v5.8.0

Added

• Pending-only plan index. agent-kit plan-index (and sessionStart) writes .cursor/context/plan-index.json from HANDOFF-named plans. /continue-plan, /run-plan-all, and Broad Intake read index + HANDOFF; they do not glob .cursor/plans/*.plan.md.
• Agent signature guard in git-hooks/prepare-commit-msg. The hook was Cursor-only (it removed one Co-authored-by: Cursor trailer). It now strips any known coding-agent signature or session link from the commit message before it is recorded: Claude Code Co-Authored-By: Claude ... <noreply@anthropic.com> and Claude-Session: https://claude.ai/code/... trailers, Cursor, Copilot, Codex, Gemini, Devin, Aider and peer co-author trailers, the 🤖 Generated with Claude Code footer and Made with Cursor lines, and agent session URLs. Human Co-authored-by: trailers are kept (matching is on agent names, agent mail domains and session hosts, never on the trailer key). The pattern list is embedded in the hook (--list), so the documented single-file copy install stays self-contained, and a new --check [file|-] mode scans a message or PR body and exits 1 with the offending lines (the /git-staging and /git-prod routines run it as a hard stop, see the next bullet). POSIX sh, BSD and GNU grep. node --test scripts/git-hooks-prepare-commit-msg.test.mjs (in pnpm test:root-node). Scope, honestly: the hook strips on the machine where it is installed and does not rewrite history; the private factory branches already carry such trailers on past commits, while the public mirror's sync commits are written by scripts/sync-public.mjs with their own message and were found clean. Install: git-hooks/README.md.
• Public repo is humans-only, technically now, not just by policy. git-hooks/pre-push and agent-kit guard shell both refuse a direct write to the public mirror repo (agent-kit-startup/agent-kit, never this private repo) — pre-push blocks any push whose remote URL resolves there regardless of branch, and the shell guard's new public-repo-direct-write rule blocks git push (by URL, -R/--repo, or a named remote resolved via git remote -v) and gh pr create / gh pr merge naming that repo directly, same ALLOW_PUBLIC_PUSH=1 escape shape as the existing ALLOW_MAIN_PUSH gate on both layers (independent of it — the public repo's main branch still needs both). gh issue * and gh api against the public repo are named, not-covered gaps (not silently enforced). Agents ship product changes to the public repo only through scripts/sync-public.mjs via CI, as before; this closes the "an agent shell could otherwise push/PR there directly" gap. Local guard only — it is not a substitute for GitHub branch protection or CODEOWNERS on the public repo itself, which stay an operator decision.
• Agent signature gate in /git-staging and /git-prod (/kit-staging and /kit-prod inherit it). Both routines now run git-hooks/prepare-commit-msg --check as a hard stop, in the same shape as the Evidence-checks merge gate: /git-staging scans the outgoing commit messages (git log origin/staging..HEAD --format=%B) before git push and the PR body (gh pr view <N> --json body) before gh pr merge; /git-prod scans the whole promotion delta (git log origin/main..origin/staging --format=%B) and, on the PR lane, the staging→main PR body before the merge to main. Exit 1 lists the offending lines and the routine stops until the message is reworded; exit 2 (missing hook) counts as red. This closes the "uninstalled hook" gap: a Co-Authored-By: Claude ... / Claude-Session: trailer, a Generated with <agent> line or an agent session URL that reached a branch commit (no hook, --no-verify, a commit made elsewhere) is caught before it can land on staging or main, where a squash merge would otherwise copy it into the branch history. Scope, honestly: the gate runs on the machine executing the routine; there is no server-side check on the private repo yet. SoT: .cursor/commands/git-staging.md step 5, git-prod.md step 5, autogit/gitupdate.md Prompt git staging §8–9 and Prompt git prod §5 and §7; git-hooks/README.md.
• Install on a fresh Ubuntu 24.04 server (docs/install-ubuntu24-bare-metal.md): a consumer recipe for a bare-metal or VM box with no Node.js and no terminal attached (cloud-init, Ansible, bash -c over SSH). NodeSource Node 20+ unattended, git init to clear the project-root guard without a prompt, npm_config_cache=... npx -y @dadado/agent-kit-cli@latest install --yes with a cache directory owned by the install, status to verify, and a recovery table for the EPERM cache-ownership and exit 255 signatures. Same CLI-first path as Getting Started, Port B stays the fallback, L0 only (no Ubuntu pack). Validated end-to-end on a clean Ubuntu 24.04 host on 2026-09-12: install, status, and the no-terminal (bash -c ... </dev/null) case all completed cleanly, no EPERM or exit 255. Pointers from install.md, Getting Started and the docs index.
• agent-kit run <slash> starts one headless session whose prompt is the L0 command file under .cursor/commands/. --backend auto selects the first installed agent CLI (cursor-agent, then claude). Cursor Ask questions stays Cursor-only; headless confirmations are a numbered list. /git-prod is omitted from the catalog and is never auto-promoted. agent-kit run-plan stays the existing one-tick loop.
• --backend claude for headless plan-loop ticks. agent-kit run-plan --backend claude (and the agent-kit run run-plan alias) runs each tick as headless claude -p under the same one-tick contract as cursor-agent: one to-do per tick, LOOP_TICK_RESULT sentinel, /git-staging on a diff, never /git-prod. --backend auto no longer fails on a machine where only claude is installed. ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN pass through to the tick for gateway routing and are redacted in every tick log, tip and error on every backend, cursor-agent included (chunk-boundary safe; the gateway host and common encoded forms — JSON-escaped, URL-encoded, base64 at value start — are elided too, not only the exact value); agent-kit run <slash> on the claude backend gets the same env passthrough, log redaction and headless permission flags (--dangerously-skip-permissions --permission-prompts none), so a dispatched git-staging can actually commit. The claude child env drops the four nested-session markers the claude CLI itself strips (CLAUDECODE, CLAUDE_CODE_SESSION_ID, CLAUDE_CODE_CHILD_SESSION, CLAUDE_CODE_BRIDGE_SESSION_ID). Pre-spawn checks: claude >= 2.1.259 and the .claude/commands/run-plan.md adapter (agent-kit install --claude), each refused with a named cause. Opt-in caps AGENT_KIT_CLAUDE_MAX_TURNS / AGENT_KIT_CLAUDE_MAX_BUDGET_USD (no default). A tick whose stream-json result carries is_error stops the loop with the result subtype on the console. Console tips print workspace-relative paths and collapse the home directory to ~. Reverses the Not --backend claude plan-loop ticks non-goal at every documented site under the reservation in ADR 2026-08-13_claude-cli-ultracode-orchestration-thin-adapter.md; the audits reviewer key externalPlanReview.backend: "claude" is a different field and is untouched. Plan major-tom Phase 1; ADR 2026-09-04_major-tom-autonomous-mode.md. MINOR.

Changed

• Cursor Projects (beta, shipped 2026-09-10) studied and decided: no structural change. Primary-source study (docs/research/cursor-projects-study.md) and ADR 2026-09-12_cursor-projects-thin-adapter.md conclude Mission Kit's continuity model (HANDOFF/plans), plan-loop BackendId (cursor-agent/claude only), Mission Control's local-only/copy-only posture, and thin hook adapters all stay as-is — Projects is a Cursor-native surface the operator may use directly. docs/cursor-3-features.md (retitled from "Cursor 3.0 Features," same filename) gains a Projects row; docs/cursor-native-audit.md gains a Projects inventory row, a refreshed last-refreshed date, and records that agent-kit cursor-awareness --check does not detect Projects (no feature-keyword diff, only open action items and a version-number baseline).
• Mission Control TUI paints field labels with the muted visual-kit token and status / lifecycle values with dashboard --green / --yellow / --red / --cyan. NO_COLOR, CI, and non-TTY frames stay uncolored.

Fixed

• agent-kit update no longer silently overwrites a customized hook or script. The consumer overlay that preserves edited kit files now covers .cursor/hooks/ and .cursor/scripts/ in addition to agents, skills and commands. A consumer that widened .cursor/hooks/pre-commit/check-secrets.sh (a security control) lost that edit to a no-version-change apply that printed only + path; the file now stays as the consumer left it, is reported under Preserved customized overlay with its path, and the output says where the change belongs (agent-kit diff, agent-kit contribute, or a single-path protected pin). Unedited hooks and scripts still refresh, including copies shipped at v5.3.0–v5.7.0. The manifest personalization.generatorVersion is also restamped with the applying CLI version on every apply so it no longer disagrees with version after an update (the personalization result file itself is not regenerated).
• install and doctor warn when the running CLI is behind npm latest, honoring the existing updateCheck opt-in and interval (no network on every invoke by default). Recovery and post-install npx copy pin @latest. Mission Control TUI quit is exact q / Q / Ctrl-C, not a substring.
• Mission Control TUI live view: q quits, refresh no longer stacks collectors, a non-git cwd stays quiet, and the CLI pack gate pins dashboard/lib data deps (semantic-model, terminal-snapshot, triage-heading, live-refresh).
• agent-kit update no longer reports success after an apply it could not deliver. The apply path stamps .cursor/agent-kit.json with the version of the CLI executing it (KIT_VERSION), so an update run by a CLI older than the registry silently re-wrote the installed version and still printed Update complete — an operator chasing a new release would re-run /update indefinitely with no signal. The apply now compares the CLI against the registry checkout's version and refuses when it is behind, printing the pinned remedy (npm i -g @dadado/agent-kit-cli@<version>) and exiting 1. --yes does not lift the guard (non-interactive and hook paths are where a capped write hurts most); --allow-stale-cli is the factory/dev escape hatch. A registry checkout with no readable version warns and proceeds. A release can be mid-publish when the new content is already public but npm does not yet serve the matching version; the refusal says so and tells the operator to retry shortly rather than presenting an unfollowable npm i -g.
• update --check names the binary upgrade when the running CLI is itself behind the latest public tag. It previously said only Run /update (Ask confirm) to apply, which cannot reach the reported version from a stale CLI.
• Apply output states the version actually written (v5.6.0 → v5.7.0, or unchanged at v5.7.0), so a capped or no-op run is visible instead of reading identically to a successful bump.
• /update contract gains a required "upgrade the CLI binary first" step ahead of the apply, never applies through an unpinned npx (which can resolve a cached older build and reintroduce the same capping), and asks the operator to report the version transition.
• Consumer install and update copy-paste now uses npx @dadado/agent-kit-cli@latest so a stale npx cache cannot silently run an older CLI after a new publish. Pin @x.y.z when you need a reproducible install. The remaining install --pack, install --claude and update --check fences (docs/bootstrap.md, docs/domain-packs.md, docs/getting-started.md, install.md, packages/cli/README.md) now carry @latest too.