ww-w-ai/bkit-claude-code

Plugin marketplace

DubDubDub Corp.'s Vibecoding Kit marketplace - PDCA methodology and AI-native development tools. Requires Claude Code v2.1.143+ for the bkit plugin (older versions reject the displayName field).

GitHub stars: 605
plugins: 2
last updated: Nov 11, 2026

View on GitHub

Add marketplace

/plugin marketplace add ww-w-ai/bkit-claude-code

Run it inside Claude Code, then install plugins from it with /plugin.

Plugins

1bkitRequires Claude Code v2.1.143+ (older versions reject the strict plugin-manifest displayName field — run `npm install -g @anthropic-ai/claude-code@latest` to upgrade; see docs/06-guide/cc-compatibility.guide.md). Vibecoding Kit - PDCA + Sprint Management + CTO-Led Agent Teams + Living Context System + 43 PM frameworks. v2.1.14 5 differentiations (Memory Enforcer, Layer 6 Defense, Sequential Dispatch, Effort-aware, Heredoc-bypass) — a sixth, PostToolUse continueOnBlock, was withdrawn in v2.1.37 (ENH-432) after the field was measured to belong to prompt-type hook definitions, which bkit has none of. v2.1.15 pdca-status.json fix. v2.1.16 4 GitHub issues (Quality Gates UX). v2.1.17 5/12~5/20 contract red 8-day class close. v2.1.18 Issues #100/#101/#102 — Sprint Trust UX Fix. v2.1.19 Quality Maturation Sprint — 5 sub-sprint master plan (S1 Self-Dogfooding Enablement / S2 Convention Restoration / S3 Sprint Report Maturity / S4 External Dogfooder Lifecycle / S5 Sprint Maturity Index) + ENH-318 차별화 7/7 정식 편입 + Real User Hall of Fame 도입 + 첫 외부 dogfooder entry @pruge. v2.1.20 Marketplace Recovery — minimum CC v2.1.143 advisory (F1+F4) + plugin manifest 21-key whitelist CI gate (F5+F6, ENH-322) + claude plugin validate wire (F7, ADR 0006 § Empirical Validation Gate) + cc-regression R3-321 (F8, ENH-321) + SessionStart CC version detection (F10, ENH-323) + ADR 0011 Plugin Manifest Schema Compliance Policy + Hall of Fame @bj (#2 external dogfooder, Lifecycle 5-stage). v2.1.21 Issue Response — Session Title Isolation (#111: per-session sessions[sessionId] cache map + GC + legacy migration + stable session tag for parallel-window disambiguation) + Sprint Output Enforcement (#113: lib/sprint/executive-summary.js sprint-shape + scripts/sprint-skill-stop.js run-export Stop hook + SKILL_HANDLERS sprint registration + advancePhase phaseTransitionSummary + /sprint status·watch human-readable display) + ADR 0012 Sprint Stop Hook Output Enforcement. v2.1.24 Skill Namespace Hardening — Issues #125/#126 (@hslee-cmyk): normalizeSkillName() canonicalizes CC `plugin:skill` form (bkit:pdca → pdca) so getSkillConfig + skill-post + implicit-trigger injection + Stop-handler dispatch resolve the bare folder; hook-reachability check no longer false-positives skill_post (event-driven vs canary correlation). v2.1.25 Claude 5 Model Alignment + Issue Response — 4-tier role-based model matrix (9 fable verification/orchestration core + 7 opus deep-reasoning/security + 16 sonnet implementers + 2 haiku monitors), dual floor (install v2.1.143 / model v2.1.170 advisory ENH-368), Claude 5 pricing sync; Issues #128 (@NEXCODE-MK: 6 deprecated pdca-eval-* stubs removed from the prompt surface → deprecation registry, ADR 0014) + #129 (@NEXCODE-MK: agent description token diet −44%, compact 8-language triggers) + #130 (@s99606931: learning-stop.js piped-stdin isTTY gate fix). v2.1.26 MCP Manifest Relocation + Fable Cost Retune — fixes the /plugin 'Needs attention: bkit MCP failed' defect (repo-root .mcp.json dual-loaded as plugin manifest + project config where CLAUDE_PLUGIN_ROOT is undefined; now declared inline in plugin.json, root file deleted, regression-locked MS-016) + release-plugin-tag.sh drift fix + full test-state isolation refactor (projectRoot injectable through batch-orchestrator/sprint-registry/audit-logger; tests no longer leak fixtures into the real .bkit) + ADR 0011 amendment/ADR 0015 (locale-scoped deferral)/eval re-baseline SOP + Fable cost retune (ENH-370: high-frequency PDCA verifiers gap-detector/design-validator/pdca-iterator fable→opus for cost → 6 fable / 10 opus / 16 sonnet / 2 haiku). v2.1.27 Slash-Path Orchestration Restored — Issue #132 (@hslee-cmyk): bkit's four orchestrator side-effects (next-skill/agent guidance, PDCA phase auto-advance, decision-trace phase_transition, audit skill_executed) were wired only to PostToolUse:Skill, which never fires on native slash commands (/bkit:pdca ...) — the only invocation form bkit's docs teach — so the advertised audit trail was empty for real usage; ENH-371 dual-wires the effects into a source-agnostic module fired from BOTH PostToolUse:Skill AND a new fail-open UserPromptExpansion hook (slash path records a new skill_invoked action), plus repays two latent defects (dead IntentRouter onboardingContext ReferenceError + slash-path Stop-handler marker) — graceful degradation on CC without UserPromptExpansion, no version floor bump. v2.1.28 Runtime-Phase-Aware Skill Guidance — Issue #135 (@hslee-cmyk), the narrower follow-up to #132: the next-step GUIDANCE-TEXT half of the same UserPromptExpansion mechanism never fired for multi-action routers (pdca/sprint/+9) because orchestrateSkillPost derived suggestions only from STATIC frontmatter (next-skill/pdca-phase), which those routers declare null by design. Root fix: new lib/orchestrator/runtime-guidance.js resolves the phase at call time from args.action + live PDCA/Sprint state and REUSES the manual-path SSoT (getNextPdcaActionAfterCompletion / buildNextActions) — no duplicated phase table; wired at the shared runSkillInvocationEffects chokepoint so BOTH slash and Skill-tool paths surface guidance; fail-open; only pdca/sprint eligible (9 utility routers stay intentionally silent); suggestedAgent extended (design→design-validator, qa→qa-lead); hardcoded Korean guidance strings migrated to EN-default + KO via i18n detector. 23-TC regression test, 0 main-baseline regressions. v2.1.29 PDCA Predecessor-Task Completion — Issue #137 (@hslee-cmyk): the `pdca` skill chains phase Tasks via `blockedBy` ([Plan]→[Design]→[Do]→…) but SKILL.md documented Task creation only, never predecessor completion, so a prior-phase Task left `in_progress` leaked a stale phase (e.g. "design" during "do") into Claude Code's ambient prompt context — disagreeing with `.bkit/state/pdca-status.json`'s phase (the phase source of truth). The issue's Option-2 (a hook auto-completing the predecessor) is technically infeasible — CC hooks communicate via stdout/exit-code/additionalContext only and cannot call TaskUpdate; only the model can — so v2.1.29 applies Option-1: every phase action now instructs the model to mark predecessor Task(s) `completed` before creating the next phase Task, and a new `## Task Integration` Phase Transition Rule codifies the completion semantics + rationale; a regression test guards each transition. Cosmetic/informational fix, zero runtime/architecture-count change. v2.1.30 Stop-Hook stdin-Block Hardening — Issue #139 (@thenopen, found via Claude Code /doctor): every bkit hook reads its payload through lib/core/io.js readStdinSync(), which used fs.readFileSync(0) — a blocking stdin read with NO timeout that returns only at EOF, so a hook stalls for as long as Claude Code keeps the stdin write-end open (the turn-gating Stop hook unified-stop.js was observed stalling up to ~15.5 min, far past its own 10s timeout). Reproduced: payload sent + pipe held open 4s → 4.07s block with flat CPU (I/O-blocked, matching the reporter's low-CPU tail). Central fix (all 36 hook scripts): readStdinSync now reads incrementally with parse-early and returns the instant the buffer holds a complete JSON value, never waiting for EOF; the turn-gating unified-stop.js additionally uses a new async readStdinBounded (parse-early + hard timeout that destroys stdin on resolve) so it is fully bounded even for no-data/truncated held-open pipes; state-store lock() CPU-burning busy-wait spin replaced with a no-CPU Atomics.wait sleep. 16-TC regression test, 0 main-baseline regressions, architecture counts invariant. v2.1.31 CC v2.1.218 Fork Background-Default Compat — the 8 `context: fork` producer skills add `background: false` to opt out of CC v2.1.218 background-by-default; qa-phase leaves the fork set to run in the main context (AskUserQuestion is stripped at the fork sub-agent boundary, CC #34592/#54892); the Invocation Contract runner gains a `contextChanges` allowance (deprecation-registry.json, ADR 0014 pattern — baseline JSON immutable); CC recommended v2.1.220. Skill-frontmatter-only, architecture counts invariant. 🚀 bkit Early Adopter Program — running bkit on a non-trivial production project + filing detailed bug reports makes you part of bkit's quality system: public Hall of Fame recognition, E2E regression test absorption, Trust Score externalDogfoodFeedbackResponseRate component (weight 0.05). 44 Skills, 34 Agents (6 pdca-eval-* registry-tombstoned per ADR 0014), 63 Scripts, 200 Lib Modules, 21 Hook Events (24 blocks), 40 Templates, 4 Output Styles, 2 MCP Servers (19 tools, declared inline in plugin.json), 14 ADR invariants. v2.1.36 Guardrail Precision — external dogfooder @Sinclair-Seo (issue #148) reported three Destructive Detector rules refusing safe commands; auditing all 16 measured the defect at ~3x the report and found the same root cause producing FALSE NEGATIVES (`chmod 777 / ; ls` was detected by nothing at all). Rules are now matched per command segment instead of against the whole input, so a chained command cannot lend its tokens to a neighbour — 12 measured false positives to 1 (an intended grading change: a scoped find-delete now asks instead of denying, matching G-001), 3 false negatives to 0, every negative control intact. G-004 stops matching git plumbing (merge-base/merge-tree/merge-file), G-013 grades by target like G-001, G-006 ignores metadata-only listing, G-007 stands down on SQL statements. the refusal message names only recourse that exists AND fits the rule that fired (the first attempt rewrote a function with no production callers, so nothing changed for anyone; the text users see is built in the hook). Auditing the whole hook path rather than one module also found `bash <<EOF … rm -rf / … EOF` being ALLOWED, a push guard refusing `git push origin feature-x && rm -f note.txt` as a force push, and every `ask` the push guard computed being emitted as a refusal. ADR 0016 records that guardrail rules are immutable at runtime — deliberately, not by omission. Config drift closed in both directions: 5 getConfig() paths that never resolved to 1 (verified benign), 27 keys read by nobody to 13, each now documented in the file with its reason. Suite 3835/3839 PASS 0 FAIL (+41 TC, verified failing against the pre-fix tree). v2.1.37 Permission-Mode Awareness — Claude Code sends `permission_mode` on every hook event and bkit read it in ZERO places (`grep -rn permission_mode scripts lib hooks` returned nothing), so all ten decision surfaces behaved identically whether the session had asked for maximum oversight or had run `--dangerously-skip-permissions`. Not a CC defect: PreToolUse hooks run BEFORE the permission prompt, proven with a bkit-free project whose single ask-hook stopped a bare `echo` in bypass mode on CC v2.1.231. The cost is that a PreToolUse question needs a human answer and an unattended run has none, so the agent stalls instead of failing. New pure domain module lib/domain/policy/permission-mode-policy.js holds the whole decision table; the ask tier stands down in bypassPermissions/dontAsk/acceptEdits while `critical` refusals and the user's own CLAUDE.md directives hold in every mode — the line is the decision's GRADE, the same line CC draws by keeping a circuit breaker on `rm -rf /` in bypass. Measured 7 modes x 21 commands: benign commands stopped 14 to 0, negative controls 49/49 intact. Five coupled defects shipped with it: the phase-9 guard refusing on the bare substrings `--force`/`production`, the QA guard's private 9-entry rule table (which refused `rm -r ./tmp` and missed `chmod 777 /`) deleted in favour of the shared detector, ENH-263 fed from a payload field CC has never sent so it had not fired once since v2.1.10, `removeWhen(ccVersion)` declared by two guards and called by nothing, G-007 matching the WORD `delete` so `grep -rn delete a b c d e` asked for confirmation, and a `grep` for a dangerous string graded as performing one. 148 test files that ran in neither the local runner nor CI were adopted — 147 passed, and the one that failed was catching this release's own doc drift. v2.1.38 QA Measurement — the QA phase reported success while producing nothing the quality gate could read, and none of it could surface as a failing run. No Stop handler had ever seen its hook payload: unified-stop reads stdin with a reader that destroys it on resolve (deliberate, issue #139) and then dispatches handlers with require() in the same process, so the parent saw the payload and every child saw {} — measured with a two-file harness reproducing the dispatch. qa-phase-stop then called .match() on that parsed object, throwing on its first pattern into its own catch, so M11-M15 were never written on any run since v2.1.1; analysis-stop and qa-stop regexed their own hardcoded guidance string, so M2 was always the 75 baseline and M5 always 0; gap-detector-stop, iterator-stop and pdca-skill-stop regexed the hook ENVELOPE (hook_event_name, session_id, transcript_path, cwd), which contains none of the signals they look for. io.js now hands the payload it already read to the later reader and readHookText() resolves it to the assistant's reported text via transcript_path. The qa gate had required qaCriticalCount === 0 since v2.1.1 with no metric ID producing that name, and an absent metric is unsatisfied, so the gate could never return pass and QA could not advance to Report regardless of test results — M16 supplies the metric, the gate is unchanged. Chrome MCP detection read MCP_SERVERS, which Claude Code does not set, so L3-L5 were skipped on 100% of runs while qa-lead's docs called that skip normal fallback; detection is now layered behind a runtime probe qa-lead records. act -> qa (QA_RETRY) was defined and emitted by nothing and its counter never advanced, so the escape hatch from the qa <-> act loop could not fire. An unmeasured match rate defaulted to 0, which isMeasured() accepts as real, turning a parse failure into a recorded regression. qa-test-planner had Write on its disallowed list while its role is producing test plan documents; the pre-release scanner scanned bkit instead of the caller's project. 78 new TC across three regression suites, suite 5355 TC 0 FAIL, live hooks 23/23.2.1.41version

2bkit-starterKorean learning guide for Claude Code beginners. No programming experience required. Includes 4 learning commands.1.0.0version

Details

Repository: github.com/ww-w-ai/bkit-claude-code
Categories: learning, development
Listed since: Nov 11, 2026