claude-code-kit 0.53.0__tar.gz → 0.55.0__tar.gz

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.53.0",
+      "version": "0.55.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.53.0",
+  "version": "0.55.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/.gitignore

@@ -28,3 +28,9 @@ zap-vapt-tool.zip
 # depth, and on case-insensitive filesystems (macOS default) it also swallows
 # rules/continuity.md — the tracked rule file.
 .claude/
+
+# Local-only working artifacts — generated during development, never part of the distributable kit.
+# (Review write-ups, ad-hoc patches, and locally-gathered reference data.)
+claude-kit-review*.md
+*.patch
+ai_repos_over_40k_stars.*

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/CHANGELOG.md

@@ -4,6 +4,92 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.55.0] — 2026-07-01
+
+**React overlay rules split under Claude Code's 40k memory limit.** Two React design-system overlay
+rules shipped over the 40,000-character memory/rule-file limit, so every React scaffold saw the
+`over the 40.0k-char limit · /memory` warning and risked the rule loading only partially. They are now
+split by concern — 100% of content preserved verbatim — and a CI guard keeps any rule from regressing.
+No change to the core promise — configuration-only SDLC scaffolding for Claude Code, no application
+code, no Docker, stack-agnostic core, catalog-driven. **0 new agents/skills.**
+
+### Fixed
+
+- **Oversized React overlay rules split under the 40k limit.** `ui-design-system.md` (56.7k) → the
+  foundations/index `ui-design-system.md` + `ui-components.md` (cards, badges, buttons, form controls,
+  states, tooltips, KPI labels, data tables, compound components) + `ui-layout-and-motion.md` (page
+  layout, motion, accessibility, page blueprints, quick reference); `ux-patterns.md` (44.4k) → the
+  content/interaction `ux-patterns.md` + `ux-dashboard-patterns.md` (chart standards, tab bar, KPI-grid
+  layouts, global filter strip). Every shipped rule file is now well under the limit. The React
+  `overlay_rules` list (`catalog/stacks.yaml`) grows 5 → 8; cross-references in `react-patterns.md`,
+  `mobile-design-guidelines.md`, and `design-system-compliance.md`, and the `ui-ux-design` /
+  `component-design` skills + `ui-designer` agent, all repoint to the split files.
+
+### Added
+
+- **`scripts/check_rule_sizes.py` regression guard.** Scans every shipped rule file (`rules/*.md`,
+  `templates/stacks/**/rules/*.md`, `templates/org/rules/*.md`) and fails if any reaches 38,000
+  characters (2k of headroom under the 40k hard limit). Wired into CI next to the MCP-pin gate and
+  covered by `tests/test_rule_sizes.py`.
+
+## [0.54.0] — 2026-06-29
+
+**Safety, correctness, and capability hardening pass.** Two reviews (a fresh practical review and an
+external improvement brief) converged on a set of gaps; every premise was verified against the source
+before acting. No change to the core promise — configuration-only SDLC scaffolding for Claude Code, no
+application code, no Docker, stack-agnostic core, catalog-driven, evidence-backed gates, safe upgrades.
+**0 new agents/skills.**
+
+### Security
+
+- **Learning capture is privacy-hardened (still on by default).** `capture-learnings.sh` now excludes
+  secret-bearing files (`.env`, `*.pem`/`*.key`, `credentials.*`) from the changed-file list, redacts
+  leaked-credential value shapes (private keys, `AKIA…`, `sk_live_…`, Slack/GitHub tokens) from
+  anything handed to the background job, bounds the payload with env-overridable
+  `CLAUDE_KIT_CAPTURE_MAX_LINES` / `CLAUDE_KIT_CAPTURE_MAX_BYTES`, and instructs the job never to record
+  secrets/PII. `init` prints a privacy notice (and a jq-missing caveat); `doctor` warns while capture is
+  wired; the same caveat is documented in `SECURITY.md` and the project README.
+- **No raw slash-command argument interpolation.** `/claude-kit:init` no longer interpolates the
+  textually-substituted `$ARGUMENTS` into any executable shell block; the agent runs the CLI with the
+  user's arguments as separate, individually-quoted argv items. A CI test fails on `$ARGUMENTS` inside a
+  command's fenced code block.
+- **Git guards hardened** against global-option and refspec bypasses (`git -c …` / `git -C …`,
+  `+main`, refspec forms); manual-stdin guards no-op on a TTY.
+
+### Added
+
+- **Command discovery (`detect.py`).** `init`/`upgrade` inspect a populated target for unambiguous
+  package-manager signals and wire the real commands into `CLAUDE.md` — JavaScript (npm·pnpm·yarn·bun)
+  install + present `package.json` scripts, Python (uv·poetry·pdm·hatch) install. Fail-open and
+  conservative (an empty target is a no-op, preserving `init --dry-run` ≡ a real install).
+  `--detect-commands` / `--no-detect-commands` opt in/out; recorded in the stack snapshot.
+- **Transactional upgrade journal.** `upgrade` writes `.claude/config/upgrade-in-progress.json` before
+  mutating and clears it after the new baseline commits; combined with convergent render-and-compare, an
+  interrupted upgrade is finished and cleared by the next run. `doctor` warns while a journal is present;
+  it is gitignored. `merge_install` is not journaled.
+- **JSON Schema validation** for the catalog and persisted artifacts (`jsonschema` is an optional
+  `[schema]` extra; a no-op when absent). Wired into `validate --strict` and the catalog check.
+- **`--json` output** for `validate`, `doctor`, `diff`, `status`, `pipeline validate|status`, and
+  `init --dry-run` via a structured `report` module (human output unchanged).
+- **MCP pin freshness tooling** — an offline CI gate that fails on `@latest`/unpinned servers, plus a
+  scheduled workflow that opens a tracking issue when a pin falls behind the registry.
+
+### Changed
+
+- **`lint-fix.sh` scopes to changed files by default** (git diff vs HEAD + untracked), so a Stop hook
+  never reformats files the user didn't touch. `CLAUDE_KIT_AUTOFIX=1` restores whole-repo formatting;
+  falls back to whole-repo when git is unavailable.
+- **Planned CLI commands are hidden** from `--help` unless `CLAUDE_KIT_EXPERIMENTAL=1` (still marked
+  `[planned]`, still exit non-zero) so they can't be mistaken for working features.
+- **Skill/agent descriptions** front-load their triggers and fit the picker cap; a warn-only CI check
+  reports any that exceed it.
+
+### Docs
+
+- New `docs/KNOWN_LIMITATIONS.md` (guards are best-effort, not a security boundary; command discovery
+  scope; non-atomic first install; convergent/journalled upgrades) + a README "Who this is for" section
+  and reconciliation/reference fixes.
+
 ## [0.53.0] — 2026-06-28
 
 **Adopt the verified wins from an exhaustive review of three GitHub orgs — `Netflix`, `aws`, and

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/CLAUDE.md

@@ -20,7 +20,7 @@ distributed two ways from one source of truth:
 | `.claude-plugin/marketplace.json` | Marketplace entry so `/plugin marketplace add` works |
 | `agents/` | SDLC pipeline subagents (auto-discovered by the plugin); each carries a `tier:` field |
 | `skills/` | Agent skills (auto-discovered by the plugin); `skills/sdlc/` is the `/sdlc` entrypoint |
-| `commands/` | Slash commands: `/claude-kit:init`, `:sdlc`, `:status` (init prefers the pip CLI, falls back to `init.sh`; sdlc delegates to the `sdlc` skill) |
+| `commands/` | Slash commands: `/claude-kit:init`, `:sdlc`, `:status`, `:abort` (init prefers the pip CLI, falls back to `init.sh`; sdlc delegates to the `sdlc` skill; abort tears down an in-progress `/sdlc` run) |
 | `hooks/hooks.json` + `hooks/scripts/` | Event hooks (paths via `${CLAUDE_PLUGIN_ROOT}`) |
 | `rules/` | The 24-file stack-agnostic engineering rule set (scaffolded into `.claude/rules/`), including the agent-operation rules (reasoning, guardrails, resilience, goal-setting, human-in-the-loop, model-tiers, evals, tool-design — see `docs/agentic-patterns.md`), the service-level `resilience-engineering` rule, and the org-core rules `autonomy-levels` + `risk-classification` (see `docs/org-capabilities.md`) |
 | `catalog/` | **Data-driven registry** — `stacks.yaml` · `profiles.yaml` · `mcp.yaml` · `org.yaml`. The only thing that decides what `resolve()` installs. Adding a stack/profile/server/pack is a data change here. |

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.53.0
+Version: 0.55.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -21,11 +21,14 @@ Requires-Dist: pyyaml>=6.0
 Requires-Dist: typer>=0.12
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: jsonschema>=4.0; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.6; extra == 'dev'
 Requires-Dist: shellcheck-py>=0.10; extra == 'dev'
 Requires-Dist: twine>=5.0; extra == 'dev'
+Provides-Extra: schema
+Requires-Dist: jsonschema>=4.0; extra == 'schema'
 Description-Content-Type: text/markdown
 
 <div align="center">
@@ -66,14 +69,27 @@ advance until each phase's quality gate passes**. You drive it all with one comm
 **`/sdlc <your task>`**.
 
 It ships **no application code and needs no Docker** — only the rules, agents, skills, and gates that
-govern *how* the work gets done. Choose your stack, rigor, and team scope at `init`; everything else
-adapts.
+govern *how* the work gets done. (Some skills *help Claude write* your Dockerfiles, CI, or k8s manifests
+when you ask — but the scaffolder itself installs none.) Choose your stack, rigor, and team scope at
+`init`; everything else adapts.
 
 > Inspired by the autonomous-SDLC idea, rebuilt from the ground up **for Claude Code**, and kept small
 > by a **reuse-first** policy — see [what we adopted](#influences--what-we-adopted) and from where.
 
 ---
 
+## Who this is for
+
+**Use claude-kit if** you drive real repository changes with Claude Code and want a repeatable
+spec → review → test → security → PR workflow whose quality gates won't advance on an unproven verdict.
+
+**Skip it if** you want a small prompt pack, don't want project config written into your repo, or need a
+standalone runtime/daemon. claude-kit is **configuration for Claude Code**, not a separate runtime — and
+its guard hooks are convenience guardrails (they need `jq` + a POSIX shell and no-op without them), **not
+a hardened security boundary**. See [Known limitations](docs/KNOWN_LIMITATIONS.md).
+
+---
+
 ## Features
 
 The whole product at a glance — one line each. Expand **[Feature details](#feature-details)** (below
@@ -88,7 +104,7 @@ Quick start) for the full breakdown of any row.
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
-| 🛠️ **Hooks & guards** | **17** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
+| 🛠️ **Hooks & guards** | **18** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **17** ready MCP fragments, and edit-preserving `upgrade` |
 | ♻️ **Reuse-first by design** | Adopt-only-the-new reviews, opt-in LLM/AI security (OWASP LLM Top 10), a worked example + self-test matrix |
 
@@ -338,7 +354,7 @@ need.
 
 <br>
 
-- **17 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
+- **18 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
   `guard-secrets`, `guard-destructive-git`, `lint-fix`, `type-check`, and `validate-settings` run
   deterministically.
 - **Advisory, never-blocking warnings** — `warn-llm-io`, `warn-large-edits`, `warn-missing-tests`, and

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/README.md

@@ -36,14 +36,27 @@ advance until each phase's quality gate passes**. You drive it all with one comm
 **`/sdlc <your task>`**.
 
 It ships **no application code and needs no Docker** — only the rules, agents, skills, and gates that
-govern *how* the work gets done. Choose your stack, rigor, and team scope at `init`; everything else
-adapts.
+govern *how* the work gets done. (Some skills *help Claude write* your Dockerfiles, CI, or k8s manifests
+when you ask — but the scaffolder itself installs none.) Choose your stack, rigor, and team scope at
+`init`; everything else adapts.
 
 > Inspired by the autonomous-SDLC idea, rebuilt from the ground up **for Claude Code**, and kept small
 > by a **reuse-first** policy — see [what we adopted](#influences--what-we-adopted) and from where.
 
 ---
 
+## Who this is for
+
+**Use claude-kit if** you drive real repository changes with Claude Code and want a repeatable
+spec → review → test → security → PR workflow whose quality gates won't advance on an unproven verdict.
+
+**Skip it if** you want a small prompt pack, don't want project config written into your repo, or need a
+standalone runtime/daemon. claude-kit is **configuration for Claude Code**, not a separate runtime — and
+its guard hooks are convenience guardrails (they need `jq` + a POSIX shell and no-op without them), **not
+a hardened security boundary**. See [Known limitations](docs/KNOWN_LIMITATIONS.md).
+
+---
+
 ## Features
 
 The whole product at a glance — one line each. Expand **[Feature details](#feature-details)** (below
@@ -58,7 +71,7 @@ Quick start) for the full breakdown of any row.
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
-| 🛠️ **Hooks & guards** | **17** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
+| 🛠️ **Hooks & guards** | **18** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **17** ready MCP fragments, and edit-preserving `upgrade` |
 | ♻️ **Reuse-first by design** | Adopt-only-the-new reviews, opt-in LLM/AI security (OWASP LLM Top 10), a worked example + self-test matrix |
 
@@ -308,7 +321,7 @@ need.
 
 <br>
 
-- **17 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
+- **18 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
   `guard-secrets`, `guard-destructive-git`, `lint-fix`, `type-check`, and `validate-settings` run
   deterministically.
 - **Advisory, never-blocking warnings** — `warn-llm-io`, `warn-large-edits`, `warn-missing-tests`, and

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/agents/devils-advocate.md

@@ -1,6 +1,6 @@
 ---
 name: devils-advocate
-description: Anti-sycophancy adversarial reviewer. Invoked to critique a plan/spec before approval (standard+), and whenever a parallel review or test-coverage gate reaches a unanimous PASS. Assumes the work is guilty and hunts for what everyone else missed. Gates the pipeline — the artifact is not final until this agent returns CONFIRMED.
+description: Anti-sycophancy adversarial reviewer. Critiques a plan/spec before approval, and when a gate reaches unanimous PASS. Gates the pipeline — the artifact is not final until it returns CONFIRMED.
 tools: Read, Glob, Grep, Bash, SendMessage
 permissionMode: plan
 model: opus

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/agents/devops-engineer.md

@@ -1,6 +1,6 @@
 ---
 name: devops-engineer
-description: Delivery & operability agent. Owns the CI pipeline, build & packaging, release/rollback, environment & secret configuration, database migrations, and the local developer experience for any stack. Container-optional — works whether the project ships as containers, plain processes, managed services, or serverless.
+description: Delivery & operability agent. Owns the CI pipeline, build & packaging, release/rollback, environment & secrets, database migrations, and local dev experience for any stack. Container-optional.
 tools: Read, Write, Edit, Bash, Glob, Grep
 permissionMode: acceptEdits
 model: sonnet

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/agents/incident-responder.md

@@ -1,6 +1,6 @@
 ---
 name: incident-responder
-description: Production incident commander. Use when prod is broken — errors spiking, a latency/availability breach, a dependency down, or a bad deploy. Triages severity, gathers signals (health, logs, metrics, error tracking), drives mitigation (rollback/flag) FIRST, then root cause. Coordinates; routes code fixes to the dev lane.
+description: Production incident commander. Use when prod is broken — errors spiking, latency breach, dependency down, bad deploy. Triages severity, gathers signals, drives mitigation (rollback/flag) FIRST, then root cause.
 tools: Read, Glob, Grep, Bash, SendMessage
 permissionMode: plan
 model: sonnet

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/agents/policy-validator.md

@@ -1,6 +1,6 @@
 ---
 name: policy-validator
-description: Security sub-scanner. Validates that required security policies are enforced — CORS allowlist, rate limiting on auth endpoints, secure session-cookie flags, security headers, input validation at boundaries, and the authz dependency chain. PASS/FAIL per policy with remediation. Reports only.
+description: Security sub-scanner. Validates required security policies — CORS allowlist, auth-endpoint rate limiting, secure session cookies, security headers, input validation, authz chain. PASS/FAIL. Reports only.
 tools: Read, Glob, Grep, Bash, SendMessage
 permissionMode: plan
 model: sonnet

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/agents/security-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: security-reviewer
-description: "Security stage coordinator. Runs at Phase 5.4 (after test-coverage VERIFIED, before DevOps). Dispatches four sub-scanners in parallel — secret-scanner, dependency-scanner, owasp-reviewer, policy-validator — aggregates findings by severity, and owns the Security Clear gate. Read-only: routes fixes through the Orchestrator's defect loop."
+description: Security stage coordinator. Runs at Phase 5.4 (after test-coverage VERIFIED, before DevOps). Dispatches four sub-scanners in parallel — secret, dependency, owasp, policy — and owns the Security Clear gate.
 tools: Agent, Read, Glob, Grep, Bash, SendMessage
 permissionMode: plan
 model: sonnet

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/agents/senior-frontend-dev.md

@@ -1,6 +1,6 @@
 ---
 name: senior-frontend-dev
-description: Senior frontend developer agent. Handles UI/UX, component architecture, API integration, client state management, routing, unit testing, performance, security, and E2E testing. Stack-agnostic — adapts to the project's frontend framework, type system, build tool, and testing setup.
+description: Senior frontend developer agent handling UI/UX, component architecture, API integration, client state, routing, testing, and performance. Stack-agnostic — adapts to the project's framework and build tool.
 tools: Read, Write, Edit, Bash, Glob, Grep
 permissionMode: acceptEdits
 model: sonnet

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/agents/ui-designer.md

@@ -19,7 +19,7 @@ For any frontend, UI, or interaction work, produce a **complete, production-read
 Your project's frontend stack may vary. Before designing, identify:
 - The UI framework (e.g., React, Vue, Svelte, Angular, vanilla JS)
 - The styling approach (e.g., CSS modules, Tailwind, styled-components, CSS-in-JS)
-- Design system location (if one exists — check `.claude/rules/ui-design-system.md` (React overlay), `docs/references/ui/`, `design-system/`, or similar)
+- Design system location (if one exists — check `.claude/rules/ui-design-system.md` (React overlay; its `ui-components.md` / `ui-layout-and-motion.md` companions cover components and layout/motion/a11y), `docs/references/ui/`, `design-system/`, or similar)
 - Component library path (check `src/components/`, `lib/ui/`, or similar)
 
 ## MANDATORY: Read Before Designing

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/catalog/stacks.yaml

@@ -24,7 +24,7 @@ frontend:
       languages:
         default: typescript
         options: [typescript, javascript]
-      overlay_rules: [react-patterns.md, design-system-compliance.md, ui-design-system.md, ux-patterns.md, mobile-design-guidelines.md]
+      overlay_rules: [react-patterns.md, design-system-compliance.md, ui-design-system.md, ui-components.md, ui-layout-and-motion.md, ux-patterns.md, ux-dashboard-patterns.md, mobile-design-guidelines.md]
       overlay_agents: []
       skills: [frontend-ui-engineering, component-design, ui-ux-design, unit-test]
       stack_dir: frontend/react

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/commands/init.md

@@ -8,12 +8,11 @@ Install the claude-kit autonomous-SDLC configuration into the current project.
 
 **The Python CLI is required.** It runs the ordered prompts, resolves the stack/profile/MCP catalog,
 installs overlay rules + agents, assembles `settings.json`, and records `init-options.json` for safe
-upgrades (`claude-kit upgrade` / `diff`). Check whether it's on PATH and use it, passing through
-`$ARGUMENTS`:
+upgrades (`claude-kit upgrade` / `diff`). First detect whether it is on PATH:
 
 ```
-command -v claude-kit >/dev/null 2>&1 && claude-kit init $ARGUMENTS \
-  || { command -v ckit >/dev/null 2>&1 && ckit init $ARGUMENTS \
+command -v claude-kit >/dev/null 2>&1 && echo "CKIT_CLI=claude-kit" \
+  || { command -v ckit >/dev/null 2>&1 && echo "CKIT_CLI=ckit" \
   || echo "CKIT_CLI_MISSING"; }
 ```
 
@@ -24,6 +23,18 @@ command -v claude-kit >/dev/null 2>&1 && claude-kit init $ARGUMENTS \
 - Recommended: `pipx install claude-code-kit`
 - Or: `pip install claude-code-kit`
 
+Otherwise, run the detected CLI's `init` subcommand with the arguments the user passed to this command:
+
+> `$ARGUMENTS`
+
+**Argument safety (important).** Pass those arguments to the CLI as **ordinary, separate command-line
+arguments, exactly as the user gave them** — do **not** interpolate them into a shell command string.
+If any single argument contains spaces or shell metacharacters (`$`, `` ` ``, `;`, `|`, `&`, `>`, `(`,
+quotes, …), quote that one argument so the shell treats it as literal text. This prevents
+word-splitting, globbing, and command injection from the raw argument text. For example, if the
+detected CLI was `claude-kit` and the user passed `/path/to/proj --defaults`, run
+`claude-kit init /path/to/proj --defaults`.
+
 **Escape hatch (advanced, opt-in only).** A thin shell scaffolder exists for locked-down environments
 where installing the CLI is impossible. It copies the full payload as a **superset** with **no**
 stack/profile/MCP resolution, and `claude-kit upgrade` / `diff` will **not** work against it. Use it
@@ -31,14 +42,16 @@ stack/profile/MCP resolution, and `claude-kit upgrade` / `diff` will **not** wor
 
 ```
 if [ "${CLAUDE_KIT_BASIC:-0}" = "1" ]; then
-  bash "${CLAUDE_PLUGIN_ROOT}/scripts/init.sh" $ARGUMENTS
+  echo "CKIT_BASIC=1"
 else
   echo "set CLAUDE_KIT_BASIC=1 to use the degraded no-CLI scaffolder (the CLI is the supported path)"
 fi
 ```
 
-If `${CLAUDE_PLUGIN_ROOT}` is not set (running from a source checkout), locate `scripts/init.sh` in
-the claude-kit repository and run it the same way.
+If that prints `CKIT_BASIC=1`, run `bash "${CLAUDE_PLUGIN_ROOT}/scripts/init.sh"` and append the same
+`$ARGUMENTS` as separate, individually-quoted argv items (same argument-safety rule as above). If
+`${CLAUDE_PLUGIN_ROOT}` is not set (running from a source checkout), locate `scripts/init.sh` in the
+claude-kit repository and run it the same way.
 
 After it completes:
 1. Summarize what was installed — `CLAUDE.md`, `.claude/{rules, agents, skills, hooks, templates}`,

claude_code_kit-0.55.0/docs/KNOWN_LIMITATIONS.md

@@ -0,0 +1,63 @@
+# Known limitations
+
+claude-kit is deliberately a **configuration scaffolder for Claude Code** — not a runtime, sandbox, or
+security product. Being honest about the edges is part of the design. If one of these is a blocker for
+you, that's useful signal — open an issue.
+
+## Guard hooks are guardrails, not a security boundary
+
+- The event hooks (block `rm -rf`, secret-file reads, pushes to `main`, destructive git, `kubectl
+  delete`, …) require **`jq` and a POSIX shell**. Without them they **degrade to no-ops** — agents,
+  rules, and skills still work, but the deterministic guards do nothing. Run `claude-kit doctor` to
+  check.
+- The git guards normalize the command (stripping `git -c …` / `git -C …` global options and matching
+  force-push refspecs like `+main`) so they aren't trivially evaded — but they are **best-effort
+  regex/tokenizers, not a sandbox**. A determined operator who deliberately crafts an obfuscated
+  command (env-var indirection, `python -c`, `find -delete`) can still get past them. They exist to
+  stop *accidental* agent mistakes, not a motivated adversary who already controls the machine.
+
+## Plugin vs. CLI behavior differs before `init`
+
+- Installed as a **plugin**, `/claude-kit:sdlc <task>` works immediately. The project-scaffolded
+  `/sdlc` skill (and the project's agents/rules/hooks) only appear **after `claude-kit init` + a Claude
+  Code restart/reload**. See the plugin-vs-CLI compatibility table in the README.
+
+## Learning capture reads session content (when enabled)
+
+- With `capture_mode` enabled (the default is `session-end-catchup`), a sandboxed background job reads
+  **changed files and the session transcript tail** to distil learnings into `.claude/agent-memory/`.
+  It runs with file tools only (no Bash), **skips sensitive files** (`.env`, `*.pem`, `*.key`,
+  `id_rsa`, `credentials*`, `secrets/`, `.ssh/`, `.aws/`, …), **redacts secret-shaped values**, and
+  **caps the transcript** by lines and bytes. It still summarizes your working context — disable it
+  with `--capture-mode off` if that's not acceptable. `doctor` warns when capture is on.
+
+## MCP servers are third-party
+
+- `catalog/mcp.yaml` **references** external MCP servers (pinned to exact versions); claude-kit does
+  **not vendor or audit** them. A scheduled freshness check flags stale pins, but bumping a pin is a
+  deliberate, reviewed action. Treat each server as third-party software you are choosing to run.
+
+## Command discovery is best-effort
+
+- `init`/`upgrade` inspect a populated target for **unambiguous** package-manager signals and wire the
+  real commands into `CLAUDE.md`. Current scope: JavaScript (npm·pnpm·yarn·bun) → the install command
+  plus whichever `package.json` scripts exist (`dev`/`test`/`lint`/`build`/`typecheck`); Python
+  (uv·poetry·pdm·hatch) → the **install** command only. Task runners (make·just·task) and rewriting
+  Python *run/test/lint* commands are not yet detected — those keep the catalog defaults.
+- Discovery is fail-open and conservative (an empty target is a no-op, which keeps `init --dry-run` ≡ a
+  real install). Uncommon or bespoke setups may still need explicit overrides via `--config`; pass
+  `--no-detect-commands` to skip discovery entirely and keep the generic catalog commands.
+
+## Planned commands are not yet implemented
+
+- `package-org-pack`, `install-org-pack`, and `research import-sources` are **planned**. They are
+  hidden unless `CLAUDE_KIT_EXPERIMENTAL=1` and exit non-zero with a "planned" notice; they do not yet
+  do anything.
+
+## Upgrades are convergent and journalled, but install replace is not atomic
+
+- `claude-kit upgrade` writes an `upgrade-in-progress.json` journal, backs up modified/removed files,
+  and is convergent (a re-run finishes an interrupted upgrade; `doctor` warns if a journal is left
+  behind). However, the first-time directory install (`_copy_tree`) replaces a kit-owned subtree
+  non-atomically — an interrupted *install* (not upgrade) can leave a partial tree that a re-run
+  restores.

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/docs/coverage-audit.md

@@ -70,7 +70,7 @@ checklists that ride *inside existing* review gates. Enforcement class of each:
 | **Suite-architecture audit** | **AGENT mode — standard+** | `suite-audit` mode on `agents/senior-tester`; a verification *mode*, not a separate token | advisory (within testing) |
 | **Staff-PM product-lens review tier** | **SKILL/AGENT — organization scope only** | `staff-pm-reviewer` + `review-scope`/`review-sprint-plan`/`review-ux-flow`/`review-sprint` install only when `scope == organization` (`catalog/org.yaml`); read-only, advisory — no product gate token | org scope (advisory) |
 | **Design-system compliance · a11y/contract overlay enrichments** | **OVERLAY RULE** | `design-system-compliance.md` + enrichments in `react-patterns.md`/`fastapi-patterns.md`; install only when the matching stack is selected | when stack selected (advisory rule) |
-| **Design system · UX patterns · mobile guidelines** (0.16.0) | **OVERLAY RULE — React-gated, always-on, advisory** | `ui-design-system.md` / `ux-patterns.md` / `mobile-design-guidelines.md` (React `overlay_rules`); install into `.claude/rules/` only when React is selected, then load every session. The authoritative source for `design-system-compliance.md`'s thin pointer and `react-patterns.md`'s trimmed a11y cross-ref; consumed by the `ui-ux-design` / `component-design` skills + `ui-designer` agent | when React selected (advisory rule) |
+| **Design system · UX patterns · mobile guidelines** (0.16.0; split under the 40k limit in 0.55.0) | **OVERLAY RULE — React-gated, always-on, advisory** | `ui-design-system.md` (foundations) + `ui-components.md` + `ui-layout-and-motion.md` / `ux-patterns.md` + `ux-dashboard-patterns.md` / `mobile-design-guidelines.md` (React `overlay_rules`); install into `.claude/rules/` only when React is selected, then load every session. The authoritative source for `design-system-compliance.md`'s thin pointer and `react-patterns.md`'s trimmed a11y cross-ref; consumed by the `ui-ux-design` / `component-design` skills + `ui-designer` agent | when React selected (advisory rule) |
 
 The two that reach *enforced* (claim-audit, eval/HITL) do so the same way P0-2 did — by strengthening
 an **existing** gate's owner-agent checklist, not by minting a token. Everything else is advisory by

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/hooks/hooks.json

@@ -33,7 +33,7 @@
           },
           {
             "type": "command",
-            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command' 2>/dev/null || true); if echo \"$CMD\" | grep -qE 'git[[:space:]]+push.*[[:space:]:](main|master)([[:space:]]|$)'; then echo 'BLOCKED: refusing to push to main/master — use a feature branch and a PR.' >&2; exit 2; fi"
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-push-main.sh\""
           },
           {
             "type": "command",

{claude_code_kit-0.53.0 → claude_code_kit-0.55.0}/hooks/scripts/capture-learnings.sh

@@ -31,23 +31,23 @@ set -u
 
 MODE="${1:-end}"   # end | stop | catchup
 
-# --- opt-out + recursion guard -> silent no-op ---------------------------------------------------
-[ -n "${CLAUDE_KIT_NO_AUTOCAPTURE:-}" ] && exit 0
-command -v jq >/dev/null 2>&1 || exit 0
-command -v claude >/dev/null 2>&1 || exit 0
+TMP="${TMPDIR:-/tmp}"
 
-INPUT=$(cat 2>/dev/null) || exit 0
-[ -n "$INPUT" ] || exit 0
+# --- privacy: skip sensitive files, redact secret-shaped values, bound the payload --------------
+# Capture is ON by default and reads your session — so it must never carry credentials into
+# .claude/agent-memory/ (a committed store). Mirrors guard-secrets.sh: EXCLUDE secret-bearing file
+# paths from the changed-file list entirely, and REDACT leaked-credential VALUE shapes (not env var
+# NAMES) from anything handed to the background job. Bounds are env-overridable.
+_SENSITIVE_FILE_RE='(^|/)\.env($|\.)|\.(pem|key|p12|pfx)$|credentials?\.(json|ya?ml|md)$'
+_SECRET_VALUE_RE='-----BEGIN [A-Z ]*PRIVATE KEY-----|AKIA[0-9A-Z]{16}|sk_live_[0-9a-zA-Z]{16,}|xox[baprs]-[0-9A-Za-z-]{10,}|gh[ps]_[0-9A-Za-z]{30,}'
 
-TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
-PROJ=$(printf '%s' "$INPUT" | jq -r '.cwd // empty' 2>/dev/null)
-[ -n "$PROJ" ] || PROJ="${CLAUDE_PROJECT_DIR:-$PWD}"
-
-# Need the learnings store to write into, and a transcript path to locate work.
-[ -d "$PROJ/.claude/agent-memory" ] || exit 0
-[ -n "$TRANSCRIPT" ] || exit 0
+CAP_MAX_LINES="${CLAUDE_KIT_CAPTURE_MAX_LINES:-50}"
+case "$CAP_MAX_LINES" in '' | *[!0-9]*) CAP_MAX_LINES=50 ;; esac
+CAP_MAX_BYTES="${CLAUDE_KIT_CAPTURE_MAX_BYTES:-8000}"
+case "$CAP_MAX_BYTES" in '' | *[!0-9]*) CAP_MAX_BYTES=8000 ;; esac
 
-TMP="${TMPDIR:-/tmp}"
+# Replace leaked-credential value shapes with [REDACTED] before a blob reaches the prompt/log.
+_redact() { sed -E "s/(${_SECRET_VALUE_RE})/[REDACTED]/g"; }
 
 # --- helpers -------------------------------------------------------------------------------------
 
@@ -75,7 +75,7 @@ changed_files() {
       | select(.name? == "Edit" or .name? == "Write" or .name? == "MultiEdit" or .name? == "NotebookEdit")
       | (.input?.file_path? // .input?.notebook_path? // empty)
     ] | unique | .[]
-  ' 2>/dev/null | head -n 50
+  ' 2>/dev/null | grep -ivE "$_SENSITIVE_FILE_RE" | head -n "$CAP_MAX_LINES"
 }
 
 line_count() { wc -l <"$1" 2>/dev/null | tr -d ' '; }
@@ -87,6 +87,9 @@ line_count() { wc -l <"$1" 2>/dev/null | tr -d ' '; }
 spawn_capture() {
   local transcript="$1" changed="$2" key="$3"
   local lock log today prompt
+  # Defence in depth: redact any leaked-credential value shapes and bound the size of the
+  # changed-file blob before it reaches the prompt or the log.
+  changed=$(printf '%s' "$changed" | _redact | head -c "$CAP_MAX_BYTES")
   lock="$TMP/claude-kit-capture-$(_safe "$key").lock"
   log="$TMP/claude-kit-capture-$(_safe "$key").log"
   today=$(date -u +%Y-%m-%d 2>/dev/null)
@@ -106,6 +109,10 @@ You have ONLY the Read/Grep/Glob/Write/Edit tools — there is no shell. Create
 with the Write and Edit tools (do not attempt Bash/heredocs); writes under .claude/agent-memory/ are
 permitted.
 
+PRIVACY (mandatory): .claude/agent-memory/ is a committed store. NEVER record secrets, credentials,
+API keys, tokens, connection strings, or personal data into it. If a candidate learning can only be
+expressed by quoting such a value, skip it. Capture the durable lesson, never the secret.
+
 Steps:
 1. Read the changed files above and the tail of the transcript to understand WHAT changed and WHY.
 2. Read .claude/agent-memory/MEMORY.md and skim the matching category folder to avoid duplicates.
@@ -143,7 +150,29 @@ Steps:
   ) </dev/null >/dev/null 2>&1 &
 }
 
-# --- dispatch ------------------------------------------------------------------------------------
+# --- main: opt-out, parse input, dispatch --------------------------------------------------------
+# When sourced (e.g. by the test suite) rather than executed, stop here so only the helper functions
+# above are defined — everything below has side effects (reads stdin, spawns a background job).
+if [ "${BASH_SOURCE[0]}" != "$0" ]; then
+  return 0
+fi
+
+# --- opt-out + recursion guard -> silent no-op ---------------------------------------------------
+[ -n "${CLAUDE_KIT_NO_AUTOCAPTURE:-}" ] && exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+command -v claude >/dev/null 2>&1 || exit 0
+
+INPUT=$(cat 2>/dev/null) || exit 0
+[ -n "$INPUT" ] || exit 0
+
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+PROJ=$(printf '%s' "$INPUT" | jq -r '.cwd // empty' 2>/dev/null)
+[ -n "$PROJ" ] || PROJ="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+# Need the learnings store to write into, and a transcript path to locate work.
+[ -d "$PROJ/.claude/agent-memory" ] || exit 0
+[ -n "$TRANSCRIPT" ] || exit 0
+
 case "$MODE" in
   end)
     # The session that just ended. Capture if it edited files; mark done either way so a later