@softspark/ai-toolkit 4.4.1 → 4.5.0

package/benchmarks/ecosystem-doctor-snapshot.json

@@ -1,5 +1,5 @@
 {
-  "last_run": "2026-05-25T11:12:53Z",
+  "last_run": "2026-05-30T19:51:17Z",
   "schema_version": 1,
   "tools": {
     "aider": {
@@ -24,7 +24,7 @@
       }
     },
     "augment": {
-      "docs_hash": "2546ce56fc2d92e4",
+      "docs_hash": "46ef1d20d537234f",
       "headings": [
         "Admin",
         "Auggie CLI",
@@ -65,11 +65,15 @@
       }
     },
     "claude-code": {
-      "docs_hash": "78dbdbf9b1b09fe8",
+      "docs_hash": "b2ee6850b58cee40",
       "headings": [
+        "Core concepts",
         "Documentation Index",
+        "Getting started",
         "On this page",
         "Overview",
+        "Platforms and integrations",
+        "Use Claude Code",
         "\u200bGet started",
         "\u200bNext steps",
         "\u200bUse Claude Code everywhere",
@@ -83,11 +87,14 @@
         "FileChanged": false,
         "InstructionsLoaded": false,
         "MCP server": true,
+        "MessageDisplay": false,
         "Notification": true,
         "PermissionDenied": false,
         "PermissionRequest": false,
         "PostCompact": false,
+        "PostToolBatch": false,
         "PostToolUse": true,
+        "PostToolUseFailure": false,
         "PreCompact": false,
         "PreToolUse": true,
         "SKILL.md": true,
@@ -101,6 +108,7 @@
         "TaskCompleted": false,
         "TaskCreated": false,
         "TeammateIdle": false,
+        "UserPromptExpansion": false,
         "UserPromptSubmit": false,
         "WorktreeCreate": false,
         "WorktreeRemove": false,
@@ -112,10 +120,10 @@
         "slash command": true,
         "sub-agent": true
       },
-      "version": "2.1.150 (Claude Code)"
+      "version": "2.1.158 (Claude Code)"
     },
     "cline": {
-      "docs_hash": "0d30b8f46cb45976",
+      "docs_hash": "9ec25e5132332d2f",
       "headings": [
         "API Reference",
         "Best Practices",
@@ -156,7 +164,7 @@
       }
     },
     "codex-cli": {
-      "docs_hash": "8cad495445dd03e0",
+      "docs_hash": "f7a6a5144e0f61a2",
       "headings": [
         "About",
         "Contributing",
@@ -175,7 +183,7 @@
         "Packages 0",
         "Provide feedback",
         "Quickstart",
-        "Releases 799",
+        "Releases 804",
         "Repository files navigation",
         "Resources",
         "Saved searches",
@@ -193,10 +201,14 @@
         "AGENTS.md": true,
         "config.toml": false,
         "hook event: PermissionRequest": false,
+        "hook event: PostCompact": false,
         "hook event: PostToolUse": false,
+        "hook event: PreCompact": false,
         "hook event: PreToolUse": false,
         "hook event: SessionStart": false,
         "hook event: Stop": false,
+        "hook event: SubagentStart": false,
+        "hook event: SubagentStop": false,
         "hook event: UserPromptSubmit": false,
         "hook handler: agent": false,
         "hook handler: command": false,
@@ -205,10 +217,10 @@
         "mcp_servers": false,
         "sandbox": true
       },
-      "version": "codex-cli 0.133.0"
+      "version": "codex-cli 0.134.0"
     },
     "cursor": {
-      "docs_hash": "56c9209877480e01",
+      "docs_hash": "6aa8a8d7cc046f13",
       "headings": [],
       "markers": {
         ".cursor/rules": false,
@@ -224,7 +236,7 @@
       }
     },
     "gemini-cli": {
-      "docs_hash": "6a47f9b11ff1527d",
+      "docs_hash": "5569709cc2e463a8",
       "headings": [
         "Breadcrumbs",
         "Directory actions",
@@ -263,16 +275,16 @@
       }
     },
     "github-copilot": {
-      "docs_hash": "a5b81592ca646743",
+      "docs_hash": "56ac2d5768f930b5",
       "headings": [
         "About Copilot auto model selection",
         "About Copilot integrations",
         "About agent management",
         "About agent skills",
         "About billing for GitHub Copilot in organizations and enterprises",
-        "About billing for individual GitHub Copilot plans",
         "About custom agents",
         "About customizing GitHub Copilot responses",
+        "About enterprise accounts for Copilot Business",
         "Articles",
         "Did you find what you needed?",
         "GitHub Copilot",
@@ -295,7 +307,7 @@
       }
     },
     "google-antigravity": {
-      "docs_hash": "6f089d2c7caabceb",
+      "docs_hash": "f933b31ac7414c29",
       "headings": [],
       "markers": {
         "AGENTS.md": false,
@@ -311,7 +323,7 @@
       }
     },
     "opencode": {
-      "docs_hash": "74eb2d934df9b613",
+      "docs_hash": "fe7f7590e4553574",
       "headings": [
         "Add features",
         "Ask questions",
@@ -371,7 +383,7 @@
       }
     },
     "windsurf": {
-      "docs_hash": "eddf51fabbcaa0a3",
+      "docs_hash": "a30041baf564742f",
       "headings": [
         "Accounts",
         "Advanced",

package/kb/reference/hooks-catalog.md

@@ -3,7 +3,7 @@ title: "Hooks Catalog"
 category: reference
 service: ai-toolkit
 tags: [hooks, quality, safety, enforcement, settings.json]
-version: "1.5.6"
+version: "1.5.7"
 created: "2026-03-27"
 last_updated: "2026-05-25"
 description: "Complete reference of all ai-toolkit hooks: events, scripts, installation, and runtime behavior."
@@ -13,7 +13,7 @@ description: "Complete reference of all ai-toolkit hooks: events, scripts, insta
 
 ## Overview
 
-ai-toolkit provides 28 global hook entries across 14 lifecycle events that enforce quality, safety, and workflow rules across all Claude Code sessions. Hooks are merged into `~/.claude/settings.json` on install, with logic in standalone scripts at `~/.softspark/ai-toolkit/hooks/`.
+ai-toolkit provides 29 global hook entries across 14 lifecycle events that enforce quality, safety, and workflow rules across all Claude Code sessions. Hooks are merged into `~/.claude/settings.json` on install, with logic in standalone scripts at `~/.softspark/ai-toolkit/hooks/`.
 
 ## Supported Surface
 
@@ -85,6 +85,10 @@ for debugging; `AI_TOOLKIT_HOOK_QUIET=1` keeps it silent explicitly.
 - `git push --force`
 - `chmod -R 777`
 
+**Exemptions (avoid false positives):**
+- `git push --force-with-lease` / `--force-if-includes` — the safe force-push variants are allowed.
+- A single, non-chained `echo`/`printf`/`git commit`/`git tag` carrying a destructive token as *data* (e.g. a commit message mentioning `DROP TABLE`) is allowed. Chained commands (`&&`, `;`, `|`) are still inspected in full.
+
 ### PreToolUse (file ops) — `guard-path.sh`
 
 | Field | Value |
@@ -403,6 +407,19 @@ First-match-wins per file. Built-in runners: `bats`, `pytest`, `vitest`, `jest`.
 
 **Overrides:** `CLAUDE_SKIP_COHESION=1` (one-off), `CLAUDE_HOOK_BOOTSTRAP=1` (when editing the hook itself). Skipped when `TOOLKIT_HOOK_PROFILE=minimal`.
 
+### PostToolUse (loop guard) — `loop-guard.sh`
+
+| Field | Value |
+|-------|-------|
+| Event | `PostToolUse` |
+| Matcher | `Bash\|Edit\|MultiEdit\|Write` |
+| Script | `~/.softspark/ai-toolkit/hooks/loop-guard.sh` |
+| Fires | After every Bash command or file edit |
+
+**Action:** Advisory only, never blocks. Hashes a `tool|identity` signature of each action (command for Bash; file path + new content for edits) and keeps the last `AI_TOOLKIT_LOOP_WINDOW` (default 6) hashes per session. When the same signature repeats `AI_TOOLKIT_LOOP_THRESHOLD` times (default 3) it emits a `PostToolUse` `additionalContext` advisory telling Claude to reassess instead of retrying. Catches successful-but-identical loops that the `/repeat` circuit breaker (which only counts failures) does not. Edits track content, so normal iterative editing of one file does not trip it. Only short hashes are stored — never raw payloads.
+
+**Tunables:** `AI_TOOLKIT_LOOP_WINDOW`, `AI_TOOLKIT_LOOP_THRESHOLD`. Skipped when `TOOLKIT_HOOK_PROFILE=minimal`; honours `AI_TOOLKIT_DISABLED_HOOKS`.
+
 ### PostToolUse (search-first tracker) — `search-tracker.sh`
 
 | Field | Value |
@@ -480,6 +497,8 @@ Set in `.claude/settings.local.json`:
 | `standard` | All hooks (default) |
 | `strict` | Standard + mypy --strict on task completion |
 
+**Disabling individual hooks:** set `AI_TOOLKIT_DISABLED_HOOKS` to a comma-separated list of hook names (with or without `.sh`), e.g. `{ "env": { "AI_TOOLKIT_DISABLED_HOOKS": "loop-guard,quality-check" } }`. Listed hooks become no-ops. This covers profile-gated hooks only; the safety guards (`guard-destructive`/`guard-path`/`guard-config`) intentionally cannot be env-disabled — remove them deliberately with `ai-toolkit remove-hook`.
+
 Non-blocking informational context is silent in plain-text mode by default while
 side effects and blocking decisions still run. Set `AI_TOOLKIT_HOOK_VERBOSE=1`
 only when debugging hook context locally. `AI_TOOLKIT_HOOK_QUIET=1` keeps hook
@@ -561,7 +580,7 @@ commands explicitly silent, and Codex-generated hooks plus Claude's bundled
 
 **Hook script not found:**
 ```bash
-ls ~/.softspark/ai-toolkit/hooks/     # should list 27 .sh files (plus _profile-check.sh + _locate-toolkit.sh + _hook-io.sh + _search-capability.sh helpers + test-cohesion-map.json)
+ls ~/.softspark/ai-toolkit/hooks/     # should list 28 .sh files (plus _profile-check.sh + _locate-toolkit.sh + _hook-io.sh + _search-capability.sh helpers + test-cohesion-map.json)
 ai-toolkit update            # re-copies scripts
 ```
 

package/kb/reference/mcp-editor-compatibility.md

@@ -5,7 +5,7 @@ service: ai-toolkit
 tags: [mcp, editors, compatibility, codex, cursor]
 version: "1.1.0"
 created: "2026-04-12"
-last_updated: "2026-04-28"
+last_updated: "2026-05-30"
 description: "Official MCP support matrix and native config targets for editors supported by ai-toolkit."
 ---
 

package/kb/reference/supported-tools-registry.md

@@ -5,7 +5,7 @@ service: ai-toolkit
 tags: [editors, platforms, generators, integration, ecosystem]
 version: "1.3.0"
 created: "2026-04-23"
-last_updated: "2026-05-25"
+last_updated: "2026-05-30"
 description: "Human-readable view of scripts/ecosystem_tools.json — the canonical list of tools ai-toolkit integrates with (Claude Code + 11 editors), their documentation URLs, config paths, our generators, and tracked capability markers."
 ---
 
@@ -30,7 +30,7 @@ The canonical data lives in **`scripts/ecosystem_tools.json`** and is consumed b
 | Release notes | https://github.com/anthropics/claude-code/releases |
 | Config paths | `~/.claude/settings.json`, `.claude/settings.local.json`, `CLAUDE.md`, `.claude/agents/*.md`, `.claude/skills/*/SKILL.md`, `~/.claude/themes/*.json` (v2.1.118+) |
 | Our generators | — (Claude Code is the primary target; toolkit content ships directly as `.md` files and `settings.json` merges) |
-| Tracked hook events | Core: `SessionStart`, `SessionEnd`, `UserPromptSubmit`, `Notification`. Tool: `PreToolUse`, `PostToolUse`. Turn: `Stop`, `StopFailure`. Subagent: `SubagentStart`, `SubagentStop`. Compaction: `PreCompact`, `PostCompact`. Permissions: `PermissionRequest`, `PermissionDenied`. Elicitation: `Elicitation`, `ElicitationResult`. Teams: `TaskCreated`, `TaskCompleted`, `TeammateIdle`. Worktrees/env: `WorktreeCreate`, `WorktreeRemove`, `CwdChanged`, `FileChanged`, `ConfigChange`. Setup: `Setup`, `InstructionsLoaded` |
+| Tracked hook events | Core: `SessionStart`, `SessionEnd`, `UserPromptSubmit`, `Notification`, `MessageDisplay`. Tool: `PreToolUse`, `PostToolUse`, `PostToolUseFailure`, `PostToolBatch`. Turn: `Stop`, `StopFailure`, `UserPromptExpansion`. Subagent: `SubagentStart`, `SubagentStop`. Compaction: `PreCompact`, `PostCompact`. Permissions: `PermissionRequest`, `PermissionDenied`. Elicitation: `Elicitation`, `ElicitationResult`. Teams: `TaskCreated`, `TaskCompleted`, `TeammateIdle`. Worktrees/env: `WorktreeCreate`, `WorktreeRemove`, `CwdChanged`, `FileChanged`, `ConfigChange`. Setup: `Setup`, `InstructionsLoaded` |
 | Tracked handler types | `command`, `prompt`, `agent`, `mcp_tool` |
 | Other capabilities | slash commands, MCP server/client, sub-agent, output style, `SKILL.md` (≥500 lines warn) |
 | Version probe | `claude --version` |
@@ -163,7 +163,7 @@ The canonical data lives in **`scripts/ecosystem_tools.json`** and is consumed b
 | Release notes | https://github.com/openai/codex/releases |
 | Config paths | `AGENTS.md`, `.agents/rules/*.md`, `.agents/skills/*/SKILL.md`, `.codex/hooks.json`, `~/.codex/config.toml` |
 | Our generators | `scripts/generate_codex.py`, `scripts/generate_codex_rules.py`, `scripts/generate_codex_hooks.py`, `scripts/generate_codex_skills.py` (opt-in via `--codex-skills`) |
-| Tracked hook events | `PreToolUse`, `PostToolUse`, `SessionStart`, `UserPromptSubmit`, `Stop`, `PermissionRequest` (6 events supported upstream in `config.toml`) |
+| Tracked hook events | Upstream canonical (codex-rs `HookEventName` enum): `PreToolUse`, `PostToolUse`, `PermissionRequest`, `PreCompact`, `PostCompact`, `SessionStart`, `UserPromptSubmit`, `SubagentStart`, `SubagentStop`, `Stop` (10 events). We currently wire a subset: `SessionStart`, `PreToolUse`, `PermissionRequest`, `UserPromptSubmit`, `Stop`. |
 | Tracked handler types | `command` (emitted by default); `prompt` and `agent` available upstream but authored by hand |
 | Other capabilities | `AGENTS.md`, `config.toml`, `mcp_servers`, sandbox policies, `.agents/skills/*/SKILL.md` (native Codex skill discovery path) |
 | Version probe | `codex --version` |

package/llms-full.txt

@@ -6965,9 +6965,9 @@ title: "AI Toolkit - Codex CLI Compatibility"
 category: reference
 service: ai-toolkit
 tags: [codex, compatibility, install, skills, hooks]
-version: "1.0.2"
+version: "1.0.3"
 created: "2026-04-12"
-last_updated: "2026-05-21"
+last_updated: "2026-05-25"
 description: "Reference for how ai-toolkit maps Claude-oriented skills, hooks, and plugin packs to Codex CLI."
 ---
 
@@ -7072,12 +7072,27 @@ This means Claude-only events such as `TaskCompleted`, `TeammateIdle`,
 `~/.codex/hooks.json` (global layer). Non-Codex events are silently skipped.
 `remove-hook` cleans both Claude and Codex targets.
 
-Generated Codex hook commands include `AI_TOOLKIT_HOOK_QUIET=1`. The
-`UserPromptSubmit` governance hook additionally sets `AI_TOOLKIT_HOOK_FORMAT=json`
-so it can pass quiet `additionalContext` before the model responds. This keeps
-non-blocking reminders and startup context out of visible hook output while
-preserving hook side effects, proactive search-first context, and blocking
-decisions such as search-first Stop enforcement.
+Generated Codex hook commands include `AI_TOOLKIT_HOOK_QUIET=1`. The generated
+`UserPromptSubmit` governance hook does not set `AI_TOOLKIT_HOOK_FORMAT=json`
+by default because Codex currently renders `additionalContext` as visible hook
+context in the TUI. This keeps prompt-submit output quiet while preserving hook
+side effects and blocking decisions such as search-first Stop enforcement.
+
+Codex `UserPromptSubmit` JSON output is event-specific. When emitting context,
+the hook must include the event name alongside the context:
+
+```json
+{
+  "hookSpecificOutput": {
+    "hookEventName": "UserPromptSubmit",
+    "additionalContext": "..."
+  },
+  "suppressOutput": true
+}
+```
+
+Older `{"hookSpecificOutput":{"additionalContext":"..."}}` output can be valid
+JSON but fail newer Codex event-output validation.
 
 Plain-text informational hook context is also silent by default in the shared
 hook helper. Set `AI_TOOLKIT_HOOK_VERBOSE=1` only when debugging hook output
@@ -8880,7 +8895,7 @@ title: "Hooks Catalog"
 category: reference
 service: ai-toolkit
 tags: [hooks, quality, safety, enforcement, settings.json]
-version: "1.5.5"
+version: "1.5.6"
 created: "2026-03-27"
 last_updated: "2026-05-25"
 description: "Complete reference of all ai-toolkit hooks: events, scripts, installation, and runtime behavior."
@@ -8890,7 +8905,7 @@ description: "Complete reference of all ai-toolkit hooks: events, scripts, insta
 
 ## Overview
 
-ai-toolkit provides 28 global hook entries across 14 lifecycle events that enforce quality, safety, and workflow rules across all Claude Code sessions. Hooks are merged into `~/.claude/settings.json` on install, with logic in standalone scripts at `~/.softspark/ai-toolkit/hooks/`.
+ai-toolkit provides 29 global hook entries across 14 lifecycle events that enforce quality, safety, and workflow rules across all Claude Code sessions. Hooks are merged into `~/.claude/settings.json` on install, with logic in standalone scripts at `~/.softspark/ai-toolkit/hooks/`.
 
 ## Supported Surface
 
@@ -8962,6 +8977,10 @@ for debugging; `AI_TOOLKIT_HOOK_QUIET=1` keeps it silent explicitly.
 - `git push --force`
 - `chmod -R 777`
 
+**Exemptions (avoid false positives):**
+- `git push --force-with-lease` / `--force-if-includes` — the safe force-push variants are allowed.
+- A single, non-chained `echo`/`printf`/`git commit`/`git tag` carrying a destructive token as *data* (e.g. a commit message mentioning `DROP TABLE`) is allowed. Chained commands (`&&`, `;`, `|`) are still inspected in full.
+
 ### PreToolUse (file ops) — `guard-path.sh`
 
 | Field | Value |
@@ -8991,12 +9010,29 @@ work, evidence-first debugging, KB-first research, and validation expectations.
 Skipped when `TOOLKIT_HOOK_PROFILE=minimal`. The bundled `app/hooks.json`
 registers this command with `AI_TOOLKIT_HOOK_QUIET=1 AI_TOOLKIT_HOOK_FORMAT=json`.
 This keeps the hook visually quiet (`suppressOutput: true`) while still
-injecting `hookSpecificOutput.additionalContext` before Claude starts working.
+injecting event-specific JSON context before Claude starts working in runtimes
+that consume hidden context:
+
+```json
+{
+  "hookSpecificOutput": {
+    "hookEventName": "UserPromptSubmit",
+    "additionalContext": "..."
+  },
+  "suppressOutput": true
+}
+```
+
 That context is the proactive half of search-first enforcement; the paired
 `stop-search-check.sh` remains the corrective half. In plain-text mode,
 informational reminders are silent by default and require
 `AI_TOOLKIT_HOOK_VERBOSE=1`.
 
+Codex-generated hooks intentionally run this script without
+`AI_TOOLKIT_HOOK_FORMAT=json` by default because Codex renders
+`additionalContext` visibly in the TUI; the search-first flag side effect still
+arms the corrective Stop hook.
+
 ### UserPromptSubmit (usage tracking) — `track-usage.sh`
 
 | Field | Value |
@@ -9006,7 +9042,7 @@ informational reminders are silent by default and require
 | Script | `~/.softspark/ai-toolkit/hooks/track-usage.sh` |
 | Fires | Before Claude starts working on a submitted prompt |
 
-**Action:** Records skill invocations (slash commands like `/commit`, `/review`) to `~/.softspark/ai-toolkit/stats.json` for local usage analytics. Non-slash prompts are ignored.
+**Action:** Records skill invocations (slash commands like `/commit`, `/review`) to `~/.softspark/ai-toolkit/stats.json` for local usage analytics. Non-slash prompts are ignored. Stats writes are best-effort and stay silent if the local state path is not writable.
 
 ### PostToolUse (edit feedback) — `post-tool-use.sh`
 
@@ -9263,6 +9299,19 @@ First-match-wins per file. Built-in runners: `bats`, `pytest`, `vitest`, `jest`.
 
 **Overrides:** `CLAUDE_SKIP_COHESION=1` (one-off), `CLAUDE_HOOK_BOOTSTRAP=1` (when editing the hook itself). Skipped when `TOOLKIT_HOOK_PROFILE=minimal`.
 
+### PostToolUse (loop guard) — `loop-guard.sh`
+
+| Field | Value |
+|-------|-------|
+| Event | `PostToolUse` |
+| Matcher | `Bash\|Edit\|MultiEdit\|Write` |
+| Script | `~/.softspark/ai-toolkit/hooks/loop-guard.sh` |
+| Fires | After every Bash command or file edit |
+
+**Action:** Advisory only, never blocks. Hashes a `tool|identity` signature of each action (command for Bash; file path + new content for edits) and keeps the last `AI_TOOLKIT_LOOP_WINDOW` (default 6) hashes per session. When the same signature repeats `AI_TOOLKIT_LOOP_THRESHOLD` times (default 3) it emits a `PostToolUse` `additionalContext` advisory telling Claude to reassess instead of retrying. Catches successful-but-identical loops that the `/repeat` circuit breaker (which only counts failures) does not. Edits track content, so normal iterative editing of one file does not trip it. Only short hashes are stored — never raw payloads.
+
+**Tunables:** `AI_TOOLKIT_LOOP_WINDOW`, `AI_TOOLKIT_LOOP_THRESHOLD`. Skipped when `TOOLKIT_HOOK_PROFILE=minimal`; honours `AI_TOOLKIT_DISABLED_HOOKS`.
+
 ### PostToolUse (search-first tracker) — `search-tracker.sh`
 
 | Field | Value |
@@ -9340,6 +9389,8 @@ Set in `.claude/settings.local.json`:
 | `standard` | All hooks (default) |
 | `strict` | Standard + mypy --strict on task completion |
 
+**Disabling individual hooks:** set `AI_TOOLKIT_DISABLED_HOOKS` to a comma-separated list of hook names (with or without `.sh`), e.g. `{ "env": { "AI_TOOLKIT_DISABLED_HOOKS": "loop-guard,quality-check" } }`. Listed hooks become no-ops. This covers profile-gated hooks only; the safety guards (`guard-destructive`/`guard-path`/`guard-config`) intentionally cannot be env-disabled — remove them deliberately with `ai-toolkit remove-hook`.
+
 Non-blocking informational context is silent in plain-text mode by default while
 side effects and blocking decisions still run. Set `AI_TOOLKIT_HOOK_VERBOSE=1`
 only when debugging hook context locally. `AI_TOOLKIT_HOOK_QUIET=1` keeps hook
@@ -9421,7 +9472,7 @@ commands explicitly silent, and Codex-generated hooks plus Claude's bundled
 
 **Hook script not found:**
 ```bash
-ls ~/.softspark/ai-toolkit/hooks/     # should list 27 .sh files (plus _profile-check.sh + _locate-toolkit.sh + _hook-io.sh + _search-capability.sh helpers + test-cohesion-map.json)
+ls ~/.softspark/ai-toolkit/hooks/     # should list 28 .sh files (plus _profile-check.sh + _locate-toolkit.sh + _hook-io.sh + _search-capability.sh helpers + test-cohesion-map.json)
 ai-toolkit update            # re-copies scripts
 ```
 
@@ -9988,7 +10039,7 @@ service: ai-toolkit
 tags: [mcp, editors, compatibility, codex, cursor]
 version: "1.1.0"
 created: "2026-04-12"
-last_updated: "2026-04-28"
+last_updated: "2026-05-30"
 description: "Official MCP support matrix and native config targets for editors supported by ai-toolkit."
 ---
 
@@ -11716,7 +11767,7 @@ service: ai-toolkit
 tags: [editors, platforms, generators, integration, ecosystem]
 version: "1.3.0"
 created: "2026-04-23"
-last_updated: "2026-05-25"
+last_updated: "2026-05-30"
 description: "Human-readable view of scripts/ecosystem_tools.json — the canonical list of tools ai-toolkit integrates with (Claude Code + 11 editors), their documentation URLs, config paths, our generators, and tracked capability markers."
 ---
 
@@ -11741,7 +11792,7 @@ The canonical data lives in **`scripts/ecosystem_tools.json`** and is consumed b
 | Release notes | https://github.com/anthropics/claude-code/releases |
 | Config paths | `~/.claude/settings.json`, `.claude/settings.local.json`, `CLAUDE.md`, `.claude/agents/*.md`, `.claude/skills/*/SKILL.md`, `~/.claude/themes/*.json` (v2.1.118+) |
 | Our generators | — (Claude Code is the primary target; toolkit content ships directly as `.md` files and `settings.json` merges) |
-| Tracked hook events | Core: `SessionStart`, `SessionEnd`, `UserPromptSubmit`, `Notification`. Tool: `PreToolUse`, `PostToolUse`. Turn: `Stop`, `StopFailure`. Subagent: `SubagentStart`, `SubagentStop`. Compaction: `PreCompact`, `PostCompact`. Permissions: `PermissionRequest`, `PermissionDenied`. Elicitation: `Elicitation`, `ElicitationResult`. Teams: `TaskCreated`, `TaskCompleted`, `TeammateIdle`. Worktrees/env: `WorktreeCreate`, `WorktreeRemove`, `CwdChanged`, `FileChanged`, `ConfigChange`. Setup: `Setup`, `InstructionsLoaded` |
+| Tracked hook events | Core: `SessionStart`, `SessionEnd`, `UserPromptSubmit`, `Notification`, `MessageDisplay`. Tool: `PreToolUse`, `PostToolUse`, `PostToolUseFailure`, `PostToolBatch`. Turn: `Stop`, `StopFailure`, `UserPromptExpansion`. Subagent: `SubagentStart`, `SubagentStop`. Compaction: `PreCompact`, `PostCompact`. Permissions: `PermissionRequest`, `PermissionDenied`. Elicitation: `Elicitation`, `ElicitationResult`. Teams: `TaskCreated`, `TaskCompleted`, `TeammateIdle`. Worktrees/env: `WorktreeCreate`, `WorktreeRemove`, `CwdChanged`, `FileChanged`, `ConfigChange`. Setup: `Setup`, `InstructionsLoaded` |
 | Tracked handler types | `command`, `prompt`, `agent`, `mcp_tool` |
 | Other capabilities | slash commands, MCP server/client, sub-agent, output style, `SKILL.md` (≥500 lines warn) |
 | Version probe | `claude --version` |
@@ -11874,7 +11925,7 @@ The canonical data lives in **`scripts/ecosystem_tools.json`** and is consumed b
 | Release notes | https://github.com/openai/codex/releases |
 | Config paths | `AGENTS.md`, `.agents/rules/*.md`, `.agents/skills/*/SKILL.md`, `.codex/hooks.json`, `~/.codex/config.toml` |
 | Our generators | `scripts/generate_codex.py`, `scripts/generate_codex_rules.py`, `scripts/generate_codex_hooks.py`, `scripts/generate_codex_skills.py` (opt-in via `--codex-skills`) |
-| Tracked hook events | `PreToolUse`, `PostToolUse`, `SessionStart`, `UserPromptSubmit`, `Stop`, `PermissionRequest` (6 events supported upstream in `config.toml`) |
+| Tracked hook events | Upstream canonical (codex-rs `HookEventName` enum): `PreToolUse`, `PostToolUse`, `PermissionRequest`, `PreCompact`, `PostCompact`, `SessionStart`, `UserPromptSubmit`, `SubagentStart`, `SubagentStop`, `Stop` (10 events). We currently wire a subset: `SessionStart`, `PreToolUse`, `PermissionRequest`, `UserPromptSubmit`, `Stop`. |
 | Tracked handler types | `command` (emitted by default); `prompt` and `agent` available upstream but authored by hand |
 | Other capabilities | `AGENTS.md`, `config.toml`, `mcp_servers`, sandbox policies, `.agents/skills/*/SKILL.md` (native Codex skill discovery path) |
 | Version probe | `codex --version` |

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.4.1",
+  "version": "4.5.0",
   "components": {
     "agents": {
       "description": "44 specialized agents (orchestrator, backend, frontend, security, devops, etc.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softspark/ai-toolkit",
-  "version": "4.4.1",
+  "version": "4.5.0",
   "description": "AI coding toolkit: 107 skills, 44 agents, 12-editor write-through (Claude, Cursor, Windsurf, Copilot, Gemini, Cline, Roo, Aider, Augment, Antigravity, Codex, opencode), machine-enforced safety constitution, SARIF audit, signed npm provenance.",
   "keywords": [
     "claude",

package/scripts/audit_skills.py

@@ -2,7 +2,8 @@
 """Skill & Agent Security Auditor.
 
 Deterministic scanner for ai-toolkit skills and agents.
-Detects dangerous code patterns, hardcoded secrets, and permission issues.
+Detects dangerous code patterns, hardcoded secrets, permission issues, and
+invisible/smuggled Unicode in shipped prompt text.
 
 Stdlib-only. JSON output to stdout. Non-zero exit on HIGH findings.
 
@@ -22,6 +23,7 @@ from __future__ import annotations
 import json
 import re
 import sys
+import unicodedata
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
@@ -149,6 +151,73 @@ def scan_secrets(filepath: Path, findings: list[Finding]) -> None:
             findings.append(Finding(severity, rel, lineno, regex, desc))
 
 
+# ---------------------------------------------------------------------------
+# Unicode safety — invisible / smuggled characters in shipped prompt text.
+# Prompt files (skills, agents, rules, personas, mcp-templates) ARE the
+# product. A poisoned PR can carry instructions a human reviewer cannot see:
+# regex-over-decoded-text checks (above) never catch them.
+# ---------------------------------------------------------------------------
+
+# ASCII smuggling: U+E0000–U+E007F mirror ASCII inside Unicode "tag" chars.
+_UNICODE_TAG_BLOCK = range(0xE0000, 0xE0080)
+
+# Trojan Source bidi controls (CVE-2021-42574) — reorder rendered text vs. its
+# logical/source order, hiding instructions from a reviewer.
+_UNICODE_BIDI_HIGH = frozenset({
+    0x202A, 0x202B, 0x202C, 0x202D, 0x202E,  # LRE RLE PDF LRO RLO
+    0x2066, 0x2067, 0x2068, 0x2069,          # LRI RLI FSI PDI
+})
+
+# Invisible / zero-width formatting that can hide or splice text.
+# U+200D (ZERO WIDTH JOINER) is deliberately EXCLUDED — it is required by
+# legitimate emoji sequences and i18n text, so flagging it floods false
+# positives and trains maintainers to disable the gate.
+_UNICODE_INVISIBLE_WARN = frozenset({
+    0x200B, 0x200C, 0x200E, 0x200F, 0x2060, 0xFEFF, 0x00AD,
+    0x180E, 0x115F, 0x1160, 0x3164, 0xFFA0, 0x17B4, 0x17B5,
+})
+
+
+def _char_name(cp: int) -> str:
+    """Best-effort Unicode name for diagnostics."""
+    try:
+        return unicodedata.name(chr(cp))
+    except ValueError:
+        return f"U+{cp:04X}"
+
+
+def scan_unicode(filepath: Path, findings: list[Finding]) -> None:
+    """Flag invisible / smuggled Unicode in shipped prompt text."""
+    try:
+        text = filepath.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return
+    rel = str(filepath)
+    for lineno, line in enumerate(text.splitlines(), 1):
+        for ch in line:
+            cp = ord(ch)
+            if cp < 0x80:  # plain ASCII — fast path, always safe
+                continue
+            if cp in _UNICODE_TAG_BLOCK:
+                findings.append(Finding(
+                    "HIGH", rel, lineno, "unicode-tag-block",
+                    f"Unicode tag char {_char_name(cp)} (U+{cp:04X}) — "
+                    "ASCII smuggling / invisible prompt injection",
+                ))
+            elif cp in _UNICODE_BIDI_HIGH:
+                findings.append(Finding(
+                    "HIGH", rel, lineno, "unicode-bidi-control",
+                    f"Bidi control {_char_name(cp)} (U+{cp:04X}) — "
+                    "Trojan Source text reordering",
+                ))
+            elif cp in _UNICODE_INVISIBLE_WARN:
+                findings.append(Finding(
+                    "WARN", rel, lineno, "unicode-invisible",
+                    f"Invisible/zero-width char {_char_name(cp)} (U+{cp:04X}) — "
+                    "verify it is intentional",
+                ))
+
+
 # Description quality — per Anthropic docs (code.claude.com/docs/en/skills.md):
 # description + when_to_use combined ≤ 1536 chars; first sentence carries
 # the trigger keywords that let the LLM route to this skill.
@@ -373,15 +442,26 @@ def audit(toolkit_root: Path) -> list[Finding]:
                 scan_file_patterns(sh, BASH_WARN, "WARN", findings)
                 scan_secrets(sh, findings)
 
-            # Secrets in any text file
+            # Secrets + invisible Unicode in any text file
             for md in skill_dir.rglob("*.md"):
                 scan_secrets(md, findings)
+                scan_unicode(md, findings)
 
     # Scan agents
     if agents.is_dir():
         for agent_md in sorted(agents.glob("*.md")):
             check_agent(agent_md, findings)
             scan_secrets(agent_md, findings)
+            scan_unicode(agent_md, findings)
+
+    # Unicode safety across the rest of the shipped prompt surface.
+    for extra in ("rules", "personas", "mcp-templates"):
+        extra_dir = app / extra
+        if not extra_dir.is_dir():
+            continue
+        for f in sorted(extra_dir.rglob("*")):
+            if f.is_file() and f.suffix in (".md", ".json"):
+                scan_unicode(f, findings)
 
     # Sort: HIGH first, then WARN, then INFO
     order = {"HIGH": 0, "WARN": 1, "INFO": 2}