@softspark/ai-toolkit 4.29.1 → 4.29.2

package/CHANGELOG.md

@@ -7,6 +7,39 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v4.29.2 — The Codex dry-run stops hiding a surface (2026-08-21)
+
+### Fixed
+
+- **`install --dry-run` never mentioned the Codex hook surfaces.** Selecting
+  `codex` runs `gen_codex_hooks()` unconditionally, at every profile, writing
+  `.codex/hooks.json` and the hook scripts under `.codex/hooks/` (23 files). The
+  dry-run branch in `scripts/install_steps/ai_tools.py` printed only
+  `.codex/agents/` and `.agents/skills/`. A preview that omits a whole surface is
+  worse than no preview, and this is the surface a user is asked to review and
+  trust with `/hooks` before Codex will run any of it.
+- **The global preview named the manifest but not its scripts.** It listed
+  `$CODEX_HOME/hooks.json` and stopped there, leaving out
+  `$CODEX_HOME/ai-toolkit-hooks/`. Same defect, other branch.
+
+### Added
+
+- Four tests in `tests/test_install_profiles.bats`: the preview names both hook
+  paths, it names them at `minimal`/`standard`/`full` alike, the preview matches
+  what a live install then writes to disk, and `--dry-run` still writes nothing.
+  All four fail against v4.29.1.
+
+### Changed
+
+- Test count: 1671 → 1675.
+
+**Found by:** running the Release Verification SOP against the published
+v4.29.1. Phase 9.1 checks dry-run output for each native surface, and the Codex
+hook lines were missing — so that SOP check would have produced a false negative
+on a build where the surface really was gone.
+
+---
+
 ## v4.29.1 — The guard stops blocking the safe branch delete (2026-08-21)
 
 ### Fixed

package/README.md

@@ -6,21 +6,21 @@
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 [![Skills](https://img.shields.io/badge/skills-109-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-44-blue)](app/agents/)
-[![Tests](https://img.shields.io/badge/tests-1671%20passing-success)](tests/)
+[![Tests](https://img.shields.io/badge/tests-1675%20passing-success)](tests/)
 
-## What's New in v4.29.1
+## What's New in v4.29.2
 
-**v4.29.1** stops the destructive-command guard from blocking a safe branch delete:
+**v4.29.2** makes `install --dry-run` tell the truth about Codex hooks:
 
-- `guard-destructive.sh` matched every pattern with one case-insensitive grep, so
-  the force-delete pattern also caught the lowercase safe delete -- the variant
-  that refuses to drop an unmerged branch, and exactly the post-merge cleanup the
-  toolkit's own git-workflow rules prescribe.
-- Patterns are now matched in two passes. Command names and flags are matched
-  case-sensitively, because short flags that differ only in case are different
-  flags. SQL keywords and the Windows `format` command stay case-insensitive, so
-  lowercase SQL still blocks.
-- Force delete still blocks. Test count: 1666 -> 1671.
+- Selecting `codex` always installs Codex lifecycle hooks -- `.codex/hooks.json`
+  plus the scripts under `.codex/hooks/` -- at every profile. The dry-run branch
+  listed only agents and skills, so the preview silently omitted a whole surface,
+  and the one you are asked to review and trust with `/hooks`.
+- Both previews now name it: project installs announce
+  `.codex/hooks.json + .codex/hooks/`, global installs add
+  `$CODEX_HOME/ai-toolkit-hooks/` next to `$CODEX_HOME/hooks.json`.
+- Four tests pin the preview against what the live install actually writes, so a
+  surface cannot go missing from the dry-run again. Test count: 1671 -> 1675.
 
 ## Table of Contents
 

package/app/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "ai-toolkit",
   "displayName": "AI Toolkit",
   "description": "Professional-grade engineering skills, agents, rules, and lifecycle guardrails for Claude Code, Claude Chat, and Cowork.",
-  "version": "4.29.1",
+  "version": "4.29.2",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.29.1",
+  "version": "4.29.2",
   "components": {
     "agents": {
       "description": "44 specialized agents (orchestrator, backend, frontend, security, devops, etc.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "4.29.1",
+  "version": "4.29.2",
   "description": "AI coding toolkit: 109 skills, 44 agents, 12 developer-tool integrations, recoverable native tool-output filtering, Claude Chat/Cowork export, safety constitution, SARIF audit, and signed npm provenance.",
   "keywords": [
     "claude",

package/scripts/install_steps/ai_tools.py

@@ -173,7 +173,7 @@ def install_ai_tools(target_dir: Path, rules_dir: Path,
     if "codex" in eds:
         if dry_run:
             print("  Would inject: $CODEX_HOME/AGENTS.md, $CODEX_HOME/agents/, "
-                  "$CODEX_HOME/hooks.json")
+                  "$CODEX_HOME/hooks.json + $CODEX_HOME/ai-toolkit-hooks/")
             print("  Would generate: ~/.agents/skills/ (shared Codex skill discovery)")
         else:
             _install_codex_global(target_dir, rules_dir)
@@ -1224,6 +1224,12 @@ def _install_local_dry_run(reset: bool, editors: list[str] | None = None,
         if "opencode" in eds:
             print("  Would generate: .opencode/skills/ (profile=full)")
     if "codex" in eds:
+        # Hooks are not profile-gated: the live path runs gen_codex_hooks
+        # unconditionally whenever codex is selected, so the preview must say so
+        # at every profile. Announcing the asset directory as well as the
+        # manifest matters here — the hook scripts are what a user reviews and
+        # trusts with /hooks before Codex will run them.
+        print("  Would generate: .codex/hooks.json + .codex/hooks/ (hook scripts)")
         print("  Would generate: .codex/agents/ native agents")
         print("  Would generate: .agents/skills/ Codex skills")
         if codex_skills: