@jeiemgi/cckit 0.1.6

package/scripts/kit-migrate.sh

@@ -0,0 +1,190 @@
+#!/usr/bin/env bash
+# kit-migrate.sh — reshuffle an OLD kit layout to the v2 one, idempotently, surviving /kit-update (#373).
+#
+# THE PROBLEM: early kits scaffolded skills as `task-*` (task-new/task-pr/...). v2 renamed them to
+# `kit-task-*` (skillPrefix='kit-'). A project that initialized on the old layout still has the old
+# dirs; a naive rename leaves three latent bugs:
+#   1. /kit-update RESURRECTS the old `task-*` dirs ("add missing files") — the known incident.
+#   2. The ownership manifest still points at the dead old paths -> remove can't leave clean.
+#   3. CLAUDE.md / rules still say `/task-pr` -> the docs reference skills that no longer exist.
+# kit-migrate fixes all three in one audited pass, and is a no-op on a project already on v2.
+#
+# WHAT IT DOES (per old->new pair in the migration map):
+#   a. BACKUP the project's .claude/ once (timestamped) before the first change.
+#   b. MOVE the file/dir content old->new (only if old exists and new doesn't — never clobber).
+#   c. RE-KEY any manifest entry old->new (so update/remove track the v2 path).
+#   d. REGISTER the rename in kit.config.json `upgrade.renamed{}` so /kit-update NEVER re-adds the
+#      old path (this is the resurrection guard, #334).
+#   e. CLAUDE.md / rules SURGERY: rewrite `/task-<verb>` references to `/kit-task-<verb>`.
+# Idempotent: a second run finds the old paths already gone + already registered -> no-op.
+# Honors KIT_DRY_RUN (preview, no writes) and KIT_ASSUME_YES (no confirm).
+#
+# Run:
+#   scripts/kit-migrate.sh             # interactive
+#   scripts/kit-migrate.sh --dry-run   # preview the reshuffle, write nothing
+#   KIT_ASSUME_YES=1 scripts/kit-migrate.sh   # non-interactive (CI / batch)
+# Requires: jq.
+
+set -uo pipefail
+_mig_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)"
+# shellcheck source=/dev/null
+. "$_mig_dir/lib/kit-operate.sh"   # four-beat machine + kit-manifest.sh
+# shellcheck source=/dev/null
+. "$_mig_dir/lib/kit-cli.sh"       # kit_is_main
+
+# The old->v2 migration map: one "OLD_RELPATH|NEW_RELPATH" per line. Data-driven so the set of
+# renames is auditable + extensible without touching the engine. Today: the task-* -> kit-task-*
+# skill rename (skillPrefix='kit-'), plus task-gc -> kit-gc.
+_kit_migrate_map() {
+  cat <<'MAP'
+.claude/skills/task-new|.claude/skills/kit-task-new
+.claude/skills/task-start|.claude/skills/kit-task-start
+.claude/skills/task-pr|.claude/skills/kit-task-pr
+.claude/skills/task-pr-merge|.claude/skills/kit-task-pr-merge
+.claude/skills/task-pr-auto|.claude/skills/kit-task-pr-auto
+.claude/skills/task-sync|.claude/skills/kit-task-sync
+.claude/skills/task-close|.claude/skills/kit-task-close
+.claude/skills/task-gc|.claude/skills/kit-gc
+MAP
+}
+
+_kit_migrate_cfg() { printf '%s\n' ".claude/kit.config.json"; }
+
+# Register OLD path in kit.config.json upgrade.renamed{} (-> NEW) so /kit-update skips re-adding it.
+# Idempotent: writes only if the key is absent or points elsewhere. (#334 resurrection guard.)
+_kit_migrate_register_rename() {
+  local old="$1" new="$2" cfg cur tmp
+  cfg="$(_kit_migrate_cfg)"
+  [ -f "$cfg" ] || { _kit_op_say "  (no $cfg — skip rename registry for $old)"; return 0; }
+  cur="$(jq -r --arg k "$old" '.upgrade.renamed[$k] // empty' "$cfg" 2>/dev/null || true)"
+  [ "$cur" = "$new" ] && return 0   # already registered
+  if _kit_op_dry; then _kit_op_say "  [dry-run] would register upgrade.renamed[$old]=$new in $cfg"; return 0; fi
+  tmp="$(mktemp)" || return 1
+  jq --arg k "$old" --arg v "$new" \
+     '.upgrade = (.upgrade // {}) | .upgrade.renamed = (.upgrade.renamed // {}) | .upgrade.renamed[$k] = $v' \
+     "$cfg" > "$tmp" && mv "$tmp" "$cfg" || { rm -f "$tmp"; return 1; }
+  _kit_op_say "  registered upgrade.renamed[$old] -> $new"
+}
+
+# Re-key a manifest entry old->new, preserving tier/op (so update/remove track the v2 path).
+_kit_migrate_rekey_manifest() {
+  local old="$1" new="$2" mf entry tier op tmp
+  mf="$(kit_manifest_path)"; [ -f "$mf" ] || return 0
+  entry="$(jq -ec --arg p "$old" '.entries[$p] // empty' "$mf" 2>/dev/null || true)"
+  [ -n "$entry" ] || return 0
+  tier="$(printf '%s' "$entry" | jq -r '.tier // "A"')"
+  op="$(printf '%s' "$entry" | jq -r '.op // "wire"')"
+  if _kit_op_dry; then _kit_op_say "  [dry-run] would re-key manifest $old -> $new"; return 0; fi
+  # record the new path at its (now moved) content, then drop the old entry
+  kit_manifest_record "$new" "$tier" "$op" >/dev/null 2>&1 || true
+  kit_manifest_remove_entry "$old" || true
+}
+
+_kit_migrate_backup_done=""
+# Backup .claude/ once per run, before the first mutation. Skipped under dry-run.
+_kit_migrate_backup() {
+  [ -n "$_kit_migrate_backup_done" ] && return 0
+  _kit_migrate_backup_done=1
+  _kit_op_dry && { _kit_op_say "  [dry-run] would back up .claude/ before migrating"; return 0; }
+  [ -d .claude ] || return 0
+  local bk=".claude.bak.$(date -u +%Y%m%d%H%M%S 2>/dev/null || echo migrate)"
+  cp -R .claude "$bk" 2>/dev/null && _kit_op_say "  backed up .claude/ -> $bk" || _kit_op_say "  (backup skipped — cp failed, continuing)"
+}
+
+# CLAUDE.md + rules surgery: rewrite /task-<verb> -> /kit-task-<verb>, task-gc -> kit-gc.
+# Operates on CLAUDE.md and .claude/rules/*.md. Idempotent (already-migrated text has no /task-).
+_kit_migrate_doc_surgery() {
+  local f changed=0 tmp files=()
+  [ -f CLAUDE.md ] && files+=(CLAUDE.md)
+  if [ -d .claude/rules ]; then
+    while IFS= read -r f; do [ -n "$f" ] && files+=("$f"); done < <(find .claude/rules -maxdepth 1 -type f -name '*.md' 2>/dev/null)
+  fi
+  for f in ${files[@]+"${files[@]}"}; do
+    [ -f "$f" ] || continue
+    # match /task-<verb> not already preceded by 'kit-' ; and the bare task-gc skill name.
+    if grep -Eq '/(task-(new|start|pr|pr-merge|pr-auto|sync|close)|task-gc)\b' "$f" 2>/dev/null; then
+      if _kit_op_dry; then _kit_op_say "  [dry-run] would rewrite /task-* -> /kit-task-* in $f"; changed=1; continue; fi
+      tmp="$(mktemp)" || return 1
+      sed -E 's#/task-(new|start|pr-merge|pr-auto|pr|sync|close)#/kit-task-\1#g; s#/task-gc#/kit-gc#g' "$f" > "$tmp" \
+        && mv "$tmp" "$f" && { _kit_op_say "  rewrote skill refs in $f"; changed=1; } || rm -f "$tmp"
+    fi
+  done
+  [ "$changed" -eq 0 ] && _kit_op_say "  (docs reference current skill names — no rewrite needed)"
+  return 0
+}
+
+# kit_migrate_all — run the full reshuffle. Returns 0 (a project already on v2 is success / no-op).
+kit_migrate_all() {
+  command -v jq >/dev/null 2>&1 || { echo "kit-migrate: jq required" >&2; return 1; }
+
+  # First pass: what WOULD move? (so we can show a plan + confirm before any write)
+  local arr=() line old new pending=0
+  while IFS= read -r line; do [ -n "$line" ] && arr+=("$line"); done < <(_kit_migrate_map)
+  for line in ${arr[@]+"${arr[@]}"}; do
+    old="${line%%|*}"; new="${line##*|}"
+    [ -e "$old" ] && [ ! -e "$new" ] && pending=$((pending+1))
+  done
+
+  if [ "$pending" -eq 0 ]; then
+    _kit_op_say "kit-migrate: layout already on v2 (no old task-* paths to move)."
+    # Still ensure the renames are registered + docs are clean (idempotent backfill for partial runs).
+    for line in ${arr[@]+"${arr[@]}"}; do
+      old="${line%%|*}"; new="${line##*|}"
+      [ ! -e "$old" ] && _kit_migrate_register_rename "$old" "$new"
+    done
+    _kit_migrate_doc_surgery
+    return 0
+  fi
+
+  _kit_op_say "kit-migrate: $pending old-layout path(s) to reshuffle to v2:"
+  for line in ${arr[@]+"${arr[@]}"}; do
+    old="${line%%|*}"; new="${line##*|}"
+    [ -e "$old" ] && [ ! -e "$new" ] && _kit_op_say "  ~ $old  ->  $new"
+  done
+
+  if [ -z "${KIT_ASSUME_YES:-}" ] && [ -z "${KIT_DRY_RUN:-}" ]; then
+    printf 'kit-migrate: reshuffle %s path(s) (a .claude/ backup is taken first)? [y/N] ' "$pending" >&2
+    local _c=""; IFS= read -r _c </dev/tty 2>/dev/null || IFS= read -r _c 2>/dev/null || _c=""
+    case "$_c" in y|Y|yes|YES) ;; *) _kit_op_say "kit-migrate: aborted (nothing moved)."; return 0;; esac
+  fi
+
+  _kit_migrate_backup
+
+  local moved=0
+  for line in ${arr[@]+"${arr[@]}"}; do
+    old="${line%%|*}"; new="${line##*|}"
+    if [ -e "$old" ] && [ ! -e "$new" ]; then
+      if _kit_op_dry; then
+        _kit_op_say "  [dry-run] would move $old -> $new"
+      else
+        mkdir -p "$(dirname "$new")" && mv "$old" "$new" && { _kit_op_say "  moved $old -> $new"; moved=$((moved+1)); }
+        # re-key the manifest for the moved file(s). For a dir, re-key each tracked child.
+        if [ -d "$new" ]; then
+          local child rel
+          while IFS= read -r child; do
+            rel="${child#./}"
+            _kit_migrate_rekey_manifest "${old}/${rel#"$new/"}" "$rel" 2>/dev/null || true
+          done < <(find "$new" -type f 2>/dev/null)
+        else
+          _kit_migrate_rekey_manifest "$old" "$new"
+        fi
+      fi
+    fi
+    # Register the rename either way (so update never resurrects $old) — idempotent.
+    _kit_migrate_register_rename "$old" "$new"
+  done
+
+  _kit_migrate_doc_surgery
+  _kit_op_say "kit-migrate: done ($moved moved). Old paths registered as renamed — /kit-update will not resurrect them."
+}
+
+# CLI (direct execution only)
+if kit_is_main; then
+  while [ $# -gt 0 ]; do case "$1" in
+    --dry-run) export KIT_DRY_RUN=1; shift;;
+    --yes|-y)  export KIT_ASSUME_YES=1; shift;;
+    -h|--help) echo "usage: kit-migrate.sh [--dry-run] [--yes]   (env: KIT_ASSUME_YES, KIT_DRY_RUN)"; exit 0;;
+    *) echo "unknown arg: $1" >&2; exit 2;;
+  esac; done
+  kit_migrate_all
+fi

package/scripts/kit-onboard-test.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# kit-onboard-test.sh — self-test for kit-onboard persistence (#372). Runs under bash AND zsh.
+# Run:  bash scripts/kit-onboard-test.sh
+dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+
+if [ -n "${KIT_OB_TEST_INNER:-}" ]; then
+  set -u
+  fail=0
+  t() { if [ "$2" != "$3" ]; then echo "FAIL($KIT_OB_TEST_INNER): $1 -> got '[$2]' want '[$3]'"; fail=1; else echo "ok($KIT_OB_TEST_INNER): $1"; fi; }
+  OB="$dir/kit-onboard.sh"
+
+  export KIT_PROFILE_HOME="$(mktemp -d)"
+  export KIT_ASSUME_YES=1 KIT_VERSION=9.9.9 KIT_PROFILE_USER=tester
+  work="$(mktemp -d)"; trap 'rm -rf "$KIT_PROFILE_HOME" "$work"' EXIT
+
+  # status: none before global interview
+  "$OB" status >/dev/null 2>&1; t "status before rc" "$?" "1"
+
+  # global: writes profile, preserves schema/user, applies answers
+  printf '%s\n' '{"name":"Ada","language":"es","mode":"enforced","plans_format":"markdown","memory":"on"}' > "$work/g.json"
+  "$OB" global --answers "$work/g.json" >/dev/null 2>&1; t "global rc" "$?" "0"
+  prof="$KIT_PROFILE_HOME/kit.profile.tester.json"
+  t "profile created"  "$([ -f "$prof" ] && echo yes)"            "yes"
+  t "schema kept"      "$(jq -r .schema "$prof")"                 "1"
+  t "user kept"        "$(jq -r .user "$prof")"                   "tester"
+  t "name applied"     "$(jq -r .name "$prof")"                   "Ada"
+  t "nested default"   "$(jq -r .defaults.mode "$prof")"          "enforced"
+  t "memory applied"   "$(jq -r .defaults.memory "$prof")"        "on"
+  "$OB" status >/dev/null 2>&1; t "status after rc" "$?" "0"
+
+  # global is mergeable (a 2nd partial run keeps prior fields)
+  printf '%s\n' '{"language":"en"}' > "$work/g2.json"
+  "$OB" global --answers "$work/g2.json" >/dev/null 2>&1
+  t "merge keeps name"  "$(jq -r .name "$prof")"      "Ada"
+  t "merge updates lang" "$(jq -r .language "$prof")" "en"
+
+  # project: writes ./.claude/kit.config.json via operate (manifest-tracked)
+  mkdir -p "$work/proj"
+  printf '%s\n' '{"name":"My App","owner":"Ada","language":"es","mode":"guided","software":"no"}' > "$work/p.json"
+  "$OB" project --answers "$work/p.json" --dir "$work/proj" >/dev/null 2>&1; t "project rc" "$?" "0"
+  cfg="$work/proj/.claude/kit.config.json"
+  t "config created"   "$([ -f "$cfg" ] && echo yes)"                          "yes"
+  t "project.name"     "$(jq -r .project.name "$cfg")"                         "My App"
+  t "project.mode"     "$(jq -r .mode "$cfg")"                                 "guided"
+  t "manifest tracks"  "$(jq -r '.entries["'.claude/kit.config.json'"]|has("hash")' "$work/proj/.claude/kit.manifest.json")" "true"
+
+  # project idempotent (byte-identical)
+  before="$(cat "$cfg")"; "$OB" project --answers "$work/p.json" --dir "$work/proj" >/dev/null 2>&1
+  t "project idempotent" "$(cat "$cfg")" "$before"
+
+  [ "$fail" -eq 0 ] && echo "ALL OK($KIT_OB_TEST_INNER)"
+  exit "$fail"
+fi
+
+rc=0; ran=0
+for sh in bash zsh; do
+  command -v "$sh" >/dev/null 2>&1 || continue
+  ran=$((ran+1)); echo "--- $sh ---"
+  rcflag=""; [ "$sh" = "zsh" ] && rcflag="--no-rcs"
+  KIT_OB_TEST_INNER="$sh" PATH="$PATH" "$sh" $rcflag "$0" || rc=1
+done
+[ "$ran" -eq 0 ] && { echo "no shell"; exit 1; }
+exit "$rc"

package/scripts/kit-onboard.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# kit-onboard.sh — persist two-tier interview answers (D11, #372). The ASKING is the kit-onboard
+# skill (AskUserQuestion, Tier A). This script is the deterministic persistence half:
+#
+#   global   answers -> ~/.claude/kit.profile.<user>.json   (the once-in-a-lifetime profile, D7)
+#   project  answers -> ./.claude/kit.config.json           (manifest-tracked via kit-operate)
+#
+# Split this way the persistence is unit-testable under bash AND zsh; the skill only renders.
+#
+# Run:
+#   scripts/kit-onboard.sh global  --answers FILE [--user U]
+#   scripts/kit-onboard.sh project --answers FILE [--dir DIR]
+#   scripts/kit-onboard.sh status                  # has the global profile been created?
+# Env: KIT_ASSUME_YES / KIT_DRY_RUN (project tier, via kit-operate).  Requires: jq.
+
+set -uo pipefail
+_ob_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)"
+# shellcheck source=/dev/null
+. "$_ob_dir/lib/kit-interview.sh"   # catalog/apply (pulls kit-cli + kit-profile)
+# shellcheck source=/dev/null
+. "$_ob_dir/lib/kit-operate.sh"     # four-beat machine + manifest (project tier)
+
+# kit_onboard_global <answersfile> [user]
+# Ensure the profile exists (schema + user + slug), then merge the global-tier answers onto it.
+kit_onboard_global() {
+  command -v jq >/dev/null 2>&1 || kit_die "jq required"
+  local answers="$1" user="${2:-}"
+  [ -f "$answers" ] || kit_die "answers file missing: $answers"
+  kit_profile_init "$user" || kit_die "could not init profile"
+  local p merged tmp; p="$(kit_profile_path "$user")"
+  merged="$(kit_interview_apply global "$answers" "$p")" || kit_die "deriving global profile failed"
+  tmp="$(mktemp)"; printf '%s\n' "$merged" > "$tmp" && mv "$tmp" "$p" || { rm -f "$tmp"; kit_die "write failed"; }
+  kit_say "global profile updated: $p"
+}
+
+# kit_onboard_project <answersfile> [targetdir]
+# Merge the project-tier answers onto ./.claude/kit.config.json through kit-operate (manifest).
+kit_onboard_project() {
+  command -v jq >/dev/null 2>&1 || kit_die "jq required"
+  local answers="$1" target="${2:-$PWD}"
+  [ -f "$answers" ] || kit_die "answers file missing: $answers"
+  target="$(cd "$target" 2>/dev/null && pwd)" || kit_die "no such dir: $target"
+  cd "$target" || kit_die "cannot enter $target"
+  local cfg=".claude/kit.config.json" base merged
+  base=""; [ -f "$cfg" ] && base="$cfg"
+  merged="$(kit_interview_apply project "$answers" "$base")" || kit_die "deriving project config failed"
+  kit_say "kit onboard project  ->  $target/$cfg"
+  printf '%s\n' "$merged" | kit_op_write_content "$cfg" A onboard
+  case $? in 0|10) return 0;; *) kit_die "failed to write $cfg";; esac
+}
+
+# CLI
+if kit_is_main; then
+  _sub="${1:-}"; shift 2>/dev/null || true
+  _answers=""; _user=""; _dir="$PWD"
+  while [ $# -gt 0 ]; do case "$1" in
+    --answers) _answers="$2"; shift 2;;
+    --user) _user="$2"; shift 2;;
+    --dir) _dir="$2"; shift 2;;
+    -h|--help) echo "usage: kit-onboard.sh global|project|status [--answers F] [--user U] [--dir D]"; exit 0;;
+    *) kit_die "unknown arg: $1";;
+  esac; done
+  case "$_sub" in
+    global)  kit_onboard_global  "$_answers" "$_user";;
+    project) kit_onboard_project "$_answers" "$_dir";;
+    status)  if kit_profile_exists "$_user"; then echo "profile: $(kit_profile_path "$_user") (exists)"; else echo "profile: none yet — run the global interview"; exit 1; fi;;
+    *) kit_die "usage: kit-onboard.sh global|project|status ...";;
+  esac
+fi

package/scripts/kit-promote-test.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# kit-promote-test.sh — self-test for kit-promote (#374). Runs under bash AND zsh.
+# Run:  bash scripts/kit-promote-test.sh
+PLUGIN_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
+
+if [ -n "${KIT_PROMOTE_TEST_INNER:-}" ]; then
+  set -u
+  fail=0
+  t() { if [ "$2" != "$3" ]; then echo "FAIL($KIT_PROMOTE_TEST_INNER): $1 -> got '[$2]' want '[$3]'"; fail=1; else echo "ok($KIT_PROMOTE_TEST_INNER): $1"; fi; }
+
+  ws="$(mktemp -d)"; trap 'rm -rf "$ws"' EXIT
+  printf '{"workspace":{"name":"w"}}\n' > "$ws/kit.workspace.json"
+  mkdir -p "$ws/proj-a/.claude/skills/brand" "$ws/proj-b/.claude/skills/brand" "$ws/proj-a/.claude/skills/solo"
+  printf 'SHARED VOICE\n' > "$ws/proj-a/.claude/skills/brand/SKILL.md"
+  printf 'SHARED VOICE\n' > "$ws/proj-b/.claude/skills/brand/SKILL.md"   # identical -> dup candidate
+  printf 'only here\n'    > "$ws/proj-a/.claude/skills/solo/SKILL.md"
+
+  . "$PLUGIN_DIR/scripts/kit-promote.sh"
+  . "$PLUGIN_DIR/scripts/lib/kit-manifest.sh"
+
+  # workspace root detection from inside a project
+  t "ws root from project" "$(cd "$ws/proj-a" && kit_workspace_root | sed "s#$ws#WS#")" "WS"
+  t "ws root from nested"  "$(cd "$ws/proj-a/.claude/skills" && kit_workspace_root | sed "s#$ws#WS#")" "WS"
+
+  # promote brand/SKILL.md from proj-a up to the commons (assume-yes skips the above-project prompt)
+  ( cd "$ws/proj-a" && export KIT_ASSUME_YES=1 && kit_promote "skills/brand/SKILL.md" >/dev/null 2>&1 )
+  t "copied to commons"    "$([ -f "$ws/.claude/skills/brand/SKILL.md" ] && echo yes || echo no)" "yes"
+  t "commons content"      "$(cat "$ws/.claude/skills/brand/SKILL.md")" "SHARED VOICE"
+  t "commons manifest"     "$(cd "$ws" && KIT_MANIFEST=.claude/kit.manifest.json kit_manifest_verify .claude/skills/brand/SKILL.md)" "intact"
+  t "project mirror tracked" "$(cd "$ws/proj-a" && kit_manifest_verify .claude/skills/brand/SKILL.md)" "intact"
+
+  # dup detection across the two projects: brand/SKILL.md is identical -> candidate; solo is not
+  cands="$(kit_promote_candidates "$ws/proj-a" "$ws/proj-b" 2>/dev/null)"
+  t "candidate found"      "$(printf '%s' "$cands" | grep -c 'skills/brand/SKILL.md')" "1"
+  t "no false candidate"   "$(printf '%s' "$cands" | grep -c 'skills/solo/SKILL.md')" "0"
+
+  # dry-run promote writes nothing new
+  mkdir -p "$ws/proj-b/.claude/skills/new"; printf 'x\n' > "$ws/proj-b/.claude/skills/new/SKILL.md"
+  ( cd "$ws/proj-b" && KIT_DRY_RUN=1 kit_promote "skills/new/SKILL.md" >/dev/null 2>&1 )
+  t "dry-run no commons write" "$([ -f "$ws/.claude/skills/new/SKILL.md" ] && echo yes || echo no)" "no"
+
+  [ "$fail" -eq 0 ] && echo "ALL OK($KIT_PROMOTE_TEST_INNER)"
+  exit "$fail"
+fi
+
+rc=0; ran=0
+for sh in bash zsh; do
+  command -v "$sh" >/dev/null 2>&1 || continue
+  ran=$((ran+1)); echo "--- $sh ---"
+  rcflag=""; [ "$sh" = "zsh" ] && rcflag="--no-rcs"
+  KIT_PROMOTE_TEST_INNER="$sh" PATH="$PATH" PLUGIN_DIR="$PLUGIN_DIR" "$sh" $rcflag "$0" || rc=1
+done
+[ "$ran" -eq 0 ] && { echo "no shell"; exit 1; }
+exit "$rc"

package/scripts/kit-promote.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# kit-promote.sh — promote a project-local skill/agent to the workspace COMMONS so sibling
+# projects can share it (#374). Born-local, shareable by ascent.
+#
+# MECHANICS (decided in the v2 plan, F6):
+#   - The commons is `<workspace>/.claude/` (workspace root = nearest ancestor with kit.workspace.json).
+#   - Promotion COPIES the file up to the commons (not symlink): Cowork ignores symlinks pointing
+#     outside a plugin dir, and a copy works on every surface. Hash in the manifest detects drift.
+#   - Writing ABOVE the current project ALWAYS asks permission (D10) — the commons is shared ground.
+#   - The promoted copy is recorded in BOTH manifests (workspace + project) so kit-wire/remove and
+#     duplicate-detection can reason about it. The project copy becomes a tracked mirror: editing it
+#     locally is drift the kit will flag (edit at the workspace level instead).
+#
+# Run:   scripts/kit-promote.sh <relpath-under-.claude>          # e.g. skills/brand-voice/SKILL.md
+#        scripts/kit-promote.sh --candidates <dir1> <dir2> ...   # list exact-dup files across projects
+# Env:   KIT_ASSUME_YES (skip the above-project permission prompt), KIT_DRY_RUN.
+# Requires: jq.
+
+set -uo pipefail
+_pr_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)"
+# shellcheck source=/dev/null
+. "$_pr_dir/lib/kit-operate.sh"   # manifest + operate
+# shellcheck source=/dev/null
+. "$_pr_dir/lib/kit-cli.sh"       # kit_is_main, kit_say/die
+
+# kit_workspace_root [startdir] -> path of nearest ancestor holding kit.workspace.json (empty if none)
+kit_workspace_root() {
+  local d; d="$(cd "${1:-$PWD}" 2>/dev/null && pwd)" || return 1
+  while [ -n "$d" ]; do
+    [ -f "$d/kit.workspace.json" ] && { printf '%s\n' "$d"; return 0; }
+    [ "$d" = "/" ] && break
+    d="$(dirname "$d")"
+  done
+  return 1
+}
+
+# kit_promote <relpath> — relpath is under the project's .claude/ (e.g. skills/foo/SKILL.md).
+# Copies <proj>/.claude/<relpath> -> <ws>/.claude/<relpath>, records both sides.
+kit_promote() {
+  command -v jq >/dev/null 2>&1 || { kit_die "jq required"; }
+  local rel="$1"
+  [ -n "$rel" ] || { kit_die "usage: kit-promote.sh <relpath-under-.claude>"; }
+  local proj_file=".claude/$rel"
+  [ -f "$proj_file" ] || { kit_die "not found: $proj_file"; }
+
+  local ws; ws="$(kit_workspace_root)" || { kit_die "no workspace root (kit.workspace.json) found above $PWD — promotion needs a workspace."; }
+  local proj; proj="$(pwd)"
+  if [ "$ws" = "$proj" ]; then kit_die "already at the workspace root — nothing to promote up."; fi
+
+  local dest="$ws/.claude/$rel"
+  kit_say "promote: $proj_file"
+  kit_say "    ->   $dest   (workspace commons)"
+
+  # Writing ABOVE the project always asks (D10), unless KIT_ASSUME_YES.
+  if [ -z "${KIT_ASSUME_YES:-}" ] && [ -z "${KIT_DRY_RUN:-}" ]; then
+    printf 'Write to the workspace commons (above this project)? [y/N] ' >&2
+    local c=""; IFS= read -r c </dev/tty 2>/dev/null || IFS= read -r c 2>/dev/null || c=""
+    case "$c" in y|Y|yes|YES) ;; *) kit_say "aborted."; return 0;; esac
+  fi
+  if [ -n "${KIT_DRY_RUN:-}" ]; then kit_say "  [dry-run] would copy to commons + record both manifests"; return 10; fi
+
+  mkdir -p "$(dirname "$dest")"
+  cp -- "$proj_file" "$dest"
+  # record in the WORKSPACE manifest (commons owner)
+  ( cd "$ws" && KIT_MANIFEST=".claude/kit.manifest.json" kit_manifest_record ".claude/$rel" A promote >/dev/null 2>&1 ) || true
+  # record the project copy as a promoted mirror (so drift can be detected; edit upstream instead)
+  kit_manifest_record "$proj_file" A promote-mirror >/dev/null 2>&1 || true
+  kit_say "  promoted. Edit it at the workspace level; the project copy is a tracked mirror."
+}
+
+# kit_promote_candidates <dir>... — find files that are byte-identical across 2+ given project
+# .claude/ trees (exact-dup = a promotion candidate). Prints "<count>\t<relpath>" for dups.
+kit_promote_candidates() {
+  command -v jq >/dev/null 2>&1 || { kit_die "jq required"; }
+  [ "$#" -ge 2 ] || { kit_die "usage: --candidates <dir1> <dir2> [..]"; }
+  local d f rel h
+  # emit "hash<TAB>relpath" for every skill/agent file under each dir's .claude/{skills,agents}
+  { for d in "$@"; do
+      [ -d "$d/.claude" ] || continue
+      while IFS= read -r f; do
+        [ -f "$f" ] || continue
+        rel="${f#"$d"/.claude/}"
+        h="$(kit_manifest_hash "$f")"
+        printf '%s\t%s\n' "$h" "$rel"
+      done <<EOF
+$(find "$d/.claude/skills" "$d/.claude/agents" -type f 2>/dev/null)
+EOF
+    done
+  } | LC_ALL=C sort | awk -F'\t' '
+      { if ($1==ph) { cnt++ } else { if (cnt>1) print cnt"\t"prel; ph=$1; prel=$2; cnt=1 } }
+      END { if (cnt>1) print cnt"\t"prel }'
+}
+
+# CLI
+if kit_is_main; then
+  case "${1:-}" in
+    --candidates) shift; kit_promote_candidates "$@";;
+    -h|--help) echo "usage: kit-promote.sh <relpath-under-.claude> | --candidates <dir>...";;
+    "") kit_die "usage: kit-promote.sh <relpath-under-.claude> | --candidates <dir>...";;
+    *) kit_promote "$1";;
+  esac
+fi

package/scripts/kit-remove-test.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# kit-remove-test.sh — self-test for kit-remove (#373). Runs under bash AND zsh.
+# Run:  bash scripts/kit-remove-test.sh
+PLUGIN_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
+
+if [ -n "${KIT_REMOVE_TEST_INNER:-}" ]; then
+  set -u
+  fail=0
+  t() { if [ "$2" != "$3" ]; then echo "FAIL($KIT_REMOVE_TEST_INNER): $1 -> got '[$2]' want '[$3]'"; fail=1; else echo "ok($KIT_REMOVE_TEST_INNER): $1"; fi; }
+
+  proj="$(mktemp -d)"; trap 'rm -rf "$proj"' EXIT
+  cd "$proj"
+  export KIT_ASSUME_YES=1
+  . "$PLUGIN_DIR/scripts/kit-remove.sh"
+  . "$PLUGIN_DIR/scripts/lib/kit-manifest.sh"
+
+  # set up a project the kit "installed": two tracked files + one user-modified + one untracked
+  mkdir -p .claude/hooks knowledge
+  printf 'a\n' > .claude/statusline.sh;        kit_manifest_record .claude/statusline.sh B wire 1 2026-01-01T00:00:00Z
+  printf 'b\n' > .claude/hooks/guard.sh;        kit_manifest_record .claude/hooks/guard.sh B wire 1 2026-01-01T00:00:00Z
+  printf 'c\n' > .claude/settings.json;         kit_manifest_record .claude/settings.json B wire 1 2026-01-01T00:00:00Z
+  printf 'USER EDITED\n' > .claude/settings.json   # now modified vs manifest
+  printf 'my notes\n' > knowledge/doc.md        # NOT tracked — must survive
+
+  t "before: statusline tracked" "$(kit_manifest_verify .claude/statusline.sh)" "intact"
+  t "before: settings modified"  "$(kit_manifest_verify .claude/settings.json)" "modified"
+
+  # remove with --yes: intact files deleted, modified kept (assume-yes still declines modified),
+  # untracked knowledge/ untouched.
+  printf 'n\n' | kit_remove_all >/dev/null 2>&1   # answer 'n' to the modified-file prompt
+
+  t "intact deleted (statusline)" "$([ -f .claude/statusline.sh ] && echo yes || echo no)" "no"
+  t "intact deleted (guard)"      "$([ -f .claude/hooks/guard.sh ] && echo yes || echo no)" "no"
+  t "modified KEPT (settings)"    "$([ -f .claude/settings.json ] && echo yes || echo no)" "yes"
+  t "modified content intact"     "$(cat .claude/settings.json)" "USER EDITED"
+  t "untracked knowledge SAFE"    "$([ -f knowledge/doc.md ] && echo yes || echo no)" "yes"
+  # manifest kept because one modified entry remained
+  t "manifest remains"            "$([ -f .claude/kit.manifest.json ] && echo yes || echo no)" "yes"
+  t "only modified entry left"    "$(kit_manifest_list | tr '\n' ',')" ".claude/settings.json,"
+
+  # dry-run never deletes
+  proj2="$(mktemp -d)"; cd "$proj2"
+  printf 'x\n' > .claude/f.sh 2>/dev/null || { mkdir -p .claude; printf 'x\n' > .claude/f.sh; }
+  kit_manifest_record .claude/f.sh B wire 1 2026-01-01T00:00:00Z
+  KIT_DRY_RUN=1 kit_remove_all >/dev/null 2>&1
+  t "dry-run keeps file"          "$([ -f .claude/f.sh ] && echo yes || echo no)" "yes"
+  t "dry-run keeps manifest"      "$([ -f .claude/kit.manifest.json ] && echo yes || echo no)" "yes"
+
+  [ "$fail" -eq 0 ] && echo "ALL OK($KIT_REMOVE_TEST_INNER)"
+  exit "$fail"
+fi
+
+rc=0; ran=0
+for sh in bash zsh; do
+  command -v "$sh" >/dev/null 2>&1 || continue
+  ran=$((ran+1)); echo "--- $sh ---"
+  rcflag=""; [ "$sh" = "zsh" ] && rcflag="--no-rcs"
+  KIT_REMOVE_TEST_INNER="$sh" PATH="$PATH" PLUGIN_DIR="$PLUGIN_DIR" "$sh" $rcflag "$0" || rc=1
+done
+[ "$ran" -eq 0 ] && { echo "no shell"; exit 1; }
+exit "$rc"

package/scripts/kit-remove.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# kit-remove.sh — uninstall the kit from a project, by MANIFEST, never by guesswork (#373).
+#
+# "You can leave clean" is the trust feature: removal walks the F0 ownership manifest in reverse
+# and deletes only what the kit installed, applying the conffiles rule (D12):
+#   intact    -> delete            (kit wrote it, user never touched it)
+#   modified  -> ASK               (user edited it; default keep)
+#   missing   -> just drop the entry
+#   untracked -> never touched (can't happen via the manifest, but kit_op_remove refuses anyway)
+# It NEVER deletes knowledge/, plans/, drafts/, the user's CLAUDE.md, or anything not in the
+# manifest. Honors KIT_DRY_RUN; KIT_ASSUME_YES applies non-interactively (still asks on modified).
+#
+# Run:   scripts/kit-remove.sh            # interactive
+#        scripts/kit-remove.sh --dry-run  # preview only
+#        scripts/kit-remove.sh --yes      # non-interactive (modified files still prompt)
+# Requires: jq.
+
+set -uo pipefail
+_rm_dir="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)"
+# shellcheck source=/dev/null
+. "$_rm_dir/lib/kit-operate.sh"   # brings kit-manifest.sh too
+# shellcheck source=/dev/null
+. "$_rm_dir/lib/kit-cli.sh"       # kit_is_main
+
+# kit_remove_all — remove every manifest entry (reverse order so nested files go before dirs),
+# then drop the manifest + prune now-empty .claude/kit dirs. Returns count kept (modified/declined).
+kit_remove_all() {
+  command -v jq >/dev/null 2>&1 || { echo "kit-remove: jq required" >&2; return 1; }
+  local mf; mf="$(kit_manifest_path)"
+  if [ ! -f "$mf" ]; then echo "kit-remove: no manifest ($mf) — nothing kit-managed here." >&2; return 0; fi
+
+  # snapshot the tracked paths, reverse-sorted (longest/deepest first)
+  local paths; paths="$(kit_manifest_list | LC_ALL=C sort -r)"
+  if [ -z "$paths" ]; then echo "kit-remove: manifest is empty." >&2; rm -f "$mf"; return 0; fi
+
+  # One top-level confirm for the whole uninstall (skipped under --yes / --dry-run). Per-file the
+  # machine still protects user-modified files individually.
+  local n; n="$(printf '%s\n' "$paths" | grep -c .)"
+  if [ -z "${KIT_ASSUME_YES:-}" ] && [ -z "${KIT_DRY_RUN:-}" ]; then
+    printf 'kit-remove: about to remove %s kit-managed file(s). Continue? [y/N] ' "$n" >&2
+    local _c=""; IFS= read -r _c </dev/tty 2>/dev/null || IFS= read -r _c 2>/dev/null || _c=""
+    case "$_c" in y|Y|yes|YES) ;; *) echo "kit-remove: aborted." >&2; return 0;; esac
+  fi
+
+  # Collect into an array FIRST, then iterate — so a per-file prompt's `read` inside the loop
+  # can't steal the next path off the loop's stdin (classic while-read pitfall).
+  local arr=() line
+  while IFS= read -r line; do [ -n "$line" ] && arr+=("$line"); done <<EOF
+$paths
+EOF
+  local total=0 removed=0 kept=0 p rc
+  for p in ${arr[@]+"${arr[@]}"}; do
+    total=$((total+1))
+    kit_op_remove "$p"; rc=$?
+    if [ "$rc" -eq 0 ]; then removed=$((removed+1)); else kept=$((kept+1)); fi
+  done
+
+  _kit_op_say "kit-remove: $removed removed, $kept kept (modified/declined), of $total tracked."
+  # If every entry is gone, remove the (now-empty) manifest too.
+  if [ -z "$(kit_manifest_list)" ]; then
+    if _kit_op_dry; then _kit_op_say "  [dry-run] would delete empty manifest $mf"
+    else rm -f "$mf"; _kit_op_say "  deleted empty manifest $mf"; fi
+  else
+    _kit_op_say "  manifest kept ($(kit_manifest_list | grep -c . ) entr(y/ies) remain — modified files you chose to keep)."
+  fi
+  # Remove any kit-managed cron entries for this project (fail-soft — missing crontab is fine).
+  local rt_script; rt_script="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)/kit-routines.sh"
+  if [ -f "$rt_script" ] && command -v crontab >/dev/null 2>&1; then
+    bash "$rt_script" remove-all || true
+  fi
+  return 0
+}
+
+# CLI (direct execution only; zsh-safe guard)
+# CLI (direct execution only)
+if kit_is_main; then
+  while [ $# -gt 0 ]; do case "$1" in
+    --dry-run) export KIT_DRY_RUN=1; shift;;
+    --yes|-y)  export KIT_ASSUME_YES=1; shift;;
+    -h|--help) echo "usage: kit-remove.sh [--dry-run] [--yes]"; exit 0;;
+    *) echo "unknown arg: $1" >&2; exit 2;;
+  esac; done
+  kit_remove_all
+fi