chore: sync private v5.5.0 (8bb0ffd)

[agent-kit-startup]

Summary

• Automated allowlist sync from the private source of truth.
• Release v5.5.0.
• Head branch sync/v5.5.0-8bb0ffd.

Release notes

Added

• Kit-repo domain skill .cursor/skills/domain/llm-security-ops/ (SKILL.md + owasp-llm-map.md, local-lab-ops.md, mitigation-patterns.md): OWASP Top 10 for LLM Applications 2025 detect/mitigate/review checklists plus local LLM lab ops (Docker Compose + Ollama), distilled from the external Urutau-LLM-Lab curriculum. Project-owned and one-way: not a registry member, not a pack member, no L0 command, not consumer-installable — it layers on the security-reviewer agent and cybersec pack without replacing classic AppSec checklists. Educational/defensive only (no exploit payloads or flags in-tree); the lab itself stays external and unvendored. ADR 2026-08-17_urutau-llm-lab-external-curriculum-domain-skill.md; first member of the .cursor/skills/domain/ scaffold (ADR 2026-08-02).
• Consumer install docs name --force-root and the start-from-zero path for the first time: docs/getting-started.md gains Project root guard (which shapes are refused, warn-vs-refuse by interactivity) and Starting from an empty folder (git init recommended, --force-root, or the interactive Proceed anyway? yes). install.md mirrors both. Installing without Git stays supported - /agent-kit-onboard still owns the Git pillar and the CLI never runs git init for you.
• Audit wait-state garbage collection: liveness of .cursor/context/audit-wait/<slug>.json is deadline vs wall clock, not status: "armed". Any arm or poll expires that slug's own dead file on contact (status -> timeout, remainingBudgetSeconds -> 0, with armEpoch, deadline, backend, implementerModel, reviewerModel, and any cloudAgentId / cloudRunId preserved), so a stale arm is never resumed as live leftover budget. New opt-in sweep --gc-wait-state (or AGENT_KIT_AUDIT_GC_WAIT_STATE=1) walks every wait-state file, expires each dead armed one, skips live and already-terminal files with one line per decision, and with no plan argument sweeps and exits 0 without starting an audit; --dry-run previews. No new status outside the ADR enum (armed | ready | timeout | soft-fail). Tests .cursor/scripts/plan-external-review-atomic-wait.test.mjs.
• Field Report owed can now close honestly in the Claude CLI lane. When a slug's wait-state is terminal-and-dead (status: "timeout"/"soft-fail", or "armed" past deadline) and a genuine post-hoc plan-monitor-<slug>.md exists on disk, /run-plan and /run-plan-all offer an owed-close HITL: Adopt existing monitor (routes into /plan-review-triage <path>; the durable triage heading records reviewed-by-adoption) or Ack owed without review (closes as acked, recorded unreviewed). The earlier exit 3 stays 3, the wait-state status is never rewritten to ready, and a duplicate re-arm against already-merged work is no longer the only sanctioned route. Not now leaves the row owed.
• Audits pre-flight (externalPlanReview.preflight) also refuses or warns on unsatisfiable config: enabled: true with backend pinned "claude" in the Claude CLI lane can only end owed (audits are a non-goal there, and a pinned Claude reviewer against a Claude implementer is an honest same-model skip), and midBatchAudits: true multiplies it across a queue. warn surfaces the combination once with the outs (backend: "auto", "cursor", "cloud"); block does not start the run or the queue. /run-plan-all checks before the confirm Ask. A growing owed pile is no longer the only signal.
• Audit sessions gain a host-global ceiling, a bounded lifetime, and a visibility surface alongside the per-workspace cap. The 2026-08-14 incident piled 26 detached agent-kit-audit-* sessions across four workspace tokens (13/10/2/1) on one 16 GB host while every token stayed under AGENT_KIT_AUDIT_SESSION_CAP=20 — the cap is per token, the exhausted resource is the host. Ceiling: the launcher now also counts detached sessions across the whole agent-kit-audit- namespace (foreign tokens and legacy unscoped names included) and refuses to spawn at AGENT_KIT_AUDIT_SESSION_HOST_CAP (default 24: at or above the per-token cap so it cannot shadow it, below the observed 26-session collapse; 0 disables). The refusal reuses the existing soft-fail shape (no new exit codes) and prints a per-token breakdown stating that the workspace-scoped dispose command only reaps this workspace's share. Attribution is unchanged: reap and dispose stay owned-token-only, and the --dry-run audit-sessions: owned line is byte-identical, with a new audit-sessions-host: line beside it. Lifetime: the detached tmux/screen spawn is now self-terminating at spawn — wrapped with timeout/gtimeout when available, else a watchdog subshell signaling only the session's own process group — after AGENT_KIT_AUDIT_SESSION_MAX_AGE seconds (default 3600; 0 disables), so a forgotten session never depends on a later launcher run to die (the opt-in AGENT_KIT_AUDIT_REAP sweep stays a separate mechanism). Attached and foreign-token sessions are never killed; emulator/Terminal channels stay advisory; the 60s progress gate remains a launch honesty check, not a lifetime. Visibility: the sessionStart hook emits one fail-open section with the host-wide detached count and oldest age (only when count >= 1; silent on zero/missing tool/error, 2s timeouts), and Mission Control exposes system.detachedAuditSessions ({count, oldestAgeSeconds}|null) with a conditional note in the Processes section. Dogfood cursor_audit_session_cap_host_scope_2026_08_14.md; ADR 2026-07-30_audits-pty-progress-gate-zombie-policy.md amended 2026-08-17.
• guard prompt detects hyphenated vendor sk- keys (sk-ant-api03-…, sk-proj-…) via a new sk-hyphenated-vendor pattern. openai-sk is /\bsk-[A-Za-z0-9]{20,}\b/ and its body class excludes -, so those keys returned hits: [] — indistinguishable from a clean prompt, with the fail-open prompt hook as the only net. maskSecretExcerpt learned the hyphen in the same change, so the new detection cannot put raw key material into SecretHit.excerpt. Fail-open posture is unchanged. Memory errors/2026-08-14_guard-secrets-scope-vs-claims.md.
• Claude Code consumer adapters, opt-in via install --claude (default install output unchanged without the flag): .claude/commands/<name>.md thin pointer adapters for every installed .cursor/commands/*.md (no command prose copied, overlay-tracked so hand edits survive a re-run), and a SessionStart hook merged idempotently into .claude/settings.json so the same session context Cursor gets from sessionStart now auto-loads in Claude Code too. agent-kit hook session-start gained --format claude (plain stdout, live-docs-verified as the shape Claude Code's SessionStart hooks actually consume — no JSON wrapper, no node -e unwrapper needed in consumer settings); --format cursor stays the byte-identical default. An existing .claude/settings.json that fails to parse is never touched — install prints the hook entry to paste in by hand instead. ADR 2026-08-13_claude-cli-kit-load-bootstrap.md amended 2026-08-21 (reverses its own discarded SessionStart-hook alternative; the mechanism was always sanctioned by 2026-07-29_cli-invariants-thin-hook-adapters.md, only the Claude Code surface was closed). Dogfood cursor_claude_code_consumer_adapters_prototype_2026_08_16.md.
• agent-kit doctor reports an environment pillar (bin-on-PATH, npm global prefix writability, Node version, shell profile) via a new env field in --json output (env.binOnPath, env.npmPrefixWritable + env.npmPrefix detail, env.nodeVersionOk + env.nodeVersion, env.shellProfile + env.shell) and a human "environment:" summary section. Read-only diagnostics, no writes.
• agent-kit setup-global: self-heals a root-owned npm global prefix (relocates to ~/.npm-global, fixes PATH via the detected shell profile with an idempotent marker comment, reinstalls globally, then verifies), with per-step confirmation, --dry-run, and a safe non-interactive fallback (prints manual copy-paste steps, mutates nothing). Never sudo/chown. Invoke via npx @dadado/agent-kit-cli setup-global (works before a global install) or bare agent-kit setup-global after one.

Changed

• install/init's post-install "what now" line is now environment-aware: printInstallEpilogue() prints a 3-option guided block (keep using npx / run setup-global / manual steps) when a bare agent-kit isn't on PATH yet, instead of the old static npx-ephemeral hint. When the bin is already on PATH, it prints one short positive line instead.
• classifyInstallError (packages/cli/src/utils/terminal.ts) distinguishes a root-owned npm global-prefix EACCES (new npm-global-eacces kind) from the generic eperm kind, pointing recovery at npx @dadado/agent-kit-cli setup-global plus the manual one-liner instead of the generic npm-cache-ownership hint.

Fixed

• validateProjectRoot no longer treats any directory with .git as a project root. A root that has .git and two or more immediate child directories that are themselves repositories is a parent-of-repos: refused in non-interactive mode, warned with a default-no Proceed anyway? prompt interactively. Previously npx @dadado/agent-kit-cli install one level above the intended project wrote L0 into the wrong grain, silently under --yes/CI. The scan is one level deep, skips dot-directories and node_modules, stops at the threshold, and is capped at 200 entries. Threshold is 2 because a single nested repo is the normal vendored/submodule shape; a child-directory count alone would false-positive on monorepos. A root that already has .cursor/agent-kit.json is never re-flagged. --force-root still bypasses, and update gets the same behaviour.
• agent-kit init runs the project-root guard. It is a compat wrapper over performInstall, which writes L0, but it never called confirmProjectRoot - so init in a blank no-git folder or a parent-of-repos root wrote the tree with no confirmation, bypassing the guard entirely. It now confirms the same way install does and accepts --yes / --force-root.
• Root refusals print what to do instead. Validation returns a recovery block next to the short reason, and install / update / init print it on a hard refusal: git init here (recommended), --force-root, or yes at the interactive prompt. The empty-folder refusal used to name only --force-root, which no consumer doc mentioned.
• Post-install copy stops implying a bare agent-kit is on PATH. npx @dadado/agent-kit-cli install is ephemeral and never links bin.agent-kit, so docs/getting-started.md now leads with the two honest invocation forms (npx @dadado/agent-kit-cli <subcommand>, or npm i -g @dadado/agent-kit-cli then bare agent-kit) and its command table lists subcommands rather than a PATH binary; install.md and the README Mission Control fences follow. install and init share one nextStepAfterInstall / ONGOING_CLI_INVOCATION pair, pinned by tests. npx stays ephemeral - only the copy changed.
• Guard and secrets prose no longer advertises coverage the invariants do not cast. guard shell --help and the shell-guard.ts header call it a git-workflow / protected-branch deny-list instead of "the destructive deny-list": SHELL_DENY_RULES is five git-scoped rules and rm -rf /, chmod -R 777 /, dd … are allowed by design (ADR 2026-07-29_cli-invariants-thin-hook-adapters.md) — the claim was renamed, no rule was added and ALLOW_MAIN_PUSH is untouched. SECRET_PATTERNS states its relation to pre-commit check-secrets as one-way (the prompt scan is a strict superset; the hook greps the single json-secret-kv expression under *.json|*.js|*.ts|*.env, so .md / .yaml / .sh / dotfiles are scanned by neither lane) instead of claiming alignment. Each sentence is now pinned by a test against the rule set, the pattern ids, and the hook file, so prose cannot drift.

Source

• Commit: 8bb0ffd
• Head branch: sync/v5.5.0-8bb0ffd

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.