@softspark/ai-toolkit 4.32.1 → 4.32.2

package/CHANGELOG.md

@@ -7,6 +7,25 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v4.32.2 - Plugin exports land where you run the command (2026-09-04)
+
+### Fixed
+
+- **`claude-app export`, `codex-plugin export`, `antigravity-plugin export`
+  write to the shell's directory.** `bin/ai-toolkit.js` runs these three with
+  `cwd` inside the installed package so their asset paths resolve, which also
+  made every relative `--output`, and therefore every default
+  (`ai-toolkit-claude-app.zip`, `*-global-instructions.md`), appear next to
+  `node_modules/@softspark/ai-toolkit`. The wrapper now passes the user's
+  directory as `AI_TOOLKIT_USER_CWD` and `paths.user_path()` resolves relative
+  outputs against it; absolute paths and direct `python3 scripts/...` runs
+  are unchanged. Found the first time the v4.32.1 README instruction was
+  followed from `~/Downloads`.
+- `.gitignore` ignores root-level `*.zip` and `*-global-instructions.md` so an
+  export run from the repository cannot be committed by accident.
+- **Test count.** Bats increased from 1972 to 1974 (relative `--output` from
+  a foreign cwd for `claude-app` and `codex-plugin`).
+
 ## v4.32.1 - Plugin removal leaves nothing behind (2026-09-04)
 
 Both fixes come from running the post-release SOPs on v4.32.0 in an isolated

package/README.md

@@ -6,25 +6,25 @@
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 [![Skills](https://img.shields.io/badge/skills-114-brightgreen)](app/skills/)
 [![Agents](https://img.shields.io/badge/agents-44-blue)](app/agents/)
-[![Tests](https://img.shields.io/badge/tests-1972%20passing-success)](tests/)
-
-## What's New in v4.32.1
-
-**v4.32.1** fixes two defects the post-release SOPs found on v4.32.0 (both
-older than that release):
-
-- `ai-toolkit plugin remove` now deletes the hooks and scripts a pack
-  installed under `~/.softspark/ai-toolkit`. Install records what it copied;
-  removal deletes only unchanged, unshared files and names anything it
-  preserves. Every pack used to leave 4-5 files behind.
-- Five skill scripts (`doc-inventory`, `dependency-graph`, `migration-status`,
-  `refactor-scan`, `complexity`) answer `--help` instead of treating it as a
-  path; a new test probes every documented skill script with `--help`.
-- Still in this train from v4.32.0: path-scoped common rules, language skills
-  scoped to your registered projects (`--language-skills`), `doctor` Context
-  Budget and Permission Rules checks, one strict frontmatter parser, and the
-  `git-team` rule for `--profile strict`. Test count: 1966 -> 1972 bats +
-  348 pytest.
+[![Tests](https://img.shields.io/badge/tests-1974%20passing-success)](tests/)
+
+## What's New in v4.32.2
+
+**v4.32.2** makes plugin exports land where you run the command:
+
+- `ai-toolkit claude-app export`, `codex-plugin export`, and
+  `antigravity-plugin export` write their ZIP (and the sibling
+  `*-global-instructions.md`) to the directory you typed the command in. They
+  used to appear inside `node_modules/@softspark/ai-toolkit` because the CLI
+  runs them with its own working directory; the wrapper now hands the shell's
+  directory to the exporters. Absolute `--output` paths are unchanged.
+- Root-level `*.zip` and `*-global-instructions.md` are gitignored so an
+  export run from the repository is never committed.
+- Still in this train: `plugin remove` leaves nothing behind, every skill
+  script answers `--help` (v4.32.1); path-scoped common rules, project-scoped
+  language skills, `doctor` context-budget and permission checks, one strict
+  frontmatter parser, `git-team` for `--profile strict` (v4.32.0). Test
+  count: 1972 -> 1974 bats + 348 pytest.
 
 See [CHANGELOG.md](CHANGELOG.md) for full history.
 

package/app/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "ai-toolkit",
   "displayName": "AI Toolkit",
   "description": "Professional-grade engineering skills, agents, rules, and lifecycle guardrails for Claude Code, Claude Chat, and Cowork.",
-  "version": "4.32.1",
+  "version": "4.32.2",
   "author": {
     "name": "SoftSpark",
     "url": "https://github.com/softspark"

package/bin/ai-toolkit.js

@@ -222,10 +222,14 @@ function runGenerator(scriptName, extraArgs = []) {
  */
 function run(script, args = [], opts = {}) {
   requirePython();
+  // Commands flagged toolkitCwd run with cwd inside the installed package so
+  // their relative asset paths resolve; the user's own directory travels in
+  // AI_TOOLKIT_USER_CWD so a relative --output still lands where they typed
+  // the command, not inside node_modules (v4.32.2).
   const result = spawnSync('python3', [script, ...args], {
     stdio: 'inherit',
     cwd: opts.cwd || CWD,
-    env: { ...process.env },
+    env: { ...process.env, AI_TOOLKIT_USER_CWD: CWD },
   });
   if (result.status !== 0) {
     process.exit(result.status || 1);

package/kb/reference/cli-reference.md

@@ -30,7 +30,7 @@ Usage: ai-toolkit <command> [options]
 | `doctor` | Diagnose install health, hooks, quick-win assets, artifact drift, context budget (est. resident tokens of the skill/agent listings and user rules, plus skills with zero recorded use; read-only, prints the `skillOverrides` key to paste), and permission rules (`permissions.allow` wildcards on interpreters, task runners, package installs, `gh api`, `curl`, `git fetch`, destructive commands; warns only, never edits) |
 | `doctor --fix` | Auto-repair broken symlinks, missing hooks, stale artifacts |
 | `eject [dir]` | Export standalone config (no symlinks, no toolkit dependency) |
-| `claude-app export [--output FILE] [--no-custom-rules] [--verify]` | Build an uploadable Claude Chat/Desktop/Cowork plugin ZIP and global-instructions file |
+| `claude-app export [--output FILE] [--no-custom-rules] [--verify]` | Writes to the directory you run the command in (relative `--output` and the default `ai-toolkit-claude-app.zip` + `*-global-instructions.md`; before v4.32.2 they landed inside `node_modules/@softspark/ai-toolkit`). Build an uploadable Claude Chat/Desktop/Cowork plugin ZIP and global-instructions file |
 | `claude-app verify` | Validate a clean staged plugin with structural checks and the official Claude plugin validator |
 | `codex-plugin export [--output FILE]` | Build a deterministic native Codex plugin ZIP with skills and self-contained hooks |
 | `codex-plugin verify` | Validate a clean native Codex plugin stage without installing it or changing user configuration |

package/llms-full.txt

@@ -10482,7 +10482,7 @@ Usage: ai-toolkit <command> [options]
 | `doctor` | Diagnose install health, hooks, quick-win assets, artifact drift, context budget (est. resident tokens of the skill/agent listings and user rules, plus skills with zero recorded use; read-only, prints the `skillOverrides` key to paste), and permission rules (`permissions.allow` wildcards on interpreters, task runners, package installs, `gh api`, `curl`, `git fetch`, destructive commands; warns only, never edits) |
 | `doctor --fix` | Auto-repair broken symlinks, missing hooks, stale artifacts |
 | `eject [dir]` | Export standalone config (no symlinks, no toolkit dependency) |
-| `claude-app export [--output FILE] [--no-custom-rules] [--verify]` | Build an uploadable Claude Chat/Desktop/Cowork plugin ZIP and global-instructions file |
+| `claude-app export [--output FILE] [--no-custom-rules] [--verify]` | Writes to the directory you run the command in (relative `--output` and the default `ai-toolkit-claude-app.zip` + `*-global-instructions.md`; before v4.32.2 they landed inside `node_modules/@softspark/ai-toolkit`). Build an uploadable Claude Chat/Desktop/Cowork plugin ZIP and global-instructions file |
 | `claude-app verify` | Validate a clean staged plugin with structural checks and the official Claude plugin validator |
 | `codex-plugin export [--output FILE]` | Build a deterministic native Codex plugin ZIP with skills and self-contained hooks |
 | `codex-plugin verify` | Validate a clean native Codex plugin stage without installing it or changing user configuration |

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.32.1",
+  "version": "4.32.2",
   "components": {
     "agents": {
       "description": "44 specialized agents (orchestrator, backend, frontend, security, devops, etc.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "4.32.1",
+  "version": "4.32.2",
   "description": "AI coding toolkit: 109 skills, 44 agents, 14 developer-tool integrations, recoverable native tool-output filtering, Claude Chat/Cowork export, safety constitution, SARIF audit, and signed npm provenance.",
   "keywords": [
     "claude",

package/scripts/antigravity_plugin.py

@@ -22,6 +22,7 @@ from typing import Any
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 
 from dir_rules_shared import STANDARD_RULES
+from paths import user_path
 from emission import agents_dir
 from generate_antigravity_agents import render_agent
 from generate_antigravity_hooks import (
@@ -550,7 +551,7 @@ def main(argv: list[str] | None = None) -> int:
                 or args.output_path
                 or "ai-toolkit-antigravity-plugin.zip"
             )
-            path = export(output)
+            path = export(user_path(output))
             print(f"Created: {path}")
             print(
                 "Install under .agents/plugins/ai-toolkit/ (workspace), "

package/scripts/claude_app.py

@@ -29,6 +29,7 @@ from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from frontmatter import split_frontmatter  # noqa: E402
+from paths import user_path  # noqa: E402
 
 
 TOOLKIT_DIR = Path(__file__).resolve().parent.parent
@@ -347,7 +348,7 @@ def main(argv: list[str] | None = None) -> int:
         return 0 if verify_plugin() else 1
     if args.action == "export":
         return 0 if export_plugin(
-            Path(args.output),
+            user_path(args.output),
             include_custom_rules=not args.no_custom_rules,
             verify=args.verify,
         ) else 1

package/scripts/codex_plugin.py

@@ -26,6 +26,7 @@ from typing import Any
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 
 from codex_skill_adapter import build_codex_skill_text
+from paths import user_path
 from generate_codex_hooks import (
     CODEX_HOOKS,
     _asset_names,
@@ -754,7 +755,7 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
 def main(argv: list[str] | None = None) -> int:
     args = parse_args(argv)
     if args.action == "export":
-        return 0 if export_plugin(Path(args.output)) else 1
+        return 0 if export_plugin(user_path(args.output)) else 1
     if args.action == "verify":
         return 0 if verify_plugin() else 1
     return 2

package/scripts/paths.py

@@ -55,3 +55,21 @@ LEGACY_PROJECT_LOCK = ".ai-toolkit.lock.json"
 
 # Base config filename (published in npm packages — unchanged)
 BASE_CONFIG_FILENAME = "ai-toolkit.config.json"
+
+
+def user_path(raw: "str | os.PathLike[str]") -> Path:
+    """Resolve a user-supplied path against the directory the user ran the CLI in.
+
+    ``bin/ai-toolkit.js`` runs some commands (``claude-app``, ``codex-plugin``,
+    ``antigravity-plugin``) with ``cwd`` inside the installed package so their
+    relative asset paths resolve, and passes the shell's own directory as
+    ``AI_TOOLKIT_USER_CWD``. Before v4.32.2 a relative ``--output`` (including
+    every default) was written next to ``node_modules/@softspark/ai-toolkit``.
+    Absolute paths pass through; direct ``python3 scripts/...`` runs, where the
+    variable is unset, resolve against the real cwd as before.
+    """
+    path = Path(raw).expanduser()
+    if path.is_absolute():
+        return path
+    base = os.environ.get("AI_TOOLKIT_USER_CWD", "").strip()
+    return (Path(base) if base else Path.cwd()) / path