@softspark/ai-toolkit 4.16.0 → 4.17.0

package/CHANGELOG.md

@@ -7,6 +7,47 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v4.17.0 — Native tool-output filter removed (2026-07-26)
+
+### Removed
+
+- **BREAKING for anyone who opted in.** The native tool-output filter shipped
+  in v4.16.0 is gone: the `PostToolUse` hook `filter-tool-output.sh`, the
+  `scripts/tool_output_filter/` runtime, the `ai-toolkit output-filter` CLI,
+  the benchmark corpus, and the `toolOutputFilter` key in
+  `.softspark-toolkit.json`. The key is accepted and ignored rather than
+  rejected, so an existing config still validates; `ai-toolkit config validate`
+  reports it as a retired key you can delete.
+- Why: measured whole-session token saving was **0.0000%** on real traffic.
+  Across 134 session transcripts spanning 22 projects, 7600 successful Bash
+  results contained 145 that parsed as simple command shapes, 18 that matched a
+  registered shape, and 0 that any filter accepted. The filter was correct;
+  its premise was not. Agent-issued commands are overwhelmingly compound
+  (`&&` and `;` chains, pipelines, heredocs), and the design accepted only
+  simple registered shapes. See
+  `kb/history/completed/output-filter-retirement-20260726.md`.
+
+### Changed
+
+- `ai-toolkit install` and `ai-toolkit update` now remove the artifacts left by
+  v4.16.x: the installed hook script, the global
+  `hooks/output-filter-policy.json`, the managed project policy and owner
+  marker under `.claude/`, and stored recovery trees under
+  `sessions/<repo-key>/output-filter/`. Cleanup is idempotent, verifies
+  ai-toolkit ownership before deleting, and leaves foreign files untouched.
+- The stale `PostToolUse` entry is removed from `~/.claude/settings.json` by
+  the existing hook strip-and-remerge cycle, so no manual edit is needed.
+- Hook counts drop from 29 entries to 28 across the same 14 events.
+
+## v4.16.1 — Copilot skill remnant recovery (2026-07-24)
+
+### Fixed
+
+- **Legacy Copilot skill remnants no longer abort local updates** — `.github/skills/ai-toolkit-*` directories left behind by pre-manifest cleanups (assets without `SKILL.md`) are rebuilt in place instead of raising `Refusing user-owned Copilot skill collision`, which aborted the entire `install --local` / `update` run on affected projects. User files inside a remnant that do not collide with generated output are preserved; any directory that still contains a `SKILL.md` stays protected and is never reclaimed.
+- **Readable installer errors** — `scripts/install.py` reports fail-closed `RuntimeError` conditions as a single `ERROR:` line instead of a raw traceback.
+
+Test count: 1477 → 1479.
+
 ## v4.16.0 — Native tool-output filtering (2026-07-24)
 
 Minor release. Adds a dependency-free, opt-in native tool-output filter for Claude Code and hardens the enterprise configuration, session-isolation, and editor-adapter surfaces around it. The filter ships disabled; `observe` and `safe` are per-project opt-ins. No source catalog count change (44 agents, 108 skills).

package/README.md

@@ -6,17 +6,17 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Skills](https://img.shields.io/badge/skills-108-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-44-blue)](app/agents/)
-[![Tests](https://img.shields.io/badge/tests-1477%20passing-success)](tests/)
+[![Tests](https://img.shields.io/badge/tests-1445%20passing-success)](tests/)
 
-## What's New in v4.16.0
+## What's New in v4.17.0
 
-v4.16.0 adds a dependency-free, opt-in native tool-output filter for Claude Code and hardens the enterprise configuration surface around it.
+v4.17.0 removes the native tool-output filter shipped in v4.16.0.
 
-- **Native tool-output filter**: opt-in `PostToolUse` filter with `off`, `observe`, and `safe` modes; ships disabled, handles only allowlisted successful Bash test/validation output.
-- **Exact ephemeral recovery**: every safe replacement keeps a private, bounded, session-scoped copy of the original response, recoverable via `ai-toolkit output-filter recover`.
-- **Output-filter CLI**: `ai-toolkit output-filter status|inspect|recover|clean` plus a deterministic benchmark for the built-in profiles.
+- **Native tool-output filter removed**: measured whole-session token saving was 0.0000% on real traffic, because agent-issued commands are overwhelmingly compound and the filter only accepted simple registered shapes. The `PostToolUse` hook, the CLI, and the `toolOutputFilter` config key are gone.
+- **Automatic cleanup on update**: `ai-toolkit update` removes the orphaned hook script, the global and project policy files, and any stored recovery artifacts left by v4.16.x. Foreign files in those directories are preserved.
 - **Stricter config validation**: unknown top-level config keys are rejected, plugin manifests must declare `requires`, and lock files go stale on toolkit version bumps.
 - **GitHub Copilot compatibility reference**: new `kb/reference/copilot-compatibility.md` documenting the Copilot integration surface.
+- **Copilot remnant recovery**: asset-only `.github/skills/ai-toolkit-*` leftovers from older cleanups are rebuilt in place instead of aborting `install --local` / `update`.
 
 See [CHANGELOG.md](CHANGELOG.md) for full history.
 
@@ -91,10 +91,7 @@ ai-toolkit claude-app export --verify
 ```
 
 Re-export and re-upload after toolkit or registered-rule updates. Skills work
-in Chat and Cowork; hooks and sub-agents are active only in Cowork. The native
-tool-output replacement hook remains Claude Code-only and is excluded from the
-Claude app archive until that runtime has an independently verified replacement
-contract.
+in Chat and Cowork; hooks and sub-agents are active only in Cowork.
 
 ### Install Profiles
 
@@ -126,7 +123,7 @@ See [CLI Reference](kb/reference/cli-reference.md) for all commands and options.
 | Gemini CLI | `~/.gemini/GEMINI.md` | ✅ | global |
 | GitHub Copilot | Project: `AGENTS.md` + `.github/copilot-instructions.md` + `.github/{instructions,prompts,agents,skills,hooks}/` + `.github/mcp.json`; user: `$COPILOT_HOME/copilot-instructions.md` + `$COPILOT_HOME/{instructions,agents,skills,hooks}/` + `$COPILOT_HOME/mcp-config.json` | ✅ | project + user |
 | Cline | `~/Documents/Cline/Rules/*.md` + `~/.cline/skills/*` + `.clinerules/*.md` | — | global + project |
-| Roo Code | `~/.roo/rules/*.md` + `.roomodes` + `.roo/rules/*.md` | — | global rules + project |
+| Roo Code / [Zoo Code](https://zoocode.dev/) | `~/.roo/rules/*.md` + `.roomodes` + `.roo/rules/*.md` | — | global rules + project |
 | Aider | `~/.aider.conf.yml` + `.aider.conf.yml` + `CONVENTIONS.md` | — | global + project |
 | Augment | `~/.augment/rules/*.md` + `.augment/rules/ai-toolkit-*.md` | ✅ | global + project |
 | Google Antigravity | `.agents/rules/*.md` + `.agents/workflows/*.md` + skill pointer in `.agent/skills/*` (IDE) and `.agents/skills/*` (CLI) | — | project |
@@ -145,7 +142,7 @@ See [CLI Reference](kb/reference/cli-reference.md) for all commands and options.
 | `skills/` (hybrid) | 30 | Slash commands with agent knowledge base |
 | `skills/` (knowledge) | 46 | Domain knowledge auto-loaded by agents (includes 13 `<lang>-rules` skills) |
 | `agents/` | 44 | Specialized agents across 10 categories |
-| `hooks/` | 29 entries / 14 events + statusLine | Quality gates, path safety, prompt governance, loop guard, output filtering, session lifecycle |
+| `hooks/` | 28 entries / 14 events + statusLine | Quality gates, path safety, prompt governance, loop guard, session lifecycle |
 | `plugins/` | 11 packs | Opt-in domain bundles (security, research, frontend, enterprise, 6 language packs) |
 | `constitution.md` | 7 articles | Machine-enforced safety rules |
 | `rules/` | auto-synced | Global/project rule files for Claude and other editors |
@@ -169,7 +166,7 @@ ai-toolkit/
 │   └── ARCHITECTURE.md  # Full system design
 ├── kb/                  # Reference docs, procedures, plans
 ├── scripts/             # Validation, install, evaluation scripts
-├── tests/               # Bats and Python test suite (1477 tests)
+├── tests/               # Bats and Python test suite (1445 tests)
 └── CHANGELOG.md
 ```
 
@@ -181,9 +178,7 @@ ai-toolkit/
 
 **Machine-enforced constitution** — 7-article safety constitution enforced via `PreToolUse` hooks that actually block `rm -rf`, `DROP TABLE`, and irreversible operations. Not just documentation.
 
-**29 lifecycle hook entries:** Executable handlers across 14 events (SessionStart → SessionEnd, plus InstructionsLoaded + ConfigChange). Guards, governance, quality gates, session persistence, MCP health checks, revert protection, test-cohesion enforcement, loop guard, search-first discipline, and opt-in output filtering. See [Hooks Catalog](kb/reference/hooks-catalog.md).
-
-**Native tool-output filtering** — dependency-free, post-execution filtering for successful Claude Code Bash output, shipped **disabled by default** (`off`). Neither `off` nor `observe` ever replaces output; opt-in `safe` mode replaces only validated `repeat-lines` or `tap-success` results after exact ephemeral recovery is available. Failures, diagnostics, unsupported payloads, and unavailable recovery always pass through unchanged. See [Tool Output Filter](kb/reference/tool-output-filter.md).
+**28 lifecycle hook entries:** Executable handlers across 14 events (SessionStart → SessionEnd, plus InstructionsLoaded + ConfigChange). Guards, governance, quality gates, session persistence, MCP health checks, revert protection, test-cohesion enforcement, loop guard, and search-first discipline. See [Hooks Catalog](kb/reference/hooks-catalog.md).
 
 **Security scanning** — `/skill-audit` for code-level risks, `/cve-scan` for dependency CVEs. Both CI-ready with exit codes.
 

package/app/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "ai-toolkit",
   "displayName": "AI Toolkit",
   "description": "Professional-grade engineering skills, agents, rules, and lifecycle guardrails for Claude Code, Claude Chat, and Cowork.",
-  "version": "4.16.0",
+  "version": "4.17.0",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"

package/app/hooks/session-end.sh

@@ -3,7 +3,7 @@
 #
 # Fires on: SessionEnd
 # Matcher: all
-# The handoff snapshot is skipped for the minimal profile. Owned recovery
+# The handoff snapshot is skipped for the minimal profile. Session-state
 # cleanup still runs for every profile.
 
 # shellcheck source=_session-paths.sh
@@ -18,18 +18,6 @@ if [ ! -t 0 ]; then
     INPUT=$(cat)
 fi
 SESSION_ID=$(hook_session_id)
-RECOVERY_ROOT="$SESSION_DIR/output-filter"
-OUTPUT_FILTER_CLI="${AI_TOOLKIT_OUTPUT_FILTER_CLI:-$HOME/.softspark/ai-toolkit/scripts/output_filter_cli.py}"
-if [ "$SESSION_ID" != "default" ] &&
-   [ -d "$RECOVERY_ROOT" ] &&
-   [ ! -L "$RECOVERY_ROOT" ] &&
-   [ -f "$OUTPUT_FILTER_CLI" ] &&
-   [ ! -L "$OUTPUT_FILTER_CLI" ] &&
-   command -v python3 >/dev/null 2>&1; then
-    python3 -S "$OUTPUT_FILTER_CLI" clean \
-        --base-directory "$SESSION_DIR" \
-        --session-id "$SESSION_ID" >/dev/null 2>&1 || true
-fi
 
 SESSION_STATE_CLI="${AI_TOOLKIT_SESSION_STATE_CLI:-$HOME/.softspark/ai-toolkit/scripts/session_state.py}"
 if [ "$SESSION_ID" != "default" ] &&

package/app/hooks.json

@@ -158,16 +158,6 @@
                         "command": "\"$HOME/.softspark/ai-toolkit/hooks/search-tracker.sh\""
                     }
                 ]
-            },
-            {
-                "_source": "ai-toolkit",
-                "matcher": "Bash",
-                "hooks": [
-                    {
-                        "type": "command",
-                        "command": "\"$HOME/.softspark/ai-toolkit/hooks/filter-tool-output.sh\""
-                    }
-                ]
             }
         ],
         "Stop": [

package/benchmarks/ecosystem-doctor-snapshot.json

@@ -1,5 +1,5 @@
 {
-  "last_run": "2026-07-24T03:52:58Z",
+  "last_run": "2026-07-26T11:36:57Z",
   "schema_version": 1,
   "tools": {
     "aider": {
@@ -24,7 +24,7 @@
       }
     },
     "augment": {
-      "docs_hash": "388c0b5e25ab4906",
+      "docs_hash": "1dd9e9f490e7103a",
       "headings": [
         "Admin",
         "Auggie CLI",
@@ -66,7 +66,7 @@
       }
     },
     "claude-app": {
-      "docs_hash": "3c7ff437aec0ab98",
+      "docs_hash": "9a5cb995316c7c71",
       "headings": [
         "Add global and folder instructions",
         "Availability",
@@ -107,7 +107,7 @@
       }
     },
     "claude-code": {
-      "docs_hash": "a6ae93657498688c",
+      "docs_hash": "d373a3e4db1f4c79",
       "headings": [
         "Core concepts",
         "Documentation Index",
@@ -163,10 +163,10 @@
         "slash command": false,
         "sub-agent": true
       },
-      "version": "2.1.218 (Claude Code)"
+      "version": "2.1.220 (Claude Code)"
     },
     "cline": {
-      "docs_hash": "3eaa20e45d385a1f",
+      "docs_hash": "d76db24ff58cb7ea",
       "headings": [
         "API Reference",
         "Best Practices",
@@ -213,7 +213,7 @@
       }
     },
     "codex-cli": {
-      "docs_hash": "87a5a879a39dc62c",
+      "docs_hash": "379d4d3760235c7f",
       "headings": [
         "API",
         "API Reference",
@@ -243,12 +243,10 @@
         "Connect tools and data",
         "Connection methods",
         "Contribute",
-        "Conversion apps",
-        "Core Concepts",
+        "Conversion specs",
         "Core concepts",
         "Cost and throughput",
         "Customization",
-        "Deploy",
         "Deployment and model providers",
         "Desktop app",
         "Development workflows",
@@ -309,6 +307,7 @@
         "Start your first task",
         "Stay in control",
         "Suggested",
+        "Test and publish",
         "Text and code",
         "Third-party integrations",
         "Topics",
@@ -349,7 +348,7 @@
       "version": "codex-cli 0.145.0"
     },
     "cursor": {
-      "docs_hash": "5387d04443d26da1",
+      "docs_hash": "74d1366066760874",
       "headings": [],
       "markers": {
         ".cursor/rules": false,
@@ -365,7 +364,7 @@
       }
     },
     "gemini-cli": {
-      "docs_hash": "8db25b552ffbed80",
+      "docs_hash": "c6d93617f9359329",
       "headings": [
         "Breadcrumbs",
         "Directory actions",
@@ -408,7 +407,7 @@
       }
     },
     "github-copilot": {
-      "docs_hash": "5d021df2f3b4d39b",
+      "docs_hash": "1c6e0fd930f573fa",
       "headings": [
         "About Copilot auto model selection",
         "About Copilot automations",
@@ -461,7 +460,7 @@
       }
     },
     "opencode": {
-      "docs_hash": "f1dd69ffcfb280fa",
+      "docs_hash": "297813a7e2881afe",
       "headings": [
         "Add features",
         "Ask questions",
@@ -521,7 +520,7 @@
       }
     },
     "windsurf": {
-      "docs_hash": "bee6ba0ee1a517dd",
+      "docs_hash": "d57d379406804a4b",
       "headings": [
         "Accounts",
         "Advanced",

package/bin/ai-toolkit.js

@@ -50,7 +50,6 @@ const SCRIPT_COMMANDS = {
   'benchmark-ecosystem':  { script: 'benchmark_ecosystem.py', toolkitCwd: true },
   'evaluate':             { script: 'evaluate_skills.py',    toolkitCwd: true },
   'stats':                { script: 'stats.py' },
-  'output-filter':        { script: 'output_filter_cli.py' },
   'compile-slm':          { script: 'compile_slm.py' },
   'pack-codebase':        { script: 'pack_codebase.py' },
   'claude-app':           { script: 'claude_app.py',          toolkitCwd: true },
@@ -80,7 +79,6 @@ const COMMANDS = {
   'benchmark-ecosystem': 'Generate ecosystem benchmark snapshot (GitHub metadata + offline fallback)',
   evaluate: 'Run skill evaluation suite',
   stats: 'Show skill usage statistics (--summary for product telemetry, --reset to clear)',
-  'output-filter': 'Manage native tool-output filter (status, inspect, recover, clean)',
   create: 'Scaffold new skill from template (e.g. create skill my-lint --template=linter)',
   mcp: 'Manage MCP templates and install native editor MCP configs',
   config: 'Manage config inheritance (validate, diff, init, create-base, check)',

package/kb/history/completed/output-filter-retirement-20260726.md

@@ -0,0 +1,128 @@
+---
+title: "Retirement: Native Tool-Output Filter — Measured 0% and Removed"
+category: planning
+service: ai-toolkit
+tags:
+  - output-filter
+  - token-reduction
+  - postmortem
+  - measurement
+  - claude-code
+doc_type: postmortem
+status: completed
+created: "2026-07-26"
+last_updated: "2026-07-26"
+shipped_in: "v4.17.0 (removal)"
+description: "Why the native tool-output filter shipped in v4.16.0 was removed in v4.17.0: measured 0.0000% whole-session token saving on real traffic, because agent-issued commands are compound and the design accepted only simple registered shapes."
+---
+
+# Retirement: Native Tool-Output Filter
+
+**Shipped:** v4.16.0 (2026-07-23). **Removed:** v4.17.0 (2026-07-26).
+
+## The number
+
+Measured whole-session input-token saving: **0.0000%**.
+
+Real Bash results from local Claude Code transcripts were replayed through the
+shipped classifier and the full filter registry. The filters ran on the actual
+captured output; this is a measurement, not an estimate.
+
+| Scope | Value |
+|---|---:|
+| Transcripts replayed | 134, across 22 distinct projects |
+| Successful Bash results | 7600 |
+| Of those, parsed as a simple command shape | 145 (1.9%) |
+| Of those, matched a registered shape | 18 (0.24%) — 16 `git diff`, 2 `git show` |
+| Accepted by any filter | **0** |
+| Bytes saved | **0** |
+
+The classifier was verified working before the result was accepted: `git
+status`, `git log -n 20`, `pytest -v`, `bats --tap`, and `npm test` each
+produced exactly one candidate. The zero is real.
+
+## Why: the premise, not the implementation
+
+Seventeen filters were correct. They cleared their byte floors on owned
+fixtures (44–95% reduction), stayed inside every latency budget at the 8 MiB
+engine cap, passed adversarial safety review, and never once compressed a
+failure. None of that mattered, because the commands they were built for are
+not the commands that get issued.
+
+95% of successful Bash invocations are compound. The byte pool breaks down as:
+
+| Class | Share of compound bytes | Why the filter refused it |
+|---|---:|---|
+| `;` chain | 44.3% | multiple output producers, attribution ambiguous |
+| multiline script | 29.1% | rejected at the raw-string boundary |
+| pipeline | 12.7% | the pipe transformed the output |
+| `&&` chain with producing segments | 5.6% | multiple output producers |
+| redirect, substitution | 4.4% | rejected at the raw-string boundary |
+| heredoc | 3.5% | rejected at the raw-string boundary |
+
+Every one of those refusals was the correct safety decision in isolation.
+Together they excluded the entire population.
+
+The most-frequent single shape was `cd <path> && …`, at 375 results and 480 KB.
+A bounded `cd`-prefix subset had already been designed, threat-modelled, and
+measured during Phase 3, and it was dropped because it covered 0.00% of the
+compound pool. The retirement measurement confirms why: of those 375 results,
+only 5 had a single simple second segment, and those 5 produced 0 bytes of
+output.
+
+## What was already rejected on the way, and still stands
+
+- **Read-result coverage: rejected on the `Edit` exact-match hazard.** On
+  670.7 KB of real Read content, adjacent-duplicate collapse saves 0.00%,
+  blank-run collapse 0.04%, trailing-whitespace 0.00%. Anything above noise
+  requires elision, and 80.7% of `Edit` old-strings target a file read earlier
+  in the same session, 63.4% of them multi-line byte-exact quotes. A Read
+  result asserts what is on disk, so omission is a false claim rather than a
+  summary.
+- **Compound-command subset: designed, measured at 0.00% coverage, dropped.**
+  The pipeline-truncator shape failed on an inversion: a truncated document
+  parses cleanly exactly where the shape would pay, and rejects exactly where
+  truncation is detectable.
+
+## The process lesson
+
+The plan validated its **design** exhaustively across five phases and its
+**premise** not at all until the fifth. Fixtures measured the filter; only real
+traffic measured the value, and the two disagreed by two orders of magnitude.
+
+The end-to-end replay that produced the 0% took under an hour and could have
+run on day one, before any filter existed. Any future plan of this shape must
+put premise validation in Phase 0, with a kill number published before the
+measurement rather than argued after it.
+
+## Evaluated as a replacement: rtk
+
+`rtk` (https://github.com/rtk-ai/rtk, Apache-2.0) rewrites commands at
+`PreToolUse` rather than filtering output afterwards, which is the mechanism
+this project's own safety contract had excluded. Its rewrite pipeline was
+ported and validated against 197 of its own test assertions (197/197 exact
+agreement), then applied to the same traffic:
+
+- addresses **31.5%** of successful Bash bytes, **9.7%** of all tool-result
+  bytes — genuinely non-zero, so the in-house 0% was a coverage failure rather
+  than a law of nature;
+- projected saving is **0.32–0.48%** of session input tokens on rtk's own
+  60–90% claim, and **0.15–0.21%** once its filters' actual behaviour is
+  modelled;
+- its two largest families here under-deliver: `rtk read` returns files
+  verbatim at the default `--level none`, and `rtk grep` models at 12.3%
+  against a claimed 75%;
+- custom TOML filters, the documented extension point, would reach 1.91% of
+  Bash bytes. The large misses are structurally unreachable from config:
+  `| head` and `| tail` (34.6%) are blocked by the pipeline-final rule, and
+  `sed` (19.4%) sits in the hard-ignored prefix list.
+
+Not adopted.
+
+## Where the tokens actually are
+
+The measurement points somewhere other than command output. In this traffic,
+`Read` is 53.8% of tool-result bytes, and within Bash the two largest buckets
+are `sed` used as a file reader (16.2%) and `| head` / `| tail` pipeline tails
+(34.6%). Those are file-reading patterns, not tool reports. Any future attempt
+at token reduction should start there, and should start by measuring.

package/kb/reference/architecture-overview.md

@@ -3,9 +3,9 @@ title: "AI Toolkit - Architecture Overview"
 category: reference
 service: ai-toolkit
 tags: [architecture, overview, design, structure]
-version: "1.5.0"
+version: "1.6.0"
 created: "2026-03-23"
-last_updated: "2026-07-23"
+last_updated: "2026-07-26"
 description: "Architecture of ai-toolkit: directory layout, Claude app export, global install model, editor-aware MCP install, Codex translation layer, skill tiers, and integration with projects."
 ---
 
@@ -300,7 +300,6 @@ Agents (code-reviewer, debugger, devops-implementer, ...)
 | UserPromptSubmit | Before user prompt execution | `track-usage.sh` | Record skill invocations to stats.json |
 | PostToolUse | After edit/write tools | `post-tool-use.sh` | Lightweight validation reminders |
 | PostToolUse | After any tool | `governance-capture.sh` | Log security-sensitive operations |
-| PostToolUse | After successful Bash | `filter-tool-output.sh` | Observe eligible text or replace it only after exact recovery succeeds; Claude Code only |
 | Stop | After response | `quality-check.sh` | Multi-language lint |
 | Stop | After response | `save-session.sh` | Persist session context |
 | Stop | Before final stop | `quality-gate.sh` | Block final response on lint/type errors |

package/kb/reference/cli-reference.md

@@ -2,9 +2,9 @@
 title: "CLI Reference"
 category: reference
 service: ai-toolkit
-tags: [cli, commands, reference, install, update, plugin, mcp, telemetry, output-filter]
+tags: [cli, commands, reference, install, update, plugin, mcp, telemetry]
 created: "2026-04-13"
-last_updated: "2026-07-23"
+last_updated: "2026-07-26"
 description: "Complete CLI reference for all ai-toolkit commands, options, and flags."
 ---
 
@@ -79,18 +79,8 @@ Usage: ai-toolkit <command> [options]
 
 | Command | Description |
 |---------|-------------|
-| `output-filter status [--policy PATH]` | Print the effective trusted project/global policy, or inspect an explicit policy |
-| `output-filter inspect --profile repeat-lines\|tap-success` | Read stdin and print content-free candidate metadata without changing or echoing the input |
-| `output-filter recover <handle> [--base-directory PATH] [--session-id ID]` | Print the exact stored native response object for an opaque recovery handle |
-| `output-filter clean [--base-directory PATH] [--session-id ID]` | Remove owned filter artifacts for one session or all sessions in the current repository |
-| `output-filter clean --session-id ID --expired` | Remove expired exact-response artifacts for one native session |
-| `output-filter hook --policy PATH` | **Internal, not for manual use.** `PostToolUse` entry point that reads the native hook payload on stdin and emits any replacement. The installed hook `filter-tool-output.sh` calls the same runtime through the lean `output_filter_hook.py` process instead |
-
-`off` is the default. Configure `toolOutputFilter.mode` in
-`.softspark-toolkit.json`, then run `install --local` or `update --local`.
+
 `AI_TOOLKIT_OUTPUT_FILTER_DISABLE=1` bypasses active filtering immediately.
-See [Native Tool Output Filter](tool-output-filter.md) for eligibility,
-privacy, recovery, and runtime support.
 
 ## Project Registry
 

package/kb/reference/enterprise-config-guide.md

@@ -10,7 +10,7 @@ tags:
   - multi-repo
 doc_type: reference
 created: "2026-04-11"
-last_updated: "2026-07-23"
+last_updated: "2026-07-26"
 description: "Comprehensive guide for setting up and using ai-toolkit configuration inheritance. Covers base config creation, project setup, enforcement rules, CI integration, and troubleshooting."
 ---
 
@@ -77,7 +77,6 @@ ai-toolkit config check       # CI enforcement check
 |-------|------|-------------|
 | `extends` | string | Base config source (npm, git URL, local path) |
 | `profile` | enum | `minimal`, `standard`, `strict`, `full`, `offline-slm` |
-| `toolOutputFilter` | object | Native Bash result filtering policy: mode, profiles, savings thresholds, and recovery limits |
 | `agents` | object | `enabled`, `disabled`, `custom` arrays |
 | `plugins` | object | Resolved `enabled` and `disabled` plugin intent |
 | `rules` | object | `inject`, `remove` arrays |
@@ -157,25 +156,6 @@ effective intent explicit and causes validation to reject a conflicting
 `plugins.disabled` entry. Install the named plugin pack separately with
 `ai-toolkit plugin install <name>` or your organization deployment workflow.
 
-### Native tool-output filtering
-
-Projects can opt into the dependency-free output filter without changing the
-organization-wide default:
-
-```json
-{
-  "toolOutputFilter": {
-    "mode": "observe",
-    "profiles": ["repeat-lines", "tap-success"]
-  }
-}
-```
-
-`ai-toolkit install --local` materializes the effective policy as the managed
-`.claude/ai-toolkit-output-filter.json` file. `off` is the default, `observe`
-collects metadata without changing model-visible output, and `safe` permits
-replacement only when every invariant and exact-recovery check succeeds.
-
 ### Overrides
 
 Projects can override base settings, but must declare intent:

package/kb/reference/hooks-catalog.md

@@ -3,9 +3,9 @@ title: "Hooks Catalog"
 category: reference
 service: ai-toolkit
 tags: [hooks, quality, safety, enforcement, settings.json]
-version: "1.8.0"
+version: "1.9.0"
 created: "2026-03-27"
-last_updated: "2026-07-23"
+last_updated: "2026-07-26"
 description: "Complete reference of all ai-toolkit hooks: events, scripts, installation, and runtime behavior."
 ---
 
@@ -31,9 +31,6 @@ ai-toolkit update     # re-copies scripts, re-merges (idempotent)
 **File locations:**
 
 - Scripts: `~/.softspark/ai-toolkit/hooks/*.sh`
-- Output-filter runtime: `~/.softspark/ai-toolkit/scripts/output_filter_hook.py`, `output_filter_cli.py`, and `tool_output_filter/`
-- Global output-filter policy: `~/.softspark/ai-toolkit/hooks/output-filter-policy.json`
-- Managed project policy: `<project>/.claude/ai-toolkit-output-filter.json`
 - Config: `~/.claude/settings.json` → `hooks` key
 - Source: `ai-toolkit/app/hooks/*.sh` + `app/hooks.json`
 
@@ -178,59 +175,6 @@ arms the corrective Stop hook.
 
 Skipped when `TOOLKIT_HOOK_PROFILE=minimal`.
 
-### PostToolUse (native Bash output filter): `filter-tool-output.sh`
-
-| Field | Value |
-|-------|-------|
-| Event | `PostToolUse` |
-| Matcher | `Bash` |
-| Script | `~/.softspark/ai-toolkit/hooks/filter-tool-output.sh` |
-| Fires | After a successful Claude Code Bash tool call |
-
-The hook is disabled by default and runs last among the installed
-`PostToolUse` handlers. Its modes are:
-
-| Mode | Behavior |
-|------|----------|
-| `off` | Shell fast path exits before Python starts |
-| `observe` | Evaluates eligible output and writes content-free metadata, but emits no replacement |
-| `safe` | Replaces eligible output only after invariants pass and the exact native response is stored for recovery |
-
-Only explicitly allowlisted test, lint, typecheck, and validation command
-shapes are eligible. Failed or interrupted tools, non-empty stderr, image or
-binary results, pipes, redirects, deployment, migrations, audits, security
-scanners, malformed payloads, unavailable recovery, and any uncertain case
-remain unchanged.
-
-The per-project policy `<project>/.claude/ai-toolkit-output-filter.json` is
-honored only when **both** checks pass: the project root is registered in
-`~/.softspark/ai-toolkit/projects.json`, and the sibling regular file
-`<project>/.claude/.ai-toolkit-output-filter.owner` holds the ai-toolkit owner
-marker. `ai-toolkit install --local` writes both. Registration is required
-because the owner marker is a public constant, so a cloned or untrusted
-checkout must never be able to self-enable filtering by shipping its own
-marker. An unregistered project, a missing or foreign marker, or a symlinked
-project root or `.claude` directory falls back to the installed global policy
-at `~/.softspark/ai-toolkit/hooks/output-filter-policy.json`, which ships as
-`off`.
-
-`jq` is a required system dependency (`python3 scripts/check_deps.py`
-verifies it alongside `python3`, `git`, and `node`); without it `guard-path.sh`
-blocks file tools rather than skipping path validation.
-
-Recovery data is private and session-scoped under
-`~/.softspark/ai-toolkit/sessions/<repo-key>/output-filter/`. Telemetry records
-only profile/version, byte and line counts, latency, outcome, and fallback
-reason. Recovery-backed modes require a bounded native session ID containing
-only ASCII letters, digits, underscores, or hyphens. Three consecutive
-profile, invariant, or recovery safety failures open a session circuit
-breaker. Set `AI_TOOLKIT_OUTPUT_FILTER_DISABLE=1` for an immediate bypass.
-
-The replacement adapter is Claude Code-specific. Claude Chat/Cowork exports
-exclude it, and the generated hooks for other editors do not activate it.
-The `minimal` hook profile and `AI_TOOLKIT_DISABLED_HOOKS=filter-tool-output`
-bypass it before the Python runtime starts.
-
 ### Stop (quality check) — `quality-check.sh`
 
 | Field | Value |
@@ -344,8 +288,7 @@ Skipped when `TOOLKIT_HOOK_PROFILE=minimal`.
 | Script | `~/.softspark/ai-toolkit/hooks/session-end.sh` |
 | Fires | When a Claude session ends |
 
-**Action:** Removes private output-filter artifacts and isolated edit state for
-the ending native session, then writes `session-end.md` to the per-repo session store
+**Action:** Removes isolated edit state for the ending native session, then writes `session-end.md` to the per-repo session store
 (`~/.softspark/ai-toolkit/sessions/<repo-key>/`) with a lightweight handoff note
 for the next session.