@softspark/ai-toolkit 1.3.2 → 1.3.4

package/CHANGELOG.md

@@ -7,6 +7,20 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v1.3.4 — Patch (2026-04-07)
+
+### Fixed
+- **skills-catalog.md**: Added 6 missing language pattern skills (rust, java, csharp, kotlin, swift, ruby) to Development section (10→16). Total now correctly sums to 90.
+
+---
+
+## v1.3.3 — Patch (2026-04-07)
+
+### Fixed
+- **manifest.json missing from npm package**: Added `manifest.json` to `package.json` `files` array. Without it, `--auto-detect` and `--modules` could not read module definitions from installed package.
+
+---
+
 ## v1.3.2 — Patch (2026-04-07)
 
 ### Fixed

package/app/hooks/governance-capture.sh

@@ -24,8 +24,17 @@ log_event() {
     local EVENT="$1"
     local DETAIL="$2"
     mkdir -p "$LOG_DIR"
-    printf '{"timestamp":"%s","event":"%s","tool":"%s","detail":"%s","session":"%s"}\n' \
-        "$TIMESTAMP" "$EVENT" "$TOOL_NAME" "$DETAIL" "$SESSION" >> "$LOG_FILE"
+    if command -v jq >/dev/null 2>&1; then
+        jq -nc --arg ts "$TIMESTAMP" --arg ev "$EVENT" --arg tl "$TOOL_NAME" --arg dt "$DETAIL" --arg ss "$SESSION" \
+            '{"timestamp":$ts,"event":$ev,"tool":$tl,"detail":$dt,"session":$ss}' >> "$LOG_FILE"
+    else
+        # Escape double quotes in variable fields for basic JSON safety
+        local SAFE_DETAIL="${DETAIL//\"/\\\"}"
+        local SAFE_TOOL="${TOOL_NAME//\"/\\\"}"
+        local SAFE_SESSION="${SESSION//\"/\\\"}"
+        printf '{"timestamp":"%s","event":"%s","tool":"%s","detail":"%s","session":"%s"}\n' \
+            "$TIMESTAMP" "$EVENT" "$SAFE_TOOL" "$SAFE_DETAIL" "$SAFE_SESSION" >> "$LOG_FILE"
+    fi
 }
 
 case "$TOOL_NAME" in

package/bin/ai-toolkit.js

@@ -8,6 +8,11 @@ const fs = require('fs');
 const TOOLKIT_DIR = path.dirname(__dirname);
 const CWD = process.cwd();
 
+if (!process.env.HOME) {
+  console.error('Error: HOME environment variable is not set');
+  process.exit(1);
+}
+
 // ---------------------------------------------------------------------------
 // Generator map: command name -> { script, dest, mkdir? }
 // Used by individual generator commands, `generate-all`, and the default case.

package/kb/reference/skills-catalog.md

@@ -3,7 +3,7 @@ title: "AI Toolkit - Skills Catalog"
 category: reference
 service: ai-toolkit
 tags: [skills, domain-knowledge, catalog, task-skills, hybrid-skills]
-version: "1.3.0"
+version: "1.3.3"
 created: "2026-03-23"
 last_updated: "2026-04-07"
 description: "Complete catalog of 90 skills: 28 task, 30 hybrid, 32 knowledge. Includes effort levels, skill-scoped hooks, executable scripts, security auditor, and persona presets."
@@ -113,7 +113,7 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 | `application-deploy` | 3 | Deploy → smoke test → release notes |
 | `proactive-troubleshooting` | 4 | Investigate → check perf → preventive fix → docs |
 
-## Knowledge Skills - Development (10)
+## Knowledge Skills - Development (16)
 
 | Skill | Directory | Domain |
 |-------|-----------|--------|
@@ -124,6 +124,12 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 | **ecommerce-patterns** | `skills/ecommerce-patterns/` | E-commerce: catalog, cart, checkout, payments |
 | **clean-code** | `skills/clean-code/` | Multi-language code quality: Python, TS, PHP, Go, Dart |
 | **typescript-patterns** | `skills/typescript-patterns/` | TypeScript/JavaScript patterns for frontend and backend |
+| **rust-patterns** | `skills/rust-patterns/` | Ownership, borrowing, error handling, Cargo, tokio, serde |
+| **java-patterns** | `skills/java-patterns/` | Records, sealed classes, Stream API, Spring Boot, JUnit 5 |
+| **csharp-patterns** | `skills/csharp-patterns/` | Nullable refs, async/await, ASP.NET Core, EF Core |
+| **kotlin-patterns** | `skills/kotlin-patterns/` | Coroutines, DSLs, sealed classes, Ktor, MockK |
+| **swift-patterns** | `skills/swift-patterns/` | Protocol-oriented, SwiftUI, async/await, SPM |
+| **ruby-patterns** | `skills/ruby-patterns/` | Blocks, Rails conventions, RSpec, ActiveRecord |
 | **design-engineering** | `skills/design-engineering/` | UI polish, animation craft, easing, transforms, accessibility |
 | **documentation-standards** | `skills/documentation-standards/` | KB document conventions, frontmatter validation, category taxonomy |
 | **brand-voice** | `skills/brand-voice/` | Anti-trope list, voice principles, LLM rhetoric prevention |

package/llms-full.txt

@@ -3343,10 +3343,10 @@ The `common/` directory uses the same structure except `frameworks.md` is replac
 
 ## Auto-Detection
 
-When `--auto-detect` is passed, `scripts/install_steps/detect_language.py` scans the current directory for known marker files and selects the matching language module:
+`--local` automatically enables language auto-detection. `scripts/install_steps/detect_language.py` scans the current directory for known marker files and selects matching language modules:
 
 ```bash
-ai-toolkit install --local --auto-detect
+ai-toolkit install --local     # auto-detects language (--auto-detect is implied)
 ```
 
 Detection logic (first match wins when multiple markers are present):
@@ -3368,14 +3368,14 @@ Common rules are always injected regardless of detected language.
 ## Installation
 
 ```bash
-# Auto-detect language from project files
-ai-toolkit install --local --auto-detect
+# Auto-detect language from project files (default with --local)
+ai-toolkit install --local
 
 # Explicitly select a language
 ai-toolkit install --local --lang typescript
 
-# Install without language rules
-ai-toolkit install --local
+# Skip auto-detect, install specific modules only
+ai-toolkit install --local --modules core,agents
 ```
 
 Language rules are injected into the project `CLAUDE.md` between named markers:
@@ -3491,8 +3491,8 @@ ai-toolkit install --profile standard
 # Module-based install (new)
 ai-toolkit install --modules core,agents,rules-typescript
 
-# Auto-detect project language and install matching rules
-ai-toolkit install --local --auto-detect
+# --local implies --auto-detect (language rules auto-detected)
+ai-toolkit install --local
 
 # Show currently installed modules and their state
 ai-toolkit status

package/manifest.json

@@ -0,0 +1,159 @@
+{
+  "version": "1.0.0",
+  "components": {
+    "agents": {
+      "description": "44 specialized agents (orchestrator, backend, frontend, security, devops, etc.)",
+      "path": "app/agents",
+      "target": ".claude/agents",
+      "type": "symlink",
+      "tags": ["core", "agents"]
+    },
+    "skills": {
+      "description": "90 skills (28 task + 30 hybrid + 32 knowledge)",
+      "path": "app/skills",
+      "target": ".claude/skills",
+      "type": "symlink",
+      "tags": ["core", "skills", "commands"]
+    },
+    "hooks": {
+      "description": "21 global hook entries across 12 lifecycle events + 5 skill-scoped lifecycle hooks",
+      "path": "app/hooks.json + app/hooks/*.sh",
+      "target": "~/.claude/settings.json (merge) + ~/.ai-toolkit/hooks/ (copy)",
+      "type": "merge+copy",
+      "tags": ["core", "hooks", "quality"]
+    },
+    "plugin-packs": {
+      "description": "Experimental domain plugin packs and optional hook/policy modules",
+      "path": "app/plugins",
+      "target": "opt-in / not installed by default",
+      "type": "experimental",
+      "tags": ["plugins", "packs", "experimental"]
+    },
+    "constitution": {
+      "description": "5-article machine-enforced safety constitution",
+      "path": "app/constitution.md",
+      "target": ".claude/constitution.md",
+      "type": "symlink",
+      "tags": ["core", "safety", "constitution"]
+    },
+    "architecture": {
+      "description": "System architecture documentation",
+      "path": "app/ARCHITECTURE.md",
+      "target": ".claude/ARCHITECTURE.md",
+      "type": "symlink",
+      "tags": ["docs"]
+    },
+    "output-styles": {
+      "description": "System prompt output style overrides (e.g. Golden Rules enforcement)",
+      "path": "app/output-styles",
+      "target": ".claude/output-styles",
+      "type": "symlink",
+      "tags": ["core", "output-styles"]
+    },
+    "rules": {
+      "description": "Auto-injected rules for CLAUDE.md (jira, quality-gates, etc.)",
+      "path": "app/rules",
+      "target": "CLAUDE.md (injected)",
+      "type": "injection",
+      "tags": ["core", "rules"]
+    }
+  },
+  "bundles": {
+    "minimal": {
+      "description": "Hooks and constitution only -- safety without agents",
+      "includes": ["hooks", "constitution"]
+    },
+    "standard": {
+      "description": "Full toolkit (recommended)",
+      "includes": ["agents", "skills", "hooks", "constitution", "rules"]
+    },
+    "agents-only": {
+      "description": "Agents without skills (for custom skill setup)",
+      "includes": ["agents", "hooks", "constitution"]
+    },
+    "skills-only": {
+      "description": "Skills without agents",
+      "includes": ["skills", "hooks", "constitution"]
+    },
+    "safety": {
+      "description": "Constitution + hooks only (zero agent overhead)",
+      "includes": ["hooks", "constitution"]
+    }
+  },
+  "modules": {
+    "core": {
+      "description": "Core hooks and essential skills",
+      "required": true
+    },
+    "agents": {
+      "description": "44 specialized agents",
+      "default": true
+    },
+    "skills": {
+      "description": "90 skills (task, hybrid, knowledge)",
+      "default": true
+    },
+    "rules-common": {
+      "description": "Common coding rules (5 files)",
+      "default": true
+    },
+    "rules-typescript": {
+      "description": "TypeScript-specific rules",
+      "auto_detect": ["package.json", "tsconfig.json"]
+    },
+    "rules-python": {
+      "description": "Python-specific rules",
+      "auto_detect": ["requirements.txt", "pyproject.toml", "setup.py", "Pipfile"]
+    },
+    "rules-golang": {
+      "description": "Go-specific rules",
+      "auto_detect": ["go.mod"]
+    },
+    "rules-rust": {
+      "description": "Rust-specific rules",
+      "auto_detect": ["Cargo.toml"]
+    },
+    "rules-java": {
+      "description": "Java-specific rules",
+      "auto_detect": ["pom.xml", "build.gradle", "build.gradle.kts"]
+    },
+    "rules-kotlin": {
+      "description": "Kotlin-specific rules",
+      "auto_detect": ["build.gradle.kts"]
+    },
+    "rules-swift": {
+      "description": "Swift-specific rules",
+      "auto_detect": ["Package.swift", "*.xcodeproj"]
+    },
+    "rules-dart": {
+      "description": "Dart/Flutter-specific rules",
+      "auto_detect": ["pubspec.yaml"]
+    },
+    "rules-csharp": {
+      "description": "C#/.NET-specific rules",
+      "auto_detect": ["*.csproj", "*.sln"]
+    },
+    "rules-php": {
+      "description": "PHP-specific rules",
+      "auto_detect": ["composer.json"]
+    },
+    "rules-cpp": {
+      "description": "C++-specific rules",
+      "auto_detect": ["CMakeLists.txt", "Makefile", "*.cpp"]
+    },
+    "rules-ruby": {
+      "description": "Ruby-specific rules",
+      "auto_detect": ["Gemfile", "*.gemspec"]
+    },
+    "mcp-templates": {
+      "description": "25 MCP server config templates",
+      "default": false
+    }
+  },
+  "profiles": {
+    "minimal": ["core"],
+    "standard": ["core", "agents", "skills", "rules-common"],
+    "strict": ["core", "agents", "skills", "rules-common", "mcp-templates"],
+    "full": ["core", "agents", "skills", "rules-common", "mcp-templates"]
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "Professional-grade AI coding toolkit: 90 skills, 44 agents, multi-platform support (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment), machine-enforced safety constitution, persona presets, skill security auditor, expanded lifecycle hooks, 11 plugin packs, and benchmark tooling.",
   "keywords": [
     "claude",
@@ -62,6 +62,7 @@
     "kb/",
     "benchmarks/",
     "action.yml",
+    "manifest.json",
     "README.md",
     "CHANGELOG.md",
     "LICENSE",

package/scripts/add_rule.py

@@ -14,6 +14,7 @@ Arguments:
 """
 from __future__ import annotations
 
+import re
 import shutil
 import sys
 from pathlib import Path
@@ -33,6 +34,10 @@ def main() -> None:
         sys.exit(1)
 
     rule_name = sys.argv[2] if len(sys.argv) > 2 else rule_file.stem
+    rule_name = re.sub(r"[^a-zA-Z0-9_-]", "", rule_name)
+    if not rule_name:
+        print("Error: rule name is empty after sanitization", file=sys.stderr)
+        sys.exit(1)
     rules_dir = Path.home() / ".ai-toolkit" / "rules"
     rules_dir.mkdir(parents=True, exist_ok=True)
 

package/scripts/plugin.py

@@ -588,6 +588,9 @@ def _parse_clean_args(args: list[str]) -> tuple[list[str], int]:
         if args[i] == "--days" and i + 1 < len(args):
             try:
                 days = int(args[i + 1])
+                if days <= 0:
+                    print(f"  ERROR: --days must be positive, got {days}")
+                    sys.exit(1)
             except ValueError:
                 print(f"  ERROR: --days requires a number, got '{args[i + 1]}'")
                 sys.exit(1)

package/scripts/stats.py

@@ -59,7 +59,31 @@ def main() -> None:
         print("No invocations recorded.")
         return
 
-    rows = sorted(data.items(), key=lambda x: x[1].get("count", 0), reverse=True)
+    # Handle both formats: {skill: {count, last_used}} and {loop_runs: [...]}
+    if "loop_runs" in data:
+        runs = data["loop_runs"]
+        if not runs:
+            print("No invocations recorded.")
+            return
+        # Aggregate loop_runs by command
+        agg: dict[str, dict] = {}
+        for run in runs:
+            cmd = run.get("command", "unknown")
+            iters = run.get("iterations", [])
+            if cmd not in agg:
+                agg[cmd] = {"count": 0, "last_used": "unknown"}
+            agg[cmd]["count"] += len(iters) if iters else 1
+            started = run.get("started_at", "")
+            if started > agg[cmd]["last_used"]:
+                agg[cmd]["last_used"] = started
+        rows = sorted(agg.items(), key=lambda x: x[1]["count"], reverse=True)
+    else:
+        # Original format: {skill_name: {count, last_used}}
+        skill_data = {k: v for k, v in data.items() if isinstance(v, dict)}
+        if not skill_data:
+            print("No invocations recorded.")
+            return
+        rows = sorted(skill_data.items(), key=lambda x: x[1].get("count", 0), reverse=True)
 
     print(f"{'Skill':<30} {'Count':>6}  {'Last Used':<20}")
     print("-" * 60)
@@ -68,10 +92,10 @@ def main() -> None:
         last = info.get("last_used", "unknown")
         print(f"{name:<30} {count:>6}  {last:<20}")
 
-    total = sum(v.get("count", 0) for v in data.values())
+    total = sum(v.get("count", 0) for _, v in rows)
     print()
     print(f"Total invocations: {total}")
-    print(f"Unique skills: {len(data)}")
+    print(f"Unique skills: {len(rows)}")
     print()
     print(f"File: {STATS_FILE}")
     print("Reset: ai-toolkit stats --reset")

package/scripts/sync.py

@@ -66,9 +66,23 @@ def do_import(source: str) -> None:
     """Import config from file or URL."""
     tmpfile: str | None = None
 
-    if source.startswith("http"):
-        tmpfile = tempfile.mktemp(suffix=".json")
-        urllib.request.urlretrieve(source, tmpfile)
+    if source.startswith("https://") or source.startswith("http://"):
+        if not source.startswith("https://"):
+            print("Error: HTTP imports are not supported. Use HTTPS for security.", file=sys.stderr)
+            sys.exit(1)
+        tmp_fd, tmpfile = tempfile.mkstemp(suffix=".json")
+        os.close(tmp_fd)
+        try:
+            import ssl
+            ctx = ssl.create_default_context()
+            with urllib.request.urlopen(source, timeout=30, context=ctx) as resp:
+                data = resp.read(10 * 1024 * 1024)  # 10MB max
+                with open(tmpfile, 'wb') as f:
+                    f.write(data)
+        except Exception:
+            if os.path.exists(tmpfile):
+                os.unlink(tmpfile)
+            raise
         source = tmpfile
 
     source_path = Path(source)
@@ -112,7 +126,8 @@ def do_push() -> None:
         print("Error: gh not authenticated. Run: gh auth login")
         sys.exit(1)
 
-    tmpfile = tempfile.mktemp(suffix=".json")
+    tmp_fd, tmpfile = tempfile.mkstemp(suffix=".json")
+    os.close(tmp_fd)
     Path(tmpfile).write_text(do_export(), encoding="utf-8")
 
     if GIST_ID_FILE.is_file():
@@ -153,12 +168,14 @@ def do_pull(gist_id: str = "") -> None:
         print("Usage: ai-toolkit sync --pull <gist-id>")
         sys.exit(1)
 
-    tmpfile = tempfile.mktemp(suffix=".json")
-    subprocess.run(
-        ["gh", "gist", "view", gist_id, "-f", "ai-toolkit-config.json"],
-        stdout=open(tmpfile, "w"),
-        check=True,
-    )
+    tmp_fd, tmpfile = tempfile.mkstemp(suffix=".json")
+    os.close(tmp_fd)
+    with open(tmpfile, "w") as f:
+        subprocess.run(
+            ["gh", "gist", "view", gist_id, "-f", "ai-toolkit-config.json"],
+            stdout=f,
+            check=True,
+        )
     do_import(tmpfile)
     os.unlink(tmpfile)
 

package/scripts/validate.py

@@ -30,7 +30,7 @@ from plugin_schema import validate_references as _validate_plugin_references
 # ---------------------------------------------------------------------------
 
 VALID_TOOLS = frozenset({
-    "Read", "Write", "Edit", "Bash", "Grep", "Glob", "Agent",
+    "Read", "Write", "Edit", "MultiEdit", "Bash", "Grep", "Glob", "Agent",
     "WebSearch", "WebFetch", "TodoRead", "TodoWrite",
     "TeamCreate", "TeamDelete", "SendMessage",
     "TaskCreate", "TaskList", "TaskUpdate", "TaskGet", "TaskOutput", "TaskStop",