@softspark/ai-toolkit 4.29.0 → 4.29.2

package/CHANGELOG.md

@@ -7,6 +7,86 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v4.29.2 — The Codex dry-run stops hiding a surface (2026-08-21)
+
+### Fixed
+
+- **`install --dry-run` never mentioned the Codex hook surfaces.** Selecting
+  `codex` runs `gen_codex_hooks()` unconditionally, at every profile, writing
+  `.codex/hooks.json` and the hook scripts under `.codex/hooks/` (23 files). The
+  dry-run branch in `scripts/install_steps/ai_tools.py` printed only
+  `.codex/agents/` and `.agents/skills/`. A preview that omits a whole surface is
+  worse than no preview, and this is the surface a user is asked to review and
+  trust with `/hooks` before Codex will run any of it.
+- **The global preview named the manifest but not its scripts.** It listed
+  `$CODEX_HOME/hooks.json` and stopped there, leaving out
+  `$CODEX_HOME/ai-toolkit-hooks/`. Same defect, other branch.
+
+### Added
+
+- Four tests in `tests/test_install_profiles.bats`: the preview names both hook
+  paths, it names them at `minimal`/`standard`/`full` alike, the preview matches
+  what a live install then writes to disk, and `--dry-run` still writes nothing.
+  All four fail against v4.29.1.
+
+### Changed
+
+- Test count: 1671 → 1675.
+
+**Found by:** running the Release Verification SOP against the published
+v4.29.1. Phase 9.1 checks dry-run output for each native surface, and the Codex
+hook lines were missing — so that SOP check would have produced a false negative
+on a build where the surface really was gone.
+
+---
+
+## v4.29.1 — The guard stops blocking the safe branch delete (2026-08-21)
+
+### Fixed
+
+- **`guard-destructive.sh` no longer folds `-d` onto `-D`.** Every pattern was
+  matched by a single `grep -qEi`, so the `git\s+branch\s+-D\b` pattern also
+  caught `git branch -d`. Those are different operations: `-D` discards an
+  unmerged branch, `-d` refuses to. The safe one is what
+  `.claude/rules/ai-toolkit-git-workflow.md` tells users to run after every
+  merge, and the guard blocked it — a false positive on the toolkit's own
+  advice, in the toolkit's own safety hook.
+- **Patterns are matched in two passes, split by whether case carries meaning.**
+  Command names and flags go through a case-sensitive `grep -qE`; POSIX flags
+  that differ only in case are different flags, and folding them together can
+  only lose information. SQL keywords and the Windows `format` command go
+  through a case-insensitive `grep -qEi`, because their casing genuinely varies
+  in the wild — `drop table`, `Truncate`, and `delete from` all still block.
+  The `-i` was presumably there for the SQL patterns all along; it was the
+  flag patterns that paid for it.
+
+- **A cross-file race in the test suite.** `doctor --fix regenerates missing
+  llms-full.txt` deleted the artifact from the shared checkout and asserted on
+  doctor's `FIXED` line. `npm test` runs `bats --jobs 4
+  --no-parallelize-within-files`, so files run concurrently, and
+  `test_doctor_plugin_double_load.bats` also runs `doctor --fix` — which
+  regenerates that artifact. When it won, the assertion saw a present file, no
+  `FIXED` line, and a red suite; the test also left a `llms-full.txt.test-bak`
+  in the repo, because the restoring `mv` never ran. v4.29.0 added a second
+  `doctor --fix` call to the plugin test file, which is what made a latent race
+  start firing. The test now runs doctor against a private copy of the toolkit,
+  so it mutates no shared state at all.
+
+### Changed
+
+- `kb/reference/hooks-catalog.md` documents the two-pass matching and lists the
+  safe branch delete among the guard's exemptions.
+- Test count: 1666 → 1671. The new cases pin both directions: the safe delete
+  and an uppercase non-flag pass, lowercase and mixed-case SQL block.
+
+### Known gap (not addressed here)
+
+- The guard matches `git branch -D` but not its long form, `git branch --delete
+  --force`. That gap predates this fix and closing it is a coverage change
+  rather than a case-sensitivity one, so it is left for a separate decision.
+
+---
+
 ## v4.29.0 — Stale plugin uploads stop hiding (2026-08-21)
 
 ### Added

package/README.md

@@ -6,24 +6,21 @@
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 [![Skills](https://img.shields.io/badge/skills-109-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-44-blue)](app/agents/)
-[![Tests](https://img.shields.io/badge/tests-1666%20passing-success)](tests/)
-
-## What's New in v4.29.0
-
-**v4.29.0** stops a stale Claude app upload from passing as healthy:
-
-- The plugin ZIP is a point-in-time snapshot. Once the toolkit moves on, Chat and
-  Cowork keep running the skills, agents, hooks, and rules from whenever you
-  exported it, with nothing anywhere saying so.
-- `ai-toolkit doctor` now compares the version recorded in
-  `~/.claude/plugins/installed_plugins.json` against the installed toolkit and
-  warns when they differ -- including when the plugin is disabled for Claude
-  Code, since Chat and Cowork still load it.
-- `--fix` cannot clear that warning. It can regenerate the export; the upload
-  itself is manual, so the check names both steps instead of pretending.
-- `ai-toolkit install` now re-asserts the plugin as disabled for Claude Code.
-  Uploading the ZIP re-enables it every time, which had left the double-load fix
-  to whoever remembered to re-run `doctor --fix`.
+[![Tests](https://img.shields.io/badge/tests-1675%20passing-success)](tests/)
+
+## What's New in v4.29.2
+
+**v4.29.2** makes `install --dry-run` tell the truth about Codex hooks:
+
+- Selecting `codex` always installs Codex lifecycle hooks -- `.codex/hooks.json`
+  plus the scripts under `.codex/hooks/` -- at every profile. The dry-run branch
+  listed only agents and skills, so the preview silently omitted a whole surface,
+  and the one you are asked to review and trust with `/hooks`.
+- Both previews now name it: project installs announce
+  `.codex/hooks.json + .codex/hooks/`, global installs add
+  `$CODEX_HOME/ai-toolkit-hooks/` next to `$CODEX_HOME/hooks.json`.
+- Four tests pin the preview against what the live install actually writes, so a
+  surface cannot go missing from the dry-run again. Test count: 1671 -> 1675.
 
 ## Table of Contents
 

package/app/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "ai-toolkit",
   "displayName": "AI Toolkit",
   "description": "Professional-grade engineering skills, agents, rules, and lifecycle guardrails for Claude Code, Claude Chat, and Cowork.",
-  "version": "4.29.0",
+  "version": "4.29.2",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"

package/app/hooks/guard-destructive.sh

@@ -40,7 +40,15 @@ fi
 # --force or -f left behind still blocks.
 SAFE_STRIPPED=$(printf '%s' "$NORMALIZED" | sed -E 's/--force-with-lease(=[^ ]*)?//g; s/--force-if-includes//g')
 
-# Destructive patterns — word-boundary aware where possible
+# Destructive patterns — word-boundary aware where possible.
+#
+# Two buckets, matched by two greps, because case sensitivity is not a uniform
+# property of these patterns. POSIX command names and flags are case-SIGNIFICANT:
+# `-d` and `-D` are different flags, and folding them together made the guard
+# block `git branch -d` — the safe delete that refuses unmerged branches — as if
+# it were `-D`. SQL keywords carry no such distinction and are written in every
+# casing in the wild, so they need folding. One case-insensitive grep over both
+# sets cannot express that, and the flag bucket is the one that loses.
 DESTRUCTIVE_PATTERNS=(
     # rm variants (short flags, long flags, separated flags, sudo, xargs/find piped)
     'rm\s+(-[rRf]{2,}|-r\s+-f|-f\s+-r)'
@@ -54,18 +62,13 @@ DESTRUCTIVE_PATTERNS=(
     'find\s+.*-delete'
     'find\s+.*-exec\s+rm\b'
 
-    # SQL destructive operations
-    'DROP\s+(TABLE|DATABASE|SCHEMA|INDEX)'
-    'TRUNCATE\s+'
-    'DELETE\s+FROM\s+\S+\s*(;|$|WHERE\s+1)'
-
     # Disk/filesystem destructive
-    'format\s+/'
     'dd\s+if='
     'mkfs\b'
     'shred\b'
 
-    # Git destructive operations
+    # Git destructive operations. `-D` only: `git branch -d` refuses to delete an
+    # unmerged branch and is the documented post-merge cleanup, not a hazard.
     'git\s+push\s+(--force|-f)\b'
     'git\s+push\s+.*--force'
     'git\s+reset\s+--hard'
@@ -88,10 +91,25 @@ DESTRUCTIVE_PATTERNS=(
     '>\s*/dev/sd[a-z]'
 )
 
-# Build combined regex
+# Case-insensitive bucket: patterns whose real-world casing genuinely varies.
+# SQL is written DROP TABLE, drop table, and Drop Table with equal frequency;
+# `format` is a Windows command and Windows command names are case-insensitive.
+DESTRUCTIVE_PATTERNS_NOCASE=(
+    # SQL destructive operations
+    'DROP\s+(TABLE|DATABASE|SCHEMA|INDEX)'
+    'TRUNCATE\s+'
+    'DELETE\s+FROM\s+\S+\s*(;|$|WHERE\s+1)'
+
+    # Disk/filesystem destructive
+    'format\s+/'
+)
+
+# Build combined regexes
 REGEX=$(IFS='|'; echo "${DESTRUCTIVE_PATTERNS[*]}")
+REGEX_NOCASE=$(IFS='|'; echo "${DESTRUCTIVE_PATTERNS_NOCASE[*]}")
 
-if echo "$SAFE_STRIPPED" | grep -qEi "($REGEX)"; then
+if echo "$SAFE_STRIPPED" | grep -qE "($REGEX)" \
+    || echo "$SAFE_STRIPPED" | grep -qEi "($REGEX_NOCASE)"; then
     echo "WARNING: Potentially destructive command detected. Please verify." >&2
     exit 2
 fi

package/kb/reference/hooks-catalog.md

@@ -95,8 +95,15 @@ for debugging; `AI_TOOLKIT_HOOK_QUIET=1` keeps it silent explicitly.
 - `git push --force`
 - `chmod -R 777`
 
+**Case sensitivity:** patterns are matched in two passes. Command names and flags
+are matched case-**sensitively**, because `-d` and `-D` are different flags —
+`git branch -D` blocks, `git branch -d` does not. SQL keywords and the Windows
+`format` command are matched case-**insensitively**, so `drop table` blocks the
+same as `DROP TABLE`.
+
 **Exemptions (avoid false positives):**
 - `git push --force-with-lease` / `--force-if-includes` — the safe force-push variants are allowed.
+- `git branch -d` — the safe delete refuses unmerged branches and is the post-merge cleanup the git-workflow rules prescribe. `git branch -D` still blocks.
 - A single, non-chained `echo`/`printf`/`git commit`/`git tag` carrying a destructive token as *data* (e.g. a commit message mentioning `DROP TABLE`) is allowed. Chained commands (`&&`, `;`, `|`) are still inspected in full.
 
 ### PreToolUse (file ops) — `guard-path.sh`

package/llms-full.txt

@@ -12244,8 +12244,15 @@ for debugging; `AI_TOOLKIT_HOOK_QUIET=1` keeps it silent explicitly.
 - `git push --force`
 - `chmod -R 777`
 
+**Case sensitivity:** patterns are matched in two passes. Command names and flags
+are matched case-**sensitively**, because `-d` and `-D` are different flags —
+`git branch -D` blocks, `git branch -d` does not. SQL keywords and the Windows
+`format` command are matched case-**insensitively**, so `drop table` blocks the
+same as `DROP TABLE`.
+
 **Exemptions (avoid false positives):**
 - `git push --force-with-lease` / `--force-if-includes` — the safe force-push variants are allowed.
+- `git branch -d` — the safe delete refuses unmerged branches and is the post-merge cleanup the git-workflow rules prescribe. `git branch -D` still blocks.
 - A single, non-chained `echo`/`printf`/`git commit`/`git tag` carrying a destructive token as *data* (e.g. a commit message mentioning `DROP TABLE`) is allowed. Chained commands (`&&`, `;`, `|`) are still inspected in full.
 
 ### PreToolUse (file ops) — `guard-path.sh`

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.29.0",
+  "version": "4.29.2",
   "components": {
     "agents": {
       "description": "44 specialized agents (orchestrator, backend, frontend, security, devops, etc.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "4.29.0",
+  "version": "4.29.2",
   "description": "AI coding toolkit: 109 skills, 44 agents, 12 developer-tool integrations, recoverable native tool-output filtering, Claude Chat/Cowork export, safety constitution, SARIF audit, and signed npm provenance.",
   "keywords": [
     "claude",

package/scripts/install_steps/ai_tools.py

@@ -173,7 +173,7 @@ def install_ai_tools(target_dir: Path, rules_dir: Path,
     if "codex" in eds:
         if dry_run:
             print("  Would inject: $CODEX_HOME/AGENTS.md, $CODEX_HOME/agents/, "
-                  "$CODEX_HOME/hooks.json")
+                  "$CODEX_HOME/hooks.json + $CODEX_HOME/ai-toolkit-hooks/")
             print("  Would generate: ~/.agents/skills/ (shared Codex skill discovery)")
         else:
             _install_codex_global(target_dir, rules_dir)
@@ -1224,6 +1224,12 @@ def _install_local_dry_run(reset: bool, editors: list[str] | None = None,
         if "opencode" in eds:
             print("  Would generate: .opencode/skills/ (profile=full)")
     if "codex" in eds:
+        # Hooks are not profile-gated: the live path runs gen_codex_hooks
+        # unconditionally whenever codex is selected, so the preview must say so
+        # at every profile. Announcing the asset directory as well as the
+        # manifest matters here — the hook scripts are what a user reviews and
+        # trusts with /hooks before Codex will run them.
+        print("  Would generate: .codex/hooks.json + .codex/hooks/ (hook scripts)")
         print("  Would generate: .codex/agents/ native agents")
         print("  Would generate: .agents/skills/ Codex skills")
         if codex_skills: