@softspark/ai-toolkit 4.29.0 → 4.29.1

package/CHANGELOG.md

@@ -7,6 +7,53 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v4.29.1 — The guard stops blocking the safe branch delete (2026-08-21)
+
+### Fixed
+
+- **`guard-destructive.sh` no longer folds `-d` onto `-D`.** Every pattern was
+  matched by a single `grep -qEi`, so the `git\s+branch\s+-D\b` pattern also
+  caught `git branch -d`. Those are different operations: `-D` discards an
+  unmerged branch, `-d` refuses to. The safe one is what
+  `.claude/rules/ai-toolkit-git-workflow.md` tells users to run after every
+  merge, and the guard blocked it — a false positive on the toolkit's own
+  advice, in the toolkit's own safety hook.
+- **Patterns are matched in two passes, split by whether case carries meaning.**
+  Command names and flags go through a case-sensitive `grep -qE`; POSIX flags
+  that differ only in case are different flags, and folding them together can
+  only lose information. SQL keywords and the Windows `format` command go
+  through a case-insensitive `grep -qEi`, because their casing genuinely varies
+  in the wild — `drop table`, `Truncate`, and `delete from` all still block.
+  The `-i` was presumably there for the SQL patterns all along; it was the
+  flag patterns that paid for it.
+
+- **A cross-file race in the test suite.** `doctor --fix regenerates missing
+  llms-full.txt` deleted the artifact from the shared checkout and asserted on
+  doctor's `FIXED` line. `npm test` runs `bats --jobs 4
+  --no-parallelize-within-files`, so files run concurrently, and
+  `test_doctor_plugin_double_load.bats` also runs `doctor --fix` — which
+  regenerates that artifact. When it won, the assertion saw a present file, no
+  `FIXED` line, and a red suite; the test also left a `llms-full.txt.test-bak`
+  in the repo, because the restoring `mv` never ran. v4.29.0 added a second
+  `doctor --fix` call to the plugin test file, which is what made a latent race
+  start firing. The test now runs doctor against a private copy of the toolkit,
+  so it mutates no shared state at all.
+
+### Changed
+
+- `kb/reference/hooks-catalog.md` documents the two-pass matching and lists the
+  safe branch delete among the guard's exemptions.
+- Test count: 1666 → 1671. The new cases pin both directions: the safe delete
+  and an uppercase non-flag pass, lowercase and mixed-case SQL block.
+
+### Known gap (not addressed here)
+
+- The guard matches `git branch -D` but not its long form, `git branch --delete
+  --force`. That gap predates this fix and closing it is a coverage change
+  rather than a case-sensitivity one, so it is left for a separate decision.
+
+---
+
 ## v4.29.0 — Stale plugin uploads stop hiding (2026-08-21)
 
 ### Added

package/README.md

@@ -6,24 +6,21 @@
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 [![Skills](https://img.shields.io/badge/skills-109-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-44-blue)](app/agents/)
-[![Tests](https://img.shields.io/badge/tests-1666%20passing-success)](tests/)
-
-## What's New in v4.29.0
-
-**v4.29.0** stops a stale Claude app upload from passing as healthy:
-
-- The plugin ZIP is a point-in-time snapshot. Once the toolkit moves on, Chat and
-  Cowork keep running the skills, agents, hooks, and rules from whenever you
-  exported it, with nothing anywhere saying so.
-- `ai-toolkit doctor` now compares the version recorded in
-  `~/.claude/plugins/installed_plugins.json` against the installed toolkit and
-  warns when they differ -- including when the plugin is disabled for Claude
-  Code, since Chat and Cowork still load it.
-- `--fix` cannot clear that warning. It can regenerate the export; the upload
-  itself is manual, so the check names both steps instead of pretending.
-- `ai-toolkit install` now re-asserts the plugin as disabled for Claude Code.
-  Uploading the ZIP re-enables it every time, which had left the double-load fix
-  to whoever remembered to re-run `doctor --fix`.
+[![Tests](https://img.shields.io/badge/tests-1671%20passing-success)](tests/)
+
+## What's New in v4.29.1
+
+**v4.29.1** stops the destructive-command guard from blocking a safe branch delete:
+
+- `guard-destructive.sh` matched every pattern with one case-insensitive grep, so
+  the force-delete pattern also caught the lowercase safe delete -- the variant
+  that refuses to drop an unmerged branch, and exactly the post-merge cleanup the
+  toolkit's own git-workflow rules prescribe.
+- Patterns are now matched in two passes. Command names and flags are matched
+  case-sensitively, because short flags that differ only in case are different
+  flags. SQL keywords and the Windows `format` command stay case-insensitive, so
+  lowercase SQL still blocks.
+- Force delete still blocks. Test count: 1666 -> 1671.
 
 ## Table of Contents
 

package/app/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "ai-toolkit",
   "displayName": "AI Toolkit",
   "description": "Professional-grade engineering skills, agents, rules, and lifecycle guardrails for Claude Code, Claude Chat, and Cowork.",
-  "version": "4.29.0",
+  "version": "4.29.1",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"

package/app/hooks/guard-destructive.sh

@@ -40,7 +40,15 @@ fi
 # --force or -f left behind still blocks.
 SAFE_STRIPPED=$(printf '%s' "$NORMALIZED" | sed -E 's/--force-with-lease(=[^ ]*)?//g; s/--force-if-includes//g')
 
-# Destructive patterns — word-boundary aware where possible
+# Destructive patterns — word-boundary aware where possible.
+#
+# Two buckets, matched by two greps, because case sensitivity is not a uniform
+# property of these patterns. POSIX command names and flags are case-SIGNIFICANT:
+# `-d` and `-D` are different flags, and folding them together made the guard
+# block `git branch -d` — the safe delete that refuses unmerged branches — as if
+# it were `-D`. SQL keywords carry no such distinction and are written in every
+# casing in the wild, so they need folding. One case-insensitive grep over both
+# sets cannot express that, and the flag bucket is the one that loses.
 DESTRUCTIVE_PATTERNS=(
     # rm variants (short flags, long flags, separated flags, sudo, xargs/find piped)
     'rm\s+(-[rRf]{2,}|-r\s+-f|-f\s+-r)'
@@ -54,18 +62,13 @@ DESTRUCTIVE_PATTERNS=(
     'find\s+.*-delete'
     'find\s+.*-exec\s+rm\b'
 
-    # SQL destructive operations
-    'DROP\s+(TABLE|DATABASE|SCHEMA|INDEX)'
-    'TRUNCATE\s+'
-    'DELETE\s+FROM\s+\S+\s*(;|$|WHERE\s+1)'
-
     # Disk/filesystem destructive
-    'format\s+/'
     'dd\s+if='
     'mkfs\b'
     'shred\b'
 
-    # Git destructive operations
+    # Git destructive operations. `-D` only: `git branch -d` refuses to delete an
+    # unmerged branch and is the documented post-merge cleanup, not a hazard.
     'git\s+push\s+(--force|-f)\b'
     'git\s+push\s+.*--force'
     'git\s+reset\s+--hard'
@@ -88,10 +91,25 @@ DESTRUCTIVE_PATTERNS=(
     '>\s*/dev/sd[a-z]'
 )
 
-# Build combined regex
+# Case-insensitive bucket: patterns whose real-world casing genuinely varies.
+# SQL is written DROP TABLE, drop table, and Drop Table with equal frequency;
+# `format` is a Windows command and Windows command names are case-insensitive.
+DESTRUCTIVE_PATTERNS_NOCASE=(
+    # SQL destructive operations
+    'DROP\s+(TABLE|DATABASE|SCHEMA|INDEX)'
+    'TRUNCATE\s+'
+    'DELETE\s+FROM\s+\S+\s*(;|$|WHERE\s+1)'
+
+    # Disk/filesystem destructive
+    'format\s+/'
+)
+
+# Build combined regexes
 REGEX=$(IFS='|'; echo "${DESTRUCTIVE_PATTERNS[*]}")
+REGEX_NOCASE=$(IFS='|'; echo "${DESTRUCTIVE_PATTERNS_NOCASE[*]}")
 
-if echo "$SAFE_STRIPPED" | grep -qEi "($REGEX)"; then
+if echo "$SAFE_STRIPPED" | grep -qE "($REGEX)" \
+    || echo "$SAFE_STRIPPED" | grep -qEi "($REGEX_NOCASE)"; then
     echo "WARNING: Potentially destructive command detected. Please verify." >&2
     exit 2
 fi

package/kb/reference/hooks-catalog.md

@@ -95,8 +95,15 @@ for debugging; `AI_TOOLKIT_HOOK_QUIET=1` keeps it silent explicitly.
 - `git push --force`
 - `chmod -R 777`
 
+**Case sensitivity:** patterns are matched in two passes. Command names and flags
+are matched case-**sensitively**, because `-d` and `-D` are different flags —
+`git branch -D` blocks, `git branch -d` does not. SQL keywords and the Windows
+`format` command are matched case-**insensitively**, so `drop table` blocks the
+same as `DROP TABLE`.
+
 **Exemptions (avoid false positives):**
 - `git push --force-with-lease` / `--force-if-includes` — the safe force-push variants are allowed.
+- `git branch -d` — the safe delete refuses unmerged branches and is the post-merge cleanup the git-workflow rules prescribe. `git branch -D` still blocks.
 - A single, non-chained `echo`/`printf`/`git commit`/`git tag` carrying a destructive token as *data* (e.g. a commit message mentioning `DROP TABLE`) is allowed. Chained commands (`&&`, `;`, `|`) are still inspected in full.
 
 ### PreToolUse (file ops) — `guard-path.sh`

package/llms-full.txt

@@ -12244,8 +12244,15 @@ for debugging; `AI_TOOLKIT_HOOK_QUIET=1` keeps it silent explicitly.
 - `git push --force`
 - `chmod -R 777`
 
+**Case sensitivity:** patterns are matched in two passes. Command names and flags
+are matched case-**sensitively**, because `-d` and `-D` are different flags —
+`git branch -D` blocks, `git branch -d` does not. SQL keywords and the Windows
+`format` command are matched case-**insensitively**, so `drop table` blocks the
+same as `DROP TABLE`.
+
 **Exemptions (avoid false positives):**
 - `git push --force-with-lease` / `--force-if-includes` — the safe force-push variants are allowed.
+- `git branch -d` — the safe delete refuses unmerged branches and is the post-merge cleanup the git-workflow rules prescribe. `git branch -D` still blocks.
 - A single, non-chained `echo`/`printf`/`git commit`/`git tag` carrying a destructive token as *data* (e.g. a commit message mentioning `DROP TABLE`) is allowed. Chained commands (`&&`, `;`, `|`) are still inspected in full.
 
 ### PreToolUse (file ops) — `guard-path.sh`

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.29.0",
+  "version": "4.29.1",
   "components": {
     "agents": {
       "description": "44 specialized agents (orchestrator, backend, frontend, security, devops, etc.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "4.29.0",
+  "version": "4.29.1",
   "description": "AI coding toolkit: 109 skills, 44 agents, 12 developer-tool integrations, recoverable native tool-output filtering, Claude Chat/Cowork export, safety constitution, SARIF audit, and signed npm provenance.",
   "keywords": [
     "claude",