release: v0.11.0 — deep audit, 5 new MCP tools, /outdated + /arch-check, Windows-first hooks - #21
Merged
Merged
Conversation
post-edit-format silently no-opped on backslash paths and infinite-looped at drive roots, so the flagship auto-format hook never worked on Windows. pre-bash-guard grepped the entire JSON payload when jq was absent (the Windows default), blocking benign commands whose payload merely mentioned a dangerous pattern, and wrote block reasons to stdout where Claude never saw them. jq-first extraction with sed fallback, path normalization, fixed-point walk guard, stderr redirects, widened rm allowlist for bin/obj variants, and shellcheck cleanups across all seven scripts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The audit found bugs CI could have caught: hooks broken on Windows, count drift between docs and the tree, cross-references that only warned. New windows-latest job runs the hook scripts under Git Bash with real JSON payloads; shellcheck over all scripts; docs-count, cross-tool parity, and version-consistency checks; cross-reference failures now fail the build; frontmatter validated with a real YAML parser accepting the new optional agent fields; NuGet release body computes the tool count instead of hardcoding it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The server pinned ModelContextProtocol 0.2.0-preview.1 — a dead preview from before the SDK went GA — violating the kit's own no-previews rule. Upgraded to 1.4.1 stable with all analyzer/build/test packages current and Central Package Management introduced. New tools (15 -> 20), each capped and read-only: get_symbol_source (bounded source of one member — kills the read-the-whole-file token leak), get_file_outline, get_nuget_packages (CPM-aware, no network), get_endpoint_map (routes + auth posture), get_di_registrations (lifetimes, duplicates, captive-dependency risks). Fixes: multi-target TFM misreport (net10.0;net8.0 flavors), workspace permanently bricked after a transient reload failure, absolute paths leaking from find_implementations, dead-code false negatives from substring matching, uncapped get_diagnostics/find_symbol/find_callers responses. Internal code now follows the kit's own rules (primary constructors, sealed, TimeProvider). 163 tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…isions The always-loaded modern-csharp skill taught pre-ship C# 14 extension syntax; docker's HEALTHCHECK relaunched the app; opentelemetry's setup triggered the exact exception its own anti-pattern warns about; testing claimed xUnit v3 with v2 signatures; security-scan mislabeled OWASP categories on the retired 2021 list; project-setup collided with three other skills and carried a conflicting grading scale. All fixed. FluentAssertions replaced with xUnit Assert kit-wide (v8+ is commercial). Three oversized pipeline skills converted to workflow format with references/ (security-scan 381->121). Aspire deployment stance, JsonWebTokenHandler, Polly v8 telemetry API, GH action versions, and illustrative package pins brought current. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
package-recommendations listed Wolverine at 3.x (actual: 6.x — it is the kit's recommended default), wrong Aspire package names four majors behind, and no assertion-library stance while the kit's own examples used commercial FluentAssertions syntax. dotnet-whats-new contradicted the kit's MediatR/MassTransit licensing warnings and pointed at nightly container images. All rows re-verified against NuGet/Microsoft Learn on 2026-07-22; new Assertions and Object Mapping (Mapperly) sections; new .NET 11 Preview Watch section with an explicit don't-generate-net11.0 guard; 10->11 breaking-changes placeholder ahead of November GA. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…tter Rules were 11% over their 600-line always-loaded budget — removed tables that duplicated their own DO/DON'T content (now exactly 600). Agents gain current Claude Code capabilities: memory: project on the five specialists so they learn conventions across sessions, a read-only code-reviewer (disallowedTools), and worktree isolation on refactor-cleaner. Fixed the phantom rules/dotnet/ path in CLAUDE.md and CONTRIBUTING.md (moved in v0.6.0), the repository-pattern example in test-engineer that violated the kit's own architecture rule, and template ghosts (nonexistent benchmarks skill, wrong module path). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
.codex and .opencode listed 9 of 10 rules (packages.md missing) and pointed at the phantom rules/dotnet/ path; shorthand-guide claimed 14 workflows but listed 13 (/dotnet-init missing). The launch SPEC and the March skill-benchmark report described a repo that no longer exists — banner-stamped as historical rather than rewritten, since both are kept for context, not guidance. mcp-configs now documents the root .mcp.json auto-discovery as the preferred pattern. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
/outdated: dependency health in one report — inventory via the new get_nuget_packages MCP tool (no network), staleness and CVEs via the dotnet CLI, and a commercial-license trap screen so an innocent update-all never silently crosses the MediatR/MassTransit/ FluentAssertions/AutoMapper licensing boundaries. This audit itself proved the need: the kit's own docs had drifted two majors on its recommended packages. /arch-check: architecture conformance against the declared baseline (VSA, Clean, DDD, Modular Monolith) — dependency direction from get_project_graph, cycles, namespace leak probes, and presentation boundaries from get_endpoint_map. The kit now enforces the architectures it recommends. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deep-audit release. README showcases the new capability set (bounded MCP analysis, architecture enforcement, dependency health, agent memory); counts, slash-command and tool tables updated everywhere; .mcp.json declares explicit stdio type; full changelog entry documents the audit findings and fixes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Full-kit deep audit (6 parallel audit passes: platform currency, all skills, structure, .NET ecosystem, MCP server, hooks/configs) followed by fixes and new features. Everything verified against current Claude Code docs and the live NuGet/.NET ecosystem as of 2026-07-22.
Includes and supersedes #20 (branched from it) — merge this and #20 closes automatically, or merge #20 first.
Critical fixes
New features
get_symbol_source,get_file_outline,get_nuget_packages,get_endpoint_map,get_di_registrations/outdated— package staleness + CVEs + commercial-license trap screen/arch-check— architecture conformance (dependency direction, layer violations, module leaks, cycles)memory: project) on 5 specialists; read-only code-reviewer; worktree-isolated refactor-cleanerContent currency
Knowledge docs re-verified against NuGet/Microsoft Learn: Wolverine 3.x→6.x, Aspire rewrite (correct packages, v13, polyglot), MediatR 14 + licensing, MassTransit v9 released, xunit.v3 3.x, and more. Rules trimmed to exactly their 600-line budget.
Test plan
dotnet build0 warnings, 163/163 tests green,dotnet formatcleantools/listreturns 20 tools; real calls verified for new tools🤖 Generated with Claude Code