COMMANDS.md

kit commands

Complete reference for every kit <subcommand>. Last updated 2026-08-30 (kit 6.11.0). Pair this with docs/THREAT_MODEL.md (what data flows where) and docs/DATA_FLOW.md (exact reads/writes per op).

Machine-readable surface: contracts/kit.opencli.json describes every command with its stability tier (x-kit-stability), MCP exposure (x-kit-mcp), and primary audience (x-kit-audience: human for interactive/setup commands, harness for hook stdin protocols like gate-*/statusline that neither humans nor agents invoke directly, or all). It also carries x-kit-accepted-flags, the generated per-command allowlist for long flags kit accepts. Agents should prefer that contract over parsing this document.

Global flags

Flag	Effect
--read-only / --readonly	Activate session-wide refusal of every mutating op. Also honored as KIT_READ_ONLY=1 env.
--non-interactive	Skip all confirmation prompts. Required in CI / agent contexts.
--env=<name>	Select the environment overlay ([env.<name>] in .kit.toml). Also honored as KIT_ENV.
--version / -v	Print kit version + exit.
--help / -h	Print top-level help + exit.

--read-only, --readonly, --non-interactive and --env=<name> may be written before or after the command word — kit --read-only check and kit check --read-only are equivalent. Every command accepts them; a command that rejects unknown flags allows these on top of its own.

[tools] pins say what they check. An exact pin (bun = "1.3.10") is a prefix match on the installed version. latest now means current: kit resolves the newest version the tool's own installer would give and reports drift — ! with 53.1.1 → 59.1.4 available in the tools table — instead of passing because the binary answered --version, which is how ✓ vercel 53.1.1 (need latest) stood for six majors. When the newest version cannot be determined (air-gap, an installer with no registry kit can query, a lookup that timed out) the row is − currency unchecked: <reason> — never a pass. A pin of any, present or * asserts presence only, and says so.

Unknown flags are rejected. Every command validates its flags at dispatch against a declared table (src/flag-surface.ts), prints what it accepts, and exits 1 — a flag that silently does nothing is indistinguishable from a working one, which is how kit check --category security ran the full check for six majors and how kit upgrade --self. (one trailing period) rewrote lock-file timestamps while installing nothing. Everything after a -- separator is passed through untouched (kit run -- pnpm test --watch).

Core lifecycle

Command	Purpose
kit init	Auto-detect project stack → generate .kit.toml + lockfiles.
kit setup [--mode <name>]	6-step orchestrator: install → hooks → login → secrets → agent-config → verify, preceded by a network-posture prompt. --mode (or [setup].mode) selects a preset: full (default) · local · airgap (forces air-gapped posture) · ci · agent · review (read-only) · minimal. --recommended also wires memory + git secret-scan/context-check gates.
kit statusline [--mode <name>]	Compact one-line status (mode score · update available · open PAL count) for Claude Code statusLine or a shell PS1; Codex receives the same text via SessionStart context. Fast, read-only, cached.
kit check	Verify tools / services / secrets / skills / hooks / deploy env / security / tests.
kit check --attest	Opt-in, fail-soft: write a signed .kit-check-attestation.json receipt recording which scanners actually ran + the verdict (HMAC-signed with the machine-local anchor key; never blocks or alters the verdict). Also kit ci --attest / KIT_ATTEST=1.
kit check verify-attestation <file> [--key <k>] [--pin]	Verify a check receipt. HMAC against the local anchor key is authoritative; an Ed25519 receipt's embedded key is untrusted and reports unverified-authenticity unless the key is pinned (TOFU in ~/.kit) or passed via --key.
kit check compare <before.json> <after.json> [--json] [--fail-on-worse]	Diff two kit check --json runs. Lost coverage ranks above a regression — a check that stopped running makes its finding unknown, not fixed, so fail → skip is never read as an improvement. Pure function of the two files; no scan is run. Reports by default; --fail-on-worse exits non-zero on lost coverage, a disappeared check, or a regression.
kit config migrate [--dry-run] [--check] [--force] [--allow-comment-loss]	Migrate .kit.toml to the current schema version (CONFIG_SCHEMA_VERSION). --dry-run (default) prints the plan + value diff and writes nothing; a real run backs up to .kit.toml.backup, re-validates, and restores on any failure; --check exits non-zero on a stale config (CI). v0→v1 only stamps the version (baseline no-op). An add-only migration is applied as a text edit, so comments and formatting survive; anything more structural would re-serialise the file and is refused while comments exist unless --allow-comment-loss is passed. --dry-run says which of the two would happen.
kit config recommend [--json]	The recommended posture as a report — what this repo would gain, writing nothing. Each row says what the piece BUYS, not merely that it is absent: memory capture, the pre-commit secret scan, the post-merge audit, [context], the pre-push context check, [policy.agent_writes], [deploy], [governance.audit] require_anchor. kit setup applies the hook/memory pieces; the [section] ones are yours to declare.
kit config sections [--json]	Every .kit.toml section: what it configures, what declaring it buys, the smallest example, and which ones this repo already declares. The same table generates docs/CONFIGURATION.md, and a test fails when a section exists in the config type with no entry — or when an entry describes a section kit no longer has.
kit coverage [--standard=<key>|all] [--list-standards] [--json]	Evidence maps that bucket kit's checks/rules per control as auto-verified / gap / manual / n-a, across 8 pinned standards: ASVS 4.0.3 L2 (default), OWASP LLM/Agentic/MCP Top 10, NIST SSDF 800-218A, NIST 800-53 Rev. 5 (control-family level), AIUC-1, GCP WAF Security. Evidence, not a compliance attestation (never claims "compliant"); --json for GRC tools. experimental.
kit browser doctor [--json]	Diagnose browser-verification readiness from [browser], selecting project Playwright, system Chrome, CDP, or a blocker with one human action. experimental.
kit browser status [--json]	Short status/strategy summary for browser verification.
kit browser cdp-url [--json]	Print the selected Chrome DevTools Protocol URL when one is configured or reachable.
kit browser playwright-env [--json]	Print shell exports (KIT_BROWSER_STRATEGY, KIT_BROWSER_CDP_URL, PLAYWRIGHT_BROWSERS_PATH) for browser test runners.
kit monkey-test plan [--json]	Detect stack, package manager, Playwright, dev server, seed, local env source, money provider markers, harness files, and static security findings for the money-app release gate. experimental.
kit monkey-test init [--force] [--json]	Create/update the managed Playwright monkey-test harness (playwright.monkey.config.ts, tests/monkey/*, .kit/monkey-test/*) without overwriting unmanaged files unless forced.
kit monkey-test run [--base-url <url>] [--start-command <cmd>] [--seed-command <cmd>] [--test-command <cmd>] [--env-command <cmd>] [--link-depth <n>] [--skip-seed] [--skip-browser] [--skip-security] [--expected <reason>] [--json]	Run the security pack plus desktop/mobile role crawl and sandbox money flow. Skips require an explicit expected reason.
kit health [--json]	Deep environment health diagnostics — granular pass/fail across tools, services, and config (more detail than check).
kit status [--json]	Adoption checklist — which subsystems are set up (config, vault, tools, gitignore hygiene, dependency policy, agent-config, memory, hooks) + the next step for each gap.
kit install	Install missing tools declared in [tools] via mise.
kit login [--service <name>] [--retry-count <N>]	Guided login to configured services. Optionally narrow to one service / retry failures with backoff.
kit login --plan [--json]	Read-only: show the resolved auth strategy per service (vault / interactive / capture) + a passkey warning for browser logins that can't be scripted on a fresh machine.
kit skills	Check status of agent skills declared in [skills] against the registry (clawhub default).
kit fix	Auto-remediate common gaps (tools, lockfiles, gitignore, hooks, .env.template, declared deploy env values when resolvable from [secrets.keys]) and print HITL blocks for auth / DSN / external setup gaps.
kit heal [--dry-run] [--agent]	Bounded self-heal loop: auto-fix safe findings, re-scan until green; gates destructive ops, fail-closed on tamper.
kit upgrade	Refresh lockfiles from .kit.toml.
kit doctor	Diagnostic sweep — config drift + CLI version skew + triage-gate registry posture (public defaults vs internal mirrors / GHE; offline, so it reports configuration, never reachability) + OS-containment posture (container/seccomp/user-ns + gVisor/Firecracker fingerprints; honest unknown off-Linux). [governance.containment] require = true makes it a fail-closed gate.
kit clone <url>	Clone + setup in one step (skip setup with --no-setup).

Browser declaration

kit browser reads only .kit.toml and local machine facts. Repo declares the app-server contract; kit owns browser strategy and diagnostics.

[browser]
app = "apps/frontend"
start = "npm --workspace apps/frontend run start"
build = "npm --workspace apps/frontend run build"
routes = "apps/frontend/e2e/static-routes.spec.ts"
port = 3107

Code quality + reviews

Command	Purpose
kit design	A11y + design-token checks, baseline-aware.
kit standards [--category general|specific|plugins|platform|<lang>] [--enforce]	Dev-standards gate: general metrics (complexity/duplication/size via lizard/jscpd/scc) + per-language linters (11 langs) + user plugins (.kit/standards.d/) + container (hadolint). Warn by default; --enforce fails net-new findings AND setup gaps.
kit standards freeze	Snapshot only the standards dimensions into .kit-baseline.json.
kit review	Meta-runner — check + design + standards + adr + skill gate for PR. The skill stage runs module discipline over every shipped SKILL.md (contract, trigger collision, bounded tool scope, snapshot drift); a repo with no skills skips honestly.
kit adr [check|list|freeze|derive]	ADR → gate: enforce accepted ADRs' kit-enforce rules (forbid_pattern / require_pattern / forbid_import, incl. transitive and cross-package via follow_packages), cited to the ADR. list shows status plus any enforced_by: frontmatter pointing at enforcement the grammar cannot express (verified to exist by check, so it cannot rot); freeze baselines existing findings; derive proposes ADRs the code already obeys (absent import edges with a populated reverse), each re-run through the real evaluator before it is shown and emitted as status: proposed so it gates nothing until a human accepts it. Zero-LLM (prose is never interpreted).
kit baseline [freeze]	Snapshot current acceptable warnings (incl. standards + ADR) to .kit-baseline.json.
kit analyze [--write]	Mine git history + framework markers → draft CLAUDE.md / RULES.md.

Declarative Standards Plugins

.kit/standards.d/*.toml plugins default to forbid-mode: a match regex hit is a finding. Directory excludes are subtree globs, so exclude = ["scripts/"] excludes scripts/x.ts; kit warns when an exclude pattern matches zero source files.

[standard]
id = "no-console"
title = "No console in shipped code"
mode = "forbid" # default
match = 'console\.(log|debug)\('
exclude = ["scripts/", "fixtures/**"]

Use require-mode when a scoped file must contain a pattern. scope selects files by regex; match must appear somewhere in the same file. Net-new gating and kit standards freeze work the same way as forbid-mode.

[standard]
id = "callable-docs"
title = "Callables declare their permission model"
mode = "require"
scope = 'export const \w+ = onCall'
match = '@apiPermission'
severity = "warn"

Secrets

Command	Purpose
kit secrets sync [--target=<github|dotenv-ci|stdout>]	Sync vault → CI / .env.local.
kit secrets migrate [--keep-commented | --purge]	Plaintext .env* → vault. Default leaves KEY= (value blanked).
kit secrets vault-migrate --from <a> --to <b>	Cross-vault key transfer (1Password → Infisical, etc.).
kit secrets set <KEY> [--stdin | --value <v>] [--store <backend>]	Capture a value to the vault. --stdin (safer — not in argv/ps) or --value. Execution behind auth = "capture".
kit secrets rotate [--mode <jwt-secret-roll | scoped-key-mint>]	Rotate via supabase-mgmt-api. JWT roll is one-shot elevation.
kit secrets onecli register	Register fake-key in OneCLI gateway.
kit secrets purge-history --force-history	git-history rewrite to scrub leaked credentials.
kit secrets propagate	Sync vault → deploy platform (Vercel / Fly / etc.).
kit secrets revoke-old	Revoke superseded credential after rotation.
kit secrets pull --from <vercel|github|fly|cloudflare>	Read env-vars from deploy platform into vault.
kit secrets set-value <KEY> <VALUE>	Write a single key/value to the configured vault.
kit secrets validate [--fix|--auto]	Verify every declared key resolves in vault. --auto pulls from .env.template.

Auth + elevation

Command	Purpose
kit auth elevate [--scope <name>] [--ttl-minutes <N>]	TTY prompt + TOTP → mints elevation marker for destructive ops.
kit auth elevate --list-scopes [--json]	Lists every scope, what it unlocks, and whether it is one-shot. Elevates nothing.
kit auth status	Show current elevation state.
kit auth revoke	Clear elevation marker.
kit auth setup-totp	Enroll TOTP secret in ~/.kit/totp-secret.

Environment

Command	Purpose
kit env list	List configured environments ([env.<name>]).
kit env switch <env>	Activate env in .kit/active-env.json.
kit env current	Print active env.
kit env diff --compare <other>	Drift report between two .env* files (values shown as sha256:8 prefixes — never plaintext).

Deploy Env

kit check --category deploy compares committed deploy env requirements with platform state. The check reads remote key names only, never values. With no [deploy] section it is a no-op row that points to the declaration shape.

[deploy.vercel]
scope = "example-team" # CLI fallback scope
team_id = "team_123"   # API selector when VERCEL_TOKEN is present
environment_specific = ["NEXT_PUBLIC_SITE_URL"]

[deploy.vercel.environments.production]
project = "app-prod"
remote_env = "production"
required = ["NEXT_PUBLIC_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_ENVIRONMENT"]

[deploy.vercel.environments.staging]
project = "app-stg"
remote_env = "production" # separate staging project; use "preview" for preview builds
required = ["NEXT_PUBLIC_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_ENVIRONMENT"]

project is the Vercel project name/id. With VERCEL_TOKEN, kit uses the Management API so multiple projects in one repo can be checked without relinking cwd; without a token, it falls back to the Vercel CLI and the target cwd link. NEXT_PUBLIC_* keys are treated as build-time keys. If kit fix can resolve a missing value from [secrets.keys], it pushes it through the existing Vercel propagation adapter and reminds the operator to redeploy.

MCP orchestrator

Command	Purpose
kit mcp / kit mcp list	Show declared MCPs + auth status.
kit mcp status	Alias for list.
kit mcp auth <name>	Show OAuth-flow guidance for vendor.
kit mcp set-token <name> [--from-env VAR | --paste]	Headless / paste-token install.
kit mcp clear <name>	Remove stored token.

Hooks

Command	Purpose
kit hooks install	Install hooks declared in [hooks]. If no [hooks] section exists, it explains that nothing was installed and points to kit hooks add <name>.
kit hooks add <name> [--force]	Add a built-in hook (secret-scan, post-pull-audit, context-check) without requiring [hooks]. Installs into the directory git will actually use — core.hooksPath is honored, and the path is printed when it resolves OUTSIDE the repo, since deleting that directory then removes the gate silently. context-check is refused when .kit.toml has no [context] block: the hook would pass every push and report a gate you do not have. --force installs it anyway.
kit hooks sync	Reconcile installed hooks with config.
kit hooks uninstall	Remove the configured git hooks. Enforcement is off until re-installed — git hooks are the agent-agnostic floor, so this disables the gate that fires in any agent or none.

Agent Config User Rules

Repo-level prose can still live outside kit markers in AGENTS.md / CLAUDE.md. For user-level prose that should travel across harnesses, opt in per repo:

[agent_config.user_rules]
enabled = true
source = "~/.kit/agent-rules.md" # file, or directory of sorted *.md files
max_lines = 120
max_bytes = 12000

kit agent-config injects the text inside the managed kit block for every detected rules file. Missing config is a no-op. Oversized sources refuse with filename, line count and byte count. Lines that look like deterministic gates produce a warning pointing to .kit/standards.d/.

Security

Command	Purpose
kit security check-gitignore [--fix]	Verify secret-file patterns are gitignored.
kit security scan-staged	Block commit if staged files contain credential patterns.
kit security verify-pull [--base <ref>]	Post-git pull audit: new deps, gitignore drops, introduced secrets.
kit security scan-build [<dir>]	Walk .next / dist for credential leaks in build artifacts.
kit security advisories [--accept]	Dependency advisories from the repo's own package manager, split into new debt, known debt, and baseline entries that no longer apply. --accept freezes the current set in .kit/advisories.json (and prunes it).
kit security scan-artifact <path> [--recursive] [--json]	Ingestion gate for an untrusted file/tree: byte-level malware scan via the ClamAV delegate. malicious fails and an unverifiable gap fails (no scanner / scan error is never a pass).
kit security clear-cache	Wipe bumblebee cache.
kit security costs	Run cost-monitor leak-detection (P3.1).
kit security policy	Validate .kit-allowlist.json against current deps.
kit security scan-transcripts	Scan agent transcripts + prompt caches for leaked credentials.
kit security prescan <path> [--deep] [--format=json] [--vs-baseline=<p>]	Multi-repo baseline sweep (secrets, gitignore, branch-protect; --deep adds CVE / workflow-drift / bumblebee).
kit security prescan-diff <baseline.jsonl> <latest.jsonl>	Diff two prescan reports — surface new regressions + fixed findings.

Secret findings: what is classified, and what you accept

kit check --category security runs trufflehog over git history and splits the results so the verdict can reach green without hiding anything:

Bucket	Meaning	Your action
verified-live	trufflehog reached the provider and the credential works.	Rotate now. Fails the gate, always.
public-by-design	A client key that ships in bundles on purpose (Firebase web config, Sentry DSN, PostHog).	Check key restrictions; rotation fixes nothing.
example	The value proves it names nothing real: unreachable host (loopback, a bare service name, .internal, example.com) or a placeholder secret (pass, password, changeme, a vendor's doc sample).	None — classified automatically, no config needed.
accepted (.kit-secretsignore)	A finding you read and accepted, named by commit.	Add an entry only after confirming it names nothing real.
unverified	Everything else: secret-shaped, unconfirmed.	Review.

.kit-secretsignore holds one accepted finding per line as <commit>:<file>:<detector> (# comments allowed; file may be * when trufflehog reports no path; the commit may be abbreviated to ≥7 hex):

# fixture literals from a commit that has since been fixed forward
d9f55afc26db3ed604946b44edf224c293405d3f:src/check-security.test.ts:Postgres

History is immutable, so a fixture committed once is a finding forever — which is why the file exists. Two properties make it safe to have: an entry names one commit, so it cannot wave through a future occurrence of the same string, and a verified-live finding is never ignorable regardless of what is listed. Prefer fixing forward (derive fixture credentials at run time) so nothing new accumulates.

Supply chain + scanners

Command	Purpose
kit scan [--sarif]	Run installed external scanners (Snyk, Trivy, Grype, Semgrep, osv-scanner, Socket) and merge into one local, air-gap-aware verdict. GuardDog opt-in via KIT_GUARDDOG=1 / [scan] guarddog. Cloud scanners (Snyk, Socket) run when their token is set (SNYK_TOKEN / SOCKET_SECURITY_API_TOKEN, from [scan.tooling] vault or env) and are dropped in air-gap; Socket gates on socket ci's exit code (no stable findings-JSON, never false-green). Token absent → skipped, not failed.
kit airgap verify [--json]	Prove air-gap posture: assert every scanner that would run in air-gap mode resolves to a local artifact (no cloud-only scanner, no registry config); print a pass/fail table. A registry (p/…) KIT_SEMGREP_CONFIG is refused in air-gap (egress), while a local ruleset path is kept so semgrep runs offline.
kit supply-chain	Install-time supply-chain triage: install-scripts, lockfile-drift, dep-confusion, slopsquat.
kit agent-audit	Audit agent / MCP / hook configs for plaintext secrets + malware-shaped hooks.
kit gha-audit	GitHub Actions hardening lint — unpinned action refs + pwn-request patterns in .github/workflows.
kit self-audit [--only <ids>] [--list-rules] [--format=github|gitlab|json] [--fail-on-warning]	Zero-LLM, deterministic self-check of kit's own source (walks src/*.ts, no network). Scans for the audit's bug-classes (reintroduced || true, unguarded dynamic imports, etc.) and asserts every script referenced from .github/workflows/*.{yml,yaml} (node/python files, npm run targets) exists. --list-rules prints the rule set without running. Error-severity findings (missing CI script, reintroduced || true, unguarded import) exit non-zero; warnings do not unless --fail-on-warning. Runs in kit's own CI feeding the security gate.
kit sbom [--format cyclonedx|spdx]	Generate an SBOM from the lockfile.
kit ingest <sarif|osv> <file>	Ingest an external SARIF / OSV report into kit's consolidated verdict (one parser per format).
kit verify-provenance <bundle>	Verify a release's SLSA provenance bundle offline (Ed25519 + SHA-256 / cosign --offline).
kit sentinel <run|install|status> [--json]	Autonomous redline watcher — propose/apply guarded remediations; install scaffolds the GitHub Actions workflow.

Triage (pre-install)

Command	Purpose
kit triage npm <pkg>	Evaluate npm package: registry + GitHub health.
kit triage npm <pkg> --sandbox	+ offline tarball inspection (install-script + path-traversal scan).
kit triage pip <pkg>	PyPI evaluation.
kit triage docker <image>	Docker image: CVE + sandbox.
kit triage repo <github-url>	GitHub repo evaluation.
kit triage skill <path|name>	Claude Code / agent skill evaluation.
kit triage all <target>	Auto-detect + run all checks.
kit triage tools	List installed security tools.
kit triage check-deps	Pre-commit gate: fail if staged deps lack triage entries.
kit triage check-skills	Pre-commit gate: fail if staged skills lack a --deep triage entry.

Packages + plugins

Command	Purpose
kit pkg install <pkg>	Triage → install with pinned version.
kit plugin search <query>	Search plugin marketplace.
kit plugin install <id>	Install a plugin.
kit plugin info <id>	Plugin metadata.
kit plugin scaffold <name>	Generate a new plugin skeleton.

Governance

Command	Purpose
kit governance status	Budget + revocation + agent info.
kit audit	Print recent .kit-audit.jsonl entries.
kit audit secrets [--key <name>] [--since-days <N>]	Forensics: who/what touched each key + when.
kit audit verify [--strict]	Verify the keyless hash chain + the external HMAC anchor (tip mismatch = keyless rewrite, count mismatch = truncation; exit 1 on break/forge). --strict / [governance.audit].require_anchor makes an unanchored log / unreadable key / unsealed tail a hard fail.
kit audit verify --all [--json]	Union view over every audit log this machine has sealed (~/.kit/audit-anchor.json keys the tip per log path, so it spans every working tree; plain kit audit verify answers for cwd only). Outcomes: verified; stalled (log present, entries past its seal or a rotated anchor key — re-seal there); missing (log path gone: temp dir / deleted clone, never a finding); failed (chain break, truncation, tip mismatch, or a seal that could not be checked). Exit 1 on any failed; stalled warns and fails under --strict / [governance.audit].require_anchor.
kit audit anchor	Seal the log with the machine-local anchor key (~/.kit/audit-anchor.key, 0600) so a keyless rewrite/truncation is detectable. Append path stays keyless; not tamper-proof against a same-UID key reader.
kit audit export [--format cef|syslog|json]	Emit the audit log for a SIEM.
kit decisions add --decision <text> --confidence <0..1> --assumed <text> --would-have-asked <text>	Record one choice the run made where the spec was silent. kit never writes the content — that is model work — it provides the form and refuses a malformed entry. Appends to .kit/decisions.jsonl (per-run, gitignored by default); refused under KIT_READ_ONLY=1.
kit decisions list [--json] [--unreviewed]	What this run recorded, plus any line that cannot be read (a ledger that hides its unreadable lines lies by omission).
kit decisions verify [--json]	The gate's verdict on its own exit code — the same function kit check calls. Missing or empty ledger under [decisions] require = true is a didNotRun fail; a malformed entry is a plain fail; content is never judged.
kit whoami [--json]	Show current agent / user identity, active environment, and budget usage.
kit usage [--tab <name>] [--prove] [--deep] [--json]	What kit has recorded, in tabs: coverage with its denominator (including what could not run, and why), refusals, the memory you own, triage, and the machine's sealed logs. --prove hands the floor inputs it must refuse and reports what happened.
kit team create <name>	Create a new team.
kit team invite <email> [--role=<role>]	Invite a user to the team (roles: owner, admin, developer, guest).
kit team members list	List team members.
kit team member remove <email>	Remove a team member.
kit team audit log [--limit=<N>]	View team audit logs.

Exec-broker runtime posture

Graduating the exec-broker from observe to enforce is evidence-driven: the readiness verdict is computed from the recorded observe window, and the flip refuses unless that verdict says ready.

Command	Purpose
kit broker enforce-readiness [--gate]	Read the recorded observe window (.kit-audit.jsonl) and report whether flipping to enforce is safe: ready | would-block (+ exactly what breaks) | untested. --gate fails CI on any not-ready verdict.
kit broker enforce [--force]	Guided observe→enforce flip: readiness pre-flight (refuses unless ready; --force overrides), sets [scope].enforce_runtime = true, re-signs the profile scope, and audits the transition.

Traveling profile

The declared project profile (.kit-profile.toml) plus an offline-verifiable signature over its scope/RoE, so a profile can move to a fresh host without trusting the transport.

Command	Purpose
kit profile show	Render the declared profile with per-line reconciliation marks.
kit profile freeze	Snapshot the discovered toolchain into .kit-profile.toml (preserves operator-authored workflows/plugins/scope/gates).
kit profile check [--gate]	Report declared-vs-discovered drift. --gate fails CI on any drift; honest skip when no profile is declared.
kit profile sign	Sign the profile (scope/RoE) into .kit-profile.sig via your identity/keystore — offline-verifiable.
kit profile verify [--key <pin>]	Verify .kit-profile.sig offline: --key pin → local identity → org .kit-policy.signers.
kit profile export [--out <file>]	Export a portable signed bundle (profile + signature + signer key) to --out or stdout.
kit profile import <bundle>	Import a bundle on a fresh host — integrity-verified offline, fail-closed on tamper/revoked. Authoritative only once the signer is anchored.

Misc

Command	Purpose
kit open <service>	Open service dashboard in browser (stripe, vercel, etc.).
kit run <cmd>	Arbitrary command runner (audit-logged).
kit insight [--json]	Deterministic lifecycle insight — what is loaded but never called (e.g. MCP servers), from the transcript index. Experimental.
kit escalate	Collect failures + format for manual handoff.
kit ci [--strict] [--attest]	One-shot CI gate (check + design + tests). Scanner-health gate: a crashed / missing / token-less scanner can no longer exit 0 (default warns); --strict / KIT_CI_STRICT=1 (or [governance.scan].required_scanners) hard-fails any non-running scanner.
kit context [--format json]	Print kit context for agent introspection.
kit context check [--json] [--require-declaration]	Verify the live CLI state against [context] — each tool's declared (account, project) pair, never inferred from whatever is logged in. With no [context] block it prints a ready-to-paste one from the detected state and exits 0; --require-declaration makes that absence a failure instead, which is what the context-check pre-push hook runs — a gate with nothing to compare against is a check that could not run, not a pass.
[context.vercel].user · [context.github].user · [context.convex].account	The identity each CLI must be logged in as — asserted like git.email, not merely reported. A mismatch is red and exits non-zero, and names the per-tool mechanism that scopes an identity to a repo (vercel -Q, gh auth switch, gcloud config configurations activate; convex has none, so CONVEX_DEPLOY_KEY per repo). An unreadable identity is unknown, never a mismatch. Why it matters: when a command's output depends on the caller's role, a wrong identity returns a filtered subset that looks complete.
kit create-plugin <name>	Scaffold a new adapter.
kit add <service> · kit add --list	Add service to .kit.toml; --list prints every available adapter (so does bare kit add, which exits 1 as a usage error).
kit version	Print kit version + exit.
kit completions <bash|zsh|fish>	Output shell completion script for the given shell.

Repo-map (experimental)

Deterministic, zero-LLM code map: load only the relevant slice of a growing repo. Also exposed to agents as the kit_map MCP tool (same core — CLI ≡ MCP).

Command	Purpose
kit tools list [--latest] [--json]	Inventory the CLIs on this machine: resolved path, the installer that owns it (measured from the path, never assumed), installed version, and — with --latest — how far behind each one is. Covers the declared [tools] and the undeclared CLIs an agent decides from (gh, op, docker, gcloud, kubectl, psql, …). An installer kit cannot query (system, cargo, a kit PATH shim) reports unchecked with the reason; air-gap reports unchecked, never a version it did not verify. Answers are cached per machine (~/.kit/tool-latest.json, TTL KIT_TOOL_LATEST_TTL_H, default 24h), so the normal path makes no network call. KIT_TOOLS_PATHS=1 prints paths.
kit map <path...>	The files connected to the seed(s) within --depth import hops (both directions) + external packages. TS/JS + Python.
kit map <path> --depth N	Widen the neighborhood (default 1).
kit map <path> --budget N	Keep only the N nearest-to-seed files; every drop is logged (never silent truncation).
kit map <path> --co-change	Add files that historically change WITH the seed (bounded git log; fail-closed without git).
kit map <path> --json	Emit the slice (+ owners, ownerSource, coChanged, dropped) for an agent/tool.

Every slice file is attributed to its owner — CODEOWNERS (last-match-wins) or the git-blame top-author fallback; no CODEOWNERS and no git ⇒ no owner shown, never guessed.

Memory

Local-first second brain — SQLite + FTS5, deterministic, zero model calls. Full guide: docs/MEMORY.md.

Command	Purpose
kit memory index	Index ~/.claude transcripts into ~/.kit/memory.db (idempotent).
kit memory search <query>	Full-text recall; defaults to the current project, --global across all.
kit memory stats	Sessions / messages / tool-uses / DB size.
kit memory suggest [--limit N] [--json]	Emit a BYO-LLM review prompt (recent activity + open items) to stdout — pipe to your own model. kit never calls a model.
kit memory install / uninstall	Wire (or remove) Claude Code prompt/start/end hooks plus silent Codex start/end hooks (~/.codex/hooks.json); Codex hooks require /hooks trust.
kit memory scan	Scan the store for stored secrets (masked; exits 1 if any found).
kit memory backup <file> / restore <file>	Encrypted AES-256-GCM backup/restore (KIT_MEMORY_PASSPHRASE).
kit memory sync init <remote> [--auto]	Write ~/.kit/sync.toml (LOCAL, never committed). --auto = pull at session start + push at session end via the hooks.
kit memory push / pull	Sync the store to/from your PRIVATE remote. Encrypted by default (passphrase or recipient public key — kit memory keygen); encrypt = false opts into a plaintext blob (destination must stay private).
kit memory keygen	X25519 recipient keypair: ephemeral sessions push encrypted with NO secret; only holders of the private key decrypt.
kit memory pal [list|add|done|snooze|verify|import]	Pending-action ledger; auto-closes on verify. Project-scoped (--global for all).
kit memory save <name> / threads / resume <name|n> / forget <name>	Named copilots — bookmark + resume sessions; resume prints the Claude or Codex command for the saved harness.
kit memory share … / areas / area <name>	Shared, area-organized team memory (committed, secret-scanned, reviewed like code).
kit memory context	Push-surface the active decisions for the area(s) whose files you are touching (deterministic, path→cluster).

Exit codes

Code	Meaning
0	success / all checks passing
1	one or more checks failed
2	usage error

Notes on read-only mode

The following commands write external state and refuse when KIT_READ_ONLY=1:

• secrets migrate / vault-migrate / rotate / set-value / pull --from
• auth elevate (writes elevation marker)
• hooks install / hooks add / setup
• fix (writes .env.template, .gitignore, git hooks)
• mcp set-token (writes token store)
• Every plugin write surface — see THREAT_MODEL.md for the list

kit check, secrets validate, env diff, mcp list, and audit are read-only and work in any mode.