kit 6.0.0

The deletion major. 6.0 contains ONE change: the deprecation cycle announced
across the 5.x line completes, and the six deprecated MCP tools leave the
surface. No CLI command changes, no config changes, no new capability — if
you never called those six MCP tools, 6.0 is a no-op upgrade. The major
number exists because semver requires removals to happen in one.

Removed

• Six deprecated MCP tools (kit_env, kit_ci, kit_install,
  kit_login, kit_add, kit_standards) are no longer registered — the MCP
  surface lands at 10 tools. Their CLI commands are unchanged; only the
  MCP exposure ends, after notice via runtime deprecation markers (since
  5.16, kit_standards since 5.20), the reference/README rows, and the guide.
  Migrations, all shipped before this removal: kit_review (with
  stages/category) covers the standards gate read-only and scoped;
  kit_context covers env inspection; kit_fix covers tool install;
  kit_run remains the escape hatch for setup-time/CI commands (shell
  contexts by definition). The audience exception list in the contract tests
  is deleted — human/harness commands are now MCP-free with NO exceptions —
  and the docs↔surface fiction gate purged the six names from every listing.

Fixed

• READ_ONLY_SAFE allowlist corrected to the 6.0 truth. The self-audit
  R8 completeness gate caught that the read-only MCP allowlist still carried
  three removed tools and lacked kit_review/kit_map/kit_memory — exactly
  the drift it exists to catch.

---

Full changelog: https://github.com/sandstream/kit/blob/v6.0.0/CHANGELOG.md

Verify this release:

git tag -v v6.0.0
npm audit signatures

kit 5.27.0

Added

• kit guard — the install gate reaches your own terminal (observe mode).
  The agent loop was already gated (PreToolUse gate-bash across 11
  harnesses), but a human typing npm i x / npx y / brew install z in
  their own shell reached the machine ungated. kit guard install writes
  PATH shims for the install + fetch-and-run family (npm npx pnpm yarn bun bunx pip pip3 pipx uv uvx brew gem cargo) that run the SAME hardened
  parser + triage verdict the agent gate uses, and log what it WOULD decide
  to ~/.kit/guard-observe.jsonl. v1 is observe-only by the exec-broker
  discipline (observe → evidence → enforce, the 7.0 track): a shim never
  blocks and never breaks the tool — kit missing or crashing means unchanged
  behavior, non-install subcommands pass silently, KIT_GUARD_BYPASS=1 skips
  observation for one call. Shims are marker-tagged (foreign files never
  clobbered), the shell-rc PATH block is marker-managed and idempotent, and
  kit guard status / uninstall complete the loop. Verified end-to-end in
  a sandbox with the real generated shims.

---

Full changelog: https://github.com/sandstream/kit/blob/v5.27.0/CHANGELOG.md

Verify this release:

git tag -v v5.27.0
npm audit signatures

kit 5.26.0

Added

• kit review scopes: --stages + --category. collectReview (and
  therefore both surfaces — kit review --stages check,standards --category general and the kit_review MCP tool's stages/category params) can run
  a subset of the four gates, canonical order kept regardless of input order.
  Enum-validated: an unknown stage is a refusal with the valid list, never a
  silent full run. stages: ["standards"] is the fast, read-only lint loop —
  seconds instead of the full audit's security scan per iteration — and it is
  the migration path that survives kit_standards' 6.0 removal (the
  deprecation text now names it). The report stays honest under scoping: ok
  covers exactly the stages that ran, and the stages array shows the scope.

---

Full changelog: https://github.com/sandstream/kit/blob/v5.26.0/CHANGELOG.md

Verify this release:

git tag -v v5.26.0
npm audit signatures

kit 5.25.0

Added

• The managed block carries its own bootstrap line. The README one-liner
  tells an agent how to install kit — but kit init replaces it with the
  managed rules block, which said "Start: kit check" and nothing about a
  missing binary. The teammate who cloned a kit-managed repo got the block,
  not the line, and their agent met command not found and had to guess.
  The block now opens with: if kit is missing (fresh clone/machine),
  install it, then continue. The docs↔block drift gate shipped in 5.24.0
  fired on this change exactly as designed and forced the README example to
  follow; kit-public's own CLAUDE.md updated with it (dogfood). Existing
  repos pick the line up on their next kit agent-config / kit init run
  (the block is idempotent — only the marker-delimited region updates).

---

Full changelog: https://github.com/sandstream/kit/blob/v5.25.0/CHANGELOG.md

Verify this release:

git tag -v v5.25.0
npm audit signatures

kit 5.24.0

The adoption release — three pieces that close the "new project, nothing set
up, nobody reminded me" loop: one pasted line lets an agent bootstrap kit
itself, the statusline tells every session in an un-kitted repo what to do
next, and your standing service preferences apply themselves at init.

Added

• User-level init defaults. ~/.kit/defaults.toml with [init] services = ["sentry", "posthog"] is merged by BOTH init surfaces (the CLI flow and the
  MCP kit_init tool) after stack detection — the operator's standing
  preferences, declared once, outside any repo (personal taste, not project
  truth: the generated .kit.toml stays the committed source). Fail-safe by
  construction: missing file is the normal case, malformed toml degrades to no
  defaults, unknown service ids are REPORTED (CLI warn / unknownDefaults in
  the MCP response), never silently dropped. KIT_DEFAULTS_FILE overrides the
  path (in kit config knobs). PostHog joins the service registry as an
  informational service (the resend pattern: detected via its SDKs, env-key
  check, no CLI login) so the default is first-class.
• Statusline adoption nudge. kit:full 1/6 in an un-kitted repo was true
  but actionless. The statusline — and therefore the SessionStart context line
  every harness session gets — now appends the ONE next step from the first
  subsystem gap: kit:full 1/6 → kit init, then → kit install,
  → kit secrets, … as adoption progresses. Complete score keeps today's
  output.
• The one-line agent bootstrap (docs). Paste one line into
  CLAUDE.md/AGENTS.md and the next agent session installs kit, runs
  kit init (which writes the managed rules block — the one-liner retires
  itself), verifies with kit check, and hands the human only the interactive
  steps. With the honest trust-root note: the first install cannot self-triage
  — verify provenance (docs/VERIFY.md) before pasting into an org template.

---

Full changelog: https://github.com/sandstream/kit/blob/v5.24.0/CHANGELOG.md

Verify this release:

git tag -v v5.24.0
npm audit signatures

kit 5.23.0

Changed

• bumblebee pin bumped 0.1.1 → 0.1.2, with the digests verified by download rather than
  copied. All four release tarballs were fetched and their SHA-256 recomputed against the
  release's checksums.txt (4/4 match); v0.1.1's published checksums were also confirmed to
  equal the digests already embedded here, cross-validating the source.
  • Threat intel: 6 → 11 catalogs, newest authoring date 2026-05-18 → 2026-06-18
    (65 → 38 days, under the 60-day staleness threshold, so the advisory clears). Adds
    glassworm, trapdoor-crypto-stealer, mastra-2026-06-17, laravel-lang-2026-05-23,
    mini-shai-hulud-redhat-cloud-services.
  • Inventory coverage widens into kit's own domain: an agent-skill ecosystem
    (skills.sh / vercel-labs lock files, including the project-local skills-lock.json kit
    already manages), homebrew install receipts, and ~/.claude.json MCP parsing for
    Claude Code's user- and project-scoped servers.

Fixed

• Corrected the 5.22.0 claim that a newer bumblebee release brings no fresher threat
  intel. It does here. The error was methodological and is now recorded in
  bumblebee-update.ts so it is not repeated: the six pre-existing catalogs are
  byte-identical across the two tags, and raw.githubusercontent.com cannot list a
  directory — so comparing only the filenames already known makes five ADDED catalogs
  invisible and looks like "nothing changed". Compare the release tarball, not a guessed
  file list. The suggestion text no longer asserts either direction: whether a bump
  refreshes the catalogs depends on the release, so it points at the evidence instead.

---

Full changelog: https://github.com/sandstream/kit/blob/v5.23.0/CHANGELOG.md

Verify this release:

git tag -v v5.23.0
npm audit signatures

kit 5.21.0

Added

• Three stack-aware hint rules. The deterministic hint engine (one tip per
  run, shown once, KIT_NO_HINTS silences, fail-safe detectors, zero LLM) now
  also surfaces the right workflow at the moment the repo's own state makes
  it relevant: .github/workflows/ present but never gha-audited → kit gha-audit; a kit-managed repo with sources but no findings baseline → kit baseline freeze; agent transcripts on the machine but no memory store →
  kit memory index.

Fixed

• The a11y/token scanners no longer flag markup in comments. A commented
  <input type="datetime-local"> example inside a docstring was reported as an
  unlabeled input, and a hex value in a comment as a token bypass. Comment
  interiors (slash-star blocks incl. the JSX-wrapped form, HTML comments,
  // lines — URLs preserved) are now blanked newline-preserving before
  matching, so finding line numbers stay stable. Stripping can only reduce
  findings, so existing baselines stay valid.
• The pinned-versions check is workspace-aware. "@repo/ui": "*"
  (npm-workspaces convention) and workspace:/file:/link:/portal:/
  catalog: protocol refs resolve to the local tree, never the registry —
  flagging them as unpinned was a false positive, and "pinning" them would be
  wrong. External * and registry ranges still flag exactly as before.
  (Both fixes from a Turborepo user's false-positive report — sharpen the
  matching, never loosen the gates.)
• Hint tests are host-isolated. The hints test env now pins
  KIT_CLAUDE_DIR and clears KIT_MEMORY_DB, so no test can see the host's
  real transcripts or memory store.

---

Full changelog: https://github.com/sandstream/kit/blob/v5.21.0/CHANGELOG.md

Verify this release:

git tag -v v5.21.0
npm audit signatures

kit 5.20.0

Added

• kit review is a structured verdict, not console output. The meta-runner
  was print-and-return-bool: --json emitted four concatenated sub-documents
  (the ADR stage ignored the flag entirely), and nothing machine-readable
  described the audit as a whole. collectReview now runs every stage's shared
  gate — check (via the new runCheckGate collection core), design
  (runDesignGate), standards (runStandardsGate), ADR (runAdrGate) — and
  returns one ReviewReport { ok, failed, stages: [{ stage, ok, summary, findings }] }. The CLI is a renderer on top; kit review --json emits ONE
  document and exits 1 on red. Same discipline as computeCheckVerdict: the
  collection can no longer fork between surfaces. kit review is now a pure
  read — kit check keeps its CLI extras (PAL sync, attestation, hints,
  scanner self-heal).
• kit_review MCP tool — the full audit for shell-less agents, serializing
  the same collectReview report. concise: true drops pass/skip rows while
  per-stage summary counts keep totals honest (nothing silently truncated).

Deprecated

• kit_standards leaves the MCP surface in kit 6.0 — kit_review runs
  that gate as its standards stage; scoped runs (--category) go via
  kit_run. With the five existing deprecations the surface lands at 10 tools
  after 6.0. Both docs↔surface drift gates updated to pin the six.

Fixed

• The hook-skip sentinel's STAMPING half is now tracked. 5.19.0 shipped the
  post-commit detector, but the pre-commit block that writes the sentinel it
  reads existed only machine-locally (via kit fix) — so a fresh clone logged
  a false sentinel-missing skip on every commit (the 5.18.0 release commit is
  a recorded example). Both halves now travel with the repo. Plus gitignore
  hardening: kit's local state files (.kit-skipped-commits.jsonl,
  .kit-audit.pending, .env.local.*), .opencode/ alongside the other
  agent-harness dirs, and .toml/extensionless-hook variants of the cloud-sync
  conflict-copy patterns.

---

Full changelog: https://github.com/sandstream/kit/blob/v5.20.0/CHANGELOG.md

Verify this release:

git tag -v v5.20.0
npm audit signatures

kit 5.19.0

Fixed

• The install gate no longer trips on shell redirections. Found live while
  verifying the 5.18.0 release: the gate blocked the release-verification
  install of sandstream-kit itself, because the segment splitter cut on the
  & inside stderr-dup redirections (shearing commands into a garbage 2>
  segment) and redirect tokens like >/dev/null reached the package matcher
  and fail-closed legitimate installs. & now splits only as a job-control
  separator, and redirections are stripped as I/O plumbing on the undequoted
  token stream — a quoted redirect-shaped operand still fail-closes, a
  background & still separates segments, and a stderr-dup piped into an
  xargs-driven install keeps its fail-close. Strictly precision, never
  looseness: all 75 existing bypass-resistance tests pass unchanged.

Added

• The hook-skip sentinel ships complete. The tracked pre-commit hook wrote
  the ran-sentinel, but the post-commit detector — which flags
  git commit --no-verify bypasses to .kit-skipped-commits.jsonl — sat
  untracked in the working tree: half a mechanism. Now tracked, and verified
  live (it flagged a rebase commit exactly as designed). Plus mise.toml
  pinning node 22 to match engines.node.

---

Full changelog: https://github.com/sandstream/kit/blob/v5.19.0/CHANGELOG.md

Verify this release:

git tag -v v5.19.0
npm audit signatures

kit 5.18.0

The surface-audit release: asked "does every user-facing surface show what the
mechanism actually does?", the answer was no in four places. All four fixed,
each behind a gate so it cannot silently regress.

Added

• kit adopts its own ADR gate. Three accepted ADRs with enforce blocks now
  gate kit review and the pre-commit hook on kit's own repo: ADR-0001
  (zero-LLM core — no LLM SDK imports in src/), ADR-0002 (dependency floor —
  utility libraries forbidden, a new runtime dep is an ADR-level decision),
  ADR-0003 (the check path never imports src/coverage/* framework mappings,
  keeping them extractable to a plugin). The engine shipped in 5.7–5.10; this
  is the adoption — the same arc as scope-needs, closing the last
  "mechanism without adoption" gap found this session. All three rules
  canary-verified.
• Docs ↔ MCP drift gate (docs-mcp-sync.test.ts). The MCP docs documented
  a tool set that never shipped (kit_configure, kit_adapter_*) and missed
  every real tool added since, including kit_triage and kit_memory. Both
  files are rewritten against the real 15-tool surface, and the gate enforces
  sync in both directions: every KIT_MCP_TOOLS entry must appear in the
  reference and the README, and no doc may mention a kit_* tool that does
  not exist — fiction is a build failure. The reference must also mark exactly
  the five 6.0-deprecated tools as deprecated.

Changed

• kit help is audience-filtered. The five harness commands (gate-*,
  statusline) are hook stdin protocols the agent harness invokes — never a
  browsing human — so the default listing hides them behind a counted note
  ("+ 5 harness hook commands — see them with kit help --all"), never a
  silent drop. kit help --all shows everything; kit help <cmd> resolves a
  harness command directly regardless. Data-layer help parity is untouched.
• README's MCP section now lists the real tool table with deprecation markers,
  names kit_triage instead of the deprecated kit_add, and states the
  CLI-first rule. docs/COMMANDS.md points agents at the OpenCLI contract
  and documents x-kit-audience.

---

Full changelog: https://github.com/sandstream/kit/blob/v5.18.0/CHANGELOG.md

Verify this release:

git tag -v v5.18.0
npm audit signatures