docks-kit 0.1.0 → 0.1.1

package/cli/src/engine-native/skillsSync.ts

@@ -0,0 +1,369 @@
+/**
+ * EngineNative `sync agents` pipeline: universal-skill bootstrap
+ * (`npx skills@<pin> add`), Claude symlink healing, --prune reconcile against
+ * the kit-managed snapshot, agent-browser/effect-solutions toolchain callbacks,
+ * and the snapshot write.
+ */
+import { spawnSync } from "node:child_process"
+import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { capture, commandExists, isExecutable, p, which } from "./exec"
+import type { Ctx } from "./index"
+import { compareCodepoints } from "./jq"
+import { echo, log, warn } from "./output"
+import { ensure, field } from "./toolchain"
+
+export interface SkillsState {
+  present: number
+}
+
+export function skillsSync(ctx: Ctx): SkillsState {
+  const state: SkillsState = { present: 0 }
+  const skillsDir = p(ctx.agentsDir, "skills")
+  const manifest = p(ctx.repoDir, "SoT", ".agents", "skills.txt")
+  const snapshot = p(ctx.agentsDir, ".kit-managed-skills")
+
+  if (!existsSync(manifest)) return state
+
+  if (!ctx.dryRun) mkdirSync(skillsDir, { recursive: true })
+
+  syncUniversal(ctx, state, skillsDir, manifest)
+  if (ctx.prune) reconcileRemovals(ctx, manifest, snapshot)
+  syncAgentBrowserCli(ctx, manifest)
+  syncEffectSolutionsCli(ctx)
+  updateSnapshot(ctx, manifest, snapshot)
+  return state
+}
+
+/** skills::_skills_cli — the pinned npx package spec. */
+function skillsCli(ctx: Ctx): string {
+  const v = field(ctx, "skills-cli", "verified")
+  return v !== "" ? `skills@${v}` : "skills"
+}
+
+/** skills::_normalize_manifest — cleaned slugs, one per line. */
+export function normalizeManifest(content: string): Array<string> {
+  const out: Array<string> = []
+  for (const line of content.split("\n")) {
+    if (/^[ \t]*#/.test(line)) continue
+    if (/^[ \t]*$/.test(line)) continue
+    const cleaned = line.replace(/[ \t]*#.*$/, "").replace(/[ \t\r]+/g, "")
+    if (cleaned.length > 0) out.push(cleaned)
+  }
+  return out
+}
+
+function readSlugs(file: string): Array<string> {
+  return existsSync(file) ? normalizeManifest(readFileSync(file, "utf8")) : []
+}
+
+function syncUniversal(ctx: Ctx, state: SkillsState, skillsDir: string, manifest: string): void {
+  if (!commandExists("node")) {
+    warn("node/npx not in PATH — skipping universal skills bootstrap (install Node.js to enable)")
+    return
+  }
+
+  let added = 0
+  let already = 0
+  let failed = 0
+  let healed = 0
+
+  for (const slug of readSlugs(manifest)) {
+    const base = slug.slice(slug.lastIndexOf("/") + 1)
+
+    if (ctx.dryRun) {
+      if (isDir(p(skillsDir, base))) {
+        echo(`[dry-run] universal skill present: ${base}`)
+        healClaudeSymlink(ctx, skillsDir, base)
+      } else {
+        echo(`[dry-run] npx ${skillsCli(ctx)} add ${slug} -g -y -a claude-code codex`)
+      }
+      continue
+    }
+
+    if (isDir(p(skillsDir, base))) {
+      already++
+      if (healClaudeSymlink(ctx, skillsDir, base)) healed++
+      continue
+    }
+
+    const res = spawnSync("npx", ["--yes", skillsCli(ctx), "add", slug, "-g", "-y", "-a", "claude-code", "codex"], {
+      stdio: "ignore"
+    })
+    if (res.error === undefined && res.status === 0) {
+      added++
+    } else {
+      warn(`Failed to install universal skill: ${slug}`)
+      failed++
+    }
+  }
+
+  if (ctx.dryRun) return
+
+  state.present = added + already
+
+  if (added > 0) {
+    log(`Universal skills synced (+${added} new, ${already} already present)`)
+  } else {
+    log(`Universal skills already in sync (${already} present)`)
+  }
+  if (healed > 0) {
+    log(`Claude per-tool symlinks healed (+${healed}) — canonical present, ~/.claude/skills/<name> was missing or broken`)
+  }
+  if (failed > 0) {
+    warn(`${failed} skill install(s) failed — re-run sync or install manually with: npx skills add <slug> -g -y -a claude-code codex`)
+  }
+}
+
+function isDir(path: string): boolean {
+  try {
+    return statSync(path).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+/** skills::heal_claude_symlink — true when a heal occurred. */
+function healClaudeSymlink(ctx: Ctx, skillsDir: string, base: string): boolean {
+  const canonical = p(skillsDir, base)
+  const claudeSkillsDir = p(ctx.home, ".claude", "skills")
+  const claudeLink = p(claudeSkillsDir, base)
+  const relTarget = `../../.agents/skills/${base}`
+
+  if (!isDir(canonical)) return false
+
+  const linkStat = lstat(claudeLink)
+  if (linkStat?.isSymbolicLink() === true) {
+    const current = safeReadlink(claudeLink)
+    if (current === relTarget) return false
+    if (ctx.dryRun) {
+      echo(`[dry-run] would replace stale Claude symlink: ~/.claude/skills/${base} -> ${current}  (correct: ${relTarget})`)
+      return true
+    }
+    rmSync(claudeLink, { force: true })
+  } else if (linkStat !== undefined) {
+    warn(`~/.claude/skills/${base} exists as a real path (not a symlink) — leaving alone; remove manually if it's stale`)
+    return false
+  } else if (ctx.dryRun) {
+    echo(`[dry-run] would create missing Claude symlink: ~/.claude/skills/${base} -> ${relTarget}`)
+    return true
+  }
+
+  mkdirSync(claudeSkillsDir, { recursive: true })
+  return linkOrCopy(relTarget, claudeLink)
+}
+
+function lstat(path: string): ReturnType<typeof lstatSync> | undefined {
+  try {
+    return lstatSync(path)
+  } catch {
+    return undefined
+  }
+}
+
+function safeReadlink(path: string): string {
+  try {
+    return readlinkSync(path)
+  } catch {
+    return ""
+  }
+}
+
+/** skills::_link_or_copy — real symlink preferred, copy fallback (Windows). */
+export function linkOrCopy(target: string, link: string): boolean {
+  rmSync(link, { force: true })
+  try {
+    symlinkSync(target, link, process.platform === "win32" ? "dir" : undefined)
+  } catch {
+    // fall through to the copy fallback below
+  }
+  if (lstat(link)?.isSymbolicLink() === true) return true
+  try {
+    // Resolve a relative target against the link's parent, like ln does.
+    const resolved = target.startsWith("/") ? target : p(link.slice(0, link.lastIndexOf("/")), target)
+    cpSync(resolved, link, { recursive: true })
+  } catch {
+    // fall through to the existence check below
+  }
+  if (existsSync(link)) {
+    warn(`symlinks unsupported here — ${link} is a copy (refreshed on sync; enable Windows Developer Mode for real links)`)
+    return true
+  }
+  warn(`could not create ${link} (symlink and copy both failed)`)
+  return false
+}
+
+// ------------------------------------------------- toolchain callbacks ----
+
+/** skills::_agent_browser_install. */
+export function agentBrowserInstall(mode: "install" | "upgrade", version: string): number {
+  const verb = mode === "upgrade" ? "Upgrading" : "Installing"
+  const pkg = version !== "" ? `agent-browser@${version}` : "agent-browser"
+  const installFlags = process.platform === "linux" ? ["--with-deps"] : []
+
+  log(`${verb} agent-browser CLI via npm${version !== "" ? ` (pinned ${version})` : ""}...`)
+  if (spawnSync("npm", ["install", "-g", pkg], { stdio: "ignore" }).status !== 0) {
+    warn(`npm install -g ${pkg} failed. Try manually: npm install -g ${pkg}`)
+    return 1
+  }
+
+  if (mode === "install") {
+    log("Downloading Chrome for Testing (~175 MB; sudo may be requested for system libs on Linux)...")
+    if (spawnSync("agent-browser", ["install", ...installFlags], { stdio: "inherit" }).status !== 0) {
+      warn(`agent-browser install failed. Re-run manually: agent-browser install ${installFlags.join(" ")}`)
+      return 1
+    }
+  }
+  const out = capture("agent-browser", ["--version"])
+  const fields = (out.split("\n")[0] ?? "").trim().split(/[ \t]+/)
+  const version2 = out !== "" ? fields[fields.length - 1] ?? "version unknown" : "version unknown"
+  log(`agent-browser CLI ready (${version2})`)
+  return 0
+}
+
+function syncAgentBrowserCli(ctx: Ctx, manifest: string): void {
+  if (!existsSync(manifest) || !readFileSync(manifest, "utf8").split("\n").includes("vercel-labs/agent-browser")) return
+
+  if (!commandExists("npm")) {
+    if (!ctx.dryRun) warn("npm not found — cannot auto-install agent-browser CLI. Install Node.js, then re-run sync.")
+    return
+  }
+
+  if (ensure(ctx, "agent-browser", agentBrowserInstall) !== 0) {
+    warn("agent-browser bootstrap failed — continuing sync")
+  }
+}
+
+/** skills::_find_bun — resolved bun path or "". */
+function findBun(ctx: Ctx): string {
+  const onPath = which("bun")
+  if (onPath !== "") return onPath
+  const bunInstall = process.env["BUN_INSTALL"] !== undefined && process.env["BUN_INSTALL"] !== "" ? process.env["BUN_INSTALL"] : p(ctx.home, ".bun")
+  for (const cand of [p(bunInstall, "bin", "bun"), p(ctx.home, ".bun", "bin", "bun")]) {
+    if (isExecutable(cand)) return cand
+  }
+  return ""
+}
+
+/** skills::_bun_bootstrap — bun path or "" after a failed bootstrap. */
+export function bunBootstrap(ctx: Ctx): string {
+  let bun = findBun(ctx)
+  if (bun !== "") return bun
+
+  if (!commandExists("curl")) {
+    warn("Bun and curl both missing — cannot bootstrap Bun. Install Bun manually, then re-run sync.")
+    return ""
+  }
+  const pin = field(ctx, "bun", "verified")
+  warn(`Bun not found — installing Bun${pin !== "" ? ` ${pin} (kit-verified)` : ""}...`)
+  const installer = p(tmpdir(), `bun-install-${process.pid}.sh`)
+  const dl = spawnSync("curl", ["-fsSL", "https://bun.sh/install", "-o", installer], { stdio: "ignore" })
+  if (dl.error === undefined && dl.status === 0) {
+    spawnSync("bash", [installer, ...(pin !== "" ? [`bun-v${pin}`] : [])], { stdio: "ignore" })
+  }
+  rmSync(installer, { force: true })
+  bun = findBun(ctx)
+  if (bun === "") {
+    warn("Bun install failed. Install manually: curl -fsSL https://bun.sh/install -o /tmp/bun.sh && bash /tmp/bun.sh")
+    return ""
+  }
+  const v = capture(bun, ["--version"])
+  log(`Bun installed (${v !== "" ? v : "version unknown"})`)
+  return bun
+}
+
+/** skills::_effect_solutions_install. */
+export function effectSolutionsInstall(ctx: Ctx): (mode: "install" | "upgrade", version: string) => number {
+  return (mode, version) => {
+    const verb = mode === "upgrade" ? "Upgrading" : "Installing"
+    const pkg = `effect-solutions@${version !== "" ? version : "latest"}`
+
+    const bun = bunBootstrap(ctx)
+    if (bun === "") return 1
+
+    log(`${verb} effect-solutions CLI via bun${version !== "" ? ` (pinned ${version})` : ""}...`)
+    if (spawnSync(bun, ["add", "-g", pkg], { stdio: "ignore" }).status !== 0) {
+      warn(`bun add -g ${pkg} failed. Try manually: bun add -g ${pkg}`)
+      return 1
+    }
+
+    const gbin = capture(bun, ["pm", "-g", "bin"])
+    if (gbin !== "" && isExecutable(p(gbin, "effect-solutions"))) {
+      mkdirSync(p(ctx.home, ".local", "bin"), { recursive: true })
+      linkOrCopy(bun, p(ctx.home, ".local", "bin", "bun"))
+      linkOrCopy(p(gbin, "effect-solutions"), p(ctx.home, ".local", "bin", "effect-solutions"))
+      log("effect-solutions CLI ready (linked bun + effect-solutions into ~/.local/bin)")
+    } else {
+      warn(`effect-solutions installed but binary not found under '${gbin !== "" ? gbin : "<unknown>"}' — link it onto PATH manually`)
+    }
+    return 0
+  }
+}
+
+function syncEffectSolutionsCli(ctx: Ctx): void {
+  const settings = p(ctx.repoDir, "SoT", ".claude", "settings.json")
+  if (!existsSync(settings)) return
+  if (!/"effect-kit@docks"[ \t]*:[ \t]*true/.test(readFileSync(settings, "utf8"))) return
+
+  if (ensure(ctx, "effect-solutions", effectSolutionsInstall(ctx)) !== 0) {
+    warn("effect-solutions bootstrap failed — continuing sync")
+  }
+}
+
+// ----------------------------------------------------- prune + snapshot ----
+
+function reconcileRemovals(ctx: Ctx, manifest: string, snapshot: string): void {
+  if (!existsSync(snapshot)) {
+    if (ctx.dryRun) {
+      echo(
+        `[dry-run] (--prune) no kit-managed-skills snapshot yet; first real sync writes ${snapshot}, then future --prune runs reconcile against it`
+      )
+    }
+    return
+  }
+
+  const current = readSlugs(manifest)
+  let removed = 0
+  let failed = 0
+  for (const slug of readSlugs(snapshot)) {
+    if (current.includes(slug)) continue
+    const base = slug.slice(slug.lastIndexOf("/") + 1)
+    if (ctx.dryRun) {
+      echo(`[dry-run] kit-managed skill no longer in SoT — would remove: ${base}`)
+      continue
+    }
+    const res = spawnSync("npx", ["--yes", skillsCli(ctx), "remove", "--global", "-y", "-a", "*", "-s", base], {
+      stdio: "ignore"
+    })
+    if (res.error === undefined && res.status === 0) {
+      removed++
+    } else {
+      warn(`Failed to remove kit-managed skill: ${base}`)
+      failed++
+    }
+  }
+
+  if (removed > 0) log(`Kit-managed skills removed (-${removed})`)
+  if (failed > 0) warn(`${failed} skill remove(s) failed — re-run with --prune or run: npx skills remove -g -y -a '*' -s <name>`)
+}
+
+function updateSnapshot(ctx: Ctx, manifest: string, snapshot: string): void {
+  if (ctx.dryRun) return
+
+  mkdirSync(ctx.agentsDir, { recursive: true })
+  const sorted = [...new Set(readSlugs(manifest))].sort(compareCodepoints)
+  writeFileSync(snapshot, sorted.length > 0 ? `${sorted.join("\n")}\n` : "")
+}
+
+// -------------------------------------------------------------- summary ----
+
+export function skillsSummary(ctx: Ctx, state: SkillsState): void {
+  echo(`Skills:   ${p(ctx.agentsDir, "skills")}`)
+  if (!ctx.dryRun) {
+    echo(`          ${state.present} universal skill(s) installed`)
+  }
+}
+
+export function skillsNextSteps(): void {
+  echo("Restart Claude Code (and Codex) to discover newly installed universal skills.")
+}

package/cli/src/engine-native/toolchain.ts

@@ -0,0 +1,257 @@
+/**
+ * Verified-version-floor layer over SoT/toolchain.json. Probe/install commands
+ * spawn deterministic argv arrays and are covered by golden regression cases.
+ */
+import { readFileSync, readSync } from "node:fs"
+
+import { capture, commandExists, isExecutable, p } from "./exec"
+import type { Ctx } from "./index"
+import { compareCodepoints, isObject, parseJson, type Json } from "./jq"
+import { echo, log, warn } from "./output"
+
+type InstallFn = (mode: "install" | "upgrade", version: string) => number
+
+function manifest(ctx: Ctx): { [k: string]: Json } {
+  const doc = parseJson(readFileSync(p(ctx.repoDir, "SoT", "toolchain.json"), "utf8"))
+  const tools = doc !== undefined && isObject(doc) ? doc["tools"] : undefined
+  return tools !== undefined && isObject(tools) ? tools : {}
+}
+
+export function field(ctx: Ctx, tool: string, name: string): string {
+  const entry = manifest(ctx)[tool]
+  if (entry === undefined || !isObject(entry)) return ""
+  const v = entry[name]
+  return v === undefined || v === null ? "" : String(v)
+}
+
+/** toolchain::_is_newer — numeric per dotted field, GNU-sort last-resort tie-break. */
+export function isNewer(a: string, b: string): boolean {
+  if (a === "" || b === "" || a === b) return false
+  const fa = a.split(".")
+  const fb = b.split(".")
+  for (let i = 0; i < 3; i++) {
+    const na = parseInt(fa[i] ?? "", 10) || 0
+    const nb = parseInt(fb[i] ?? "", 10) || 0
+    if (na !== nb) return na > nb
+  }
+  return compareCodepoints(a, b) > 0
+}
+
+export function present(ctx: Ctx, tool: string): boolean {
+  if (tool === "bun") {
+    return (
+      commandExists("bun") ||
+      isExecutable(p(process.env["BUN_INSTALL"] ?? p(ctx.home, ".bun"), "bin", "bun")) ||
+      isExecutable(p(ctx.home, ".bun", "bin", "bun"))
+    )
+  }
+  return commandExists(tool)
+}
+
+function firstLineField(out: string, index: number): string {
+  const fields = (out.split("\n")[0] ?? "").trim().split(/[ \t]+/)
+  return fields[index === -1 ? fields.length - 1 : index] ?? ""
+}
+
+export function installedVersion(ctx: Ctx, tool: string): string {
+  if (!present(ctx, tool)) return ""
+  switch (tool) {
+    case "rtk":
+      return firstLineField(capture("rtk", ["--version"]), 1)
+    case "claude":
+      return firstLineField(capture("claude", ["--version"]), 0)
+    case "codex":
+      return firstLineField(capture("codex", ["--version"]), -1)
+    case "bun":
+      return commandExists("bun") ? capture("bun", ["--version"]) : capture(p(ctx.home, ".bun", "bin", "bun"), ["--version"])
+    case "agent-browser":
+      return firstLineField(capture("agent-browser", ["--version"]), -1)
+    case "effect-solutions": {
+      const bunbin = commandExists("bun") ? "bun" : p(ctx.home, ".bun", "bin", "bun")
+      if (bunbin !== "bun" && !isExecutable(bunbin)) return ""
+      const m = /effect-solutions@([0-9][0-9.]*)/.exec(capture(bunbin, ["pm", "-g", "ls"]))
+      return m?.[1] ?? ""
+    }
+    case "node":
+      return capture("node", ["--version"]).replace(/^v/, "")
+    case "npm":
+      return capture("npm", ["--version"])
+    case "jq":
+      return capture("jq", ["--version"]).replace(/^jq-/, "")
+    case "curl":
+      return firstLineField(capture("curl", ["--version"]), 1)
+    case "tsc":
+      return firstLineField(capture("tsc", ["--version"]), 1)
+    default:
+      return ""
+  }
+}
+
+export function latestVersion(tool: string): string {
+  switch (tool) {
+    case "rtk": {
+      const body = capture("curl", ["-fsSL", "--max-time", "5", "https://api.github.com/repos/rtk-ai/rtk/releases/latest"])
+      const doc = parseJson(body)
+      const tag = doc !== undefined && isObject(doc) && typeof doc["tag_name"] === "string" ? doc["tag_name"] : ""
+      return tag.replace(/^v/, "")
+    }
+    case "agent-browser":
+    case "effect-solutions":
+      return commandExists("npm") ? capture("npm", ["view", tool, "version"]) : ""
+    default:
+      return ""
+  }
+}
+
+/** Blocking TTY prompt matching bash `read -r -p` (prompt on stderr). */
+function promptLine(prompt: string): string {
+  process.stderr.write(prompt)
+  const buf = Buffer.alloc(1)
+  let line = ""
+  for (;;) {
+    let n: number
+    try {
+      n = readSync(0, buf, 0, 1, null)
+    } catch {
+      break
+    }
+    if (n === 0) break
+    const ch = buf.toString("utf8")
+    if (ch === "\n") break
+    line += ch
+  }
+  return line.replace(/\r$/, "")
+}
+
+/** toolchain::_gate — { proceed, target } ("" target = latest). */
+function gate(ctx: Ctx, tool: string, mode: "install" | "upgrade", latest: string): { proceed: boolean; target: string } {
+  const verified = field(ctx, tool, "verified")
+  const pinnable = field(ctx, tool, "pinnable")
+
+  if (verified === "" || !isNewer(latest, verified)) return { proceed: true, target: "" }
+
+  if (ctx.assumeYes) {
+    warn(`${tool} ${latest} is newer than kit-verified ${verified} — proceeding (--yes)`)
+    return { proceed: true, target: "" }
+  }
+
+  if (process.stdin.isTTY === true) {
+    process.stderr.write(`\x1b[1;33m[warn]\x1b[0m ${tool} ${latest} is not kit-verified (verified: ${verified}).\n`)
+    const answer = promptLine(`Install ${tool} ${latest} anyway? [y/N] `)
+    if (/^[yY]/.test(answer)) return { proceed: true, target: "" }
+  }
+
+  if (mode === "install" && pinnable === "true") {
+    warn(`installing kit-verified ${tool} ${verified} instead of ${latest}`)
+    return { proceed: true, target: verified }
+  }
+  warn(
+    `skipping ${tool} ${mode} (latest ${latest} is above kit-verified ${verified}; pass --yes to accept, or update SoT/toolchain.json after testing)`
+  )
+  return { proceed: false, target: "" }
+}
+
+export function ensure(ctx: Ctx, tool: string, installFn: InstallFn): number {
+  const policy = field(ctx, tool, "policy")
+
+  if (!present(ctx, tool)) {
+    const latest = latestVersion(tool)
+    if (ctx.dryRun) {
+      echo(`[dry-run] would install ${tool} (${latest !== "" ? latest : "latest"}, gated by toolchain.json verified pin)`)
+      return 0
+    }
+    let target: string
+    if (latest === "") {
+      target = field(ctx, tool, "verified")
+      if (target !== "" && field(ctx, tool, "pinnable") === "true") {
+        warn(`${tool} latest version unknown (offline?) — installing kit-verified ${target} instead`)
+      } else {
+        target = ""
+        warn(`${tool} latest version unknown (offline?) and not pinnable — installing latest unverified`)
+      }
+    } else {
+      const g = gate(ctx, tool, "install", latest)
+      if (!g.proceed) return 0
+      target = g.target
+    }
+    return installFn("install", target !== "" ? target : latest)
+  }
+
+  const installed = installedVersion(ctx, tool)
+  const installedLabel = installed !== "" ? installed : "version unknown"
+
+  if (policy !== "track") {
+    if (ctx.dryRun) {
+      echo(`[dry-run] ${tool} present (${installedLabel})`)
+      return 0
+    }
+    log(`${tool} present (${installedLabel})`)
+    return 0
+  }
+
+  const latest = latestVersion(tool)
+  if (latest === "") {
+    if (ctx.dryRun) {
+      echo(`[dry-run] ${tool} present (${installedLabel}); latest unknown (offline?) — no action`)
+      return 0
+    }
+    log(`${tool} present (${installedLabel}; latest unknown — no action)`)
+    return 0
+  }
+
+  if (installed === "" || isNewer(latest, installed)) {
+    if (ctx.dryRun) {
+      echo(`[dry-run] would upgrade ${tool} (${installed !== "" ? installed : "unknown"} -> ${latest}, gated by toolchain.json verified pin)`)
+      return 0
+    }
+    const g = gate(ctx, tool, "upgrade", latest)
+    if (!g.proceed) return 0
+    return installFn("upgrade", g.target !== "" ? g.target : latest)
+  }
+
+  if (ctx.dryRun) {
+    echo(`[dry-run] ${tool} up to date (${installed})`)
+    return 0
+  }
+  log(`${tool} up to date (${installed})`)
+  return 0
+}
+
+function row(cells: [string, string, string, string, string, string]): string {
+  const widths = [28, 9, 14, 9, 9]
+  return cells.map((c, i) => (i < widths.length ? c.padEnd(widths[i]!) : c)).join(" ")
+}
+
+export function report(ctx: Ctx): void {
+  echo(row(["TOOL", "KIND", "INSTALLED", "FLOOR", "VERIFIED", "STATUS"]))
+  const platformOs =
+    process.platform === "linux" ? "linux" : process.platform === "darwin" ? "darwin" : process.platform === "win32" ? "windows" : ""
+  for (const tool of Object.keys(manifest(ctx)).sort(compareCodepoints)) {
+    const os = field(ctx, tool, "os")
+    if (os !== "" && platformOs !== "" && os !== platformOs) continue
+    const kind = field(ctx, tool, "kind")
+    const floor = field(ctx, tool, "floor")
+    const verified = field(ctx, tool, "verified")
+    const dash = (v: string): string => (v !== "" ? v : "-")
+    if (kind === "pin") {
+      echo(row([tool, kind, "(npx)", dash(floor), dash(verified), "pinned"]))
+      continue
+    }
+    let installed: string
+    let status: string
+    if (present(ctx, tool)) {
+      installed = installedVersion(ctx, tool)
+      status = "ok"
+      if (floor !== "" && installed !== "" && isNewer(floor, installed)) {
+        status = "below-floor"
+      } else if (verified !== "" && installed !== "" && isNewer(installed, verified)) {
+        status = "above-verified"
+      }
+      installed = installed !== "" ? installed : "?"
+    } else {
+      installed = "-"
+      status = "missing"
+    }
+    echo(row([tool, dash(kind), installed, dash(floor), dash(verified), status]))
+  }
+}