claude-code-kit 0.26.0__tar.gz → 0.26.1__tar.gz

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.26.0",
+      "version": "0.26.1",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.26.1] — 2026-06-24
+
+**A second strict practical review (installed and exercised end-to-end) surfaced seven papercuts on
+top of 0.26.0 — all bug fixes and polish, no behavior change for existing configs.**
+
+### Changed
+- **The destructive-delete guard is no longer order-dependent.** The previous regex only matched
+  `r…f` order, so `rm -fr`, `rm -r -f`, `rm -Rf`, and `rm --recursive --force` slipped through. It now
+  blocks any invocation that combines a recursive flag **and** a force flag in any order or spelling
+  (incl. `-R` and long flags); the plugin `hooks.json` and starter `settings.json` were regenerated
+  from the registry. New functional tests fire JSON payloads through the guard to lock the behavior in.
+- **CI lints shipped skill Python** (`ruff check … skills`), so future skill scripts are covered;
+  `zap_vapt.py` import ordering was fixed to match.
+
+### Fixed
+- **Upgrade artifacts are now gitignored.** `claude-kit upgrade` writes `.claude-kit.bak-*/` backup
+  dirs and `*.claude-kit` sidecars; a scaffolded `.gitignore` now lists both so `git add -A` never
+  commits a backup.
+- **Frontmatter hygiene, swept across every component.** Two skill descriptions over the 1024-char cap
+  (`design-patterns-and-conventions`, `shannon-ai-pentest`) were trimmed; `security-reviewer` and two
+  `templates/org` skills (`prompt-to-safe-task`, `repo-onboarding`) had unquoted `: ` scalars that
+  fail strict YAML and are now quoted; `smoke-test`'s `argument-hint` is a valid YAML string. A new
+  `tests/test_frontmatter.py` parses every shipped agent/command/skill under strict YAML and enforces
+  the description cap, so these regress loudly.
+
 ## [0.26.0] — 2026-06-24
 
 **Post-hardening follow-up: two correctness/security fixes plus polish, all from a verified review

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.26.0
+Version: 0.26.1
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/agents/security-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: security-reviewer
-description: Security stage coordinator. Runs at Phase 5.4 (after test-coverage VERIFIED, before DevOps). Dispatches four sub-scanners in parallel — secret-scanner, dependency-scanner, owasp-reviewer, policy-validator — aggregates findings by severity, and owns the Security Clear gate. Read-only: routes fixes through the Orchestrator's defect loop.
+description: "Security stage coordinator. Runs at Phase 5.4 (after test-coverage VERIFIED, before DevOps). Dispatches four sub-scanners in parallel — secret-scanner, dependency-scanner, owasp-reviewer, policy-validator — aggregates findings by severity, and owns the Security Clear gate. Read-only: routes fixes through the Orchestrator's defect loop."
 tools: Agent, Read, Glob, Grep, Bash, SendMessage
 permissionMode: plan
 model: sonnet

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/hooks/hooks.json

@@ -29,7 +29,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command' 2>/dev/null || true); if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi"
+            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command' 2>/dev/null || true); if printf '%s' \"$CMD\" | grep -qE '(^|[^[:alnum:]_])rm([[:space:]]|$)' && printf '%s' \"$CMD\" | grep -qE '(^|[[:space:]])-[a-zA-Z]*[rR]|--recursive' && printf '%s' \"$CMD\" | grep -qE '(^|[[:space:]])-[a-zA-Z]*f|--force'; then echo 'BLOCKED: rm -rf (recursive+force, any flag order/spelling) is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi"
           },
           {
             "type": "command",

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.26.0"
+version = "0.26.1"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/skills/design-patterns-and-conventions/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: design-patterns-and-conventions
-description: Encodes the cross-cutting design patterns, naming conventions, folder layout, testing strategies, troubleshooting diagnostics, and catalogued anti-patterns observed across production Python/FastAPI backend services. Use when architecting new FastAPI services, refactoring code, reviewing structure, investigating technical debt, debugging session leaks or event loop blocks, setting up dependency injection, configuring multi-mode entrypoints (server/consumer/worker), implementing response envelopes, integrating Kafka or Temporal, organizing domain modules, or avoiding known anti-patterns (hardcoded secrets, CORS wildcards, sync clients in async code, unscoped sessions, deprecated lifecycle hooks). Particularly relevant for questions about layered architecture (router/service/dao), singleton patterns (ConnectionManager), CustomRequestRoute, loaded_config, naming standards (snake_case vs PascalCase), folder layout (per-domain modules), testing patterns (mocking, fixtures, TestClient), or troubleshooting common issues (session leaks, blocked event loop, duplicate routes, CORS errors, Kafka/Temporal problems).
+description: Encodes the cross-cutting design patterns, naming conventions, folder layout, testing strategies, troubleshooting diagnostics, and catalogued anti-patterns observed across production Python/FastAPI backend services. Use when architecting new FastAPI services, refactoring code, reviewing structure, investigating technical debt, debugging session leaks or event loop blocks, setting up dependency injection, configuring multi-mode entrypoints (server/consumer/worker), implementing response envelopes, integrating Kafka or Temporal, organizing domain modules, or avoiding known anti-patterns (hardcoded secrets, CORS wildcards, sync clients in async code, unscoped sessions, deprecated lifecycle hooks). Also covers layered architecture (router/service/dao), the ConnectionManager singleton, CustomRequestRoute, naming standards (snake_case vs PascalCase), per-domain folder layout, and testing patterns (mocking, fixtures, TestClient).
 ---
 
 Enforce consistent design patterns, naming conventions, and architectural decisions across FastAPI backends, derived from real-world production services.

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/skills/shannon-ai-pentest/SKILL.md

@@ -5,13 +5,12 @@ description: >
   app's source code, plans attacks, then runs real proof-of-concept exploits against the live app and
   reports only confirmed, reproducible findings. Covers installing/running the externally-distributed
   `npx @keygraph/shannon` CLI (setup, start, status, logs, stop, workspaces), configuring AI providers
-  (Anthropic / AWS Bedrock / Google Vertex AI / proxy) and model tiers, writing the YAML engagement
-  config (vuln classes, authentication + login flows + TOTP, scope avoid/focus rules, report
-  filtering, rate limits), reading the Markdown report, and the safety/authorization rules. Shannon is
-  a separate AGPL-3.0 tool you install yourself — this skill does NOT bundle it. Use when asked to run
-  Shannon, set up an autonomous/white-box AI pentest, exploit-test an app from its source, configure
-  `@keygraph/shannon`, write a Shannon engagement config, or produce a proof-by-exploitation security
-  report. Only for systems you own or are authorized to test, never production.
+  and model tiers, writing the YAML engagement config (vuln classes, auth + login flows + TOTP, scope
+  avoid/focus rules, report filtering, rate limits), reading the Markdown report, and the
+  safety/authorization rules. Shannon is a separate AGPL-3.0 tool you install yourself — this skill
+  does NOT bundle it. Use when asked to run Shannon, set up an autonomous/white-box AI pentest,
+  exploit-test an app from its source, write a Shannon engagement config, or produce a
+  proof-by-exploitation security report. Only for systems you own or are authorized to test.
 ---
 
 # Shannon — Autonomous White-Box AI Pentesting

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/skills/smoke-test/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: smoke-test
 description: Quick health check — verifies all services are running and basic user flow works. Use before starting development or after deployment.
-argument-hint: [optional: "backend-only" or "frontend-only"]
+argument-hint: 'backend-only | frontend-only (optional)'
 disable-model-invocation: true
 ---
 

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/skills/zap-vapt-scanning/scripts/zap_vapt.py

@@ -20,7 +20,6 @@ import atexit
 import base64
 import json
 import os
-from collections import Counter
 import platform
 import re
 import shlex
@@ -28,12 +27,13 @@ import shutil
 import subprocess
 import sys
 import time
+import xml.etree.ElementTree as ET
+from collections import Counter
 from dataclasses import dataclass, field
 from datetime import datetime
 from glob import glob
-from urllib.parse import urlsplit, quote_plus
+from urllib.parse import quote_plus, urlsplit
 from xml.sax.saxutils import escape as _xml_escape
-import xml.etree.ElementTree as ET
 
 # ----------------------------------------------------------------------------
 # Constants & small console helpers
@@ -1082,22 +1082,22 @@ def build_pdf(
     agg: Aggregates,
     unmatched: list | None = None,
 ):
-    from reportlab.lib.pagesizes import A4
     from reportlab.lib.colors import HexColor, white
     from reportlab.lib.enums import TA_CENTER
+    from reportlab.lib.pagesizes import A4
     from reportlab.lib.styles import ParagraphStyle
     from reportlab.lib.utils import ImageReader
     from reportlab.platypus import (
-        SimpleDocTemplate,
+        CondPageBreak,
+        Flowable,
+        Image,
+        ListFlowable,
+        PageBreak,
         Paragraph,
+        SimpleDocTemplate,
         Spacer,
         Table,
         TableStyle,
-        Image,
-        PageBreak,
-        ListFlowable,
-        Flowable,
-        CondPageBreak,
     )
 
     G, B, GR = HexColor(GREEN), HexColor(BLUE), HexColor(GRID)
@@ -2091,8 +2091,8 @@ def main() -> int:
         return run_selftest()
 
     try:
-        import requests  # noqa: F401
         import reportlab  # noqa: F401
+        import requests  # noqa: F401
     except ImportError:
         err("Missing dependencies. Run:  python3 -m pip install -r requirements.txt")
         return 2

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.26.0"
+__version__ = "0.26.1"

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/src/claude_kit/hooks.py

@@ -20,9 +20,11 @@ from typing import Any
 _RM_RF_GUARD = (
     "command -v jq >/dev/null 2>&1 || exit 0; "
     "CMD=$(jq -r '.tool_input.command' 2>/dev/null || true); "
-    "if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then "
-    "echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths "
-    "explicitly.' >&2; exit 2; fi"
+    "if printf '%s' \"$CMD\" | grep -qE '(^|[^[:alnum:]_])rm([[:space:]]|$)' "
+    "&& printf '%s' \"$CMD\" | grep -qE '(^|[[:space:]])-[a-zA-Z]*[rR]|--recursive' "
+    "&& printf '%s' \"$CMD\" | grep -qE '(^|[[:space:]])-[a-zA-Z]*f|--force'; then "
+    "echo 'BLOCKED: rm -rf (recursive+force, any flag order/spelling) is disabled by claude-kit. "
+    "Move to trash or delete specific paths explicitly.' >&2; exit 2; fi"
 )
 
 # Block pushes whose *target* ref is main/master. The branch token must be bounded by a space or

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/src/claude_kit/scaffold.py

@@ -36,6 +36,9 @@ GITIGNORE_ENTRIES = (
     "CLAUDE.local.md",
     ".claude/state/",
     ".claude/tmp/",
+    # upgrade/merge artifacts written by `claude-kit upgrade` — never commit these
+    ".claude-kit.bak-*/",
+    "*.claude-kit",
 )
 
 

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/templates/org/skills/prompt-to-safe-task/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: prompt-to-safe-task
-description: Use when anyone — especially a non-engineer — types a free-form request in plain language and wants it turned into a scoped, risk-classified, approval-gated task before anything happens. The safe front door for vibe-coding: goal → scope + out-of-scope → risk tier → success criteria → plan → approval, then route to the right skill/agent.
+description: "Use when anyone — especially a non-engineer — types a free-form request in plain language and wants it turned into a scoped, risk-classified, approval-gated task before anything happens. The safe front door for vibe-coding: goal → scope + out-of-scope → risk tier → success criteria → plan → approval, then route to the right skill/agent."
 ---
 
 # Prompt to Safe Task

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/templates/org/skills/repo-onboarding/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: repo-onboarding
-description: Use when someone new to the repo — a new engineer, support, or any newcomer — asks "how does this fit together and where do I start?" Maps the architecture, explains key modules and entry points, surfaces conventions, and produces an ordered onboarding path plus a "where things live" guide. Read-only: explores and explains, never changes code.
+description: 'Use when someone new to the repo — a new engineer, support, or any newcomer — asks "how does this fit together and where do I start?" Maps the architecture, explains key modules and entry points, surfaces conventions, and produces an ordered onboarding path plus a "where things live" guide. Read-only: explores and explains, never changes code.'
 ---
 
 # Repo Onboarding

{claude_code_kit-0.26.0 → claude_code_kit-0.26.1}/templates/settings.json

@@ -26,7 +26,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command' 2>/dev/null || true); if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi"
+            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command' 2>/dev/null || true); if printf '%s' \"$CMD\" | grep -qE '(^|[^[:alnum:]_])rm([[:space:]]|$)' && printf '%s' \"$CMD\" | grep -qE '(^|[[:space:]])-[a-zA-Z]*[rR]|--recursive' && printf '%s' \"$CMD\" | grep -qE '(^|[[:space:]])-[a-zA-Z]*f|--force'; then echo 'BLOCKED: rm -rf (recursive+force, any flag order/spelling) is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi"
           },
           {
             "type": "command",