claude-code-kit 0.44.0__tar.gz → 0.45.0__tar.gz

{claude_code_kit-0.44.0 → claude_code_kit-0.45.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.44.0",
+      "version": "0.45.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.44.0 → claude_code_kit-0.45.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.44.0 → claude_code_kit-0.45.0}/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.45.0] — 2026-06-27
+
+**Adopt `library-skills` as a referenced companion** — [`library-skills`](https://library-skills.io)
+(MIT) is a tool (`uvx library-skills` / `npx library-skills`) that installs a dependency's
+*author-shipped, version-synced* skills into `.claude/skills/` (via managed symlinks) so an agent uses
+a library's **current** API instead of stale training-data patterns. It is the same root defense as
+`dependency-verification` (the model's memory of an API is a *claim*, not a fact), one step later in
+the dependency lifecycle — so it is wired in **reuse-first** (referenced, never vendored; no new skill,
+since it would duplicate the existing Context7 live-docs MCP):
+
+- **`dependency-verification`** gains a *"use its current API"* layer in its supply-chain-lifecycle
+  diagram (between install and the post-install CVE audit), naming `library-skills` (for libraries that
+  ship skills today) and Context7 (live docs for the rest) as the two ways to ground usage in the
+  source rather than the model's memory.
+- **`library-review`** notes the post-adopt step (once you adopt, pull the library's current skills/docs)
+  and adds a `library-skills` entry to its Related list.
+- **`catalog/mcp.yaml`** documents `library-skills` as the no-MCP companion to the Context7 docs server.
+
+No new skills/agents and no count changes; honest about the tool being nascent (it only helps for the
+growing set of libraries that ship skills).
+
 ## [0.44.0] — 2026-06-27
 
 **Token-economy pass** — cut claude-kit's eager per-session context cost without removing any SDLC

{claude_code_kit-0.44.0 → claude_code_kit-0.45.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.44.0
+Version: 0.45.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit

{claude_code_kit-0.44.0 → claude_code_kit-0.45.0}/catalog/mcp.yaml

@@ -65,6 +65,12 @@ servers:
     config:
       type: http
       url: "https://mcp.context7.com/mcp"
+    # Companion (no MCP needed): `library-skills` (https://library-skills.io, MIT) installs a
+    # dependency's *author-shipped, version-synced* skills into `.claude/skills/` via managed symlinks
+    # (`uvx library-skills` / `npx library-skills`) so the agent uses a library's CURRENT API instead of
+    # stale training-data patterns — for the (growing) set of libraries that ship skills; Context7 above
+    # covers everything else with live docs. Both are referenced (not bundled). See the
+    # `dependency-verification` and `library-review` skills for where this sits in the dependency lifecycle.
   # Sentry (github.com/getsentry/sentry-mcp) — official, vendor-maintained MCP for production error
   # monitoring / issue triage: top unresolved issues, stacktraces, performance & trace data, and Seer
   # root-cause analysis. Fills the error-monitoring gap the `incident-responder` + `observability-engineer`

{claude_code_kit-0.44.0 → claude_code_kit-0.45.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.44.0"
+version = "0.45.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.44.0 → claude_code_kit-0.45.0}/skills/dependency-verification/SKILL.md

@@ -85,10 +85,18 @@ need a dep at all?      → mandatory-workflow.md §2a.5 (Reuse & YAGNI gate)
 which dep, is it healthy?→ library-review skill (adopt/reject evaluation)
 does this NAME exist?    → THIS skill (pre-install: hallucination/typosquat)   ◄── you are here
             install
+use its CURRENT api?     → Context7 MCP (live docs) · library-skills (author-shipped, version-synced skills)
 installed deps: CVEs?    → dependency-scanner agent (post-install CVE/outdated audit)
 lockfile/artifact integrity? → dependency-scanner agent (supply-chain integrity mode)
 ```
 
+**The "use its current API" layer** is the same root defense as the name check, one step later: the
+model's memory of a library's API is also a *claim*, and it goes stale as the library releases. Ground
+usage in the source — [`library-skills`](https://library-skills.io) (MIT) installs a dependency's
+*author-shipped, version-synced* skills into `.claude/skills/` (managed symlinks; `uvx library-skills`
+/ `npx library-skills`) for the growing set of libraries that ship them, and the Context7 MCP (live
+docs) covers the rest. Both beat reconstructing an out-of-date API from training data.
+
 **Optional enforcement:** a `PreToolUse` hook on install commands can run this check automatically
 (warn-by-default; block on nonexistent/typosquat when configured). The hook is a backstop — verify
 deliberately when you add a dependency rather than waiting for the gate.

{claude_code_kit-0.44.0 → claude_code_kit-0.45.0}/skills/library-review/SKILL.md

@@ -71,7 +71,9 @@ scanning / signed releases · small focused surface · typings available · seve
 
 Conclude explicitly — never let a dependency slip in undecided:
 
-1. **Adopt** — passes every dimension; pin sensibly and move on.
+1. **Adopt** — passes every dimension; pin sensibly and move on. Then use its *current* API, not the
+   model's memory of it: pull the library's author-shipped, version-synced skills with `library-skills`
+   (or its live docs via Context7) — see the `dependency-verification` "use its current API" layer.
 2. **Adopt behind a seam** — acceptable but with real lock-in/risk → wrap it behind a thin interface
    so it can be swapped, and note the exit path.
 3. **Reject** — a disqualifier fires, or a cheaper §2a.5 rung wins → record what you'll do instead.
@@ -100,6 +102,7 @@ worth recording too, so the question isn't re-litigated.
 - `.claude/rules/mandatory-workflow.md` (§2a.5 Reuse & YAGNI Gate) — the gate that decides *whether* a dep is needed
 - `over-engineering-review` — reactive twin of §2a.5; stdlib/native/yagni lenses
 - `dependency-verification` — the *pre-install* name check (does this package name even exist / is it a typosquat) that runs before this evaluation
+- [`library-skills`](https://library-skills.io) (MIT) — *after* you adopt, installs the library's author-shipped, version-synced skills into `.claude/skills/` so the agent uses its current API rather than stale training-data patterns (complements the Context7 live-docs MCP); for libraries that ship skills today
 - `dependency-scanner` agent — audits *already-installed* deps for CVEs + lockfile/artifact integrity (this skill's post-add counterpart)
 - `code-review-and-quality` (Dependency Discipline) — the quick 5-point form of this evaluation
 - `documentation-and-adrs` — record a consequential adopt/reject as an ADR

{claude_code_kit-0.44.0 → claude_code_kit-0.45.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.44.0"
+__version__ = "0.45.0"