What the installer does to your files.

1. Welcome. What the kit contains, and a promise card: preview first, backed up, cleanly reversible.
2. Target. An existing project (type the path or browse) or global ~/.claude. Recently used folders appear below.
3. Scan. What’s already there: .claude/ and its settings, CLAUDE.md, AGENTS.md, the domain glossary, git status, the stack, the AI tools in use, and whether the kit is installed. Warnings appear for uncommitted changes or invalid settings.
4. AI tools. A card per tool. Tools with files in the project are pre-selected; tools only found on this computer are marked but left unselected, because your team may not use them.
5. Components. Grouped checkboxes with presets. Each has a “What is this?” panel, and dependencies are selected for you with a note saying why.
6. About your project (optional). Stack and commands pre-filled from package.json, lockfiles and Makefile, plus conventions and workflow preferences.
7. Preview. Nothing is written yet. Every file gets a stamp (CREATE, MERGE, APPEND, UPDATE, SKIP, CONFLICT, REMOVE), a one-line explanation, the tools that read it, and a diff for anything that changes. For each conflict you choose: keep yours, use the kit’s (yours is backed up), or save the kit’s as .kit-new.
8. Done. What changed, where the backup is, and the follow-up steps the installer deliberately leaves to you, each with a Copy button.

AGENTS.md                         kit block (marked) + your project section
CLAUDE.md                         Claude Code only: a marked block with @AGENTS.md
.agents/skills/<name>/SKILL.md    skills, shared by most tools
.claude/skills, .kiro/skills, …   only for tools that don't read .agents/skills
.claude/agents, .codex/agents/*.toml, .gemini/agents, .github/agents, …
                                  agents, in each tool's format
.agent-kit/RULES.md               the rulebook (reference, read a section at a time)
.agent-kit/agents/*.md            each agent's instructions, for tools without sub-agents
.agent-kit/plans/                 your plans, written by the feature skill
.agent-kit/                       install.json, backup/, format.mjs, .gitignore,
                                  and (optional) check.sh, checks.conf, protected

1. Copies (agents, skills, rules, the hook). A new file is created; an identical one is skipped; one you’ve changed is a conflict you decide; one the kit installed earlier that you haven’t touched is updated.
2. JSON settings (.claude/settings.json, .cursor/hooks.json, .devin/hooks.json, .gemini/settings.json). The kit’s entries are added only if missing, as an in-place text edit that keeps your indentation and line endings. Invalid JSON stops the install with the line and column of the problem; the file is never overwritten.
3. AGENTS.md and CLAUDE.md. The kit’s block goes between <!-- agent-engineering-kit:start --> and <!-- agent-engineering-kit:end -->, and is replaced on a re-run, never appended twice.
4. Ignore files (.cursorignore, .geminiignore, .aiderignore…) get a marked block too.
5. Project info you type goes above the kit’s block as a normal section. It’s added once and never changed or removed by the installer.
6. Pre-commit checks (optional) are created once and then belong to you; updates never overwrite them.

1. Backups. Before writing, every file that will change is copied to .agent-kit/backup/<UTC timestamp>/. Backups are never deleted, and .agent-kit/.gitignore keeps them out of git.
2. The install record. .agent-kit/install.json records the kit version, components and tools; every file created or modified, with a hash of how the installer left it; the exact JSON entries it added; the original backup of each modified file; and the folders it created.
3. Uninstall only touches files in the record. A file the kit created that you haven’t changed is deleted; a file it modified that you haven’t changed is restored from its backup; a file you’ve edited loses only the kit’s parts; empty folders the kit created are removed.

1. It writes only inside the chosen folder. Every path is resolved and checked: no .. escapes, no symlinked folders leading outside, and it never reads or writes through a symlink. Files are written via a fresh, exclusive temp file and renamed into place.
2. The install record is checked, not trusted. A cloned repo could ship a forged one, so every path, JSON entry and backup in it must be one the installer could have written. Otherwise it refuses to act and explains why.
3. It touches nothing it shouldn’t. It never deletes files it didn’t create, makes no network calls, and never runs plugin or package-manager commands. The only external commands are read-only git queries and opening your browser.
4. Git hooks only for the kit’s own code. It writes .git/hooks/pre-commit only when check.sh and checks.conf come from the kit, and recognises its hook by exact content.
5. The GUI server is locked down. It listens on 127.0.0.1 only, needs a random per-session token on every request, rejects other Host headers, serves a strict Content-Security-Policy, caps request bodies at 1 MB, and renders all data as text.

1. Windows isn’t tested by hand yet. The code paths exist, and the format hook runs on Node; the optional pre-commit check uses sh, which Git for Windows includes.
2. Only Claude Code has been run end to end. The other tools’ files follow their official docs and are checked by format tests.
3. Global installs are Claude Code only. Other tools would need the whole home folder as the write root, which would weaken the containment checks.
4. Symlinked files stop the install. The preview says which file; deselect the parts that write it, or replace the symlink with a real file.

The full reference on GitHub.