kit 5.1.0

Added

• kit skill test <path> (experimental) — module-discipline linter for a
  SKILL.md. Treats an agent skill as a software module and runs four deterministic,
  zero-LLM checks: contract (required frontmatter present + slug-shaped name +
  non-trivial description + body), trigger (a trigger is declared + no collision with
  a sibling skill's normalized trigger), scope (declared least-privilege —
  allowed-tools present and bounded, wildcard/absent fails), and regression
  (contract+trigger+scope fingerprint vs a committed .kit-skill.snapshot.json, drift
  fails like public-surface.json; --update-snapshot pins it). --gate makes any
  failure a non-zero CI exit; --json for tooling. It is the module-discipline sibling
  of kit triage skill (which answers "safe to install?"). Honest seams stated in every
  run: proving a skill refrains from forbidden actions and stays within its declared
  scope at runtime needs the exec-broker (a later phase), and grading whether the
  output is good is an LLM judgement that kit delegates to an eval harness and never
  runs. Design: kit-research skills-as-software-modules note.
• kit bootstrap (experimental) — one-command cold start for an ephemeral
  environment. Composes setup → identity init → policy pull → profile import
  → memory restore behind one idempotent, non-interactive verb, driven by a single
  platform-injected seed (vault auth + KIT_MEMORY_PASSPHRASE/KIT_MEMORY_BACKUP +
  optional --profile bundle). The floor is fail-closed (config/identity/policy+profile
  integrity — a broken gate aborts); the fuel is fail-open (secrets availability, recall
  degrade to a blank-but-working environment). --json emits a redacted receipt; the
  seed is never fetched, stored, or logged. See docs/ENV_FUELING.md.

Fixed

• Secrets scan (degraded path): substitution expressions are no longer flagged.
  The basic no-trufflehog scan flagged pure template references — ${{ secrets.X }}
  (GitHub Actions), ${VAR} (shell/compose), {{ .Values.x }} (Helm/Jinja),
  $(cmd) (command substitution) — as
  secret-shaped strings; these are the correct way to reference a secret, never a
  literal credential. Found by running the findings sweep against curl/curl
  (workflow files) and simonw/llm (contributing docs) — the only warns on both. The filter is now an exported pure function
  (basicSecretScanFiles) with unit tests; a template-prefixed literal still flags.
• Lockfile handling is ecosystem-aware — no more false-RED on pnpm/bun/yarn/cargo/go/…
  repos (#354). Both signal layers were npm/pip-only: npm audit ran on any
  package.json (erroring into a high-severity audit check failed on pnpm/bun/yarn),
  and the committed-lockfile check only accepted package-lock.json / requirements.txt
  (flagging a healthy repo that commits pnpm-lock.yaml / bun.lock / Cargo.lock /
  go.sum / … as "no lockfile"). Now npm audit skips honestly (not-applicable; deps
  still covered by osv-scanner) when there is no npm lockfile, and a new
  LOCKFILE_ECOSYSTEMS map accepts any valid committed lockfile per present manifest.
  Found by pointing kit's floor at the agent harnesses it integrates with; verified e2e
  (cline/opencode/codex/create-t3-app: 2 false-red high-fails each → skip + pass).

---

Full changelog: https://github.com/sandstream/kit/blob/v5.1.0/CHANGELOG.md

Verify this release:

git tag -v v5.1.0
npm audit signatures