v0.4.0

Added

• Dry behavior benchmark gate (npm run benchmark:behavior:gate) with score
  thresholds, included in npm test.
• Dependency manifest extraction for root npm lockfiles, Maven pom.xml, NuGet
  project files, editable Python requirements, and Cargo package aliases.
• buy-vs-build init CLI for installing AGENTS.md, .buyvsbuild.json, and
  the GitHub dependency-review workflow into another repository.
• Reusable GitHub Action at .github/actions/dependency-review.
• Distribution docs with launch messaging and an example dependency-review PR
  comment.

Changed

• Strict .buyvsbuild.json mode now fails the PR dependency review when new
  dependencies lack a decision note, while still posting the explanatory PR
  comment.
• Tests now use Node's built-in test discovery instead of a hand-maintained
  test-file list.
• Dependency report lookup failures now distinguish missing packages, rate
  limits, service outages, and network failures.
• PR review and dependency audit now use the shared manifest detector, so dynamic
  manifest types such as NuGet project files are actually included.
• Maven manifest extraction now ignores dependencyManagement entries so version
  constraints are not mistaken for directly owned dependencies.

v0.3.0

Buy vs Build 0.3.0 closes the loop from advice → enforcement → evidence → memory. Five new features, plus a behavioral nudge — all zero-runtime-dependency.

Highlights

• PR check now posts evidence, across ecosystems. The dependency check diffs package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, and Gemfile — not just npm — and for each newly added dependency posts deps.dev / OSV / OpenSSF Scorecard signals and a license-compatibility check, alongside the decision-note nudge.
• Right-tool reference skill ($buy-vs-build-right-tool). On-demand decision tables for the traps the benchmark targets — SSE vs WebSockets, SQL vs NoSQL, cron vs queue, REST vs GraphQL, webhook vs polling, and more — organized around the distinguishing requirement (directionality, volume, latency, consistency, failure mode). Kept out of the always-injected rule so the rule stays lean.
• Whole-repo dependency audit (npm run audit:deps). Ranks every direct dependency by ownership risk and names the lower rung you could drop to — the left-pad story, run against what you already own.
• Revisit tracker (npm run revisit). Surfaces ADRs whose date- or dependency-version-based revisit trigger has fired, and flags free-text triggers for a human or LLM to judge. The back half of the ADR loop.
• License-compatibility guard. A coarse copyleft-into-permissive/proprietary check (it surfaces, it doesn't adjudicate), wired into the dependency report, the audit, and the PR check.
• Verify the choice paid off. The rule and the main/review skills now nudge a post-implementation check: did the choice actually cut code, failure modes, and operating burden — not just name the right option? A sound choice can still be integrated badly, and the decision note is the artifact that makes the tradeoff reviewable. (Thanks to the Reddit feedback that prompted this.)

Under the hood

New shared, dependency-free modules scripts/manifests.js (name-only manifest extractors) and scripts/license-compat.js. Tests added for every feature; the suite stays at zero runtime dependencies.

Full changelog: v0.2.0...v0.3.0

v0.2.0

Buy vs Build grows from "don't reinvent it" into a full decision system: pick the right tool, research what you adopt, adapt to your project, and leave a trail — across every agent.

New capabilities

• Picks the right tool, not the flashy one. A fit-over-reputation rule + the $buy-vs-build skill match the option to the requirement (SSE vs WebSockets, SQL vs NoSQL, cron vs queue), instead of the most powerful/popular/familiar default.
• Researches a dependency before you own it — for any language. The new $buy-vs-build-dependency skill applies a best-in-class checklist (Russ Cox's "Our Software Dependency Problem"; the OpenSSF "Concise Guide"), and scripts/dependency-report.js pulls automatable health/security signals from keyless public APIs (deps.dev / OpenSSF Scorecard, OSV, npm) for npm, PyPI, Go, Maven, Cargo, NuGet, and RubyGems.
• Adapts to your project. Drop a .buyvsbuild.json to weight security/speed, ban or prefer dependencies, and mark what's core; the SessionStart hook injects it.
• Leaves an audit trail. $buy-vs-build-adr + scripts/record-decision.js capture decisions as durable ADRs in docs/decisions/.
• Catches risky deps in review. A PR-review GitHub Action flags new dependencies added without a decision note (advisory).
• Proves it works. A 13-case behavior benchmark (Codex + Claude, with an optional rubric-based LLM judge). Latest Claude run on a small model: baseline 33/65 → enabled 55/65 (+22).

Maintenance & infrastructure

• Single-source generator (npm run sync): edit rules/buy-vs-build.md once; every per-agent copy and the marketplace mirror regenerate. CI enforces it.
• CI runs npm test on Node 20 & 22; added Code of Conduct, security policy, issue/PR templates, and CODEOWNERS.
• README refocused on the problems solved.

Zero runtime dependencies. Same rule, every host: Codex, Claude Code, Gemini, Cursor, GitHub Copilot, Windsurf, Cline, Kiro, OpenCode, OpenClaw.

v0.1.0

First release of Buy vs Build — an always-on buy-before-build ruleset for AI coding agents.

Before writing code, the agent classifies the work (core vs context, commodity vs novel), walks a reuse ladder, and builds in-house only for core, novel work:

do-nothing → built-in → native-platform → installed-dependency → open-source → commercial → in-house

Highlights

• One rule, every host. Ships the same canonical rule to Codex, Claude Code, Gemini, Cursor, GitHub Copilot, Windsurf, Cline, Kiro, OpenCode, and OpenClaw — kept byte-in-sync by a drift check.
• Strategic routing. Core-vs-context + commodity-vs-novel 2×2, reversibility (one-way vs two-way doors), and total-cost-of-ownership framing on top of the reuse ladder.
• Skills + lifecycle hooks for applying, reviewing, auditing, and writing decision memos.
• Behavior benchmarks for both Codex and Claude (npm run benchmark:behavior[:claude]). Latest Claude run: baseline 18/30 → enabled 29/30 (+11), correct-rung hits 4/6 → 6/6.

Install

• Codex: codex plugin marketplace add stdin/buy-vs-build
• Gemini CLI: gemini extensions install https://github.com/stdin/buy-vs-build
• Claude Code / instruction-only hosts: use the plugin, or copy the matching rule file (CLAUDE.md, AGENTS.md, .cursor/rules/..., etc.).