docks-kit 0.15.3 → 0.15.4

package/README.md

@@ -136,7 +136,7 @@ Tagging `cli-v*` builds six standalone binaries for Linux, macOS, and Windows
 on x64 and arm64. The workflow attaches them plus `SHA256SUMS` to the GitHub
 release. npm publishes the exact package tarball through trusted publishing
 with OIDC provenance.
-Package `docks-kit` 0.15.3 bundles the CLI + generated payload, so npm releases
+Package `docks-kit` 0.15.4 bundles the CLI + generated payload, so npm releases
 are versioned config snapshots without shipping the authoring `SoT/` tree.
 
 ## Deeper docs

package/cli/docs/install.md

@@ -31,29 +31,25 @@ are versioned config snapshots without publishing the authoring `SoT/` tree.
 Kit-home resolution remains available for checkout/package update behavior and
 display paths, but sync reads do not depend on it.
 
-### Bun 1.3.14 blocked-postinstall notice
+### Bun 1.4.0 install output
 
-A supported global install may finish successfully with this exact notice:
+A supported global install completes with no blocked postinstall: `bun pm -g
+untrusted` reports zero untrusted dependencies with scripts. Neither
+`@parcel/watcher` nor `esbuild` is in the consumer graph. The graph does carry
+one package with an `install` script, `msgpackr-extract` by way of
+`effect > msgpackr`, and Bun raises no trust prompt for it.
 
-```
-Blocked 1 postinstall. Run `bun pm -g untrusted` for details.
-```
-
-For the pinned production dependency graph, the diagnostic names only:
+The install does print one expected warning:
 
 ```
-./node_modules/@parcel/watcher @2.5.6
- » [install]: node scripts/build-from-source.js
+warn: incorrect peer dependency "effect@4.0.0-rc.109"
 ```
 
-`@parcel/watcher` is a transitive of the Effect Bun runtime. Supported default
-installs already carry its platform prebuilt package, and that install script
-only attempts a source build when `npm_config_build_from_source=true` was
-explicitly requested. `esbuild` is not in the consumer production graph. The
-blocked notice therefore needs no trust action for the supported default
-install; `docks-kit --version`, model catalogs, toolchain checks, and real sync
-remain functional with the script blocked. CI pins the one-package/one-command
-identity above and will fail if the script-bearing set changes.
+`@effect/platform-bun` resolves `@effect/platform-node-shared` through a caret
+range, which installs rc.111, and that release declares a peer requirement of
+`effect@^4.0.0-rc.111`. The kit pins `effect@4.0.0-rc.109` deliberately, so this
+newer transitive peer range cannot be satisfied. `docks-kit --version`, model
+catalogs, toolchain checks, and real sync are unaffected.
 
 ## 3. curl installer (POSIX)
 

package/cli/docs/toolchain.md

@@ -12,6 +12,8 @@
 
 `docks-kit toolchain check` reports each installed version against the
 manifest's `floor` and `verified` columns.
+Before running `bun install --frozen-lockfile`, the checkout launchers reject Bun versions below the manifest's `floor` and direct the user to `bun upgrade`.
+Their generated Bun floor is intentionally separate from the generated `verified` pin: the floor gates lockfile compatibility, while the verified pin selects the exact release for kit-driven installs.
 
 ## Managed tools
 

package/cli/src/engine.ts

@@ -25,11 +25,11 @@ const requireSupportedHost = () => {
     )
 }
 
-// bun build --compile runs the embedded entry from a virtual POSIX path
-// ("/$bunfs/root/…"). There process.execPath IS the CLI, so a re-spawn must
-// not pass main.ts.
-export const compiled =
-  process.argv[1] !== undefined && process.argv[1].startsWith("/$bunfs/")
+// In a compiled executable process.execPath IS the CLI, so a re-spawn must
+// not pass main.ts. Guarded because the unit suite imports this module under
+// Node, where the `Bun` global is absent; only a Bun-hosted standalone
+// executable can be compiled, so absence means false.
+export const compiled: boolean = typeof Bun !== "undefined" && Bun.isStandaloneExecutable === true
 
 export class EngineCaptureError extends ExitError {
   constructor(readonly diagnostic: string, code: number) {

package/cli/src/generated/sotPayload.ts

@@ -1,12 +1,12 @@
 // Generated by cli/scripts/generate-sot-payload.ts. DO NOT EDIT.
 // Edit SoT/, notification.mp3, or package.json, then run: bun cli/scripts/generate-sot-payload.ts
 
-export const GENERATED_PACKAGE_VERSION = "0.15.3"
+export const GENERATED_PACKAGE_VERSION = "0.15.4"
 
 export const GENERATED_PAYLOAD_TEXT = {
   "SoT/.agents/skills.txt": "# Universal AI-agent skill manifest intentionally empty.\n# Global skill discovery is opt-in: add one <owner>/<repo> slug per line.\n# EngineNative ignores comments and blank lines.\n",
   "SoT/models.json": "{\n  \"$comment\": \"Kit-verified model catalog — single source for EngineNative validators, the docks-kit CLI (models/model commands, pickers, and bare-flag help), and docs. Entries are research-proofed: update an entry and its tool-level `verified` date when a model ships or retires. Deploy-time model flags remain permissive.\",\n  \"claude\": {\n    \"verified\": \"2026-07-27\",\n    \"models\": [\n      { \"id\": \"best\", \"kind\": \"alias\", \"note\": \"Fable 5 where the org has access, latest Opus otherwise (Claude Code >=2.1.170)\" },\n      { \"id\": \"opus\", \"kind\": \"alias\", \"note\": \"latest Opus — the kit SoT default (Opus 5 on the Anthropic API from Claude Code >=2.1.219; Opus 4.6 on Microsoft Foundry)\" },\n      { \"id\": \"fable\", \"kind\": \"alias\", \"note\": \"Fable 5 — advisor opt-in default; needs org access + Claude Code >=2.1.170\" },\n      { \"id\": \"sonnet\", \"kind\": \"alias\", \"note\": \"latest Sonnet (currently Sonnet 5)\" },\n      { \"id\": \"haiku\", \"kind\": \"alias\", \"note\": \"latest Haiku (currently Haiku 4.5)\" },\n      { \"id\": \"default\", \"kind\": \"alias\", \"note\": \"engine pseudo-value: deletes the deployed model key so the account default applies\" },\n      { \"id\": \"claude-fable-5\", \"kind\": \"id\", \"note\": \"Fable 5\" },\n      { \"id\": \"claude-opus-5\", \"kind\": \"id\", \"note\": \"Opus 5 — needs Claude Code >=2.1.219\" },\n      { \"id\": \"claude-opus-4-8\", \"kind\": \"id\", \"note\": \"Opus 4.8\" },\n      { \"id\": \"claude-sonnet-5\", \"kind\": \"id\", \"note\": \"Sonnet 5\" },\n      { \"id\": \"claude-haiku-4-5-20251001\", \"kind\": \"id\", \"note\": \"Haiku 4.5\" }\n    ]\n  },\n  \"codex\": {\n    \"verified\": \"2026-07-16\",\n    \"models\": [\n      { \"id\": \"gpt-5.6-sol\", \"kind\": \"id\", \"note\": \"GPT-5.6 Sol — frontier, recommended default; the kit SoT pin\" },\n      { \"id\": \"gpt-5.6-terra\", \"kind\": \"id\", \"note\": \"GPT-5.6 Terra — balanced tier\" },\n      { \"id\": \"gpt-5.6-luna\", \"kind\": \"id\", \"note\": \"GPT-5.6 Luna — fast/light tier\" },\n      { \"id\": \"gpt-5.5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5.5\" },\n      { \"id\": \"gpt-5.1\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5\" }\n    ]\n  }\n}\n",
-  "SoT/toolchain.json": "{\n  \"$comment\": \"Kit toolchain manifest - DATA only (versions, floors, policy); version probing and the doctor report live in cli/src/engine-native/toolchain.ts, and the one managed install lives in cli/src/engine-native/bun.ts bunBootstrap. kind: check (doctor visibility only) | managed (kit installs it when missing) | pin (no binary probe - a version pin for a tool the kit invokes via npx). policy (managed only): present (install when missing, never upgrade). `verified` = last kit-tested version; `pinnable` marks a tool whose `verified` release the bootstrap can install by exact tag. Supply-chain stance: every kit-driven install is pinned to `verified` - never floating @latest (npm-worm/Shai-Hulud surface). Update `verified` after testing a new release.\",\n  \"tools\": {\n    \"jq\":     { \"kind\": \"check\", \"note\": \"optional operator CLI; EngineNative JSON and Claude runtime do not invoke it\" },\n    \"curl\":   { \"kind\": \"check\", \"note\": \"POSIX installer transport for the Bun bootstrap\" },\n    \"git\":    { \"kind\": \"check\", \"note\": \"plugin marketplaces (claude/codex clone them) + kit checkout updates\" },\n    \"node\":   { \"kind\": \"check\", \"note\": \"hosts the npm globals installed for the Claude LSP plugins\" },\n    \"npm\":    { \"kind\": \"check\", \"note\": \"npm-global installer; also backs the intelephense version probe (`npm ls -g`)\" },\n    \"claude\": { \"kind\": \"check\", \"floor\": \"2.1.219\", \"note\": \"kit floor — lets the `opus` alias select the newest Opus its provider offers (Anthropic API: 5; Foundry: 4.6) and subsumes Fable 5's >=2.1.170 requirement (mirrors settings minimumVersion)\" },\n    \"codex\":  { \"kind\": \"check\", \"note\": \"upstream-owned; standalone installer prints when missing\" },\n    \"ffplay\": { \"kind\": \"check\", \"note\": \"Notification hook sound; distro-installed, so no kit floor applies\" },\n    \"bwrap\":  { \"kind\": \"check\", \"os\": \"linux\", \"floor\": \"0.9.0\",\n                \"note\": \"Codex Linux sandbox runtime; sync installs it via the distro package manager, so the floor is the kit-tested baseline (Ubuntu 24.04 LTS) and no verified pin applies\" },\n    \"intelephense\": { \"kind\": \"check\", \"floor\": \"1.18.5\", \"verified\": \"1.18.5\",\n                \"note\": \"php-lsp server; `verified` pins claudeSync syncLspServers' npm install. Version comes from `npm ls -g` — its own --version prints minified source\" },\n    \"typescript-language-server\": { \"kind\": \"check\", \"floor\": \"5.3.0\", \"verified\": \"5.3.0\", \"note\": \"typescript-lsp server binary; `verified` pins claudeSync syncLspServers' npm install\" },\n    \"tsc\":    { \"kind\": \"check\", \"floor\": \"6.0.3\", \"verified\": \"6.0.3\", \"note\": \"typescript-lsp dependency (npm package `typescript`); `verified` pins claudeSync syncLspServers' npm install. Deliberately on the 6.x line: typescript-language-server embeds TypeScript's programmatic API, which TS7 (native) doesn't yet expose — the repo's own devDependency runs TS7 for tsc --noEmit\" },\n    \"bun\":    { \"kind\": \"managed\", \"policy\": \"present\", \"floor\": \"1.3.14\", \"verified\": \"1.3.14\", \"pinnable\": true,\n                \"note\": \"runtime for the docks-kit CLI and the Claude statusline/hook programs; bootstrap installs the verified release (installer takes bun-vX.Y.Z); self-updates via `bun upgrade` when wanted\" },\n    \"skills-cli\": { \"kind\": \"pin\", \"verified\": \"1.5.22\",\n                \"note\": \"the `skills` npm package the kit runs via `npx skills@<verified>` when SoT/.agents/skills.txt names a slug (it is empty by default) — pinned, never @latest\" }\n  }\n}\n",
+  "SoT/toolchain.json": "{\n  \"$comment\": \"Kit toolchain manifest - DATA only (versions, floors, policy); version probing and the doctor report live in cli/src/engine-native/toolchain.ts, and the one managed install lives in cli/src/engine-native/bun.ts bunBootstrap. kind: check (doctor visibility only) | managed (kit installs it when missing) | pin (no binary probe - a version pin for a tool the kit invokes via npx). policy (managed only): present (install when missing, never upgrade). `verified` = last kit-tested version; `pinnable` marks a tool whose `verified` release the bootstrap can install by exact tag. Supply-chain stance: every kit-driven install is pinned to `verified` - never floating @latest (npm-worm/Shai-Hulud surface). Update `verified` after testing a new release.\",\n  \"tools\": {\n    \"jq\":     { \"kind\": \"check\", \"note\": \"optional operator CLI; EngineNative JSON and Claude runtime do not invoke it\" },\n    \"curl\":   { \"kind\": \"check\", \"note\": \"POSIX installer transport for the Bun bootstrap\" },\n    \"git\":    { \"kind\": \"check\", \"note\": \"plugin marketplaces (claude/codex clone them) + kit checkout updates\" },\n    \"node\":   { \"kind\": \"check\", \"note\": \"hosts the npm globals installed for the Claude LSP plugins\" },\n    \"npm\":    { \"kind\": \"check\", \"note\": \"npm-global installer; also backs the intelephense version probe (`npm ls -g`)\" },\n    \"claude\": { \"kind\": \"check\", \"floor\": \"2.1.219\", \"note\": \"kit floor — lets the `opus` alias select the newest Opus its provider offers (Anthropic API: 5; Foundry: 4.6) and subsumes Fable 5's >=2.1.170 requirement (mirrors settings minimumVersion)\" },\n    \"codex\":  { \"kind\": \"check\", \"note\": \"upstream-owned; standalone installer prints when missing\" },\n    \"ffplay\": { \"kind\": \"check\", \"note\": \"Notification hook sound; distro-installed, so no kit floor applies\" },\n    \"bwrap\":  { \"kind\": \"check\", \"os\": \"linux\", \"floor\": \"0.9.0\",\n                \"note\": \"Codex Linux sandbox runtime; sync installs it via the distro package manager, so the floor is the kit-tested baseline (Ubuntu 24.04 LTS) and no verified pin applies\" },\n    \"intelephense\": { \"kind\": \"check\", \"floor\": \"1.18.5\", \"verified\": \"1.18.5\",\n                \"note\": \"php-lsp server; `verified` pins claudeSync syncLspServers' npm install. Version comes from `npm ls -g` — its own --version prints minified source\" },\n    \"typescript-language-server\": { \"kind\": \"check\", \"floor\": \"5.3.0\", \"verified\": \"5.3.0\", \"note\": \"typescript-lsp server binary; `verified` pins claudeSync syncLspServers' npm install\" },\n    \"tsc\":    { \"kind\": \"check\", \"floor\": \"6.0.3\", \"verified\": \"6.0.3\", \"note\": \"typescript-lsp dependency (npm package `typescript`); `verified` pins claudeSync syncLspServers' npm install. Deliberately on the 6.x line: typescript-language-server embeds TypeScript's programmatic API, which TS7 (native) doesn't yet expose — the repo's own devDependency runs TS7 for tsc --noEmit\" },\n    \"bun\":    { \"kind\": \"managed\", \"policy\": \"present\", \"floor\": \"1.4.0\", \"verified\": \"1.4.0\", \"pinnable\": true,\n                \"note\": \"runtime for the docks-kit CLI and the Claude statusline/hook programs; bootstrap installs the verified release (installer takes bun-vX.Y.Z); self-updates via `bun upgrade` when wanted\" },\n    \"skills-cli\": { \"kind\": \"pin\", \"verified\": \"1.5.22\",\n                \"note\": \"the `skills` npm package the kit runs via `npx skills@<verified>` when SoT/.agents/skills.txt names a slug (it is empty by default) — pinned, never @latest\" }\n  }\n}\n",
   "SoT/.claude/CLAUDE.md": "## Research Before Implementation\n\nBefore writing or modifying code that uses an API, hook, method, or config surface you have not verified in this session, research current documentation first.\n\nResearch workflow:\n1. Prefer official documentation and primary sources for the specific library, framework, or API.\n2. If a local docs or MCP tool is available, use it before broad web search.\n3. Only then proceed to implementation.\n\nResearch when:\n- Installing or configuring a dependency.\n- Using an API, hook, method, or pattern not verified in this session.\n- Upgrading or migrating between versions.\n- Any task where relying on memory could cause stale syntax or behavior.\n\nDo not:\n- Assume API signatures, method names, or config options from memory.\n- Generate framework code without checking current docs first.\n- Skip research because the library seems familiar.\n\n<constraint>\nResearch the codebase before editing. Never change code you have not read.\n</constraint>\n\n## Agentic Harness Heuristics\n\n**1. Persistence.** Keep going until the user's query is completely resolved. Only yield when sure the problem is solved. Before ending a turn, check the last paragraph: if it is a plan, a question you can answer yourself, or a promise of work not done (\"I'll…\"), do that work now.\n\n**2. Default to parallel.** Whenever you have multiple independent operations (reads, greps, web fetches, independent edits), invoke them in a single response with multiple tool-use blocks. Sequential calls only when output of one operation is required as input to the next.\n\n**3. Multi-pass search.** First-pass search often misses — vary the wording (colleague-questions over keywords) before concluding something doesn't exist.\n\n**4. Trace symbols.** Before modifying a symbol, trace it to its definitions and all usages. Don't assume a function's behavior or a type's shape from the call site alone.\n\n**5. Linter-loop 3-strike rule.** Don't loop more than 3 times fixing linter errors on the same file. On the third attempt, stop and ask the user — repeated failure usually means the diagnosis is wrong, not the code.\n\n**6. Read-before-Edit TTL.** If you haven't read a file with the Read tool in the last ~5 messages, re-read it before editing. Cached file content goes stale silently when the user edits between turns.\n\n**7. Big-file rule.** For files >1000 lines, prefer Grep + scoped Read (`offset` + `limit`) over reading the entire file. Whole-file reads bloat context; targeted reads keep the working set small.\n\n**8. Todo hygiene.** Use TaskCreate for items with meaningful outcome (≥5 min, distinct deliverable). Never include operational sub-actions (linting, testing, searching, examining the codebase) as their own todos — those are sub-steps in service of higher-level tasks. Mark complete immediately when done, never in batches.\n\n**9. Literal-instruction rule.** Current frontier models follow instructions literally — they do not silently generalize from intent. Phrase requirements as explicit checklists with success criteria, not narrative.\n\n**10. Context hygiene.** Prefer `/clear` at task boundaries and `/rewind` for wrong-path detours over carrying rot forward (corrections accumulate noise; rewinds preserve the prefix and discard the bad branch). On a continuing task, run `/compact` with steering before context quality degrades. Never stop, summarize, or suggest a new session on account of context limits.\n\n**11. Autonomy calibration.** For minor choices (naming, formatting, default values, which of two equivalent approaches), pick a reasonable option and note it — don't ask. Ask first only for scope changes, destructive actions, or decisions that change the deliverable. When the user is describing a problem or asking a question rather than requesting a change, the deliverable is your assessment — report findings and stop; don't apply fixes until asked. Don't close a finished task with \"Want me to also…?\" — run the obvious verification, then stop cleanly.\n\n**12. Capability triggering.** When the answer depends on current or version-specific information, search or fetch before answering — never answer from memory. When work fans out across independent items (many files to read, many tests to run, many candidates to check), delegate to parallel subagents; never spawn one for work you can complete directly. For verification, prefer a fresh-context subagent over self-critique. On tasks longer than a few turns, keep a running notes file and re-read it before each phase.\n\n<constraint>\nTreat the 12 heuristics above as protocol, not preference. If a turn ends without honoring an applicable one (e.g., lint-loop guard not respected, edit without re-read), self-correct in the next turn before continuing.\n</constraint>\n\nReuse before invention: inventory existing code, components, conventions, and dependencies; extend them instead of creating a parallel pattern. Load only the narrow skills supported by the task and repository evidence. If a request establishes a new React/Tailwind system and no convention exists, prefer current shadcn/ui `base-*` components backed by Base UI; otherwise preserve the existing stack. Treat probe, production access, publish, push, release, and deploy as literal current-request effects—never infer external authority from a plan, schedule, review, or old receipt.\n\nFor Docks plan reviews, cross-company review is standing-authorized; do not ask for export consent. This never overrides a host or platform security denial.\n\nUse a narrow-to-broad verification ladder: direct acceptance while iterating, focused regressions next, and one full CI at the pre-commit or release boundary. Reuse still-matching evidence; rerun full CI only after a relevant edit invalidates it.\n\n<constraint>\nNo secrets in committed config. Treat plugin marketplaces, installers, and downloaded artifacts as untrusted until verified.\n</constraint>\n",
   "SoT/.claude/mcp-servers.json": "{\n  \"mcpServers\": {}\n}\n",
   "SoT/.claude/settings.json": "{\n  \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n  \"minimumVersion\": \"2.1.219\",\n  \"model\": \"opus\",\n  \"effortLevel\": \"high\",\n  \"autoMemoryEnabled\": true,\n  \"skillListingMaxDescChars\": 2048,\n  \"respectGitignore\": true,\n  \"cleanupPeriodDays\": 14,\n  \"skillListingBudgetFraction\": 0.05,\n  \"env\": {\n    \"CLAUDE_CODE_MAX_OUTPUT_TOKENS\": \"64000\",\n    \"CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR\": \"1\",\n    \"CLAUDE_CODE_AUTO_COMPACT_WINDOW\": \"468000\",\n    \"CLAUDE_CODE_NO_FLICKER\": \"1\"\n  },\n  \"permissions\": {\n    \"defaultMode\": \"auto\",\n    \"allow\": [\n      \"Read\",\n      \"Glob\",\n      \"Grep\",\n      \"WebFetch\",\n      \"WebSearch\",\n      \"Edit(./)\",\n      \"Bash(git *)\",\n      \"Bash(git add *)\",\n      \"Bash(git commit *)\",\n      \"Bash(git status *)\",\n      \"Bash(git diff *)\",\n      \"Bash(git log *)\",\n      \"Bash(git branch *)\",\n      \"Bash(git checkout *)\",\n      \"Bash(git switch *)\",\n      \"Bash(git stash *)\",\n      \"Bash(git fetch *)\",\n      \"Bash(git pull *)\",\n      \"Bash(git tag *)\",\n      \"Bash(git show *)\",\n      \"Bash(git blame *)\",\n      \"Bash(git worktree *)\",\n      \"Bash(gh *)\",\n      \"Bash(pnpm *)\",\n      \"Bash(npm *)\",\n      \"Bash(npx *)\",\n      \"Bash(node *)\",\n      \"Bash(docker *)\",\n      \"Bash(docker-compose *)\",\n      \"Bash(ls *)\",\n      \"Bash(cat *)\",\n      \"Bash(find *)\",\n      \"Bash(grep *)\",\n      \"Bash(head *)\",\n      \"Bash(tail *)\",\n      \"Bash(wc *)\",\n      \"Bash(sort *)\",\n      \"Bash(uniq *)\",\n      \"Bash(diff *)\",\n      \"Bash(which *)\",\n      \"Bash(pwd *)\",\n      \"Bash(date *)\",\n      \"Bash(mkdir *)\",\n      \"Bash(basename *)\",\n      \"Bash(dirname *)\",\n      \"Bash(realpath *)\",\n      \"Bash(jq *)\",\n      \"Bash(curl *)\",\n      \"Bash(tree *)\",\n      \"Bash(sed *)\",\n      \"Bash(awk *)\",\n      \"Bash(cut *)\",\n      \"Bash(tr *)\",\n      \"Bash(tee *)\",\n      \"Bash(echo *)\",\n      \"Bash(printf *)\",\n      \"Bash(env *)\",\n      \"Bash(printenv *)\",\n      \"Bash(uname *)\",\n      \"Bash(file *)\",\n      \"Bash(stat *)\",\n      \"Bash(du *)\",\n      \"Bash(id *)\",\n      \"Bash(whoami *)\",\n      \"Bash(php *)\",\n      \"Bash(composer *)\",\n      \"Bash(python3 *)\",\n      \"Bash(python *)\",\n      \"Bash(pip *)\",\n      \"Bash(pip3 *)\",\n      \"PowerShell(git *)\",\n      \"PowerShell(git add *)\",\n      \"PowerShell(git commit *)\",\n      \"PowerShell(git status *)\",\n      \"PowerShell(git diff *)\",\n      \"PowerShell(git log *)\",\n      \"PowerShell(git branch *)\",\n      \"PowerShell(git checkout *)\",\n      \"PowerShell(git switch *)\",\n      \"PowerShell(git stash *)\",\n      \"PowerShell(git fetch *)\",\n      \"PowerShell(git pull *)\",\n      \"PowerShell(git tag *)\",\n      \"PowerShell(git show *)\",\n      \"PowerShell(git blame *)\",\n      \"PowerShell(git worktree *)\",\n      \"PowerShell(gh *)\",\n      \"PowerShell(pnpm *)\",\n      \"PowerShell(npm *)\",\n      \"PowerShell(npx *)\",\n      \"PowerShell(node *)\",\n      \"PowerShell(docker *)\",\n      \"PowerShell(docker-compose *)\",\n      \"PowerShell(ls *)\",\n      \"PowerShell(cat *)\",\n      \"PowerShell(find *)\",\n      \"PowerShell(grep *)\",\n      \"PowerShell(head *)\",\n      \"PowerShell(tail *)\",\n      \"PowerShell(wc *)\",\n      \"PowerShell(sort *)\",\n      \"PowerShell(uniq *)\",\n      \"PowerShell(diff *)\",\n      \"PowerShell(which *)\",\n      \"PowerShell(pwd *)\",\n      \"PowerShell(date *)\",\n      \"PowerShell(mkdir *)\",\n      \"PowerShell(basename *)\",\n      \"PowerShell(dirname *)\",\n      \"PowerShell(realpath *)\",\n      \"PowerShell(jq *)\",\n      \"PowerShell(curl *)\",\n      \"PowerShell(tree *)\",\n      \"PowerShell(sed *)\",\n      \"PowerShell(awk *)\",\n      \"PowerShell(cut *)\",\n      \"PowerShell(tr *)\",\n      \"PowerShell(tee *)\",\n      \"PowerShell(echo *)\",\n      \"PowerShell(printf *)\",\n      \"PowerShell(env *)\",\n      \"PowerShell(printenv *)\",\n      \"PowerShell(uname *)\",\n      \"PowerShell(file *)\",\n      \"PowerShell(stat *)\",\n      \"PowerShell(du *)\",\n      \"PowerShell(id *)\",\n      \"PowerShell(whoami *)\",\n      \"PowerShell(php *)\",\n      \"PowerShell(composer *)\",\n      \"PowerShell(python3 *)\",\n      \"PowerShell(python *)\",\n      \"PowerShell(pip *)\",\n      \"PowerShell(pip3 *)\"\n    ],\n    \"deny\": [\n      \"Read(**/.env)\",\n      \"Read(**/.env.local)\",\n      \"Read(**/secrets/**)\",\n      \"Read(**/*.key)\",\n      \"Read(**/*.pem)\",\n      \"Read(**/*.p12)\",\n      \"Read(**/.credentials*)\",\n      \"Edit(**/.env)\",\n      \"Edit(**/.env.local)\",\n      \"Edit(**/secrets/**)\",\n      \"Bash(sudo *)\",\n      \"Bash(rm -rf /)\",\n      \"Bash(rm -rf / *)\",\n      \"Bash(rm -rf ~)\",\n      \"Bash(rm -rf ~ *)\",\n      \"Bash(rm -rf $HOME)\",\n      \"Bash(rm -rf $HOME *)\",\n      \"Bash(> /dev *)\",\n      \"Bash(dd if= *)\",\n      \"Bash(mkfs *)\",\n      \"Bash(eval *)\",\n      \"Bash(chmod 777 *)\",\n      \"Bash(chmod -R 777 *)\",\n      \"Bash(git push --force origin main *)\",\n      \"Bash(git push --force origin master *)\",\n      \"Bash(git push -f origin main *)\",\n      \"Bash(git push -f origin master *)\",\n      \"PowerShell(sudo *)\",\n      \"PowerShell(rm -rf /)\",\n      \"PowerShell(rm -rf / *)\",\n      \"PowerShell(rm -rf ~)\",\n      \"PowerShell(rm -rf ~ *)\",\n      \"PowerShell(rm -rf $HOME)\",\n      \"PowerShell(rm -rf $HOME *)\",\n      \"PowerShell(> /dev *)\",\n      \"PowerShell(dd if= *)\",\n      \"PowerShell(mkfs *)\",\n      \"PowerShell(eval *)\",\n      \"PowerShell(chmod 777 *)\",\n      \"PowerShell(chmod -R 777 *)\",\n      \"PowerShell(git push --force origin main *)\",\n      \"PowerShell(git push --force origin master *)\",\n      \"PowerShell(git push -f origin main *)\",\n      \"PowerShell(git push -f origin master *)\",\n      \"PowerShell(Remove-Item *-Recurse* /)\",\n      \"PowerShell(Remove-Item *-Recurse* / *)\",\n      \"PowerShell(Remove-Item / *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path / *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath / *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* ~)\",\n      \"PowerShell(Remove-Item *-Recurse* ~ *)\",\n      \"PowerShell(Remove-Item ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME *)\",\n      \"PowerShell(Remove-Item $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(Remove-Item $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\ *)\",\n      \"PowerShell(Remove-Item \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\ *)\",\n      \"PowerShell(Remove-Item *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* /)\",\n      \"PowerShell(del *-Recurse* / *)\",\n      \"PowerShell(del / *-Recurse*)\",\n      \"PowerShell(del -Path / *-Recurse*)\",\n      \"PowerShell(del -LiteralPath / *-Recurse*)\",\n      \"PowerShell(del *-Recurse* ~)\",\n      \"PowerShell(del *-Recurse* ~ *)\",\n      \"PowerShell(del ~ *-Recurse*)\",\n      \"PowerShell(del -Path ~ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $HOME)\",\n      \"PowerShell(del *-Recurse* $HOME *)\",\n      \"PowerShell(del $HOME *-Recurse*)\",\n      \"PowerShell(del -Path $HOME *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(del $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del *-Recurse* \\\\)\",\n      \"PowerShell(del *-Recurse* \\\\ *)\",\n      \"PowerShell(del \\\\ *-Recurse*)\",\n      \"PowerShell(del -Path \\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* *:\\\\)\",\n      \"PowerShell(del *-Recurse* *:\\\\ *)\",\n      \"PowerShell(del *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* /)\",\n      \"PowerShell(erase *-Recurse* / *)\",\n      \"PowerShell(erase / *-Recurse*)\",\n      \"PowerShell(erase -Path / *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath / *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* ~)\",\n      \"PowerShell(erase *-Recurse* ~ *)\",\n      \"PowerShell(erase ~ *-Recurse*)\",\n      \"PowerShell(erase -Path ~ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $HOME)\",\n      \"PowerShell(erase *-Recurse* $HOME *)\",\n      \"PowerShell(erase $HOME *-Recurse*)\",\n      \"PowerShell(erase -Path $HOME *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(erase $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* \\\\)\",\n      \"PowerShell(erase *-Recurse* \\\\ *)\",\n      \"PowerShell(erase \\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path \\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* *:\\\\)\",\n      \"PowerShell(erase *-Recurse* *:\\\\ *)\",\n      \"PowerShell(erase *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* /)\",\n      \"PowerShell(rd *-Recurse* / *)\",\n      \"PowerShell(rd / *-Recurse*)\",\n      \"PowerShell(rd -Path / *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* ~)\",\n      \"PowerShell(rd *-Recurse* ~ *)\",\n      \"PowerShell(rd ~ *-Recurse*)\",\n      \"PowerShell(rd -Path ~ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $HOME)\",\n      \"PowerShell(rd *-Recurse* $HOME *)\",\n      \"PowerShell(rd $HOME *-Recurse*)\",\n      \"PowerShell(rd -Path $HOME *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rd $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* \\\\)\",\n      \"PowerShell(rd *-Recurse* \\\\ *)\",\n      \"PowerShell(rd \\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* *:\\\\)\",\n      \"PowerShell(rd *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rd *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* /)\",\n      \"PowerShell(ri *-Recurse* / *)\",\n      \"PowerShell(ri / *-Recurse*)\",\n      \"PowerShell(ri -Path / *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath / *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* ~)\",\n      \"PowerShell(ri *-Recurse* ~ *)\",\n      \"PowerShell(ri ~ *-Recurse*)\",\n      \"PowerShell(ri -Path ~ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $HOME)\",\n      \"PowerShell(ri *-Recurse* $HOME *)\",\n      \"PowerShell(ri $HOME *-Recurse*)\",\n      \"PowerShell(ri -Path $HOME *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(ri $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* \\\\)\",\n      \"PowerShell(ri *-Recurse* \\\\ *)\",\n      \"PowerShell(ri \\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path \\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* *:\\\\)\",\n      \"PowerShell(ri *-Recurse* *:\\\\ *)\",\n      \"PowerShell(ri *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* /)\",\n      \"PowerShell(rm *-Recurse* / *)\",\n      \"PowerShell(rm / *-Recurse*)\",\n      \"PowerShell(rm -Path / *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* ~)\",\n      \"PowerShell(rm *-Recurse* ~ *)\",\n      \"PowerShell(rm ~ *-Recurse*)\",\n      \"PowerShell(rm -Path ~ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $HOME)\",\n      \"PowerShell(rm *-Recurse* $HOME *)\",\n      \"PowerShell(rm $HOME *-Recurse*)\",\n      \"PowerShell(rm -Path $HOME *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rm $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* \\\\)\",\n      \"PowerShell(rm *-Recurse* \\\\ *)\",\n      \"PowerShell(rm \\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* *:\\\\)\",\n      \"PowerShell(rm *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rm *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* /)\",\n      \"PowerShell(rmdir *-Recurse* / *)\",\n      \"PowerShell(rmdir / *-Recurse*)\",\n      \"PowerShell(rmdir -Path / *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* ~)\",\n      \"PowerShell(rmdir *-Recurse* ~ *)\",\n      \"PowerShell(rmdir ~ *-Recurse*)\",\n      \"PowerShell(rmdir -Path ~ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $HOME)\",\n      \"PowerShell(rmdir *-Recurse* $HOME *)\",\n      \"PowerShell(rmdir $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -Path $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rmdir $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* \\\\)\",\n      \"PowerShell(rmdir *-Recurse* \\\\ *)\",\n      \"PowerShell(rmdir \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rmdir *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(Start-Process *-Verb RunAs*)\",\n      \"PowerShell(Invoke-Expression *)\",\n      \"PowerShell(iex *)\",\n      \"PowerShell(Format-Volume *)\",\n      \"PowerShell(icacls */grant*Everyone:F*)\",\n      \"PowerShell(icacls */grant*Everyone:(F)*)\"\n    ],\n    \"ask\": [\n      \"Bash(git clean *)\",\n      \"Bash(docker volume rm *)\",\n      \"Bash(docker system prune *)\",\n      \"PowerShell(git clean *)\",\n      \"PowerShell(docker volume rm *)\",\n      \"PowerShell(docker system prune *)\"\n    ]\n  },\n  \"hooks\": {\n    \"SessionStart\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_SESSION_START__\"],\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"Notification\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_NOTIFY__\"],\n            \"timeout\": 10,\n            \"async\": true\n          }\n        ]\n      }\n    ],\n    \"PostToolUseFailure\": [\n      {\n        \"matcher\": \"Bash|PowerShell\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"echo '{\\\"hookSpecificOutput\\\":{\\\"hookEventName\\\":\\\"PostToolUseFailure\\\",\\\"additionalContext\\\":\\\"Last bash command failed. Repository / file state may have shifted \\u2014 re-read affected files before retrying. If the failure is a missing dependency or env mismatch, surface it to the user rather than retrying blindly.\\\"}}'\",\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"SubagentStop\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"prompt\",\n            \"prompt\": \"You are a quality gate for subagent outputs in a multi-agent code-analysis pipeline.\\n\\nEvaluate the subagent's `last_assistant_message` field (in the JSON below) against these requirements:\\n\\n1. ALLOW (return `{}`): Mode-selection or no-issues responses. Examples: \\\"Which mode do you prefer\\\", \\\"select an option\\\", \\\"no issues / problems / violations / blockers found\\\".\\n\\n2. ALLOW (return `{}`): Output contains at least one concrete file:line citation \\u2014 e.g. `src/auth.ts:42`, `lib/db.ts:100-115`, or path references that include line numbers.\\n\\n3. BLOCK (return `{\\\"decision\\\":\\\"block\\\",\\\"reason\\\":\\\"<one-line explanation>\\\"}`): Output claims about code or findings WITHOUT concrete file:line citations. Vague references like \\\"the auth handler\\\" or \\\"near the database code\\\" are not acceptable as the only evidence.\\n\\nSubagent invocation JSON:\\n$ARGUMENTS\\n\\nReturn ONLY the JSON decision (no commentary, no markdown fences).\",\n            \"timeout\": 30\n          }\n        ]\n      }\n    ]\n  },\n  \"statusLine\": {\n    \"type\": \"command\",\n    \"command\": \"__DOCKS_KIT_STATUSLINE__\",\n    \"refreshInterval\": 5\n  },\n  \"enabledPlugins\": {\n    \"docks@docks\": true,\n    \"plan-lifecycle@docks\": true,\n    \"php-lsp@claude-plugins-official\": true,\n    \"typescript-lsp@claude-plugins-official\": true\n  },\n  \"extraKnownMarketplaces\": {\n    \"docks\": {\n      \"source\": {\n        \"source\": \"github\",\n        \"repo\": \"DocksDocks/docks\"\n      }\n    }\n  },\n  \"alwaysThinkingEnabled\": true,\n  \"showThinkingSummaries\": true,\n  \"viewMode\": \"default\",\n  \"theme\": \"dark-daltonized\",\n  \"skipDangerousModePermissionPrompt\": true\n}\n",
@@ -40,4 +40,4 @@ export const GENERATED_PAYLOAD_PATHS = [
   "notification.mp3"
 ] as const
 
-export const GENERATED_PAYLOAD_HASH = "0731027e7794f1864a544774f6c29292636be535f8d1f020374c1d1d2ccf6dc5"
+export const GENERATED_PAYLOAD_HASH = "6df6dc96471e467988d977447657fa87b44233aded1a45f6132edebffb3e24ee"

package/docks-kit

@@ -8,9 +8,13 @@ set -euo pipefail
 REPO_DIR="$(cd "$(dirname "$0")" && pwd)"
 
 # BEGIN GENERATED BUN PIN
-BUN_PIN="1.3.14"
+BUN_PIN="1.4.0"
 # END GENERATED BUN PIN
 
+# BEGIN GENERATED BUN FLOOR
+BUN_FLOOR="1.4.0"
+# END GENERATED BUN FLOOR
+
 HOST="$(uname -s)-$(uname -m)"
 case "$HOST" in
   Linux-x86_64)  KIT_BIN="docks-kit-linux-x64" ;;
@@ -50,6 +54,35 @@ find_bun() {
   return 1
 }
 
+bun_version_at_least() {
+  local installed="${1%%[-+]*}"
+  local required="${2%%[-+]*}"
+  local installed_major installed_minor installed_patch
+  local required_major required_minor required_patch
+
+  if [[ "$installed" =~ ^([0-9]{1,9})\.([0-9]{1,9})\.([0-9]{1,9})$ ]]; then
+    installed_major="${BASH_REMATCH[1]}"
+    installed_minor="${BASH_REMATCH[2]}"
+    installed_patch="${BASH_REMATCH[3]}"
+  else
+    return 2
+  fi
+  if [[ "$required" =~ ^([0-9]{1,9})\.([0-9]{1,9})\.([0-9]{1,9})$ ]]; then
+    required_major="${BASH_REMATCH[1]}"
+    required_minor="${BASH_REMATCH[2]}"
+    required_patch="${BASH_REMATCH[3]}"
+  else
+    return 2
+  fi
+
+  if (( 10#$installed_major > 10#$required_major )); then return 0; fi
+  if (( 10#$installed_major < 10#$required_major )); then return 1; fi
+  if (( 10#$installed_minor > 10#$required_minor )); then return 0; fi
+  if (( 10#$installed_minor < 10#$required_minor )); then return 1; fi
+  if (( 10#$installed_patch >= 10#$required_patch )); then return 0; fi
+  return 1
+}
+
 if ! BUN="$(find_bun)"; then
   echo "[docks-kit] Bun not found — installing (download-then-run)..." >&2
   if ! command -v curl >/dev/null 2>&1; then
@@ -70,6 +103,14 @@ fi
 # Sentinel is a real dependency dir, not bare node_modules/ — a failed or
 # partial install leaves node_modules/ present and would suppress the repair.
 if [[ ! -d "$REPO_DIR/node_modules/effect" ]]; then
+  BUN_VERSION="$("$BUN" --version 2>/dev/null || true)"
+  BUN_VERSION="${BUN_VERSION%$'\r'}"
+  bun_version_status=0
+  bun_version_at_least "$BUN_VERSION" "$BUN_FLOOR" || bun_version_status=$?
+  if [[ "$bun_version_status" -eq 1 ]]; then
+    echo "[docks-kit] Bun $BUN_VERSION is below the required floor $BUN_FLOOR; this checkout's lockfile requires Bun $BUN_FLOOR or newer. Run: bun upgrade" >&2
+    exit 1
+  fi
   echo "[docks-kit] Installing CLI dependencies (bun install --frozen-lockfile)..." >&2
   (cd "$REPO_DIR" && "$BUN" install --frozen-lockfile >/dev/null)
 fi

package/docks-kit.ps1

@@ -8,9 +8,13 @@ $ErrorActionPreference = 'Stop'
 $RepoDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 
 # BEGIN GENERATED BUN PIN
-$BunPin = "1.3.14"
+$BunPin = "1.4.0"
 # END GENERATED BUN PIN
 
+# BEGIN GENERATED BUN FLOOR
+$BunFloor = "1.4.0"
+# END GENERATED BUN FLOOR
+
 $ProcessorArchitecture = if (-not [string]::IsNullOrWhiteSpace($env:PROCESSOR_ARCHITEW6432)) {
   $env:PROCESSOR_ARCHITEW6432
 } else {
@@ -107,6 +111,32 @@ if ($null -eq $Bun) {
 # Sentinel is a real dependency dir, not bare node_modules\ — a failed or
 # partial install leaves node_modules\ present and would suppress the repair.
 if (-not (Test-Path -LiteralPath (Join-Path $RepoDir 'node_modules\effect') -PathType Container)) {
+  $DetectedBunVersion = ''
+  try {
+    $BunOutput = & $Bun --version 2>$null
+    if ($LASTEXITCODE -eq 0) {
+      $DetectedBunVersion = ([string]($BunOutput -join "`n")).TrimEnd("`r")
+    }
+  } catch {
+    $DetectedBunVersion = ''
+  }
+
+  $NormalizedBunVersion = $DetectedBunVersion -replace '[-+].*$', ''
+  $InstalledBunVersion = $null
+  $RequiredBunVersion = $null
+  if ($NormalizedBunVersion -match '^\d+\.\d+\.\d+$' -and $BunFloor -match '^\d+\.\d+\.\d+$') {
+    try {
+      $InstalledBunVersion = [version]::Parse($NormalizedBunVersion)
+      $RequiredBunVersion = [version]::Parse($BunFloor)
+    } catch {
+      $InstalledBunVersion = $null
+      $RequiredBunVersion = $null
+    }
+  }
+  if ($null -ne $InstalledBunVersion -and $null -ne $RequiredBunVersion -and $InstalledBunVersion -lt $RequiredBunVersion) {
+    [Console]::Error.WriteLine("[docks-kit] Bun $DetectedBunVersion is below the required floor $BunFloor; this checkout's lockfile requires Bun $BunFloor or newer. Run: bun upgrade")
+    exit 1
+  }
   [Console]::Error.WriteLine('[docks-kit] Installing CLI dependencies (bun install --frozen-lockfile)...')
   Push-Location $RepoDir
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docks-kit",
-  "version": "0.15.3",
+  "version": "0.15.4",
   "description": "Portable AI coding agent config kit — SoT sync engine + typed CLI for Claude Code, Codex, and universal agent skills",
   "type": "module",
   "license": "MIT",
@@ -36,7 +36,7 @@
     "test:unit": "vitest run",
     "test:runtime:posix": "bun cli/test/statusline-runtime-smoke.mjs posix",
     "test:runtime:windows": "bun cli/test/statusline-runtime-smoke.mjs windows",
-    "test:ci": "bun run check:generated && bun run typecheck && bun run test:unit && bun run test:runtime:posix && bun run golden:dryrun && bun run golden:mutation"
+    "test:ci": "bun run check:generated && bun run --parallel typecheck test:unit golden:dryrun golden:mutation && bun run test:runtime:posix"
   },
   "dependencies": {
     "@effect/platform-bun": "4.0.0-rc.109",
@@ -44,7 +44,7 @@
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-rc.109",
-    "@types/bun": "^1.3.0",
+    "@types/bun": "^1.4.0",
     "typescript": "7.0.2",
     "vitest": "4.1.10"
   }