claude-dev-env 8.1.0 → 8.2.0

package/.agents/agents/clean-coder.md

@@ -79,7 +79,7 @@ Load only the group that matches the task. Keep session policy details in these
 
 Material implementation questions must return to the caller for `AskUserQuestion` handling; do not ask in plain text or guess.
 
-Type-ignore rule (AGENTS Types): avoid `# type: ignore`; remove it and use a typed boundary or real type.
+Type-ignore rule (AGENTS Types): avoid `# type: ignore`; remove it and use a typed boundary or type.
 
 Constants (AGENTS Magic values): use named constants from the target layout. Search its constants module first. Do not force a generic `config/` layout. Example:
 
@@ -101,7 +101,7 @@ def fetch_with_retries(fetch_text: Callable[[str], str], url: str) -> str:
 - **No secrets in context.** Never open `.env` / `.env.*` / credential files. The sensitive-file protector blocks editing them.
 - **No lock-file hand edits.** Do not edit lock files by hand; regenerate with the package manager.
 - **No unasked scratch files.** Follow the target repo's policy for scratch, planning, and image files. Do not create temporary scratch files or working docs. Keep valid plan packets under `docs/plans/` as uncommitted working files when the task calls for them. Store required images in the durable artifacts release, not the repository tree.
-- **Pre-check before Write.** Run `python <managed-root>/hooks/blocking/code_rules_enforcer.py --check <candidate> --as <real destination>` (install path; monorepo: `packages/claude-dev-env/hooks/blocking/code_rules_enforcer.py`) until clean, then Write/Edit once. Use the real `--as` path; a wrong path can hide violations. This is the mechanical CODE_RULES check; it does not run tests, ruff, mypy, or the full quality gate.
+- **Pre-check before Write.** Run `python <managed-root>/hooks/blocking/code_rules_enforcer.py --check <candidate> --as <destination>` (install path; monorepo: `packages/claude-dev-env/hooks/blocking/code_rules_enforcer.py`) until clean, then Write/Edit once. Use the `--as` path; a wrong path can hide violations. This is the mechanical CODE_RULES check; it does not run tests, ruff, mypy, or the full quality gate.
 - **Candidate check vs full gate.** The pre-check tests CODE_RULES only. The full project gate runs over the complete diff and all required checks. `code_rules_enforcer.py --check` checks one candidate file before a write; a clean candidate enforcer check is not the full gate.
 - **Windows shell.** Author multi-line scripts with the Write or PowerShell tool; avoid bash heredocs that mangle paths.
 - **`gh` bodies.** Always `--body-file`; never use `--body` or `-b` with markdown.
@@ -113,7 +113,7 @@ def fetch_with_retries(fetch_text: Callable[[str], str], url: str) -> str:
 
 Every behavior change follows Red-Green-Refactor:
 
-1. **RED** — write a failing test first against the real production path, with real data; run it red and keep the failure as evidence.
+1. **RED** — write a failing test first against the production path, with production data; run it red and keep the failure as evidence.
 2. **GREEN** — write the minimum production change, then run the focused test.
 3. **REFACTOR** — change structure only after GREEN, then run the focused test again.
 
@@ -121,7 +121,7 @@ Do not write production behavior before RED, skip the red run, or call a green t
 
 ## Hook-specific workflow
 
-For a hook change, use the target package's active managed root for installed files, not the current working directory. The default is `~/.claude`; `--target` or `CLAUDE_CONFIG_DIR` selects another managed root. Read `<managed-root>/hooks/AGENTS.md` (default: `~/.claude/hooks/AGENTS.md`; source fallback: `packages/claude-dev-env/hooks/AGENTS.md`), each closer `AGENTS.md` and `CLAUDE.md`, and the registered hook entry before editing. Trace the lifecycle event, stdin JSON, output contract, exit code, and registration. Reuse the target hook area's constants package. Run `<managed-root>/scripts/check.ps1` (default: `~/.claude/scripts/check.ps1`; source fallback: `packages/claude-dev-env/scripts/check.ps1`) and drive the real production entry point with event payloads. The RED test covers each allow and deny outcome. Run every applicable test file and suite for the hook, then the full quality gates required by the affected package.
+For a hook change, use the target package's active managed root for installed files, not the current working directory. The default is `~/.claude`; `--target` or `CLAUDE_CONFIG_DIR` selects another managed root. Read `<managed-root>/hooks/AGENTS.md` (default: `~/.claude/hooks/AGENTS.md`; source fallback: `packages/claude-dev-env/hooks/AGENTS.md`), each closer `AGENTS.md` and `CLAUDE.md`, and the registered hook entry before editing. Trace the lifecycle event, stdin JSON, output contract, exit code, and registration. Reuse the target hook area's constants package. Run `<managed-root>/scripts/check.ps1` (default: `~/.claude/scripts/check.ps1`; source fallback: `packages/claude-dev-env/scripts/check.ps1`) and drive the production entry point with event payloads. The RED test covers each allow and deny outcome. Run every applicable test file and suite for the hook, then the full quality gates required by the affected package.
 
 ## Session advisor
 

package/.agents/agents/code-quality-agent.md

@@ -127,7 +127,7 @@ evidence, report an evidence gap or open question.
 
 `id` uses the form `loop<N>-<K>` when the orchestrator supplies a loop prefix and `find<K>` for standalone audit calls. Honor the prefix supplied in the prompt.
 
-**The `failure_mode` field is the audit-to-fix handoff.** State the failing line, the desired post-fix property, and a one-line validation the fix agent can run to confirm correctness. The fix agent reads `failure_mode` without re-running your audit — make it self-sufficient.
+**The `failure_mode` field is the audit-to-fix handoff.** State the failing line, the desired post-fix property, and a one-line validation the fix agent can run to confirm correctness. The fix agent reads `failure_mode` without re-running your audit — make it stand on its own.
 
 Each audit→fix→audit cycle in the calling skill adds wall-clock latency. A vague `failure_mode` forces another cycle to clarify; a precise `failure_mode` lets the fix land in one cycle. Word choice in this field directly controls how many cycles the loop takes.
 
@@ -165,9 +165,9 @@ not a Shape B entry.
 
 ## Collection before filtering
 
-Report every real finding at its true severity. Collection retains P0, P1, and
+Report every finding at the severity it warrants. Collection retains P0, P1, and
 P2 findings with file, line, evidence (`excerpt` / `failure_mode`), and
-category. Do not drop lower-severity real findings during collection so a later
+category. Do not drop lower-severity findings during collection so a later
 consumer can filter. Severity or action filtering is a separate stage after the
 collection record is complete.
 
@@ -197,7 +197,7 @@ When the primary and adversarial passes flag the same file:line:
 
 - Merge into a single Shape A finding using max-wins severity (P0 > P1 > P2).
 - Concatenate the `failure_mode` strings (separator: " // adversarial: ") so both pass narratives survive.
-- For Shape B entries on the same category, keep every distinct `adversarial_probe` from both passes — collapsing them would drop information that was actually found.
+- For Shape B entries on the same category, keep every distinct `adversarial_probe` from both passes — collapsing them would drop information that was found.
 
 The merge runs at the end of the adversarial pass, before constructing the output. The output preamble's `Total: N` counts merged findings, not pre-merge total.
 

package/.agents/agents/plan-packet-validator.md

@@ -20,7 +20,7 @@ You validate plan packets. You are not the planner and you do not repair docs.
 1. Read `README.md`, `packet.json`, `context/source-map.md`, `implementation/steps.md`, `implementation/tdd-plan.md`, `spec/acceptance.md`, and `handoff/build-prompt.md`.
 2. Read or search the source files named in `source-map.md` and `packet.json`.
 3. Verify referenced paths exist unless the packet clearly labels them as new files.
-4. Verify source facts match actual files.
+4. Verify source facts match the files.
 5. Verify the implementation steps are enough for a blind build agent.
 6. Verify the TDD sequence starts with failing tests and names the behavior those tests prove.
 7. Verify scope matches the user request and non-goals.
@@ -30,4 +30,4 @@ You validate plan packets. You are not the planner and you do not repair docs.
 
 ## Output
 
-Return the requested structured schema. Set `allPassed` to true only when every check is clean. Each finding must name the packet file, the check, and the exact source-grounded problem.
+Return the requested structured schema. Set `allPassed` to `true` only when every check is clean. Each finding must name the packet file, the check, and the exact source-grounded problem.

package/.agents/agents/session-advisor.md

@@ -16,7 +16,7 @@ Many different consumers may reach you over one shared transcript — a coordina
 Reply with exactly one of four signals, named on the first line:
 
 - **ENDORSE** — the plan, or the finished work, holds up, with nothing worth flagging. A clean yes.
-- **CORRECTION** — something needs attention before the plan or the finished work is genuinely done: a wrong assumption or step, or a risk worth naming and closing. Name the specific problem(s) and the precise fix(es) or mitigation(s). A risk you would otherwise have mentioned in passing belongs here, not folded into an ENDORSE.
+- **CORRECTION** — something needs attention before the plan or the finished work is done: a wrong assumption or step, or a risk worth naming and closing. Name the specific problem(s) and the precise fix(es) or mitigation(s). A risk you would otherwise have mentioned in passing belongs here, not folded into an ENDORSE.
 - **PLAN** — the current approach needs to change. Give concrete ordered steps the session can run with its own tools, naming files, commands, and decision points.
 - **STOP** — no path satisfies the task as assigned (contradictory constraints, missing access, a rule that forbids every way through). Say why, and report your reasoning with cited proof and examples.
 

package/.agents/skills/cert-classification-rule/SKILL.md

@@ -135,7 +135,7 @@ truthful note, because it becomes the pasted sentence for those classes.
 
 Do **not** fabricate a "Samsung confirmed" claim. State only what is true. The shipped Gallery
 note is true because Samsung Support did confirm that issue; a new pattern for a different
-issue must not borrow that wording unless the confirmation actually happened.
+issue must not borrow that wording unless the confirmation happened.
 
 ## How to add the paired production-path test
 
@@ -143,7 +143,7 @@ Every new unfixable pattern gets a paired test in
 `shared_utils/samsung_utils/tests/test_cert_failure_classifier.py` that drives the production
 path:
 
-1. Load the real patterns with `load_unfixable_patterns()` (no path argument, so it reads the
+1. Load the patterns with `load_unfixable_patterns()` (no path argument, so it reads the
    shipped config).
 2. Build the report HTML with the live must-fix title text, run it through
    `extract_issue_titles`, then `classify_failure`, and assert the result is `unfixable`.
@@ -153,7 +153,7 @@ path:
 
 Use the exact title strings Samsung's report produces. The existing
 `TestClassifyFailure::test_gallery_regex_matches_all_known_variants` shows the shape: a list of
-real title variants, each asserted as `unfixable` through `classify_failure`.
+title variants, each asserted as `unfixable` through `classify_failure`.
 
 Run the tests from the `shared_utils` directory (its pytest config is anchored there):
 

package/.agents/skills/e-code-review/SKILL.md

@@ -24,7 +24,7 @@ Proposal mode selects the review level and records finding outcomes. The downstr
 ## Gotchas
 
 - **`low` stays single-pass.** No subagents, no full-file reads: one read pass per target item, one findings pass.
-- **Collection reports every real finding.** Keep every CONFIRMED or PLAUSIBLE finding at its assigned severity (`blocker`, `high`, `medium`, `low`, `nit`). Do not drop low or nit findings during collection. Severity or action filtering is a separate consumer stage after the collection record is complete (`scripts/finding_pipeline.py`).
+- **Collection reports every finding.** Keep every CONFIRMED or PLAUSIBLE finding at its assigned severity (`blocker`, `high`, `medium`, `low`, `nit`). Do not drop low or nit findings during collection. Severity or action filtering is a separate consumer stage after the collection record is complete (`scripts/finding_pipeline.py`).
 - **`medium` favors precision, `xhigh` favors recall.** At `medium` (8 angles) assign severity carefully so a later filter can pick maintainer-action findings. At `xhigh` (10 angles plus a gap sweep) a single non-REFUTED vote carries the finding; do not drop on uncertainty.
 - **Every retained finding carries `severity` and `verdict`.** Severity is one of `blocker`, `high`, `medium`, `low`, `nit`. Verdict is `CONFIRMED` or `PLAUSIBLE`. Drop REFUTED candidates only; never emit an unclassified retained finding.
 - **`--fix` applies findings once.** Load `reference/fix.md` and follow it. That file owns the fix agent, the code-rules gate, skip logging, and outcome reporting. Commits are lead-owned; fix agents never commit or push.
@@ -74,7 +74,7 @@ Detail: `reference/effort-evaluation.md`.
 | `reference/preflight-proposal.md` | Isolated local review, immutable SHAs, proposal evidence, and mutation boundary |
 | `reference/effort-evaluation.md` | Effort evaluation fixtures, evidence, and skill defaults |
 | `reference/runner-selection.md` | Runner selection map |
-| `scripts/finding_pipeline.py` | Collect every real finding; filter severity only later |
+| `scripts/finding_pipeline.py` | Collect every finding; filter severity only later |
 | `scripts/test_finding_pipeline.py` | Collection and filter-stage behavioral tests |
 | `scripts/e_code_review_scripts_constants/finding_pipeline_constants.py` | Named constants for the collect-then-filter pipeline |
 | `scripts/effort_evaluation.py` | Effort rows, recommendation, skill default resolver |

package/.agents/skills/e-code-review/reference/fix.md

@@ -66,7 +66,7 @@ After fixes land, report the same findings list again through the structured
 findings-report call, the call that renders this review's results as a typed
 list in the host UI, with each finding now carrying an `outcome`:
 `fixed`, `no_change_needed` (the finding was wrong or already handled), or
-`skipped` (real but not applied). Do not repeat the findings as text in the
+`skipped` (the finding stands but no fix was applied). Do not repeat the findings as text in the
 response body; the structured call is the record the host UI reads, and the
 batched skip list from above goes in the prose that follows it.
 

package/.agents/skills/e-code-review/reference/loop.md

@@ -183,7 +183,7 @@ round's progress report. Then take the one case that matches the round's
 findings.
 
 - Any bug-severity finding: validate each bug with an advisor before touching
-  code. Confirm it's real and confirm the intended fix, then fix every
+  code. Confirm the bug exists and confirm the intended fix, then fix every
   validated bug and every nit on the review target. A refuted bug removes only
   itself from the round's work; the nits are fixed either way.
 - Nits only, with at least one nit present: fix all of them on the review

package/.agents/skills/e-code-review/reference/medium.md

@@ -2,7 +2,7 @@
 
 You are reviewing for **precision** at medium effort: assign severity carefully
 so a later consumer can select maintainer-action findings. **Collection
-reports every real finding** (including `low` and `nit`); do not drop by
+reports every finding** (including `low` and `nit`); do not drop by
 severity during collection. Severity filtering is a separate consumer stage
 after the collection record is complete.
 
@@ -44,7 +44,7 @@ wrong-variable copy-paste, error swallowed in catch, unescaped regex metachars.
 For every line the diff DELETES or replaces, name the invariant or behavior it
 enforced, then search the new code for where that invariant is re-established.
 If you can't find it, that's a candidate: a removed guard, a dropped error
-path, a narrowed validation, a deleted test that was covering a real case.
+path, a narrowed validation, a deleted test that was covering a case.
 
 ### Angle C — cross-file tracer
 
@@ -115,7 +115,7 @@ file(s), and the candidate, and have it return exactly one of:
 
 - **CONFIRMED** — can name the inputs/state that trigger it and the wrong
   output or crash. Quote the line.
-- **PLAUSIBLE** — mechanism is real, trigger is uncertain (timing, env,
+- **PLAUSIBLE** — mechanism is present in the code, trigger is uncertain (timing, env,
   config). State what would confirm it.
 - **REFUTED** — factually wrong (code doesn't say that) or guarded elsewhere.
   Quote the line that proves it.
@@ -126,7 +126,7 @@ Keep candidates where the vote is CONFIRMED or PLAUSIBLE.
 
 **Collection stage first.** Keep every CONFIRMED or PLAUSIBLE finding in the
 collection record, including `low` and `nit`. Drop only REFUTED candidates.
-Do not drop a real finding because its severity is low.
+Do not drop a finding because its severity is low.
 
 Report this review's results — `{level, findings}` — through the structured
 findings-report call: the mechanism that renders a review's results as a typed

package/.agents/skills/e-code-review/reference/xhigh.md

@@ -1,7 +1,7 @@
 `xhigh effort → 5+5 angles → 1-vote verify → sweep`
 
-You are reviewing for **recall** at extra-high effort: catch every real bug. At
-this level, catching real bugs matters more than avoiding false positives — a
+You are reviewing for **recall** at extra-high effort: catch every bug. At
+this level, catching bugs matters more than avoiding false positives — a
 missed bug ships. Err on the side of surfacing.
 
 ## Phase 0 — Gather the diff
@@ -42,7 +42,7 @@ wrong-variable copy-paste, error swallowed in catch, unescaped regex metachars.
 For every line the diff DELETES or replaces, name the invariant or behavior it
 enforced, then search the new code for where that invariant is re-established.
 If you can't find it, that's a candidate: a removed guard, a dropped error
-path, a narrowed validation, a deleted test that was covering a real case.
+path, a narrowed validation, a deleted test that was covering a case.
 
 ### Angle C — cross-file tracer
 
@@ -65,7 +65,7 @@ adapter): check that every method routes to the wrapped instance and not back
 through a registry/session/global — e.g. a caching provider holding a
 `delegate` field that resolves IDs via `session.get(...)` instead of
 `delegate.get(...)` will re-enter the cache or recurse. Also check that the
-wrapper forwards all the methods the callers actually use.
+wrapper forwards all the methods the callers use.
 
 ### Reuse
 
@@ -125,7 +125,7 @@ file(s), and the candidate, and have it return exactly one of:
 
 - **CONFIRMED** — can name the inputs/state that trigger it and the wrong
   output or crash. Quote the line.
-- **PLAUSIBLE** — mechanism is real, trigger is uncertain (timing, env,
+- **PLAUSIBLE** — mechanism is present in the code, trigger is uncertain (timing, env,
   config). State what would confirm it.
 - **REFUTED** — factually wrong (code doesn't say that) or guarded elsewhere.
   Quote the line that proves it.

package/.agents/skills/everything-search/SKILL.md

@@ -152,16 +152,16 @@ Run separate searches for each extension type:
 
 ### Junctions, Symlinks & Drive Mapping
 
-Everything indexes REAL paths only, not junctions or mapped drives.
+Everything indexes paths only, not junctions or mapped drives.
 
 | Drive | Type | Indexed? | Action |
 |-------|------|----------|--------|
-| Y:\ | Real NTFS | Yes | Use this path |
+| Y:\ | NTFS | Yes | Use this path |
 | Z:\ | Junction to Y: | No | Use Y:\ instead |
 
 **If search returns empty:**
 1. Check if the path is a junction/symlink
-2. Find the real path and search that instead
+2. Find the path the junction targets and search that instead
 3. Or use Glob tool as fallback (works on any path)
 
 **Common drive mappings:**

package/.agents/skills/issue-tracker/SKILL.md

@@ -79,7 +79,7 @@ GitHub closes the sub-issue when someone **merges** a pull request into the **de
 
 **Preferred on commits:** also put `Closes #N` in the first commit message when the fix starts. Commit alone is backup; the PR body is the contract.
 
-**Stacked / intermediate PRs** that do not merge into the default branch: use a plain `#N` reference in the body so the issue links without a false close promise. Put `Closes #N` only on the PR that actually lands on the default branch.
+**Stacked / intermediate PRs** that do not merge into the default branch: use a plain `#N` reference in the body so the issue links without a false close promise. Put `Closes #N` only on the PR that lands on the default branch.
 
 **Not enough:** a Development "related" link with no closing keyword. **Not enough:** closing the PR without merging.
 

package/.agents/skills/orchestrator/SKILL.md

@@ -255,8 +255,8 @@ Routing rules:
   detection system, with no second one.
 - Resume a warm workflow agent before creating a new workflow run when
   the warm agent holds the relevant context.
-- Review and verification workflows apply the [review guide](../reviews/SKILL.md#review-workflow).
-- PR-description workflows include the actual changed-file list in the
+- Review and verification workflows apply the [review guide](../e-code-review/SKILL.md).
+- PR-description workflows include the changed-file list in the
   prompt and verify the final body against that file list before posting
   or returning it.
 - Exploration workflows return file paths, line numbers, and direct
@@ -274,7 +274,7 @@ Routing rules:
   background spawn — keep the `agentId` (format `a...-...`) from the
   spawn result so `SendMessage` can reach that agent later.
 - **Spawn a fresh agent only when** no existing agent holds relevant
-  context, or a genuine task switch needs a clean context.
+  context, or a task switch needs a clean context.
 - **Reuse is a cost rule, not a correctness dependency.** The run
   artifacts keep every executor replaceable (Run state section).
 - **Name the agent to resume.** When a PLAN from this session fits

package/.agents/skills/orchestrator/reference/consult-the-orchestrator.md

@@ -21,7 +21,7 @@ The first consult is complete. It carries:
 - Assignment and desired outcome
 - Constraints and exclusions
 - Actions taken in order
-- Real output and current state
+- Output and current state
 - Live decision or blocker
 - Validation evidence
 - Unresolved risks

package/.agents/skills/orchestrator/reference/executor-consult-block.md

@@ -31,7 +31,7 @@ Fill `<orchestrator-name>` with the name the executor can address.
 > failure repeats or progress has stalled, and when the chosen approach
 > is being reconsidered.
 > The first consult carries: assignment, desired outcome, constraints
-> and exclusions, actions taken in order, real output and current
+> and exclusions, actions taken in order, output and current
 > state, live decision or blocker, validation evidence, unresolved
 > risks, load-bearing paths or excerpts, and who is asking. Later
 > consults carry only changed evidence.

package/.agents/skills/orchestrator-refresh/SKILL.md

@@ -70,7 +70,7 @@ reports and adds nothing further.
    executor has no `in_progress` task naming it as owner; a finished
    executor's task is still open (or was closed without its result
    merged); the next phase you will dispatch has no pending task; a
-   `blockedBy` link contradicts the actual run order. Fix every mismatch
+   `blockedBy` link contradicts the run order. Fix every mismatch
    with TaskCreate / TaskUpdate in this same firing — never defer.
 2. **You are the orchestrator.** Orchestrate and hold the user
    conversation; spawn executor subagents for every code edit and build
@@ -89,7 +89,7 @@ reports and adds nothing further.
    to orchestration and light verification reads.
 4. **Resume before you spawn.** `SendMessage` an existing *executor* by
    name or `agentId` before a cold spawn.
-5. **Fresh spawn only for a genuine task switch.** Never tell an agent
+5. **Fresh spawn only for a task switch.** Never tell an agent
    to compact for a clean context.
 6. **Single-pending re-arm only.** Same protocol as the orchestrator
    skill (host-agnostic; **create then claim**):

package/.agents/skills/plugin-eval-standalone-skill/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: plugin-eval-standalone-skill
+description: >-
+  Run `claude plugin eval` against a standalone skill that is not a plugin, by wrapping the skill in a plugin folder, writing trigger and must-not-trigger cases, and reading the with-skill minus without-skill delta. Triggers: eval a skill, plugin eval, claude plugin eval, test my skill, skill eval, eval a standalone skill.
+---
+
+# Plugin eval for a standalone skill
+
+## Contents
+
+- Principle
+- Gotchas
+- When this applies
+- Process
+- Files
+
+## Principle
+
+`claude plugin eval` runs plugins only. Wrap the skill in a plugin folder whose layout keeps every
+relative link working. Grade behavior only the skill produces. Judge the skill by the delta between
+the arm with the plugin and the arm without it.
+
+## Gotchas
+
+- A `.claude-plugin/plugin.json` under any skills directory turns that folder into a
+  `<name>@skills-dir` plugin in every session. Build the wrapper outside every skills directory.
+- The run sandbox gets a throwaway home and config. User settings, hooks, CLAUDE.md, MCP servers,
+  memory, and other skills are absent. Plugin items carry a prefix, such as `<plugin>:session-advisor`.
+- `claude plugin eval init` with no arguments is interactive and needs a terminal. From an agent
+  shell, run `claude plugin eval init --bare <case-name>`.
+- A prompt that starts with `/skill-name` loads the skill with no `Skill` tool call, so
+  `tool_used: Skill` always fails on a slash case.
+- A plain-words case triggers only when the skill allows model invocation. Leave
+  `disable-model-invocation` unset in the copied frontmatter.
+- Write, Edit, SendMessage, and Bash need `--allow-tools` on the command line. Bash and PowerShell
+  grants refuse the run on native Windows, which has no sandbox backend. Run those cases under WSL2.
+- Writes under a loaded `--plugin-dir` are denied in dontAsk mode. That skews the with-plugin arm
+  only, so keep every working and output folder outside the plugin root.
+- A metric built from tool_use attempts reports success even when every write was denied. Read each
+  run's `permission_denials` and final result before you compare arms.
+- A score under `--ablation none` says nothing about what the skill adds. Run the baseline once
+  before you claim the skill helps.
+- The sandbox disables feature-flag fetching. Flag-gated features such as the built-in `advisor()`
+  tool are off, and `/advisor` replies "isn't available in this environment". No env var or plugin
+  setting turns them on. Plugin `settings.json` accepts only `agent` and `subagentStatusLine`. Test
+  such a feature with the `claude -p` recipe in `reference/graders-and-commands.md`.
+- `--keep-temp` on Windows warns that it cannot seal the folder. Delete that folder when done with
+  PowerShell `Remove-Item -Recurse -Force -LiteralPath <path>`.
+
+## When this applies
+
+Use this skill to measure whether a skill that is not packaged as a plugin triggers and changes
+behavior. It needs Claude Code 2.1.269 or later. Source doc: https://code.claude.com/docs/en/plugin-evals
+
+## Process
+
+Register one session task per numbered step through the host task tool. Use `TaskCreate`, else
+`TodoWrite`. Where the host has no task tool, say so and work the steps in order.
+
+1. Run `claude --version` and confirm 2.1.269 or later.
+2. Create the wrapper folder outside every skills directory:
+
+   ```text
+   <wrapper>/
+   ├── .claude-plugin/
+   │   └── plugin.json
+   ├── skills/
+   │   └── <name>/
+   ├── agents/
+   └── <each shared doc, at the path the skill's relative links expect>
+   ```
+
+   `plugin.json` holds `name`, `version`, and `description`.
+3. Copy the skill, every agent it spawns, and every shared doc it links. Copy from a tree at
+   `origin/main`, not from a stale worktree. Resolve each relative link in the copied skill against
+   the wrapper root.
+4. In the wrapper root, run `claude plugin eval init --bare <case-name>` once per case.
+5. Write `evals/<case>/prompt.md` and `evals/<case>/graders/*.md` for each case. Frontmatter keys,
+   grader types, and the case set are in `reference/graders-and-commands.md`.
+6. Re-copy the skill from `origin/main`, then run the smoke command from the reference file.
+7. Read each run's `permission_denials` and final result. Fix any denial that the case needs.
+8. Re-copy the skill, then run the full eval. Read the delta in `aggregate-result.json`.
+9. Delete any `--keep-temp` sandbox folder.
+
+## Files
+
+- `SKILL.md`. Wrapper layout, gotchas, and process.
+- `reference/graders-and-commands.md`. Prompt frontmatter, grader types, case set, eval commands,
+  and the `claude -p` recipe for flag-gated features.
+
+```text
+plugin-eval-standalone-skill/
+├── SKILL.md
+└── reference/
+    └── graders-and-commands.md
+```

package/.agents/skills/plugin-eval-standalone-skill/reference/graders-and-commands.md

@@ -0,0 +1,108 @@
+# Graders and commands
+
+## Contents
+
+- Prompt frontmatter
+- Grader types
+- Case set
+- Eval commands
+- Results
+- Flag-gated features outside plugin eval
+
+## Prompt frontmatter
+
+`evals/<case>/prompt.md` takes these frontmatter keys.
+
+| Key | Use |
+| --- | --- |
+| `max_turns` | Default 10. Set about 40 for a skill that spawns agents. |
+| `timeout_seconds` | Wall-clock cap for one run. |
+| `allowed_tools` | Read-only set: Read, Glob, Grep, Skill, Agent, TodoWrite, and the task tools. |
+
+Write, Edit, SendMessage, and Bash go on the command line through `--allow-tools`, not in
+`allowed_tools`.
+
+## Grader types
+
+Each file in `evals/<case>/graders/` is one grader.
+
+| Type | Fields | Checks |
+| --- | --- | --- |
+| `regex` | `target`: `last_message`, `trace`, `files`, or `{source: file, path}` | A pattern in the chosen text |
+| `tool_used` | `tool`, `input_match`, `min`, `max`, `arm` | How many calls to a tool, filtered by an input regex |
+| `tool_order` | `before`, `after`, each a tool name or `{tool, input_match}` | One call lands before another |
+| `file_exists` | `path` glob, `exists` | A file created during the run matches, or none does with `exists: false` |
+| `llm` | The body is the rubric, `focus` | A judge panel votes, and 2 of 3 decide |
+| `baseline` | `baseline_file`, `criteria` | A judge rates the run at least as good as a reference `.jsonl` transcript |
+
+Source doc: https://code.claude.com/docs/en/plugin-evals
+
+## Case set
+
+Write at least these three shapes.
+
+**Slash case.** The prompt starts with `/<name>`. No `Skill` call happens, so grade what only the
+skill produces:
+
+- `tool_used` with `tool: Agent` and an `input_match` on the agent name the skill spawns.
+- `tool_order` with that `Agent` spawn before the first `Write`.
+
+**Plain-words case.** The prompt asks for the job in ordinary words. Vary the wording, and do not
+copy the exact phrase from the skill description into the only trigger case. Grade the trigger with:
+
+```text
+tool: Skill
+input_match: '"skill"\s*:\s*"(?:[\w-]+:)?<name>"'
+```
+
+**Must-not-trigger case.** The prompt uses a verb near the triggers in its ordinary sense. Grade
+with `tool_used`, `tool: Skill`, `min: 0`, `max: 0`, `arm: both`.
+
+Grade on skill behavior. A grader keyed to a transport token that upstream may remove breaks on an
+upgrade with no change in the skill.
+
+## Eval commands
+
+Run every command from the wrapper root.
+
+Smoke run, one case:
+
+```text
+claude plugin eval . --case <name> --runs 1 --ablation none --max-cost-usd 2 --no-publish --trust-plugin --allow-tools Write SendMessage
+```
+
+`--trust-plugin` is needed when stdin is not a terminal. `--case` takes one glob. Only the last
+`--case` flag takes effect, so match several cases with one glob.
+
+Full run: drop `--runs` and `--ablation`. The default is 3 runs with the plugin and 3 runs without.
+The delta, with minus without, measures what the skill adds. A smoke score under `--ablation none`
+has no without-plugin arm, so it measures nothing about contribution.
+
+Add `--keep-temp` to keep the sandbox. Its trace is `out/trace.jsonl`.
+
+## Results
+
+Each run writes `evals/results/<timestamp>/report.html` and `aggregate-result.json`.
+
+Before you compare arms, read each run's `permission_denials` and its final result. A run whose
+writes were all denied still shows the tool_use attempts.
+
+## Flag-gated features outside plugin eval
+
+The sandbox cannot turn on a flag-gated feature. Test it with `claude -p`, once with the wrapper
+loaded and once without:
+
+```text
+claude -p "<task>" --advisor <model> --plugin-dir <wrapper> --setting-sources project --strict-mcp-config --allowedTools "<list>" --permission-mode dontAsk --output-format stream-json --verbose
+```
+
+Drop `--plugin-dir <wrapper>` for the second arm.
+
+- Keep the user's config. An empty `CLAUDE_CONFIG_DIR` drops the login and the run reports
+  "Not logged in". `--setting-sources project` keeps user settings out.
+- Count the feature in the stream. For the advisor, count content blocks with `type`
+  `server_tool_use` and `name` `advisor` on the main thread only.
+- Before you read a zero count, run a positive control whose prompt asks for the feature by name. A
+  zero can mean the feature was not attached, rather than not chosen.
+- Keep the run's working folder outside the wrapper root, since writes under `--plugin-dir` are
+  denied in dontAsk mode.

package/.agents/skills/privacy-hygiene/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: privacy-hygiene
-description: Full-repo sweep for personal data and secrets before commit or durable GitHub post. Use when preparing a PR, cleaning a leak, or when `pii_prevention_blocker` denies a write, post, or commit. Triggers on "privacy hygiene", "personal data", "secret sweep", "sanitize repository", "/privacy-hygiene".
+description: Full-repo sweep for personal data and secrets before commit or durable GitHub post. Use when preparing a PR or cleaning a leak. Triggers on "privacy hygiene", "personal data", "secret sweep", "sanitize repository", "/privacy-hygiene".
 ---
 
 # privacy-hygiene
 
 ## Overview
 
-Find and remove personal data and high-confidence secrets before they land in git history or a durable GitHub post. The `pii_prevention_blocker` hook blocks the common cases at write, post, and commit time. This skill is the full sweep when you need a broader pass or a remediation plan.
+Find and remove personal data and high-confidence secrets before they land in git history or a durable GitHub post. No write-time hook scans for these; `pii_prevention_blocker` was retired. This skill is the sweep.
 
 **Announce at start:** "Running privacy-hygiene sweep."
 
@@ -40,8 +40,7 @@ Run the full-tree sweep in
 run the ripgrep pass for the four high-confidence pattern families (email, home
 path, LAN address, secret), review each hit against the ignore list, and
 remediate. It also lists the accepted residual — what to leave in place rather
-than over-scrub. The ripgrep command is the only full-tree pass; the write-time
-`pii_prevention_blocker` scans one payload at a time.
+than over-scrub. The ripgrep command is the only pass over the tree.
 
 ## Enable on any machine / public repository
 
@@ -56,9 +55,9 @@ Hooks register via `hooks/hooks.json` into `~/.claude/settings.json`. Once insta
 
 ## Open knobs
 
-- **NAS / LAN allowlist:** Unlisted private IPs are blocked. The scanner resolves your NAS host from `CLAUDE_NAS_HOST`, then `~/.claude/local-identity.json` (`nas.host`), and allowlists it when it is a private address, so the committed tree holds no real host. `ALL_ALLOWLISTED_PRIVATE_IP_ADDRESSES` in `hooks_constants` holds the static allowlist for any host every machine must share.
+- **NAS / LAN allowlist:** Unlisted private IPs are blocked. The scanner resolves your NAS host from `CLAUDE_NAS_HOST`, then `~/.claude/local-identity.json` (`nas.host`), and allowlists it when it is a private address, so the committed tree holds no host address. `ALL_ALLOWLISTED_PRIVATE_IP_ADDRESSES` in `hooks_constants` holds the static allowlist for any host every machine must share.
 - **Commit-scan exempt repositories:** named owner/repo slugs skip the staged-commit PII scan only. Set `CLAUDE_PII_EXEMPT_REPOS` (comma-separated `owner/repo` values) or list them under `pii_exempt_repositories` in `~/.claude/local-identity.json`. Matching uses the repository's `remote.origin.url` and accepts only the exact host `github.com` (https, ssh scheme, or scp-style). A repository with no readable origin is never exempt (fail-closed to scanning). Write / Edit / MultiEdit and durable post bodies still scan in every repository.
-- **Public maintainer identity:** when a real email or name is intentional product surface, keep it and note that in the PR body so reviewers do not treat it as a leak.
+- **Public maintainer identity:** when an email or name is intentional product surface, keep it and note that in the PR body so reviewers do not treat it as a leak.
 
 ## What this skill does not do
 

package/.agents/skills/privacy-hygiene/reference/sweep-procedure.md

@@ -1,10 +1,9 @@
 # Full-tree PII sweep procedure
 
-The on-demand full-repository sweep for the `privacy-hygiene` skill — the
-complement to the write-time `pii_prevention_blocker`, which scans one payload at
-a time. The canonical per-payload patterns live in the hooks' `pii_scanner` and
-`pii_prevention_constants` modules; the ripgrep command below is the only
-full-tree pass. The hub ([`../SKILL.md`](../SKILL.md)) points here.
+The on-demand full-repository sweep for the `privacy-hygiene` skill. The
+per-payload patterns live in the hooks' `pii_scanner` and
+`pii_prevention_constants` modules; the ripgrep command below is the only pass
+over the tree. The hub ([`../SKILL.md`](../SKILL.md)) points here.
 
 ## 1. Scope the tree
 
@@ -40,7 +39,7 @@ Review each hit. Ignore:
 
 | Hit | Fix |
 |---|---|
-| Real email | Replace with `user@example.com` or remove |
+| Email address | Replace with `user@example.com` or remove |
 | Home path | Use `Path.home()`, `~`, or `C:/Users/<you>/` |
 | LAN address | Remove, use a hostname, or — for your own NAS — set the host in `CLAUDE_NAS_HOST` or `~/.claude/local-identity.json`, both of which stay out of git |
 | Credential material | Remove from the tree; rotate the credential; load from env/secret store |

package/.agents/skills/repairing-hook-boundaries/SKILL.md

@@ -27,7 +27,7 @@ output envelope, and exit status as separate boundaries.
 Use this skill for Claude or Codex hook failures involving registered events,
 settings, launchers, imports, paths, payloads, output envelopes, or exit status.
 
-For installer-only work, say: `Use /run-claude-dev-env for installer work that has no hook-boundary failure.`
+For installer-only work, say: `Installer work with no hook-boundary failure belongs outside this skill.`
 
 ## Process
 

package/.agents/skills/syncing-submodules/SKILL.md

@@ -31,7 +31,7 @@ Use this skill after committing inside a checked-out submodule when its parent r
 Refusals use the first matching line:
 
 - Clone, initialize, or check out a submodule: `Use Git's submodule commands. This skill records an existing submodule commit in its parent.`
-- Fast-forward `main`: `Use /update. This skill changes one parent submodule pointer.`
+- Fast-forward `main`: `Use Git directly. This skill changes one parent submodule pointer.`
 - Make an ordinary commit or push: `Use /source-command-commit. This skill commits only a parent submodule pointer.`
 
 ## Process