docks-kit 0.16.4 → 0.16.6

package/cli/src/engine-native/codexToml.ts

@@ -1,7 +1,8 @@
 /**
- * Top-level Codex TOML setting replacement plus `--codex-model`. The pass is
- * line-based on purpose: a TOML library would reformat user configs and break
- * the golden contract. The key is used as a raw regex fragment, preserving the
+ * Line-based Codex TOML passes: top-level setting replacement, the SoT
+ * top-level and table merges used by `sync codex`, and `--codex-model` /
+ * `--codex-effort`. A TOML library would reformat user configs and break the
+ * golden contract. The key is used as a raw regex fragment, preserving the
  * historical record-oriented behavior.
  */
 import { p } from "./exec"
@@ -110,3 +111,143 @@ export function syncCodexEffort(ctx: Ctx, effort: string): void {
     unchanged: `Effort: deployed Codex model_reasoning_effort already ${resolved}`
   })
 }
+
+export function mergeTopLevelSettings(sotConfigText: string, userConfig: string): void {
+  for (const line of sotConfigText.split("\n")) {
+    if (line.startsWith("[")) break
+    if (/^[ \t]*($|#)/.test(line)) continue
+    if (!/^[A-Za-z0-9_.-]+[ \t]*=/.test(line)) continue
+    const key = line.slice(0, line.indexOf("=")).replace(/[ \t]+$/, "")
+    replaceTopLevelSettingInFile(userConfig, key, line)
+  }
+}
+
+interface TomlTableHeader {
+  readonly path: string
+}
+
+const TOML_BASIC_ESCAPES: Readonly<Record<string, string>> = {
+  b: "\b",
+  t: "\t",
+  n: "\n",
+  f: "\f",
+  r: "\r",
+  '"': '"',
+  "\\": "\\"
+}
+
+function tomlBasicEscape(line: string, offset: number): { readonly next: number; readonly value: string } | undefined {
+  const escaped = line[offset]
+  const simple = escaped === undefined ? undefined : TOML_BASIC_ESCAPES[escaped]
+  if (simple !== undefined) return { next: offset + 1, value: simple }
+  const digits = escaped === "u" ? 4 : escaped === "U" ? 8 : 0
+  if (digits === 0) return undefined
+  const hex = line.slice(offset + 1, offset + 1 + digits)
+  if (hex.length !== digits || !/^[0-9A-Fa-f]+$/.test(hex)) return undefined
+  const codePoint = Number.parseInt(hex, 16)
+  if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff)) return undefined
+  return { next: offset + 1 + digits, value: String.fromCodePoint(codePoint) }
+}
+
+/** Decode a table header to the TOML path that determines managed ownership. */
+function tomlTableHeader(line: string): TomlTableHeader | undefined {
+  let offset = 0
+  const skipWhitespace = (): void => {
+    while (line[offset] === " " || line[offset] === "\t") offset++
+  }
+
+  skipWhitespace()
+  if (line[offset] !== "[") return undefined
+  offset++
+  const array = line[offset] === "["
+  if (array) offset++
+
+  const keys: Array<string> = []
+  while (true) {
+    skipWhitespace()
+    const quote = line[offset]
+    let key = ""
+    if (quote === '"' || quote === "'") {
+      offset++
+      let closed = false
+      while (offset < line.length) {
+        const char = line[offset]!
+        if (char === quote) {
+          offset++
+          closed = true
+          break
+        }
+        if (quote === '"' && char === "\\") {
+          const escape = tomlBasicEscape(line, offset + 1)
+          if (escape === undefined) return undefined
+          key += escape.value
+          offset = escape.next
+          continue
+        }
+        if (char === "\n" || char === "\r") return undefined
+        key += char
+        offset++
+      }
+      if (!closed) return undefined
+    } else {
+      const start = offset
+      while (offset < line.length && /[A-Za-z0-9_-]/.test(line[offset]!)) offset++
+      if (offset === start) return undefined
+      key = line.slice(start, offset)
+    }
+    keys.push(key)
+
+    skipWhitespace()
+    if (line[offset] === ".") {
+      offset++
+      continue
+    }
+    if (line[offset] !== "]") return undefined
+    offset++
+    if (array) {
+      if (line[offset] !== "]") return undefined
+      offset++
+    }
+    skipWhitespace()
+    if (offset < line.length && line[offset] !== "#") return undefined
+    return { path: JSON.stringify(keys) }
+  }
+}
+
+function mergeTableSettingsText(sotConfigText: string, userConfigText: string): string {
+  const sotLines = sotConfigText.split("\n")
+  let merged = userConfigText
+  for (let tableOffset = 0; tableOffset < sotLines.length; tableOffset++) {
+    const managedHeader = tomlTableHeader(sotLines[tableOffset]!)
+    if (managedHeader === undefined) continue
+
+    const block: Array<string> = []
+    for (let blockOffset = tableOffset; blockOffset < sotLines.length; blockOffset++) {
+      const line = sotLines[blockOffset]!
+      if (blockOffset !== tableOffset && tomlTableHeader(line) !== undefined) break
+      block.push(line)
+    }
+    const tableBlock = block.join("\n").replace(/\n+$/, "")
+
+    const userLines = merged.split("\n")
+    if (userLines[userLines.length - 1] === "") userLines.pop()
+    let skip = false
+    const kept: Array<string> = []
+    for (const line of userLines) {
+      const header = tomlTableHeader(line)
+      if (header !== undefined) {
+        skip = header.path === managedHeader.path
+        if (skip) continue
+      }
+      if (!skip) kept.push(line)
+    }
+    merged = `${kept.join("\n")}\n\n${tableBlock}\n`
+  }
+  return merged
+}
+
+export function mergeTableSettings(sotConfigText: string, userConfig: string): void {
+  const next = mergeTableSettingsText(sotConfigText, readFileSync(userConfig, "utf8"))
+  writeFileSync(`${userConfig}.tmp`, next)
+  renameSync(`${userConfig}.tmp`, userConfig)
+}

package/cli/src/engine-native/exec.ts

@@ -116,7 +116,7 @@ export function commandExists(name: string): boolean {
   return which(name) !== ""
 }
 
-export function isExecutable(path: string, suffixes: ReadonlyArray<string> = hostOs().executableSuffixes): boolean {
+function isExecutable(path: string, suffixes: ReadonlyArray<string> = hostOs().executableSuffixes): boolean {
   try {
     if (!statSync(path).isFile()) return false
     if (suffixes.some((suffix) => suffix !== "")) {
@@ -148,7 +148,3 @@ export function writeBytesIfChanged(path: string, content: Uint8Array): boolean
   writeFileSync(path, bytes)
   return true
 }
-
-export function writeFileIfChanged(path: string, content: string): boolean {
-  return writeTextIfChanged(path, content)
-}

package/cli/src/engine-native/jq.ts

@@ -11,6 +11,8 @@
  *   - output formatting: 2-space indent, UTF-8 raw, trailing newline.
  */
 
+import { existsSync, readFileSync } from "node:fs"
+
 export type Json = null | boolean | number | string | Array<Json> | { [key: string]: Json }
 
 export function isObject(v: Json): v is { [key: string]: Json } {
@@ -61,3 +63,8 @@ export function parseJson(text: string): Json | undefined {
     return undefined
   }
 }
+
+/** Parse a JSON file with `parseJson` semantics; a missing file is `undefined`. */
+export function readJsonFile(file: string): Json | undefined {
+  return existsSync(file) ? parseJson(readFileSync(file, "utf8")) : undefined
+}

package/cli/src/engine-native/models.ts

@@ -6,6 +6,16 @@ import type { Ctx } from "./index"
 import { isObject, parseJson, type Json } from "./jq"
 import { payloadDisplayPath, payloadText } from "../payload"
 
+export interface ModelEntry {
+  readonly id: string
+  readonly kind: "alias" | "id"
+  readonly note?: string
+}
+
+export interface ModelCatalog {
+  readonly verified: string
+  readonly models: ReadonlyArray<ModelEntry>
+}
 
 function toolEntry(tool: string): { [k: string]: Json } | undefined {
   const doc = parseJson(payloadText("SoT/models.json"))
@@ -14,16 +24,28 @@ function toolEntry(tool: string): { [k: string]: Json } | undefined {
   return entry !== undefined && isObject(entry) ? entry : undefined
 }
 
-function modelEntries(tool: string): Array<{ [k: string]: Json }> {
-  const entry = toolEntry(tool)
+function modelEntries(entry: { [k: string]: Json } | undefined): Array<{ [k: string]: Json }> {
   const models = entry?.["models"]
   return Array.isArray(models) ? models.filter(isObject) : []
 }
 
-export function modelsFromManifest(tool: string): Array<string> {
-  return modelEntries(tool)
-    .map((m) => m["id"])
-    .filter((id): id is string => typeof id === "string")
+/**
+ * Typed view of one tool's `SoT/models.json` section. An entry whose `id` is not a
+ * string or whose `kind` is neither `alias` nor `id` is skipped; a missing section
+ * yields `verified: "?"` and no models.
+ */
+export function modelCatalog(tool: string): ModelCatalog {
+  const entry = toolEntry(tool)
+  const verified = entry?.["verified"]
+  const models: Array<ModelEntry> = []
+  for (const m of modelEntries(entry)) {
+    const id = m["id"]
+    const kind = m["kind"]
+    if (typeof id !== "string" || (kind !== "alias" && kind !== "id")) continue
+    const note = m["note"]
+    models.push(typeof note === "string" ? { id, kind, note } : { id, kind })
+  }
+  return { verified: typeof verified === "string" ? verified : "?", models }
 }
 
 export function printModels(ctx: Ctx, tool: string): void {
@@ -35,7 +57,7 @@ export function printModels(ctx: Ctx, tool: string): void {
   }
   const verified = typeof entry["verified"] === "string" ? entry["verified"] : "?"
   const lines = [`Available ${tool} models (kit-verified ${verified} — SoT/models.json):`]
-  for (const m of modelEntries(tool)) {
+  for (const m of modelEntries(entry)) {
     const note = typeof m["note"] === "string" ? `  — ${m["note"]}` : ""
     lines.push(`  ${String(m["id"] ?? "")}${note}`)
   }
@@ -46,7 +68,7 @@ export function printModels(ctx: Ctx, tool: string): void {
 
 export function validateClaudeModel(ctx: Ctx, m: string): boolean {
   if (m === "") return false
-  if (modelsFromManifest("claude").includes(m)) return true
+  if (modelCatalog("claude").models.some((entry) => entry.id === m)) return true
   if (m.startsWith("claude-")) {
     ctx.services.logger.warn(`Claude model '${m}' is not in the kit-verified catalog (SoT/models.json) — applying anyway`)
     return true
@@ -56,7 +78,7 @@ export function validateClaudeModel(ctx: Ctx, m: string): boolean {
 
 export function validateCodexModel(ctx: Ctx, m: string): boolean {
   if (!/^[A-Za-z0-9._-]+$/.test(m)) return false
-  if (!modelsFromManifest("codex").includes(m)) {
+  if (!modelCatalog("codex").models.some((entry) => entry.id === m)) {
     ctx.services.logger.warn(
       `Codex model '${m}' is not in the kit-verified catalog (SoT/models.json) — applying anyway (check ~/.codex/config.toml if Codex rejects it)`
     )

package/cli/src/engine-native/ompSync.ts

@@ -10,7 +10,7 @@ import { isAbsolute, resolve } from "node:path"
 
 import { payloadDisplayPath, payloadText, type PayloadPath } from "../payload"
 import { bunBootstrap } from "./bun"
-import { commandExists, p, spawnProcess, type AsyncProcessResult } from "./exec"
+import { p, spawnProcess, type AsyncProcessResult } from "./exec"
 import type { Ctx } from "./index"
 import { isObject, parseJson } from "./jq"
 import { ompPaths } from "./ompPaths"
@@ -317,7 +317,7 @@ async function syncPlugins(ctx: Ctx): Promise<number> {
   const { change, clearProgress, echo, progress, verbose, warn } = ctx.services.logger
 
   if (ctx.dryRun) {
-    const piIntercomPin = field(ctx, "pi-intercom", "verified")
+    const piIntercomPin = field("pi-intercom", "verified")
     for (const pluginId of MARKETPLACE_PLUGIN_IDS) {
       echo(`[dry-run] omp plugin install --scope user ${pluginId}`)
     }
@@ -345,7 +345,7 @@ async function syncPlugins(ctx: Ctx): Promise<number> {
     )
     return 0
   }
-  const piIntercomPin = field(ctx, "pi-intercom", "verified")
+  const piIntercomPin = field("pi-intercom", "verified")
 
   progress("Checking installed omp plugins...")
   const installed = await installedPluginIdsFromCli()

package/cli/src/engine-native/os/darwin.ts

@@ -1,62 +1,14 @@
-import { p } from "../exec"
+import { posixHost } from "./posix"
 import type { HostOs } from "./types"
 
-function posixLiteral(value: string): string {
-  return `'${value.replaceAll("'", `'"'"'`)}'`
-}
-
-export const darwin: HostOs = {
+export const darwin: HostOs = posixHost({
   id: "darwin",
   toolchainOs: "darwin",
   supportsBubblewrap: false,
-  directoryLinkKinds: ["symlink"],
-  executableSuffixes: [""],
-  invoke: (executablePath, args) => ({ command: executablePath, args }),
-  bunExecutableName: "bun",
-  bunInstaller: (pin, directory) => {
-    const scriptPath = p(directory, "install.sh")
-    return {
-      scriptPath,
-      download: {
-        command: "curl",
-        args: ["-fsSL", "https://bun.sh/install", "-o", scriptPath]
-      },
-      run: {
-        command: "bash",
-        args: [scriptPath, `bun-v${pin}`]
-      }
-    }
-  },
-  environmentSetting: (name, value) => ({
-    kind: "profile",
-    candidates: [".zshrc", ".bashrc", ".bash_profile", ".profile", ".zshenv"],
-    target: (shell) => {
-      const shellPath = shell ?? "bash"
-      const shellName = shellPath.slice(shellPath.lastIndexOf("/") + 1)
-      return shellName === "zsh" ? ".zshrc" : shellName === "bash" ? ".bashrc" : ".profile"
-    },
-    line: `export ${name}=${value}`
-  }),
-  statusLineCommand: (bun, script) => {
-    const bunLiteral = posixLiteral(bun)
-    const scriptLiteral = posixLiteral(script)
-    return `test -x ${bunLiteral} && test -f ${scriptLiteral} && exec ${bunLiteral} ${scriptLiteral} || true`
-  },
-  failureHookCommand: (command) => command,
-  installHint: (tool) => {
-    switch (tool) {
-      case "git":
-        return "brew install git"
-      case "jq":
-        return "brew install jq"
-      case "curl":
-        return "brew install curl"
-      case "ffplay":
-        return "brew install ffmpeg"
-      case "claude":
-        return "curl -fsSL https://claude.ai/install.sh -o /tmp/claude-install.sh && bash /tmp/claude-install.sh"
-      case "codex":
-        return 'tmp=$(mktemp) && curl -fsSL https://chatgpt.com/codex/install.sh -o "$tmp" && CODEX_NON_INTERACTIVE=1 sh "$tmp"'
-    }
+  packageManagerHints: {
+    git: "brew install git",
+    jq: "brew install jq",
+    curl: "brew install curl",
+    ffplay: "brew install ffmpeg"
   }
-}
+})

package/cli/src/engine-native/os/linux.ts

@@ -1,62 +1,14 @@
-import { p } from "../exec"
+import { posixHost } from "./posix"
 import type { HostOs } from "./types"
 
-function posixLiteral(value: string): string {
-  return `'${value.replaceAll("'", `'"'"'`)}'`
-}
-
-export const linux: HostOs = {
+export const linux: HostOs = posixHost({
   id: "linux",
   toolchainOs: "linux",
   supportsBubblewrap: true,
-  directoryLinkKinds: ["symlink"],
-  executableSuffixes: [""],
-  invoke: (executablePath, args) => ({ command: executablePath, args }),
-  bunExecutableName: "bun",
-  bunInstaller: (pin, directory) => {
-    const scriptPath = p(directory, "install.sh")
-    return {
-      scriptPath,
-      download: {
-        command: "curl",
-        args: ["-fsSL", "https://bun.sh/install", "-o", scriptPath]
-      },
-      run: {
-        command: "bash",
-        args: [scriptPath, `bun-v${pin}`]
-      }
-    }
-  },
-  environmentSetting: (name, value) => ({
-    kind: "profile",
-    candidates: [".zshrc", ".bashrc", ".bash_profile", ".profile", ".zshenv"],
-    target: (shell) => {
-      const shellPath = shell ?? "bash"
-      const shellName = shellPath.slice(shellPath.lastIndexOf("/") + 1)
-      return shellName === "zsh" ? ".zshrc" : shellName === "bash" ? ".bashrc" : ".profile"
-    },
-    line: `export ${name}=${value}`
-  }),
-  statusLineCommand: (bun, script) => {
-    const bunLiteral = posixLiteral(bun)
-    const scriptLiteral = posixLiteral(script)
-    return `test -x ${bunLiteral} && test -f ${scriptLiteral} && exec ${bunLiteral} ${scriptLiteral} || true`
-  },
-  failureHookCommand: (command) => command,
-  installHint: (tool) => {
-    switch (tool) {
-      case "git":
-        return "sudo apt install -y git (or your distro's package manager)"
-      case "jq":
-        return "sudo apt install -y jq"
-      case "curl":
-        return "sudo apt install -y curl"
-      case "ffplay":
-        return "sudo apt install -y ffmpeg"
-      case "claude":
-        return "curl -fsSL https://claude.ai/install.sh -o /tmp/claude-install.sh && bash /tmp/claude-install.sh"
-      case "codex":
-        return 'tmp=$(mktemp) && curl -fsSL https://chatgpt.com/codex/install.sh -o "$tmp" && CODEX_NON_INTERACTIVE=1 sh "$tmp"'
-    }
+  packageManagerHints: {
+    git: "sudo apt install -y git (or your distro's package manager)",
+    jq: "sudo apt install -y jq",
+    curl: "sudo apt install -y curl",
+    ffplay: "sudo apt install -y ffmpeg"
   }
-}
+})

package/cli/src/engine-native/os/posix.ts

@@ -0,0 +1,67 @@
+// No import from "../exec": exec.ts imports "./os", which evaluates linux and darwin
+// through this module. A slash join keeps the same host-stable path p() would produce.
+import type { HintedTool, HostOs } from "./types"
+
+function posixLiteral(value: string): string {
+  return `'${value.replaceAll("'", `'"'"'`)}'`
+}
+
+/** Package-manager hints for the tools a POSIX host installs through its own package manager. */
+export type PackageManagerHints = Readonly<Record<Exclude<HintedTool, "claude" | "codex">, string>>
+
+const UPSTREAM_INSTALLER_HINTS: Readonly<Record<"claude" | "codex", string>> = {
+  claude: "curl -fsSL https://claude.ai/install.sh -o /tmp/claude-install.sh && bash /tmp/claude-install.sh",
+  codex: 'tmp=$(mktemp) && curl -fsSL https://chatgpt.com/codex/install.sh -o "$tmp" && CODEX_NON_INTERACTIVE=1 sh "$tmp"'
+}
+
+interface PosixHostInputs {
+  readonly id: HostOs["id"]
+  readonly toolchainOs: HostOs["toolchainOs"]
+  readonly supportsBubblewrap: boolean
+  readonly packageManagerHints: PackageManagerHints
+}
+
+/** Members shared by every POSIX host; linux and darwin differ only in the inputs. */
+export function posixHost(inputs: PosixHostInputs): HostOs {
+  return {
+    id: inputs.id,
+    toolchainOs: inputs.toolchainOs,
+    supportsBubblewrap: inputs.supportsBubblewrap,
+    directoryLinkKinds: ["symlink"],
+    executableSuffixes: [""],
+    invoke: (executablePath, args) => ({ command: executablePath, args }),
+    bunExecutableName: "bun",
+    bunInstaller: (pin, directory) => {
+      const scriptPath = `${directory}/install.sh`
+      return {
+        scriptPath,
+        download: {
+          command: "curl",
+          args: ["-fsSL", "https://bun.sh/install", "-o", scriptPath]
+        },
+        run: {
+          command: "bash",
+          args: [scriptPath, `bun-v${pin}`]
+        }
+      }
+    },
+    environmentSetting: (name, value) => ({
+      kind: "profile",
+      candidates: [".zshrc", ".bashrc", ".bash_profile", ".profile", ".zshenv"],
+      target: (shell) => {
+        const shellPath = shell ?? "bash"
+        const shellName = shellPath.slice(shellPath.lastIndexOf("/") + 1)
+        return shellName === "zsh" ? ".zshrc" : shellName === "bash" ? ".bashrc" : ".profile"
+      },
+      line: `export ${name}=${value}`
+    }),
+    statusLineCommand: (bun, script) => {
+      const bunLiteral = posixLiteral(bun)
+      const scriptLiteral = posixLiteral(script)
+      return `test -x ${bunLiteral} && test -f ${scriptLiteral} && exec ${bunLiteral} ${scriptLiteral} || true`
+    },
+    failureHookCommand: (command) => command,
+    installHint: (tool) =>
+      tool === "claude" || tool === "codex" ? UPSTREAM_INSTALLER_HINTS[tool] : inputs.packageManagerHints[tool]
+  }
+}

package/cli/src/engine-native/os/targets.ts

@@ -63,7 +63,7 @@ export const HOST_TARGETS: ReadonlyArray<HostTarget> = [
   target("windows-arm64", "windows", "arm64", [], ["ARM64"])
 ]
 
-export function targetFor(platform: PlatformName, arch: string): HostTarget | undefined {
+function targetFor(platform: PlatformName, arch: string): HostTarget | undefined {
   return HOST_TARGETS.find((t) => t.platform === platform && t.arch === arch)
 }
 

package/cli/src/engine-native/skillsSync.ts

@@ -17,7 +17,7 @@ import {
 } from "node:fs"
 import { dirname, relative, resolve } from "node:path"
 import { payloadText } from "../payload"
-import { p, spawnProcess, writeFileIfChanged } from "./exec"
+import { p, spawnProcess, writeTextIfChanged } from "./exec"
 import type { Ctx } from "./index"
 import { compareCodepoints } from "./jq"
 import { hostOs, type DirectoryLinkKind } from "./os"
@@ -50,7 +50,7 @@ export async function skillsSync(ctx: Ctx): Promise<SkillsState> {
 
 /** skills::_skills_cli — the pinned npx package spec. */
 function skillsCli(ctx: Ctx): string {
-  const version = field(ctx, "skills-cli", "verified")
+  const version = field("skills-cli", "verified")
   if (version !== "") return `skills@${version}`
   ctx.services.logger.err("Universal skills sync aborted because SoT/toolchain.json has no verified skills-cli pin")
   throw new ExitError(1)
@@ -365,7 +365,7 @@ function updateSnapshot(ctx: Ctx, manifest: string, snapshot: string, failedRemo
 
   mkdirSync(ctx.agentsDir, { recursive: true })
   const sorted = [...new Set([...normalizeManifest(manifest), ...failedRemovals])].sort(compareCodepoints)
-  writeFileIfChanged(snapshot, sorted.length > 0 ? `${sorted.join("\n")}\n` : "")
+  writeTextIfChanged(snapshot, sorted.length > 0 ? `${sorted.join("\n")}\n` : "")
 }
 
 // -------------------------------------------------------------- summary ----

package/cli/src/engine-native/toolchain.ts

@@ -14,7 +14,7 @@ function manifest(): { [k: string]: Json } {
   return tools !== undefined && isObject(tools) ? tools : {}
 }
 
-export function field(ctx: Ctx, tool: string, name: string): string {
+export function field(tool: string, name: string): string {
   const entry = manifest()[tool]
   if (entry === undefined || !isObject(entry)) return ""
   const v = entry[name]
@@ -22,7 +22,7 @@ export function field(ctx: Ctx, tool: string, name: string): string {
 }
 
 /** toolchain::_is_newer — numeric per dotted field, GNU-sort last-resort tie-break. */
-export function isNewer(a: string, b: string): boolean {
+function isNewer(a: string, b: string): boolean {
   if (a === "" || b === "" || a === b) return false
   const fa = a.split(".")
   const fb = b.split(".")
@@ -86,14 +86,14 @@ export async function report(ctx: Ctx): Promise<void> {
   const pn = ctx.services.platform.name()
   const platformOs = hostOs(pn).toolchainOs
   for (const tool of Object.keys(manifest()).sort(compareCodepoints)) {
-    const os = field(ctx, tool, "os")
+    const os = field(tool, "os")
     if (os !== "" && platformOs !== "" && os !== platformOs) continue
-    const kind = field(ctx, tool, "kind")
-    const floor = field(ctx, tool, "floor")
-    const verified = field(ctx, tool, "verified")
+    const kind = field(tool, "kind")
+    const floor = field(tool, "floor")
+    const verified = field(tool, "verified")
     const dash = (v: string): string => (v !== "" ? v : "-")
     if (kind === "pin") {
-      const via = field(ctx, tool, "via")
+      const via = field(tool, "via")
       echo(row([tool, kind, `(${via !== "" ? via : "npx"})`, dash(floor), dash(verified), "pinned"]))
       continue
     }

package/cli/src/generated/sotPayload.ts

@@ -1,7 +1,7 @@
 // Generated by cli/scripts/generate-sot-payload.ts. DO NOT EDIT.
 // Edit SoT/, notification.mp3, or package.json, then run: bun cli/scripts/generate-sot-payload.ts
 
-export const GENERATED_PACKAGE_VERSION = "0.16.4"
+export const GENERATED_PACKAGE_VERSION = "0.16.6"
 
 export const GENERATED_PAYLOAD_TEXT = {
   "SoT/.agents/skills.txt": "# Universal AI-agent skill manifest intentionally empty.\n# Global skill discovery is opt-in: add one <owner>/<repo> slug per line.\n# EngineNative ignores comments and blank lines.\n",
@@ -18,7 +18,7 @@ export const GENERATED_PAYLOAD_TEXT = {
   "SoT/.codex/plugins/marketplace.json": "{\n  \"name\": \"docks\",\n  \"interface\": {\n    \"displayName\": \"DocksDocks\"\n  },\n  \"plugins\": [\n    {\n      \"name\": \"docks\",\n      \"source\": {\n        \"source\": \"git-subdir\",\n        \"url\": \"https://github.com/DocksDocks/docks.git\",\n        \"path\": \"./plugins/docks\",\n        \"ref\": \"main\"\n      },\n      \"policy\": {\n        \"installation\": \"AVAILABLE\",\n        \"authentication\": \"ON_INSTALL\"\n      },\n      \"category\": \"Productivity\"\n    },\n    {\n      \"name\": \"plan-lifecycle\",\n      \"source\": {\n        \"source\": \"git-subdir\",\n        \"url\": \"https://github.com/DocksDocks/docks.git\",\n        \"path\": \"./plugins/plan-lifecycle\",\n        \"ref\": \"main\"\n      },\n      \"policy\": {\n        \"installation\": \"AVAILABLE\",\n        \"authentication\": \"ON_INSTALL\"\n      },\n      \"category\": \"Productivity\"\n    }\n  ]\n}\n",
   "SoT/.codex/rules/docks.rules": "prefix_rule(pattern=[\"pwd\"], decision=\"allow\")\nprefix_rule(pattern=[\"ls\"], decision=\"allow\")\nprefix_rule(pattern=[\"cat\"], decision=\"allow\")\nprefix_rule(pattern=[\"head\"], decision=\"allow\")\nprefix_rule(pattern=[\"tail\"], decision=\"allow\")\nprefix_rule(pattern=[\"wc\"], decision=\"allow\")\nprefix_rule(pattern=[\"nl\"], decision=\"allow\")\nprefix_rule(pattern=[\"grep\"], decision=\"allow\")\nprefix_rule(pattern=[\"sort\"], decision=\"allow\")\nprefix_rule(pattern=[\"uniq\"], decision=\"allow\")\nprefix_rule(pattern=[\"diff\"], decision=\"allow\")\nprefix_rule(pattern=[\"which\"], decision=\"allow\")\nprefix_rule(pattern=[\"date\"], decision=\"allow\")\nprefix_rule(pattern=[\"basename\"], decision=\"allow\")\nprefix_rule(pattern=[\"dirname\"], decision=\"allow\")\nprefix_rule(pattern=[\"realpath\"], decision=\"allow\")\nprefix_rule(pattern=[\"readlink\"], decision=\"allow\")\nprefix_rule(pattern=[\"jq\"], decision=\"allow\")\nprefix_rule(pattern=[\"tree\"], decision=\"allow\")\nprefix_rule(pattern=[\"cut\"], decision=\"allow\")\nprefix_rule(pattern=[\"tr\"], decision=\"allow\")\nprefix_rule(pattern=[\"echo\"], decision=\"allow\")\nprefix_rule(pattern=[\"printf\"], decision=\"allow\")\nprefix_rule(pattern=[\"printenv\"], decision=\"allow\")\nprefix_rule(pattern=[\"uname\"], decision=\"allow\")\nprefix_rule(pattern=[\"file\"], decision=\"allow\")\nprefix_rule(pattern=[\"stat\"], decision=\"allow\")\nprefix_rule(pattern=[\"du\"], decision=\"allow\")\nprefix_rule(pattern=[\"id\"], decision=\"allow\")\nprefix_rule(pattern=[\"whoami\"], decision=\"allow\")\n\nprefix_rule(pattern=[\"git\", \"status\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"diff\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"log\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"show\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"blame\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"rev-parse\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"ls-files\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"grep\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"ls-tree\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"branch\", \"--show-current\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"branch\", \"-vv\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"mv\"], decision=\"allow\")\n\nprefix_rule(pattern=[\"gh\", \"pr\", \"view\"], decision=\"allow\")\nprefix_rule(pattern=[\"gh\", \"pr\", \"list\"], decision=\"allow\")\nprefix_rule(pattern=[\"gh\", \"pr\", \"diff\"], decision=\"allow\")\nprefix_rule(pattern=[\"gh\", \"pr\", \"status\"], decision=\"allow\")\nprefix_rule(pattern=[\"gh\", \"pr\", \"checks\"], decision=\"allow\")\n\nprefix_rule(pattern=[\"docker\", \"ps\"], decision=\"allow\")\n\nprefix_rule(pattern=[\"git\", \"push\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"reset\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"clean\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"merge\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"rebase\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"checkout\"], decision=\"prompt\")\n\nprefix_rule(pattern=[\"rm\"], decision=\"prompt\")\nprefix_rule(pattern=[\"mv\"], decision=\"prompt\")\nprefix_rule(pattern=[\"chmod\"], decision=\"prompt\")\nprefix_rule(pattern=[\"chown\"], decision=\"prompt\")\nprefix_rule(pattern=[\"kill\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pkill\"], decision=\"prompt\")\n\nprefix_rule(pattern=[\"npm\", \"install\"], decision=\"prompt\")\nprefix_rule(pattern=[\"npm\", \"uninstall\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pnpm\", \"add\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pnpm\", \"remove\"], decision=\"prompt\")\nprefix_rule(pattern=[\"yarn\", \"add\"], decision=\"prompt\")\nprefix_rule(pattern=[\"yarn\", \"remove\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pip\", \"install\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pip\", \"uninstall\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pip3\", \"install\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pip3\", \"uninstall\"], decision=\"prompt\")\n\nprefix_rule(pattern=[\"docker\", \"run\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"rm\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"stop\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"volume\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"system\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"compose\", \"up\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"compose\", \"down\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"compose\", \"rm\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"compose\", \"stop\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker-compose\", \"up\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker-compose\", \"down\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker-compose\", \"rm\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker-compose\", \"stop\"], decision=\"prompt\")\n\n# `tail -f`/`--follow` never returns and hangs the agent (bare `tail` stays allowed above).\nprefix_rule(pattern=[\"tail\", \"-f\"], decision=\"prompt\")\nprefix_rule(pattern=[\"tail\", \"--follow\"], decision=\"prompt\")\n# rg and `sed -n` are prompt, NOT allow: argv-prefix matching cannot gate their\n# code-exec forms (rg --pre=CMD or a reordered --pre; sed -n 'e CMD' / -ni) while a\n# shorter allow prefix would auto-approve the whole command.\nprefix_rule(pattern=[\"rg\"], decision=\"prompt\")\nprefix_rule(pattern=[\"sed\", \"-n\"], decision=\"prompt\")\nprefix_rule(pattern=[\"find\"], decision=\"prompt\")\nprefix_rule(pattern=[\"sed\", \"-i\"], decision=\"prompt\")\nprefix_rule(pattern=[\"sed\", \"--in-place\"], decision=\"prompt\")\nprefix_rule(pattern=[\"awk\"], decision=\"prompt\")\nprefix_rule(pattern=[\"xargs\"], decision=\"prompt\")\nprefix_rule(pattern=[\"tee\"], decision=\"prompt\")\nprefix_rule(pattern=[\"curl\"], decision=\"prompt\")\nprefix_rule(pattern=[\"env\"], decision=\"prompt\")\n\nprefix_rule(pattern=[\"sudo\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"eval\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"mkfs\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"dd\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"git\", \"push\", \"--force\", \"origin\", \"main\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"git\", \"push\", \"--force\", \"origin\", \"master\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"git\", \"push\", \"-f\", \"origin\", \"main\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"git\", \"push\", \"-f\", \"origin\", \"master\"], decision=\"forbidden\")\n",
   "SoT/.omp/AGENTS.md": "# Global OMP guidance\n\n- Verify unfamiliar or version-sensitive APIs and configuration against current official documentation before implementation.\n- When the user asks for an assessment rather than a change, report findings without editing.\n- For Docks plan reviews, cross-company review is standing-authorized; host security policy still applies.\n- Please remove all mannered prose.\n\n## Asking me things\n\nA question typed in prose is just text I may or may not act on. The `ask` tool renders a\nblocking picker, waits indefinitely (`ask.timeout = 0`), and records my answer in the\ntranscript. If you actually need an answer, it MUST go through `ask`.\n\nMUST use `ask` before:\n- Anything irreversible or destructive: deleting/overwriting files or data you did not create,\n  force-push, history rewrite, dropping tables, running migrations, mass rename, touching\n  secrets/credentials, or publishing outward (release, upstream PR, issue, comment).\n- Two or more viable approaches whose tradeoffs are mine to own: schema/API/protocol shape,\n  adding a dependency, or establishing a convention this repo does not already have.\n- A fact only I hold: intended semantics of an ambiguous requirement, which of several\n  conflicting existing patterns is canonical, or which environment/account/target to use.\n- A request that contradicts the repo: surface the conflict and let me resolve it; never\n  silently pick one side.\n\nIf `ask` is not registered — subagent, headless, or `-p` print runs, where `hasUI` is false —\nthe MUST above cannot be satisfied: do not fabricate the call and do not stall on it. Take the\nconservative reversible option and put the question, plus the assumption you made, in your\nfinal report so whoever spawned you can decide.\n\nNEVER use `ask` for:\n- Permission to begin, or to confirm scope already stated in the request.\n- Anything a tool, grep, or doc can answer — go read it.\n- A cheap reversible choice — take the conservative option and say which you took.\n- Something already answered earlier in the conversation.\n\nBatch every open question into one `ask` call with multiple questions; do not serialize\nround trips. Being overruled ends the discussion — execute my call without relitigating.\n\n## Output Standard\n\nApply Simplified Technical English to all agent text. This includes responses, messages,\ndocumentation, comments, and interface text.\n\nReply in the language I use, and apply every rule below to that language.\n\nA rule that names English grammar applies only to English. The contraction ban is one\nsuch rule. In another language, follow the normal grammar of that language. Portuguese,\nSpanish, French, Italian, and German merge a preposition with an article, and that merge\nis required, not optional.\n\nTreat the word limits as approximate outside English. Some languages need more words to\ncarry the same content.\n\n- Use the simplest precise technical term.\n- Use each term consistently.\n- Expand an abbreviation at its first occurrence.\n- Explain a technical term when I ask for an explanation.\n- Write complete and grammatically correct sentences.\n- Use active voice and identify the actor.\n- Use the imperative form for instructions.\n- Put only one action in each instruction sentence.\n- Put a necessary condition before its instruction.\n- Use simple verb tenses.\n- Do not use contractions, idioms, or slang. Avoid humor and rhetorical questions.\n- Keep procedural sentences to 20 words or fewer.\n- Keep descriptive sentences to 25 words or fewer.\n- Keep each paragraph to one topic and six sentences or fewer.\n- Do not use more than three nouns together.\n- Use vertical lists for complex information.\n- Put a warning or caution before a related hazardous instruction.\n\n### Naming\n\n- Say what the thing does before you name it. Put the technical term after the plain\n  description, once, in parentheses.\n- Do not use a technical term as the only name for something you just introduced.\n- Prefer the short common word. Use \"use\", not \"utilize\". Use \"set up\", not \"provision\".\n- Do not explain by metaphor alone. A metaphor may follow a literal statement.\n",
-  "SoT/.omp/config.yml": "symbolPreset: unicode\n\ntheme:\n  dark: titanium\n\nstatusLine:\n  preset: default\n  compactThinkingLevel: false\n  showHookStatus: true\n  sessionAccent: true\n  transparent: false\n\nterminal:\n  showProgress: false\n\ntui:\n  textSizing: false\n  tight: false\n\ndefaultThinkingLevel: high\n\ncycleOrder:\n  - smol\n  - default\n  - slow\n  - fable\n\ntier:\n  openai: none\n  anthropic: none\n\nadvisor:\n  enabled: true\n  syncBacklog: \"1\"\n\ngithub:\n  enabled: true\n\ntask:\n  eager: always\n  showResolvedModelBadge: true\n  softRequestBudget: 200\n  softRequestBudgetNotice: true\n  batch: true\n  enableLsp: true\n  enableEffort: true\n  maxEffort: high\n  maxConcurrency: 16\n  maxRecursionDepth: 2\n  maxRuntimeMs: 3600000\n  agentModelOverrides:\n    reviewer: \"@task\"\n    security-reviewer: \"@task\"\n    code-reviewer: \"@task\"\n    plan-reviewer: \"@task\"\n\nmodelRoles:\n  smol: openai-codex/gpt-5.6-luna:medium\n  advisor: openai-codex/gpt-5.6-sol:medium\n  designer: anthropic/claude-opus-5:high\n  plan: anthropic/claude-opus-5:xhigh\n  commit: openai-codex/gpt-5.6-luna:medium\n  task: openai-codex/gpt-6-astra:low\n  vision: anthropic/claude-opus-5:medium\n  tiny: openai-codex/gpt-5.6-luna:low\n  default: anthropic/claude-opus-5:high\n  slow: anthropic/claude-opus-5:xhigh\n  fable: anthropic/claude-fable-5-1:medium\n  switch_fable: anthropic/claude-fable-5-1:medium\n\nmodelTags:\n  fable:\n    name: Fable 5.1\n  switch_fable:\n    name: Fable switch default\n    hidden: true\n\ndisplay:\n  shimmer: classic\n  showTokenUsage: true\n\nproviders:\n  anthropic:\n    serverSideFallback: false\n  fetch: auto\n  webSearchTimeoutSeconds: 30\n  webSearchOrder:\n    - firecrawl\n    - exa\n    - perplexity\n    - gemini\n    - codex\n\nretry:\n  usageAwareFallback: true\n  fallbackChains:\n    default:\n      - openai-codex/gpt-5.6-sol:high\n    advisor:\n      - anthropic/claude-opus-5:medium\n    task:\n      - anthropic/claude-opus-5:high\n    vision:\n      - openai-codex/gpt-5.6-sol:medium\n    smol:\n      - anthropic/claude-opus-5:low\n    tiny:\n      - anthropic/claude-opus-5:low\n    commit:\n      - anthropic/claude-opus-5:medium\n    switch_fable: []\n    fable: []\n\nomitThinking: false\nincludeWorkspaceTree: false\nautocompleteMaxVisible: 10\nemojiAutocomplete: true\n\nbranchSummary:\n  enabled: true\n\nreadLineNumbers: false\n\ncommands:\n  enableOpencodeProject: false\n  enableOpencodeUser: false\n\nskills:\n  enableClaudeUser: false\n  enableCodexUser: false\n  enableAgentsUser: true\n\nsteeringMode: all\ninterruptMode: immediate\n\ndev:\n  autoqa: false\n  autoqaConsent: denied\n\ncompaction:\n  thresholdTokens: 231200\n  idleEnabled: true\n  handoffSaveToDisk: true\n\ndoubleEscapeAction: tree\nhideThinkingBlock: false\nautoResume: false\ntextVerbosity: low\n\nfeatures:\n  unexpectedStopDetection: smart\n\ncodexResets:\n  autoRedeem: \"no\"\n\nstartup:\n  quiet: true\n  changelogMode: summary\n\ntools:\n  approvalMode: yolo\n",
+  "SoT/.omp/config.yml": "symbolPreset: unicode\n\ntheme:\n  dark: titanium\n\nstatusLine:\n  preset: default\n  compactThinkingLevel: false\n  showHookStatus: true\n  sessionAccent: true\n  transparent: false\n\nterminal:\n  showProgress: false\n\ntui:\n  textSizing: false\n  tight: false\n\ndefaultThinkingLevel: high\n\ncycleOrder:\n  - smol\n  - default\n  - slow\n  - fable\n\ntier:\n  openai: none\n  anthropic: none\n\nadvisor:\n  enabled: true\n  syncBacklog: \"1\"\n\ngithub:\n  enabled: true\n\ntask:\n  eager: always\n  showResolvedModelBadge: true\n  softRequestBudget: 200\n  softRequestBudgetNotice: true\n  batch: true\n  enableLsp: true\n  enableEffort: true\n  maxEffort: low\n  maxConcurrency: 16\n  maxRecursionDepth: 2\n  maxRuntimeMs: 3600000\n  agentModelOverrides:\n    reviewer: \"@task\"\n    security-reviewer: \"@task\"\n    code-reviewer: \"@task\"\n    plan-reviewer: \"@task\"\n\nmodelRoles:\n  smol: openai-codex/gpt-5.6-luna:medium\n  advisor: openai-codex/gpt-5.6-sol:medium\n  designer: anthropic/claude-opus-5:high\n  plan: anthropic/claude-opus-5:xhigh\n  commit: openai-codex/gpt-5.6-luna:medium\n  task: openai-codex/gpt-6-astra:low\n  vision: anthropic/claude-opus-5:medium\n  tiny: openai-codex/gpt-5.6-luna:low\n  default: anthropic/claude-opus-5:high\n  slow: anthropic/claude-opus-5:xhigh\n  fable: anthropic/claude-fable-5-1:medium\n  switch_fable: anthropic/claude-fable-5-1:medium\n\nmodelTags:\n  fable:\n    name: Fable 5.1\n  switch_fable:\n    name: Fable switch default\n    hidden: true\n\ndisplay:\n  shimmer: classic\n  showTokenUsage: true\n\nproviders:\n  anthropic:\n    serverSideFallback: false\n  fetch: auto\n  webSearchTimeoutSeconds: 30\n  webSearchOrder:\n    - firecrawl\n    - exa\n    - perplexity\n    - gemini\n    - codex\n\nretry:\n  usageAwareFallback: true\n  fallbackChains:\n    default:\n      - openai-codex/gpt-5.6-sol:high\n    advisor:\n      - anthropic/claude-opus-5:medium\n    task:\n      - anthropic/claude-opus-5:high\n    vision:\n      - openai-codex/gpt-5.6-sol:medium\n    smol:\n      - anthropic/claude-opus-5:low\n    tiny:\n      - anthropic/claude-opus-5:low\n    commit:\n      - anthropic/claude-opus-5:medium\n    switch_fable: []\n    fable: []\n\nomitThinking: false\nincludeWorkspaceTree: false\nautocompleteMaxVisible: 10\nemojiAutocomplete: true\n\nbranchSummary:\n  enabled: true\n\nreadLineNumbers: false\n\ncommands:\n  enableOpencodeProject: false\n  enableOpencodeUser: false\n\nskills:\n  enableClaudeUser: false\n  enableCodexUser: false\n  enableAgentsUser: true\n\nsteeringMode: all\ninterruptMode: immediate\n\ndev:\n  autoqa: false\n  autoqaConsent: denied\n\ncompaction:\n  thresholdTokens: 231200\n  idleEnabled: true\n  handoffSaveToDisk: true\n\ndoubleEscapeAction: tree\nhideThinkingBlock: false\nautoResume: false\ntextVerbosity: low\n\nfeatures:\n  unexpectedStopDetection: smart\n\ncodexResets:\n  autoRedeem: \"no\"\n\nstartup:\n  quiet: true\n  changelogMode: summary\n\ntools:\n  approvalMode: yolo\n",
   "SoT/.omp/intercom.json": "{\n  \"brokerCommand\": \"bun\",\n  \"brokerArgs\": []\n}\n",
   "SoT/.omp/mcp.json": "{\n  \"$schema\": \"https://raw.githubusercontent.com/can1357/oh-my-pi/main/packages/coding-agent/src/config/mcp-schema.json\",\n  \"disabledServers\": [\n    \"chrome-devtools\",\n    \"context7:context7\",\n    \"openaiDeveloperDocs\"\n  ]\n}\n"
 } as const
@@ -48,4 +48,4 @@ export const GENERATED_PAYLOAD_PATHS = [
   "notification.mp3"
 ] as const
 
-export const GENERATED_PAYLOAD_HASH = "b5d7c2aee0741d56a5f6b427bd096d8548501bf59c4e818f41c01ba92e085aaa"
+export const GENERATED_PAYLOAD_HASH = "df37d563d668ab4f09d4b0ab50f9e7ff81612c2032b57870b0f919aacef43855"