@softspark/ai-toolkit 4.17.0 → 4.19.0

package/CHANGELOG.md

@@ -7,6 +7,95 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v4.19.0 — rtk-pack retired (2026-07-27)
+
+### Removed
+
+- **`rtk-pack`**, one day after it shipped. The first real install proved every
+  rewritten command failed with exit 127: rtk names itself bare in the rewrite
+  and the pack keeps its binary off `PATH` on purpose, so the shell could not
+  find it. `git`, `ls`, `cat`, `find`, `grep`, `diff` and the rest all died
+  before running. A second defect fetched the Intel build onto Apple Silicon,
+  because `platform.machine()` reports `x86_64` from a Rosetta-translated
+  Python. The pack's own `plugin status` reported both as green.
+
+  All three were fixed and tested before the decision. The measured saving was
+  0.0615% of input tokens against a kill number of 0.05%, a margin the
+  integration plan itself called "a pass, not a vindication", which does not
+  justify a supply-chain surface, a five-target cross-build workflow, an
+  upstream-sync SOP, and a hook that rewrites every command before it runs.
+
+  Full postmortem: `kb/history/completed/rtk-pack-retirement-20260727.md`.
+- `.github/workflows/rtk-build.yml`, `scripts/verify_rtk_binary.py`,
+  `tests/test_rtk_pack.bats`, `tests/test_verify_rtk_binary.bats`,
+  `kb/procedures/rtk-upstream-sync-sop.md`, and the GitHub Release
+  `softspark-rtk-v0.44.0-1` holding the five cross-built binaries.
+
+If you installed the pack under v4.18.0, run
+`ai-toolkit plugin remove rtk-pack`.
+
+### Kept
+
+Everything the pack work built underneath it, none of which is rtk-specific:
+pack hook wiring for Cursor and Gemini, `supported_editors` in the manifest,
+generic `plugin status` dispatch to a pack's own `scripts/status.py`,
+version-aware `plugin update`, and `audit_skills.py --ci` plus the ShellCheck
+gate covering `app/plugins/`.
+
+---
+
+## v4.18.0 — rtk-pack, an opt-in command rewriter (2026-07-26)
+
+### Added
+
+- **`rtk-pack`**, an opt-in plugin pack that rewrites Bash commands at
+  `PreToolUse` via [rtk](https://github.com/rtk-ai/rtk) (Apache-2.0). Nothing
+  installs it for you. `ai-toolkit plugin install rtk-pack` fetches a
+  platform-specific binary from an ai-toolkit GitHub Release and verifies its
+  SHA-256 before installing anything; a mismatch aborts and leaves nothing
+  behind. Read `app/plugins/rtk-pack/README.md` before enabling it: the rewrite
+  means what runs is not literally what the model asked for, and rtk applies
+  your permission verdict for the original command to the rewritten one.
+- **`.github/workflows/rtk-build.yml`**, a manual-dispatch pipeline that
+  cross-builds rtk from upstream source for five targets with the compile-time
+  telemetry endpoint left undefined, proves each artifact starts, writes no
+  telemetry state and (on Linux) behaves identically with no network route,
+  then publishes checksummed artifacts with LICENSE and NOTICE.
+- **`scripts/verify_rtk_binary.py`**, the silence verifier that pipeline uses.
+  A target it cannot start reports `inconclusive`, never `pass`.
+- **`kb/procedures/rtk-upstream-sync-sop.md`**, the procedure for moving to a
+  newer upstream tag, including a re-measure gate and a published kill number.
+- Plugin packs can now ship `scripts/status.py` and have `plugin status` pick it
+  up. This replaces a hardcoded `if name == "memory-pack"` branch, so any pack
+  can report its own health.
+
+### Changed
+
+- **`ai-toolkit update` now updates installed plugin packs.** It reads
+  `plugins.json` and runs the equivalent of `plugin update --all` for every
+  installed pack. `--local` leaves packs alone, since they are global.
+- **`plugin update` is version-aware.** `plugins.json` records the pack version
+  installed per editor, and an update whose manifest version matches is a silent
+  no-op. Previously every update removed and reinstalled unconditionally, which
+  for a pack that downloads a binary meant refetching it every time. `--force`
+  overrides; `--dry-run` reports without acting. State written before versions
+  were tracked updates each pack exactly once.
+- Plugin packs are now covered by `audit_skills.py --ci` and by the ShellCheck
+  gate in CI. Both previously scanned only `app/skills`, `app/agents` and
+  `app/hooks`, exempting the highest-risk code in the repo.
+- A pack's install-time script may be named `init.py`; `init_db.py` still works.
+  Previously only the latter ran, so a pack using any other name installed
+  successfully while doing nothing.
+
+### Fixed
+
+- `plugin install` no longer aborts with `IsADirectoryError` when a pack ships a
+  subdirectory under `scripts/`.
+- A failing pack init script now always reports, instead of printing nothing
+  when it exited non-zero with empty stderr.
+
+---
+
 ## v4.17.0 — Native tool-output filter removed (2026-07-26)
 
 ### Removed

package/README.md

@@ -6,17 +6,19 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Skills](https://img.shields.io/badge/skills-108-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-44-blue)](app/agents/)
-[![Tests](https://img.shields.io/badge/tests-1445%20passing-success)](tests/)
+[![Tests](https://img.shields.io/badge/tests-1465%20passing-success)](tests/)
 
-## What's New in v4.17.0
+## What's New in v4.19.0
 
-v4.17.0 removes the native tool-output filter shipped in v4.16.0.
+v4.19.0 removes `rtk-pack`. The pack that v4.18.0 shipped is gone; everything the work built underneath it stays.
 
-- **Native tool-output filter removed**: measured whole-session token saving was 0.0000% on real traffic, because agent-issued commands are overwhelmingly compound and the filter only accepted simple registered shapes. The `PostToolUse` hook, the CLI, and the `toolOutputFilter` config key are gone.
-- **Automatic cleanup on update**: `ai-toolkit update` removes the orphaned hook script, the global and project policy files, and any stored recovery artifacts left by v4.16.x. Foreign files in those directories are preserved.
-- **Stricter config validation**: unknown top-level config keys are rejected, plugin manifests must declare `requires`, and lock files go stale on toolkit version bumps.
-- **GitHub Copilot compatibility reference**: new `kb/reference/copilot-compatibility.md` documenting the Copilot integration surface.
-- **Copilot remnant recovery**: asset-only `.github/skills/ai-toolkit-*` leftovers from older cleanups are rebuilt in place instead of aborting `install --local` / `update`.
+- **`rtk-pack` retired**: it broke every command it rewrote. rtk names itself bare in the rewrite, the pack kept its binary off `PATH` on purpose, and the result was exit 127 on `git`, `ls`, `cat`, `find`, `grep` and the rest. Measured value before the defect was 0.0615% of input tokens against a 0.05% kill number, so the fix was not worth the surface. See [the retirement note](kb/history/completed/rtk-pack-retirement-20260727.md).
+- **Pack hook wiring for Cursor and Gemini stays**: packs write user-scope entries to `~/.cursor/hooks.json` and `~/.gemini/settings.json`, tagged per pack, and `plugin remove` takes only its own back out.
+- **`ai-toolkit update` maintains installed packs**: it runs the equivalent of `plugin update --all`. Updates are version-aware, so a pack whose manifest has not moved is a silent no-op instead of a remove-and-reinstall.
+- **Packs can report their own health**: `plugin status` picks up a pack's `scripts/status.py`, replacing a hardcoded per-pack branch.
+- **Security gates cover packs**: `audit_skills.py --ci` and the ShellCheck gate now scan `app/plugins/`, which they previously skipped.
+
+If you installed the pack under v4.18.0, run `ai-toolkit plugin remove rtk-pack`.
 
 See [CHANGELOG.md](CHANGELOG.md) for full history.
 
@@ -143,7 +145,7 @@ See [CLI Reference](kb/reference/cli-reference.md) for all commands and options.
 | `skills/` (knowledge) | 46 | Domain knowledge auto-loaded by agents (includes 13 `<lang>-rules` skills) |
 | `agents/` | 44 | Specialized agents across 10 categories |
 | `hooks/` | 28 entries / 14 events + statusLine | Quality gates, path safety, prompt governance, loop guard, session lifecycle |
-| `plugins/` | 11 packs | Opt-in domain bundles (security, research, frontend, enterprise, 6 language packs) |
+| `plugins/` | 11 packs | Opt-in domain bundles (security, research, frontend, enterprise, memory, 6 language packs) |
 | `constitution.md` | 7 articles | Machine-enforced safety rules |
 | `rules/` | auto-synced | Global/project rule files for Claude and other editors |
 | `kb/` | reference docs | Architecture, procedures, and best practices |
@@ -166,7 +168,7 @@ ai-toolkit/
 │   └── ARCHITECTURE.md  # Full system design
 ├── kb/                  # Reference docs, procedures, plans
 ├── scripts/             # Validation, install, evaluation scripts
-├── tests/               # Bats and Python test suite (1445 tests)
+├── tests/               # Bats and Python test suite (1494 tests)
 └── CHANGELOG.md
 ```
 

package/app/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "ai-toolkit",
   "displayName": "AI Toolkit",
   "description": "Professional-grade engineering skills, agents, rules, and lifecycle guardrails for Claude Code, Claude Chat, and Cowork.",
-  "version": "4.17.0",
+  "version": "4.19.0",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"

package/app/plugins/README.md

@@ -17,10 +17,22 @@ Plugin packs can target:
 These packs are not directly uploadable Claude app plugins. For Claude Chat,
 Desktop, and Cowork use `ai-toolkit claude-app export`.
 
-Current packs:
-- `security-pack`
-- `research-pack`
-- `frontend-pack`
+Current packs (11):
+- `csharp-pack`
 - `enterprise-pack`
+- `frontend-pack`
+- `java-pack`
+- `kotlin-pack`
+- `memory-pack`
+- `research-pack`
+- `ruby-pack`
+- `rust-pack`
+- `security-pack`
+- `swift-pack`
+
+Every pack here is content: agents, skills, rules and hook scripts that ship in
+this repository. None fetches a binary at install time. `rtk-pack` did, and was
+retired in v4.19.0; see `kb/history/completed/rtk-pack-retirement-20260727.md`
+before proposing another pack of that shape.
 
 See `kb/reference/plugin-pack-conventions.md` for pack rules, validation, and adoption guidance.

package/benchmarks/ecosystem-doctor-snapshot.json

@@ -1,5 +1,5 @@
 {
-  "last_run": "2026-07-26T11:36:57Z",
+  "last_run": "2026-07-27T07:12:31Z",
   "schema_version": 1,
   "tools": {
     "aider": {
@@ -24,7 +24,7 @@
       }
     },
     "augment": {
-      "docs_hash": "1dd9e9f490e7103a",
+      "docs_hash": "b8b7ddbeaccd618d",
       "headings": [
         "Admin",
         "Auggie CLI",
@@ -66,7 +66,7 @@
       }
     },
     "claude-app": {
-      "docs_hash": "9a5cb995316c7c71",
+      "docs_hash": "1925050f50fb6fc3",
       "headings": [
         "Add global and folder instructions",
         "Availability",
@@ -107,7 +107,7 @@
       }
     },
     "claude-code": {
-      "docs_hash": "d373a3e4db1f4c79",
+      "docs_hash": "e85f8751f08026f0",
       "headings": [
         "Core concepts",
         "Documentation Index",
@@ -166,7 +166,7 @@
       "version": "2.1.220 (Claude Code)"
     },
     "cline": {
-      "docs_hash": "d76db24ff58cb7ea",
+      "docs_hash": "3bbabe935a9e6ebb",
       "headings": [
         "API Reference",
         "Best Practices",
@@ -364,7 +364,7 @@
       }
     },
     "gemini-cli": {
-      "docs_hash": "c6d93617f9359329",
+      "docs_hash": "1149b358f401b6b3",
       "headings": [
         "Breadcrumbs",
         "Directory actions",
@@ -444,7 +444,7 @@
       }
     },
     "google-antigravity": {
-      "docs_hash": "03145f425dd475d1",
+      "docs_hash": "1e0c0d249231d2a9",
       "headings": [],
       "markers": {
         "AGENTS.md": false,
@@ -520,7 +520,7 @@
       }
     },
     "windsurf": {
-      "docs_hash": "d57d379406804a4b",
+      "docs_hash": "56080b3b62a1de8e",
       "headings": [
         "Accounts",
         "Advanced",

package/bin/ai-toolkit.js

@@ -281,7 +281,7 @@ function showHelp() {
   console.log('  remove --all    Remove all installed plugins');
   console.log('  list            Show available plugin packs with install status');
   console.log('  status          Show currently installed plugins with data stats');
-  console.log('  --editor <list> Runtime target: claude, codex, or all (default: claude)');
+  console.log('  --editor <list> Runtime target: claude, codex, cursor, gemini, or all (default: claude)');
   console.log('\nOptions for claude-app:');
   console.log('  export [--output FILE] [--no-custom-rules] [--verify]');
   console.log('                  Build a ZIP for Customize > Plugins and Cowork instructions');
@@ -574,6 +574,21 @@ function handleUpdate(args) {
   // User-provided args override state-derived args
   run(scriptPath('install.py'), [...stateArgs, ...args]);
 
+  // Installed plugin packs live under ~/.softspark/ai-toolkit and are global,
+  // so --local (project-local config only) leaves them alone. The wiring is
+  // generic: plugin.py decides per pack whether anything changed and stays
+  // silent when nothing has, so this adds no noise for the common case.
+  if (!isLocal) {
+    const pluginArgs = ['update', '--editor', 'all', '--all'];
+    if (isDryRun) pluginArgs.push('--dry-run');
+    try {
+      run(scriptPath('plugin.py'), pluginArgs);
+    } catch (_err) {
+      // A pack update never fails the core update that already succeeded.
+      console.warn('WARN: plugin pack update skipped');
+    }
+  }
+
   // After global update (not --local), propagate to all registered projects
   if (!isLocal && !isDryRun) {
     const registryPath = path.join(process.env.HOME, '.softspark', 'ai-toolkit', 'projects.json');