claude-code-kit 0.21.0__tar.gz → 0.22.0__tar.gz

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.21.0",
+      "version": "0.22.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/CHANGELOG.md

@@ -4,6 +4,51 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.22.0] — 2026-06-23
+
+**Critical-correctness hardening (PR1 of a phased review): a non-destructive `init` merge that no longer
+deletes your files, a CI guard against doc/version/count drift, stricter config validation, pinned
+third-party MCP versions, and several P2 fixes.**
+
+### Fixed
+
+- **Data-loss bug in `init` merge mode.** Re-running `claude-kit init` over an existing `.claude/`
+  (the default `merge` mode) used to `shutil.rmtree` whole kit-managed directories (`rules/`,
+  `skills/<name>/`, `skills/_references/`), silently deleting any file you had added under them.
+  `init` now reconciles non-destructively via the new `upgrader.merge_install`, which reuses the
+  owner-aware upgrade logic: kit/overlay files are refreshed (user-modified ones backed up to
+  `.claude-kit.bak-N/` first), user-editable files are sidecar'd, kit/overlay orphans are pruned, and
+  **files the kit doesn't track are never touched**. An untracked hand-rolled `.claude/` is migrated
+  safely too (collisions are backed up). `--force` / `overwrite` remains the only destructive path.
+- **`README.claude-sdlc.md` is now user-editable.** `init` no longer hard-overwrites it; it honours
+  `--force` and otherwise writes a `.claude-kit` sidecar, and `upgrade` protects it like `CLAUDE.md`.
+- **Documentation/version drift.** `SECURITY.md` supported-version, the `/sdlc` skill's `standard`
+  gate row (added `contract-clear`), and the README hook count (16 → 17) corrected.
+
+### Added
+
+- **`scripts/check_docs_consistency.py`** — a fail-loud guard (run in tests + CI) that re-derives the
+  facts and asserts the docs agree: version parity across `pyproject.toml`, `__init__.py`, both plugin
+  manifests, the latest `CHANGELOG` heading and `SECURITY.md`; component counts (agents / rules / core
+  & collection skills / hook scripts / MCP servers) against every number the docs quote; and the
+  profile→gate tables in `README.md` + `skills/sdlc/SKILL.md` against `catalog/profiles.yaml`.
+- **Stricter `--config` / selection validation.** A bare `mcp: github` (or `teams: …`) string is
+  normalised to a one-element list instead of being iterated character-by-character; malformed shapes,
+  unknown config keys, an unknown `frontend_language` for the chosen framework, and an unknown `scope`
+  now fail loudly with a clear message (`Selection.from_dict(strict=True)` + `catalog.resolve` checks).
+
+### Changed
+
+- **Pinned MCP server package versions.** `catalog/mcp.yaml` replaces moving `@latest` / implicit-latest
+  `npx` tags with exact version pins (snapshot 2026-06-23) for reproducible, supply-chain-aware installs;
+  the deprecated official GitHub/Postgres reference servers are flagged. README notes that MCP servers
+  are third-party code.
+- **Planned CLI commands exit non-zero.** `package-org-pack`, `install-org-pack`, and
+  `research import-sources` now exit `2` (still announcing "planned") instead of a silent success-`0`.
+- **Inline guard hooks degrade without `jq`.** The `rm -rf` / push-to-main / secrets inline guards (in
+  both the plugin `hooks.json` and the CLI registry) now no-op when `jq` is absent, matching the
+  script-backed guards and the SECURITY.md promise.
+
 ## [0.21.0] — 2026-06-22
 
 **Add two stack-collection skills — `cron-and-scheduled-jobs` (scheduled/recurring jobs across Kubernetes

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.21.0
+Version: 0.22.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -82,7 +82,7 @@ Quick start) for the full breakdown of any row.
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
-| 🛠️ **Hooks & guards** | **16** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
+| 🛠️ **Hooks & guards** | **17** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **9** ready MCP fragments, and edit-preserving `upgrade` |
 | ♻️ **Reuse-first by design** | Adopt-only-the-new reviews, opt-in LLM/AI security (OWASP LLM Top 10), a worked example + self-test matrix |
 
@@ -306,7 +306,7 @@ need.
 
 <br>
 
-- **16 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
+- **17 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
   `guard-secrets`, `guard-destructive-git`, `lint-fix`, `type-check`, and `validate-settings` run
   deterministically.
 - **Advisory, never-blocking warnings** — `warn-llm-io`, `warn-large-edits`, `warn-missing-tests`, and
@@ -325,6 +325,10 @@ need.
   (`claude-kit` / `ckit` / `claude-sdlc`) generate identical config.
 - **Catalog-driven extensibility** — adding a stack, framework, database, profile, MCP server, or org
   pack is a [`catalog/`](catalog/) YAML edit, never a code change; 9 MCP server fragments ship ready.
+- **MCP servers are third-party** — each fragment runs an external package or hosted endpoint that
+  claude-kit references but does not vendor or audit; the `npx` commands are **pinned to an exact
+  version** (not `@latest`) for reproducible, supply-chain-aware installs. Review a server's source and
+  license before enabling it, and bump pins deliberately. See [`SECURITY.md`](SECURITY.md).
 - **Safe, edit-preserving upgrades** — `upgrade` refreshes kit/overlay files via per-file `owner` +
   checksum, never clobbers your edits, backs up changes, and restores deleted files (`diff` previews
   first).

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/README.md

@@ -55,7 +55,7 @@ Quick start) for the full breakdown of any row.
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
-| 🛠️ **Hooks & guards** | **16** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
+| 🛠️ **Hooks & guards** | **17** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **9** ready MCP fragments, and edit-preserving `upgrade` |
 | ♻️ **Reuse-first by design** | Adopt-only-the-new reviews, opt-in LLM/AI security (OWASP LLM Top 10), a worked example + self-test matrix |
 
@@ -279,7 +279,7 @@ need.
 
 <br>
 
-- **16 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
+- **17 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
   `guard-secrets`, `guard-destructive-git`, `lint-fix`, `type-check`, and `validate-settings` run
   deterministically.
 - **Advisory, never-blocking warnings** — `warn-llm-io`, `warn-large-edits`, `warn-missing-tests`, and
@@ -298,6 +298,10 @@ need.
   (`claude-kit` / `ckit` / `claude-sdlc`) generate identical config.
 - **Catalog-driven extensibility** — adding a stack, framework, database, profile, MCP server, or org
   pack is a [`catalog/`](catalog/) YAML edit, never a code change; 9 MCP server fragments ship ready.
+- **MCP servers are third-party** — each fragment runs an external package or hosted endpoint that
+  claude-kit references but does not vendor or audit; the `npx` commands are **pinned to an exact
+  version** (not `@latest`) for reproducible, supply-chain-aware installs. Review a server's source and
+  license before enabling it, and bump pins deliberately. See [`SECURITY.md`](SECURITY.md).
 - **Safe, edit-preserving upgrades** — `upgrade` refreshes kit/overlay files via per-file `owner` +
   checksum, never clobbers your edits, backs up changes, and restores deleted files (`diff` previews
   first).

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/catalog/mcp.yaml

@@ -1,16 +1,26 @@
 # claude-kit optional MCP integrations. Selected servers are written into a project-root `.mcp.json`
 # ONLY when chosen at init (default: none). Configs use ${ENV} placeholders — no credentials are ever
 # generated. Fill the referenced env vars (e.g. in your shell or .env) before using a server.
+#
+# SUPPLY CHAIN: every server below is THIRD-PARTY code (an npx package or a hosted HTTP endpoint) with
+# its own maintainers, trust, and licensing model — claude-kit only references it, never vendors or
+# audits it. The `npx -y <pkg>@<version>` commands are pinned to an exact version (snapshot 2026-06-23)
+# rather than a moving `@latest`, so an install is reproducible and a fresh upstream release can't
+# silently change what runs. Bump these deliberately (and review the changelog) — do not switch back
+# to `@latest`. See SECURITY.md and the README "MCP integrations" note.
 
 version: 1
 
 servers:
   github:
     label: "GitHub (issues, PRs, repos)"
+    # NOTE: the official @modelcontextprotocol/server-github npm package is archived/deprecated upstream
+    # (GitHub now ships a Go `github-mcp-server`). Pinned to its last published version for a stable
+    # install; switch to the maintained server in a future kit release if you need newer features.
     config:
       type: stdio
       command: npx
-      args: ["-y", "@modelcontextprotocol/server-github"]
+      args: ["-y", "@modelcontextprotocol/server-github@2025.4.8"]
       env:
         GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_PERSONAL_ACCESS_TOKEN}"
   linear:
@@ -23,22 +33,25 @@ servers:
     config:
       type: stdio
       command: npx
-      args: ["-y", "mcp-atlassian"]
+      args: ["-y", "mcp-atlassian@2.1.0"]
       env:
         JIRA_URL: "${JIRA_URL}"
         JIRA_API_TOKEN: "${JIRA_API_TOKEN}"
   postgres:
     label: "PostgreSQL (query the database)"
+    # NOTE: @modelcontextprotocol/server-postgres is archived/deprecated upstream; pinned to its last
+    # published version for a stable install. Consider a maintained Postgres MCP server going forward.
     config:
       type: stdio
       command: npx
-      args: ["-y", "@modelcontextprotocol/server-postgres", "${DATABASE_URL}"]
+      args:
+        ["-y", "@modelcontextprotocol/server-postgres@0.6.2", "${DATABASE_URL}"]
   mongodb:
     label: "MongoDB (query the database)"
     config:
       type: stdio
       command: npx
-      args: ["-y", "mongodb-mcp-server"]
+      args: ["-y", "mongodb-mcp-server@1.13.0"]
       env:
         MDB_MCP_CONNECTION_STRING: "${MONGODB_URI}"
   playwright:
@@ -46,7 +59,7 @@ servers:
     config:
       type: stdio
       command: npx
-      args: ["-y", "@playwright/mcp@latest"]
+      args: ["-y", "@playwright/mcp@0.0.76"]
   docs:
     label: "Docs / Context7 (live library docs)"
     config:
@@ -61,7 +74,7 @@ servers:
   # source is FSL-1.1-Apache-2.0 (source-available; converts to Apache-2.0 two years after each
   # release) — flagged in the label like the repowise AGPL note; this entry references only the
   # OAuth-hosted service, not the source. Self-hosted/token alternative (instead of the http url):
-  #   command: npx, args: ["-y", "@sentry/mcp-server@latest"], env: SENTRY_ACCESS_TOKEN: "${SENTRY_ACCESS_TOKEN}".
+  #   command: npx, args: ["-y", "@sentry/mcp-server@0.36.0"], env: SENTRY_ACCESS_TOKEN: "${SENTRY_ACCESS_TOKEN}".
   sentry:
     label: "Sentry (error monitoring / issue triage; source-available FSL-1.1)"
     config:

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/hooks/hooks.json

@@ -15,8 +15,8 @@
       {
         "matcher": "Bash",
         "hooks": [
-          { "type": "command", "command": "CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi" },
-          { "type": "command", "command": "CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'git[[:space:]]+push.*[[:space:]:](main|master)([[:space:]]|$)'; then echo 'BLOCKED: refusing to push to main/master — use a feature branch and a PR.' >&2; exit 2; fi" },
+          { "type": "command", "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi" },
+          { "type": "command", "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'git[[:space:]]+push.*[[:space:]:](main|master)([[:space:]]|$)'; then echo 'BLOCKED: refusing to push to main/master — use a feature branch and a PR.' >&2; exit 2; fi" },
           { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-destructive-git.sh\"" },
           { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-secrets.sh\"" },
           { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-kubectl-delete.sh\"" }

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.21.0"
+version = "0.22.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

claude_code_kit-0.22.0/scripts/check_docs_consistency.py

@@ -0,0 +1,257 @@
+#!/usr/bin/env python3
+"""Fail-loud guard against documentation / version / count drift in this repo.
+
+claude-kit ships from one source of truth but advertises itself in many places — the README,
+SECURITY.md, the CHANGELOG, the plugin manifests, and the `/sdlc` skill. Those numbers and version
+strings drift the moment a component is added without a doc sweep (e.g. PR #25 added a 17th hook
+script but left the README saying "16"). This script re-derives the facts from the filesystem and
+the catalog and asserts the docs agree.
+
+It checks three classes of drift:
+
+1. **Version parity** — the single version string must be identical across ``pyproject.toml``,
+   ``src/claude_kit/__init__.py``, both plugin manifests, the latest ``CHANGELOG.md`` heading, and
+   ``SECURITY.md``.
+2. **Component counts** — agents / core rules / core skills / collection skills / hook scripts /
+   MCP fragments, counted on disk (or in ``catalog/mcp.yaml``), must match every number the docs
+   quote for them.
+3. **Profile → gate tables** — the gate lists in ``README.md`` and ``skills/sdlc/SKILL.md`` must
+   match the effective gate sets resolved from ``catalog/profiles.yaml`` (inheritance included).
+
+Run directly (``python scripts/check_docs_consistency.py``) — exits 0 when consistent, 1 otherwise
+and prints every mismatch. Also exercised by ``tests/test_docs_consistency.py`` and CI.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+def _read(rel: str) -> str:
+    return (ROOT / rel).read_text(encoding="utf-8")
+
+
+# --------------------------------------------------------------------------------------------------
+# 1) Version parity
+# --------------------------------------------------------------------------------------------------
+
+
+def _versions() -> dict[str, str]:
+    """Return the version string each source declares, keyed by a human label."""
+    out: dict[str, str] = {}
+    m = re.search(r'^version\s*=\s*"([^"]+)"', _read("pyproject.toml"), re.MULTILINE)
+    out["pyproject.toml"] = m.group(1) if m else "??"
+    m = re.search(r'__version__\s*=\s*"([^"]+)"', _read("src/claude_kit/__init__.py"))
+    out["src/claude_kit/__init__.py"] = m.group(1) if m else "??"
+    out[".claude-plugin/plugin.json"] = json.loads(
+        _read(".claude-plugin/plugin.json")
+    ).get("version", "??")
+    market = json.loads(_read(".claude-plugin/marketplace.json"))
+    for i, p in enumerate(market.get("plugins", [])):
+        out[f".claude-plugin/marketplace.json[{i}]"] = p.get("version", "??")
+    m = re.search(r"^##\s*\[([^\]]+)\]", _read("CHANGELOG.md"), re.MULTILINE)
+    out["CHANGELOG.md (latest)"] = m.group(1) if m else "??"
+    m = re.search(r"currently\s*\*\*([^*]+)\*\*", _read("SECURITY.md"))
+    out["SECURITY.md"] = m.group(1) if m else "??"
+    return out
+
+
+def check_versions() -> list[str]:
+    versions = _versions()
+    distinct = set(versions.values())
+    if len(distinct) == 1:
+        return []
+    canonical = versions["pyproject.toml"]
+    return [
+        f"version drift: {label} says {ver!r} (canonical pyproject.toml = {canonical!r})"
+        for label, ver in versions.items()
+        if ver != canonical
+    ]
+
+
+# --------------------------------------------------------------------------------------------------
+# 2) Component counts
+# --------------------------------------------------------------------------------------------------
+
+
+def _count_skills() -> tuple[int, int]:
+    """Return (core, collection): collection skills carry a README.md, core ones do not."""
+    core = collection = 0
+    for d in sorted((ROOT / "skills").iterdir()):
+        if not d.is_dir() or d.name.startswith("_"):
+            continue
+        if (d / "README.md").is_file():
+            collection += 1
+        else:
+            core += 1
+    return core, collection
+
+
+def _actuals() -> dict[str, int]:
+    core, collection = _count_skills()
+    mcp = yaml.safe_load(_read("catalog/mcp.yaml")).get("servers", {})
+    return {
+        "agents": len(list((ROOT / "agents").glob("*.md"))),
+        "rules": len(list((ROOT / "rules").glob("*.md"))),
+        "core skills": core,
+        "collection skills": collection,
+        "hook scripts": len(list((ROOT / "hooks" / "scripts").glob("*.sh"))),
+        "mcp servers": len(mcp),
+    }
+
+
+# Each anchor ties a component count to one regex (single capture group = the number) in one file.
+# Every listed regex must match at least once, and every match must equal the on-disk count — so a
+# count change forces a doc update, and a reworded sentence that drops the number trips "anchor not
+# found". Subset counts elsewhere ("8 agent-operation rules") are deliberately NOT anchored.
+_ANCHORS: list[tuple[str, str, str]] = [
+    ("agents", "README.md", r"\*\*(\d+)\*\* tiered agents"),
+    ("agents", "README.md", r"(\d+) specialized agents"),
+    ("agents", "README.md", r"(\d+) specialized roles"),
+    ("agents", "README.md", r"(\d+) SDLC agents"),
+    ("rules", "README.md", r"\*\*(\d+)\*\* stack-agnostic core rules"),
+    ("rules", "README.md", r"(\d+) stack-agnostic core rules"),
+    ("rules", "README.md", r"(\d+) stack-agnostic contracts"),
+    ("rules", "README.md", r"(\d+) engineering rules"),
+    ("core skills", "README.md", r"\*\*(\d+)\*\* context-activated skills"),
+    ("core skills", "README.md", r"(\d+) on-demand skills"),
+    ("hook scripts", "README.md", r"\*\*(\d+)\*\* event hooks"),
+    ("hook scripts", "README.md", r"(\d+) event hook scripts"),
+    ("mcp servers", "README.md", r"\*\*(\d+)\*\* ready MCP fragments"),
+    ("mcp servers", "README.md", r"(\d+) MCP server fragments"),
+]
+
+
+def check_counts() -> list[str]:
+    actuals = _actuals()
+    errors: list[str] = []
+    for component, relfile, pattern in _ANCHORS:
+        text = _read(relfile)
+        matches = re.findall(pattern, text)
+        if not matches:
+            errors.append(
+                f"{relfile}: anchor for {component!r} not found (pattern {pattern!r}) — "
+                "doc reworded? update check_docs_consistency.py"
+            )
+            continue
+        want = actuals[component]
+        for got in matches:
+            if int(got) != want:
+                errors.append(
+                    f"{relfile}: {component} count says {got}, but there are {want} "
+                    f"(pattern {pattern!r})"
+                )
+
+    # Collection skills also drive the living index table in docs/stack-skills/README.md.
+    idx = _read("docs/stack-skills/README.md")
+    rows = [ln for ln in idx.splitlines() if re.match(r"\|\s*\*\*", ln)]
+    if len(rows) != actuals["collection skills"]:
+        errors.append(
+            f"docs/stack-skills/README.md: {len(rows)} skill rows, but "
+            f"{actuals['collection skills']} collection skills exist on disk"
+        )
+    return errors
+
+
+# --------------------------------------------------------------------------------------------------
+# 3) Profile -> gate tables
+# --------------------------------------------------------------------------------------------------
+
+
+def _effective_gates() -> dict[str, set[str]]:
+    """Resolve each profile's effective gate set from profiles.yaml (unioning ``inherit``)."""
+    profiles = yaml.safe_load(_read("catalog/profiles.yaml"))["profiles"]
+    cache: dict[str, set[str]] = {}
+
+    def resolve(name: str) -> set[str]:
+        if name in cache:
+            return cache[name]
+        p = profiles[name]
+        gates = set(p.get("gates") or [])
+        if p.get("inherit"):
+            gates |= resolve(p["inherit"])
+        cache[name] = gates
+        return gates
+
+    return {name: resolve(name) for name in profiles}
+
+
+def _doc_gate_sets(relfile: str) -> dict[str, set[str]]:
+    """Parse the lean/standard/enterprise gate rows from a doc's profile→gate table."""
+    raw: dict[str, str] = {}
+    for line in _read(relfile).splitlines():
+        m = re.match(r"\|\s*\*\*(lean|standard|enterprise)\*\*\s*\|(.+?)\|\s*$", line)
+        if m:
+            raw[m.group(1)] = m.group(2)
+
+    def tokens(cell: str) -> set[str]:
+        return {
+            t.strip().strip("*").strip("\\").strip()
+            for t in cell.split("·")
+            if t.strip().strip("*").strip("\\").strip()
+        }
+
+    def expand(profile: str) -> set[str]:
+        cell = raw[profile]
+        if (
+            "+" in cell
+        ):  # e.g. "standard + pipeline-green · observability-ready · acceptance"
+            base, extra = cell.split("+", 1)
+            return expand(base.strip().strip("*").lower()) | tokens(extra)
+        return tokens(cell)
+
+    return {p: expand(p) for p in raw}
+
+
+def check_profile_gates() -> list[str]:
+    effective = _effective_gates()
+    errors: list[str] = []
+    for relfile in ("README.md", "skills/sdlc/SKILL.md"):
+        doc = _doc_gate_sets(relfile)
+        for profile in ("lean", "standard", "enterprise"):
+            if profile not in doc:
+                errors.append(f"{relfile}: no gate row found for profile {profile!r}")
+                continue
+            if doc[profile] != effective[profile]:
+                missing = effective[profile] - doc[profile]
+                extra = doc[profile] - effective[profile]
+                detail = []
+                if missing:
+                    detail.append(f"missing {sorted(missing)}")
+                if extra:
+                    detail.append(f"unexpected {sorted(extra)}")
+                errors.append(
+                    f"{relfile}: {profile} gate row disagrees with profiles.yaml — "
+                    + "; ".join(detail)
+                )
+    return errors
+
+
+# --------------------------------------------------------------------------------------------------
+
+
+def run() -> list[str]:
+    """Run every check and return the combined list of error messages (empty = consistent)."""
+    return check_versions() + check_counts() + check_profile_gates()
+
+
+def main() -> int:
+    errors = run()
+    if errors:
+        print("docs consistency: FAIL")
+        for e in errors:
+            print(f"  - {e}")
+        return 1
+    print("docs consistency: OK")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/skills/sdlc/SKILL.md

@@ -53,7 +53,7 @@ Run **only** the gates present in the snapshot's `gates:` list. The three profil
 | Profile | Gates that run |
 |---|---|
 | **lean** | code-review · build-green |
-| **standard** | spec-complete · em-approved · code-review · build-green · test-coverage · security-clear |
+| **standard** | spec-complete · em-approved · code-review · build-green · test-coverage · security-clear · contract-clear |
 | **enterprise** | standard + pipeline-green · observability-ready · acceptance |
 
 Never run a gate (or spawn its agent) that isn't in the active set — that's what makes lean fast and

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.21.0"
+__version__ = "0.22.0"

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/src/claude_kit/catalog.py

@@ -326,11 +326,23 @@ def resolve(payload_root: str | Path, selection: Selection) -> ResolvedPlan:
     capture_cfg = _load(payload_root, "capture.yaml")
 
     frontend = _frontend(stacks, selection.frontend_framework)
+    fe_langs = frontend.get("languages", {}).get("options", [])
+    if fe_langs and selection.frontend_language not in fe_langs:
+        raise ValueError(
+            f"unknown frontend language {selection.frontend_language!r} for "
+            f"{selection.frontend_framework!r} (choices: {', '.join(fe_langs)})"
+        )
     backend_lang, backend_fw = _backend(
         stacks, selection.backend_language, selection.backend_framework
     )
     database = _database(stacks, selection.database)
 
+    valid_scopes = {s["id"] for s in _load(payload_root, "org.yaml").get("scopes", [])}
+    if valid_scopes and selection.scope not in valid_scopes:
+        raise ValueError(
+            f"unknown scope {selection.scope!r} (choices: {', '.join(sorted(valid_scopes))})"
+        )
+
     avail = available(payload_root)
     prof = _resolve_profile(profiles, selection.profile, avail)
 

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/src/claude_kit/cli.py

@@ -103,6 +103,7 @@ def init(
             target.mkdir(parents=True, exist_ok=True)
 
         # 2) Existing .claude handling: merge / overwrite / backup / abort.
+        mode = "fresh"
         overwrite = force
         if (target / ".claude").exists():
             if force:
@@ -143,10 +144,21 @@ def init(
             typer.echo(f"error: {exc}", err=True)
             raise typer.Exit(2) from exc
 
-        # 4) Install.
-        typer.echo(f"\nclaude-kit: installing into {target}")
-        for line in scaffold.install_sdlc(src, target, plan, force=overwrite):
-            typer.echo(line)
+        # 4) Install. Merge mode reconciles non-destructively (preserving the user's own files);
+        # fresh / overwrite / backup all go through the destructive install spine.
+        if mode == "merge":
+            typer.echo(
+                f"\nclaude-kit: merging into {target} (your files are preserved)"
+            )
+            ok, messages = upgrader.merge_install(src, target, plan, force=force)
+            for line in messages:
+                typer.echo(line)
+            if not ok:
+                raise typer.Exit(1)
+        else:
+            typer.echo(f"\nclaude-kit: installing into {target}")
+            for line in scaffold.install_sdlc(src, target, plan, force=overwrite):
+                typer.echo(line)
 
     typer.echo(
         "\nDone. Open the project in Claude Code and run `/sdlc <your task>` to start the pipeline."
@@ -281,6 +293,7 @@ def package_org_pack(
         "a distributable plugin directory for an internal registry.\n"
         f"(given: pack={pack}, out={out or 'dist/org-packs/'})"
     )
+    raise typer.Exit(2)  # not a successful no-op — signal "unimplemented" to scripts/CI
 
 
 @app.command("install-org-pack")
@@ -300,6 +313,7 @@ def install_org_pack(
         "safe upgrades.\n"
         f"(given: source={source}, target={'user (~/.claude)' if user else 'repo (.claude)'})"
     )
+    raise typer.Exit(2)  # not a successful no-op — signal "unimplemented" to scripts/CI
 
 
 @research_app.command("import-sources")
@@ -316,6 +330,7 @@ def research_import_sources(
         "(never copying proprietary text), and require human approval before adding anything.\n"
         f"(given: {sources})"
     )
+    raise typer.Exit(2)  # not a successful no-op — signal "unimplemented" to scripts/CI
 
 
 def main() -> None:

{claude_code_kit-0.21.0 → claude_code_kit-0.22.0}/src/claude_kit/hooks.py

@@ -18,6 +18,7 @@ from typing import Any
 # --- inline guard commands (no script file needed) -------------------------------------------------
 
 _RM_RF_GUARD = (
+    "command -v jq >/dev/null 2>&1 || exit 0; "
     "CMD=$(jq -r '.tool_input.command'); "
     "if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then "
     "echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths "
@@ -28,6 +29,7 @@ _RM_RF_GUARD = (
 # ':' before and a space/end after, so legit branches that merely contain the substring
 # (maintenance, mainframe-fix, remaster-ui, domain-model) are NOT blocked.
 _PUSH_GUARD = (
+    "command -v jq >/dev/null 2>&1 || exit 0; "
     "CMD=$(jq -r '.tool_input.command'); "
     "if echo \"$CMD\" | grep -qE 'git[[:space:]]+push.*[[:space:]:](main|master)([[:space:]]|$)'; "
     "then echo 'BLOCKED: refusing to push to main/master — use a feature branch and a PR.' >&2; "
@@ -35,6 +37,7 @@ _PUSH_GUARD = (
 )
 
 _SECRETS_GUARD = (
+    "command -v jq >/dev/null 2>&1 || exit 0; "
     "FP=$(jq -r '.tool_input.file_path // empty'); "
     'if echo "$FP" | grep -qE \'(^|/)\\.env$|\\.pem$|\\.key$|(^|/)id_rsa|(^|/)id_ed25519|'
     "(^|/)credentials(\\.json)?$|\\.p12$'; then "