@dain-os/claude-tooling

CLI that syncs .claude/ assets — instructions, skills, agents, commands, hooks — from the DainOS library (Supabase claude_instructions_library + dev_knowledge_base) into any target repository.

Installation

npx @dain-os/claude-tooling init

Commands

| Command | Purpose | |---------|---------| | dain-claude init | Initialise .claude/ in a repo by selecting items from the DainOS library. Installs the auto-sync workflow unless --skip-workflow is passed. | | dain-claude upgrade | Pull newer versions of installed items | | dain-claude add | Add a single library item by slug | | dain-claude doctor | Diagnose .claude/ drift and suggest fixes | | dain-claude install-workflow | Install (or --force overwrite) .github/workflows/sync-claude-tooling.yml — auto-sync existing repos that ran init before v0.2.0 |

Auto-sync workflow

init writes .github/workflows/sync-claude-tooling.yml by default. Once a day (08:00 UTC), the workflow runs dain-claude upgrade, opens a PR with any drift between the repo's .claude/ tree and the live library, and enables auto-merge with --squash. The PR merges itself when required checks pass.

One-time setup per repo:

1. Add a repo secret called CLAUDE_TOOLING_PAT — a fine-grained PAT with contents:write + pull-requests:write on the repo. Without it the workflow opens PRs but the default GITHUB_TOKEN won't trigger CI on them, so auto-merge waits forever.
2. Settings → General → enable "Allow auto-merge".
3. Branch protection on main must require at least one status check.

To skip the workflow at install time: dain-claude init --skip-workflow. To retrofit a repo initialised before v0.2.0: dain-claude install-workflow.

Governance

Every item in claude_instructions_library carries a lifecycle status:

• active — safe for production use, installed by default
• draft — work-in-progress, not installed by the CLI (authors edit via the DainOS web UI)
• deprecated — scheduled for removal, never installed, warned in doctor

V1 installs only active items. A --include-draft flag is planned for V0.2.

Security

The Supabase anon key is embedded in the published binary. Row-level security is disabled on claude_instructions_library and dev_knowledge_base, so anyone who installs this package can read every row across every Dain project. This is an accepted trade-off: the library is Dain-internal reference material, and a per-repo service-role flow would add friction far above the sensitivity of the data.

Do not store secrets, client PII, or commercially sensitive material in these tables.

Development

npm install              # from repo root — registers the workspace
cd packages/claude-tooling
npm run build            # emits dist/cli.js
npm run dev              # watch mode
npm run check-types      # tsc --noEmit

The CLI entrypoint is bin/dain-claude.js, which loads the compiled dist/cli.js.

Troubleshooting

init failed midway — how do I recover?

dain-claude init is transactional: if it throws mid-run, it rolls back its own writes before exiting. You should see lines on stderr like rollback: removed .claude/ (created this run).

Re-run dain-claude init after fixing the underlying error — no flags or manual cleanup needed.

If you ran with --force and the rollback itself hit a problem, a .claude.bak/ (and possibly .dain-tooling-manifest.json.bak) will be preserved at the repo root as a manual recovery copy. Inspect it, restore what you need, then delete the .bak paths before re-running.