@softspark/ai-toolkit 4.16.1 → 4.18.0

package/CHANGELOG.md

@@ -7,6 +7,90 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v4.18.0 — rtk-pack, an opt-in command rewriter (2026-07-26)
+
+### Added
+
+- **`rtk-pack`**, an opt-in plugin pack that rewrites Bash commands at
+  `PreToolUse` via [rtk](https://github.com/rtk-ai/rtk) (Apache-2.0). Nothing
+  installs it for you. `ai-toolkit plugin install rtk-pack` fetches a
+  platform-specific binary from an ai-toolkit GitHub Release and verifies its
+  SHA-256 before installing anything; a mismatch aborts and leaves nothing
+  behind. Read `app/plugins/rtk-pack/README.md` before enabling it: the rewrite
+  means what runs is not literally what the model asked for, and rtk applies
+  your permission verdict for the original command to the rewritten one.
+- **`.github/workflows/rtk-build.yml`**, a manual-dispatch pipeline that
+  cross-builds rtk from upstream source for five targets with the compile-time
+  telemetry endpoint left undefined, proves each artifact starts, writes no
+  telemetry state and (on Linux) behaves identically with no network route,
+  then publishes checksummed artifacts with LICENSE and NOTICE.
+- **`scripts/verify_rtk_binary.py`**, the silence verifier that pipeline uses.
+  A target it cannot start reports `inconclusive`, never `pass`.
+- **`kb/procedures/rtk-upstream-sync-sop.md`**, the procedure for moving to a
+  newer upstream tag, including a re-measure gate and a published kill number.
+- Plugin packs can now ship `scripts/status.py` and have `plugin status` pick it
+  up. This replaces a hardcoded `if name == "memory-pack"` branch, so any pack
+  can report its own health.
+
+### Changed
+
+- **`ai-toolkit update` now updates installed plugin packs.** It reads
+  `plugins.json` and runs the equivalent of `plugin update --all` for every
+  installed pack. `--local` leaves packs alone, since they are global.
+- **`plugin update` is version-aware.** `plugins.json` records the pack version
+  installed per editor, and an update whose manifest version matches is a silent
+  no-op. Previously every update removed and reinstalled unconditionally, which
+  for a pack that downloads a binary meant refetching it every time. `--force`
+  overrides; `--dry-run` reports without acting. State written before versions
+  were tracked updates each pack exactly once.
+- Plugin packs are now covered by `audit_skills.py --ci` and by the ShellCheck
+  gate in CI. Both previously scanned only `app/skills`, `app/agents` and
+  `app/hooks`, exempting the highest-risk code in the repo.
+- A pack's install-time script may be named `init.py`; `init_db.py` still works.
+  Previously only the latter ran, so a pack using any other name installed
+  successfully while doing nothing.
+
+### Fixed
+
+- `plugin install` no longer aborts with `IsADirectoryError` when a pack ships a
+  subdirectory under `scripts/`.
+- A failing pack init script now always reports, instead of printing nothing
+  when it exited non-zero with empty stderr.
+
+---
+
+## v4.17.0 — Native tool-output filter removed (2026-07-26)
+
+### Removed
+
+- **BREAKING for anyone who opted in.** The native tool-output filter shipped
+  in v4.16.0 is gone: the `PostToolUse` hook `filter-tool-output.sh`, the
+  `scripts/tool_output_filter/` runtime, the `ai-toolkit output-filter` CLI,
+  the benchmark corpus, and the `toolOutputFilter` key in
+  `.softspark-toolkit.json`. The key is accepted and ignored rather than
+  rejected, so an existing config still validates; `ai-toolkit config validate`
+  reports it as a retired key you can delete.
+- Why: measured whole-session token saving was **0.0000%** on real traffic.
+  Across 134 session transcripts spanning 22 projects, 7600 successful Bash
+  results contained 145 that parsed as simple command shapes, 18 that matched a
+  registered shape, and 0 that any filter accepted. The filter was correct;
+  its premise was not. Agent-issued commands are overwhelmingly compound
+  (`&&` and `;` chains, pipelines, heredocs), and the design accepted only
+  simple registered shapes. See
+  `kb/history/completed/output-filter-retirement-20260726.md`.
+
+### Changed
+
+- `ai-toolkit install` and `ai-toolkit update` now remove the artifacts left by
+  v4.16.x: the installed hook script, the global
+  `hooks/output-filter-policy.json`, the managed project policy and owner
+  marker under `.claude/`, and stored recovery trees under
+  `sessions/<repo-key>/output-filter/`. Cleanup is idempotent, verifies
+  ai-toolkit ownership before deleting, and leaves foreign files untouched.
+- The stale `PostToolUse` entry is removed from `~/.claude/settings.json` by
+  the existing hook strip-and-remerge cycle, so no manual edit is needed.
+- Hook counts drop from 29 entries to 28 across the same 14 events.
+
 ## v4.16.1 — Copilot skill remnant recovery (2026-07-24)
 
 ### Fixed

package/README.md

@@ -6,18 +6,17 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Skills](https://img.shields.io/badge/skills-108-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-44-blue)](app/agents/)
-[![Tests](https://img.shields.io/badge/tests-1479%20passing-success)](tests/)
+[![Tests](https://img.shields.io/badge/tests-1484%20passing-success)](tests/)
 
-## What's New in v4.16.1
+## What's New in v4.18.0
 
-v4.16.1 ships the native tool-output filter introduced in v4.16.0 and fixes local updates crashing on legacy Copilot skill remnants.
+v4.18.0 adds `rtk-pack`, an opt-in command rewriter, and makes `ai-toolkit update` maintain installed packs.
 
-- **Native tool-output filter**: opt-in `PostToolUse` filter with `off`, `observe`, and `safe` modes; ships disabled, handles only allowlisted successful Bash test/validation output.
-- **Exact ephemeral recovery**: every safe replacement keeps a private, bounded, session-scoped copy of the original response, recoverable via `ai-toolkit output-filter recover`.
-- **Output-filter CLI**: `ai-toolkit output-filter status|inspect|recover|clean` plus a deterministic benchmark for the built-in profiles.
-- **Stricter config validation**: unknown top-level config keys are rejected, plugin manifests must declare `requires`, and lock files go stale on toolkit version bumps.
-- **GitHub Copilot compatibility reference**: new `kb/reference/copilot-compatibility.md` documenting the Copilot integration surface.
-- **Copilot remnant recovery**: asset-only `.github/skills/ai-toolkit-*` leftovers from older cleanups are rebuilt in place instead of aborting `install --local` / `update`.
+- **`rtk-pack`, opt-in only**: rewrites Bash commands at `PreToolUse` via [rtk](https://github.com/rtk-ai/rtk) (Apache-2.0). Nothing installs it for you. `plugin install` fetches a platform binary from an ai-toolkit Release and verifies its SHA-256 before installing anything. Measured saving on the reference workload is 0.0615% of input tokens; the pack README states the trust boundary and the numbers up front.
+- **Binaries built from source, telemetry compiled out**: a manual-dispatch workflow cross-builds five targets with the compile-time telemetry endpoint undefined, proves each artifact starts, writes no telemetry state, and on Linux behaves identically with no network route.
+- **`ai-toolkit update` maintains installed packs**: it now runs the equivalent of `plugin update --all`. Updates are version-aware, so a pack whose manifest has not moved is a silent no-op instead of a remove-and-reinstall.
+- **Packs can report their own health**: `plugin status` picks up a pack's `scripts/status.py`, replacing a hardcoded per-pack branch.
+- **Security gates cover packs**: `audit_skills.py --ci` and the ShellCheck gate now scan `app/plugins/`, which they previously skipped.
 
 See [CHANGELOG.md](CHANGELOG.md) for full history.
 
@@ -92,10 +91,7 @@ ai-toolkit claude-app export --verify
 ```
 
 Re-export and re-upload after toolkit or registered-rule updates. Skills work
-in Chat and Cowork; hooks and sub-agents are active only in Cowork. The native
-tool-output replacement hook remains Claude Code-only and is excluded from the
-Claude app archive until that runtime has an independently verified replacement
-contract.
+in Chat and Cowork; hooks and sub-agents are active only in Cowork.
 
 ### Install Profiles
 
@@ -146,8 +142,8 @@ See [CLI Reference](kb/reference/cli-reference.md) for all commands and options.
 | `skills/` (hybrid) | 30 | Slash commands with agent knowledge base |
 | `skills/` (knowledge) | 46 | Domain knowledge auto-loaded by agents (includes 13 `<lang>-rules` skills) |
 | `agents/` | 44 | Specialized agents across 10 categories |
-| `hooks/` | 29 entries / 14 events + statusLine | Quality gates, path safety, prompt governance, loop guard, output filtering, session lifecycle |
-| `plugins/` | 11 packs | Opt-in domain bundles (security, research, frontend, enterprise, 6 language packs) |
+| `hooks/` | 28 entries / 14 events + statusLine | Quality gates, path safety, prompt governance, loop guard, session lifecycle |
+| `plugins/` | 12 packs | Opt-in domain bundles (security, research, frontend, enterprise, memory, rtk, 6 language packs) |
 | `constitution.md` | 7 articles | Machine-enforced safety rules |
 | `rules/` | auto-synced | Global/project rule files for Claude and other editors |
 | `kb/` | reference docs | Architecture, procedures, and best practices |
@@ -170,7 +166,7 @@ ai-toolkit/
 │   └── ARCHITECTURE.md  # Full system design
 ├── kb/                  # Reference docs, procedures, plans
 ├── scripts/             # Validation, install, evaluation scripts
-├── tests/               # Bats and Python test suite (1479 tests)
+├── tests/               # Bats and Python test suite (1484 tests)
 └── CHANGELOG.md
 ```
 
@@ -182,9 +178,7 @@ ai-toolkit/
 
 **Machine-enforced constitution** — 7-article safety constitution enforced via `PreToolUse` hooks that actually block `rm -rf`, `DROP TABLE`, and irreversible operations. Not just documentation.
 
-**29 lifecycle hook entries:** Executable handlers across 14 events (SessionStart → SessionEnd, plus InstructionsLoaded + ConfigChange). Guards, governance, quality gates, session persistence, MCP health checks, revert protection, test-cohesion enforcement, loop guard, search-first discipline, and opt-in output filtering. See [Hooks Catalog](kb/reference/hooks-catalog.md).
-
-**Native tool-output filtering** — dependency-free, post-execution filtering for successful Claude Code Bash output, shipped **disabled by default** (`off`). Neither `off` nor `observe` ever replaces output; opt-in `safe` mode replaces only validated `repeat-lines` or `tap-success` results after exact ephemeral recovery is available. Failures, diagnostics, unsupported payloads, and unavailable recovery always pass through unchanged. See [Tool Output Filter](kb/reference/tool-output-filter.md).
+**28 lifecycle hook entries:** Executable handlers across 14 events (SessionStart → SessionEnd, plus InstructionsLoaded + ConfigChange). Guards, governance, quality gates, session persistence, MCP health checks, revert protection, test-cohesion enforcement, loop guard, and search-first discipline. See [Hooks Catalog](kb/reference/hooks-catalog.md).
 
 **Security scanning** — `/skill-audit` for code-level risks, `/cve-scan` for dependency CVEs. Both CI-ready with exit codes.
 

package/app/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "ai-toolkit",
   "displayName": "AI Toolkit",
   "description": "Professional-grade engineering skills, agents, rules, and lifecycle guardrails for Claude Code, Claude Chat, and Cowork.",
-  "version": "4.16.1",
+  "version": "4.18.0",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"

package/app/hooks/session-end.sh

@@ -3,7 +3,7 @@
 #
 # Fires on: SessionEnd
 # Matcher: all
-# The handoff snapshot is skipped for the minimal profile. Owned recovery
+# The handoff snapshot is skipped for the minimal profile. Session-state
 # cleanup still runs for every profile.
 
 # shellcheck source=_session-paths.sh
@@ -18,18 +18,6 @@ if [ ! -t 0 ]; then
     INPUT=$(cat)
 fi
 SESSION_ID=$(hook_session_id)
-RECOVERY_ROOT="$SESSION_DIR/output-filter"
-OUTPUT_FILTER_CLI="${AI_TOOLKIT_OUTPUT_FILTER_CLI:-$HOME/.softspark/ai-toolkit/scripts/output_filter_cli.py}"
-if [ "$SESSION_ID" != "default" ] &&
-   [ -d "$RECOVERY_ROOT" ] &&
-   [ ! -L "$RECOVERY_ROOT" ] &&
-   [ -f "$OUTPUT_FILTER_CLI" ] &&
-   [ ! -L "$OUTPUT_FILTER_CLI" ] &&
-   command -v python3 >/dev/null 2>&1; then
-    python3 -S "$OUTPUT_FILTER_CLI" clean \
-        --base-directory "$SESSION_DIR" \
-        --session-id "$SESSION_ID" >/dev/null 2>&1 || true
-fi
 
 SESSION_STATE_CLI="${AI_TOOLKIT_SESSION_STATE_CLI:-$HOME/.softspark/ai-toolkit/scripts/session_state.py}"
 if [ "$SESSION_ID" != "default" ] &&

package/app/hooks.json

@@ -158,16 +158,6 @@
                         "command": "\"$HOME/.softspark/ai-toolkit/hooks/search-tracker.sh\""
                     }
                 ]
-            },
-            {
-                "_source": "ai-toolkit",
-                "matcher": "Bash",
-                "hooks": [
-                    {
-                        "type": "command",
-                        "command": "\"$HOME/.softspark/ai-toolkit/hooks/filter-tool-output.sh\""
-                    }
-                ]
             }
         ],
         "Stop": [

package/app/plugins/README.md

@@ -17,10 +17,22 @@ Plugin packs can target:
 These packs are not directly uploadable Claude app plugins. For Claude Chat,
 Desktop, and Cowork use `ai-toolkit claude-app export`.
 
-Current packs:
-- `security-pack`
-- `research-pack`
-- `frontend-pack`
+Current packs (12):
+- `csharp-pack`
 - `enterprise-pack`
+- `frontend-pack`
+- `java-pack`
+- `kotlin-pack`
+- `memory-pack`
+- `research-pack`
+- `rtk-pack`
+- `ruby-pack`
+- `rust-pack`
+- `security-pack`
+- `swift-pack`
+
+`rtk-pack` is the only one that fetches a native binary at install time and the
+only one that rewrites commands before they run. Read its README before
+installing it.
 
 See `kb/reference/plugin-pack-conventions.md` for pack rules, validation, and adoption guidance.

package/app/plugins/rtk-pack/README.md

@@ -0,0 +1,123 @@
+# rtk-pack
+
+Opt-in command rewriting via [rtk](https://github.com/rtk-ai/rtk), Apache-2.0.
+
+Install: `ai-toolkit plugin install rtk-pack`. Remove: `ai-toolkit plugin remove rtk-pack`.
+Nothing installs it for you, and nothing in the core depends on it.
+
+## Read this before installing
+
+**This pack rewrites your commands before they run.** A `PreToolUse` hook hands
+each command to `rtk`, which may replace it with an `rtk` equivalent that
+produces shorter output. What executes is therefore not literally what the model
+asked for.
+
+That is a real trade-off and the reason this ships as an opt-in pack rather than
+a core feature. ai-toolkit's own retired output filter explicitly refused to do
+this. Adopting rtk is a deliberate reversal, made with the mechanism understood
+rather than assumed.
+
+**Your permission rules are evaluated against the original command, and the
+verdict is applied to the rewritten one.** rtk checks what the model asked for
+against your `settings.json`, and if a rule allows it, emits
+`permissionDecision: allow` for the `rtk …` form it substituted. So an allowlist
+entry for `git status` transitively authorises `rtk git status`, a command you
+never wrote a rule for. With no matching allow rule, no decision is emitted and
+your normal prompt appears. Verified against upstream's own test at
+`src/hooks/hook_cmd.rs:1272-1283`.
+
+If your allowlist is broad, review it before installing. If it is narrow, expect
+prompts on commands that used to run without one.
+
+Every failure path degrades to passthrough: no binary, a non-zero exit, a
+timeout, or unparseable output all result in the original command running
+unchanged. Removing the pack strips the hook from `settings.json`.
+
+## What you get, measured
+
+On the reference workload (1224 local transcripts, 26.6 MB of successful Bash
+output) rtk addresses **35.2%** of Bash bytes, which is **8.8%** of all
+tool-result bytes. The projected saving is **0.12% to 0.16%** of session input
+tokens, or 0.24% to 0.36% if rtk's own 60-90% claim holds on your traffic.
+
+That is small, and it is stated up front on purpose. The arithmetic ceiling for
+any tool-output mechanism on that workload is 4.5%, because tool results are
+that share of input token volume, and `Read` results are 63% of them. If your
+work is dominated by `cargo test`, `mvn` or `jest` output rather than file
+reading, rtk is calibrated for you and will do better. Measure before believing
+either number.
+
+Full method and caveats: `kb/history/completed/rtk-pack-integration-20260726.md`.
+
+## The binary
+
+Not bundled. `plugin install` fetches the artifact for your platform from an
+ai-toolkit GitHub Release and verifies its SHA-256 against `plugin.json` before
+installing anything. A digest mismatch aborts and leaves nothing behind. This is
+the only moment the pack uses the network.
+
+Binaries are cross-built from upstream source in ai-toolkit CI with
+`RTK_TELEMETRY_URL` and `RTK_TELEMETRY_TOKEN` left undefined, so the
+compile-time telemetry endpoint is absent and cannot be supplied at runtime.
+Each build asserts that, runs the artifact, checks no telemetry state is
+written, and on Linux confirms behaviour is unchanged with no network route.
+
+| Platform | Artifact |
+|---|---|
+| macOS arm64 | `rtk-aarch64-apple-darwin.tar.gz` |
+| macOS x86_64 | `rtk-x86_64-apple-darwin.tar.gz` |
+| Linux x86_64 | `rtk-x86_64-unknown-linux-musl.tar.gz` (static, runs on glibc) |
+| Linux aarch64 | `rtk-aarch64-unknown-linux-gnu.tar.gz` |
+| Windows x86_64 | `rtk-x86_64-pc-windows-msvc.zip` |
+
+## One thing the binary does reach the network for
+
+`rtk cc` (Claude economics) shells out to `npx --yes ccusage` when `ccusage` is
+not already on `PATH`, which fetches and executes a third-party npm package.
+That is not telemetry and never happens automatically, but it is outbound
+network from a binary otherwise described as silent. Do not run `rtk cc` in an
+air-gapped or policy-restricted environment.
+
+Related: `rtk telemetry forget` on these builds prints a failure telling you to
+email upstream to complete erasure. Nothing was ever sent; the message is
+upstream's and does not apply here.
+
+## Layout
+
+```
+~/.softspark/ai-toolkit/
+├── hooks/plugin-rtk-pack-rewrite.sh     # the PreToolUse hook
+└── plugin-scripts/rtk-pack/
+    ├── bin/rtk                          # verified binary
+    └── version.json                     # pinned versions and recorded digest
+```
+
+## Installing from a mirror
+
+Set `RTK_PACK_RELEASE_BASE_URL` to a base URL holding the release assets and the
+install fetches from there instead of GitHub, for networks that cannot reach it
+directly:
+
+```bash
+RTK_PACK_RELEASE_BASE_URL=https://mirror.internal/rtk/v0.44.0-1 \
+  ai-toolkit plugin install rtk-pack
+```
+
+The digest check is unchanged. A mirror serving different bytes is rejected
+exactly like a corrupt download, so this widens where the artifact comes from
+without widening what is accepted.
+
+## Disabling without removing
+
+`rtk` honours `RTK_DISABLED=1` as a per-command prefix. To turn the pack off
+entirely, remove it: `ai-toolkit plugin remove rtk-pack`.
+
+## Licence
+
+rtk is Apache-2.0. `LICENSE` and `NOTICE` ship with every release artifact. The
+NOTICE records the two build-time differences from an upstream build: the
+undefined telemetry endpoint, and in-range lockfile security updates for
+`anyhow` and `crossbeam-epoch`. No upstream source is modified.
+
+Upstream `DISCLAIMER.md` is deliberately not redistributed: it states that
+telemetry is collected by default, which is not true of these builds.

package/app/plugins/rtk-pack/hooks/rewrite.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# rewrite.sh — delegate PreToolUse command rewriting to the rtk binary.
+#
+# Fires on: PreToolUse
+# Reads the Claude Code hook JSON from stdin and hands it to `rtk hook claude`,
+# which emits hookSpecificOutput with permissionDecision and updatedInput.
+#
+# This hook rewrites the command before it runs, so what executes is not
+# literally what the model asked for. That is the pack's stated trade-off; see
+# the pack README. Everything here is built so that any failure degrades to
+# passthrough rather than to a broken or altered command:
+#
+#   no binary        -> no output, exit 0 (command runs unchanged)
+#   rtk fails        -> no output, exit 0
+#   rtk times out    -> no output, exit 0
+#   rtk prints junk  -> no output, exit 0
+#
+# Emitting nothing is the safe default: Claude Code treats an empty hook
+# response as "no opinion" and runs the original command.
+
+set -u
+
+PACK_BIN_DIR="${HOME}/.softspark/ai-toolkit/plugin-scripts/rtk-pack/bin"
+TIMEOUT_SECONDS=5
+
+# Read stdin once; it is not replayable.
+INPUT=$(cat)
+[ -n "$INPUT" ] || exit 0
+
+# jq is needed both to gate on the tool name and to check rtk's reply. Without
+# it we cannot do either safely, so stay out of the way entirely.
+command -v jq >/dev/null 2>&1 || exit 0
+
+# A pack hook cannot declare its own matcher: plugin.py:408 looks the basename
+# up in core app/hooks.json and falls back to "", so this registers against
+# every tool rather than Bash alone. Gate here instead, otherwise every Read,
+# Edit and Grep would spawn a subprocess for nothing.
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL" = "Bash" ] || exit 0
+
+RTK=""
+for candidate in "${PACK_BIN_DIR}/rtk" "${PACK_BIN_DIR}/rtk.exe"; do
+    if [ -x "$candidate" ]; then
+        RTK="$candidate"
+        break
+    fi
+done
+
+# Inert when init.py could not install a binary. The pack stays wired so that a
+# later `ai-toolkit plugin install rtk-pack` fixes it without touching settings.
+[ -n "$RTK" ] || exit 0
+
+# GNU timeout is `timeout`, Homebrew coreutils installs it as `gtimeout`, and
+# on a bare macOS it is absent. A hung rewriter would hang the session, so use
+# it when we can and accept the risk when we cannot.
+TIMEOUT_CMD=""
+if command -v timeout >/dev/null 2>&1; then
+    TIMEOUT_CMD="timeout"
+elif command -v gtimeout >/dev/null 2>&1; then
+    TIMEOUT_CMD="gtimeout"
+fi
+
+if [ -n "$TIMEOUT_CMD" ]; then
+    OUTPUT=$(printf '%s' "$INPUT" | "$TIMEOUT_CMD" "$TIMEOUT_SECONDS" "$RTK" hook claude 2>/dev/null)
+else
+    OUTPUT=$(printf '%s' "$INPUT" | "$RTK" hook claude 2>/dev/null)
+fi
+STATUS=$?
+
+[ "$STATUS" -eq 0 ] || exit 0
+[ -n "$OUTPUT" ] || exit 0
+
+# Only forward something that parses as JSON. A partial write or a stray
+# diagnostic on stdout would otherwise reach Claude Code as a malformed hook
+# response.
+printf '%s' "$OUTPUT" | jq -e . >/dev/null 2>&1 || exit 0
+
+printf '%s\n' "$OUTPUT"
+exit 0

package/app/plugins/rtk-pack/plugin.json

@@ -0,0 +1,60 @@
+{
+  "name": "rtk-pack",
+  "description": "Opt-in command rewriting via rtk, cross-built from source with telemetry disabled and fetched from a checksum-pinned release",
+  "version": "0.1.0",
+  "domain": "token-reduction",
+  "type": "plugin-pack",
+  "status": "experimental",
+  "requires": {
+    "ai-toolkit": ">=4.17.0",
+    "claude-code": ">=1.0.33"
+  },
+  "includes": {
+    "agents": [],
+    "skills": [],
+    "rules": [],
+    "hooks": ["rewrite.sh"]
+  },
+  "hook_events": {
+    "rewrite.sh": "PreToolUse"
+  },
+  "upstream": {
+    "project": "rtk",
+    "repository": "https://github.com/rtk-ai/rtk",
+    "license": "Apache-2.0",
+    "version": "v0.44.0",
+    "note": "Built from source in our CI with RTK_TELEMETRY_URL and RTK_TELEMETRY_TOKEN undefined. Cargo.lock carries in-range security updates for anyhow and crossbeam-epoch. No source modifications."
+  },
+  "binary": {
+    "release_repo": "softspark/ai-toolkit",
+    "release_tag": "softspark-rtk-v0.44.0-1",
+    "install_name": "rtk",
+    "assets": {
+      "darwin-arm64": {
+        "file": "rtk-aarch64-apple-darwin.tar.gz",
+        "sha256": "a69b8ccb7c516a1d6e06aff714bdc8bf0afcb2af240c5b2f6c83122743c93c56",
+        "member": "rtk"
+      },
+      "darwin-x86_64": {
+        "file": "rtk-x86_64-apple-darwin.tar.gz",
+        "sha256": "bda9f4a6acf87be859394d5da3a064db211a869cf331ed2c485e174f5fd81dcb",
+        "member": "rtk"
+      },
+      "linux-aarch64": {
+        "file": "rtk-aarch64-unknown-linux-gnu.tar.gz",
+        "sha256": "fd5f4b10ca2e96e674b437f9a00639f376b215e7d15373327142f5f8e9642795",
+        "member": "rtk"
+      },
+      "linux-x86_64": {
+        "file": "rtk-x86_64-unknown-linux-musl.tar.gz",
+        "sha256": "1d886b748181b78e11ea99c2f2ff60ad04a73dbc29ca20ca807f01642ebcea32",
+        "member": "rtk"
+      },
+      "windows-x86_64": {
+        "file": "rtk-x86_64-pc-windows-msvc.zip",
+        "sha256": "83ebf53af4f15d860cef16e8ff6fe9a5cf25fa10ed4c48a1544d359a2796ef38",
+        "member": "rtk.exe"
+      }
+    }
+  }
+}