claude-setup 1.1.2 → 1.1.3

package/README.md

@@ -52,30 +52,7 @@ npx claude-setup doctor --verbose  # Include passing checks in output
 - `.claude/commands/` — project-specific slash commands
 - `.github/workflows/` — CI workflows (only if `.github/` exists)
 
-## Token cost controls
-
-Every byte injected into command files costs tokens. The CLI enforces:
-
-| Control | Default |
-|---------|---------|
-| Init token budget | 12,000 |
-| Sync token budget | 6,000 |
-| Add token budget | 3,000 |
-| Remove token budget | 2,000 |
-| Max source files sampled | 15 |
-| Max file size | 80KB |
-| Max depth | 6 levels |
-
-### File-specific truncation
-
-| File | Strategy |
-|------|----------|
-| `package-lock.json` | Extract `{ name, version, lockfileVersion }` only |
-| `Dockerfile` | First 50 lines |
-| `docker-compose.yml` | First 100 lines if > 8KB |
-| `pom.xml`, `build.gradle*` | First 80 lines |
-| `setup.py` | First 60 lines |
-| `*.config.{js,ts,mjs}` | First 100 lines |
+
 
 ## Configuration
 

package/dist/builder.js

@@ -2,7 +2,7 @@ import { readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { loadConfig } from "./config.js";
-import { detectOS } from "./os.js";
+import { detectOS, VERIFIED_MCP_PACKAGES } from "./os.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const TEMPLATES_DIR = join(__dirname, "..", "templates");
 function estimateTokens(content) {
@@ -220,14 +220,44 @@ export function buildAtomicSteps(collected, state) {
                 `- Env var name in .env.example matching a known service pattern\n` +
                 `- Explicit dependency on an MCP-compatible package\n\n` +
                 `No evidence = no server. Do not invent services.\n\n` +
+                `### Verified MCP package names — ONLY use these\n` +
+                `\`\`\`\n` +
+                Object.entries(VERIFIED_MCP_PACKAGES).map(([k, v]) => `${k.padEnd(12)} → ${v}`).join("\n") +
+                `\n\`\`\`\n` +
+                `If the service is not in this list, print:\n` +
+                `\`⚠️ UNKNOWN PACKAGE — [service] MCP server not added: package name unverified. Find it at https://github.com/modelcontextprotocol/servers\`\n` +
+                `Do not add a placeholder. Do not guess.\n\n` +
                 `### OS-correct format (detected: ${os})\n` +
                 (os === "Windows"
-                    ? `Use: \`{ "command": "cmd", "args": ["/c", "npx", "<package>"] }\`\n`
-                    : `Use: \`{ "command": "npx", "args": ["<package>"] }\`\n`) +
+                    ? `Use: \`{ "command": "cmd", "args": ["/c", "npx", "-y", "<package>"] }\`\n`
+                    : `Use: \`{ "command": "npx", "args": ["-y", "<package>"] }\`\n`) +
+                `Always include \`-y\` in npx args to prevent install hangs.\n` +
+                `\n### Connection strings — NEVER hardcode\n` +
+                `Wrong: \`"args": [..., "postgresql://localhost:5432/db"]\`\n` +
+                `Right: \`"env": { "DATABASE_URL": "\${DATABASE_URL}" }\`\n` +
+                `All credentials and connection strings must go in \`env\` using \`\${VARNAME}\` syntax.\n` +
+                `After adding any server with env vars, flag them:\n` +
+                `\`⚠️ Add DATABASE_URL to .env.example and populate before starting Claude Code\`\n\n` +
                 `\n### Rules\n` +
-                `- All env var refs use \`\${VARNAME}\` syntax\n` +
+                `- All env var refs use \`\${VARNAME}\` syntax — never literal values\n` +
                 `- Produce valid JSON only\n` +
                 `- If creating: document every new env var in .env.example\n\n` +
+                `### Channels (Telegram, Discord) — special MCP servers\n` +
+                `Channels are MCP servers that push events INTO a session. They require:\n` +
+                `- Claude Code v2.1.80+\n` +
+                `- claude.ai login (not API key / Console)\n` +
+                `- Bun runtime installed\n` +
+                `- \`--channels\` flag at EVERY session launch\n\n` +
+                `Verified channel plugins:\n` +
+                `\`\`\`\n` +
+                `Telegram → plugin:telegram@claude-plugins-official\n` +
+                `Discord  → plugin:discord@claude-plugins-official\n` +
+                `\`\`\`\n\n` +
+                `If adding a channel-type server, bot tokens must NEVER be hardcoded:\n` +
+                (os === "Windows"
+                    ? `\`{ "command": "cmd", "args": ["/c", "bun", "run", "\${CLAUDE_PLUGIN_ROOT}/servers/telegram"], "env": { "TELEGRAM_BOT_TOKEN": "\${TELEGRAM_BOT_TOKEN}" } }\`\n`
+                    : `\`{ "command": "bun", "args": ["run", "\${CLAUDE_PLUGIN_ROOT}/servers/telegram"], "env": { "TELEGRAM_BOT_TOKEN": "\${TELEGRAM_BOT_TOKEN}" } }\`\n`) +
+                `After adding, flag: \`⚠️ CHANNEL ACTIVATION REQUIRED — launch with: claude --channels plugin:telegram@claude-plugins-official\`\n\n` +
                 `### Output\n` +
                 `Created/Updated: ✅ .mcp.json — [what server and evidence source]\n` +
                 `Skipped: ⏭ .mcp.json — checked [files], found [nothing], no action\n`,
@@ -249,7 +279,12 @@ export function buildAtomicSteps(collected, state) {
                     : `Use: \`{ "command": "bash", "args": ["-c", "<command>"] }\`\n` +
                         `**Bash quoting rule**: never use bare \`"\` inside \`-c "..."\` — use \`\\x22\` instead.\n` +
                         `Replace \`'\` with \`\\x27\`, \`$\` in character classes with \`\\x24\`.\n`) +
-                `\n### Rules\n` +
+                `\n### Valid hook event names — use ONLY these\n` +
+                `\`PreToolUse\`, \`PostToolUse\`, \`PostToolUseFailure\`, \`Stop\`, \`SessionStart\`\n` +
+                `If unsure which event name to use: do not write the hook. Print:\n` +
+                `\`SKIPPED — hook event name uncertain. Valid names: PreToolUse, PostToolUse, PostToolUseFailure, Stop, SessionStart\`\n\n` +
+                `### Rules\n` +
+                `- **NEVER write a "model" key into settings.json** — it overrides the user's model selection silently\n` +
                 `- If it exists above: audit quoting of existing hooks first, fix broken ones\n` +
                 `- Only add hooks for patterns that genuinely recur for this project type\n` +
                 `- Produce valid JSON only\n\n` +
@@ -283,19 +318,55 @@ export function buildAtomicSteps(collected, state) {
                 `## Target: .claude/commands/ (excluding stack-*.md — those are setup artifacts)\n` +
                 `Installed: ${vars.COMMANDS_LIST}\n\n` +
                 `### When to create\n` +
-                `Create a command ONLY for project-specific multi-step workflows a developer repeats:\n` +
-                `- Deploy sequences\n` +
-                `- Database migration + seed\n` +
-                `- Release workflows\n` +
-                `- Environment setup for a new contributor\n\n` +
-                `Do NOT create commands for things expressible as a single shell alias.\n` +
-                `Look at the scripts in /stack-0-context for evidence of multi-step workflows.\n\n` +
+                `Create a command ONLY for project-specific multi-step workflows a developer repeats.\n` +
+                `Do NOT create commands for things expressible as a single shell alias.\n\n` +
+                `### Smart environment detection\n` +
+                `Also scan for missing/incomplete environment setup:\n` +
+                `- \`.env.example\` exists but \`.env\` missing → suggest \`/setup-env\`\n` +
+                `- \`docker-compose.yml\` with \`depends_on\` → suggest \`/up\` with correct startup order\n` +
+                `- Database migration files (\`migrations/\`, \`prisma/schema.prisma\`, \`alembic/\`) → suggest \`/db:migrate\`, \`/db:rollback\`\n` +
+                `- \`package.json\` with \`"prepare"\` or \`"postinstall"\` hooks → suggest \`/install\`\n` +
+                `- \`Makefile\` with \`install\`, \`deps\`, \`bootstrap\` → fold into \`/init\`\n` +
+                `- README sections ("Environment Variables", "Database Setup") → each can become a command\n\n` +
+                `All suggestions must be built from actual project files — never assume fixed commands.\n` +
+                `Detect the real tooling (npm vs yarn vs pnpm, docker compose vs docker-compose) from project evidence.\n\n` +
+                `### REQUIRED: Scan for multi-step patterns before deciding\n` +
+                `You MUST actively scan these sources in /stack-0-context:\n` +
+                `- **Makefile targets**: multiple chained commands under one target\n` +
+                `- **package.json scripts**: chained commands with && or ;\n` +
+                `- **docker-compose.yml**: service dependencies implying a boot order\n` +
+                `- **Dockerfile**: multi-stage patterns implying a build sequence\n` +
+                `- **README.md / docs**: sections like "Getting Started", "How to run"\n` +
+                `- **Shell scripts** in /scripts or /bin\n` +
+                `- **.env.example**: many vars suggest a setup sequence\n\n` +
+                `### Pattern signatures to detect\n` +
+                `| Pattern found | Suggested command |\n` +
+                `|---------------|-------------------|\n` +
+                `| docker-compose down + volume removal + build + up | /clean-rebuild |\n` +
+                `| migrate + seed + start | /fresh-start |\n` +
+                `| build + test + deploy | /release |\n` +
+                `| lint + format + typecheck all separate | /check |\n` +
+                `| setup + install + configure in README or scripts | /init |\n` +
+                `| backup/restore scripts or pg_dump/mongodump | /db:backup, /db:restore |\n` +
+                `| test + test:watch + test:coverage | /test |\n` +
+                `| dev + start + debug in package.json | /dev |\n` +
+                `| >2 manual steps in README "how to run" | candidate for /start |\n\n` +
+                `For each pattern found, suggest to the user:\n` +
+                `\`\`\`\n` +
+                `## Suggested command: /[name]\n\n` +
+                `I found a multi-step pattern in [source]:\n` +
+                `  1. [step]\n` +
+                `  2. [step]\n\n` +
+                `Create .claude/commands/[name].md?\n` +
+                `\`\`\`\n\n` +
                 `### Rules\n` +
                 `- If existing commands cover the same workflow: skip\n` +
-                `- Commands should be specific to this project, not generic\n\n` +
+                `- Commands should be specific to this project, not generic\n` +
+                `- Adapt exact commands from actual project files — never hardcode\n` +
+                `- Never skip with a blanket "no workflows found" without scanning all sources above\n\n` +
                 `### Output\n` +
                 `Created: ✅ .claude/commands/[name].md — [what workflow and why useful]\n` +
-                `Skipped: ⏭ commands — [why no project-specific workflows found]\n`,
+                `Skipped: ⏭ commands — scanned [list each source checked and result]. Nothing warranted.\n`,
         },
         // --- Step 6: .github/workflows/ ---
         {
@@ -321,9 +392,33 @@ export function buildAtomicSteps(collected, state) {
                         `- NEVER create or modify workflows without explicit developer confirmation\n` +
                         `- If existing workflows exist: do not touch them\n` +
                         `- Secrets must use \`\${{ secrets.VARNAME }}\` syntax only\n`)
-                    : (`### .github/ does not exist\n` +
-                        `Do not create workflows. Print:\n` +
-                        `Skipped: ⏭ .github/workflows/ — .github/ directory does not exist\n`)),
+                    : (`### .github/ does not exist — scan for CI/CD evidence before skipping\n\n` +
+                        `The absence of .github/ is an opportunity to suggest, not a reason to stop.\n\n` +
+                        `Scan /stack-0-context for CI/CD evidence:\n` +
+                        `- \`tests/\` or \`__tests__/\` or \`spec/\` directory → test pipeline candidate\n` +
+                        `- \`Dockerfile\` or \`docker-compose.yml\` → build + deploy pipeline candidate\n` +
+                        `- \`package.json\` with build/test/lint scripts → Node CI candidate\n` +
+                        `- \`Makefile\` with test/build/deploy targets → generic CI candidate\n` +
+                        `- \`pyproject.toml\` with test config → Python CI candidate\n` +
+                        `- README references to "deploy", "release", "staging", "production"\n\n` +
+                        `If evidence found, print EXACTLY:\n` +
+                        `\`\`\`\n` +
+                        `⚙️  WORKFLOW SUGGESTION — .github/ does not exist\n\n` +
+                        `Evidence that CI/CD would be useful:\n` +
+                        `  [list each piece of evidence and its source]\n\n` +
+                        `I can set up:\n` +
+                        `  1. CI pipeline     — run tests + build on every push\n` +
+                        `  2. Deploy pipeline — build image + push to registry on merge to main\n` +
+                        `  3. Both\n\n` +
+                        `Two questions before I create anything:\n` +
+                        `  1. Which of the above? (1 / 2 / 3 / none)\n` +
+                        `  2. Is this connected to a remote GitHub repository? (yes / no)\n` +
+                        `\`\`\`\n\n` +
+                        `If user confirms: create .github/workflows/ with workflows based on actual project commands.\n` +
+                        `All secrets must use \`\${{ secrets.VARNAME }}\` syntax — never hardcoded.\n` +
+                        `After writing, flag every secret: \`⚠️ Add [VARNAME] to GitHub Settings → Secrets\`\n\n` +
+                        `If NO evidence found:\n` +
+                        `Skipped: ⏭ .github/workflows/ — scanned: no tests dir, no Dockerfile, no build/deploy scripts, no deployment references. Nothing to automate.\n`)),
         },
     ];
     return steps;

package/dist/commands/status.js

@@ -52,7 +52,7 @@ export async function runStatus() {
         const settings = safeJsonParse(state.settings.content);
         let hookCount = 0;
         if (settings) {
-            for (const key of ["PreToolUse", "PostToolUse", "PreCompact", "PostCompact", "Notification", "Stop", "SubagentStop"]) {
+            for (const key of ["PreToolUse", "PostToolUse", "PostToolUseFailure", "Stop", "SessionStart"]) {
                 const hooks = settings[key];
                 if (Array.isArray(hooks))
                     hookCount += hooks.length;

package/dist/commands/sync.js

@@ -1,4 +1,5 @@
-import { writeFileSync, mkdirSync, existsSync } from "fs";
+import { writeFileSync, mkdirSync, existsSync, readFileSync } from "fs";
+import { join } from "path";
 import { collectProjectFiles } from "../collect.js";
 import { readState } from "../state.js";
 import { readManifest, sha256, updateManifest } from "../manifest.js";
@@ -50,9 +51,35 @@ export async function runSync(opts = {}) {
         return;
     }
     const lastRun = manifest.runs.at(-1);
-    const collected = await collectProjectFiles(process.cwd(), "normal");
+    const cwd = process.cwd();
+    // --- Out-of-band edit detection ---
+    // Check if CLI-managed files were modified outside the CLI (e.g. by Claude Code directly)
+    const managedFiles = [
+        { label: "CLAUDE.md", path: join(cwd, "CLAUDE.md"), snapshotKey: "CLAUDE.md" },
+        { label: ".mcp.json", path: join(cwd, ".mcp.json"), snapshotKey: ".mcp.json" },
+        { label: "settings.json", path: join(cwd, ".claude", "settings.json"), snapshotKey: ".claude/settings.json" },
+    ];
+    let oobDetected = false;
+    for (const mf of managedFiles) {
+        if (!existsSync(mf.path))
+            continue;
+        const currentContent = readFileSync(mf.path, "utf8");
+        const currentHash = sha256(currentContent);
+        const snapshotHash = lastRun.snapshot[mf.snapshotKey];
+        if (snapshotHash && currentHash !== snapshotHash) {
+            if (!oobDetected) {
+                oobDetected = true;
+                console.log("");
+            }
+            console.log(`${c.yellow("⚠️")}  OUT-OF-BAND EDIT — ${mf.label} was modified outside the CLI`);
+            console.log(`    Re-snapshotting. Run ${c.cyan("npx claude-setup doctor")} to validate the new state.`);
+        }
+    }
+    if (oobDetected)
+        console.log("");
+    const collected = await collectProjectFiles(cwd, "normal");
     const diff = computeDiff(lastRun.snapshot, collected);
-    if (!diff.added.length && !diff.changed.length && !diff.deleted.length) {
+    if (!diff.added.length && !diff.changed.length && !diff.deleted.length && !oobDetected) {
         console.log(`${c.green("✅")} No changes since ${c.dim(lastRun.at)}. Setup is current.`);
         return;
     }

package/dist/doctor.js

@@ -62,6 +62,26 @@ export async function runDoctor(verbose = false) {
         statusLine("⚠️ ", "Manifest", c.yellow("not found — run: npx claude-setup init"));
         counts.warnings++;
     }
+    // --- Check 2b: Out-of-band edit detection ---
+    if (lastRun) {
+        const { createHash } = await import("crypto");
+        const oobFiles = [
+            { label: "CLAUDE.md", path: join(process.cwd(), "CLAUDE.md"), snapshotKey: "CLAUDE.md" },
+            { label: ".mcp.json", path: join(process.cwd(), ".mcp.json"), snapshotKey: ".mcp.json" },
+            { label: "settings.json", path: join(process.cwd(), ".claude", "settings.json"), snapshotKey: ".claude/settings.json" },
+        ];
+        for (const mf of oobFiles) {
+            if (!existsSync(mf.path))
+                continue;
+            const content = readFileSync(mf.path, "utf8");
+            const currentHash = createHash("sha256").update(content).digest("hex");
+            const snapshotHash = lastRun.snapshot[mf.snapshotKey];
+            if (snapshotHash && currentHash !== snapshotHash) {
+                statusLine("⚠️ ", mf.label, c.yellow("modified outside the CLI since last run — run sync to re-snapshot"));
+                counts.warnings++;
+            }
+        }
+    }
     // --- Check 3: OS/MCP format mismatch ---
     if (state.mcpJson.content) {
         section("MCP servers");
@@ -87,6 +107,32 @@ export async function runDoctor(verbose = false) {
                     statusLine("✅", name, `valid, OS-format correct (${cmd})`);
                     counts.healthy++;
                 }
+                // Check for missing -y flag in npx args
+                const args = config.args;
+                if (args) {
+                    const npxIndex = args.indexOf("npx");
+                    if (npxIndex >= 0 && args[npxIndex + 1] !== "-y") {
+                        statusLine("⚠️ ", name, c.yellow(`npx without -y flag — installs may hang`));
+                        counts.warnings++;
+                    }
+                    // Check for hardcoded connection strings in args
+                    for (const arg of args) {
+                        if (/^(postgresql|postgres|mysql|mongodb|redis|amqp):\/\//.test(arg)) {
+                            statusLine("🔴", name, c.red(`HARDCODED connection string in args — move to env: { "DATABASE_URL": "\${DATABASE_URL}" }`));
+                            counts.critical++;
+                            break;
+                        }
+                    }
+                }
+            }
+            // Check for channel-type servers
+            const channelNames = ["telegram", "discord", "fakechat"];
+            for (const [name] of Object.entries(servers)) {
+                if (channelNames.includes(name.toLowerCase())) {
+                    statusLine("⚠️ ", `${name} (CHANNEL)`, c.yellow(`channel server detected — .mcp.json alone does not activate delivery. ` +
+                        `Launch with: claude --channels plugin:${name.toLowerCase()}@claude-plugins-official`));
+                    counts.warnings++;
+                }
             }
         }
         else if (mcp) {
@@ -105,9 +151,24 @@ export async function runDoctor(verbose = false) {
         const settings = safeJsonParse(state.settings.content);
         if (settings) {
             const hookCategories = [
-                "PreToolUse", "PostToolUse", "PreCompact", "PostCompact",
-                "Notification", "Stop", "SubagentStop"
+                "PreToolUse", "PostToolUse", "PostToolUseFailure",
+                "Stop", "SessionStart"
             ];
+            // Bug 6: Check for model override
+            if (settings["model"]) {
+                statusLine("⚠️ ", "MODEL OVERRIDE", c.yellow(`"model": "${settings["model"]}" in settings.json forces this model on every session. Remove it if not intentional.`));
+                counts.warnings++;
+            }
+            // Check for invalid hook event names
+            const validHookNames = new Set(hookCategories);
+            for (const key of Object.keys(settings)) {
+                if (key === "permissions" || key === "model" || key === "env" || key === "allowedTools")
+                    continue;
+                if (Array.isArray(settings[key]) && !validHookNames.has(key)) {
+                    statusLine("🔴", `"${key}"`, c.red(`INVALID hook event name. Valid names: ${hookCategories.join(", ")}`));
+                    counts.critical++;
+                }
+            }
             let foundHooks = false;
             for (const category of hookCategories) {
                 const hooks = settings[category];

package/dist/manifest.js

@@ -47,6 +47,18 @@ export async function updateManifest(command, collected, opts = {}) {
     for (const { path, content } of collected.source) {
         snapshot[path] = sha256(content);
     }
+    // Also snapshot CLI-managed files for out-of-band edit detection
+    const managedFiles = [
+        { key: "CLAUDE.md", path: join(cwd, "CLAUDE.md") },
+        { key: ".mcp.json", path: join(cwd, ".mcp.json") },
+        { key: ".claude/settings.json", path: join(cwd, ".claude", "settings.json") },
+    ];
+    for (const mf of managedFiles) {
+        if (existsSync(mf.path)) {
+            const content = readFileSync(mf.path, "utf8");
+            snapshot[mf.key] = sha256(content);
+        }
+    }
     const filesRead = [
         ...Object.keys(collected.configs),
         ...collected.source.map(s => s.path),

package/dist/os.d.ts

@@ -8,7 +8,12 @@ export type DetectedOS = "Windows" | "macOS" | "Linux";
  * 5. default → Linux
  */
 export declare function detectOS(): DetectedOS;
-/** MCP command format per OS */
+/**
+ * Verified MCP package names — ONLY use these.
+ * If a service is not in this map, do not guess a package name.
+ */
+export declare const VERIFIED_MCP_PACKAGES: Record<string, string>;
+/** MCP command format per OS — always includes -y to prevent npx install hangs */
 export declare function mcpCommandFormat(os: DetectedOS, pkg: string): {
     command: string;
     args: string[];

package/dist/os.js

@@ -22,12 +22,26 @@ export function detectOS() {
     catch { /* not unix — unlikely to reach here */ }
     return "Linux";
 }
-/** MCP command format per OS */
+/**
+ * Verified MCP package names — ONLY use these.
+ * If a service is not in this map, do not guess a package name.
+ */
+export const VERIFIED_MCP_PACKAGES = {
+    playwright: "@playwright/mcp@latest",
+    postgres: "@modelcontextprotocol/server-postgres",
+    filesystem: "@modelcontextprotocol/server-filesystem",
+    memory: "@modelcontextprotocol/server-memory",
+    github: "@modelcontextprotocol/server-github",
+    brave: "@modelcontextprotocol/server-brave-search",
+    puppeteer: "@modelcontextprotocol/server-puppeteer",
+    slack: "@modelcontextprotocol/server-slack",
+};
+/** MCP command format per OS — always includes -y to prevent npx install hangs */
 export function mcpCommandFormat(os, pkg) {
     if (os === "Windows") {
-        return { command: "cmd", args: ["/c", "npx", pkg] };
+        return { command: "cmd", args: ["/c", "npx", "-y", pkg] };
     }
-    return { command: "npx", args: [pkg] };
+    return { command: "npx", args: ["-y", pkg] };
 }
 /** Hook shell format per OS */
 export function hookShellFormat(os, cmd) {

package/dist/state.js

@@ -9,9 +9,13 @@ export async function readState(cwd = process.cwd()) {
     const claudeMd = readIfExists(claudeMdPath);
     const mcpJson = readIfExists(mcpJsonPath);
     const settings = readIfExists(settingsPath);
+    // Scan all three skill patterns and deduplicate (Bug 4 fix)
     let skills = [];
     try {
-        skills = await glob(".claude/skills/*/SKILL.md", { cwd, posix: true });
+        const structured = await glob(".claude/skills/*/SKILL.md", { cwd, posix: true });
+        const flat = await glob(".claude/skills/*.md", { cwd, posix: true });
+        const nested = await glob(".claude/skills/**/*.md", { cwd, posix: true });
+        skills = [...new Set([...structured, ...flat, ...nested])];
     }
     catch { /* no skills */ }
     let commands = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-setup",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Setup layer for Claude Code — reads your project, writes command files, Claude Code does the rest",
   "type": "module",
   "bin": {

package/templates/remove.md

@@ -21,8 +21,29 @@ Remove from setup: "{{USER_INPUT}}"
 
 Skills: {{SKILLS_LIST}} | Commands: {{COMMANDS_LIST}} | Workflows: {{WORKFLOWS_LIST}}
 
+## IMPORTANT: Scan the filesystem directly — do NOT rely on manifest history
+
+The manifest is a historical record, not a reliable source of what exists now.
+Claude Code can create, modify, or delete files outside the CLI at any time.
+
+Before removing anything, scan these locations directly:
+- Skills   : `.claude/skills/*/SKILL.md`, `.claude/skills/*.md`, `.claude/skills/**/*.md`
+- Commands : `.claude/commands/*.md` (exclude stack-*.md)
+- MCP      : read `.mcp.json` directly
+- Hooks    : read `.claude/settings.json` directly
+- CLAUDE.md: read the file directly
+
+Before deleting, list every reference found and confirm scope:
+```
+Planning to remove:
+  [path/entry] — [what it is]
+
+Dangling references that will break:
+  [path] — still references [thing being removed]
+```
+
 ## Rules
-- Find everything related to the removal request across ALL files above.
+- Find everything related to the removal request across ALL files — scan the filesystem, not just the data shown above.
 - Remove surgically — section by section, key by key.
 - Never delete an entire file. Remove only the relevant section.
 - Never remove content unrelated to the request.