@rhize/skill-forge 0.17.0 → 0.17.1

package/README.md

@@ -2,7 +2,7 @@
 
 **The supply-chain gate for agent skills.**
 
-Status: published — `@rhize/skill-forge@0.17.0` on npm (released 2026-09-04),
+Status: published — `@rhize/skill-forge@0.17.1` on npm (released 2026-09-05),
 0.x beta (Pro features free until 1.0)
 
 > This project is unrelated to the [`skillforge`](https://www.npmjs.com/package/skillforge)

package/dist/cli.js

@@ -1193,12 +1193,20 @@ function refineRmRf(line, _ctx) {
 }
 var DOC_CUE_RE = /\b(never|not|don't|do not|must not|reject|refuse|attack|dangerous|unsafe|avoid|warning)\b/i;
 var DOC_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".mdx", ".markdown"]);
-var NO_FENCES = [];
+var INSTALL_CUE_RE = /\b(install|run|paste|set ?up)\b/gi;
+var NEGATION_BEFORE_CUE_RE = /\b(never|not|don't|avoid|shouldn't|mustn't)(\s+\w+)?\s*$/i;
+function hasUnnegatedInstallCue(line) {
+  for (const m of line.matchAll(INSTALL_CUE_RE)) {
+    if (!NEGATION_BEFORE_CUE_RE.test(line.slice(0, m.index))) return true;
+  }
+  return false;
+}
 function refineCurlPipeShell(line, ctx) {
   const base = { severity: "CRITICAL", message: "downloads a remote script and pipes it directly into a shell" };
   if (ctx.inFence) return base;
   if (!DOC_EXTENSIONS.has(extname2(ctx.file).toLowerCase())) return base;
   if (!DOC_CUE_RE.test(line)) return base;
+  if (hasUnnegatedInstallCue(line)) return base;
   return { ...base, classification: "documentation-example" };
 }
 function computeFenceFlags(lines) {
@@ -1296,11 +1304,11 @@ function scanStaticRules(targetPath) {
     const content = readTextFile(file);
     if (content === void 0) continue;
     const lines = content.split("\n");
-    const fenceFlags = DOC_EXTENSIONS.has(extname2(file).toLowerCase()) ? computeFenceFlags(lines) : NO_FENCES;
+    const fenceFlags = DOC_EXTENSIONS.has(extname2(file).toLowerCase()) ? computeFenceFlags(lines) : void 0;
     for (const rule of DENY_RULES) {
       for (let i = 0; i < lines.length; i++) {
         if (rule.pattern.test(lines[i])) {
-          const refined = rule.refine ? rule.refine(lines[i], { inFence: fenceFlags[i], file }) : { severity: rule.severity, message: rule.message };
+          const refined = rule.refine ? rule.refine(lines[i], { inFence: fenceFlags?.[i] ?? false, file }) : { severity: rule.severity, message: rule.message };
           if (!refined) continue;
           findings.push({
             severity: refined.severity,
@@ -2304,15 +2312,7 @@ function toClusterMembers(members) {
 function annotateSiblingClusters(clusters, nameByPath) {
   return clusters.map((cluster) => {
     const names = cluster.members.map((p) => nameByPath.get(p) ?? basename6(p));
-    let allSiblings = true;
-    outer: for (let i = 0; i < names.length && allSiblings; i++) {
-      for (let j = i + 1; j < names.length; j++) {
-        if (!isStackSiblingPair(names[i], names[j])) {
-          allSiblings = false;
-          break outer;
-        }
-      }
-    }
+    const allSiblings = names.every((a, i) => names.slice(i + 1).every((b) => isStackSiblingPair(a, b)));
     return allSiblings ? { ...cluster, siblingVariants: true, suggestedVerb: "DEFER" } : cluster;
   });
 }
@@ -2351,7 +2351,7 @@ function collapseIdenticalContent(skills, configuredRootOrder) {
       const ai = configuredRootOrder.indexOf(a.root);
       const bi = configuredRootOrder.indexOf(b.root);
       if (ai !== bi) return ai - bi;
-      return a.path.localeCompare(b.path);
+      return comparePaths(a.path, b.path);
     });
     const canonical = sorted[0];
     for (const duplicate of sorted.slice(1)) {
@@ -2362,23 +2362,41 @@ function collapseIdenticalContent(skills, configuredRootOrder) {
   }
   return { skills: skills.filter((s) => !toRemove.has(s)), collapsedCount };
 }
-function matchUsage(skill, usage, notices) {
+function comparePaths(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function buildUsageJoinIndex(usage, skills) {
+  const bareKeys = /* @__PURE__ */ new Map();
+  for (const key of usage.keys()) {
+    const bare = key.includes(":") ? key.slice(key.lastIndexOf(":") + 1) : key;
+    bareKeys.set(bare, [...bareKeys.get(bare) ?? [], key]);
+  }
+  const inventoryNameCounts = /* @__PURE__ */ new Map();
+  for (const skill of skills) inventoryNameCounts.set(skill.name, (inventoryNameCounts.get(skill.name) ?? 0) + 1);
+  return { bareKeys, inventoryNameCounts, noticed: /* @__PURE__ */ new Set() };
+}
+function matchUsage(skill, usage, index, notices) {
   if (usage.has(skill.name)) return usage.get(skill.name);
   if (skill.pluginId) {
     const composite = `${skill.pluginId.split("@")[0]}:${skill.name}`;
     if (usage.has(composite)) return usage.get(composite);
   }
-  const bareMatches = [...usage.keys()].filter((k) => (k.includes(":") ? k.slice(k.lastIndexOf(":") + 1) : k) === skill.name);
-  if (bareMatches.length === 1) return usage.get(bareMatches[0]);
-  if (bareMatches.length > 1) {
-    notices.push(`usage snapshot: ambiguous bare name "${skill.name}" matches ${bareMatches.length} entries \u2014 skipping attribution`);
+  const bareMatches = index.bareKeys.get(skill.name) ?? [];
+  if (bareMatches.length === 0) return void 0;
+  const installedWithName = index.inventoryNameCounts.get(skill.name) ?? 0;
+  if (bareMatches.length === 1 && installedWithName === 1) return usage.get(bareMatches[0]);
+  if (!index.noticed.has(skill.name)) {
+    index.noticed.add(skill.name);
+    notices.push(
+      bareMatches.length > 1 ? `usage snapshot: ambiguous bare name "${skill.name}" matches ${bareMatches.length} entries \u2014 skipping attribution` : `usage snapshot: bare name "${skill.name}" matches ${installedWithName} installed skills \u2014 skipping attribution`
+    );
   }
   return void 0;
 }
 function isUnderInstallPath(target, installPath) {
   return target === installPath || target.startsWith(installPath + sep2);
 }
-function computePluginSummaries(pluginRoots, activeFindings, skills, usage) {
+function computePluginSummaries(pluginRoots, activeFindings, skills, usage, usageJoined) {
   return pluginRoots.map((pr) => {
     const findingCounts = { LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0 };
     for (const f of activeFindings) {
@@ -2391,9 +2409,10 @@ function computePluginSummaries(pluginRoots, activeFindings, skills, usage) {
     const observedSkillCount = hasUsage ? skills.filter((s) => s.pluginId === pr.pluginId && (s.usage ?? 0) > 0).length : void 0;
     let recommendation;
     const reasons = [];
+    const longWindow = windowDays !== void 0 && windowDays >= 28;
     if (findingCounts.HIGH > 0 || findingCounts.CRITICAL > 0) {
       recommendation = "review";
-    } else if (exhaustive && windowDays !== void 0 && windowDays >= 28 && skillCount > 0 && observedSkillCount === 0) {
+    } else if (exhaustive && longWindow && skillCount > 0 && observedSkillCount === 0 && (usageJoined ?? 0) > 0) {
       recommendation = "unobserved";
     } else if (exhaustive && (observedSkillCount ?? 0) >= 1) {
       recommendation = "keep";
@@ -2401,9 +2420,10 @@ function computePluginSummaries(pluginRoots, activeFindings, skills, usage) {
       recommendation = "unknown";
       if (skillCount === 0) reasons.push("no skills to observe");
       if (!hasUsage) reasons.push("no usage telemetry");
+      else if (usage.usage.size === 0) reasons.push("usage snapshot is empty or unreadable (see notices)");
       else if (!exhaustive) reasons.push("usage snapshot is not exhaustive (top-50 only)");
-      else if (windowDays === void 0 || windowDays < 28) reasons.push(`window ${windowDays ?? "unknown"} < 28 days`);
-      if (reasons.length === 0) reasons.push("no usage telemetry");
+      else if (!longWindow) reasons.push(`window ${windowDays ?? "unknown"} < 28 days`);
+      else if ((usageJoined ?? 0) === 0) reasons.push("usage snapshot joined 0 installed skills");
     }
     return {
       pluginId: pr.pluginId,
@@ -2413,9 +2433,9 @@ function computePluginSummaries(pluginRoots, activeFindings, skills, usage) {
       findingCounts,
       observedSkillCount,
       recommendation,
-      reasons: [...new Set(reasons)].sort()
+      reasons: reasons.sort()
     };
-  }).sort((a, b) => a.pluginId.localeCompare(b.pluginId));
+  }).sort((a, b) => comparePaths(a.pluginId, b.pluginId));
 }
 function defaultWhich(cmd) {
   const pathEnv = process.env.PATH ?? "";
@@ -2624,8 +2644,9 @@ async function auditConfiguredSet(config, options = {}) {
   };
   const usage = options.usage;
   if (usage) {
+    const index = buildUsageJoinIndex(usage.usage, skills);
     for (const skill of skills) {
-      const matched = matchUsage(skill, usage.usage, notices);
+      const matched = matchUsage(skill, usage.usage, index, notices);
       if (matched !== void 0) skill.usage = matched;
     }
   }
@@ -2633,7 +2654,7 @@ async function auditConfiguredSet(config, options = {}) {
   if (usage && usageJoined === 0) {
     notices.push(`usage snapshot (${usage.sourcePath}) joined 0 of ${skills.length} skill(s)`);
   }
-  const unobservedInWindow = usage && usage.exhaustive ? skills.filter((s) => (s.usage ?? 0) === 0).map((s) => ({ name: s.name, path: s.path, pluginId: s.pluginId })) : [];
+  const unobservedInWindow = usage && usage.exhaustive && usage.windowDays !== void 0 && usage.windowDays >= 28 && (usageJoined ?? 0) > 0 ? skills.filter((s) => (s.usage ?? 0) === 0).map((s) => ({ name: s.name, path: s.path, pluginId: s.pluginId })) : [];
   const findingCounts = { LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0 };
   for (const f of activeFindings) findingCounts[f.severity]++;
   const summary = {
@@ -2648,7 +2669,7 @@ async function auditConfiguredSet(config, options = {}) {
     documentationExampleCount: activeFindings.filter((f) => f.classification === "documentation-example").length,
     ...usage ? { usageJoined, usageExhaustive: usage.exhaustive, usageWindowDays: usage.windowDays } : {}
   };
-  const plugins = options.pluginRoots ? computePluginSummaries(pluginRoots, activeFindings, skills, usage) : void 0;
+  const plugins = options.pluginRoots ? computePluginSummaries(pluginRoots, activeFindings, skills, usage, usageJoined) : void 0;
   const tooling = checkTooling(options.which ?? defaultWhich, options.env ?? process.env);
   return {
     schemaVersion: 1,
@@ -2731,7 +2752,7 @@ function renderFindingsSection(findings) {
   const docExamples = findings.filter((f) => f.classification === "documentation-example");
   const lines = ["## Hygiene findings", "", ...bulletList(live.map(renderFindingLine), "(none \u2014 clean)")];
   if (docExamples.length > 0) {
-    lines.push("", "### Probable documentation examples (still CRITICAL \u2014 review)", "", ...bulletList(docExamples.map(renderFindingLine), ""));
+    lines.push("", "### Heuristically classified as documentation examples (still CRITICAL \u2014 review each; the heuristic can be gamed)", "", ...bulletList(docExamples.map(renderFindingLine), ""));
   }
   return lines;
 }
@@ -2778,7 +2799,9 @@ function renderUsageSection(report) {
   const lines = ["## Usage", ""];
   lines.push(`- Matched: ${summary.usageJoined ?? 0} of ${summary.skillCount} skill(s)`);
   lines.push(`- Window: ${summary.usageWindowDays !== void 0 ? `${summary.usageWindowDays} day(s)` : "unknown"}`);
-  if (summary.usageExhaustive) {
+  if ((summary.usageJoined ?? 0) === 0) {
+    lines.push("- Coverage: nothing joined (see Notices)");
+  } else if (summary.usageExhaustive) {
     lines.push("- Coverage: exhaustive (every skill counted this window)");
   } else {
     lines.push("- Coverage: top-50 only; absence is not zero usage");
@@ -2788,6 +2811,8 @@ function renderUsageSection(report) {
     for (const s of report.opportunities.unobservedInWindow) {
       lines.push(`- ${sanitizeForMarkdown(s.name)} \u2014 ${s.path}${s.pluginId ? ` (plugin ${sanitizeForMarkdown(s.pluginId)})` : ""}`);
     }
+  } else if (summary.usageExhaustive && (summary.usageJoined ?? 0) > 0 && (summary.usageWindowDays ?? 0) < 28) {
+    lines.push("- Unobserved list: suppressed \u2014 window shorter than 28 days proves nothing about monthly-use skills");
   }
   return lines;
 }
@@ -2843,6 +2868,7 @@ function renderAuditMarkdown(report) {
     `- Overlap clusters: ${summary.overlapClusterCount}`,
     `- Evolve-eligible skills: ${summary.evolveEligibleCount}`,
     `- Collapsed duplicates: ${summary.collapsedDuplicateCount}`,
+    `- Documentation-example classified (heuristic; counted above as CRITICAL): ${summary.documentationExampleCount}`,
     "",
     "## Inventory",
     "",
@@ -2973,7 +2999,9 @@ function summarizeAudit(report, reportPath) {
   for (const skill of report.inventory.skills) {
     rootOfSkillPath.set(skill.path, skill.root);
   }
+  const pluginRootPaths = new Set(report.inventory.skillRoots.filter((r) => r.origin === "plugin").map((r) => r.root));
   const byRoot = {};
+  const pluginCounts = emptyCounts();
   for (const finding2 of report.hygiene) {
     let root;
     for (let dir = finding2.target; ; dir = dirname5(dir)) {
@@ -2981,19 +3009,24 @@ function summarizeAudit(report, reportPath) {
       if (root || dirname5(dir) === dir) break;
     }
     if (!root) continue;
+    if (pluginRootPaths.has(root)) {
+      bump(pluginCounts, finding2.severity);
+      continue;
+    }
     byRoot[root] ??= emptyCounts();
     bump(byRoot[root], finding2.severity);
   }
+  const findings = emptyCounts();
+  for (const severity of Object.keys(findings)) {
+    findings[severity] = report.summary.findingCounts[severity] - pluginCounts[severity];
+  }
   return {
     schemaVersion: 1,
     lastRunAt: report.generatedAt,
     reportPath,
     skillCount: report.summary.skillCount,
     mcpTargetCount: report.summary.mcpTargetCount,
-    // Taken from the report rather than re-accumulated: `audit.ts` already counted exactly this
-    // array, and a second tally is how the terminal summary and the markdown report end up
-    // disagreeing about the same run.
-    findings: { ...report.summary.findingCounts },
+    findings,
     byRoot,
     overlapClusters: report.opportunities.overlapClusters.map((c) => ({
       // Cluster members are SKILL.md paths; the skill name is the parent directory name. Stripped
@@ -4696,16 +4729,17 @@ function extractEnabledMap(data) {
   return out;
 }
 function extractRegistry(data) {
-  if (typeof data !== "object" || data === null) return {};
+  const empty = { entries: {}, malformed: {} };
+  if (typeof data !== "object" || data === null) return empty;
   const pluginsRaw = data.plugins;
-  if (typeof pluginsRaw !== "object" || pluginsRaw === null) return {};
+  if (typeof pluginsRaw !== "object" || pluginsRaw === null) return empty;
   const out = {};
+  const malformed = {};
   for (const [id, entriesRaw] of Object.entries(pluginsRaw)) {
     if (!Array.isArray(entriesRaw)) continue;
     const entries = [];
     for (const raw of entriesRaw) {
-      if (typeof raw !== "object" || raw === null) continue;
-      const rec = raw;
+      const rec = typeof raw === "object" && raw !== null ? raw : {};
       const scope = rec.scope;
       const installPath = rec.installPath;
       const version = rec.version;
@@ -4716,11 +4750,13 @@ function extractRegistry(data) {
           installPath,
           version
         });
+      } else {
+        malformed[id] = (malformed[id] ?? 0) + 1;
       }
     }
     if (entries.length > 0) out[id] = entries;
   }
-  return out;
+  return { entries: out, malformed };
 }
 function splitPluginId(id) {
   const idx = id.lastIndexOf("@");
@@ -4799,8 +4835,17 @@ function resolveDeclaredPath(installPath, realInstall, declaredPath, explicit, p
   }
   const found = [];
   for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const childPath = join20(real, entry.name);
+    let childPath = join20(real, entry.name);
+    if (entry.isSymbolicLink()) {
+      const target = safeRealpath(childPath);
+      if (!target || !isInside2(target, realInstall)) {
+        notices.push(`plugin ${pluginId}: skill dir symlink escapes the install root, skipping: ${join20(declaredPath, entry.name)}`);
+        continue;
+      }
+      childPath = target;
+    } else if (!entry.isDirectory()) {
+      continue;
+    }
     if (existsSync16(join20(childPath, "SKILL.md"))) found.push(childPath);
   }
   return found;
@@ -4820,7 +4865,7 @@ function resolveSkillDirs(installPath, pluginId) {
       skillDirs.add(dir);
     }
   }
-  return { skillDirs: Array.from(skillDirs).sort(), notices };
+  return { skillDirs: Array.from(skillDirs).sort(), notices, realInstall };
 }
 function discoverClaudePluginRoots(options = {}) {
   const homeDir = options.homeDir ?? homedir4();
@@ -4851,27 +4896,44 @@ function discoverClaudePluginRoots(options = {}) {
   }
   const merged = { ...globalEnabled, ...localEnabled };
   const enabledIds = Object.keys(merged).filter((id) => merged[id] === true).sort();
-  const registry = extractRegistry(registryResult.data);
+  const { entries: registry, malformed } = extractRegistry(registryResult.data);
   const roots = [];
   for (const id of enabledIds) {
     const entries = registry[id];
+    const dropped = malformed[id] ?? 0;
+    if (dropped > 0) {
+      notices.push(`plugin ${id}: ignored ${dropped} malformed installed_plugins.json entr${dropped === 1 ? "y" : "ies"} (missing installPath/version or unknown scope)`);
+    }
     if (!entries || entries.length === 0) {
-      notices.push(`plugin ${id} is enabled but has no installed_plugins.json entry \u2014 skipping`);
+      notices.push(`plugin ${id} is enabled but has no ${dropped > 0 ? "usable " : ""}installed_plugins.json entry \u2014 skipping`);
       continue;
     }
     const entry = selectInstallEntry(entries, cwd);
     const { plugin, marketplace } = splitPluginId(id);
-    const { skillDirs, notices: manifestNotices } = resolveSkillDirs(entry.installPath, id);
+    const { skillDirs, notices: manifestNotices, realInstall } = resolveSkillDirs(entry.installPath, id);
     notices.push(...manifestNotices);
-    roots.push({ pluginId: id, marketplace, plugin, version: entry.version, installPath: entry.installPath, skillDirs });
+    roots.push({ pluginId: id, marketplace, plugin, version: entry.version, installPath: realInstall ?? entry.installPath, skillDirs });
   }
-  roots.sort((a, b) => a.pluginId.localeCompare(b.pluginId));
+  roots.sort((a, b) => a.pluginId < b.pluginId ? -1 : a.pluginId > b.pluginId ? 1 : 0);
   return { roots, notices };
 }
 
 // src/usageSnapshot.ts
 import { readFileSync as readFileSync17, readdirSync as readdirSync9 } from "fs";
 import { extname as extname7, join as join21, resolve as resolvePath4 } from "path";
+function isValidCount(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+function toSnapshot(parsed, sourcePath) {
+  return {
+    usage: parsed.usage,
+    exhaustive: parsed.exhaustive,
+    windowDays: parsed.windowDays,
+    generatedAt: parsed.generatedAt,
+    sourcePath,
+    ...parsed.warning ? { warning: parsed.warning } : {}
+  };
+}
 function emptySnapshot(sourcePath, warning) {
   return { usage: /* @__PURE__ */ new Map(), exhaustive: false, sourcePath, warning };
 }
@@ -4888,31 +4950,35 @@ function parseSnapshotFile(raw) {
   const generatedAt = typeof report.generated_at === "string" ? report.generated_at : void 0;
   const windowDays = typeof report.window_days === "number" ? report.window_days : void 0;
   const uniqueSkillsUsed = typeof report.unique_skills_used === "number" ? report.unique_skills_used : void 0;
-  const skillTotals = report.skill_totals && typeof report.skill_totals === "object" ? report.skill_totals : void 0;
+  const skillTotalsRaw = report.skill_totals;
+  const skillTotals = skillTotalsRaw && typeof skillTotalsRaw === "object" && !Array.isArray(skillTotalsRaw) ? skillTotalsRaw : void 0;
+  const warning = skillTotalsRaw !== void 0 && skillTotals === void 0 ? 'usage snapshot: "skill_totals" is not an object \u2014 ignoring it' : void 0;
   const topSkills = Array.isArray(report.top_skills) ? report.top_skills : void 0;
   const usage = /* @__PURE__ */ new Map();
   if (skillTotals) {
     for (const [name, count] of Object.entries(skillTotals)) {
-      if (typeof count === "number") usage.set(name, count);
+      if (isValidCount(count)) usage.set(name, count);
     }
   } else if (topSkills) {
     for (const row of topSkills) {
-      if (Array.isArray(row) && row.length === 2 && typeof row[0] === "string" && typeof row[1] === "number") {
+      if (Array.isArray(row) && row.length === 2 && typeof row[0] === "string" && isValidCount(row[1])) {
         usage.set(row[0], row[1]);
       }
     }
   }
   const exhaustive = Boolean(skillTotals) || topSkills !== void 0 && uniqueSkillsUsed !== void 0 && topSkills.length === uniqueSkillsUsed;
-  return { usage, exhaustive, windowDays, generatedAt };
+  return { usage, exhaustive, windowDays, generatedAt, warning };
 }
 function pickLatest(candidates) {
   return candidates.reduce((best, cur) => {
     if (!best) return cur;
-    if (cur.generatedAt === void 0 && best.generatedAt === void 0) return cur.path > best.path ? cur : best;
-    if (cur.generatedAt === void 0) return best;
-    if (best.generatedAt === void 0) return cur;
-    if (cur.generatedAt === best.generatedAt) return cur.path > best.path ? cur : best;
-    return cur.generatedAt > best.generatedAt ? cur : best;
+    const curAt = cur.parsed.generatedAt;
+    const bestAt = best.parsed.generatedAt;
+    if (curAt === void 0 && bestAt === void 0) return cur.path > best.path ? cur : best;
+    if (curAt === void 0) return best;
+    if (bestAt === void 0) return cur;
+    if (curAt === bestAt) return cur.path > best.path ? cur : best;
+    return curAt > bestAt ? cur : best;
   }, void 0);
 }
 function loadUsageSnapshot(pathOrDir, opts = {}) {
@@ -4930,16 +4996,16 @@ function loadUsageSnapshot(pathOrDir, opts = {}) {
     const candidates = [];
     for (const name of entries) {
       const filePath = join21(resolved, name);
-      let raw3;
+      let raw2;
       try {
-        raw3 = readFileSync17(filePath, "utf-8");
+        raw2 = readFileSync17(filePath, "utf-8");
       } catch {
         continue;
       }
-      const parsed3 = parseSnapshotFile(raw3);
-      if ("error" in parsed3) continue;
-      if (opts.windowDays !== void 0 && parsed3.windowDays !== opts.windowDays) continue;
-      candidates.push({ path: filePath, generatedAt: parsed3.generatedAt });
+      const parsed2 = parseSnapshotFile(raw2);
+      if ("error" in parsed2) continue;
+      if (opts.windowDays !== void 0 && parsed2.windowDays !== opts.windowDays) continue;
+      candidates.push({ path: filePath, parsed: parsed2 });
     }
     const picked = pickLatest(candidates);
     if (!picked) {
@@ -4948,10 +5014,7 @@ function loadUsageSnapshot(pathOrDir, opts = {}) {
         opts.windowDays !== void 0 ? `no usage snapshot in ${resolved} matches --usage-window ${opts.windowDays}` : `no readable usage snapshot found in ${resolved}`
       );
     }
-    const raw2 = readFileSync17(picked.path, "utf-8");
-    const parsed2 = parseSnapshotFile(raw2);
-    if ("error" in parsed2) return emptySnapshot(picked.path, parsed2.error);
-    return { usage: parsed2.usage, exhaustive: parsed2.exhaustive, windowDays: parsed2.windowDays, generatedAt: parsed2.generatedAt, sourcePath: picked.path };
+    return toSnapshot(picked.parsed, picked.path);
   }
   let raw;
   try {
@@ -4961,7 +5024,7 @@ function loadUsageSnapshot(pathOrDir, opts = {}) {
   }
   const parsed = parseSnapshotFile(raw);
   if ("error" in parsed) return emptySnapshot(resolved, parsed.error);
-  return { usage: parsed.usage, exhaustive: parsed.exhaustive, windowDays: parsed.windowDays, generatedAt: parsed.generatedAt, sourcePath: resolved };
+  return toSnapshot(parsed, resolved);
 }
 
 // src/commands/audit.ts
@@ -7902,6 +7965,15 @@ async function routineCommand(options = {}, deps = {}) {
   for (const notice of notices) log(`[skill-forge] ${notice}`);
   const audit2 = await auditConfiguredSet(config, { accepted, pluginRoots, usage });
   const auditState = summarizeAudit(audit2);
+  if (audit2.plugins) {
+    const critical = audit2.plugins.reduce((n, p) => n + p.findingCounts.CRITICAL, 0);
+    const high = audit2.plugins.reduce((n, p) => n + p.findingCounts.HIGH, 0);
+    if (critical + high > 0) {
+      const notice = `plugin-origin findings (${critical} CRITICAL, ${high} HIGH) are excluded from --fail-on and the add/scan advisory \u2014 see the Plugins section for per-plugin review recommendations`;
+      notices.push(notice);
+      log(`[skill-forge] ${notice}`);
+    }
+  }
   const degraded = [];
   let watch;
   if (!options.skipWatch) {