Budget: 3. |
-| `/council` | Coordinates reviewer/researcher/analyst agents into one merged plan. | `/council` on this branch diff. |
-| `/vibe-finalize` | Graduate the project: move one-time bootstrap files to `_vibekit-cleanup/`. | `/vibe-finalize` — preview first, apply after approval. |
+| Command                | What it does                                                                | Example                                                            |
+| ---------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------ |
+| `/init-vibe`           | First-time init or repair: propose one diff, wait for approval.             | `/init-vibe` — then review the diff and answer `yes`.              |
+| `/security-scan`       | Read-only AgentShield probe + optional scanner over agent surfaces.         | `/security-scan` before merging changes to `.claude/**` or skills. |
+| `/daily-enhance`       | Propose-only report to improve rules, skills, and workflows.                | `/daily-enhance` — review the proposed diff, then approve.         |
+| `/autoresearch-coding` | Metric-driven experiment loop with baseline and budget.                     | `/autoresearch-coding` Goal: fewer lint errors. Budget: 3.         |
+| `/council`             | Coordinates reviewer/researcher/analyst agents into one merged plan.        | `/council` on this branch diff.                                    |
+| `/vibe-finalize`       | Graduate the project: move one-time bootstrap files to `_vibekit-cleanup/`. | `/vibe-finalize` — preview first, apply after approval.            |
 
 ## Skills
 
-All 12 skills live in `.vibekit/skills/` and are mirrored for each tool. Invoke them by name ("Use the X skill…") or via the commands above.
-
-| Skill | Use it when | Example prompt |
-| --- | --- | --- |
-| `vibekit-init` | First-time setup, or `backbone.yml` / managed blocks need repair. | "Use the vibekit-init skill. Propose one diff and wait for my yes." |
-| `parallel-analysis` | Repo-wide questions, large diff reviews, consistency audits. | "Use parallel-analysis: where is auth handled and what depends on it?" |
-| `agentshield-security-review` | Auditing agent config, skills, hooks, MCP, commands before merge. | "Use agentshield-security-review on .claude/** and .vibekit/skills/**." |
-| `autoresearch-coding` | Improving the repo through measured experiments. | "Use autoresearch-coding. Metric: `npm test`. Direction: higher. Budget: 3." |
-| `daily-workflow-curator` | Periodic tune-up of rules, skills, and workflows (propose-only). | "Use daily-workflow-curator and propose today's improvements." |
-| `path-sensitive-shell-safety` | Before editing shell/installer/deploy logic with path variables or `rm`/`mv`/`rsync`. | "Use path-sensitive-shell-safety before changing this cleanup script." |
-| `visual-design-loop` | UI polish: render → screenshot → review → fix, in a loop. | "Use visual-design-loop on /dashboard. Budget 3 loops." |
-| `clearthought` | Ambiguous requirements, design tradeoffs, risky decisions. | "Use clearthought. Operation: implementation_plan. Split this feature into safe tasks." |
-| `sequential-thinking` | Step-by-step decomposition of complex work. | "Use sequential-thinking. Break this refactor into ordered steps with tests." |
-| `reviewing-4p-priorities` | Triaging bugs/findings into P0–P4 fix order. | "Use reviewing-4p-priorities. Classify these findings and give a fix sequence." |
-| `memento` | Multi-day tasks: save context before stopping, resume next session. | "/memento — write MEMENTO.md with Goal, Done, Stuck, Next." |
-| `coding-level` | Setting how detailed explanations should be (0 = ELI5 … 5 = expert). | "/coding-level 2" |
+All 15 skills live canonically in `.vibekit/skills/`. Claude, Codex, and Grok mirror all 15; Cursor mirrors the 10 interactive ones. Invoke them by name ("Use the X skill…") or via the commands above.
+
+| Skill                         | Use it when                                                                                                                                                                                                                              | Example prompt                                                                                        |
+| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
+| `vibekit-init`                | First-time setup, or `backbone.yml` / managed blocks need repair.                                                                                                                                                                        | "Use the vibekit-init skill. Propose one diff and wait for my yes."                                   |
+| `parallel-analysis`           | Repo-wide questions, large diff reviews, consistency audits.                                                                                                                                                                             | "Use parallel-analysis: where is auth handled and what depends on it?"                                |
+| `agentshield-security-review` | Auditing agent config, skills, hooks, MCP, commands before merge.                                                                                                                                                                        | "Use agentshield-security-review on .claude/** and .vibekit/skills/**."                               |
+| `autoresearch-coding`         | Improving the repo through measured experiments.                                                                                                                                                                                         | "Use autoresearch-coding. Metric: `npm test`. Direction: higher. Budget: 3."                          |
+| `daily-workflow-curator`      | Periodic tune-up of rules, skills, and workflows (propose-only).                                                                                                                                                                         | "Use daily-workflow-curator and propose today's improvements."                                        |
+| `path-sensitive-shell-safety` | Before editing shell/installer/deploy logic with path variables or `rm`/`mv`/`rsync`.                                                                                                                                                    | "Use path-sensitive-shell-safety before changing this cleanup script."                                |
+| `visual-design-loop`          | UI polish: render → screenshot → review → fix, in a loop.                                                                                                                                                                                | "Use visual-design-loop on /dashboard. Budget 3 loops."                                               |
+| `clearthought`                | Ambiguous requirements, design tradeoffs, risky decisions.                                                                                                                                                                               | "Use clearthought. Operation: implementation_plan. Split this feature into safe tasks."               |
+| `sequential-thinking`         | Step-by-step decomposition of complex work.                                                                                                                                                                                              | "Use sequential-thinking. Break this refactor into ordered steps with tests."                         |
+| `reviewing-4p-priorities`     | Triaging bugs/findings into P0–P4 fix order.                                                                                                                                                                                             | "Use reviewing-4p-priorities. Classify these findings and give a fix sequence."                       |
+| `memento`                     | Multi-day tasks: save context before stopping, resume next session.                                                                                                                                                                      | "/memento — write MEMENTO.md with Goal, Done, Stuck, Next."                                           |
+| `coding-level`                | Setting how detailed explanations should be (0 = ELI5 … 5 = expert).                                                                                                                                                                     | "/coding-level 2"                                                                                     |
+| `prompt-sharpener`            | A complex task but only a rough prompt: sharpen it, then execute it in the same turn.                                                                                                                                                    | "/prompt-sharpener make the settings page load faster"                                                |
+| `claim`                       | Bringing something new into the repo (skill, rule, convention, tool): vet sources against official docs, fit-check, confirm, integrate, document.                                                                                        | "/claim add the conventional-commits rule from https://www.npmjs.com/package/minimal-vibe-coding-kit" |
+| `tutien`                      | A private, stress-relieving xianxia classification game for coding progress: refined mystical prose around exact Git/chat evidence, isolated from unrelated conversational modes. User-invoked; `/tutien off` restores normal kit prose. | "/tutien preview sources=git,/path/to/export.jsonl"                                                   |
 
 ## Advanced
 
@@ -188,6 +196,7 @@ Install only the surfaces you use (default is `all`):
 npx --yes minimal-vibe-coding-kit@latest install . --profile claude          # Claude Code only
 npx --yes minimal-vibe-coding-kit@latest install . --profile claude,cursor   # Claude + Cursor
 npx --yes minimal-vibe-coding-kit@latest install . --profile codex           # Codex / AGENTS.md agents
+npx --yes minimal-vibe-coding-kit@latest install . --profile grok            # Grok Build CLI
 ```
 
 Flags: `--force` (overwrite existing kit files), `--dry-run` (preview), `--json` (machine-readable plan).
@@ -243,14 +252,14 @@ Publishing checklist: [.vibekit/init/PUSH_TO_GITHUB.md](.vibekit/init/PUSH_TO_GI
 <details>
 <summary><strong>Troubleshooting</strong></summary>
 
-| Symptom | Fix |
-| --- | --- |
-| Agent ignores the init flow | Re-run the installer, or copy [.vibekit/init/CLAUDE-template.md](.vibekit/init/CLAUDE-template.md) to `CLAUDE.md`. |
-| Agent re-asks to init every session | Run init and approve; confirm `meta.template_status: initialized` in `backbone.yml`. |
-| Wrong stack detected | Remove stale lockfiles, or edit `backbone.yml` directly. |
-| Agent touches a path it shouldn't | Add the path to `policy.protected_paths` in `backbone.yml` (globs supported). |
-| AgentShield probe warning | Install Python 3, or ignore — it is a warning, not a failure. |
-| Scripts missing after install | Re-run install with `--force`, or copy `.vibekit/scripts/` manually. |
+| Symptom                             | Fix                                                                                                                |
+| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| Agent ignores the init flow         | Re-run the installer, or copy [.vibekit/init/CLAUDE-template.md](.vibekit/init/CLAUDE-template.md) to `CLAUDE.md`. |
+| Agent re-asks to init every session | Run init and approve; confirm `meta.template_status: initialized` in `backbone.yml`.                               |
+| Wrong stack detected                | Remove stale lockfiles, or edit `backbone.yml` directly.                                                           |
+| Agent touches a path it shouldn't   | Add the path to `policy.protected_paths` in `backbone.yml` (globs supported).                                      |
+| AgentShield probe warning           | Install Python 3, or ignore — it is a warning, not a failure.                                                      |
+| Scripts missing after install       | Re-run install with `--force`, or copy `.vibekit/scripts/` manually.                                               |
 
 </details>
 
@@ -265,4 +274,4 @@ Issues and PRs welcome at [`giang6283623/minimal-vibe-coding-kit`](https://githu
 
 MIT. See [LICENSE](LICENSE).
 
-> 🇻🇳 *If you love Vietnam and its people, you are fully free to use everything in here at no cost.*
+> 🇻🇳 _If you love Vietnam and its people, you are fully free to use everything in here at no cost._

package/backbone.yml

@@ -10,7 +10,7 @@ meta:
 
 project:
   name: minimal-vibe-coding-kit
-  description: "Project-agnostic AI coding workflow kit for Claude Code, Cursor, and Codex with AgentShield security review."
+  description: "Project-agnostic AI coding workflow kit for Claude Code, Cursor, Codex, and Grok with AgentShield security review."
   type: single-repo
   primary_language: js
   package_manager: npm
@@ -83,6 +83,7 @@ agent_surfaces:
   cursor: .cursor/
   codex: .agents/
   codex_plugin: .codex-plugin/plugin.json
+  grok: .grok/
   shared_skills: .vibekit/skills/
   shared_commands: .vibekit/commands/
 

package/docs/README.vi.md

@@ -1,19 +1,20 @@
 <div align="center">
 
-**Đọc bằng:** [English](../README.md) · **Tiếng Việt**
+**Đọc bằng:** [English](../README.md) · **Tiếng Việt** · [简体中文](README.zh-CN.md)
 
 # Minimal Vibe Coding Kit
 
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](../LICENSE)
 [![npm](https://img.shields.io/badge/npm-minimal--vibe--coding--kit-cb3837?logo=npm)](https://www.npmjs.com/package/minimal-vibe-coding-kit)
-[![Version](https://img.shields.io/badge/version-0.4.1-2ea44f.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.5.0-2ea44f.svg)](../CHANGELOG.md)
 ![Claude](https://img.shields.io/badge/Claude%20Code-Commands%20%26%20Skills-111111)
 ![Cursor](https://img.shields.io/badge/Cursor-Rules%20%26%20Commands-1f6feb)
 ![Codex](https://img.shields.io/badge/Codex-AGENTS.md%20%26%20Plugin-6f42c1)
+![Grok](https://img.shields.io/badge/Grok-Rules%20%26%20Skills-000000)
 ![AgentShield](https://img.shields.io/badge/Security-AgentShield-d62828)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js&logoColor=white)
 
-**Một bộ kit AI-coding cài một lần cho Claude Code, Cursor và Codex — mọi repo, mọi ngôn ngữ.**
+**Một bộ kit AI-coding cài một lần cho Claude Code, Cursor, Codex và Grok — mọi repo, mọi ngôn ngữ.**
 
 Cài đặt → dán một prompt → duyệt đề xuất → code với guardrails.
 
@@ -23,12 +24,12 @@ Cài đặt → dán một prompt → duyệt đề xuất → code với guardr
 
 ## Bộ kit này là gì?
 
-Một bộ kit nhỏ gồm **rules**, **skills**, **commands** dùng chung, cộng một manifest **`backbone.yml`**, giúp Claude Code, Cursor và Codex hiểu project của bạn theo cùng một cách.
+Một bộ kit nhỏ gồm **rules**, **skills**, **commands** dùng chung, cộng một manifest **`backbone.yml`**, giúp Claude Code, Cursor, Codex và Grok hiểu project của bạn theo cùng một cách.
 
 - Không bao giờ ghi đè `CLAUDE.md` / `AGENTS.md` sẵn có — chỉ thêm managed block.
 - Mọi thao tác ghi khi setup đều chờ bạn duyệt.
 - Rà soát bảo mật bề mặt agent (AgentShield) là một phần của workflow bình thường.
-- Xóa an toàn mặc định: `rm` bị deny-list cho Claude Code và Cursor, mọi agent ưu tiên lệnh `trash` (khôi phục được; init sẽ kiểm tra và gợi ý cách cài nếu thiếu).
+- Xóa an toàn mặc định: mọi agent ưu tiên lệnh `trash` (khôi phục được; init sẽ kiểm tra và gợi ý cách cài nếu thiếu), kèm guardrail config đúng chuẩn từng tool — deny rules cho Claude Code (`.claude/settings.json`), CLI permissions cho Cursor (`.cursor/cli.json`), execution-policy rules cho Codex (`.codex/rules/`, experimental, chỉ chạy khi project được trust), và permission rules cấp project cho Grok (`.grok/config.toml`).
 - Init lần đầu hỏi hai tùy chọn — dùng `trash` thay `rm`, và mức giải thích mặc định (0–5, đổi bất cứ lúc nào với `/coding-level N`) — rồi lưu cả hai vào `backbone.yml`.
 
 ## Bắt đầu nhanh
@@ -43,7 +44,7 @@ npx --yes minimal-vibe-coding-kit@latest install /path/to/your-project
 
 Đã chạy `npm i minimal-vibe-coding-kit`, hoặc muốn cài từ GitHub / bản clone? Xem [Cài từ npm](#cài-từ-npm).
 
-**2. Mở project trong Claude Code, Cursor hoặc Codex và dán:**
+**2. Mở project trong Claude Code, Cursor, Codex hoặc Grok và dán:**
 
 ```text
 Read .vibekit/init/FIRST_TIME_INIT.md and initialize this repo with Minimal Vibe Coding Kit.
@@ -83,12 +84,12 @@ npx mvck install .        # bắt buộc — copy kit từ node_modules ra repo
 
 Sau đó, lệnh ngắn `mvck` (alias: `vibe-kit`) dùng được qua `npx`:
 
-| Lệnh ngắn | Chức năng |
-| --- | --- |
-| `npx mvck install .` | Copy kit vào repo (`--profile`, `--dry-run`, `--force`) |
-| `npx mvck update .` | Làm mới file thuộc kit khi có bản phát hành mới |
-| `npx mvck doctor .` | Health check chỉ-đọc |
-| `npx mvck validate .` | Validate cấu trúc |
+| Lệnh ngắn             | Chức năng                                               |
+| --------------------- | ------------------------------------------------------- |
+| `npx mvck install .`  | Copy kit vào repo (`--profile`, `--dry-run`, `--force`) |
+| `npx mvck update .`   | Làm mới file thuộc kit khi có bản phát hành mới         |
+| `npx mvck doctor .`   | Health check chỉ-đọc                                    |
+| `npx mvck validate .` | Validate cấu trúc                                       |
 
 Rồi tiếp tục **bước 2** của Bắt đầu nhanh (dán prompt init).
 
@@ -108,6 +109,7 @@ your-project/
 ├── .cursor/                  ← Cursor: rules, commands, skills
 ├── .agents/                  ← skills cho Codex / portable
 ├── .codex/  .codex-plugin/   ← config mẫu Codex + plugin manifest
+├── .grok/                    ← Grok Build: rules, skills, config mẫu
 └── .vibekit/                 ← mọi thứ thuộc kit, trong MỘT thư mục
     ├── skills/               ← shared skills canonical (mirror sang các harness)
     ├── commands/             ← prompt command dùng chung
@@ -121,7 +123,7 @@ File sẵn có không bao giờ bị thay thế — kit chỉ merge managed bloc
 ## Các mảnh ghép kết nối thế nào
 
 ```text
-Bạn (prompt) ──▶ Claude Code / Cursor / Codex
+Bạn (prompt) ──▶ Claude Code / Cursor / Codex / Grok
                       │  đọc đầu tiên
                       ▼
         backbone.yml  +  AGENTS.md / CLAUDE.md  +  rules
@@ -142,41 +144,47 @@ Bạn (prompt) ──▶ Claude Code / Cursor / Codex
 
 1. **Cứ code bình thường.** Yêu cầu feature/fix như thường lệ; agent theo quy ước trong `backbone.yml` và giữ diff nhỏ.
 2. **Task lớn hoặc mơ hồ?** Bắt đầu với skill `clearthought` hoặc `sequential-thinking` để có kế hoạch trước.
-3. **Câu hỏi toàn repo hoặc review lớn?** Dùng `parallel-analysis` — chia các lane phân tích chỉ-đọc chạy song song rồi xác minh kết quả gộp.
-4. **Đã sửa `.claude/`, skills, hooks, hoặc script installer?** Chạy `/security-scan` trước khi merge.
-5. **Muốn cải tiến đo được?** Chạy `/autoresearch-coding` với metric và budget.
-6. **Giữ setup luôn sắc bén:** `/daily-enhance` đề xuất cải tiến — không bao giờ tự áp dụng.
-7. **Onboarding xong hẳn?** `/vibe-finalize` dọn các file bootstrap một lần.
+3. **Task phức tạp nhưng prompt mù mờ?** `/prompt-sharpener <prompt mù mờ>` cải thiện prompt thành bản rõ ràng rồi thực thi ngay trong cùng lượt.
+4. **Muốn đưa skill, rule, hoặc tool mới vào repo?** `/claim <yêu cầu + link>` kiểm chứng nguồn với tài liệu chính thức, kiểm tra độ khớp với repo, hỏi lại khi chưa rõ, rồi tích hợp và ghi tài liệu.
+5. **Muốn thả lỏng một chút khi nhìn lại tiến độ?** `/tutien` là trò chơi phân loại tu tiên lành mạnh, riêng tư dựa trên lịch sử Git + file export chat AI. Giọng văn huyền nhã bao quanh số liệu thật về cảnh giới, token và thói quen làm việc; `/tutien off` khôi phục văn phong bình thường của kit.
+6. **Câu hỏi toàn repo hoặc review lớn?** Dùng `parallel-analysis` — chia các lane phân tích chỉ-đọc chạy song song rồi xác minh kết quả gộp.
+7. **Đã sửa `.claude/`, skills, hooks, hoặc script installer?** Chạy `/security-scan` trước khi merge.
+8. **Muốn cải tiến đo được?** Chạy `/autoresearch-coding` với metric và budget.
+9. **Giữ setup luôn sắc bén:** `/daily-enhance` đề xuất cải tiến — không bao giờ tự áp dụng.
+10. **Onboarding xong hẳn?** `/vibe-finalize` dọn các file bootstrap một lần.
 
 ## Commands
 
-| Command | Chức năng | Ví dụ |
-| --- | --- | --- |
-| `/init-vibe` | Init lần đầu hoặc sửa chữa: đề xuất một diff, chờ duyệt. | `/init-vibe` — review diff rồi trả lời `yes`. |
-| `/security-scan` | AgentShield probe chỉ-đọc + scanner tùy chọn cho bề mặt agent. | `/security-scan` trước khi merge thay đổi `.claude/**` hoặc skills. |
-| `/daily-enhance` | Báo cáo chỉ-đề-xuất để cải tiến rules, skills, workflows. | `/daily-enhance` — review diff đề xuất rồi duyệt. |
-| `/autoresearch-coding` | Vòng lặp thử nghiệm theo metric với baseline và budget. | `/autoresearch-coding` Goal: giảm lỗi lint. Budget: 3. |
-| `/council` | Phối hợp các agent reviewer/researcher/analyst thành một kế hoạch gộp. | `/council` trên diff của branch này. |
-| `/vibe-finalize` | Tốt nghiệp project: chuyển file bootstrap một lần vào `_vibekit-cleanup/`. | `/vibe-finalize` — xem trước, áp dụng sau khi duyệt. |
+| Command                | Chức năng                                                                  | Ví dụ                                                               |
+| ---------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------- |
+| `/init-vibe`           | Init lần đầu hoặc sửa chữa: đề xuất một diff, chờ duyệt.                   | `/init-vibe` — review diff rồi trả lời `yes`.                       |
+| `/security-scan`       | AgentShield probe chỉ-đọc + scanner tùy chọn cho bề mặt agent.             | `/security-scan` trước khi merge thay đổi `.claude/**` hoặc skills. |
+| `/daily-enhance`       | Báo cáo chỉ-đề-xuất để cải tiến rules, skills, workflows.                  | `/daily-enhance` — review diff đề xuất rồi duyệt.                   |
+| `/autoresearch-coding` | Vòng lặp thử nghiệm theo metric với baseline và budget.                    | `/autoresearch-coding` Goal: giảm lỗi lint. Budget: 3.              |
+| `/council`             | Phối hợp các agent reviewer/researcher/analyst thành một kế hoạch gộp.     | `/council` trên diff của branch này.                                |
+| `/vibe-finalize`       | Tốt nghiệp project: chuyển file bootstrap một lần vào `_vibekit-cleanup/`. | `/vibe-finalize` — xem trước, áp dụng sau khi duyệt.                |
 
 ## Skills
 
-Cả 12 skill nằm trong `.vibekit/skills/` và được mirror cho từng tool. Gọi bằng tên ("Use the X skill…") hoặc qua các command ở trên.
-
-| Skill | Dùng khi | Prompt ví dụ |
-| --- | --- | --- |
-| `vibekit-init` | Setup lần đầu, hoặc `backbone.yml` / managed blocks cần sửa. | "Use the vibekit-init skill. Propose one diff and wait for my yes." |
-| `parallel-analysis` | Câu hỏi toàn repo, review diff lớn, audit tính nhất quán. | "Use parallel-analysis: where is auth handled and what depends on it?" |
-| `agentshield-security-review` | Audit config agent, skills, hooks, MCP, commands trước khi merge. | "Use agentshield-security-review on .claude/** and .vibekit/skills/**." |
-| `autoresearch-coding` | Cải tiến repo qua các thử nghiệm đo được. | "Use autoresearch-coding. Metric: `npm test`. Direction: higher. Budget: 3." |
-| `daily-workflow-curator` | Tune-up định kỳ cho rules, skills, workflows (chỉ đề xuất). | "Use daily-workflow-curator and propose today's improvements." |
-| `path-sensitive-shell-safety` | Trước khi sửa logic shell/installer/deploy có biến path hoặc `rm`/`mv`/`rsync`. | "Use path-sensitive-shell-safety before changing this cleanup script." |
-| `visual-design-loop` | Polish UI: render → screenshot → review → fix, theo vòng lặp. | "Use visual-design-loop on /dashboard. Budget 3 loops." |
-| `clearthought` | Yêu cầu mơ hồ, tradeoff thiết kế, quyết định rủi ro. | "Use clearthought. Operation: implementation_plan. Split this feature into safe tasks." |
-| `sequential-thinking` | Chia nhỏ công việc phức tạp theo từng bước. | "Use sequential-thinking. Break this refactor into ordered steps with tests." |
-| `reviewing-4p-priorities` | Triage bug/finding theo thứ tự fix P0–P4. | "Use reviewing-4p-priorities. Classify these findings and give a fix sequence." |
-| `memento` | Task nhiều ngày: lưu ngữ cảnh trước khi dừng, resume phiên sau. | "/memento — write MEMENTO.md with Goal, Done, Stuck, Next." |
-| `coding-level` | Chỉnh độ chi tiết khi giải thích (0 = ELI5 … 5 = chuyên gia). | "/coding-level 2" |
+Cả 15 skill nằm canonical trong `.vibekit/skills/`. Claude, Codex và Grok mirror đủ 15; Cursor mirror 10 skill tương tác. Gọi bằng tên ("Use the X skill…") hoặc qua các command ở trên.
+
+| Skill                         | Dùng khi                                                                              | Prompt ví dụ                                                                            |
+| ----------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
+| `vibekit-init`                | Setup lần đầu, hoặc `backbone.yml` / managed blocks cần sửa.                          | "Use the vibekit-init skill. Propose one diff and wait for my yes."                     |
+| `parallel-analysis`           | Câu hỏi toàn repo, review diff lớn, audit tính nhất quán.                             | "Use parallel-analysis: where is auth handled and what depends on it?"                  |
+| `agentshield-security-review` | Audit config agent, skills, hooks, MCP, commands trước khi merge.                     | "Use agentshield-security-review on .claude/** and .vibekit/skills/**."                 |
+| `autoresearch-coding`         | Cải tiến repo qua các thử nghiệm đo được.                                             | "Use autoresearch-coding. Metric: `npm test`. Direction: higher. Budget: 3."            |
+| `daily-workflow-curator`      | Tune-up định kỳ cho rules, skills, workflows (chỉ đề xuất).                           | "Use daily-workflow-curator and propose today's improvements."                          |
+| `path-sensitive-shell-safety` | Trước khi sửa logic shell/installer/deploy có biến path hoặc `rm`/`mv`/`rsync`.       | "Use path-sensitive-shell-safety before changing this cleanup script."                  |
+| `visual-design-loop`          | Polish UI: render → screenshot → review → fix, theo vòng lặp.                         | "Use visual-design-loop on /dashboard. Budget 3 loops."                                 |
+| `clearthought`                | Yêu cầu mơ hồ, tradeoff thiết kế, quyết định rủi ro.                                  | "Use clearthought. Operation: implementation_plan. Split this feature into safe tasks." |
+| `sequential-thinking`         | Chia nhỏ công việc phức tạp theo từng bước.                                           | "Use sequential-thinking. Break this refactor into ordered steps with tests."           |
+| `reviewing-4p-priorities`     | Triage bug/finding theo thứ tự fix P0–P4.                                             | "Use reviewing-4p-priorities. Classify these findings and give a fix sequence."         |
+| `memento`                     | Task nhiều ngày: lưu ngữ cảnh trước khi dừng, resume phiên sau.                       | "/memento — write MEMENTO.md with Goal, Done, Stuck, Next."                             |
+| `coding-level`                | Chỉnh độ chi tiết khi giải thích (0 = ELI5 … 5 = chuyên gia).                         | "/coding-level 2"                                                                       |
+| `prompt-sharpener`            | Task phức tạp nhưng prompt mù mờ: cải thiện prompt rồi thực thi ngay trong cùng lượt. | "/prompt-sharpener make the settings page load faster"                                  |
+| `claim`                       | Đưa thứ mới vào repo (skill, rule, quy ước, tool): kiểm chứng nguồn chính thức, kiểm tra độ khớp, xác nhận, tích hợp, ghi tài liệu. | "/claim add the conventional-commits rule from https://www.conventionalcommits.org"     |
+| `tutien`                      | Trò chơi phân loại tu tiên riêng tư, giúp thư giãn khi nhìn lại tiến độ code; văn phong huyền nhã bao quanh bằng chứng Git/chat chính xác và tách biệt với các chế độ hội thoại khác. User-invoked; `/tutien off` khôi phục văn phong bình thường. | "/tutien preview sources=git,/path/to/export.jsonl"                                     |
 
 ## Nâng cao
 
@@ -188,6 +196,7 @@ Chỉ cài các bề mặt bạn dùng (mặc định là `all`):
 npx --yes minimal-vibe-coding-kit@latest install . --profile claude          # chỉ Claude Code
 npx --yes minimal-vibe-coding-kit@latest install . --profile claude,cursor   # Claude + Cursor
 npx --yes minimal-vibe-coding-kit@latest install . --profile codex           # Codex / agent dùng AGENTS.md
+npx --yes minimal-vibe-coding-kit@latest install . --profile grok            # Grok Build CLI
 ```
 
 Cờ: `--force` (ghi đè file kit sẵn có), `--dry-run` (xem trước), `--json` (kế hoạch dạng máy đọc).
@@ -221,7 +230,7 @@ node .vibekit/scripts/agentshield-probe.mjs .                          # probe c
 npx ecc-agentshield scan --path . --format text --min-severity medium  # scan đầy đủ, tùy chọn
 ```
 
-Mọi thay đổi tới `CLAUDE.md`, `AGENTS.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.codex-plugin/**`, hoặc `.vibekit/skills|commands|scripts/**` đều nên kích hoạt review. Mô hình: [.vibekit/docs/SECURITY_MODEL.md](../.vibekit/docs/SECURITY_MODEL.md).
+Mọi thay đổi tới `CLAUDE.md`, `AGENTS.md`, `.claude/**`, `.cursor/**`, `.agents/**`, `.grok/**`, `.codex-plugin/**`, hoặc `.vibekit/skills|commands|scripts/**` đều nên kích hoạt review. Mô hình: [.vibekit/docs/SECURITY_MODEL.md](../.vibekit/docs/SECURITY_MODEL.md).
 
 ### Doctor và báo cáo
 
@@ -243,14 +252,14 @@ Checklist publish: [.vibekit/init/PUSH_TO_GITHUB.md](../.vibekit/init/PUSH_TO_GI
 <details>
 <summary><strong>Khắc phục sự cố</strong></summary>
 
-| Triệu chứng | Cách xử lý |
-| --- | --- |
-| Agent bỏ qua luồng init | Chạy lại installer, hoặc copy [.vibekit/init/CLAUDE-template.md](../.vibekit/init/CLAUDE-template.md) thành `CLAUDE.md`. |
-| Agent hỏi init lại mỗi phiên | Chạy init và duyệt; xác nhận `meta.template_status: initialized` trong `backbone.yml`. |
-| Dò sai stack | Xóa lockfile cũ, hoặc sửa `backbone.yml` trực tiếp. |
-| Agent chạm path không nên | Thêm path vào `policy.protected_paths` trong `backbone.yml` (hỗ trợ glob). |
-| AgentShield probe cảnh báo | Cài Python 3, hoặc bỏ qua — là warning, không phải failure. |
-| Thiếu script sau khi cài | Chạy lại install với `--force`, hoặc copy thủ công `.vibekit/scripts/`. |
+| Triệu chứng                  | Cách xử lý                                                                                                               |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| Agent bỏ qua luồng init      | Chạy lại installer, hoặc copy [.vibekit/init/CLAUDE-template.md](../.vibekit/init/CLAUDE-template.md) thành `CLAUDE.md`. |
+| Agent hỏi init lại mỗi phiên | Chạy init và duyệt; xác nhận `meta.template_status: initialized` trong `backbone.yml`.                                   |
+| Dò sai stack                 | Xóa lockfile cũ, hoặc sửa `backbone.yml` trực tiếp.                                                                      |
+| Agent chạm path không nên    | Thêm path vào `policy.protected_paths` trong `backbone.yml` (hỗ trợ glob).                                               |
+| AgentShield probe cảnh báo   | Cài Python 3, hoặc bỏ qua — là warning, không phải failure.                                                              |
+| Thiếu script sau khi cài     | Chạy lại install với `--force`, hoặc copy thủ công `.vibekit/scripts/`.                                                  |
 
 </details>
 
@@ -265,4 +274,4 @@ Issue và PR luôn welcome tại [`giang6283623/minimal-vibe-coding-kit`](https:
 
 MIT. Xem [LICENSE](../LICENSE).
 
-> 🇻🇳 *Nếu bạn yêu Việt Nam và con người Việt Nam, bạn hoàn toàn được dùng miễn phí mọi thứ trong đây.*
+> 🇻🇳 _Nếu bạn yêu Việt Nam và con người Việt Nam, bạn hoàn toàn được dùng miễn phí mọi thứ trong đây._