@softspark/ai-toolkit 1.3.3 → 1.3.5

package/CHANGELOG.md

@@ -7,6 +7,20 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v1.3.5 — Patch (2026-04-07)
+
+### Fixed
+- **Stats not counting**: `track-usage.sh` and `user-prompt-submit.sh` now read prompt from stdin JSON (`.prompt` field) instead of non-existent `CLAUDE_USER_PROMPT` env var. Skill invocations are now properly tracked in `~/.ai-toolkit/stats.json`.
+
+---
+
+## v1.3.4 — Patch (2026-04-07)
+
+### Fixed
+- **skills-catalog.md**: Added 6 missing language pattern skills (rust, java, csharp, kotlin, swift, ruby) to Development section (10→16). Total now correctly sums to 90.
+
+---
+
 ## v1.3.3 — Patch (2026-04-07)
 
 ### Fixed

package/app/hooks/governance-capture.sh

@@ -24,8 +24,17 @@ log_event() {
     local EVENT="$1"
     local DETAIL="$2"
     mkdir -p "$LOG_DIR"
-    printf '{"timestamp":"%s","event":"%s","tool":"%s","detail":"%s","session":"%s"}\n' \
-        "$TIMESTAMP" "$EVENT" "$TOOL_NAME" "$DETAIL" "$SESSION" >> "$LOG_FILE"
+    if command -v jq >/dev/null 2>&1; then
+        jq -nc --arg ts "$TIMESTAMP" --arg ev "$EVENT" --arg tl "$TOOL_NAME" --arg dt "$DETAIL" --arg ss "$SESSION" \
+            '{"timestamp":$ts,"event":$ev,"tool":$tl,"detail":$dt,"session":$ss}' >> "$LOG_FILE"
+    else
+        # Escape double quotes in variable fields for basic JSON safety
+        local SAFE_DETAIL="${DETAIL//\"/\\\"}"
+        local SAFE_TOOL="${TOOL_NAME//\"/\\\"}"
+        local SAFE_SESSION="${SESSION//\"/\\\"}"
+        printf '{"timestamp":"%s","event":"%s","tool":"%s","detail":"%s","session":"%s"}\n' \
+            "$TIMESTAMP" "$EVENT" "$SAFE_TOOL" "$SAFE_DETAIL" "$SAFE_SESSION" >> "$LOG_FILE"
+    fi
 }
 
 case "$TOOL_NAME" in

package/app/hooks/post-tool-use.sh

@@ -8,8 +8,10 @@
 # shellcheck source=_profile-check.sh
 source "$(dirname "$0")/_profile-check.sh"
 
-FILE_PATH="${CLAUDE_TOOL_INPUT_FILE_PATH:-}"
-TOOL_NAME="${CLAUDE_TOOL_NAME:-unknown}"
+# Read from stdin (Claude Code passes JSON with .tool_name, .tool_input)
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // "unknown"' 2>/dev/null)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
 
 if [ -z "$FILE_PATH" ]; then
     echo "PostToolUse: ${TOOL_NAME} completed. Consider validating lint, tests, and docs if behavior changed."

package/app/hooks/pre-compact-save.sh

@@ -11,8 +11,11 @@ source "$(dirname "$0")/_profile-check.sh"
 SAVE_DIR="$HOME/.ai-toolkit/compactions"
 mkdir -p "$SAVE_DIR"
 
+# Read from stdin (Claude Code passes JSON with .session_id)
+INPUT=$(cat)
 TIMESTAMP=$(date -u +"%Y-%m-%d_%H-%M-%S")
-SESSION="${CLAUDE_SESSION_ID:-$$}"
+SESSION=$(echo "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
+[ -z "$SESSION" ] && SESSION="$$"
 SAVE_FILE="$SAVE_DIR/${TIMESTAMP}_${SESSION}.txt"
 
 # Gather context

package/app/hooks/save-session.sh

@@ -7,17 +7,22 @@
 # shellcheck source=_profile-check.sh
 source "$(dirname "$0")/_profile-check.sh"
 
+# Read from stdin (Claude Code passes JSON with .session_id, .last_assistant_message)
+INPUT=$(cat)
+SESSION_ID=$(echo "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
+LAST_MSG=$(echo "$INPUT" | jq -r '.last_assistant_message // "No summary available"' 2>/dev/null | head -5)
+
 SESSION_FILE=".claude/session-context.md"
 
-if [ -n "${CLAUDE_SESSION_ID:-}" ]; then
+if [ -n "$SESSION_ID" ]; then
     mkdir -p .claude
     cat > "$SESSION_FILE" << EOF
 # Session Context
 Updated: $(date -u +"%Y-%m-%dT%H:%M:%SZ")
-Session: ${CLAUDE_SESSION_ID:-unknown}
+Session: ${SESSION_ID}
 
-## Last Active Task
-${CLAUDE_TASK_DESCRIPTION:-No task description available}
+## Last Assistant Message
+${LAST_MSG}
 EOF
 fi
 

package/app/hooks/session-context.sh

@@ -8,7 +8,10 @@
 # shellcheck source=_profile-check.sh
 source "$(dirname "$0")/_profile-check.sh"
 
-SESSION="${CLAUDE_SESSION_ID:-$$}"
+# Read from stdin (Claude Code passes JSON with .session_id)
+INPUT=$(cat)
+SESSION=$(echo "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
+[ -z "$SESSION" ] && SESSION="$$"
 SESSIONS_DIR="$HOME/.ai-toolkit/sessions"
 mkdir -p "$SESSIONS_DIR"
 

package/app/hooks/subagent-start.sh

@@ -8,9 +8,11 @@
 # shellcheck source=_profile-check.sh
 source "$(dirname "$0")/_profile-check.sh"
 
-SUBAGENT="${CLAUDE_SUBAGENT_NAME:-${CLAUDE_TOOL_INPUT_SUBAGENT_TYPE:-subagent}}"
+# Read from stdin (Claude Code passes JSON with .agent_id, .agent_type)
+INPUT=$(cat)
+AGENT_TYPE=$(echo "$INPUT" | jq -r '.agent_type // "subagent"' 2>/dev/null)
 
-echo "SubagentStart: ${SUBAGENT} owns a narrow scope. Read only the necessary files first, cite evidence, and return explicit validation notes with any edits."
+echo "SubagentStart: ${AGENT_TYPE} owns a narrow scope. Read only the necessary files first, cite evidence, and return explicit validation notes with any edits."
 
 exit 0
 

package/app/hooks/subagent-stop.sh

@@ -8,9 +8,11 @@
 # shellcheck source=_profile-check.sh
 source "$(dirname "$0")/_profile-check.sh"
 
-SUBAGENT="${CLAUDE_SUBAGENT_NAME:-${CLAUDE_TOOL_INPUT_SUBAGENT_TYPE:-subagent}}"
+# Read from stdin (Claude Code passes JSON with .agent_id, .agent_type)
+INPUT=$(cat)
+AGENT_TYPE=$(echo "$INPUT" | jq -r '.agent_type // "subagent"' 2>/dev/null)
 
-echo "SubagentStop: ${SUBAGENT} should report findings, exact files touched, tests run, remaining risks, and any docs that must be updated by the lead agent."
+echo "SubagentStop: ${AGENT_TYPE} should report findings, exact files touched, tests run, remaining risks, and any docs that must be updated by the lead agent."
 
 exit 0
 

package/app/hooks/track-usage.sh

@@ -8,7 +8,11 @@
 # Uses atomic write via python3 os.replace() to prevent corruption.
 
 STATS_FILE="${HOME}/.ai-toolkit/stats.json"
-PROMPT_TEXT="${CLAUDE_USER_PROMPT:-${CLAUDE_PROMPT:-}}"
+
+# Read prompt from stdin (Claude Code passes JSON with .prompt field)
+INPUT=$(cat)
+PROMPT_TEXT=$(echo "$INPUT" | jq -r '.prompt // empty' 2>/dev/null)
+[ -z "$PROMPT_TEXT" ] && exit 0
 
 # Only track if prompt starts with a slash command
 SKILL_NAME=$(printf '%s' "$PROMPT_TEXT" | grep -oE '^/[a-z][a-z0-9-]*' | head -1 | sed 's|^/||')

package/app/hooks/user-prompt-submit.sh

@@ -8,7 +8,9 @@
 # shellcheck source=_profile-check.sh
 source "$(dirname "$0")/_profile-check.sh"
 
-PROMPT_TEXT="${CLAUDE_USER_PROMPT:-${CLAUDE_PROMPT:-}}"
+# Read prompt from stdin (Claude Code passes JSON with .prompt field)
+INPUT=$(cat)
+PROMPT_TEXT=$(echo "$INPUT" | jq -r '.prompt // empty' 2>/dev/null)
 LOWERED="$(printf '%s' "$PROMPT_TEXT" | tr '[:upper:]' '[:lower:]')"
 
 echo "STOP. Execute Step 0 before responding: check your CLAUDE.md for search-first rules. If search-first rules exist, call the required search tool NOW — before any other tool or text output. If you skip this step, the user will interrupt you."

package/bin/ai-toolkit.js

@@ -8,6 +8,11 @@ const fs = require('fs');
 const TOOLKIT_DIR = path.dirname(__dirname);
 const CWD = process.cwd();
 
+if (!process.env.HOME) {
+  console.error('Error: HOME environment variable is not set');
+  process.exit(1);
+}
+
 // ---------------------------------------------------------------------------
 // Generator map: command name -> { script, dest, mkdir? }
 // Used by individual generator commands, `generate-all`, and the default case.

package/kb/reference/skills-catalog.md

@@ -3,7 +3,7 @@ title: "AI Toolkit - Skills Catalog"
 category: reference
 service: ai-toolkit
 tags: [skills, domain-knowledge, catalog, task-skills, hybrid-skills]
-version: "1.3.0"
+version: "1.3.3"
 created: "2026-03-23"
 last_updated: "2026-04-07"
 description: "Complete catalog of 90 skills: 28 task, 30 hybrid, 32 knowledge. Includes effort levels, skill-scoped hooks, executable scripts, security auditor, and persona presets."
@@ -113,7 +113,7 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 | `application-deploy` | 3 | Deploy → smoke test → release notes |
 | `proactive-troubleshooting` | 4 | Investigate → check perf → preventive fix → docs |
 
-## Knowledge Skills - Development (10)
+## Knowledge Skills - Development (16)
 
 | Skill | Directory | Domain |
 |-------|-----------|--------|
@@ -124,6 +124,12 @@ Hybrid skills combine slash-command invocation with domain knowledge that agents
 | **ecommerce-patterns** | `skills/ecommerce-patterns/` | E-commerce: catalog, cart, checkout, payments |
 | **clean-code** | `skills/clean-code/` | Multi-language code quality: Python, TS, PHP, Go, Dart |
 | **typescript-patterns** | `skills/typescript-patterns/` | TypeScript/JavaScript patterns for frontend and backend |
+| **rust-patterns** | `skills/rust-patterns/` | Ownership, borrowing, error handling, Cargo, tokio, serde |
+| **java-patterns** | `skills/java-patterns/` | Records, sealed classes, Stream API, Spring Boot, JUnit 5 |
+| **csharp-patterns** | `skills/csharp-patterns/` | Nullable refs, async/await, ASP.NET Core, EF Core |
+| **kotlin-patterns** | `skills/kotlin-patterns/` | Coroutines, DSLs, sealed classes, Ktor, MockK |
+| **swift-patterns** | `skills/swift-patterns/` | Protocol-oriented, SwiftUI, async/await, SPM |
+| **ruby-patterns** | `skills/ruby-patterns/` | Blocks, Rails conventions, RSpec, ActiveRecord |
 | **design-engineering** | `skills/design-engineering/` | UI polish, animation craft, easing, transforms, accessibility |
 | **documentation-standards** | `skills/documentation-standards/` | KB document conventions, frontmatter validation, category taxonomy |
 | **brand-voice** | `skills/brand-voice/` | Anti-trope list, voice principles, LLM rhetoric prevention |

package/llms-full.txt

@@ -3343,10 +3343,10 @@ The `common/` directory uses the same structure except `frameworks.md` is replac
 
 ## Auto-Detection
 
-When `--auto-detect` is passed, `scripts/install_steps/detect_language.py` scans the current directory for known marker files and selects the matching language module:
+`--local` automatically enables language auto-detection. `scripts/install_steps/detect_language.py` scans the current directory for known marker files and selects matching language modules:
 
 ```bash
-ai-toolkit install --local --auto-detect
+ai-toolkit install --local     # auto-detects language (--auto-detect is implied)
 ```
 
 Detection logic (first match wins when multiple markers are present):
@@ -3368,14 +3368,14 @@ Common rules are always injected regardless of detected language.
 ## Installation
 
 ```bash
-# Auto-detect language from project files
-ai-toolkit install --local --auto-detect
+# Auto-detect language from project files (default with --local)
+ai-toolkit install --local
 
 # Explicitly select a language
 ai-toolkit install --local --lang typescript
 
-# Install without language rules
-ai-toolkit install --local
+# Skip auto-detect, install specific modules only
+ai-toolkit install --local --modules core,agents
 ```
 
 Language rules are injected into the project `CLAUDE.md` between named markers:
@@ -3491,8 +3491,8 @@ ai-toolkit install --profile standard
 # Module-based install (new)
 ai-toolkit install --modules core,agents,rules-typescript
 
-# Auto-detect project language and install matching rules
-ai-toolkit install --local --auto-detect
+# --local implies --auto-detect (language rules auto-detected)
+ai-toolkit install --local
 
 # Show currently installed modules and their state
 ai-toolkit status

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "Professional-grade AI coding toolkit: 90 skills, 44 agents, multi-platform support (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment), machine-enforced safety constitution, persona presets, skill security auditor, expanded lifecycle hooks, 11 plugin packs, and benchmark tooling.",
   "keywords": [
     "claude",

package/scripts/add_rule.py

@@ -14,6 +14,7 @@ Arguments:
 """
 from __future__ import annotations
 
+import re
 import shutil
 import sys
 from pathlib import Path
@@ -33,6 +34,10 @@ def main() -> None:
         sys.exit(1)
 
     rule_name = sys.argv[2] if len(sys.argv) > 2 else rule_file.stem
+    rule_name = re.sub(r"[^a-zA-Z0-9_-]", "", rule_name)
+    if not rule_name:
+        print("Error: rule name is empty after sanitization", file=sys.stderr)
+        sys.exit(1)
     rules_dir = Path.home() / ".ai-toolkit" / "rules"
     rules_dir.mkdir(parents=True, exist_ok=True)
 

package/scripts/plugin.py

@@ -588,6 +588,9 @@ def _parse_clean_args(args: list[str]) -> tuple[list[str], int]:
         if args[i] == "--days" and i + 1 < len(args):
             try:
                 days = int(args[i + 1])
+                if days <= 0:
+                    print(f"  ERROR: --days must be positive, got {days}")
+                    sys.exit(1)
             except ValueError:
                 print(f"  ERROR: --days requires a number, got '{args[i + 1]}'")
                 sys.exit(1)

package/scripts/sync.py

@@ -66,9 +66,23 @@ def do_import(source: str) -> None:
     """Import config from file or URL."""
     tmpfile: str | None = None
 
-    if source.startswith("http"):
-        tmpfile = tempfile.mktemp(suffix=".json")
-        urllib.request.urlretrieve(source, tmpfile)
+    if source.startswith("https://") or source.startswith("http://"):
+        if not source.startswith("https://"):
+            print("Error: HTTP imports are not supported. Use HTTPS for security.", file=sys.stderr)
+            sys.exit(1)
+        tmp_fd, tmpfile = tempfile.mkstemp(suffix=".json")
+        os.close(tmp_fd)
+        try:
+            import ssl
+            ctx = ssl.create_default_context()
+            with urllib.request.urlopen(source, timeout=30, context=ctx) as resp:
+                data = resp.read(10 * 1024 * 1024)  # 10MB max
+                with open(tmpfile, 'wb') as f:
+                    f.write(data)
+        except Exception:
+            if os.path.exists(tmpfile):
+                os.unlink(tmpfile)
+            raise
         source = tmpfile
 
     source_path = Path(source)
@@ -112,7 +126,8 @@ def do_push() -> None:
         print("Error: gh not authenticated. Run: gh auth login")
         sys.exit(1)
 
-    tmpfile = tempfile.mktemp(suffix=".json")
+    tmp_fd, tmpfile = tempfile.mkstemp(suffix=".json")
+    os.close(tmp_fd)
     Path(tmpfile).write_text(do_export(), encoding="utf-8")
 
     if GIST_ID_FILE.is_file():
@@ -153,12 +168,14 @@ def do_pull(gist_id: str = "") -> None:
         print("Usage: ai-toolkit sync --pull <gist-id>")
         sys.exit(1)
 
-    tmpfile = tempfile.mktemp(suffix=".json")
-    subprocess.run(
-        ["gh", "gist", "view", gist_id, "-f", "ai-toolkit-config.json"],
-        stdout=open(tmpfile, "w"),
-        check=True,
-    )
+    tmp_fd, tmpfile = tempfile.mkstemp(suffix=".json")
+    os.close(tmp_fd)
+    with open(tmpfile, "w") as f:
+        subprocess.run(
+            ["gh", "gist", "view", gist_id, "-f", "ai-toolkit-config.json"],
+            stdout=f,
+            check=True,
+        )
     do_import(tmpfile)
     os.unlink(tmpfile)
 

package/scripts/validate.py

@@ -30,7 +30,7 @@ from plugin_schema import validate_references as _validate_plugin_references
 # ---------------------------------------------------------------------------
 
 VALID_TOOLS = frozenset({
-    "Read", "Write", "Edit", "Bash", "Grep", "Glob", "Agent",
+    "Read", "Write", "Edit", "MultiEdit", "Bash", "Grep", "Glob", "Agent",
     "WebSearch", "WebFetch", "TodoRead", "TodoWrite",
     "TeamCreate", "TeamDelete", "SendMessage",
     "TaskCreate", "TaskList", "TaskUpdate", "TaskGet", "TaskOutput", "TaskStop",