docks-kit 0.18.1 → 0.19.1

package/cli/src/engine-native/toolchain.ts

@@ -7,7 +7,8 @@ import type { Ctx } from "./index";
 import { compareCodepoints, isObject, parseJson } from "./jq";
 import { payloadText } from "../payload";
 import { hostOs } from "./os";
-import type { JsonObject } from "./sharedTypes";
+import { readCache, writeCache } from "./kitDb";
+import type { FetchLike, JsonObject } from "./sharedTypes";
 
 function manifest(): JsonObject {
   const doc = parseJson(payloadText("SoT/toolchain.json"));
@@ -23,7 +24,7 @@ export function field(tool: string, name: string): string {
 }
 
 /** toolchain::_is_newer — numeric per dotted field, GNU-sort last-resort tie-break. */
-function isNewer(a: string, b: string): boolean {
+export function isNewer(a: string, b: string): boolean {
   if (a === "" || b === "" || a === b) return false;
   const fa = a.split(".");
   const fb = b.split(".");
@@ -131,3 +132,161 @@ export async function report(ctx: Ctx): Promise<void> {
     echo(row([tool, dash(kind), installed, dash(floor), dash(verified), status]));
   }
 }
+
+export type UpstreamResult = { ok: true; version: string } | { ok: false; reason: string };
+
+export interface UpstreamInputs {
+  readonly home: string;
+  readonly refresh: boolean;
+  readonly now: number;
+  readonly fetchImpl?: FetchLike;
+  readonly env?: NodeJS.ProcessEnv;
+}
+
+const UPSTREAM_CACHE_MS = 24 * 3600_000;
+
+function upstreamSpec(tool: string): JsonObject | undefined {
+  const entry = manifest()[tool];
+  const upstream = entry !== undefined && isObject(entry) ? entry["upstream"] : undefined;
+  return upstream !== undefined && isObject(upstream) ? upstream : undefined;
+}
+
+function upstreamLabel(spec: JsonObject): string {
+  const { npm, github, line } = spec;
+  if (typeof npm === "string")
+    return typeof line === "string" ? `npm ${npm} (${line}.x)` : `npm ${npm}`;
+  return typeof github === "string" ? `github ${github}` : "-";
+}
+
+async function fetchJson(
+  fetchImpl: FetchLike,
+  url: string,
+  headers: Record<string, string>,
+): Promise<{ ok: true; body: JsonObject } | { ok: false; reason: string }> {
+  const response = await fetchImpl(url, { headers, signal: AbortSignal.timeout(8000) });
+  if (response.status !== 200) return { ok: false, reason: `HTTP ${response.status}` };
+  const body = parseJson(await response.text());
+  return body !== undefined && isObject(body)
+    ? { ok: true, body }
+    : { ok: false, reason: "invalid response" };
+}
+
+async function lookupUpstream(
+  spec: JsonObject,
+  fetchImpl: FetchLike,
+  env: NodeJS.ProcessEnv,
+): Promise<UpstreamResult> {
+  const { npm, line, github, tagPrefix } = spec;
+  if (typeof npm === "string" && typeof line === "string") {
+    // The registry rejects ranges, so read the packument and pick the newest release on the line.
+    const result = await fetchJson(fetchImpl, `https://registry.npmjs.org/${npm}`, {
+      Accept: "application/vnd.npm.install-v1+json",
+    });
+    if (!result.ok) return result;
+    const versions = result.body["versions"];
+    if (versions === undefined || !isObject(versions))
+      return { ok: false, reason: "invalid response" };
+    if (!/^\d+$/.test(line)) return { ok: false, reason: `invalid line ${line}` };
+    const pattern = new RegExp(`^${line}\\.\\d+\\.\\d+$`);
+    let newest = "";
+    for (const version of Object.keys(versions)) {
+      if (pattern.test(version) && (newest === "" || isNewer(version, newest))) newest = version;
+    }
+    return newest === ""
+      ? { ok: false, reason: `no ${line}.x release` }
+      : { ok: true, version: newest };
+  }
+  if (typeof npm === "string") {
+    const result = await fetchJson(fetchImpl, `https://registry.npmjs.org/${npm}/latest`, {
+      Accept: "application/json",
+    });
+    if (!result.ok) return result;
+    const version = result.body["version"];
+    return typeof version === "string" && version !== ""
+      ? { ok: true, version }
+      : { ok: false, reason: "invalid response" };
+  }
+  if (typeof github === "string") {
+    const headers: Record<string, string> = {
+      Accept: "application/vnd.github+json",
+      "User-Agent": "docks-kit",
+    };
+    const token = env["GITHUB_TOKEN"] || env["GH_TOKEN"];
+    if (token !== undefined && token !== "") headers["Authorization"] = `Bearer ${token}`;
+    const result = await fetchJson(
+      fetchImpl,
+      `https://api.github.com/repos/${github}/releases/latest`,
+      headers,
+    );
+    if (!result.ok) return result;
+    const tag = result.body["tag_name"];
+    if (typeof tag !== "string") return { ok: false, reason: "invalid response" };
+    const prefix = typeof tagPrefix === "string" ? tagPrefix : "";
+    return tag.startsWith(prefix)
+      ? { ok: true, version: tag.slice(prefix.length) }
+      : { ok: false, reason: `unexpected tag ${tag}` };
+  }
+  return { ok: false, reason: "no upstream in SoT/toolchain.json" };
+}
+
+/** Newest upstream release for one manifest tool; successes cache 24 h in kit.db. */
+export async function latestUpstream(
+  tool: string,
+  inputs: UpstreamInputs,
+): Promise<UpstreamResult> {
+  const { home, refresh, now, fetchImpl = globalThis.fetch, env = process.env } = inputs;
+  const key = `upstream:${tool}`;
+  if (!refresh) {
+    const cached = readCache(home, key, UPSTREAM_CACHE_MS, now);
+    if (cached !== undefined) return { ok: true, version: cached };
+  }
+  const spec = upstreamSpec(tool);
+  if (spec === undefined) return { ok: false, reason: "no upstream in SoT/toolchain.json" };
+  let result: UpstreamResult;
+  try {
+    result = await lookupUpstream(spec, fetchImpl, env);
+  } catch (error) {
+    result = { ok: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+  if (result.ok) writeCache(home, key, result.version, now);
+  return result;
+}
+
+/** Compare each verified pin with the newest upstream release. Report only. */
+export async function outdatedReport(
+  ctx: Ctx,
+  options: { readonly refresh: boolean; readonly fetchImpl?: FetchLike },
+): Promise<number> {
+  const { echo } = ctx.services.logger;
+  const tools = Object.keys(manifest()).filter(
+    (tool) => field(tool, "verified") !== "" && upstreamSpec(tool) !== undefined,
+  );
+  const now = Date.now();
+  const results = await Promise.all(
+    tools.map((tool) =>
+      latestUpstream(tool, {
+        home: ctx.home,
+        refresh: options.refresh,
+        now,
+        ...(options.fetchImpl !== undefined ? { fetchImpl: options.fetchImpl } : {}),
+      }),
+    ),
+  );
+  echo(row(["TOOL", "KIND", "VERIFIED", "LATEST", "STATUS", "UPSTREAM"]));
+  tools.forEach((tool, index) => {
+    const verified = field(tool, "verified");
+    const result = results[index]!;
+    let latest = "-";
+    let status: string;
+    if (result.ok) {
+      latest = result.version;
+      status = isNewer(latest, verified) ? "newer" : "current";
+    } else {
+      status = `lookup failed: ${result.reason}`;
+    }
+    const label = upstreamLabel(upstreamSpec(tool) ?? {});
+    echo(row([tool, field(tool, "kind"), verified, latest, status, label]));
+  });
+  echo("Report only: update a verified pin after testing that release (SoT/toolchain.json).");
+  return 0;
+}

package/cli/src/generated/sotPayload.ts

@@ -1,12 +1,12 @@
 // Generated by cli/scripts/generate-sot-payload.ts. DO NOT EDIT.
 // Edit SoT/, notification.mp3, or package.json, then run: bun cli/scripts/generate-sot-payload.ts
 
-export const GENERATED_PACKAGE_VERSION = "0.18.1"
+export const GENERATED_PACKAGE_VERSION = "0.19.1"
 
 export const GENERATED_PAYLOAD_TEXT = {
   "SoT/.agents/skills.txt": "# Universal AI-agent skill manifest intentionally empty.\n# Global skill discovery is opt-in: add one <owner>/<repo> slug per line.\n# EngineNative ignores comments and blank lines.\n",
-  "SoT/models.json": "{\n  \"$comment\": \"Kit-verified model catalog — single source for EngineNative validators, the docks-kit CLI (models/model commands, pickers, and bare-flag help), and docs. Entries are research-proofed: update an entry and its tool-level `verified` date when a model ships or retires. Deploy-time model flags remain permissive.\",\n  \"claude\": {\n    \"verified\": \"2026-09-22\",\n    \"models\": [\n      { \"id\": \"best\", \"kind\": \"alias\", \"note\": \"Fable 5.1 where the org has access, latest Opus otherwise (Claude Code >=2.1.257; Claude apps gateway sessions still resolve Fable 5)\" },\n      { \"id\": \"opus\", \"kind\": \"alias\", \"note\": \"latest Opus — the kit SoT default (Opus 5.5 from Claude Code >=2.1.280)\" },\n      { \"id\": \"fable\", \"kind\": \"alias\", \"note\": \"Fable 5.1 — needs org access + Claude Code >=2.1.257 (Claude apps gateway sessions still resolve Fable 5)\" },\n      { \"id\": \"sonnet\", \"kind\": \"alias\", \"note\": \"latest Sonnet (currently Sonnet 5)\" },\n      { \"id\": \"haiku\", \"kind\": \"alias\", \"note\": \"latest Haiku (currently Haiku 4.5)\" },\n      { \"id\": \"default\", \"kind\": \"alias\", \"note\": \"engine pseudo-value: deletes the deployed model key so the account default applies\" },\n      { \"id\": \"claude-opus-5-5\", \"kind\": \"id\", \"note\": \"Opus 5.5 — needs Claude Code >=2.1.280\" },\n      { \"id\": \"claude-fable-5-1\", \"kind\": \"id\", \"note\": \"Fable 5.1 — needs Claude Code >=2.1.257\" },\n      { \"id\": \"claude-fable-5\", \"kind\": \"id\", \"note\": \"Fable 5 (legacy)\" },\n      { \"id\": \"claude-opus-5\", \"kind\": \"id\", \"note\": \"Opus 5 (legacy)\" },\n      { \"id\": \"claude-opus-4-8\", \"kind\": \"id\", \"note\": \"Opus 4.8 (legacy)\" },\n      { \"id\": \"claude-sonnet-5\", \"kind\": \"id\", \"note\": \"Sonnet 5\" },\n      { \"id\": \"claude-haiku-4-5-20251001\", \"kind\": \"id\", \"note\": \"Haiku 4.5\" }\n    ]\n  },\n  \"codex\": {\n    \"verified\": \"2026-09-22\",\n    \"models\": [\n      { \"id\": \"gpt-6-sol\", \"kind\": \"id\", \"note\": \"GPT-6 Sol — complex coding and agentic work, recommended default; the kit SoT pin\" },\n      { \"id\": \"gpt-6-luna\", \"kind\": \"id\", \"note\": \"GPT-6 Luna — fast/light tier\" },\n      { \"id\": \"gpt-6-astra\", \"kind\": \"id\", \"note\": \"GPT-6 Astra — most capable, highest cost\" },\n      { \"id\": \"gpt-5.6-sol\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.6-terra\", \"kind\": \"id\", \"note\": \"previous generation, balanced tier\" },\n      { \"id\": \"gpt-5.6-luna\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5.5\" },\n      { \"id\": \"gpt-5.1\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5\" }\n    ]\n  }\n}\n",
-  "SoT/toolchain.json": "{\n  \"$comment\": \"Kit toolchain manifest - DATA only (versions, floors, policy); version probing and the doctor report live in cli/src/engine-native/toolchain.ts, and the one managed install lives in cli/src/engine-native/bun.ts bunBootstrap. kind: check (doctor visibility only) | managed (kit installs it when missing) | pin (no binary probe - a version pin for a package the kit installs through another tool, such as npx or `omp install`). policy (managed only): present (install when missing, never upgrade). `verified` = last kit-tested version; `pinnable` marks a tool whose `verified` release the bootstrap can install by exact tag. Supply-chain stance: every kit-driven install is pinned to `verified` - never floating @latest (npm-worm/Shai-Hulud surface). Update `verified` after testing a new release.\",\n  \"tools\": {\n    \"jq\":     { \"kind\": \"check\", \"note\": \"optional operator CLI; EngineNative JSON and Claude runtime do not invoke it\" },\n    \"curl\":   { \"kind\": \"check\", \"note\": \"POSIX installer transport for the Bun bootstrap\" },\n    \"git\":    { \"kind\": \"check\", \"note\": \"plugin marketplaces (claude/codex clone them) + kit checkout updates\" },\n    \"node\":   { \"kind\": \"check\", \"floor\": \"22.22.2\",\n                \"note\": \"hosts the npm globals installed for the Claude LSP plugins; the floor is typescript-language-server 6's engines requirement, so an older Node reports `below-floor` in `docks-kit toolchain` instead of silently installing an LSP server that cannot start\" },\n    \"npm\":    { \"kind\": \"check\", \"note\": \"npm-global installer; also backs the intelephense version probe (`npm ls -g`)\" },\n    \"claude\": { \"kind\": \"check\", \"floor\": \"2.1.280\", \"note\": \"kit floor — lets the `opus` alias resolve to Opus 5.5, the default Opus from Claude Code 2.1.280, and subsumes the older Fable 5.1 (>=2.1.257) and Opus 5 (>=2.1.219) requirements (mirrors settings minimumVersion)\" },\n    \"codex\":  { \"kind\": \"check\", \"note\": \"upstream-owned; standalone installer prints when missing\" },\n    \"omp\":    { \"kind\": \"check\", \"floor\": \"18.0.8\", \"verified\": \"18.0.8\",\n                \"note\": \"Oh My Pi harness (https://github.com/can1357/oh-my-pi); upstream-owned and self-updating through `omp update`, so sync never installs or upgrades it. `sync omp` needs the CLI only for the marketplace and plugin passes; the file deploys proceed without it\" },\n    \"ffplay\": { \"kind\": \"check\", \"note\": \"Notification hook sound; distro-installed, so no kit floor applies\" },\n    \"bwrap\":  { \"kind\": \"check\", \"os\": \"linux\", \"floor\": \"0.9.0\",\n                \"note\": \"Codex Linux sandbox runtime; sync installs it via the distro package manager, so the floor is the kit-tested baseline (Ubuntu 24.04 LTS) and no verified pin applies\" },\n    \"intelephense\": { \"kind\": \"check\", \"floor\": \"1.18.5\", \"verified\": \"1.18.5\",\n                \"note\": \"php-lsp server; `verified` pins claudeSync syncLspServers' npm install. Version comes from `npm ls -g` — its own --version prints minified source\" },\n    \"typescript-language-server\": { \"kind\": \"check\", \"floor\": \"6.0.0\", \"verified\": \"6.0.0\",\n                \"note\": \"typescript-lsp server binary; `verified` pins claudeSync syncLspServers' npm install. Version 6 requires Node >=22.22.2 (see the `node` floor)\" },\n    \"rust-analyzer\": { \"kind\": \"check\",\n                \"note\": \"rust-analyzer-lsp server binary; claudeSync syncLspServers installs it with `rustup component add rust-analyzer` when rustup is present, so the version follows the host Rust toolchain and no verified pin applies (the bubblewrap stance for a tool the kit does not publish). A host without rustup is skipped in silence\" },\n    \"tsc\":    { \"kind\": \"check\", \"floor\": \"6.0.3\", \"verified\": \"6.0.3\", \"note\": \"typescript-lsp dependency (npm package `typescript`); `verified` pins claudeSync syncLspServers' npm install. Deliberately on the 6.x line: typescript-language-server embeds TypeScript's programmatic API, which TS7 (native) doesn't yet expose — the repo's own devDependency runs TS7 for tsc --noEmit\" },\n    \"bun\":    { \"kind\": \"managed\", \"policy\": \"present\", \"floor\": \"1.4.0\", \"verified\": \"1.4.2\", \"pinnable\": true,\n                \"note\": \"runtime for the docks-kit CLI and the Claude statusline/hook programs; bootstrap installs the verified release (installer takes bun-vX.Y.Z); self-updates via `bun upgrade` when wanted\" },\n    \"skills-cli\": { \"kind\": \"pin\", \"verified\": \"1.5.25\",\n                \"note\": \"the `skills` npm package the kit runs via `npx skills@<verified>` when SoT/.agents/skills.txt names a slug (it is empty by default) — pinned, never @latest\" },\n    \"pi-intercom\": { \"kind\": \"pin\", \"verified\": \"0.13.0\",\n                \"note\": \"the cross-session messaging plugin ompSync installs with `omp install pi-intercom@<verified>` - pinned, never floating. Its broker runs under Bun because omp's flat plugin store cannot resolve the default `npx --no-install tsx` launcher\" }\n  }\n}\n",
+  "SoT/models.json": "{\n  \"$comment\": \"Curated overlay for docks-kit model listings: aliases (kind alias) and notes always apply; the id rows are the fallback when the harness's live list is unavailable (harness not enabled, no login or cache, offline). Live sources: Claude via the Claude Code login against the Anthropic models API (cached 6 h in ~/.docks-kit/kit.db), Codex via ~/.codex/models_cache.json, omp via omp models --json.\",\n  \"claude\": {\n    \"verified\": \"2026-09-22\",\n    \"models\": [\n      { \"id\": \"best\", \"kind\": \"alias\", \"note\": \"Fable 5.1 where the org has access, latest Opus otherwise (Claude Code >=2.1.257; Claude apps gateway sessions still resolve Fable 5)\" },\n      { \"id\": \"opus\", \"kind\": \"alias\", \"note\": \"latest Opus — the kit SoT default (Opus 5.5 from Claude Code >=2.1.280)\" },\n      { \"id\": \"fable\", \"kind\": \"alias\", \"note\": \"Fable 5.1 — needs org access + Claude Code >=2.1.257 (Claude apps gateway sessions still resolve Fable 5)\" },\n      { \"id\": \"sonnet\", \"kind\": \"alias\", \"note\": \"latest Sonnet (currently Sonnet 5)\" },\n      { \"id\": \"haiku\", \"kind\": \"alias\", \"note\": \"latest Haiku (currently Haiku 4.5)\" },\n      { \"id\": \"default\", \"kind\": \"alias\", \"note\": \"engine pseudo-value: deletes the deployed model key so the account default applies\" },\n      { \"id\": \"claude-opus-5-5\", \"kind\": \"id\", \"note\": \"Opus 5.5 — needs Claude Code >=2.1.280\" },\n      { \"id\": \"claude-fable-5-1\", \"kind\": \"id\", \"note\": \"Fable 5.1 — needs Claude Code >=2.1.257\" },\n      { \"id\": \"claude-fable-5\", \"kind\": \"id\", \"note\": \"Fable 5 (legacy)\" },\n      { \"id\": \"claude-opus-5\", \"kind\": \"id\", \"note\": \"Opus 5 (legacy)\" },\n      { \"id\": \"claude-opus-4-8\", \"kind\": \"id\", \"note\": \"Opus 4.8 (legacy)\" },\n      { \"id\": \"claude-sonnet-5\", \"kind\": \"id\", \"note\": \"Sonnet 5\" },\n      { \"id\": \"claude-haiku-4-5-20251001\", \"kind\": \"id\", \"note\": \"Haiku 4.5\" }\n    ]\n  },\n  \"codex\": {\n    \"verified\": \"2026-09-22\",\n    \"models\": [\n      { \"id\": \"gpt-6-sol\", \"kind\": \"id\", \"note\": \"GPT-6 Sol — complex coding and agentic work, recommended default; the kit SoT pin\" },\n      { \"id\": \"gpt-6-luna\", \"kind\": \"id\", \"note\": \"GPT-6 Luna — fast/light tier\" },\n      { \"id\": \"gpt-6-astra\", \"kind\": \"id\", \"note\": \"GPT-6 Astra — most capable, highest cost\" },\n      { \"id\": \"gpt-5.6-sol\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.6-terra\", \"kind\": \"id\", \"note\": \"previous generation, balanced tier\" },\n      { \"id\": \"gpt-5.6-luna\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5.5\" },\n      { \"id\": \"gpt-5.1\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5\" }\n    ]\n  }\n}\n",
+  "SoT/toolchain.json": "{\n  \"$comment\": \"Kit toolchain manifest - DATA only (versions, floors, policy); version probing and the doctor report live in cli/src/engine-native/toolchain.ts, and the one managed install lives in cli/src/engine-native/bun.ts bunBootstrap. kind: check (doctor visibility only) | managed (kit installs it when missing) | pin (no binary probe - a version pin for a package the kit installs through another tool, such as npx or `omp install`). policy (managed only): present (install when missing, never upgrade). `verified` = last kit-tested version; `pinnable` marks a tool whose `verified` release the bootstrap can install by exact tag. Supply-chain stance: every kit-driven install is pinned to `verified` - never floating @latest (npm-worm/Shai-Hulud surface). Update `verified` after testing a new release. upstream (optional) names where `docks-kit toolchain outdated` reads the newest release: npm package (optional major line) or GitHub repo releases with a tag prefix; results cache 24 h in ~/.docks-kit/kit.db; the report never installs or edits pins.\",\n  \"tools\": {\n    \"jq\":     { \"kind\": \"check\", \"note\": \"optional operator CLI; EngineNative JSON and Claude runtime do not invoke it\" },\n    \"curl\":   { \"kind\": \"check\", \"note\": \"POSIX installer transport for the Bun bootstrap\" },\n    \"git\":    { \"kind\": \"check\", \"note\": \"plugin marketplaces (claude/codex clone them) + kit checkout updates\" },\n    \"node\":   { \"kind\": \"check\", \"floor\": \"22.22.2\",\n                \"note\": \"hosts the npm globals installed for the Claude LSP plugins; the floor is typescript-language-server 6's engines requirement, so an older Node reports `below-floor` in `docks-kit toolchain` instead of silently installing an LSP server that cannot start\" },\n    \"npm\":    { \"kind\": \"check\", \"note\": \"npm-global installer; also backs the intelephense version probe (`npm ls -g`)\" },\n    \"claude\": { \"kind\": \"check\", \"floor\": \"2.1.280\", \"note\": \"kit floor — lets the `opus` alias resolve to Opus 5.5, the default Opus from Claude Code 2.1.280, and subsumes the older Fable 5.1 (>=2.1.257) and Opus 5 (>=2.1.219) requirements (mirrors settings minimumVersion)\" },\n    \"codex\":  { \"kind\": \"check\", \"note\": \"upstream-owned; standalone installer prints when missing\" },\n    \"omp\":    { \"kind\": \"check\", \"floor\": \"18.0.8\", \"verified\": \"18.0.8\",\n                \"upstream\": { \"github\": \"can1357/oh-my-pi\", \"tagPrefix\": \"v\" },\n                \"note\": \"Oh My Pi harness (https://github.com/can1357/oh-my-pi); upstream-owned and self-updating through `omp update`, so sync never installs or upgrades it. `sync omp` needs the CLI only for the marketplace and plugin passes; the file deploys proceed without it\" },\n    \"ffplay\": { \"kind\": \"check\", \"note\": \"Notification hook sound; distro-installed, so no kit floor applies\" },\n    \"bwrap\":  { \"kind\": \"check\", \"os\": \"linux\", \"floor\": \"0.9.0\",\n                \"note\": \"Codex Linux sandbox runtime; sync installs it via the distro package manager, so the floor is the kit-tested baseline (Ubuntu 24.04 LTS) and no verified pin applies\" },\n    \"intelephense\": { \"kind\": \"check\", \"floor\": \"1.18.5\", \"verified\": \"1.18.5\",\n                \"upstream\": { \"npm\": \"intelephense\" },\n                \"note\": \"php-lsp server; `verified` pins claudeSync syncLspServers' npm install. Version comes from `npm ls -g` — its own --version prints minified source\" },\n    \"typescript-language-server\": { \"kind\": \"check\", \"floor\": \"6.0.0\", \"verified\": \"6.0.0\",\n                \"upstream\": { \"npm\": \"typescript-language-server\" },\n                \"note\": \"typescript-lsp server binary; `verified` pins claudeSync syncLspServers' npm install. Version 6 requires Node >=22.22.2 (see the `node` floor)\" },\n    \"rust-analyzer\": { \"kind\": \"check\",\n                \"note\": \"rust-analyzer-lsp server binary; claudeSync syncLspServers installs it with `rustup component add rust-analyzer` when rustup is present, so the version follows the host Rust toolchain and no verified pin applies (the bubblewrap stance for a tool the kit does not publish). A host without rustup is skipped in silence\" },\n    \"tsc\":    { \"kind\": \"check\", \"floor\": \"6.0.3\", \"verified\": \"6.0.3\",\n                \"upstream\": { \"npm\": \"typescript\", \"line\": \"6\" }, \"note\": \"typescript-lsp dependency (npm package `typescript`); `verified` pins claudeSync syncLspServers' npm install. Deliberately on the 6.x line: typescript-language-server embeds TypeScript's programmatic API, which TS7 (native) doesn't yet expose — the repo's own devDependency runs TS7 for tsc --noEmit\" },\n    \"bun\":    { \"kind\": \"managed\", \"policy\": \"present\", \"floor\": \"1.4.0\", \"verified\": \"1.4.2\", \"pinnable\": true,\n                \"upstream\": { \"github\": \"oven-sh/bun\", \"tagPrefix\": \"bun-v\" },\n                \"note\": \"runtime for the docks-kit CLI and the Claude statusline/hook programs; bootstrap installs the verified release (installer takes bun-vX.Y.Z); self-updates via `bun upgrade` when wanted\" },\n    \"skills-cli\": { \"kind\": \"pin\", \"verified\": \"1.5.25\",\n                \"upstream\": { \"npm\": \"skills\" },\n                \"note\": \"the `skills` npm package the kit runs via `npx skills@<verified>` when SoT/.agents/skills.txt names a slug (it is empty by default) — pinned, never @latest\" },\n    \"pi-intercom\": { \"kind\": \"pin\", \"verified\": \"0.13.0\",\n                \"upstream\": { \"npm\": \"pi-intercom\" },\n                \"note\": \"the cross-session messaging plugin ompSync installs with `omp install pi-intercom@<verified>` - pinned, never floating. Its broker runs under Bun because omp's flat plugin store cannot resolve the default `npx --no-install tsx` launcher\" }\n  }\n}\n",
   "SoT/.claude/CLAUDE.md": "## Research Before Implementation\n\nBefore writing or modifying code that uses an API, hook, method, or config surface you have not verified in this session, research current documentation first.\n\nResearch workflow:\n1. Prefer official documentation and primary sources for the specific library, framework, or API.\n2. If a local docs or MCP tool is available, use it before broad web search.\n3. Only then proceed to implementation.\n\nResearch when:\n- Installing or configuring a dependency.\n- Using an API, hook, method, or pattern not verified in this session.\n- Upgrading or migrating between versions.\n- Any task where relying on memory could cause stale syntax or behavior.\n\nDo not:\n- Assume API signatures, method names, or config options from memory.\n- Generate framework code without checking current docs first.\n- Skip research because the library seems familiar.\n\n<constraint>\nResearch the codebase before editing. Never change code you have not read.\n</constraint>\n\n## Agentic Harness Heuristics\n\n**1. Persistence.** Keep going until the user's query is completely resolved. Only yield when sure the problem is solved. Before ending a turn, check the last paragraph: if it is a plan, a question you can answer yourself, or a promise of work not done (\"I'll…\"), do that work now.\n\n**2. Default to parallel.** Whenever you have multiple independent operations (reads, greps, web fetches, independent edits), invoke them in a single response with multiple tool-use blocks. Sequential calls only when output of one operation is required as input to the next.\n\n**3. Multi-pass search.** First-pass search often misses — vary the wording (colleague-questions over keywords) before concluding something doesn't exist.\n\n**4. Trace symbols.** Before modifying a symbol, trace it to its definitions and all usages. Don't assume a function's behavior or a type's shape from the call site alone.\n\n**5. Linter-loop 3-strike rule.** Don't loop more than 3 times fixing linter errors on the same file. On the third attempt, stop and ask the user — repeated failure usually means the diagnosis is wrong, not the code.\n\n**6. Read-before-Edit TTL.** If you haven't read a file with the Read tool in the last ~5 messages, re-read it before editing. Cached file content goes stale silently when the user edits between turns.\n\n**7. Big-file rule.** For files >1000 lines, prefer Grep + scoped Read (`offset` + `limit`) over reading the entire file. Whole-file reads bloat context; targeted reads keep the working set small.\n\n**8. Todo hygiene.** Use TaskCreate for items with meaningful outcome (≥5 min, distinct deliverable). Never include operational sub-actions (linting, testing, searching, examining the codebase) as their own todos — those are sub-steps in service of higher-level tasks. Mark complete immediately when done, never in batches.\n\n**9. Literal-instruction rule.** Current frontier models follow instructions literally — they do not silently generalize from intent. Phrase requirements as explicit checklists with success criteria, not narrative.\n\n**10. Context hygiene.** Prefer `/clear` at task boundaries and `/rewind` for wrong-path detours over carrying rot forward (corrections accumulate noise; rewinds preserve the prefix and discard the bad branch). On a continuing task, run `/compact` with steering before context quality degrades. Never stop, summarize, or suggest a new session on account of context limits.\n\n**11. Autonomy calibration.** For minor choices (naming, formatting, default values, which of two equivalent approaches), pick a reasonable option and note it — don't ask. Ask first only for scope changes, destructive actions, or decisions that change the deliverable. When the user is describing a problem or asking a question rather than requesting a change, the deliverable is your assessment — report findings and stop; don't apply fixes until asked. Don't close a finished task with \"Want me to also…?\" — run the obvious verification, then stop cleanly.\n\n**12. Capability triggering.** When the answer depends on current or version-specific information, search or fetch before answering — never answer from memory. When work fans out across independent items (many files to read, many tests to run, many candidates to check), delegate to parallel subagents; never spawn one for work you can complete directly. For verification, prefer a fresh-context subagent over self-critique. On tasks longer than a few turns, keep a running notes file and re-read it before each phase.\n\n<constraint>\nTreat the 12 heuristics above as protocol, not preference. If a turn ends without honoring an applicable one (e.g., lint-loop guard not respected, edit without re-read), self-correct in the next turn before continuing.\n</constraint>\n\nReuse before invention: inventory existing code, components, conventions, and dependencies; extend them instead of creating a parallel pattern. Load only the narrow skills supported by the task and repository evidence. If a request establishes a new React/Tailwind system and no convention exists, prefer current shadcn/ui `base-*` components backed by Base UI; otherwise preserve the existing stack. Treat probe, production access, publish, push, release, and deploy as literal current-request effects—never infer external authority from a plan, schedule, review, or old receipt.\n\nFor Docks plan reviews, cross-company review is standing-authorized; do not ask for export consent. This never overrides a host or platform security denial.\n\nUse a narrow-to-broad verification ladder: direct acceptance while iterating, focused regressions next, and one full CI at the pre-commit or release boundary. Reuse still-matching evidence; rerun full CI only after a relevant edit invalidates it.\n\n<constraint>\nNo secrets in committed config. Treat plugin marketplaces, installers, and downloaded artifacts as untrusted until verified.\n</constraint>\n",
   "SoT/.claude/mcp-servers.json": "{\n  \"mcpServers\": {}\n}\n",
   "SoT/.claude/settings.json": "{\n  \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n  \"minimumVersion\": \"2.1.280\",\n  \"model\": \"opus\",\n  \"effortLevel\": \"high\",\n  \"autoMemoryEnabled\": false,\n  \"autoDreamEnabled\": false,\n  \"skillListingMaxDescChars\": 2048,\n  \"respectGitignore\": true,\n  \"cleanupPeriodDays\": 14,\n  \"skillListingBudgetFraction\": 0.05,\n  \"env\": {\n    \"CLAUDE_CODE_MAX_OUTPUT_TOKENS\": \"64000\",\n    \"CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR\": \"1\",\n    \"CLAUDE_CODE_AUTO_COMPACT_WINDOW\": \"468000\",\n    \"CLAUDE_CODE_NO_FLICKER\": \"1\"\n  },\n  \"permissions\": {\n    \"defaultMode\": \"auto\",\n    \"allow\": [\n      \"Read\",\n      \"Glob\",\n      \"Grep\",\n      \"WebSearch\",\n      \"Edit(./)\"\n    ],\n    \"deny\": [\n      \"Read(**/.env)\",\n      \"Read(**/.env.local)\",\n      \"Read(**/secrets/**)\",\n      \"Read(**/*.key)\",\n      \"Read(**/*.pem)\",\n      \"Read(**/*.p12)\",\n      \"Read(**/.credentials*)\",\n      \"Edit(**/.env)\",\n      \"Edit(**/.env.local)\",\n      \"Edit(**/secrets/**)\",\n      \"Bash(sudo *)\",\n      \"Bash(rm -rf /)\",\n      \"Bash(rm -rf / *)\",\n      \"Bash(rm -rf ~)\",\n      \"Bash(rm -rf ~ *)\",\n      \"Bash(rm -rf $HOME)\",\n      \"Bash(rm -rf $HOME *)\",\n      \"Bash(> /dev *)\",\n      \"Bash(dd if= *)\",\n      \"Bash(mkfs *)\",\n      \"Bash(eval *)\",\n      \"Bash(chmod 777 *)\",\n      \"Bash(chmod -R 777 *)\",\n      \"Bash(git push --force origin main *)\",\n      \"Bash(git push --force origin master *)\",\n      \"Bash(git push -f origin main *)\",\n      \"Bash(git push -f origin master *)\",\n      \"PowerShell(sudo *)\",\n      \"PowerShell(rm -rf /)\",\n      \"PowerShell(rm -rf / *)\",\n      \"PowerShell(rm -rf ~)\",\n      \"PowerShell(rm -rf ~ *)\",\n      \"PowerShell(rm -rf $HOME)\",\n      \"PowerShell(rm -rf $HOME *)\",\n      \"PowerShell(> /dev *)\",\n      \"PowerShell(dd if= *)\",\n      \"PowerShell(mkfs *)\",\n      \"PowerShell(eval *)\",\n      \"PowerShell(chmod 777 *)\",\n      \"PowerShell(chmod -R 777 *)\",\n      \"PowerShell(git push --force origin main *)\",\n      \"PowerShell(git push --force origin master *)\",\n      \"PowerShell(git push -f origin main *)\",\n      \"PowerShell(git push -f origin master *)\",\n      \"PowerShell(Remove-Item *-Recurse* /)\",\n      \"PowerShell(Remove-Item *-Recurse* / *)\",\n      \"PowerShell(Remove-Item / *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path / *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath / *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* ~)\",\n      \"PowerShell(Remove-Item *-Recurse* ~ *)\",\n      \"PowerShell(Remove-Item ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME *)\",\n      \"PowerShell(Remove-Item $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(Remove-Item $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\ *)\",\n      \"PowerShell(Remove-Item \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\ *)\",\n      \"PowerShell(Remove-Item *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* /)\",\n      \"PowerShell(del *-Recurse* / *)\",\n      \"PowerShell(del / *-Recurse*)\",\n      \"PowerShell(del -Path / *-Recurse*)\",\n      \"PowerShell(del -LiteralPath / *-Recurse*)\",\n      \"PowerShell(del *-Recurse* ~)\",\n      \"PowerShell(del *-Recurse* ~ *)\",\n      \"PowerShell(del ~ *-Recurse*)\",\n      \"PowerShell(del -Path ~ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $HOME)\",\n      \"PowerShell(del *-Recurse* $HOME *)\",\n      \"PowerShell(del $HOME *-Recurse*)\",\n      \"PowerShell(del -Path $HOME *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(del $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del *-Recurse* \\\\\\\\)\",\n      \"PowerShell(del *-Recurse* \\\\ *)\",\n      \"PowerShell(del \\\\ *-Recurse*)\",\n      \"PowerShell(del -Path \\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(del *-Recurse* *:\\\\ *)\",\n      \"PowerShell(del *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* /)\",\n      \"PowerShell(erase *-Recurse* / *)\",\n      \"PowerShell(erase / *-Recurse*)\",\n      \"PowerShell(erase -Path / *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath / *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* ~)\",\n      \"PowerShell(erase *-Recurse* ~ *)\",\n      \"PowerShell(erase ~ *-Recurse*)\",\n      \"PowerShell(erase -Path ~ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $HOME)\",\n      \"PowerShell(erase *-Recurse* $HOME *)\",\n      \"PowerShell(erase $HOME *-Recurse*)\",\n      \"PowerShell(erase -Path $HOME *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(erase $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* \\\\\\\\)\",\n      \"PowerShell(erase *-Recurse* \\\\ *)\",\n      \"PowerShell(erase \\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path \\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(erase *-Recurse* *:\\\\ *)\",\n      \"PowerShell(erase *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* /)\",\n      \"PowerShell(rd *-Recurse* / *)\",\n      \"PowerShell(rd / *-Recurse*)\",\n      \"PowerShell(rd -Path / *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* ~)\",\n      \"PowerShell(rd *-Recurse* ~ *)\",\n      \"PowerShell(rd ~ *-Recurse*)\",\n      \"PowerShell(rd -Path ~ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $HOME)\",\n      \"PowerShell(rd *-Recurse* $HOME *)\",\n      \"PowerShell(rd $HOME *-Recurse*)\",\n      \"PowerShell(rd -Path $HOME *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rd $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rd *-Recurse* \\\\ *)\",\n      \"PowerShell(rd \\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rd *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rd *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* /)\",\n      \"PowerShell(ri *-Recurse* / *)\",\n      \"PowerShell(ri / *-Recurse*)\",\n      \"PowerShell(ri -Path / *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath / *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* ~)\",\n      \"PowerShell(ri *-Recurse* ~ *)\",\n      \"PowerShell(ri ~ *-Recurse*)\",\n      \"PowerShell(ri -Path ~ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $HOME)\",\n      \"PowerShell(ri *-Recurse* $HOME *)\",\n      \"PowerShell(ri $HOME *-Recurse*)\",\n      \"PowerShell(ri -Path $HOME *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(ri $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* \\\\\\\\)\",\n      \"PowerShell(ri *-Recurse* \\\\ *)\",\n      \"PowerShell(ri \\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path \\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(ri *-Recurse* *:\\\\ *)\",\n      \"PowerShell(ri *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* /)\",\n      \"PowerShell(rm *-Recurse* / *)\",\n      \"PowerShell(rm / *-Recurse*)\",\n      \"PowerShell(rm -Path / *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* ~)\",\n      \"PowerShell(rm *-Recurse* ~ *)\",\n      \"PowerShell(rm ~ *-Recurse*)\",\n      \"PowerShell(rm -Path ~ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $HOME)\",\n      \"PowerShell(rm *-Recurse* $HOME *)\",\n      \"PowerShell(rm $HOME *-Recurse*)\",\n      \"PowerShell(rm -Path $HOME *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rm $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rm *-Recurse* \\\\ *)\",\n      \"PowerShell(rm \\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rm *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rm *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* /)\",\n      \"PowerShell(rmdir *-Recurse* / *)\",\n      \"PowerShell(rmdir / *-Recurse*)\",\n      \"PowerShell(rmdir -Path / *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* ~)\",\n      \"PowerShell(rmdir *-Recurse* ~ *)\",\n      \"PowerShell(rmdir ~ *-Recurse*)\",\n      \"PowerShell(rmdir -Path ~ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $HOME)\",\n      \"PowerShell(rmdir *-Recurse* $HOME *)\",\n      \"PowerShell(rmdir $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -Path $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rmdir $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rmdir *-Recurse* \\\\ *)\",\n      \"PowerShell(rmdir \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rmdir *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(Start-Process *-Verb RunAs*)\",\n      \"PowerShell(Invoke-Expression *)\",\n      \"PowerShell(iex *)\",\n      \"PowerShell(Format-Volume *)\",\n      \"PowerShell(icacls */grant*Everyone:F*)\",\n      \"PowerShell(icacls */grant*Everyone:(F)*)\"\n    ],\n    \"ask\": [\n      \"Bash(git clean *)\",\n      \"Bash(docker volume rm *)\",\n      \"Bash(docker system prune *)\",\n      \"PowerShell(git clean *)\",\n      \"PowerShell(docker volume rm *)\",\n      \"PowerShell(docker system prune *)\"\n    ]\n  },\n  \"hooks\": {\n    \"SessionStart\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_SESSION_START__\"],\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"Notification\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_NOTIFY__\"],\n            \"timeout\": 10,\n            \"async\": true\n          }\n        ]\n      }\n    ],\n    \"PostToolUseFailure\": [\n      {\n        \"matcher\": \"Bash|PowerShell\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"echo '{\\\"hookSpecificOutput\\\":{\\\"hookEventName\\\":\\\"PostToolUseFailure\\\",\\\"additionalContext\\\":\\\"Last bash command failed. Repository / file state may have shifted \\u2014 re-read affected files before retrying. If the failure is a missing dependency or env mismatch, surface it to the user rather than retrying blindly.\\\"}}'\",\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"SubagentStop\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"prompt\",\n            \"prompt\": \"You are a quality gate for subagent outputs in a multi-agent code-analysis pipeline.\\n\\nEvaluate the subagent's `last_assistant_message` field (in the JSON below) against these requirements:\\n\\n1. ALLOW (return `{}`): Mode-selection or no-issues responses. Examples: \\\"Which mode do you prefer\\\", \\\"select an option\\\", \\\"no issues / problems / violations / blockers found\\\".\\n\\n2. ALLOW (return `{}`): Output contains at least one concrete file:line citation \\u2014 e.g. `src/auth.ts:42`, `lib/db.ts:100-115`, or path references that include line numbers.\\n\\n3. BLOCK (return `{\\\"decision\\\":\\\"block\\\",\\\"reason\\\":\\\"<one-line explanation>\\\"}`): Output claims about code or findings WITHOUT concrete file:line citations. Vague references like \\\"the auth handler\\\" or \\\"near the database code\\\" are not acceptable as the only evidence.\\n\\nSubagent invocation JSON:\\n$ARGUMENTS\\n\\nReturn ONLY the JSON decision (no commentary, no markdown fences).\",\n            \"timeout\": 30\n          }\n        ]\n      }\n    ]\n  },\n  \"statusLine\": {\n    \"type\": \"command\",\n    \"command\": \"__DOCKS_KIT_STATUSLINE__\",\n    \"refreshInterval\": 5\n  },\n  \"enabledPlugins\": {\n    \"docks@docks\": true,\n    \"plan-lifecycle@docks\": true,\n    \"php-lsp@claude-plugins-official\": true,\n    \"rust-analyzer-lsp@claude-plugins-official\": true,\n    \"typescript-lsp@claude-plugins-official\": true\n  },\n  \"extraKnownMarketplaces\": {\n    \"docks\": {\n      \"source\": {\n        \"source\": \"github\",\n        \"repo\": \"DocksDocks/docks\"\n      }\n    }\n  },\n  \"alwaysThinkingEnabled\": true,\n  \"showThinkingSummaries\": true,\n  \"viewMode\": \"default\",\n  \"theme\": \"dark-daltonized\",\n  \"skipDangerousModePermissionPrompt\": true\n}\n",
@@ -50,4 +50,4 @@ export const GENERATED_PAYLOAD_PATHS = [
   "notification.mp3"
 ] as const
 
-export const GENERATED_PAYLOAD_HASH = "a7a267f2130ee053cf9c40b2284ec447b6dd3cbcfa7af1306536dbd69f59b460"
+export const GENERATED_PAYLOAD_HASH = "50f4b203e999063431db49c361709d773bcdd8af7690df409a1055dbe4da4b59"

package/cli/src/main.ts

@@ -32,8 +32,8 @@ const root = Command.make("docks-kit", {}, () =>
       "  docks-kit update [--no-sync]              self-update the kit, then sync",
     );
     yield* Console.log("  docks-kit model <claude|codex> [value]     get/set the deployed model");
-    yield* Console.log("  docks-kit models [tool]                    kit-verified model catalog");
-    yield* Console.log("  docks-kit toolchain [check|ensure <tool>]  verified-version floors");
+    yield* Console.log("  docks-kit models [tool] [--refresh]        live model lists per harness");
+    yield* Console.log("  docks-kit toolchain [check|ensure|outdated] verified-version floors");
     yield* Console.log("  docks-kit status                           deployed-vs-SoT doctor view");
     yield* Console.log("  docks-kit plugins list                     plugin tri-state");
     yield* Console.log("  docks-kit skills list                      universal skills");

package/cli/src/manifests.ts

@@ -23,8 +23,8 @@ export const deployedClaudeSettings = (): any | undefined => {
 export function topLevelTomlString(text: string, setting: string): string | undefined {
   for (const line of text.split(/\r?\n/)) {
     if (/^\s*\[/.test(line)) return undefined;
-    const assignment = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*"([^"]+)"/);
-    if (assignment?.[1] === setting) return assignment[2];
+    const assignment = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*(?:"([^"]+)"|'([^']*)')/);
+    if (assignment?.[1] === setting) return assignment[2] ?? assignment[3];
   }
   return undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docks-kit",
-  "version": "0.18.1",
+  "version": "0.19.1",
   "description": "Portable AI coding agent config kit — SoT sync engine + typed CLI for Claude Code, Codex, and universal agent skills",
   "type": "module",
   "license": "MIT",