vgxness weekly downloads statistics

VGXNESS

VGXNESS is an installable, local-first governance OS and MCP/CLI control plane for existing coding agents. It governs SDD artifacts, local memory, runs, permissions, skills, provider setup, and verification evidence while OpenCode, Claude Code, and future adapters keep executing provider-native.

Release status and license

This package is proprietary software. The npm package ships inspectable JavaScript (dist/) so Node can run it, but it is not open-source licensed and may not be redistributed unless you have written permission. See LICENSE.

OpenCode is the primary supported provider. Claude Code setup support is secondary/preview guidance. VGX-managed OpenCode and Claude provider configuration is user-global only; provider config writes require explicit CLI confirmation.

VGXNESS is versioned from package.json. The latest full project health audit is the historical v1.14.x snapshot, which documents the implemented CLI/MCP/SDD governance control plane, OpenCode-first workflow, release-readiness checks, and the remaining execution/recovery gaps at that point in time. v1.10.x and v1.9.1 remain historical validation evidence for those releases.

Requirements

• Bun >= 1.3.14 for the installed vgxness/vgx CLI/MCP runtime and repository verification
• Node.js >= 22 for repository development, build, test, and helper-script tooling
• A platform supported by Bun SQLite (bun:sqlite) for runtime storage

Bun is the canonical installed runtime and verification tool. Node remains development/build/test tooling for TypeScript, node:test, and selected helper scripts; package consumer metadata (bin and files) remains part of the npm install contract.

Bun-first staged toolchain

Use Bun for development verification and CI parity:

bun install --frozen-lockfile
bun run check:bun-lock
bun run verify:typecheck
bun run verify:test
bun run verify:test:bun-storage
bun run verify:bun-sqlite
bun run verify:package
bun run package:bun:evidence -- --require-pass

bun run verify

Package evidence is Bun-only after the npm publication bridge retirement:

Area	Current owner	Why
Typecheck, tests, Bun SQLite probe, package evidence	Bun	This is the canonical CI verification path.
Package artifact and isolated install smoke	bun run package:bun:evidence -- --require-pass	It creates/inspects the artifact, validates package contents, installs in an isolated Bun environment, checks both CLI bins, and records Bun runtime identity.
Installed CLI runtime	Bun >=1.3.14	Published vgxness/vgx execute dist/cli/bun-bin.js, which records optional runtime evidence and then imports the CLI.
Lockfile review	bun.lock	The npm bridge lockfile has been retired; do not treat that as dropping npm consumer installability.

Do not remove npm package metadata, bin, or files as part of bridge cleanup; those remain the package consumer contract. The product runtime engine is engines.bun, not engines.node.

When package.json dependency specifiers change, refresh and review bun.lock intentionally. To check manifest/lock drift without mutating node_modules, run:

bun run check:bun-lock

The manual compatibility probe remains useful when diagnosing Bun/package-manager behavior:

npm run probe:bun
npm run probe:bun -- --yes   # mutates dependencies only after explicit consent

Runtime SQLite readiness is proven only with bun:sqlite. bun run verify:bun-sqlite copies the source migrations into a temporary directory, applies them against a temporary database, checks foreign keys, busy timeout, FTS/search, transaction rollback, integrity, and cleanup. Node.js remains development/build/test tooling, but real local SQLite storage is supported through the Bun runtime path.

Bun package evidence

To collect diagnostic package artifact and isolated install-smoke evidence without publishing, run:

bun run package:bun:evidence

Diagnostic mode may emit status: incompatible and still exit 0 so maintainers can inspect JSON. For release-readiness, require a passing result explicitly:

bun run package:bun:evidence -- --require-pass

The probe is the authoritative release evidence path for package contents. It does not invoke registry publication commands, writes optional JSON only where requested, records publicationAttempted: false, and reports releaseReadiness diagnostics when evaluating the gate.

It protects:

• package metadata, files, bin, license, Bun engine, README/LICENSE, docs, migrations, and shipped seed assets;
• absence of workspace-only content such as src/, test/, .opencode/, openspec/, source maps, SQLite/database files, and OS junk;
• both installed commands: vgxness --help and vgx --help.

Release-candidate checklist, still non-publishing:

1. bun install --frozen-lockfile completes on a clean checkout.
2. bun run check:bun-lock passes.
3. bun run verify:typecheck, bun run verify:test, bun run verify:test:bun-storage, and bun run verify:bun-sqlite pass.
4. bun run package:bun:evidence -- --require-pass passes on supported CI OSes.
5. JSON evidence shows status: pass, artifact/install smoke pass, no retired bridge scripts, no package-lock.json, publicationAttempted: false, and releaseReadiness.status: pass.
6. Version, release notes, proprietary license boundary, and rollback criteria are reviewed.
7. Publishing remains a separate explicit human-approved process.

This checklist does not run npm publish, bun publish, registry dry-runs that contact a registry, registry token use, provenance upload, release creation, or dist-tag mutation.

Temporary rollback if Bun package evidence misses a release regression…