@softspark/ai-toolkit 1.4.2 → 1.5.0

package/llms-full.txt

@@ -84,6 +84,7 @@
 - **git-mastery**: Loaded when user asks about advanced Git workflows or history rewriting
 - **grill-me**: Stress-test a plan or design through relentless Socratic questioning, walking down each decision branch until reaching shared understanding. Use when user wants to stress-test a plan, get grilled, validate assumptions, or mentions 'grill me'.
 - **health**: Report service and infrastructure health status
+- **hipaa-validate**: Validate code against HIPAA policy: PHI exposure, missing audit logging, unencrypted transmission/storage, access control gaps, temp file exposure, and missing BAA references
 - **hive-mind**: Loaded when orchestrating multi-agent swarms or consensus workflows
 - **hook-creator**: Creates new Claude Code hooks with guided workflow, strict conventions, and validation
 - **index**: Index codebase into the knowledge base
@@ -272,9 +273,9 @@ title: "SOP: Claude Toolkit Maintenance"
 category: procedures
 service: ai-toolkit
 tags: [sop, maintenance, agents, skills, install]
-version: "1.0.0"
+version: "1.4.2"
 created: "2026-03-23"
-last_updated: "2026-04-02"
+last_updated: "2026-04-09"
 description: "Standard operating procedures for installing, maintaining, and evolving the ai-toolkit."
 ---
 
@@ -291,18 +292,30 @@ cd /path/to/new-project
 ai-toolkit install --local
 ```
 
-This creates/updates:
+By default, `--local` installs Claude Code configs only:
 - `CLAUDE.md` — project-specific rules template (only if missing)
 - `.claude/settings.local.json` — MCP servers, env vars, permissions (only if missing, initialized with MCP defaults)
 - `.claude/constitution.md` — toolkit constitution **injected** via markers (preserves user content)
-- `.github/copilot-instructions.md` — GitHub Copilot rules (marker-injected)
-- `.clinerules` — Cline rules (marker-injected)
-- `.roomodes` — Roo Code custom modes (generated)
-- `.aider.conf.yml` — Aider configuration (generated)
-- `.git/hooks/pre-commit` — Safety fallback for quality gates (generated)
+
+To also install editor configs, use `--editors`:
+
+```bash
+ai-toolkit install --local --editors all                  # all supported editors
+ai-toolkit install --local --editors cursor,aider         # specific editors only
+```
+
+Supported editors: `cursor`, `windsurf`, `cline`, `roo`, `aider`, `augment`, `copilot`, `antigravity`.
+
+To restrict which language rules are injected into `CLAUDE.md`, use `--lang`:
+
+```bash
+ai-toolkit install --local --lang python,typescript
+```
 
 **Note:** Hooks are global-only — merged into `~/.claude/settings.json` by `ai-toolkit install`. Project-local `--local` does not install hooks; any legacy `.claude/hooks.json` is removed automatically.
 
+**Input validation (v1.4.2):** `--only`, `--skip`, `--editors`, and `--lang` are validated on input; an invalid value exits with a clear error before any changes are made.
+
 Then edit `CLAUDE.md`:
 ```markdown
 # My Project
@@ -359,11 +372,14 @@ ai-toolkit update
 `update` is a semantic alias for `install` — use it for all re-apply flows. Supports the same flags:
 
 ```bash
-ai-toolkit update --only agents,hooks   # re-apply only specific components
-ai-toolkit update --local               # also refresh project-local Copilot + Cline + Roo + Aider
-ai-toolkit update --list                # dry-run: show what would change
+ai-toolkit update --only agents,hooks                  # re-apply only specific components
+ai-toolkit update --local                              # refresh project-local Claude Code configs; auto-detects editors from existing project files (no --editors needed)
+ai-toolkit update --local --editors cursor,windsurf   # override auto-detection and target specific editors
+ai-toolkit update --list                               # dry-run: show what would change
 ```
 
+When running `update --local`, the CLI inspects existing config files (e.g. `.cursor/rules`, `.aider.conf.yml`) to determine which editors are present and refreshes only those — no flags required.
+
 ---
 
 ## Register a Rule from Another Repo
@@ -502,15 +518,14 @@ ai-toolkit benchmark-ecosystem --offline   # benchmark snapshot
 Changes propagate instantly to all machines via symlinks. After any change:
 
 ```bash
-scripts/validate.py           # must pass before commit
-npm test                      # must pass before commit
+npm run generate:all          # FIRST: regenerate AGENTS.md, llms.txt, all platform configs
+scripts/validate.py           # then validate — must pass before commit
+npm test                      # then test — must pass before commit
 ```
 
-If you added/removed agents or skills, also regenerate derived artifacts:
-
-```bash
-npm run generate:all          # regenerates AGENTS.md, llms.txt, all platform configs
-```
+Run `generate:all` before validate and test so that generated artifacts are current when
+the metadata contract tests run. Committing without regenerating first causes artifact
+drift and fails CI.
 
 ## Release Checklist
 
@@ -541,7 +556,17 @@ npm test            # full bats suite including metadata contracts and CLI tests
 The metadata contract tests (`tests/test_metadata_contracts.bats`) catch drift
 automatically. If they fail, fix the stale numbers before continuing.
 
-### 5. Commit and tag
+### 5. Check for artifact drift
+
+```bash
+git diff --stat
+```
+
+Review the diff to confirm that all generated files (`AGENTS.md`, `llms.txt`, platform
+configs) reflect the current state. If `generate:all` produced unexpected changes,
+investigate before staging.
+
+### 6. Commit and tag
 
 ```bash
 git add -A
@@ -871,9 +896,9 @@ title: "AI Toolkit - Agents Catalog"
 category: reference
 service: ai-toolkit
 tags: [agents, catalog, roles, ai-development]
-version: "1.3.10"
+version: "1.4.2"
 created: "2026-03-23"
-last_updated: "2026-03-25"
+last_updated: "2026-04-09"
 description: "Complete catalog of specialized agents with roles, models, and use cases."
 ---
 
@@ -1223,9 +1248,9 @@ title: "AI Toolkit - Architecture Overview"
 category: reference
 service: ai-toolkit
 tags: [architecture, overview, design, structure]
-version: "1.4.0"
+version: "1.4.2"
 created: "2026-03-23"
-last_updated: "2026-04-08"
+last_updated: "2026-04-09"
 description: "Architecture of ai-toolkit: directory layout, global install model, skill tiers, and integration with projects."
 ---
 
@@ -1397,7 +1422,7 @@ Three tiers determine how to approach a task:
 
 | Type | Field | Invocation | Count |
 |------|-------|-----------|-------|
-| Task | `disable-model-invocation: true` | User via `/skill` only | 28 |
+| Task | `disable-model-invocation: true` | User via `/skill` only | 29 |
 | Hybrid | (neither) | User via `/skill` + agent knowledge | 31 |
 | Knowledge | `user-invocable: false` | Claude auto-loads | 32 |
 
@@ -2546,9 +2571,9 @@ title: "Distribution Model"
 category: reference
 service: ai-toolkit
 tags: [architecture, distribution, symlinks, npm, install]
-version: "1.0.0"
+version: "1.4.2"
 created: "2026-03-23"
-last_updated: "2026-03-28"
+last_updated: "2026-04-09"
 description: "Reference description of how ai-toolkit is delivered and propagated on a developer machine."
 ---
 
@@ -2794,9 +2819,9 @@ title: "Global Install Model"
 category: reference
 service: ai-toolkit
 tags: [install, global, claude, local-setup]
-version: "1.0.0"
+version: "1.4.2"
 created: "2026-03-26"
-last_updated: "2026-03-28"
+last_updated: "2026-04-09"
 description: "Reference description of the global install target, local project setup, and command responsibilities in ai-toolkit."
 ---
 
@@ -2814,8 +2839,10 @@ That means one machine-level install provides agents, skills, hooks, and rules t
 |---------|--------|---------|
 | `ai-toolkit install` | `~/.claude/` | first-time machine setup |
 | `ai-toolkit update` | `~/.claude/` | re-apply after package or rule changes |
-| `ai-toolkit install --local` | current project | create local `CLAUDE.md`, `.claude/settings.local.json`, and inject constitution + Copilot + Cline + Roo Code + Aider configs. Installs git hooks fallback. |
-| `ai-toolkit update --local` | current project | refresh those local project files |
+| `ai-toolkit install --local` | current project | Claude Code configs only (CLAUDE.md, settings, constitution, language rules). Add `--editors all` for other tools, or `--editors cursor,aider` for specific ones. Auto-detects editors from existing project files when `--editors` is omitted. |
+| `ai-toolkit install --local --lang <lang>` | current project | explicit language selection for rules (e.g. `--lang typescript`, `--lang go,python`); auto-detected when omitted |
+| `ai-toolkit install --modules <list>` | `~/.claude/` | selective module install (e.g. `--modules core,agents,rules-typescript`) |
+| `ai-toolkit update --local` | current project | refresh project configs; auto-detects editors from existing files |
 | `ai-toolkit add-rule` | `~/.ai-toolkit/rules/` | register a global rule |
 | `ai-toolkit remove-rule` | `~/.ai-toolkit/rules/` | unregister a global rule |
 
@@ -2836,6 +2863,8 @@ These files still stay local to a repository:
 - `.clinerules`
 - `.roomodes`
 - `.aider.conf.yml`
+- `.augment/rules/ai-toolkit-*.md`
+- `.agent/rules/*.md` and `.agent/workflows/*.md` (Google Antigravity)
 - `.git/hooks/pre-commit` (fallback)
 - project-specific documentation or safety overlays
 
@@ -3060,9 +3089,9 @@ title: "Hooks Catalog"
 category: reference
 service: ai-toolkit
 tags: [hooks, quality, safety, enforcement, settings.json]
-version: "1.1.0"
+version: "1.4.2"
 created: "2026-03-27"
-last_updated: "2026-04-07"
+last_updated: "2026-04-09"
 description: "Complete reference of all ai-toolkit hooks: events, scripts, installation, and runtime behavior."
 ---
 
@@ -3437,7 +3466,7 @@ Set in `.claude/settings.local.json`:
 
 **Hook script not found:**
 ```bash
-ls ~/.ai-toolkit/hooks/     # should list 12 .sh files (plus _profile-check.sh helper)
+ls ~/.ai-toolkit/hooks/     # should list 21 .sh files (plus _profile-check.sh helper)
 ai-toolkit update            # re-copies scripts
 ```
 
@@ -4426,9 +4455,9 @@ title: "AI Toolkit - Skills Catalog"
 category: reference
 service: ai-toolkit
 tags: [skills, domain-knowledge, catalog, task-skills, hybrid-skills]
-version: "1.4.0"
+version: "1.4.2"
 created: "2026-03-23"
-last_updated: "2026-04-08"
+last_updated: "2026-04-09"
 description: "Complete skills catalog with task, hybrid, and knowledge skills. Includes effort levels, skill-scoped hooks, executable scripts, security auditor, and persona presets."
 ---
 
@@ -4444,7 +4473,7 @@ All functionality is unified under skills. Task and hybrid skills are user-invoc
 | **2 — Multi-agent workflow** | `/workflow <type>` | Cross-cutting task with known pattern |
 | **3 — Custom parallelism** | `/orchestrate`, `/swarm` | No predefined workflow matches |
 
-## Task Skills (28)
+## Task Skills (29)
 
 Task skills execute a specific action. Invoked via slash commands. `disable-model-invocation: true`.
 
@@ -4478,6 +4507,7 @@ Task skills execute a specific action. Invoked via slash commands. `disable-mode
 | **health** | `/health` | medium | Check health of project services (auto-detect) |
 | **prd-to-issues** | `/prd-to-issues` | medium | Break PRD into GitHub issues with vertical slices and HITL/AFK tagging |
 | **skill-audit** | `/skill-audit` | medium | Scan skills and agents for security risks: dangerous patterns, secrets, excessive permissions |
+| **hipaa-validate** | `/hipaa-validate` | medium | Scan codebase for HIPAA compliance issues: PHI exposure, missing audit logging, unencrypted transmission/storage, access control gaps, temp file exposure, and missing BAA references |
 
 ## Hybrid Skills (31)
 

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.4.2",
+  "version": "1.5.0",
   "components": {
     "agents": {
       "description": "44 specialized agents (orchestrator, backend, frontend, security, devops, etc.)",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "1.4.2",
-  "description": "Professional-grade AI coding toolkit: 91 skills, 44 agents, multi-platform support (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment, Google Antigravity), machine-enforced safety constitution, persona presets, skill security auditor, expanded lifecycle hooks, 11 plugin packs, and benchmark tooling.",
+  "version": "1.5.0",
+  "description": "Professional-grade AI coding toolkit: 92 skills, 44 agents, multi-platform support (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo Code, Aider, Augment, Google Antigravity), machine-enforced safety constitution, persona presets, skill security auditor, expanded lifecycle hooks, 11 plugin packs, and benchmark tooling.",
   "keywords": [
     "claude",
     "claude-code",

package/scripts/install.py

@@ -257,6 +257,56 @@ def parse_args(argv: list[str]) -> dict:
     return cfg
 
 
+# ---------------------------------------------------------------------------
+# Input validation
+# ---------------------------------------------------------------------------
+
+VALID_COMPONENTS = {"agents", "skills", "hooks", "rules", "constitution", "architecture"}
+VALID_LANGS = {"python", "typescript", "golang", "go", "rust", "java", "kotlin",
+               "swift", "ruby", "php", "dart", "cpp", "csharp", "c++", "c#", "cs",
+               "common"}
+
+
+def validate_args(cfg: dict) -> None:
+    """Validate parsed arguments — exit non-zero on invalid values."""
+    from install_steps.ai_tools import ALL_EDITORS
+
+    errors: list[str] = []
+
+    # Validate --only components
+    if cfg["only"]:
+        for c in cfg["only"].split(","):
+            c = c.strip()
+            if c and c not in VALID_COMPONENTS:
+                errors.append(f"Unknown component in --only: '{c}' (valid: {', '.join(sorted(VALID_COMPONENTS))})")
+
+    # Validate --skip components
+    if cfg["skip"]:
+        for c in cfg["skip"].split(","):
+            c = c.strip()
+            if c and c not in VALID_COMPONENTS:
+                errors.append(f"Unknown component in --skip: '{c}' (valid: {', '.join(sorted(VALID_COMPONENTS))})")
+
+    # Validate --editors
+    if cfg["editors"] and cfg["editors"] != "all":
+        for e in cfg["editors"].split(","):
+            e = e.strip()
+            if e and e not in ALL_EDITORS:
+                errors.append(f"Unknown editor: '{e}' (valid: {', '.join(ALL_EDITORS)}, all)")
+
+    # Validate --lang
+    if cfg["lang"]:
+        for l in cfg["lang"].split(","):
+            l = l.strip()
+            if l and l.lower() not in VALID_LANGS:
+                errors.append(f"Unknown language: '{l}' (valid: {', '.join(sorted(VALID_LANGS - {'c++', 'c#', 'cs', 'go', 'common'}))})")
+
+    if errors:
+        for e in errors:
+            print(f"Error: {e}")
+        sys.exit(1)
+
+
 # ---------------------------------------------------------------------------
 # Dependency check
 # ---------------------------------------------------------------------------
@@ -408,6 +458,7 @@ def _get_toolkit_version() -> str:
 
 def main() -> None:
     cfg = parse_args(sys.argv[1:])
+    validate_args(cfg)
 
     # Handle --status early exit
     if cfg["status"]: