README
¶
Výbava
Výbava is FixIt Technologies' portable engineering environment: small tools, agent skills, and workstation diagnostics, distributed as one catalog where every item installs independently.
Packages
| ID | Kind | What it does |
|---|---|---|
memorylint |
applet | Validate and maintain AI memory homes — schema, indexes, wikilinks, fixtures, write hooks. → docs/memorylint.md |
claude-guards |
applet | PreToolUse guard hooks for Claude Code — destructive git/docker, secret dumps, host-input automation, commit secrets, whole-disk walks, per-look Appium sessions, uncapped local test runners, and the context-budget rules (no shell-rewritten files, no whole-file dumps, no transcript reads). → docs/claude-guards.md |
lok |
applet | Locale catalogs for AI sessions — configured in vybava.config.ts, queried by key, written by verb with every locale kept in sync, extracted from source, gated in CI. → docs/lok.md |
vybava config |
verb | The shared per-repo vybava.config.ts every applet reads — init scaffolds it with typed helpers, check gates CI, show prints the evaluated JSON. → docs/config.md |
shrt |
applet | Terminal-safe short links on luko.to — offline repo rules, team-shared dynamic rules, minted codes; also the redirector server. → docs/shrt.md |
posta |
applet | Drive a shared test mailbox end to end — mint a per-run plus-address, wait for the mail a journey triggered, take its links and attachments. → docs/posta.md |
fontfreeze |
applet | Freeze variable webfonts at rendered axis positions and subset per language. |
perfrig |
applet | Performance drills from a testing/<project>/perf manifest — ramp to first failure, percentile report. |
ingressgen |
applet | Render and drift-check complete default-deny Docker ingress policies from a manifest. |
reconcile |
applet | Pull-based GitOps for the infra boxes — converge a VPS to its infra repo's merged main from a per-box manifest: HELD hotfixes, transactional nginx hooks, commit rollback, textfile metrics, mesh-only status page + estate hub. → docs/reconcile.md |
prm / prc / merge |
skills | PR create → review-resolve → gated merge workflows for Claude Code and Codex. |
codexsync |
applet | Render ~/.claude skills and commands into ~/.agents/skills, the structure Codex discovers — nesting preserved, each command a source-command skill, duplicate discovery suppressed. → docs/codexsync.md |
codexusage |
applet | Explain where the Codex plan limit went — per-thread spend from ~/.codex rollouts, the derived allowance, and the runway left at the measured burn rate. → docs/codexusage.md |
repolicy |
applet | Hold GitHub repository settings to a declared policy across whole owners — GitHub inherits no organization default, so audit reports the drift (exit 1) and apply converges it, touching only the settings the policy names. → docs/repolicy.md |
menubar-doctor |
applet | Find and fix macOS menu-bar items that run but never appear — since macOS 26 Control Center files a status item under the process that launched the app, so anything started from a terminal is filed under the terminal and stays invisible while its switch is off. → docs/menubar-doctor.md |
reclaim |
applet | Emergency disk reclaim for a dev Mac — a fixed ladder of regenerating caches deleted biggest-first with live df after every step, an early-stop target, and by-hand notes for what it refuses to touch. → docs/reclaim.md |
macwatch |
applet | Mac load sampler with owner attribution - append load, memory and the heaviest processes to a TSV every interval, each tagged with project, directory and the claude/codex session that spawned it; report integrates the file into offenders, per-project and per-session totals and a spike ledger. → docs/macwatch.md |
plugin-gc |
applet | Garbage-collect the Claude Code plugin cache — every version ever installed is kept behind a PID refcount that abandoned sessions never release, and the payload is almost all node_modules; reports by default, deletes only on --apply. → docs/plugin-gc.md |
handoffs |
applet | Handoff ledger upkeep — handoffs reconcile judges every open handoff by whether its branches and PRs are still alive and archives the dead ones; unknown is never touched. → docs/handoffs.md |
press |
applet | Deterministic state for the document family — project resolution, ~/Exports/<project>/ config and index, ARES lookups, shared doctrine. → docs/press.md |
press-pdf / press-logo / press-offer / press-email |
skills | Offer, documentation and legal PDFs; brand marks; Czech commercial DOCX; Outlook-paste client emails. Issuer identity stays machine-local. → docs/press.md |
Groups (recommended, experimental, ai-git, press-family, everything)
are composable presets in the catalog — never code.
Install
Homebrew (everything is public — no authentication needed):
brew install --cask FixIt-Technologies/tap/vybava
CI images, workflows and provisioning scripts use the release installer in
ci/ — never a checkout of this repository:
curl -fsSL -o /tmp/vybava-install.sh \
https://raw.githubusercontent.com/FixIt-Technologies/vybava/v0.3.3/ci/install.sh \
&& bash /tmp/vybava-install.sh --version 0.3.3 --bin-dir /usr/local/bin --install memorylint,hotfix
From source:
go build -o ./bin/vybava ./cmd/vybava
./bin/vybava catalog list
./bin/vybava install recommended
install takes item or group selectors (default: the recommended group)
and supports --agent claude|codex|all,
--scope user|project, --dry-run, and --json. Installed applets are links
to the vybava binary, so vybava memory lint . and memorylint . are
equivalent.
Layout
catalog/catalog.yaml package and group source of truth
cmd/vybava/ multicall entrypoint
internal/<id>/ one focused Go package per capability
skills/<id>/ canonical cross-agent skill payloads (SKILL.md plus any
references/ and assets/ the skill ships)
docs/ per-tool references, release flow, decisions
Dockerfile the luko.to redirector image (deployik app "luko")
Extending
One payload + one catalog entry = one package; presets are one more catalog line. Contract: docs/decisions/0001-modular-catalog.md · checklist: CONTRIBUTING.md · releases: docs/homebrew.md.
Documentation
¶
Overview ¶
Package assets exposes Výbava's versioned catalog and installable payloads.
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var FS embed.FS
FS is the immutable payload shipped inside the Výbava binary.
The bare "skills" pattern walks the whole payload tree — a skill is not always a lone SKILL.md; press-pdf ships references/ and an assets/ pipeline. Without the all: prefix Go skips _ and . prefixed entries, which keeps __pycache__ and editor droppings out of the binary for free.
Functions ¶
This section is empty.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
vybava
command
|
|
|
internal
|
|
|
claudeguards
Package claudeguards is the single-binary PreToolUse enforcement for the hard bans in ~/.claude/CLAUDE.md: destructive git/docker calls, secret and environment dumps, host-input automation, /e2e screenshot hygiene, commit-time secret scanning, the three machine-health rules (whole-disk walks, per-look Appium sessions, uncapped local test runners) — and the context-budget rules that keep an agent from dumping whole files or rewriting them through the shell.
|
Package claudeguards is the single-binary PreToolUse enforcement for the hard bans in ~/.claude/CLAUDE.md: destructive git/docker calls, secret and environment dumps, host-input automation, /e2e screenshot hygiene, commit-time secret scanning, the three machine-health rules (whole-disk walks, per-look Appium sessions, uncapped local test runners) — and the context-budget rules that keep an agent from dumping whole files or rewriting them through the shell. |
|
codexsync
Package codexsync renders the Claude Code personal home (skills and commands) into the structure Codex actually discovers.
|
Package codexsync renders the Claude Code personal home (skills and commands) into the structure Codex actually discovers. |
|
codexusage
Package codexusage explains where a Codex CLI plan limit went.
|
Package codexusage explains where a Codex CLI plan limit went. |
|
configdiscover
Package configdiscover composes lok parsing and vconfig without making the config loader depend on its consumers.
|
Package configdiscover composes lok parsing and vconfig without making the config loader depend on its consumers. |
|
envbridge
Package envbridge transfers an explicit environment through a private, short-lived Unix socket.
|
Package envbridge transfers an explicit environment through a private, short-lived Unix socket. |
|
fontfreeze
Package fontfreeze freezes variable webfonts at the style positions a site actually renders, then subsets them to the languages it actually sets.
|
Package fontfreeze freezes variable webfonts at the style positions a site actually renders, then subsets them to the languages it actually sets. |
|
handoffs
Package handoffs keeps the handoff ledger honest: it decides which open handoffs under `~/.claude/handoffs` still have a branch or pull request alive and archives the rest — done when the work merged, abandoned when it simply stopped.
|
Package handoffs keeps the handoff ledger honest: it decides which open handoffs under `~/.claude/handoffs` still have a branch or pull request alive and archives the rest — done when the work merged, abandoned when it simply stopped. |
|
hotfix
Package hotfix drives one release-lineage hotfix end to end: a branch cut from the tag production runs, an isolated worktree, a PR against the default branch (the forward-port), a production deploy dispatched ON the hotfix branch, and the merge that lands the fix — and its tag — on main.
|
Package hotfix drives one release-lineage hotfix end to end: a branch cut from the tag production runs, an isolated worktree, a PR against the default branch (the forward-port), a production deploy dispatched ON the hotfix branch, and the merge that lands the fix — and its tag — on main. |
|
ingressgen
Package ingressgen renders a complete, default-deny DOCKER-USER ruleset from a small YAML manifest.
|
Package ingressgen renders a complete, default-deny DOCKER-USER ruleset from a small YAML manifest. |
|
lok
Package lok owns locale catalogs for AI-driven sessions: a JSON catalog is never read whole — it is queried by key, written by verb, and kept in sync across locales by construction.
|
Package lok owns locale catalogs for AI-driven sessions: a JSON catalog is never read whole — it is queried by key, written by verb, and kept in sync across locales by construction. |
|
macwatch
Package macwatch samples what is loading a Mac and attributes every heavy process to a project, a directory and the Claude/Codex session that owns it.
|
Package macwatch samples what is loading a Mac and attributes every heavy process to a project, a directory and the Claude/Codex session that owns it. |
|
memo
Package memo is the append-only memory ledger: LEDGER.md holds every row ever written, MEMORY.md is rendered from it (pinned, then usage score, then newest), usage.jsonl records the citations a session actually made.
|
Package memo is the append-only memory ledger: LEDGER.md holds every row ever written, MEMORY.md is rendered from it (pinned, then usage score, then newest), usage.jsonl records the citations a session actually made. |
|
menubar
Package menubar diagnoses and repairs macOS menu-bar items that run but never appear.
|
Package menubar diagnoses and repairs macOS menu-bar items that run but never appear. |
|
operator
Package operator records observations, Codex delivery receipts and human-rated proposals.
|
Package operator records observations, Codex delivery receipts and human-rated proposals. |
|
perfrig
Package perfrig is the reusable performance-drill orchestrator behind the `testing/<project>/perf/` convention.
|
Package perfrig is the reusable performance-drill orchestrator behind the `testing/<project>/perf/` convention. |
|
plaud
Package plaud talks to the Plaud developer API directly: OAuth 2.0 authorization-code + PKCE for the public client, a short-lived access-token cache, and the handful of read-only data calls the retired @plaud-ai/mcp server wrapped (files, notes, transcript blocks, current user).
|
Package plaud talks to the Plaud developer API directly: OAuth 2.0 authorization-code + PKCE for the public client, a short-lived access-token cache, and the handful of read-only data calls the retired @plaud-ai/mcp server wrapped (files, notes, transcript blocks, current user). |
|
plugingc
Package plugingc keeps the Claude Code plugin cache honest.
|
Package plugingc keeps the Claude Code plugin cache honest. |
|
posta
Package posta drives the shared AI test mailbox — the one inbox an agent may read end to end.
|
Package posta drives the shared AI test mailbox — the one inbox an agent may read end to end. |
|
press
Package press is the determinism layer of the press skill family (press-pdf, press-logo, press-offer, press-email).
|
Package press is the determinism layer of the press skill family (press-pdf, press-logo, press-offer, press-email). |
|
reclaim
Package reclaim is the emergency disk reclaimer: when a dev Mac is minutes away from processes crashing on a full disk, it must free the most space in the fewest seconds, visibly, without asking anything.
|
Package reclaim is the emergency disk reclaimer: when a dev Mac is minutes away from processes crashing on a full disk, it must free the most space in the fewest seconds, visibly, without asking anything. |
|
reconcile
Package reconcile is the pull-based GitOps engine for the infra boxes: a cron tick pulls origin/main into a clone and converges the mapped files onto the box.
|
Package reconcile is the pull-based GitOps engine for the infra boxes: a cron tick pulls origin/main into a clone and converges the mapped files onto the box. |
|
repolicy
Package repolicy converges GitHub repository settings to a declared policy.
|
Package repolicy converges GitHub repository settings to a declared policy. |
|
runx
Package runx is the AI-first envelope contract shared by Výbava applets: one versioned JSON document per invocation under --json, a closed diagnostic vocabulary, and real exit codes.
|
Package runx is the AI-first envelope contract shared by Výbava applets: one versioned JSON document per invocation under --json, a closed diagnostic vocabulary, and real exit codes. |
|
shrt
Package shrt shortens long URLs into terminal-safe luko.to forms and serves the redirector that expands them back.
|
Package shrt shortens long URLs into terminal-safe luko.to forms and serves the redirector that expands them back. |
|
vconfig
Package vconfig loads the shared per-repository Výbava configuration: vybava.config.ts (evaluated by bun, the repo's TypeScript is the source of truth) or vybava.config.json (the same shape, for machines without bun).
|
Package vconfig loads the shared per-repository Výbava configuration: vybava.config.ts (evaluated by bun, the repo's TypeScript is the source of truth) or vybava.config.json (the same shape, for machines without bun). |
|
worktime
Package worktime provides metadata-only workstation activity observations.
|
Package worktime provides metadata-only workstation activity observations. |
Click to show internal directories.
Click to hide internal directories.