# Changelog All notable changes to `ai-toolkit` are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). Versioning follows [Semantic Versioning](https://semver.org/). --- ## v4.20.0 — Apache-2.0, nine plugin packs removed (2026-07-27) ### Changed — licence: MIT to Apache-2.0 The project is now licensed under the Apache License 2.0. It stays permissive: fork it, modify it, ship it commercially. What changes is what a redistributor owes back. - **`NOTICE` is the point.** MIT already required keeping the copyright notice, so attribution is not new. What Apache-2.0 adds is §4(d): a redistributor must carry the contents of the `NOTICE` file — project name, copyright, source URL — into their distribution. That is the strongest attribution mechanism available in a permissive licence, and it is why this change was made. `NOTICE` is now in `package.json` `files`, so it ships with the npm package. - **Modified files must say so** (§4b). MIT had no equivalent. - **Express patent grant with retaliation** (§3) and **no trademark rights** (§6). Neither existed under MIT. - **Nothing is revoked.** Releases up to and including v4.20.0 were published under MIT and remain available under MIT. This applies going forward. - **Prior contributions are handled correctly.** Contributions received while the project was MIT-licensed remain their authors' copyright. MIT permits sublicensing, so they are redistributed under Apache-2.0 with the original MIT notice preserved verbatim in `NOTICE`, which is what MIT requires. `LICENSE` now holds the verbatim Apache-2.0 text, cross-verified against two independent published copies before being written. - **SPDX headers on 253 source files.** Short three-line form, placed after the shebang. Markdown is deliberately excluded: skill and agent files carry parsed frontmatter, and their descriptions cost 5,051 and 2,750 tokens of every session's context, so a header there would be billed on every conversation for a notice Apache only recommends. - **`tests/test_licensing.bats`, 7 assertions, enforced in CI**: headers present and naming Apache-2.0, no header in markdown, `LICENSE` complete, `NOTICE` carrying attribution and section 4(d), both files in `package.json` `files`, and every manifest agreeing. The release SOP gains Phase 5c running the same gate before the tag. Convention and reasoning: `kb/reference/licensing.md`. ### Removed - **Nine plugin packs that installed nothing**: `csharp-pack`, `java-pack`, `kotlin-pack`, `ruby-pack`, `rust-pack`, `swift-pack`, `frontend-pack`, `research-pack`, `security-pack`. Every one declared only skills and agents that already ship in the core install, so `plugin install` reported `(0 file items)` and put no file on disk. Measured on both runtimes and all three profiles. Eight of the nine owned nothing but a `README.md`. **Nothing is lost.** `rust-patterns`, `java-patterns`, `security-patterns`, `research-mastery` and every other asset those packs named are core skills and agents; they are still installed and still trigger exactly as before. A pack never held them. `frontend-pack` was the sole partial exception: on codex it copied core's `post-tool-use.sh` in under a pack-prefixed name. That is a generic hook with a domain label, not frontend functionality. If `post-tool-use` should run on codex it belongs in the core codex hook set, as its own change. Full measurement: `kb/history/completed/no-op-plugin-packs-removed-20260727.md`. - `kb/reference/language-packs.md`, the reference for six of the removed packs, moved to `kb/history/completed/language-packs-removed-20260727.md`. ### Changed - **`plugin-creator` now requires a pack to do something.** The authoring rule said "reference existing toolkit assets before duplicating", which against a core install that ships everything produces a no-op every time — nine packs followed it exactly. It now requires that a pack install files the core does not, and the validation checklist carries a non-zero-file-count check on every runtime the pack claims. - `kb/reference/plugin-pack-conventions.md` documents the two surviving packs by what they **own**, not by what they list. ### Kept `memory-pack` (2 hooks, 2 scripts, its own `mem-search` skill) and `enterprise-pack` (`status-line.sh`, `output-style.sh`) — the two packs that ship files of their own. --- ## v4.19.1 — re-release from corrected history (2026-07-27) No functional change. The package contents are identical to v4.19.0. v4.19.0 was committed with two commit messages attached to the wrong changes: the commit titled `chore: release v4.19.0` held only the post-release testing SOP, and the release itself shipped under a recycled message about a CodeQL action bump. `main` has been rewritten so the history states what each commit actually did, and this version is published from that corrected history. The `v4.19.0` tag is deliberately left pointing at the pre-rewrite commit `8c90024`. That commit is what the published SLSA attestation for v4.19.0 pins, so the tag keeps it fetchable even though it is no longer an ancestor of `main`. Do not delete that tag. --- ## v4.19.0 — rtk-pack retired (2026-07-27) ### Removed - **`rtk-pack`**, one day after it shipped. The first real install proved every rewritten command failed with exit 127: rtk names itself bare in the rewrite and the pack keeps its binary off `PATH` on purpose, so the shell could not find it. `git`, `ls`, `cat`, `find`, `grep`, `diff` and the rest all died before running. A second defect fetched the Intel build onto Apple Silicon, because `platform.machine()` reports `x86_64` from a Rosetta-translated Python. The pack's own `plugin status` reported both as green. All three were fixed and tested before the decision. The measured saving was 0.0615% of input tokens against a kill number of 0.05%, a margin the integration plan itself called "a pass, not a vindication", which does not justify a supply-chain surface, a five-target cross-build workflow, an upstream-sync SOP, and a hook that rewrites every command before it runs. Full postmortem: `kb/history/completed/rtk-pack-retirement-20260727.md`. - `.github/workflows/rtk-build.yml`, `scripts/verify_rtk_binary.py`, `tests/test_rtk_pack.bats`, `tests/test_verify_rtk_binary.bats`, `kb/procedures/rtk-upstream-sync-sop.md`, and the GitHub Release `softspark-rtk-v0.44.0-1` holding the five cross-built binaries. If you installed the pack under v4.18.0, run `ai-toolkit plugin remove rtk-pack`. ### Kept Everything the pack work built underneath it, none of which is rtk-specific: pack hook wiring for Cursor and Gemini, `supported_editors` in the manifest, generic `plugin status` dispatch to a pack's own `scripts/status.py`, version-aware `plugin update`, and `audit_skills.py --ci` plus the ShellCheck gate covering `app/plugins/`. --- ## v4.18.0 — rtk-pack, an opt-in command rewriter (2026-07-26) ### Added - **`rtk-pack`**, an opt-in plugin pack that rewrites Bash commands at `PreToolUse` via [rtk](https://github.com/rtk-ai/rtk) (Apache-2.0). Nothing installs it for you. `ai-toolkit plugin install rtk-pack` fetches a platform-specific binary from an ai-toolkit GitHub Release and verifies its SHA-256 before installing anything; a mismatch aborts and leaves nothing behind. Read `app/plugins/rtk-pack/README.md` before enabling it: the rewrite means what runs is not literally what the model asked for, and rtk applies your permission verdict for the original command to the rewritten one. - **`.github/workflows/rtk-build.yml`**, a manual-dispatch pipeline that cross-builds rtk from upstream source for five targets with the compile-time telemetry endpoint left undefined, proves each artifact starts, writes no telemetry state and (on Linux) behaves identically with no network route, then publishes checksummed artifacts with LICENSE and NOTICE. - **`scripts/verify_rtk_binary.py`**, the silence verifier that pipeline uses. A target it cannot start reports `inconclusive`, never `pass`. - **`kb/procedures/rtk-upstream-sync-sop.md`**, the procedure for moving to a newer upstream tag, including a re-measure gate and a published kill number. - Plugin packs can now ship `scripts/status.py` and have `plugin status` pick it up. This replaces a hardcoded `if name == "memory-pack"` branch, so any pack can report its own health. ### Changed - **`ai-toolkit update` now updates installed plugin packs.** It reads `plugins.json` and runs the equivalent of `plugin update --all` for every installed pack. `--local` leaves packs alone, since they are global. - **`plugin update` is version-aware.** `plugins.json` records the pack version installed per editor, and an update whose manifest version matches is a silent no-op. Previously every update removed and reinstalled unconditionally, which for a pack that downloads a binary meant refetching it every time. `--force` overrides; `--dry-run` reports without acting. State written before versions were tracked updates each pack exactly once. - Plugin packs are now covered by `audit_skills.py --ci` and by the ShellCheck gate in CI. Both previously scanned only `app/skills`, `app/agents` and `app/hooks`, exempting the highest-risk code in the repo. - A pack's install-time script may be named `init.py`; `init_db.py` still works. Previously only the latter ran, so a pack using any other name installed successfully while doing nothing. ### Fixed - `plugin install` no longer aborts with `IsADirectoryError` when a pack ships a subdirectory under `scripts/`. - A failing pack init script now always reports, instead of printing nothing when it exited non-zero with empty stderr. --- ## v4.17.0 — Native tool-output filter removed (2026-07-26) ### Removed - **BREAKING for anyone who opted in.** The native tool-output filter shipped in v4.16.0 is gone: the `PostToolUse` hook `filter-tool-output.sh`, the `scripts/tool_output_filter/` runtime, the `ai-toolkit output-filter` CLI, the benchmark corpus, and the `toolOutputFilter` key in `.softspark-toolkit.json`. The key is accepted and ignored rather than rejected, so an existing config still validates; `ai-toolkit config validate` reports it as a retired key you can delete. - Why: measured whole-session token saving was **0.0000%** on real traffic. Across 134 session transcripts spanning 22 projects, 7600 successful Bash results contained 145 that parsed as simple command shapes, 18 that matched a registered shape, and 0 that any filter accepted. The filter was correct; its premise was not. Agent-issued commands are overwhelmingly compound (`&&` and `;` chains, pipelines, heredocs), and the design accepted only simple registered shapes. See `kb/history/completed/output-filter-retirement-20260726.md`. ### Changed - `ai-toolkit install` and `ai-toolkit update` now remove the artifacts left by v4.16.x: the installed hook script, the global `hooks/output-filter-policy.json`, the managed project policy and owner marker under `.claude/`, and stored recovery trees under `sessions//output-filter/`. Cleanup is idempotent, verifies ai-toolkit ownership before deleting, and leaves foreign files untouched. - The stale `PostToolUse` entry is removed from `~/.claude/settings.json` by the existing hook strip-and-remerge cycle, so no manual edit is needed. - Hook counts drop from 29 entries to 28 across the same 14 events. ## v4.16.1 — Copilot skill remnant recovery (2026-07-24) ### Fixed - **Legacy Copilot skill remnants no longer abort local updates** — `.github/skills/ai-toolkit-*` directories left behind by pre-manifest cleanups (assets without `SKILL.md`) are rebuilt in place instead of raising `Refusing user-owned Copilot skill collision`, which aborted the entire `install --local` / `update` run on affected projects. User files inside a remnant that do not collide with generated output are preserved; any directory that still contains a `SKILL.md` stays protected and is never reclaimed. - **Readable installer errors** — `scripts/install.py` reports fail-closed `RuntimeError` conditions as a single `ERROR:` line instead of a raw traceback. Test count: 1477 → 1479. ## v4.16.0 — Native tool-output filtering (2026-07-24) Minor release. Adds a dependency-free, opt-in native tool-output filter for Claude Code and hardens the enterprise configuration, session-isolation, and editor-adapter surfaces around it. The filter ships disabled; `observe` and `safe` are per-project opt-ins. No source catalog count change (44 agents, 108 skills). ### BREAKING - **Unknown config keys rejected** — `.softspark-toolkit.json` and `ai-toolkit.config.json` are now validated against a closed set of top-level keys. Files carrying typos or unsupported keys that previously validated will fail `config validate` and `config check` until the key is removed. - **Constitution Article VII reserved** — reserved articles expand from I-VI to I-VII, so custom amendments must start at article 8 instead of 7. A base config that defines article 7 was valid before and now aborts validation. - **Plugin manifests require `requires`** — `plugin.json` must declare a non-empty `requires` map of non-empty string constraints. Existing manifests without the field fail schema validation. - **Lock files go stale on every toolkit version bump** — `.softspark-toolkit.lock.json` records the toolkit version and is reported stale when it differs from the running version. This is intentional integrity design: re-run `install --local` or `update --local` after upgrading to refresh the lock. ### Added - **Native tool-output filter** — added a dependency-free, opt-in Claude Code `PostToolUse` filter with `off`, `observe`, and `safe` modes. The initial version handles only allowlisted successful Bash test and validation output through deterministic `repeat-lines` and `tap-success` profiles. - **Exact ephemeral recovery** — every safe replacement is preceded by a private, bounded, session-scoped copy of the exact native response object. Opaque handles support manual recovery and cleanup without storing commands, paths, session IDs, or raw output in telemetry. - **Output-filter operations** — added inspect, status, recover, and clean entry points under `ai-toolkit output-filter`, plus a deterministic benchmark script for the built-in profiles. - **Project policy inheritance** — `toolOutputFilter` participates in schema validation, inheritance, merge, lock, local install, and managed project-policy cleanup. - **GitHub Copilot compatibility reference** — added `kb/reference/copilot-compatibility.md` documenting the Copilot integration surface, with cross-links from the Codex CLI, opencode, and global-install references. ### Fixed - **Hook safety** — `guard-path.sh` now blocks when `jq` is unavailable instead of silently skipping path validation. Codex Bash hooks apply the same path guard during `PreToolUse` and `PermissionRequest`. - **Filter eligibility** — allowlisted task names now use exact token boundaries, and recovery-backed filtering rejects unsafe or unbounded native session identifiers instead of creating mismatched cleanup paths. - **Session isolation** — edit tracking uses per-session state files, hook adapters preserve native OpenCode and Augment session identifiers, unsafe identifiers receive collision-resistant normalized names, and pre-compact snapshots prefer the payload session identifier. - **Editor adapter integrity** — OpenCode propagates guard exit code 2 as a blocked tool execution, Gemini preserves malformed settings, rejects symlinked destinations, and writes valid updates atomically, while Claude app exports omit the Claude Code-only output replacement hook. - **Statusline token trend** — the documented baseline file now drives a visible input/output token trend, including payloads without optional cost or effort fields. - **Brand-voice fact checks** — missing extracted facts now fail the quality gate, while inline-code extraction is restricted to identifier-shaped values to avoid false positives. - **Enterprise configuration** — config and lock readers reject non-object JSON and invalid UTF-8 without traceback, invalid output-filter updates preserve the last valid managed policy, and lock staleness checks cover lock format, toolkit version, source, resolved version, and content integrity. Constitution Articles I through VII remain reserved, `requiredPlugins` materializes enforceable enable intent, and plugin manifests validate non-empty dependency constraints. - **Recovery cleanup** — session end and global uninstall remove only validated ai-toolkit recovery artifacts, remain idempotent for foreign-only trees, and abort before other mutations when the recovery namespace is unsafe. - **Flaky pack-audit tests** — npm's update-notifier stderr no longer corrupts JSON parsing in the package-content tests (`npm_config_update_notifier=false` in the test environment). - **Linux-only test failures** — the jq-unavailable guard test hides `jq` via a stub `PATH` (plain `PATH=/bin` keeps `jq` visible on usrmerge systems where `/bin` is `/usr/bin`), and the foreign-recovery uninstall test now asserts the message `uninstall.py` actually prints. Both passed on macOS only because bash 3.2 does not enforce bare `[[ ]]` bats assertions. Hook entries: 28 → 29. Test count: 1377 → 1477. ## v4.15.1 — Copilot profile cleanup (2026-07-15) ### Fixed - **Copilot profile downgrade cleanup** — switching a project from `standard`, `strict`, or `full` to `minimal` now removes managed instructions, prompts, and hooks, including byte-exact pre-marker output from v3.0.0 through v4.14.1, while preserving user-owned files. - **Atomic downgrade preflight** — hook-only cleanup is validated before any Copilot file changes, so unsupported native Windows mutations fail without leaving a partial profile transition. - **Release gate enforcement** — tag publishing now regenerates package assets and runs ecosystem, validation, audit, ShellCheck, and test gates before the provenance-signed npm publish; SARIF is uploaded to GitHub code scanning. Test count: 1367 → 1377. ## v4.15.0 — Native Codex and Copilot parity (2026-07-14) Minor release. Rebuilds the Codex CLI and GitHub Copilot integrations around their current native instruction, agent, skill, hook, and MCP surfaces. It also hardens managed-file migration and multi-file configuration updates so toolkit refreshes preserve user-owned content and fail without leaving partial state. No source catalog count change (44 agents, 108 skills). ### Added - **Codex native custom agents** — `scripts/generate_codex_agents.py` materializes all 44 source agents as validated `.codex/agents/ai-toolkit-*.toml` files with native `name`, `description`, and `developer_instructions` fields. Logical-name collisions, unmanaged files, stale symlinks, and staging failures preserve user content. - **Complete Codex skill delivery** — project installs expose all 108 skills under `.agents/skills/`: 51 portable skills link to their canonical source and 57 Claude-specific skills receive self-contained, signature-free Codex adaptations with required assets retained. - **Self-contained Codex hooks** — project and user installs emit schema-validated `.codex/hooks.json` plus native runtime assets under `.codex/hooks/` or `$CODEX_HOME/ai-toolkit-hooks/`. Managed handlers merge idempotently with user hooks and keep Codex trust review explicit. - **Copilot native customization bundle** — project installs now generate all 44 native `.agent.md` agents, all 108 materialized portable skills, 62 slash-command `.prompt.md` files, and scoped instruction files under `.github/`. User installs provide instructions, agents, and skills under `$COPILOT_HOME`; prompt files remain repository-scoped. - **Copilot native lifecycle hooks** — `scripts/generate_copilot_hooks.py` writes GitHub version-1 hook configuration and a self-contained runtime with native camelCase events, event-specific decisions, destructive-command/path guards, quality gates, and a bounded stop-loop circuit breaker. - **Codex project and user MCP** — MCP templates now render validated STDIO or Streamable HTTP `[mcp_servers.*]` tables into project `.codex/config.toml` and user `$CODEX_HOME/config.toml`, while preserving unrelated TOML text and comments. ### Changed - **One shared instruction and constitution core** — Codex and Copilot `AGENTS.md` output now comes from `scripts/instruction_core.py` and the canonical `app/constitution.md`. Agent and skill catalogs are discovered from native directories instead of being duplicated into always-on instructions. - **Portable skill translation** — Codex, Copilot, and opencode adapters replace Claude-only tools, prompt placeholders, and skill-directory variables with runtime-neutral workflow intent instead of guessed client function signatures. opencode commands retain native `$ARGUMENTS` and positional argument behavior. - **Profile-aware Copilot install model** — project `minimal` installs agents and skills; `standard`, `strict`, and `full` additionally install instructions, prompts, and native hooks. User installs always provide instructions, agents, and skills, with hooks enabled from `standard` upward. `COPILOT_HOME` replaces the default user root consistently. - **Release workflow runtime** — pinned `softprops/action-gh-release` to the reviewed v3.0.2 commit for the Node 24 action runtime. ### Fixed - **Rules and constitution enforcement gaps** — current Codex and Copilot instruction files now receive the same always-on policy derived from the canonical constitution, eliminating stale or unread duplicated rule catalogs. - **Managed marker migration** — instruction injection handles nested, crossed, orphaned, empty legacy, and Unicode section markers without consuming adjacent user-authored content. - **Transactional MCP updates** — canonical `.mcp.json` and all requested native editor configs are preflighted and applied as one atomic transaction. Invalid JSON/TOML, symlinked destinations, concurrent changes, or a late replace failure leave prior files byte-identical or trigger an explicit rollback failure. - **Managed output safety** — native generators stage and validate replacements, reject symlinked roots, preserve reserved user collisions and unmanaged files, and remove only files carrying ai-toolkit ownership markers. ### Ecosystem - **Class B/F — Codex CLI**: adopted native custom-agent TOML, current skill discovery, the documented hook schema and trust model, project/user configuration layers, `$CODEX_HOME`, and project-scoped MCP from the current OpenAI documentation. - **Class B/F — GitHub Copilot**: adopted repository and user custom agents, prompt files, instruction files, portable skills, version-1 hooks, `$COPILOT_HOME`, and `.github/mcp.json` from the current GitHub documentation. ## v4.14.1 — Keep fact-checker on Sonnet (2026-07-14) Patch release. Reverts one of the two agent model reassignments from v4.14.0: `fact-checker` goes back to `model: sonnet`. Claim verification is accuracy-sensitive and Haiku's recall on subtle claims did not justify the cost saving. `explorer-agent` (pure read/search) stays on `model: haiku`. No count change (44 agents, 108 skills, 1216 tests). ### Changed - **`fact-checker` reverted to Sonnet** — `model: haiku → model: sonnet`. Quality over cost for claim verification / RAG-accuracy checks. ## v4.14.0 — Model refresh + effort-aware routing (2026-07-14) Minor release. Refreshes Claude model IDs to the current generation across the toolkit, teaches the routing skill to route on `effort` (not just model tier), and moves two pure-retrieval agents to Haiku. No skill/agent/hook count change (44 agents, 108 skills, 1216 tests). ### Changed - **Canonical model IDs bumped** — `scripts/_common.py` `DEFAULT_CLAUDE_MODELS` now resolves `opus → claude-opus-4-8` and `sonnet → claude-sonnet-5` (`haiku → claude-haiku-4-5` unchanged). This is the single source of truth generators emit. - **`model-routing-patterns` skill refreshed** — tier table updated to Haiku 4.5 / Sonnet 5 / Opus 4.8 with per-1M pricing, added a **Fable 5** row plus a "not the default best model" caveat (target for "strongest model" stays `claude-opus-4-8`), and a new **Effort routing** section (effort is the cheaper lever before swapping models — it does not invalidate the prompt cache). Fallback-chain example IDs updated. - **Stale example model IDs refreshed** — `json-mode-patterns`, `prompt-caching-patterns`, and `skill-creator` code samples now reference `claude-opus-4-8`. - **Pure-retrieval agents routed to Haiku** — `explorer-agent` (Read/Grep/Glob only) and `fact-checker` (Read only) changed from `model: sonnet` to `model: haiku`, closing the gap where the routing skill recommended Haiku workers but no agent used the tier. ## v4.13.0 — Claude app delivery + Devin sunset cleanup (2026-07-10) Minor release. Adds a validated distribution path for Claude Chat/Desktop/Cowork, fixes the core plugin contract, and removes the retired Cascade hook surface. Test count: 1208 → 1216 (seven deprecated Cascade assertions removed; six Claude app contract tests, three editor migration/propagation tests, two state-isolation/cleanup tests, two untagged-hook diagnostics, and two dry-run regressions added). ### Added - **Claude app plugin export** — `ai-toolkit claude-app export [--output FILE] [--no-custom-rules] [--verify]` creates a deterministic plugin ZIP for `Customize > Plugins` and a sibling Cowork global-instructions file. The archive bundles skills, agents, app-relative hooks, required helper scripts, core rules, and registered user rules (opt-out for shareable bundles). - **App-native rules delivery** — common and standalone rule sources are rendered into the `ai-toolkit-rules` skill because Claude Chat/Cowork does not read Claude Code's `CLAUDE.md` or `~/.claude/rules/` surfaces. - **Claude app ecosystem target** — registry/tooling now tracks 13 targets: Claude Code, Claude Chat/Cowork, and 11 editor integrations. ### Fixed - **Official plugin manifest** — changed `repository` from an invalid object to the required URL string, removed four ignored non-schema fields, and declared the generated app skill/hook component paths. `claude plugin validate` now passes on a clean staged plugin. - **Cowork hook portability** — generated plugin hooks use `${CLAUDE_PLUGIN_ROOT}` and bundle their Python helpers instead of assuming a separate `~/.softspark/ai-toolkit/hooks` install. - **Untagged hook diagnostics** — `doctor` and `config-desync-guard.sh` now recognize canonical hook behavior when Claude rewrites settings without preserving ai-toolkit's private `_source` marker, eliminating false "hooks missing" warnings. - **Update dry-run safety** — `ai-toolkit update --dry-run` and `--list` no longer invoke registered-project updates or create `projects.lock` after the read-only preview. - **Cline dry-run accuracy** — global preview now reports reuse of Cline-compatible `~/.claude/skills` instead of claiming it will create a redundant `~/.cline/skills` pointer. - **Global/local state isolation** — project-local installs and registered-project propagation no longer overwrite global `state.json` modules/profile with the last project's detected languages; project metadata remains in `projects.json`. - **Detected-language state cleanup** — explicit module installs now clear stale `auto_detected_languages` metadata instead of reporting an obsolete last-detected language in `status`. - **Registered-project editor/profile propagation** — explicit `ai-toolkit update --editors/--profile ...` overrides now reach registered projects; without an override, each project's saved editor set and profile are preserved. - **Devin skill discovery** — emit a single canonical pointer under `.windsurf/skills` instead of also writing `.devin/skills`. Both are in Devin's documented eight-path discovery list (all scanned in every repo), so one pointer keeps skills discoverable while avoiding duplicate registration. ### Removed - **Cascade hook generator** — removed `generate_windsurf_hooks.py`, `.windsurf/hooks.json` install wiring, tests, and docs after Cascade's 2026-07-01 sunset. `generate_devin_hooks.py` / `.devin/hooks.v1.json` is the sole Windsurf-family hook surface. - **Retired path migration** — local Windsurf/Devin updates strip only ai-toolkit-owned entries from legacy `.windsurf/hooks.json` and remove the managed `.devin/skills/ai-toolkit-skill-catalogue` pointer while preserving user content. ### Ecosystem - **Class B/F — Claude app plugins**: adopted the official plugin surface shared by Chat/Desktop/Cowork; skills work across Chat and Cowork while hooks/sub-agents are Cowork-only. - **Class D — Devin/Cascade**: completed the scheduled removal and refreshed current skill paths. Devin Desktop v3.4.27 and its v3.4.22 skill-permission change were reviewed; no permission field is needed for ai-toolkit's non-executing pointer skill. - **Class A — editor docs**: reviewed content-only drift for Cursor, Copilot, Gemini, Cline, Augment, and opencode; no generator contract changes were found. - **Class A — versions/docs**: refreshed Claude Code 2.1.206 and Codex CLI 0.144.1 after reviewing their official releases/current config surfaces. ## v4.12.0 — Global-first editor installs + Codex path fix (2026-07-02) Minor release. Expands global (HOME-scoped) installs to every editor with a documented, merge-safe file surface, and fixes a Codex global-install bug where instructions landed in a file Codex never reads. Test count: 1203 → 1208. ### Fixed - **Codex global instructions path** — `ai-toolkit install --editors codex` and `ai-toolkit plugin install --editor codex` wrote to `~/AGENTS.md`, which Codex never loads as global instructions, so global installs delivered zero instructions. Now write `~/.codex/AGENTS.md` (the documented `$CODEX_HOME/AGENTS.md`), strip the stale `~/AGENTS.md` toolkit section on upgrade, and warn when `~/.codex/AGENTS.override.md` would mask it. - **Codex plugin-pack rules** — pack rules were copied to `~/.agents/rules/`, a directory Codex never reads; now marker-injected into `~/.codex/AGENTS.md`, with legacy dead files cleaned on install/remove (`scripts/plugin.py`). - **`inject-hook` Codex event parity** — `CODEX_EVENTS` propagated only 5 of the 9 events `scripts/generate_codex_hooks.py` wires; added `PermissionRequest`, `SubagentStart`, `SubagentStop`, `PreCompact`. ### Added - **Global native surfaces for 7 editors** — `install_ai_tools` now threads `--profile` and installs each editor's documented HOME surfaces (gated like the local install): **Gemini** (hooks `~/.gemini/settings.json`, `~/.gemini/commands/`, skills pointer), **Augment** (`~/.augment/agents/`, `~/.augment/commands/`, hooks), **Roo/Zoo** (skills via `~/.agents/skills`), **Windsurf** (`~/.config/devin/AGENTS.md` for Devin CLI), **Cursor** (`~/.cursor/hooks.json`), **GitHub Copilot** (`~/.copilot/` instructions), **Google Antigravity** (skill pointer to `~/.gemini/config/skills` and `~/.gemini/antigravity-cli/skills`). ### Changed - **`GLOBAL_CAPABLE_EDITORS`** — added `cursor`, `copilot`, and `antigravity` (scoped: cursor = hooks, copilot = instructions, antigravity = skills; RULES stay project-local where no mergeable global file surface exists). - **`generate_copilot.py`** and **`generate_antigravity.py`** gained global layouts (`config_root=~/.copilot`; `generate_global()`). ### Ecosystem - **Roo → Zoo Code** (class D) — `RooCodeInc/Roo-Code` archived (frozen v3.54.0, dead release feed); retargeted the feed to the successor `Zoo-Code-Org/Zoo-Code` and added skills/commands config paths. (class F) Global skill install via `~/.agents/skills`. - **Cursor** (class F) global `~/.cursor/hooks.json`; (class D) `.cursorrules` demoted to legacy (dropped from official rules docs). - **GitHub Copilot** (class F) documented `~/.copilot/` user-level surface adopted. - **Google Antigravity** (class F) global skill dirs adopted; `~/.gemini/config/mcp_config.json` global MCP path resolved and recorded (adapter is backlog). - **Gemini / Augment** (class F) hooks/commands/agents made global. - Version refresh: Gemini v0.49.0, Codex 0.142.5, Auggie 0.31.0, Antigravity CLI 1.0.14, Claude Code 2.1.198; Devin `read_config_from` 7-key matrix. Snapshot re-baselined via `scripts/ecosystem_doctor.py --update`. ## v4.11.0 — Claude rules-space fix + editor registry parity (2026-06-30) Minor release. Reduces Claude Code startup context pressure by moving ai-toolkit rules out of global/project `CLAUDE.md` inline blocks and into Claude Code rule files. Also finishes the editor registry sync by recording all Gemini generators in the canonical ecosystem registry. Test count: 1198 → 1203. ### Changed - **Claude Code global rules now use `~/.claude/rules/ai-toolkit-*.md`.** `ai-toolkit install/update` writes toolkit rules from `app/rules/*.md` and registered rules from `~/.softspark/ai-toolkit/rules/*.md` into Claude Code user-level rule files, keeps `~/.claude/CLAUDE.md` as a compact index, and removes legacy inline rule markers during migration. The `ai-toolkit-*` prefix is installer-managed. - **Claude Code common rules now use `.claude/rules/ai-toolkit-*.md`.** `install --local` writes `ai-toolkit-coding-style.md`, `ai-toolkit-git-workflow.md`, `ai-toolkit-performance.md`, `ai-toolkit-security.md`, and `ai-toolkit-testing.md` under `.claude/rules/` with `paths: ["**/*"]` frontmatter, while `.claude/CLAUDE.md` stays a compact index. This follows Claude Code's current guidance to keep `CLAUDE.md` concise and move larger instruction sets into scoped rules. - **Language rules reference updated.** `kb/reference/language-rules.md` now documents the Claude-specific split: common rules as project-local Claude rules, per-language rules as knowledge skills, and other editors still receiving native rule files from their generators. - **Ecosystem registry reflects Gemini native surfaces.** `scripts/ecosystem_tools.json` now includes `generate_gemini_hooks.py`, `generate_gemini_commands.py`, and `generate_gemini_skills.py` alongside `generate_gemini.py`, matching the installer and supported-tools registry. - **Ecosystem doctor baseline refreshed.** Snapshot updated after class A/C upstream documentation drift review; no additional generator contract changes were required. ### Fixed - **Claude rules-space regression.** Global Claude installs no longer inline toolkit/registered rules into `~/.claude/CLAUDE.md`, and project-local Claude installs no longer inflate `.claude/CLAUDE.md` with the full common-rule corpus. Regression tests now assert compact CLAUDE.md indexes, generated rule files, legacy marker cleanup, and managed `.claude/rules/ai-toolkit-*.md` refresh behavior. ## v4.10.1 — Copilot AGENTS.md install + Claude KB-first rule (2026-06-23) Patch release. Fixes two governance regressions found in the editor-update audit: Copilot installs now emit the root `AGENTS.md` surface documented in the registry, and Claude Code receives the KB-first rule in `CLAUDE.md`, which it actually reads. Test count: 1195 → 1198. ### Fixed - **GitHub Copilot local install now emits root `AGENTS.md`.** `ai-toolkit install --local --editors copilot` writes the generated agent catalog into a `TOOLKIT:copilot-agents` section without clobbering existing Codex/opencode `TOOLKIT:ai-toolkit` sections or user-authored content. Dry-run output and tests now cover the `.github/copilot-instructions.md + AGENTS.md` contract. - **Claude Code KB-first rule restored in the right instruction file.** `CLAUDE.md` now explicitly requires `smart_query()` or `hybrid_search_kb()` before technical/project answers; the prior generated `AGENTS.md` placement was not sufficient for Claude Code runtime enforcement. - **Codex PostToolUse no longer emits unsupported `suppressOutput`.** `loop-guard.sh` no longer forces `AI_TOOLKIT_HOOK_FORMAT=json`; under Codex it stays quiet/plain unless the generator explicitly opts into a supported JSON schema. - **Npm package excludes local Claude session artifacts.** `package.json` now excludes `app/**/.claude/**` so ignored maintainer-local session files cannot leak into `npm pack`. ### Changed - **Editor registry/docs aligned with implementation.** README, architecture overview, and the supported-tools registry now describe Copilot's root `AGENTS.md` emission consistently. - **Ecosystem doctor baseline refreshed.** Snapshot updated for upstream Claude Code and Gemini CLI documentation content hash drift; no generator changes were required. ## v4.10.0 — Per-repo session storage outside the repo + drop dead session-context hook (2026-06-17) Minor release. Session lifecycle hooks stop writing auto-generated files into each project's `.claude/` directory and store them per-repo under `~/.softspark/ai-toolkit/`. The dead `session-context.sh` hook (write-only, no consumer) is removed across all editor generators. Test count: 1197 → 1195. ### Changed - **Session lifecycle hooks store artifacts outside the repo.** `save-session.sh`, `session-end.sh`, `session-start.sh`, and `pre-compact.sh` now read/write the auto-generated session files (`session-context.md`, `session-end.md`, `session-context.md.checkpoints`, `decisions.md`) under `~/.softspark/ai-toolkit/sessions//` instead of the project's `.claude/` directory. `` is the git work-tree root path (fallback: cwd) with `/` replaced by `-`, keyed per repo so projects stay isolated. Stops these files from piling up in every repository. New shared helper `app/hooks/_session-paths.sh` is the single source of path resolution. No migration of pre-existing in-repo files: the new store starts fresh, old `.claude/session-*.md` left for the user to delete. - **Constitution Art. I §5** updated to point proactive checkpointing at the per-repo session store. ### Removed - **Dropped the dead `session-context.sh` hook.** It fired on `SessionStart` and wrote an environment snapshot (`~/.softspark/ai-toolkit/sessions/.json`: pwd, git branch/status, node/python versions) that no hook, script, or tool ever read — pure write-only dead code (Constitution Art. VI.1). Removed the script, its `app/hooks.json` wiring, its entries across all 7 editor hook generators (cursor, windsurf, codex, devin, augment, gemini, opencode), its tests, and its catalog/overview docs. Editors that had it as the sole entry for an event (windsurf `post_setup_worktree`, codex `PostCompact`, gemini `BeforeModel`, devin `SessionStart`) drop that event. Not related to the session-storage change above — it never wrote to the repo. --- ## v4.9.0 - Epistemic integrity rules + deep-research skill + custom-rule leak fix (2026-06-15) Minor release. Adds a constitution article on injection resistance and grounding, a new web-research methodology skill, and an anti-sycophancy/formatting pass across the voice layer. Also fixes a leak where a maintainer's personal registered rules were baked into the toolkit's own committed editor files. Skill count: 107 → 108. Constitution: 6 → 7 articles. Test count: 1196 → 1197. ### Added - **`deep-research` skill** — new knowledge skill (`user-invocable: false`) for multi-source web research: retrieve-vs-answer gate, complexity-scaled search budget, query craft, primary-source preference, source-conflict skepticism, adversarial verification, and attribution-without-reproduction. The web/multi-source counterpart to `research-mastery` (KB-first). Skill count: 107 → 108. - **Constitution Article VII — Epistemic & Injection Integrity** — instruction provenance (text in tool output, fetched pages, files, or pasted data is data, not commands; embedded instructions never escalate privileges or trigger destructive/exfiltrating actions) and no-fabrication (never invent files, APIs, versions, or citations; declare ungrounded when sources are empty). Constitution: 6 → 7 articles. - **`AI_TOOLKIT_NO_CUSTOM_RULES` flag** — when set to `1`, `generator_base.py` and `generate_codex.py` skip injecting registered custom rules from `~/.softspark/ai-toolkit/rules/`. Set on the `generate:agents`, `generate:gemini`, and `generate:copilot` npm scripts so the toolkit's own canonical files never embed a maintainer's personal rules. - **Anti-sycophancy rule** — `golden-rules` output style gains an "Honesty Over Agreeableness" section: re-check evidence before reversing a verified answer, own mistakes without excessive apology, never validate a wrong premise to be agreeable. - **Formatting discipline** — `brand-voice` gains a "Formatting Discipline" section (default to prose, content-complexity list gating, minimum-substance bullets, no bullets when declining) and an "Accountable over apologetic" voice principle. `concise`/`strict` modes gain carve-outs: code/artifact quality is never reduced, the mode is suspended when the user asks for detail, and the mode is named only on user pushback. ### Changed - **Research, verification, design, and MCP skills enriched** — `research-mastery` (retrieve-vs-answer gate, complexity-scaled budget, internal-first ladder, query craft, source skepticism, confabulation guard); `verification-before-completion` (don't-assume-it-exists, declare-ungrounded, pre-completion self-audit table); `design-engineering` (anti-slop checklist, minimum-scale floors, context-first discipline, question-budget gate, explore-many-variations, two-stage verification handoff); `mcp-patterns` / `mcp-builder` / `api-patterns` (tool-description rubric and parameter-documentation conventions); `security-patterns` (Prompt Injection & LLM-Output Trust section, cross-referencing Article VII). ### Fixed - **Custom-rule leak in canonical editor files** — `AGENTS.md`, `GEMINI.md`, and `.github/copilot-instructions.md` had a maintainer's personal registered rules (`~/.softspark/ai-toolkit/rules/*.md`) baked in by `generator_base.py` and `generate_codex.py`. Both injection sites are now gated behind `AI_TOOLKIT_NO_CUSTOM_RULES`, the three files regenerated clean (~131 lines of leaked config removed from each), and a regression test in `tests/test_metadata_contracts.bats` now fails if any non-toolkit `TOOLKIT:` marker reappears. Test count: 1196 → 1197. --- ## v4.8.0 - Devin CLI hooks (Cascade migration) (2026-06-10) Minor release. Migrates the deprecated Windsurf Cascade hooks onto the Devin CLI surface ahead of the 2026-07-01 Cascade sunset. Class D/F ecosystem change per `kb/procedures/ecosystem-sync-sop.md`. No skill/agent count change; no new broad-access skills. ### Added - **Devin CLI hooks** — new `scripts/generate_devin_hooks.py` emits `.devin/hooks.v1.json` in the Claude-compatible hook format Devin CLI uses (docs.devin.ai/cli/extensibility/hooks). Wired into `ai-toolkit install --local --editors windsurf --profile full` alongside the existing (now deprecated) Cascade generator. Events are Claude-style (`PreToolUse`/`PostToolUse`/`UserPromptSubmit`/`Stop`/`SessionStart`) with matchers on Devin tool names (`read`/`edit`/`exec`/`mcp__*`); blocking uses the flat `{"decision":"block","reason":...}` shape + exit 2 (no `AI_TOOLKIT_HOOK_FORMAT=json`). Reuses the existing `~/.softspark/ai-toolkit/hooks/*.sh` scripts; `_hook-io.sh` already parses Devin's flat `hook_event_name`/`tool_name`/`tool_input` payload, so no normalizer change was needed. Test count: 1186 → 1196. ### Changed - **Cascade hooks deprecation** — `scripts/generate_windsurf_hooks.py` (`.windsurf/hooks.json`) is marked deprecated: the Cascade agent and its hook surface stop working 2026-07-01, and Devin Local / Devin CLI do not read `.windsurf/hooks.json` as a fallback. Both generators run during the transition; `generate_windsurf_hooks.py` will be dropped in the first release after the sunset. - **Global hooks reach Devin for free** — documented that Devin CLI reads `~/.claude/settings.json` + `.claude/settings.json` hooks directly (`read_config_from.claude` default on), so a global `ai-toolkit install` already covers Devin even without the project-local file. - Registry: `.devin/hooks.v1.json` + `generate_devin_hooks.py` added to the windsurf entry in `scripts/ecosystem_tools.json` and `kb/reference/supported-tools-registry.md`; new "Per-Editor Native Hooks" section in `kb/reference/hooks-catalog.md`. `validate.py` maps the `devin` hook-generator stem back to the windsurf README platform key. --- ## v4.7.0 - Devin Desktop .devin tree + Antigravity CLI surfaces (2026-06-10) Minor release. Ecosystem sync per `kb/procedures/ecosystem-sync-sop.md` (window 2026-06-05 → 2026-06-10, doctor run + per-tool docs review with adversarial verification). No skill/agent count change; no new broad-access skills. ### Ecosystem (class B/D/F drift) - **Windsurf/Devin Desktop: `.devin/` dual-emit** — `generate_windsurf_rules.py` and `generate_windsurf_skills.py` now write rules, workflows, and the skill pointer to `.devin/{rules,workflows,skills}/` (primary tree since the 2026-06-02 rebrand) alongside legacy `.windsurf/` (still read as fallback). `.devin/rules` added to editor auto-detection. Test count: 1179 → 1186. - **Antigravity: CLI skill pointer** — `generate_antigravity.py` dual-emits the skill pointer to `.agent/skills/` (IDE) and `.agents/skills/` (CLI, plural). Editor auto-detection no longer misreads a pointer-only `.agents/skills/` as a Codex install. - **Registry coverage** — added verified config surfaces to `scripts/ecosystem_tools.json`: Claude Code project `.claude/settings.json` + `.claude/rules/*.md` + `http` hook handler; Cursor subagent fallback dirs; Devin Local config files; Gemini CLI hook events (`BeforeToolSelection`, `AfterModel`, `Notification`, `PreCompress`) + `~/.agents/skills` alias; Cline CLI/SDK unified `.cline/` layout, `AGENTS.md` rules sources, and plugins; Augment workspace settings + `Notification` event; Codex project-layer `.codex/config.toml`; opencode skill discovery aliases; Antigravity CLI `.agents/{skills,hooks.json,mcp_config.json}`. ### Changed - **Cascade deprecation note** — `.windsurf/hooks.json` (Cascade-scoped) marked deprecated: Cascade is available only through 2026-07-01; migration target is the Devin CLI lifecycle-hooks surface (tracked in registry status_note). - **Cursor registry fix** — removed phantom `.cursor/rules/*.md` path (plain `.md` files are ignored by Cursor's rules system); fixed the stale claim in `generate_cursor_mdc.py` docstring. - **Augment registry fix** — `.augment/guidelines.md` replaced with documented `.augment-guidelines` + `~/.augment/user-guidelines.md`; `our_generators` synced to all 6 augment generators. - **Maintenance SOP** — added `claude --safe-mode` (v2.1.169) isolation step to the rule-enforcement troubleshooting flow. - Doctor snapshot refreshed (Claude Code 2.1.170, Codex CLI 0.138.0); class-C items recorded as not adopted (`fallbackModel`, Copilot `excludeAgent`); opencode v1.16.0 experimental v2 skill registry tracked as a watch item. --- ## v4.6.0 - Editor ecosystem sync + Codex rules in AGENTS.md (2026-06-05) Minor release. Syncs the editor registry with current upstream reality (Windsurf→Devin rebrand, Roo Code archive, Gemini CLI sunset, moved docs hosts) and fixes several generators that wrote to paths their editors never read. Headline: Codex now actually receives the universal coding rules. ### Added - **Codex CLI: all 10 native hook events** — wired the 5 previously-missing events (`PostToolUse`, `PreCompact`, `PostCompact`, `SubagentStart`, `SubagentStop`) to the shared toolkit hook scripts, mirroring `app/hooks.json`. Was 5 of 10. ### Changed - **Codex CLI: coding rules now in `AGENTS.md`** — the universal code-style/testing/security/output-mode rule bodies are inlined into `AGENTS.md`, the only instruction path Codex reads. They were previously emitted to `.agents/rules/`, which Codex never reads (confirmed against `developers.openai.com/codex`). Language rules continue via `.agents/skills/`. - **Google Antigravity: plural `.agents/`** — generators now emit `.agents/rules/` and `.agents/workflows/` (the Antigravity 2.0 default); singular `.agent/` is still read by Antigravity as a fallback. - **Conditional skill pointers** — Cursor/Cline/Augment skip the `ai-toolkit-skill-catalogue` pointer when real skills are discoverable at `.claude/skills/` (project or `~/.claude/skills/`), emitting it only as the editor-only fallback. Windsurf keeps its pointer unconditionally (its `.claude/skills` scan is gated behind a Devin "Claude Code config reading" setting). - **Cursor subagents** — emit `model: inherit`; dropped the undocumented `tools`/`color` fields to match the current Cursor schema. - **Augment subagents** — omit the `model` field (Augment uses the CLI default model; `inherit` is not a documented value). - **Ecosystem registry sync** — Windsurf → Devin Desktop (docs/changelog redirects); Roo Code repo archived + docs moved to `roocodeinc.github.io`; Claude Code docs host `code.claude.com`; Codex docs `developers.openai.com/codex`; Gemini CLI free/paid tier sunset 2026-06-18 (enterprise continues); Cline config-path corrections; stale Gemini `Stop` marker dropped. ### Fixed - **opencode commands were empty** — the prompt now lives in the markdown body. Commands previously put it in a `template:` frontmatter block (JSON-config-only) with an empty body, so every generated opencode command was effectively blank. - **Cline global rules** — now written to `~/Documents/Cline/Rules/` (the documented Cline global path) instead of the never-read `~/.cline/rules/`. - **Augment commands** — dropped the undocumented `agent:` frontmatter field; fixed a false `generate_augment_hooks.py` docstring claim about per-workspace settings. ### Removed - **`scripts/generate_codex_rules.py`** and the `ai-toolkit codex-rules` / `npm run generate:codex-rules` subcommands — Codex never read the `.agents/rules/` output. Coding rules now ship via `AGENTS.md` (universal) and `.agents/skills/` (language). Installs need no migration; if you scripted `ai-toolkit codex-rules`, the rules are now produced by `ai-toolkit codex-md`. Test count: 1181 → 1179 (dead-path tests removed). ### Ecosystem - Class B (integrate): Codex 10 hook events. Class E (now-default): Antigravity plural `.agents/`, conditional skill pointers. Class D (deprecation): Windsurf→Devin, Roo Code archive, Gemini CLI tier sunset. Plus registry URL/version/config-path corrections across 9 tools. --- ## v4.5.1 - ShellCheck fix for loop-guard hook (2026-06-02) Patch release. Clears two ShellCheck `SC2034` warnings in `loop-guard.sh` that turned the `main` CI ShellCheck job red after v4.5.0. The publish workflow does not run ShellCheck, so v4.5.0 published despite the red CI; this patch makes `main` green again. No runtime behavior change. ### Fixed - **`loop-guard.sh` ShellCheck** — `INPUT` now carries the `# shellcheck disable=SC2034` directive (it is consumed via the sourced `_hook-io.sh`, matching `guard-destructive.sh`), and `AI_TOOLKIT_HOOK_FORMAT` is `export`ed. `shellcheck --severity=warning app/hooks/*.sh` is clean. --- ## v4.5.0 - Unicode-safety scanner, loop guard, honest instincts (2026-06-02) Minor release. Hardens the security audit against invisible prompt injection, adds a repeated-action loop guard, fixes destructive-guard false positives, and turns the instinct system from a dormant promise into a working manual feature. ### Added - **Unicode-safety scanner** — `scripts/audit_skills.py` now flags invisible/smuggled Unicode across shipped prompt text (skills, agents, rules, personas, mcp-templates): tag-block ASCII smuggling (`U+E0000–E007F`) and Trojan Source bidi controls as HIGH, zero-width/invisible format chars as WARN. Emoji ZWJ (`U+200D`) is allowlisted. Runs inside the existing `--ci` gate. - **`loop-guard.sh`** — advisory `PostToolUse` hook (`Bash|Edit|MultiEdit|Write`) that warns when the same action repeats within a short window, catching successful-but-identical loops the `/repeat` circuit breaker (failures-only) misses. Edits track content, so iterative editing of one file does not trip it. Tunable via `AI_TOOLKIT_LOOP_WINDOW`/`AI_TOOLKIT_LOOP_THRESHOLD`. Hook entries: 28 → 29. - **Per-hook opt-out** — `AI_TOOLKIT_DISABLED_HOOKS` (comma list) disables named profile-gated hooks via `_profile-check.sh`. Safety guards are intentionally excluded — remove them with `ai-toolkit remove-hook`. - **Editor hooks honesty** — the README platform matrix gained a **Hooks** column marking which editors get lifecycle hook enforcement; `validate.py` cross-checks the claim against the actual `generate_*_hooks.py` generators and fails on drift. - **`doctor` language-rules drift check** — warns when a local-install project gained a language (e.g. a new `Cargo.toml`) whose `-rules` were never injected. - **Live-app rubric verification** — `verification-before-completion` documents an optional weighted-rubric scoring pass for behavioral/visual work. ### Changed - **Instincts load by default** — `session-start.sh` loads `.claude/instincts/*.md` whenever present (previously gated behind `AI_TOOLKIT_HOOK_VERBOSE=1`, so they never surfaced by default). `AI_TOOLKIT_HOOK_QUIET=1` suppresses; no instincts on disk means no output. - **memory-pack `strip_private.py`** — now redacts high-confidence secrets (API keys, tokens, private keys) to `[REDACTED: