kit 1.14.0

Added

• kit health adds Sentry + Resend sensors (runtime errors + email-delivery). Sentry probes the issues API (GET /api/0/projects/:org/:project/issues/?query=is:unresolved firstSeen:-24h) with SENTRY_AUTH_TOKEN (SENTRY_URL overrides the region) and goes red on new unresolved issues in the last 24h. Resend probes GET /domains with RESEND_API_KEY and goes red (class human — a DNS/customer action, not a code fix) when any sending domain is not verified. Both report unknown (never a false green) on missing creds or a non-OK response. These two are selected by connected-service detection (the registry sees @sentry/* / resend in deps), per the sentinel design's "derive from connected services". Live API smoke pending real tokens; parsers fixture-tested.
• kit health adds a Vercel sensor (failed production deploys). Probes the Vercel REST API (GET /v6/deployments?target=production) with VERCEL_TOKEN, using the projectId/teamId from .vercel/project.json; flags the most recent terminal production deployment as red when its state is ERROR (CANCELED is not red), and reports unknown (never a false green) when the project isn't linked, the token is missing, or the API errors. Reuses the httpGet probe path the GitLab/Bitbucket sensors introduced. Live API smoke is pending a real token; the parsers are fixture-tested.

Fixed

• kit check (tools) and kit doctor now detect tools installed globally via mise use -g. Both decided tool presence/version with mise current <tool> (project-scoped) plus a bare <tool> --version / which <tool> on PATH — so a tool installed globally with mise use -g reported as not installed whenever mise wasn't activated in the shell (its shims aren't on PATH then, and kit's own process doesn't activate it). This made e.g. globally-installed semgrep/trivy invisible in kit check's Tools section even though the security scan ran them (the scanners already resolved mise-first via resolveToolBin). Both now resolve the binary through resolveToolBin (mise which → PATH) before reading its version, closing the gap. checkTools takes the resolver as an injectable parameter (default resolveToolBin) so the global-mise path is unit-tested.
• Service auth checks/logins and the pip-audit / license-checker scans now resolve mise-first too. kit check (service auth) and kit login exec a service's check/login CLI (stripe, vercel, supabase, …) by bare command name, and the pip-audit + license-checker dependency scans did the same — so a mise use -g install was unreachable when mise wasn't activated. All now resolve via resolveToolBin before exec, with a bare-name fallback (npm stays bare — it ships with node and is always on PATH; license-checker still falls back to npx). Completes the mise-first coverage the security scanners (semgrep/trivy/socket/osv/trufflehog) already had.

---

Full changelog: https://github.com/sandstream/kit/blob/v1.14.0/CHANGELOG.md

Verify this release:

git tag -v v1.14.0
npm audit signatures