docks-kit 0.9.0 → 0.10.0

package/AGENTS.md

@@ -4,24 +4,29 @@ Canonical instructions for coding agents working on this project. Compatible wit
 
 ## Repository purpose
 
-Portable configuration kit for AI coding agents. Per-tool Single Source of Truth (SoT) directories get deployed to each tool's user-config location via `./docks-kit sync` — clone once, sync to your home directory, get a consistent AI-assisted dev environment everywhere. The kit focuses on **token efficiency without sacrificing quality**: every setting and hook is tuned to minimize token consumption while preserving rigorous output. When adding or editing anything, ask: *does this change reduce tokens without weakening correctness?*
+Portable configuration kit for AI coding agents. Per-tool Single Source of Truth (SoT) directories get deployed to each tool's user-config location via `./docks-kit sync` — clone once and get a consistent AI-assisted dev environment across supported Linux and macOS hosts. The kit focuses on **token efficiency without sacrificing quality**: every setting and hook is tuned to minimize token consumption while preserving rigorous output. When adding or editing anything, ask: *does this change reduce tokens without weakening correctness?*
 
 Tool-specific instructions live alongside this file:
 - **`CLAUDE.md`** — Claude Code SoT (`SoT/.claude/`), env vars, hooks, plugins, RTK, status line, session management, permission mode, open concerns.
 - Codex uses this `AGENTS.md` file plus the Codex SoT under `SoT/.codex/`; no separate root `CODEX.md` is needed.
 
+
+docks-kit runtime, standalone binary, and Session Relay prebuilt support is
+exactly Linux x64/arm64 and macOS x64/arm64. Unsupported hosts fail before the
+launcher can fall back to Bun source.
+
 ## Repository layout (cross-cutting)
 
 | Path | Purpose |
 |------|---------|
-| `docks-kit` | CLI launcher: runs the platform binary in `cli/dist/` only when its `--version` matches `package.json`, otherwise Bun-from-source (auto-installs Bun + `node_modules`). No-Bun recovery is the standalone platform release binary |
+| `docks-kit` | CLI launcher: on supported hosts, runs the platform binary in `cli/dist/` only when its `--version` matches `package.json`, otherwise Bun-from-source (auto-installs Bun + `node_modules`). Unsupported hosts fail before source fallback. No-Bun recovery is the standalone platform release binary |
 | `cli/src/engine-native/` | EngineNative implementation for `sync`, `model`, `workflow`, and `toolchain`; idempotent, flag-gated for destructive reconciliation |
 | `cli/` | Effect-TS CLI + bundled docs topics |
 | `SoT/models.json` | Kit-verified model catalog plus the strict Docks workflow-role registry |
 | `SoT/toolchain.json` | Toolchain floors manifest (verified pins consumed by EngineNative) |
 | `SoT/.claude/bin/` | Dependency-free Bun runtime programs for Claude's statusline, SessionStart, and Notification |
 | `install.sh` | Global installer |
-| `.github/workflows/release-cli.yml` | `cli-v*` release binaries + npm publish |
+| `.github/workflows/release-cli.yml` | `cli-v*` release: four Linux/macOS x64/arm64 binaries, `SHA256SUMS`, and npm publish |
 | `README.md` | Front door |
 | `package.json` / `bun.lock` | npm package: `bin` = `cli/src/main.ts`; bundles `cli/` with the generated in-memory SoT payload |
 | `SoT/.agents/skills.txt` | Universal-skill manifest, intentionally empty by default. Adding an [agentskills.io](https://agentskills.io/specification) slug opts it into EngineNative's shared `~/.agents/skills/` bootstrap and Claude symlink. |
@@ -36,7 +41,7 @@ Codex SoT notes:
 - `SoT/.codex/rules/*.rules` deploys to `~/.codex/rules/` as kit-managed Codex command policy. This is Codex's equivalent of permission allow/prompt/block rules; user-learned approvals in `~/.codex/rules/default.rules` are preserved.
 - `SoT/.codex/plugins/marketplace.json` deploys to Codex's personal marketplace path at `~/.agents/plugins/marketplace.json`; when the `codex` CLI is available, sync reruns `codex plugin add <plugin@marketplace>` for enabled SoT plugins so stale cached installs are refreshed.
 - `docks-kit status` verifies Session Relay only through the supported `codex plugin list --json` inventory. `ready` means installed and enabled for a newly started Codex session; it is not evidence about an old process, lifecycle state, receive-path health, or worker quiescence. The global prompt SoTs carry the owner's standing authorization for Docks cross-company plan review, which never overrides host or platform denial.
-- Claude and Codex sync call `sessionRelayCli.ts ensureSessionRelayCli` immediately before their plugin passes. It installs the exact source-pinned precompiled command at `~/.local/bin/session-relay` for Linux/macOS x64/arm64 only, requires committed digest = same-release `SHA256SUMS` row = downloaded bytes, smoke-tests the staged version, and atomically replaces the stable path. `agents`-only sync never enters this boundary. The committed digests remain fixture-only until the four `session-relay--v0.12.0` production assets exist; do not publish them as release evidence.
+- Claude and Codex sync call `sessionRelayCli.ts ensureSessionRelayCli` immediately before their plugin passes. It installs the exact source-pinned precompiled command at `~/.local/bin/session-relay` for Linux/macOS x64/arm64 only, requires committed digest = same-release `SHA256SUMS` row = downloaded bytes, smoke-tests the staged version, and atomically replaces the stable path. `agents`-only sync never enters this boundary. The four pinned production digests correspond to the stable `session-relay--v0.12.0` assets and its `SHA256SUMS`.
 - Both global prompt SoTs carry one byte-identical compact `Docks-workflow-models:` record. Root `--model-orchestrator` / `--model-reviewer` / `--model-implementer` / review-bound flags update only that deployed record; `docks-kit models workflow` lists the closed selectors, and a flag-less sync restores defaults.
 - Codex workflow selectors use the closed `<tool>:<model>@<effort>[+fast]` routing grammar. Fast is intentionally absent from the global SoT: no suffix means Standard and keeps the backward-compatible schema-1 record; `+fast` emits a schema-2 candidate with `service_tier: "fast"`. Docks and Session Relay consumers must explicitly launch unsuffixed Codex roles with the default service tier so a user's global Fast preference cannot leak into workflows.
 - The `codex` CLI binary is upstream-owned, not kit-owned. The official standalone installer keeps package metadata under `$CODEX_HOME/packages/standalone` and places the `codex` symlink in `~/.local/bin` by default; sync only warns with a download-then-run installer command when the CLI is missing. Existing installs can self-update with `codex update`; npm and Homebrew remain upstream alternatives.

package/README.md

@@ -2,8 +2,8 @@
 
 Portable configuration kit for AI coding agents. Per-tool **Single Source of
 Truth (SoT)** directories are deployed to each tool's user-config location —
-clone once, sync everywhere, get a consistent AI-assisted dev environment on
-every machine. Tuned for **token efficiency without sacrificing quality**.
+clone once and get a consistent AI-assisted dev environment across supported
+Linux and macOS machines. Tuned for **token efficiency without sacrificing quality**.
 
 Supported tools: **Claude Code**, **Codex**, and any agent consuming
 [agentskills.io](https://agentskills.io) universal skills.
@@ -17,10 +17,12 @@ cd ~/projects/public
 ./docks-kit status          # doctor view: drift, toolchain, plugins, skills
 ```
 
-The `./docks-kit` launcher prefers a compiled binary (`cli/dist/`) only when
-its version matches the checkout, then runs from source via Bun — auto-installing
-Bun and dependencies when missing. Stale ignored build artifacts cannot mask
-newer checkout code.
+The `./docks-kit` launcher supports Linux x64/arm64 and macOS x64/arm64.
+On those hosts it prefers a compiled binary (`cli/dist/`) only when its version
+matches the checkout, then runs from source via Bun—auto-installing Bun and
+dependencies when missing. Unsupported hosts fail immediately and never fall
+back to Bun source. Stale ignored build artifacts cannot mask newer checkout
+code.
 
 Other install paths (global `bun add -g docks-kit`, curl installer) —
 see `./docks-kit docs install`.
@@ -32,7 +34,7 @@ The executable carries the generated sync payload; no checkout or adjacent
 `SoT/` directory is required.
 
 Prerequisites for source/global installs: Bun; Node/npm for npm-global tools.
-`jq` is optional doctor/test tooling. `curl` is used only at requested POSIX
+`jq` is optional doctor/test tooling. `curl` is used only at requested Linux/macOS
 RTK/Bun download boundaries, not as a global sync prerequisite.
 
 ## CLI
@@ -107,7 +109,8 @@ current valid values, while a later flag-less sync restores all defaults.
   Session Relay plugin reconciliation. Linux/macOS x64/arm64 assets must match
   both the committed digest and their release `SHA256SUMS`, then pass an exact
   staged version smoke before atomic replacement; failures preserve any prior
-  command. Production digests for `session-relay--v0.12.0` are still pending.
+  command. The four production digests are pinned for the stable
+  `session-relay--v0.12.0` assets and match the same-release `SHA256SUMS`.
 - **Model catalog** — `SoT/models.json` is the research-verified source for
   model validation, listings, pickers, and the Docks workflow-role registry.
 - **Claude runtime** — sync materializes three dependency-free Bun `.mjs`
@@ -135,19 +138,21 @@ current valid values, while a later flag-less sync restores all defaults.
 
 ## Platform support
 
-| Platform | CLI | Sync engine |
-|----------|-----|-------------|
-| Linux | ✅ native | ✅ native |
-| macOS (x64/arm64) | ✅ native | ✅ native |
-| Windows | ✅ native binary (`.exe` and `bun add -g` CI-verified) | ✅ EngineNative (TS, default engine — no Git Bash); real-machine verified 2026-07-09 — RTK hooks are native too (rtk ≥0.37.2) |
+| Platform | Architecture | docks-kit binary | Session Relay prebuilt | Sync engine |
+|----------|--------------|------------------|------------------------|-------------|
+| Linux | x64 | ✅ | ✅ | ✅ native |
+| Linux | arm64 | ✅ | ✅ | ✅ native |
+| macOS | x64 | ✅ | ✅ | ✅ native |
+| macOS | arm64 | ✅ | ✅ | ✅ native |
 
 Details: `docks-kit docs platforms`.
 
 ## Releases
 
-Tagging `cli-v*` builds five standalone binaries (+ SHA256SUMS) and attaches
-them to the GitHub release; npm publish runs when the `NPM_TOKEN` secret is
-configured. Package bundles the CLI + generated payload, so npm releases are
+Tagging `cli-v*` builds four standalone binaries (Linux x64/arm64 and macOS
+x64/arm64) plus `SHA256SUMS` and attaches them to the GitHub release; npm
+publish runs when the `NPM_TOKEN` secret is configured.
+Package bundles the CLI + generated payload, so npm releases are
 versioned config snapshots without shipping the authoring `SoT/` tree.
 
 ## Deeper docs

package/cli/docs/install.md

@@ -1,5 +1,8 @@
 # Installing docks-kit
 
+Supported hosts are Linux x64/arm64 and macOS x64/arm64. Unsupported hosts
+fail before the launcher can fall back to Bun source.
+
 ## 1. Repo checkout (development / current users)
 
 ```
@@ -8,10 +11,11 @@ cd ~/projects/public
 ./docks-kit sync
 ```
 
-The `./docks-kit` launcher prefers a compiled binary in `cli/dist/` only when
-its reported version matches `package.json`, then falls back to Bun-from-source
-(auto-installing Bun via download-then-run and `bun install --frozen-lockfile`
-when needed). An ignored stale build is reported and bypassed.
+On a supported host, the `./docks-kit` launcher prefers a compiled binary in
+`cli/dist/` only when its reported version matches `package.json`, then falls
+back to Bun-from-source (auto-installing Bun via download-then-run and
+`bun install --frozen-lockfile` when needed). An ignored stale build is reported
+and bypassed.
 
 ## 2. Global via Bun (effect-solutions-style)
 
@@ -51,7 +55,7 @@ install; `docks-kit --version`, model catalogs, toolchain checks, and real sync
 remain functional with the script blocked. CI pins the one-package/one-command
 identity above and will fail if the script-bearing set changes.
 
-## 3. curl installer (Unix-only)
+## 3. curl installer (Linux/macOS)
 
 ```
 curl -fsSL https://raw.githubusercontent.com/DocksDocks/public/main/install.sh -o /tmp/docks-kit-install.sh
@@ -61,20 +65,7 @@ bash /tmp/docks-kit-install.sh && rm /tmp/docks-kit-install.sh
 Download-then-run, never `curl | bash` — stream truncation has bitten this
 kit before. The installer bootstraps Bun when absent, runs
 `bun add -g docks-kit`, and links the binary into `~/.local/bin`.
-**Linux/macOS only** — on Windows use the compiled `.exe` or `bun add -g`
-(both CI-verified; see below).
-
-## Windows entrypoints
-
-Two supported paths (CI-verified on windows-2025, native PowerShell):
-
-- **Compiled binary** — `docks-kit-windows-x64.exe` release asset. No Bun,
-  no Git Bash: the exe embeds the runtime and generated payload, and
-  EngineNative runs in-process from any working directory.
-- **`bun add -g docks-kit`** — bun creates a working shim for the
-  `#!/usr/bin/env bun` bin; the package carries the same generated payload.
-
-`install.sh` is not a Windows path.
+This installer supports Linux and macOS only.
 
 ## Keeping the kit up to date
 
@@ -105,6 +96,6 @@ sync/config reads.
 - Bun for source/global installs; release binaries embed the runtime
 - Node/npm for npm-global tools (agent-browser, LSP servers)
 - jq is optional doctor/test tooling; sync has no jq runtime dependency
-- curl is required only when a requested POSIX RTK/Bun bootstrap must download
+- curl is required only when a requested Linux/macOS RTK/Bun bootstrap must download
   an installer; an already-present Bun does not require it
 - See `docks-kit toolchain check` for the full picture on this machine

package/cli/docs/platforms.md

@@ -1,46 +1,18 @@
 # Platform support
 
-| Platform | CLI (docks-kit) | Sync engine | Notes |
-|----------|-----------------|-------------|-------|
-| Linux | native | EngineNative (TS) | Primary target |
-| macOS | native (x64 + arm64) | EngineNative (TS) | Release binary or Bun source path |
-| Windows | native (`.exe` / `bun add -g`, CI-verified) | EngineNative (TS) — no Git Bash | Real-machine verified 2026-07-09 |
-
-EngineNative is the only supported engine on all platforms. `DOCKS_KIT_ENGINE=bash`
-now exits with the removed-engine message and points at the `bash-engine-final`
-tag for historical recovery.
-
-## Windows detail
-
-Supported entrypoints (both verified in CI on windows-2025 under native
-PowerShell — see `.github/workflows/windows-entrypoints.yml`):
-
-- **`docks-kit-windows-x64.exe`** (release asset) — the no-toolchain path.
-  No Bun, no Git Bash; the exe embeds the runtime and generated payload, and
-  EngineNative runs in-process from any working directory.
-- **`bun add -g docks-kit`** — bun creates a working Windows shim for the
-  `#!/usr/bin/env bun` bin; the package carries the same generated payload.
-- `install.sh` is **Unix-only** and not a Windows path.
-
-The managed tools all run natively on Windows: Claude Code (requires Git
-Bash for its own Bash tool — that requirement is Claude Code's, not this
-kit's), Codex CLI (native PowerShell + Windows sandbox), RTK (native
-binaries; since rtk 0.37.2 the PreToolUse hook is a native binary command —
-`rtk hook claude`, no shell or jq. Only the kit's *auto-installer* is
-Unix-only: install rtk natively, then sync).
-
-CI coverage (all on the pinned windows-2025 label): EngineNative PowerShell
-smoke with `HOME` unset — `%USERPROFILE%` path resolution, `.cmd` tool
-spawning (npm), toolchain gate branches (`.github/workflows/parity.yml`,
-`native-windows` job); the two entrypoints above (`windows-entrypoints.yml`).
-Deployed SessionStart/Notification hooks directly exec an absolute real
-`bun.exe`. Claude still shell-evaluates the statusline, so its stored command is
-an encoded PowerShell missing-file guard that behaves identically when the outer
-shell is native PowerShell or Git Bash. CI executes both outer-shell paths and
-pins output bytes/channels plus latency ceilings.
-
-**Status: supported** — real-machine verified 2026-07-09 (Claude Code loads
-the synced `%USERPROFILE%\.claude`; full sync, self-update, plugin passes,
-universal skills, and agent-browser all green on native PowerShell). Needs
-git on PATH for plugin marketplaces; rtk installs natively via its Windows
-release (the kit's auto-install is Unix-only).
+The supported host matrix is exact:
+
+| Platform | Architecture | docks-kit binary | Session Relay prebuilt | Sync engine |
+|----------|--------------|------------------|------------------------|-------------|
+| Linux | x64 | `docks-kit-linux-x64` | `x86_64-unknown-linux-musl` | EngineNative (TS) |
+| Linux | arm64 | `docks-kit-linux-arm64` | `aarch64-unknown-linux-musl` | EngineNative (TS) |
+| macOS | x64 | `docks-kit-darwin-x64` | `x86_64-apple-darwin` | EngineNative (TS) |
+| macOS | arm64 | `docks-kit-darwin-arm64` | `aarch64-apple-darwin` | EngineNative (TS) |
+
+Windows and every other host are unsupported. The launcher fails before any
+Bun-from-source fallback, and Session Relay installation reports the unsupported
+host without downloading an asset.
+
+EngineNative is the only supported engine on supported hosts.
+`DOCKS_KIT_ENGINE=bash` exits with the removed-engine message and points at the
+`bash-engine-final` tag for historical recovery.

package/cli/docs/toolchain.md

@@ -33,7 +33,7 @@ now kit-approved" act.
 - **bun** — policy `present`: bootstrap only (pinned to `verified` via the
   installer's version argument), never auto-upgraded. `bun.ts` owns one
   per-engine-run memo shared by Claude runtime, effect-solutions, and direct
-  toolchain ensure. Windows resolves only a real absolute `bun.exe` for hooks.
+  toolchain ensure on supported Linux/macOS hosts.
 - **effect-solutions**, **agent-browser** — policy `track`: self-upgrade
   toward npm latest, gated by their `verified` pins.
 - **session-relay** — policy `exact`: Claude/Codex sync and
@@ -44,13 +44,13 @@ now kit-approved" act.
   source pin = selected row = downloaded bytes, chmods/smoke-tests only the
   sibling stage, then renames it over `~/.local/bin/session-relay`. Offline,
   unsupported-host, checksum, chmod, version, download, or rename failures
-  preserve an existing command byte-for-byte. The four committed digests are
-  validation fixtures pending independently hashed production assets; this
-  pin must not ship until they are replaced and reviewed.
+  preserve an existing command byte-for-byte. The four pinned production
+  digests correspond to the stable `session-relay--v0.12.0` assets and match
+  its `SHA256SUMS`.
 
 jq and curl are `check` rows, not global prerequisites. jq is not consumed by
-normal sync. curl is checked only at a requested POSIX RTK/Bun installer
-download boundary; Windows Bun bootstrap uses PowerShell's native download.
+normal sync. curl is checked only at a requested Linux/macOS RTK/Bun installer
+download boundary.
 
 ## Supply-chain stance
 

package/cli/src/commands/docs.ts

@@ -20,7 +20,7 @@ const TOPICS: Record<string, { summary: string; body: string }> = {
   "toolchain": { summary: "Verified-version floors, gate policy, --yes semantics", body: toolchain },
   "plugins": { summary: "enabledPlugins tri-state + optional plugin opt-ins", body: plugins },
   "install": { summary: "Install paths: repo checkout, bun add -g, curl installer", body: install },
-  "platforms": { summary: "Platform support: Linux/macOS native, Windows via Git Bash/WSL", body: platforms }
+  "platforms": { summary: "Platform support: Linux/macOS x64 and arm64", body: platforms }
 }
 
 const topic = Args.text({ name: "topic" }).pipe(

package/cli/src/commands/toolchain.ts

@@ -2,7 +2,7 @@ import { Args, Command, Options } from "@effect/cli"
 import { Effect, Option } from "effect"
 import { bail, engine } from "../engine"
 
-const MANAGED = ["rtk", "bun", "effect-solutions", "agent-browser"]
+const MANAGED = ["rtk", "bun", "effect-solutions", "agent-browser", "session-relay"]
 
 const op = Args.text({ name: "op" }).pipe(
   Args.withDescription("check (default) | ensure <tool>"),

package/cli/src/engine-native/DESIGN.md

@@ -96,12 +96,10 @@ hooks/env changed → restart line; skills changed → discovery line) or under
 
 ### Platform seam
 
-All platform branching routes through `os.ts` — the only engine module that
-reads `process.platform`, with one named exemption: `exec.ts`'s path/exec
-primitives (`commandExists` PATHEXT resolution and `X_OK` probing) stay
-self-contained because they sit below the seam. `deps.ts` install hints
-default their platform from `os.ts` and keep the parameter injectable for
-tests.
+All host detection routes through `os.ts`, the engine module that reads
+`process.platform`. `exec.ts` contains only POSIX executable and PATH probes.
+`deps.ts` install hints default their platform from `os.ts` and keep the
+parameter injectable for tests.
 
 ### Verbosity plumbing
 
@@ -122,7 +120,7 @@ active logger binding.
 | `../payload.ts` | generated text/byte payload reads and presentation-only source labels |
 | `claudeSync.ts` | Claude pipeline: RTK, prepared settings transaction, runtime assets, deploy-time modifiers, `~/.claude.json`, readiness-gated removed artifacts, plugins, optional plugins, LSP binaries |
 | `bun.ts` | per-run memoized Bun resolution/bootstrap shared by Claude runtime, effect-solutions, and direct toolchain ensure |
-| `claudeRuntime.ts` | sentinel validation, absolute runtime paths, no-cutover settings projection, and POSIX/encoded-PowerShell statusline commands |
+| `claudeRuntime.ts` | sentinel validation, absolute runtime paths, no-cutover settings projection, and POSIX statusline commands |
 | `settings.ts` | pure Claude settings merge/reconcile semantics and permission-array union |
 | `claudeModel.ts` | deployed Claude model modifier and direct `model claude` write path |
 | `codexSync.ts` | Codex pipeline: bubblewrap check, config merge, rules, AGENTS.md, personal marketplace, plugin refresh |
@@ -132,24 +130,20 @@ active logger binding.
 | `modes.ts` | direct `model` and `toolchain` modes |
 | `models.ts` | model catalog listing and validation |
 | `jq.ts` | JSON helpers that preserve jq-style merge/order/stringify behavior where the deployed file contract needs it |
-| `exec.ts` | path helpers, command probes, capture/spawn wrappers, Windows command resolution, change-detecting write/copy helpers |
+| `exec.ts` | slash-stable path helpers, POSIX command probes, capture/spawn wrappers, and change-detecting write/copy helpers |
 | `logger.ts` | Logger shape + stable raw stdout/stderr sink factory; the run-scoped verbosity gate lives in `index.ts` |
-| `deps.ts` | external-tool registry: identity, requirement class, presence probe, platform-correct install hints, per-manager missing-tool dedup; callers supply the current run Logger to `warnMissing` |
-| `os.ts` | platform capability seam — the single `process.platform` reader (`platformName`, `isWindows`, `isLinux`, shell-rc applicability) |
+| `deps.ts` | external-tool registry: identity, requirement class, presence probe, supported-host install hints, per-manager missing-tool dedup; callers supply the current run Logger to `warnMissing` |
+| `os.ts` | platform capability seam — the single `process.platform` reader (`platformName`, `isLinux`, shell-rc applicability) |
 | `services.ts` | shared raw-Logger + DependencyManager + Platform factory; wrapped in Effect Layers at `cli/src/services.ts`, with the run-scoped Logger gate applied only by `runEngineNative` |
 
-## Windows Specifics
+## Platform Support
 
-- Home resolves through Node's platform APIs; CI deliberately unsets `HOME` so
-  `%USERPROFILE%` is exercised.
-- Paths are built through `node:path`.
-- Connector env uses `setx` on win32; Unix shell rc files are not touched.
-- Symlink creation falls back to copy where the platform or permissions require
-  it.
-- Bubblewrap and shell-rc work are Linux/macOS only.
-- Claude command hooks directly exec the resolved absolute `bun.exe`; the
-  statusline stores an encoded PowerShell missing-file guard because Claude
-  shell-evaluates `statusLine.command` through PowerShell or Git Bash.
+- EngineNative supports Linux and macOS on x64 and arm64.
+- Unsupported hosts fail before launcher fallback, dependency probes, downloads,
+  settings writes, or sync work.
+- Runtime hooks use POSIX commands and absolute Bun paths.
+- Symlink creation remains capability-driven: permission or filesystem failures
+  fall back to copy without predicting the host.
 
 ## Tests
 
@@ -158,12 +152,10 @@ active logger binding.
   `cli/test/goldens/dryrun.json`.
 - `bun run golden:mutation` compares live native mutation snapshots, argv logs,
   output, and TOML invariants to `cli/test/goldens/mutation.json`.
-- `.github/workflows/parity.yml` is now the golden-regression workflow: Linux
-  runs unit + golden + prove-red plus the exact materialized POSIX runtime
-  commands; the `native-windows` job executes the same stored statusline command
-  through PowerShell and Git Bash plus direct Bun hooks.
-- `.github/workflows/windows-entrypoints.yml` verifies the release binary and
-  `bun add -g` entrypoints on Windows.
+- `.github/workflows/parity.yml` is the golden-regression workflow: Linux runs
+  unit + golden + prove-red plus the exact materialized POSIX runtime commands.
+- `.github/workflows/release-cli.yml` publishes the four Linux/macOS x64/arm64
+  binaries, `SHA256SUMS`, and the npm package.
 
 ## Non-Goals
 

package/cli/src/engine-native/bun.ts

@@ -4,7 +4,6 @@ import { tmpdir } from "node:os"
 
 import { p } from "./exec"
 import type { Ctx } from "./index"
-import { encodePowerShellCommand, powerShellLiteral } from "./powershell"
 import type { EngineServices } from "./services"
 import { field } from "./toolchain"
 
@@ -17,31 +16,14 @@ function remember(ctx: Ctx, state: BunRuntimeState): BunRuntimeState {
   return state
 }
 
-function predictedExecutable(ctx: Ctx, services: EngineServices): string {
+function predictedExecutable(ctx: Ctx): string {
   const root = process.env["BUN_INSTALL"] !== undefined && process.env["BUN_INSTALL"] !== ""
     ? process.env["BUN_INSTALL"]!
     : p(ctx.home, ".bun")
-  return p(root, "bin", services.platform.isWindows() ? "bun.exe" : "bun")
+  return p(root, "bin", "bun")
 }
 
-function windowsDownloadScript(installer: string): string {
-  return `$ErrorActionPreference = 'Stop'; Invoke-WebRequest -Uri ${powerShellLiteral("https://bun.sh/install.ps1")} -OutFile ${powerShellLiteral(installer)}`
-}
-
-function installBun(ctx: Ctx, services: EngineServices, pin: string, installer: string): void {
-  if (services.platform.isWindows()) {
-    const encoded = encodePowerShellCommand(windowsDownloadScript(installer))
-    const download = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", encoded], { stdio: "ignore" })
-    if (download.error === undefined && download.status === 0) {
-      spawnSync(
-        "powershell.exe",
-        ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", installer, "-Version", pin, "-DownloadWithoutCurl"],
-        { stdio: "ignore" }
-      )
-    }
-    return
-  }
-
+function installBun(pin: string, installer: string): void {
   const download = spawnSync("curl", ["-fsSL", "https://bun.sh/install", "-o", installer], { stdio: "ignore" })
   if (download.error === undefined && download.status === 0) {
     spawnSync("bash", [installer, `bun-v${pin}`], { stdio: "ignore" })
@@ -59,19 +41,19 @@ export function bunBootstrap(ctx: Ctx, services: EngineServices): BunRuntimeStat
     services.logger.warn("Bun bootstrap aborted — SoT/toolchain.json has no verified Bun pin")
     return remember(ctx, { kind: "deferred", reason: "install-failed" })
   }
-  if (!services.platform.isWindows() && services.deps.probe("curl").state === "missing") {
+  if (services.deps.probe("curl").state === "missing") {
     services.deps.warnMissing("curl", services.logger, "cannot bootstrap Bun; install Bun manually, then re-run sync")
     return remember(ctx, { kind: "deferred", reason: "missing-curl" })
   }
   if (ctx.dryRun) {
-    const executable = predictedExecutable(ctx, services)
+    const executable = predictedExecutable(ctx)
     services.logger.echo(`[dry-run] install Bun ${pin} (kit-verified) -> ${executable}`)
     return remember(ctx, { kind: "ready", executable })
   }
   services.logger.warn(`Bun not found — installing Bun ${pin} (kit-verified)...`)
-  const installer = p(tmpdir(), `bun-install-${process.pid}.${services.platform.isWindows() ? "ps1" : "sh"}`)
+  const installer = p(tmpdir(), `bun-install-${process.pid}.sh`)
   try {
-    installBun(ctx, services, pin, installer)
+    installBun(pin, installer)
   } finally {
     rmSync(installer, { force: true })
   }

package/cli/src/engine-native/claudeRuntime.ts

@@ -1,7 +1,5 @@
 import { p } from "./exec"
 import { isObject, parseJson, type Json } from "./jq"
-import { encodePowerShellCommand, powerShellLiteral } from "./powershell"
-import type { Platform } from "./services"
 
 const BUN_SENTINEL = "__DOCKS_KIT_BUN__"
 const SESSION_START_SENTINEL = "__DOCKS_KIT_SESSION_START__"
@@ -89,22 +87,15 @@ function posixLiteral(value: string): string {
   return `'${value.replaceAll("'", `'"'"'`)}'`
 }
 
-export function statusLineCommand(runtime: ClaudeRuntimePaths, platform: Platform): string {
-  if (!platform.isWindows()) {
-    const bun = posixLiteral(runtime.bun)
-    const script = posixLiteral(runtime.statusline)
-    return `test -x ${bun} && test -f ${script} && exec ${bun} ${script} || true`
-  }
-  const bun = powerShellLiteral(runtime.bun.replaceAll("\\", "/"))
-  const script = powerShellLiteral(runtime.statusline.replaceAll("\\", "/"))
-  const guard = `$ProgressPreference = 'SilentlyContinue'; if ((Test-Path -LiteralPath ${bun} -PathType Leaf) -and (Test-Path -LiteralPath ${script} -PathType Leaf)) { & ${bun} ${script} }`
-  return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${encodePowerShellCommand(guard)}`
+export function statusLineCommand(runtime: ClaudeRuntimePaths): string {
+  const bun = posixLiteral(runtime.bun)
+  const script = posixLiteral(runtime.statusline)
+  return `test -x ${bun} && test -f ${script} && exec ${bun} ${script} || true`
 }
 
 export function materializeClaudeSettings(
   template: Json,
-  runtime: ClaudeRuntimePaths | undefined,
-  platform: Platform
+  runtime: ClaudeRuntimePaths | undefined
 ): Json {
   validateTemplate(template)
   const result = cloneJson(template)
@@ -122,7 +113,7 @@ export function materializeClaudeSettings(
     notification["command"] = runtime.bun
     notification["args"] = [runtime.notify]
     if (!isObject(result) || !isObject(result["statusLine"])) throw new Error("Claude statusLine object is missing")
-    result["statusLine"]["command"] = statusLineCommand(runtime, platform)
+    result["statusLine"]["command"] = statusLineCommand(runtime)
   }
 
   for (const sentinel of [BUN_SENTINEL, SESSION_START_SENTINEL, NOTIFY_SENTINEL, STATUSLINE_SENTINEL]) {

package/cli/src/engine-native/claudeSync.ts

@@ -62,8 +62,7 @@ export function claudeSync(ctx: Ctx): ClaudeRuntimeState {
   }
   const materialized = materializeClaudeSettings(
     template,
-    runtime.kind === "ready" ? runtime.paths : undefined,
-    ctx.services.platform
+    runtime.kind === "ready" ? runtime.paths : undefined
   )
   const prepared = ctx.dryRun ? undefined : prepareClaudeSettings(ctx, claudeDir, materialized)
 
@@ -150,12 +149,7 @@ function syncRtk(ctx: Ctx, claudeDir: string): void {
     return
   }
 
-  if (ctx.services.platform.isWindows()) {
-    if (ctx.services.deps.probe("rtk").state === "missing") {
-      warn("rtk not installed — the kit's auto-install is Unix-only. Install natively (winget, or the rtk-*-windows-msvc.zip release), then re-run sync")
-      return
-    }
-  } else if (ensureRtk(ctx, "cannot download RTK installer; continuing sync without RTK", 0) !== 0) {
+  if (ensureRtk(ctx, "cannot download RTK installer; continuing sync without RTK", 0) !== 0) {
     warn("RTK bootstrap failed — continuing sync without it")
   }
 
@@ -412,32 +406,7 @@ function syncClaudeJson(ctx: Ctx): void {
 // -------------------------------------------------------- connector env ----
 
 function syncConnectorEnv(ctx: Ctx): void {
-  const { change, echo, verbose, warn } = ctx.services.logger
-  // win32: Claude Code launches from PowerShell/GUI, so the flag must be a
-  // real user env var (setx), not a Git-Bash-only shell-rc export. Never
-  // clobbers an existing value (set =true yourself to keep connectors).
-  if (ctx.services.platform.isWindows()) {
-    const existing = spawnSync("reg", ["query", "HKCU\\Environment", "/v", "ENABLE_CLAUDEAI_MCP_SERVERS"], {
-      stdio: "ignore"
-    })
-    if (existing.error === undefined && existing.status === 0) {
-      if (ctx.dryRun) echo("[dry-run] ENABLE_CLAUDEAI_MCP_SERVERS already in user environment — would skip")
-      else verbose("claude.ai connectors: ENABLE_CLAUDEAI_MCP_SERVERS already set in user environment (left as-is)")
-      return
-    }
-    if (ctx.dryRun) {
-      echo("[dry-run] setx ENABLE_CLAUDEAI_MCP_SERVERS false (user environment)")
-      return
-    }
-    const res = spawnSync("setx", ["ENABLE_CLAUDEAI_MCP_SERVERS", "false"], { stdio: "ignore" })
-    if (res.error === undefined && res.status === 0) {
-      change("claude.ai connectors disabled via setx (open a new terminal to apply)")
-      ctx.nextStepTriggers.claudeRestart = true
-    } else {
-      warn("setx ENABLE_CLAUDEAI_MCP_SERVERS false failed — set it manually in System Properties > Environment Variables")
-    }
-    return
-  }
+  const { change, echo, verbose } = ctx.services.logger
 
   const line = "export ENABLE_CLAUDEAI_MCP_SERVERS=false"
   const marker = "# docks-kit: disable claude.ai cloud MCP connectors (set =true to keep them)"

package/cli/src/engine-native/codexSync.ts

@@ -86,7 +86,7 @@ function bwrapSupportedOs(ctx: Ctx): boolean {
   const { warn } = ctx.services.logger
   const pn = ctx.services.platform.name()
   if (pn === "linux") return true
-  if (pn === "darwin" || pn === "windows") return false
+  if (pn === "darwin") return false
   warn("Unknown OS — skipping bubblewrap check; Codex sandbox may not work")
   return false
 }

package/cli/src/engine-native/deps.ts

@@ -112,34 +112,29 @@ const home = (): string => {
   return envHome !== undefined && envHome !== "" ? envHome : homedir()
 }
 
-const absoluteWindowsExe = (path: string): boolean =>
-  /\.exe$/i.test(path) && (/^[A-Za-z]:[\\/]/.test(path) || /^\\\\/.test(path))
 
 // The resolved path gets persisted into global direct-exec hooks, so a
 // relative `which` hit (relative PATH entry, relative BUN_INSTALL) would
 // break outside the sync working directory.
-const absoluteExecutable = (path: string, platform: NodeJS.Platform): boolean =>
-  platform === "win32" ? absoluteWindowsExe(path) : isAbsolute(path)
 
-const findBun = (exec: ProbeExecutor, platform: NodeJS.Platform = rawPlatform()): { command: string; path: string } | undefined => {
+const findBun = (exec: ProbeExecutor): { command: string; path: string } | undefined => {
   const onPath = exec.which("bun")
-  if (onPath !== "" && absoluteExecutable(onPath, platform)) {
-    return { command: platform === "win32" ? onPath : "bun", path: onPath }
+  if (onPath !== "" && isAbsolute(onPath)) {
+    return { command: "bun", path: onPath }
   }
   const root =
     process.env["BUN_INSTALL"] !== undefined && process.env["BUN_INSTALL"] !== ""
       ? process.env["BUN_INSTALL"]!
       : p(home(), ".bun")
-  const name = platform === "win32" ? "bun.exe" : "bun"
-  for (const candidate of [p(root, "bin", name), p(home(), ".bun", "bin", name)]) {
+  for (const candidate of [p(root, "bin", "bun"), p(home(), ".bun", "bin", "bun")]) {
     const found = exec.which(candidate)
-    if (found !== "" && absoluteExecutable(found, platform)) return { command: found, path: found }
+    if (found !== "" && isAbsolute(found)) return { command: found, path: found }
   }
   return undefined
 }
 
-const resolveBun = (exec: ProbeExecutor, platform: NodeJS.Platform): ProbeResult => {
-  const bun = findBun(exec, platform)
+const resolveBun = (exec: ProbeExecutor): ProbeResult => {
+  const bun = findBun(exec)
   return bun === undefined
     ? { state: "missing" }
     : { state: "present", path: bun.path }
@@ -161,28 +156,23 @@ const versionEffectSolutions = (exec: ProbeExecutor): string => {
   return match?.[1] ?? ""
 }
 
-const locateEffectSolutions = (exec: ProbeExecutor, platform: NodeJS.Platform): DependencyLocation => {
-  const strictBun = findBun(exec, platform)
+const locateEffectSolutions = (exec: ProbeExecutor): DependencyLocation => {
+  const strictBun = findBun(exec)
   const pathBun = exec.which("bun")
   const bun = strictBun ?? (pathBun !== "" ? { command: "bun", path: pathBun } : undefined)
   if (bun === undefined) return { path: "", binDir: "" }
   const globalBin = exec.capture(bun.command, ["pm", "-g", "bin"])
-  const names =
-    platform === "win32"
-      ? ["effect-solutions.exe", "effect-solutions.cmd", "effect-solutions.bunx"]
-      : ["effect-solutions"]
-  const path = names.map((name) => p(globalBin, name)).find((candidate) => globalBin !== "" && exec.which(candidate) !== "")
-  return { path: path ?? "", binDir: globalBin }
+  const path = globalBin !== "" ? p(globalBin, "effect-solutions") : ""
+  const resolved = path !== "" && exec.which(path) !== "" ? path : ""
+  return { path: resolved, binDir: globalBin }
 }
 
 const resolveChrome = (exec: ProbeExecutor, platform: NodeJS.Platform): ProbeResult => {
   const root = p(home(), ".agent-browser", "browsers")
   const relative =
-    platform === "win32"
-      ? "chrome.exe"
-      : platform === "darwin"
-        ? "Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing"
-        : "chrome"
+    platform === "darwin"
+      ? "Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing"
+      : "chrome"
   if (existsSync(root)) {
     for (const directory of readdirSync(root).filter((name) => name.startsWith("chrome-")).sort().reverse()) {
       const path = exec.which(p(root, directory, relative))
@@ -215,23 +205,19 @@ export const DEPENDENCIES: Record<ToolId, DependencySpec> = {
     "git",
     "optional",
     (pf = rawPlatform()) =>
-      pf === "win32"
-        ? "winget install Git.Git (then open a new terminal)"
-        : pf === "darwin"
-          ? "brew install git"
-          : "sudo apt install -y git (or your distro's package manager)",
+      pf === "darwin"
+        ? "brew install git"
+        : "sudo apt install -y git (or your distro's package manager)",
     { version: versionProbe("git") }
   ),
   jq: spec("jq", "optional", (pf = rawPlatform()) =>
-    pf === "win32"
-      ? "winget install jqlang.jq (then open a new terminal)"
-      : pf === "darwin"
-        ? "brew install jq"
-        : "sudo apt install -y jq",
+    pf === "darwin"
+      ? "brew install jq"
+      : "sudo apt install -y jq",
     { version: versionProbe("jq") }
   ),
   curl: spec("curl", "optional", (pf = rawPlatform()) =>
-    pf === "win32" ? "winget install cURL.cURL" : pf === "darwin" ? "brew install curl" : "sudo apt install -y curl",
+    pf === "darwin" ? "brew install curl" : "sudo apt install -y curl",
     { version: versionProbe("curl") }
   ),
   node: spec("node", "optional", () => "install Node.js via https://nodejs.org (or your package manager)", {
@@ -242,22 +228,16 @@ export const DEPENDENCIES: Record<ToolId, DependencySpec> = {
   claude: spec(
     "claude",
     "optional",
-    (pf = rawPlatform()) =>
-      pf === "win32"
-        ? "winget install Anthropic.ClaudeCode"
-        : "curl -fsSL https://claude.ai/install.sh -o /tmp/claude-install.sh && bash /tmp/claude-install.sh",
+    () => "curl -fsSL https://claude.ai/install.sh -o /tmp/claude-install.sh && bash /tmp/claude-install.sh",
     { version: versionProbe("claude") }
   ),
   codex: spec(
     "codex",
     "optional",
-    (pf = rawPlatform()) =>
-      pf === "win32"
-        ? `powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"`
-        : 'tmp=$(mktemp) && curl -fsSL https://chatgpt.com/codex/install.sh -o "$tmp" && CODEX_NON_INTERACTIVE=1 sh "$tmp"',
+    () => 'tmp=$(mktemp) && curl -fsSL https://chatgpt.com/codex/install.sh -o "$tmp" && CODEX_NON_INTERACTIVE=1 sh "$tmp"',
     { version: versionProbe("codex") }
   ),
-  rtk: spec("rtk", "optional", () => "see https://github.com/rtk-ai/rtk (kit auto-install is Unix-only)", {
+  rtk: spec("rtk", "optional", () => "see https://github.com/rtk-ai/rtk (kit auto-install is Linux/macOS-only)", {
     version: versionProbe("rtk"),
     latest: latestRtk
   }),
@@ -269,12 +249,11 @@ export const DEPENDENCIES: Record<ToolId, DependencySpec> = {
   bun: spec(
     "bun",
     "optional",
-    (pf = rawPlatform()) =>
-      pf === "win32" ? `powershell -c "irm bun.sh/install.ps1 | iex"` : "curl -fsSL https://bun.sh/install | bash",
+    () => "curl -fsSL https://bun.sh/install | bash",
     {
       resolve: resolveBun,
       version: (exec) => exec.capture(versionBunCommand(exec), ["--version"]),
-      locate: (exec, platform) => ({ path: findBun(exec, platform)?.path ?? "", binDir: "" })
+      locate: (exec) => ({ path: findBun(exec)?.path ?? "", binDir: "" })
     }
   ),
   bwrap: spec("bwrap", "optional", () => "sudo apt install -y bubblewrap (or dnf/pacman/zypper equivalent)"),
@@ -298,7 +277,7 @@ export const DEPENDENCIES: Record<ToolId, DependencySpec> = {
     "ffplay",
     "optional",
     (pf = rawPlatform()) =>
-      pf === "win32" ? "winget install Gyan.FFmpeg" : pf === "darwin" ? "brew install ffmpeg" : "sudo apt install -y ffmpeg",
+      pf === "darwin" ? "brew install ffmpeg" : "sudo apt install -y ffmpeg",
     { versionArgs: ["-version"], resolve: pathProbe("ffplay") }
   ),
   intelephense: spec("intelephense", "optional", () => "npm install -g intelephense", {

package/cli/src/engine-native/exec.ts

@@ -7,11 +7,7 @@ import { spawnSync } from "node:child_process"
 import { accessSync, chmodSync, constants, existsSync, readFileSync, statSync, writeFileSync } from "node:fs"
 import { delimiter, isAbsolute, join } from "node:path"
 
-/**
- * Engine paths are built with "/" because they appear verbatim in output
- * (dry-run lines, warns), where node:path.join would print "\" on Windows
- * and break the golden contract. fs accepts "/" on every platform.
- */
+/** Keep engine paths slash-separated so rendered output is host-stable. */
 export function p(...parts: Array<string>): string {
   return parts.join("/")
 }
@@ -22,18 +18,15 @@ export function capture(cmd: string, args: ReadonlyArray<string>): string {
   return (res.stdout ?? "").replace(/[\r\n]+$/, "")
 }
 
-/** `command -v` — resolve a name on PATH (PATHEXT-aware on Windows). */
+/** `command -v` — resolve an executable name on PATH. */
 export function which(name: string): string {
-  if (isAbsolute(name) || name.includes("/") || name.includes("\\")) {
+  if (isAbsolute(name) || name.includes("/")) {
     return isExecutable(name) ? name : ""
   }
-  const exts = process.platform === "win32" ? (process.env["PATHEXT"] ?? ".EXE;.CMD;.BAT;.COM").split(";").concat("") : [""]
   for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
     if (dir === "") continue
-    for (const ext of exts) {
-      const cand = join(dir, name + ext.toLowerCase())
-      if (isExecutable(cand)) return cand
-    }
+    const candidate = join(dir, name)
+    if (isExecutable(candidate)) return candidate
   }
   return ""
 }
@@ -45,7 +38,7 @@ export function commandExists(name: string): boolean {
 export function isExecutable(p: string): boolean {
   try {
     if (!statSync(p).isFile()) return false
-    if (process.platform !== "win32") accessSync(p, constants.X_OK)
+    accessSync(p, constants.X_OK)
     return true
   } catch {
     return false

package/cli/src/engine-native/os.ts

@@ -1,29 +1,24 @@
 /**
- * Platform capability seam (Output Policy in DESIGN.md) — the only engine
- * module that reads process.platform besides exec.ts's PATH/executability
- * primitives. Per-tool package identifiers stay in deps.ts; symlink handling
- * stays try-then-fallback at the call site (capability-driven, not predicted).
+ * Platform capability seam (Output Policy in DESIGN.md). Per-tool package
+ * identifiers stay in deps.ts; symlink handling stays try-then-fallback at
+ * the call site (capability-driven, not predicted).
  */
 
-export type PlatformName = "linux" | "darwin" | "windows" | "unknown"
+export type PlatformName = "linux" | "darwin" | "unknown"
 
 export function rawPlatform(): NodeJS.Platform {
   return process.platform
 }
 
 export function platformName(pf: NodeJS.Platform = rawPlatform()): PlatformName {
-  return pf === "linux" ? "linux" : pf === "darwin" ? "darwin" : pf === "win32" ? "windows" : "unknown"
-}
-
-export function isWindows(): boolean {
-  return rawPlatform() === "win32"
+  return pf === "linux" ? "linux" : pf === "darwin" ? "darwin" : "unknown"
 }
 
 export function isLinux(): boolean {
   return rawPlatform() === "linux"
 }
 
-/** Shell-rc exports (bashrc/zshrc) apply only off Windows. */
+/** Shell-rc exports apply only on supported hosts. */
 export function shellRcApplicable(): boolean {
-  return !isWindows()
+  return platformName() !== "unknown"
 }

package/cli/src/engine-native/services.ts

@@ -36,7 +36,6 @@ export interface DependencyManager {
 export interface Platform {
   readonly raw: () => NodeJS.Platform
   readonly name: () => PlatformName
-  readonly isWindows: () => boolean
   readonly isLinux: () => boolean
   readonly shellRcApplicable: () => boolean
 }
@@ -51,13 +50,12 @@ export interface EngineServiceOptions {
   readonly sinks?: LoggerSinks
 }
 
-/** Platform view over an injectable platform id (tests pass e.g. "win32"). */
+/** Platform view over an injectable platform id. */
 export const makePlatform = (pf: NodeJS.Platform = rawPlatform()): Platform => ({
   raw: () => pf,
   name: () => platformName(pf),
-  isWindows: () => pf === "win32",
   isLinux: () => pf === "linux",
-  shellRcApplicable: () => pf !== "win32"
+  shellRcApplicable: () => pf === "linux" || pf === "darwin"
 })
 
 /** DependencyManager whose hints default to the INJECTED platform, not the host. */

package/cli/src/engine-native/sessionRelayCli.ts

@@ -9,7 +9,7 @@ import {
   rmSync,
   statSync
 } from "node:fs"
-import { basename, dirname, join } from "node:path"
+import { dirname, join } from "node:path"
 
 import { isObject, parseJson, type Json } from "./jq"
 import type { Ctx } from "./index"

package/cli/src/engine-native/skillsSync.ts

@@ -5,12 +5,12 @@
  * and the snapshot write.
  */
 import { spawnSync } from "node:child_process"
-import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, realpathSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs"
+import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, statSync, symlinkSync } from "node:fs"
 import { p, writeFileIfChanged } from "./exec"
 import { bunBootstrap } from "./bun"
 import type { Ctx } from "./index"
 import { compareCodepoints } from "./jq"
-import type { EngineServices, Platform } from "./services"
+import type { EngineServices } from "./services"
 import { ensure, field } from "./toolchain"
 import { payloadText } from "../payload"
 
@@ -139,9 +139,6 @@ function healClaudeSymlink(ctx: Ctx, skillsDir: string, base: string): boolean {
   if (linkStat?.isSymbolicLink() === true) {
     const current = safeReadlink(claudeLink)
     if (current === relTarget) return false
-    // win32: `npx skills add` creates absolute symlinks/junctions — any link
-    // that RESOLVES to the canonical dir is healthy, not stale.
-    if (ctx.services.platform.isWindows() && realpathEquals(claudeLink, canonical)) return false
     if (ctx.dryRun) {
       echo(`[dry-run] would replace stale Claude symlink: ~/.claude/skills/${base} -> ${current}  (correct: ${relTarget})`)
       return true
@@ -178,36 +175,22 @@ function safeReadlink(path: string): string {
   }
 }
 
-function realpathEquals(a: string, b: string): boolean {
-  try {
-    return realpathSync(a) === realpathSync(b)
-  } catch {
-    return false
-  }
-}
 
-/**
- * Remove a symlink/junction without crashing: Bun's rmSync throws EFAULT on
- * win32 directory symlinks. unlink handles file symlinks, rmdir handles
- * dir symlinks/junctions, rmSync is the POSIX catch-all.
- */
+/** Remove a symlink without touching a real directory. */
 function removeLink(path: string): boolean {
-  for (const rm of [() => unlinkSync(path), () => rmdirSync(path), () => rmSync(path, { force: true })]) {
-    try {
-      rm()
-      return true
-    } catch {
-      // try the next removal shape
-    }
+  try {
+    rmSync(path, { force: true })
+    return true
+  } catch {
+    return lstat(path) === undefined
   }
-  return lstat(path) === undefined
 }
 
-/** skills::_link_or_copy — real symlink preferred, copy fallback (Windows). */
-export function linkOrCopy(target: string, link: string, platform: Platform): boolean {
+/** skills::_link_or_copy — real symlink preferred, copy fallback. */
+export function linkOrCopy(target: string, link: string): boolean {
   removeLink(link)
   try {
-    symlinkSync(target, link, platform.isWindows() ? "dir" : undefined)
+    symlinkSync(target, link)
   } catch {
     // fall through to the copy fallback below
   }
@@ -223,11 +206,11 @@ export function linkOrCopy(target: string, link: string, platform: Platform): bo
 }
 
 function linkOrCopyWithWarnings(target: string, link: string, services: EngineServices): boolean {
-  const linked = linkOrCopy(target, link, services.platform)
+  const linked = linkOrCopy(target, link)
   if (!linked) {
     services.logger.warn(`could not create ${link} (symlink and copy both failed)`)
   } else if (lstat(link)?.isSymbolicLink() !== true) {
-    services.logger.warn(`symlinks unsupported here — ${link} is a copy (refreshed on sync; enable Windows Developer Mode for real links)`)
+    services.logger.warn(`symlinks unsupported here — ${link} is a copy refreshed on sync`)
   }
   return linked
 }
@@ -298,14 +281,6 @@ export function effectSolutionsInstall(
 
     const location = services.deps.location("effect-solutions")
     const gbin = location.binDir
-    // win32: bun writes an .exe shim (not the bare Unix name), and the
-    // ~/.local/bin link step below is Unix-only plumbing (non-interactive
-    // agent PATH) — bun's global bin is already the Windows PATH entry.
-    if (services.platform.isWindows()) {
-      if (location.path !== "") change(`effect-solutions CLI ready (${gbin})`)
-      else warn(`effect-solutions installed but no shim found under '${gbin !== "" ? gbin : "<unknown>"}' — check bun pm -g bin`)
-      return 0
-    }
     if (location.path !== "") {
       mkdirSync(p(ctx.home, ".local", "bin"), { recursive: true })
       linkOrCopyWithWarnings(bun, p(ctx.home, ".local", "bin", "bun"), services)

package/cli/src/engine.ts

@@ -5,28 +5,32 @@ import { makeEngineServices } from "./engine-native/services"
 import { kitHome } from "./kitHome"
 import { DependencyManagerService, LoggerService, PlatformService } from "./services"
 
-// Same factory as the Effect rim's live layers — this path runs outside the
-// runtime (child-spawn capture), so it takes the services directly.
-const services = makeEngineServices()
-
 /**
  * The single seam between the typed CLI and EngineNative. Engine execution
  * stays in-process after @effect/cli has parsed pickers and flag spellings.
  */
 const bashRemovedMessage = "bash engine removed — recover at tag bash-engine-final"
 const bashEngineRequested = (): boolean => process.env["DOCKS_KIT_ENGINE"] === "bash"
+const requireSupportedHost = () => {
+  const platform = process.platform
+  const arch = process.arch
+  return (platform === "linux" || platform === "darwin") && (arch === "x64" || arch === "arm64")
+    ? Effect.void
+    : bail(
+      `unsupported host ${platform}/${arch}; docks-kit supports only Linux and macOS on x64 or arm64`,
+      2
+    )
+}
 
-// bun build --compile runs the embedded entry from a virtual path
-// ("/$bunfs/root/…" on POSIX, "B:\~BUN\root\…" on Windows). There
-// process.execPath IS the CLI, so a re-spawn must not pass main.ts.
-// The Windows check is anchored to the drive-rooted "~BUN" segment so a
-// real checkout under a ~BUN-named directory can't false-positive.
+// bun build --compile runs the embedded entry from a virtual POSIX path
+// ("/$bunfs/root/…"). There process.execPath IS the CLI, so a re-spawn must
+// not pass main.ts.
 export const compiled =
-  process.argv[1] !== undefined &&
-  (process.argv[1].startsWith("/$bunfs/") || /^[A-Za-z]:[\\/]~BUN[\\/]/i.test(process.argv[1]))
+  process.argv[1] !== undefined && process.argv[1].startsWith("/$bunfs/")
 
 export const engine = (args: ReadonlyArray<string>) =>
   Effect.gen(function* () {
+    yield* requireSupportedHost()
     if (bashEngineRequested()) {
       yield* bail(bashRemovedMessage, 2)
     }
@@ -41,9 +45,12 @@ export const engine = (args: ReadonlyArray<string>) =>
 
 /** Run the engine capturing stdout (engine logs/warns go to stderr and pass through). */
 export const engineCapture = (args: ReadonlyArray<string>) =>
-  bashEngineRequested()
-    ? bail(bashRemovedMessage, 2)
-    : Effect.sync(() => {
+  Effect.gen(function* () {
+    yield* requireSupportedHost()
+    if (bashEngineRequested()) {
+      return yield* bail(bashRemovedMessage, 2)
+    }
+    return yield* Effect.sync(() => {
       // Child process (raw channel): runEngineNative writes straight to
       // process.stdout, so in-process capture isn't possible.
       const res = spawnSync(process.execPath, compiled ? [...args] : [`${kitHome()}/cli/src/main.ts`, ...args], {
@@ -52,10 +59,11 @@ export const engineCapture = (args: ReadonlyArray<string>) =>
         stdio: ["ignore", "pipe", "inherit"]
       })
       if (res.error !== undefined || res.status !== 0) {
-        services.logger.warn(`engine capture failed (${args.join(" ")} exited ${res.status ?? "spawn-error"})`)
+        makeEngineServices().logger.warn(`engine capture failed (${args.join(" ")} exited ${res.status ?? "spawn-error"})`)
       }
       return res.stdout ?? ""
     })
+  })
 
 /** Print a message to stderr and exit — for CLI-side validation failures. */
 export const bail = (message: string, code = 2) =>

package/cli/src/generated/sotPayload.ts

@@ -1,7 +1,7 @@
 // Generated by cli/scripts/generate-sot-payload.ts. DO NOT EDIT.
 // Edit SoT/, notification.mp3, or package.json, then run: bun cli/scripts/generate-sot-payload.ts
 
-export const GENERATED_PACKAGE_VERSION = "0.9.0"
+export const GENERATED_PACKAGE_VERSION = "0.10.0"
 
 export const GENERATED_PAYLOAD_TEXT = {
   "SoT/.agents/skills.txt": "# Universal AI-agent skill manifest intentionally empty.\n# Global skill discovery is opt-in: add one <owner>/<repo> slug per line.\n# EngineNative ignores comments and blank lines.\n",

package/docks-kit

@@ -11,17 +11,18 @@ REPO_DIR="$(cd "$(dirname "$0")" && pwd)"
 BUN_PIN="1.3.14"
 # END GENERATED BUN PIN
 
-case "$(uname -s)-$(uname -m)" in
-  Linux-x86_64)   KIT_BIN="docks-kit-linux-x64" ;;
-  Linux-aarch64)  KIT_BIN="docks-kit-linux-arm64" ;;
-  Darwin-x86_64)  KIT_BIN="docks-kit-darwin-x64" ;;
-  Darwin-arm64)   KIT_BIN="docks-kit-darwin-arm64" ;;
-  # Git Bash unames look like MINGW64_NT-10.0-19045-x86_64. The compiled
-  # binary is the supported Windows path; the Bun fallback below is Unix-shaped.
-  MINGW*-x86_64|MSYS*-x86_64|CYGWIN*-x86_64) KIT_BIN="docks-kit-windows-x64.exe" ;;
-  *)              KIT_BIN="" ;;
+HOST="$(uname -s)-$(uname -m)"
+case "$HOST" in
+  Linux-x86_64)  KIT_BIN="docks-kit-linux-x64" ;;
+  Linux-aarch64) KIT_BIN="docks-kit-linux-arm64" ;;
+  Darwin-x86_64) KIT_BIN="docks-kit-darwin-x64" ;;
+  Darwin-arm64)  KIT_BIN="docks-kit-darwin-arm64" ;;
+  *)
+    echo "[docks-kit] unsupported host $HOST; docks-kit supports only Linux and macOS on x64 or arm64." >&2
+    exit 1
+    ;;
 esac
-if [[ -n "$KIT_BIN" && -x "$REPO_DIR/cli/dist/$KIT_BIN" ]]; then
+if [[ -x "$REPO_DIR/cli/dist/$KIT_BIN" ]]; then
   CHECKOUT_VERSION=""
   while IFS= read -r line; do
     if [[ "$line" =~ ^[[:space:]]*\"version\"[[:space:]]*:[[:space:]]*\"([^\"]+)\" ]]; then

package/package.json

@@ -1,9 +1,13 @@
 {
   "name": "docks-kit",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Portable AI coding agent config kit — SoT sync engine + typed CLI for Claude Code, Codex, and universal agent skills",
   "type": "module",
   "license": "MIT",
+  "os": [
+    "linux",
+    "darwin"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/DocksDocks/public.git"

package/cli/src/engine-native/powershell.ts

@@ -1,11 +0,0 @@
-export function powerShellLiteral(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
-export function encodePowerShellCommand(script: string): string {
-  return Buffer.from(script, "utf16le").toString("base64")
-}
-
-export function decodePowerShellCommand(encoded: string): string {
-  return Buffer.from(encoded, "base64").toString("utf16le")
-}