From 6aa714845f6e583dd9829f0bd9bfc4ef0229ab4f Mon Sep 17 00:00:00 2001
From: AstrumBot <astrumbot@users.noreply.github.com>
Date: Thu, 21 May 2026 17:19:53 +0800
Subject: [PATCH 1/2] feat: add pinned kdocs-cli v2.5.2 (CLI only)

---
 Dockerfile                 | 17 +++++++++++++++++
 versions/tool-versions.env |  1 +
 2 files changed, 18 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index e622bd3..d602669 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -230,6 +230,23 @@ RUN set -eux; \
     fi; \
     officecli --version
 
+# Install pinned kdocs-cli v2.5.2 (CLI only — no skill files)
+RUN set -eux; \
+    set -a; source /tmp/runtime-versions/tool-versions.env; set +a; \
+    arch="$(dpkg --print-architecture)"; \
+    case "$arch" in \
+        amd64) kdocs_arch="amd64" ;; \
+        arm64) kdocs_arch="arm64" ;; \
+        *) echo "Unsupported architecture: $arch" >&2; exit 1 ;; \
+    esac; \
+    kdocs_url="https://wpsai.wpscdn.cn/skillhub/pro/v${KDOCS_CLI_VERSION}/releases/kdocs-cli-${KDOCS_CLI_VERSION}-linux-${kdocs_arch}.tar.gz"; \
+    echo "Downloading kdocs-cli v${KDOCS_CLI_VERSION} (${kdocs_arch})..."; \
+    curl --fail --show-error --silent --location --proto '=https' --tlsv1.2 --retry 5 --retry-delay 2 -o /tmp/kdocs-cli.tar.gz "$kdocs_url"; \
+    tar -xzf /tmp/kdocs-cli.tar.gz -C /tmp; \
+    install -m 0755 /tmp/kdocs-cli /usr/local/bin/kdocs-cli; \
+    rm -f /tmp/kdocs-cli.tar.gz /tmp/kdocs-cli; \
+    kdocs-cli version | grep -F "${KDOCS_CLI_VERSION}"
+
 COPY verify-runtime.sh /usr/local/bin/verify-runtime
 RUN chmod +x /usr/local/bin/verify-runtime \
     && install -d -m 0755 /usr/local/share/astrum-agent-runtime \
diff --git a/versions/tool-versions.env b/versions/tool-versions.env
index 0c5e223..fb09151 100644
--- a/versions/tool-versions.env
+++ b/versions/tool-versions.env
@@ -25,3 +25,4 @@ WEBSOCAT_X86_64_SHA256=66f8dd3a0394761556339117f8bb5123bddefd44e087af2a72ec22b0b
 WEBSOCAT_AARCH64_SHA256=711a69576a2ff473fb01a90ffafb571c2ed019e55479d7ae71b12c2eadeb7011
 OXIPNG_AMD64_SHA256=6a433d9d10a9c4772e618136a491fc0e2b8b373c55db731fa5cc7b5f7a556053
 OXIPNG_ARM64_SHA256=c54b99b8f14801639a535eccd460d80cefadd8ffd581862fb2ba2ae83d411388
+KDOCS_CLI_VERSION=2.5.2

From ced4748e1502c12ad219dbb706673c7265252185 Mon Sep 17 00:00:00 2001
From: AstrumBot <astrumbot@users.noreply.github.com>
Date: Thu, 21 May 2026 17:22:58 +0800
Subject: [PATCH 2/2] chore: add kdocs-cli to runtime verification

---
 verify-runtime.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/verify-runtime.sh b/verify-runtime.sh
index f2f568d..3c15804 100644
--- a/verify-runtime.sh
+++ b/verify-runtime.sh
@@ -28,7 +28,7 @@ echo "== runtime flavor =="
 printf '%s\n' "$flavor"
 
 echo "== base commands =="
-for cmd in printenv envsubst timeout flock stdbuf script git git-lfs gh rg aria2c tmux rsync 7z zip unzip unrar rclone ffmpeg ffprobe yt-dlp convert identify exiftool oxipng duckdb psql mysql redis-cli sqlite3 pandoc jq yq fd officecli mmdc; do
+for cmd in printenv envsubst timeout flock stdbuf script git git-lfs gh rg aria2c tmux rsync 7z zip unzip unrar rclone ffmpeg ffprobe yt-dlp convert identify exiftool oxipng duckdb psql mysql redis-cli sqlite3 pandoc jq yq fd officecli mmdc kdocs-cli; do
   command -v "$cmd" >/dev/null
   printf '%-14s %s\n' "$cmd" "$(command -v "$cmd")"
 done
@@ -58,6 +58,7 @@ expect_exact playwright "$(playwright --version | awk '{print $2}' | trim_versio
 expect_exact vercel "$(vercel --version 2>/dev/null | trim_version)" "53.4.0"
 expect_exact wrangler "$(wrangler --version 2>/dev/null | trim_version)" "4.90.1"
 expect_exact gemini "$(gemini --version | awk '{print $NF}' | trim_version)" "0.42.0"
+expect_exact kdocs-cli "$(kdocs-cli version | trim_version)" "${KDOCS_CLI_VERSION}"
 
 echo "== go =="
 go version