javi-forge 1.26.0 → 1.28.0

package/dist/lib/skill-scanner.d.ts

@@ -15,13 +15,34 @@ export interface SkillThreat {
     context: string;
     message: string;
 }
-export type SkillScanVerdict = "pass" | "warn" | "block";
+/**
+ * `unscannable` is a fail-closed verdict: the file could not be read in full
+ * (binary, oversized, I/O error) or a content-mutating clamp/truncation
+ * happened during the read, so we cannot certify it. A gate MUST treat it as a
+ * rejection exactly like `block` — see {@link isRejectedVerdict}, the single
+ * predicate every install/registry gate should use instead of `=== "block"`.
+ */
+export type SkillScanVerdict = "pass" | "warn" | "block" | "unscannable";
+/**
+ * The set of verdicts an install/registry gate rejects on. Fail-closed:
+ * `block` (a critical threat was found) and `unscannable` (the file could not
+ * be certified because it was not fully scanned) both mean "do not install".
+ * Use this everywhere instead of a bare `verdict === "block"` check so a future
+ * gate can never let an `unscannable` file slip through.
+ */
+export declare function isRejectedVerdict(verdict: SkillScanVerdict): boolean;
 export interface SkillScanResult {
     skillPath: string;
     skillName: string;
     verdict: SkillScanVerdict;
     threats: SkillThreat[];
     summary: SkillScanSummary;
+    /**
+     * Scan-level notes — populated when the file could not be fully analysed
+     * (binary, oversized, unreadable) so a skipped file is visible in the report
+     * instead of masquerading as a clean pass.
+     */
+    notes?: string[];
 }
 export interface SkillScanSummary {
     total: number;
@@ -57,6 +78,49 @@ export declare function scanSkillFile(filePath: string): Promise<SkillScanResult
  * Useful for scanning a plugin's skills directory before installation.
  */
 export declare function scanSkillsDirectory(dir: string): Promise<SkillScanResult[]>;
+export interface SkillCoverageScan {
+    /**
+     * Scan results for the declared-entry SKILL.md files — the ONLY files the
+     * walk content-scans (JD-005). A declared file that is a symlink is never
+     * read through (it is already in {@link symlinks}); a missing declared
+     * SKILL.md fails closed as `unscannable`.
+     */
+    declared: SkillScanResult[];
+    /**
+     * Skill-shaped files (basename `SKILL.md`/`skill.md`) found in the tree
+     * OUTSIDE the declared set — including under `node_modules`/`.git` (JD-007).
+     * Paths only; content is never read during the walk (JD-005).
+     */
+    undeclared: string[];
+    /**
+     * ANY symlink (file or dir) found in the tree. The caller refuses on this
+     * (manifest-integrity, block-level, force never lifts — JD-007); the walk
+     * never dereferences them (JD-003).
+     */
+    symlinks: string[];
+    /**
+     * Paths the walk could not enumerate or stat (realpath/readdir/lstat I/O
+     * failure — e.g. an unreadable subtree). An incomplete walk cannot certify
+     * the installed footprint, so the caller refuses on this (manifest-
+     * integrity, block-level, force never lifts — JD-013); a silent `return`/
+     * `continue` would treat the broken subtree as empty and let the install
+     * proceed un-scanned.
+     */
+    errors: string[];
+}
+/**
+ * SKILL.md-only coverage walk for the install gates (JD-006/JD-007).
+ *
+ * Visits the ENTIRE tree with NO `node_modules`/`.git` exemption, so the visit
+ * set is exactly the footprint `fs.move`/`fs.copy` will place (JD-007). Collects
+ * only basename `SKILL.md`/`skill.md` files — never `PLUGIN.md`/README content
+ * (JD-002) — and flags ANY symlink (file or dir) without dereferencing it
+ * (JD-007/JD-003). A realpath visited-set terminates cycles defensively even if
+ * a future caller ever recurses through a link (JD-003). The walk itself does NO
+ * content reads: only the declared-entry files are handed to
+ * {@link scanSkillFile} afterwards (JD-005).
+ */
+export declare function scanSkillsWithCoverage(dir: string, declaredPaths: string[]): Promise<SkillCoverageScan>;
 export declare function formatScanReport(result: SkillScanResult): string;
 export declare function formatBatchReport(results: SkillScanResult[]): string;
 export {};

package/dist/lib/skill-scanner.js

@@ -7,6 +7,17 @@
  */
 import path from "node:path";
 import fs from "fs-extra";
+import { describeSafeReadFailure, safeReadFile } from "./safe-read.js";
+/**
+ * The set of verdicts an install/registry gate rejects on. Fail-closed:
+ * `block` (a critical threat was found) and `unscannable` (the file could not
+ * be certified because it was not fully scanned) both mean "do not install".
+ * Use this everywhere instead of a bare `verdict === "block"` check so a future
+ * gate can never let an `unscannable` file slip through.
+ */
+export function isRejectedVerdict(verdict) {
+    return verdict === "block" || verdict === "unscannable";
+}
 /**
  * Ordered by severity (critical first). Each pattern is tested against
  * every non-comment line in the skill file.
@@ -282,18 +293,66 @@ export function extractSkillName(content, filePath) {
 // =============================================================================
 // Main scan function
 // =============================================================================
+/**
+ * Hard ceiling for a scanned skill file. Past this it is not a skill document
+ * but a dumped log or a vendored bundle: scanning it would run every regex
+ * over megabytes of noise, so it is skipped and reported instead.
+ */
+const MAX_SCAN_BYTES = 1024 * 1024;
 export async function scanSkillFile(filePath) {
-    const content = await fs.readFile(filePath, "utf-8");
+    // `maxLineLength: 0` disables the per-line clamp for the scanner's own read:
+    // a padded single line hiding `rm -rf ~` past column 10k must reach the regex
+    // pass intact, not be silently truncated and then scanned as if complete. The
+    // total-byte ceiling still bounds memory (a file past it fails `too-large`).
+    const read = await safeReadFile(filePath, {
+        hardRejectOverBytes: MAX_SCAN_BYTES,
+        maxLineLength: 0,
+    });
+    // A file we could not read is not a clean file. Never crash the batch, and
+    // never report it as a pass: an unscannable file cannot be certified safe, so
+    // it fails closed with the strongest verdict a gate rejects on.
+    if (!read.ok) {
+        return {
+            skillPath: filePath,
+            skillName: path.basename(path.dirname(filePath)),
+            verdict: "unscannable",
+            threats: [],
+            summary: computeScanSummary([]),
+            notes: [
+                `scanning incomplete: ${describeSafeReadFailure(read)} — rejected (an unscannable file cannot be certified safe)`,
+            ],
+        };
+    }
+    const content = read.content;
     const skillName = extractSkillName(content, filePath);
     const threats = scanSkillContent(content, filePath);
-    const verdict = computeVerdict(threats);
     const summary = computeScanSummary(threats);
+    // A content-mutating read (truncated bytes, or a clamped line) means the
+    // regex pass did NOT see the whole file. Even if no threat surfaced in what
+    // we did see, we cannot certify the rest — fail closed rather than emit a
+    // pass/warn over partial content. With `maxLineLength: 0` and the byte
+    // ceiling above these should not fire, but the guard is the safety net.
+    const incomplete = read.truncated || read.longLinesClamped;
+    const notes = [];
+    if (read.truncated) {
+        notes.push(`truncated: only the first ${read.bytesRead} of ${read.totalBytes} bytes were scanned`);
+    }
+    if (read.longLinesClamped) {
+        notes.push("clamped: one or more lines exceeded the per-line limit");
+    }
+    if (incomplete) {
+        notes.push("rejected: the file was not fully scanned and cannot be certified safe");
+    }
+    const verdict = incomplete
+        ? "unscannable"
+        : computeVerdict(threats);
     return {
         skillPath: filePath,
         skillName,
         verdict,
         threats,
         summary,
+        ...(notes.length > 0 ? { notes } : {}),
     };
 }
 /**
@@ -335,6 +394,237 @@ export async function scanSkillsDirectory(dir) {
     await walk(dir);
     return results;
 }
+/**
+ * SKILL.md-only coverage walk for the install gates (JD-006/JD-007).
+ *
+ * Visits the ENTIRE tree with NO `node_modules`/`.git` exemption, so the visit
+ * set is exactly the footprint `fs.move`/`fs.copy` will place (JD-007). Collects
+ * only basename `SKILL.md`/`skill.md` files — never `PLUGIN.md`/README content
+ * (JD-002) — and flags ANY symlink (file or dir) without dereferencing it
+ * (JD-007/JD-003). A realpath visited-set terminates cycles defensively even if
+ * a future caller ever recurses through a link (JD-003). The walk itself does NO
+ * content reads: only the declared-entry files are handed to
+ * {@link scanSkillFile} afterwards (JD-005).
+ */
+export async function scanSkillsWithCoverage(dir, declaredPaths) {
+    // Resolve the scan root once. Declared entries must stay inside it — a
+    // hostile manifest can never make the gate read outside the staged clone
+    // (JD-003: "no read outside the staged clone"; the interface contract names
+    // declared paths realpath-contained).
+    const rootAbs = path.resolve(dir);
+    const rootReal = await fs.realpath(rootAbs);
+    // Resolve each declared entry once (containment-verified) and reuse it for
+    // both the coverage set and the content scan — never twice.
+    const declaredDirs = new Map();
+    for (const entry of declaredPaths) {
+        declaredDirs.set(entry, await resolveContained(rootAbs, rootReal, entry));
+    }
+    // Declared skill DIRECTORIES — membership is case-insensitive by declared
+    // directory, never by file-basename spelling (R1-001/R3-001/R4-001). The
+    // walk collects ANY entry whose lowercased basename is `skill.md`, because
+    // the installed footprint is the on-disk tree whether the author wrote
+    // `SKILL.md`, `Skill.md`, `SKILL.MD` or any other fold — a declared skill's
+    // file must be recognized as declared no matter its case. Seeding exact-case
+    // basenames (F1/JD-011 seeded `SKILL.md` + `skill.md`) still missed every
+    // other fold: the file was collected, failed membership, and landed in
+    // `undeclared` — a block-level refusal `--force` never lifts — while the
+    // declared scan reported `unscannable` (permanent lockout for a legit
+    // declared skill). Membership by declared DIRECTORY keeps the smuggling
+    // refusal intact: a skill-shaped file whose parent dir is NOT a declared
+    // dir still misses the set and refuses as undeclared (CASE3).
+    const declaredDirAbs = new Set(declaredDirs.values());
+    // R1-F2-N1: declared-dir membership must ALSO fold case on the DIRECTORY
+    // name. `declaredDirAbs` retains MANIFEST case (`resolveContained` returns
+    // the manifest-spelled `entryAbs`); a package authored on a case-
+    // insensitive FS can declare `skills/Alpha` while the disk tree carries
+    // `skills/alpha` — the on-disk footprint the walk actually sees. Exact-
+    // case membership left the walk's dirname check missing the set → the file
+    // landed `undeclared` (block-level, force never lifts) while the declared
+    // scan reported the manifest-case path `unscannable` — the third instance
+    // of the case-lockout class (JD-011 file, R1-001 file-fold, dir-name
+    // fold). Compare lowercased on BOTH sides; the real on-disk path is still
+    // the one scanned below (never invent casing for file access).
+    const declaredDirAbsLower = new Set([...declaredDirAbs].map((d) => d.toLowerCase()));
+    const undeclared = [];
+    const symlinks = [];
+    const errors = [];
+    // Real on-disk dirs the walk actually visited (readdir-spelled casing) —
+    // used AFTER the walk to resolve declared dirs whose manifest spelling
+    // differs in case from the disk (R1-F2-N1); see the declared scan below.
+    const walkDirs = [];
+    const visited = new Set();
+    async function walk(currentDir) {
+        // realpath visited-set: a defensive cycle invariant (JD-003). Symlinks are
+        // never recursed into, so no cycle can form through the walk itself; the
+        // set guarantees termination even if that ever changes.
+        let real;
+        try {
+            real = await fs.realpath(currentDir);
+        }
+        catch {
+            // Fail-closed (JD-013): an unlistable subtree must surface as an
+            // error the caller refuses on, not silently read as empty.
+            errors.push(currentDir);
+            return;
+        }
+        if (visited.has(real))
+            return;
+        visited.add(real);
+        walkDirs.push(currentDir);
+        let entries;
+        try {
+            entries = await fs.readdir(currentDir);
+        }
+        catch {
+            // Fail-closed (JD-013): same as realpath above — record, do not
+            // swallow, so the caller can refuse an incomplete walk.
+            errors.push(currentDir);
+            return;
+        }
+        for (const entry of entries) {
+            const fullPath = path.join(currentDir, entry);
+            let lst;
+            try {
+                lst = await fs.lstat(fullPath);
+            }
+            catch {
+                // Fail-closed (JD-013): a path we cannot stat (race, I/O, or
+                // permission) must not silently vanish from the footprint
+                // inventory — record it and keep walking the rest.
+                errors.push(fullPath);
+                continue;
+            }
+            // Symlinks are never dereferenced: flagged for the caller's
+            // manifest-integrity refusal, never recursed into, never scanned
+            // (JD-007/JD-003).
+            if (lst.isSymbolicLink()) {
+                symlinks.push(fullPath);
+                continue;
+            }
+            if (lst.isDirectory()) {
+                await walk(fullPath);
+                continue;
+            }
+            // SKILL.md-only collection: basename SKILL.md/skill.md (any case
+            // fold), never PLUGIN.md or README (JD-002). Declared-ness is
+            // decided by the parent DIRECTORY being declared (R1-001): any case
+            // fold of the file inside a declared dir is declared, so the file
+            // is scanned — never flagged undeclared (block-level, force never
+            // lifts) for the exact-case spelling it happens to carry on disk.
+            if (entry.toLowerCase() === "skill.md") {
+                const resolved = path.resolve(fullPath);
+                if (!declaredDirAbsLower.has(path.dirname(resolved).toLowerCase())) {
+                    undeclared.push(fullPath);
+                }
+            }
+        }
+    }
+    // R3-F3-N1: walk the ABSOLUTE root, never the caller's raw `dir`. With a
+    // relative invocation (`javi-forge plugin import <relative-dir>`), the
+    // walkDirs two-tier lookup below compares walk-visited paths against
+    // `declaredAbs` (always absolute) — a relative walk made every declared dir
+    // fall back to the manifest path, reporting an existing declared file as
+    // `unscannable` (force would lift it and install un-scanned content).
+    // Starting from `rootAbs` also keeps undeclared/symlinks/errors absolute
+    // and consistent with the gate's realpath expectations.
+    await walk(rootAbs);
+    // Content-scanned results for declared entries only (JD-005), in declared
+    // order so reports are deterministic. A declared file that is a symlink is
+    // already in `symlinks` — reading through it would escape the tree (JD-003),
+    // so it is skipped here (the caller refuses on `symlinks` first anyway).
+    const symlinkSet = new Set(symlinks.map((p) => path.resolve(p)));
+    const declared = [];
+    // Iterating the map keeps declared order (insertion order == declaredPaths)
+    // and guarantees an entry cannot be absent once resolved.
+    for (const declaredAbs of declaredDirs.values()) {
+        // R1-F2-N1: the declared scan reads the REAL on-disk dir the walk saw —
+        // a manifest spelling `skills/Alpha` against a disk tree `skills/alpha`
+        // must scan the lowercase dir that exists. The two-tier lookup prefers
+        // the exact-case real dir when present, then a case-fold match; a truly
+        // missing declared dir (no real dir matches) falls back to the manifest
+        // path so it still fails closed as `unscannable` (unchanged). Only
+        // the real on-disk path is ever handed to
+        // `declaredSkillFileOnDisk`/`scanSkillFile` — no casing is invented for
+        // file access.
+        const realDir = walkDirs.find((d) => d === declaredAbs) ??
+            walkDirs.find((d) => d.toLowerCase() === declaredAbs.toLowerCase()) ??
+            declaredAbs;
+        // Case-tolerant resolution (JD-011/R1-001): a declared skill whose
+        // on-disk file is lowercase `skill.md` — or any other case fold
+        // (`Skill.md`, `SKILL.MD`, …) — is the same declared entry; scan the
+        // file that actually exists instead of reporting the exact-case path
+        // as a missing/unscannable file.
+        const file = await declaredSkillFileOnDisk(realDir);
+        // Whether the canonical or the lowercase variant, a symlinked declared
+        // file is already in `symlinks` — never read through it (JD-003/JD-007).
+        if (symlinkSet.has(path.resolve(file)))
+            continue;
+        declared.push(await scanSkillFile(file));
+    }
+    return { declared, undeclared, symlinks, errors };
+}
+/**
+ * Resolve the on-disk skill file for a declared skill directory. The coverage
+ * walk recognizes ANY case fold of the `skill.md`/`SKILL.md` basename in a
+ * declared dir as the declared file (R1-001), so a declared entry may
+ * legitimately carry any fold on disk; favor the conventional exact-case name,
+ * fall back to the lowercase variant (JD-011), then to any other case fold via
+ * a case-insensitive readdir. When no skill-shaped file exists at all, return
+ * the canonical path so `scanSkillFile` reports the declared skill as
+ * `unscannable` (fail-closed, unchanged behavior).
+ */
+async function declaredSkillFileOnDisk(absDir) {
+    const canonical = path.join(absDir, "SKILL.md");
+    if (await fs.pathExists(canonical))
+        return canonical;
+    const lower = path.join(absDir, "skill.md");
+    if (await fs.pathExists(lower))
+        return lower;
+    // Any other case fold (`Skill.md`, `SKILL.MD`, `skill.MD`, …) is the same
+    // declared file (R1-001): the declared scan must read what actually exists
+    // or the declared entry reports `unscannable` while the walk collects it as
+    // declared. Prefer the canonical name when both exist (JD-F1-N1 residual).
+    try {
+        const entries = await fs.readdir(absDir);
+        const fold = entries.find((e) => e.toLowerCase() === "skill.md");
+        if (fold)
+            return path.join(absDir, fold);
+    }
+    catch {
+        // Unreadable declared dir → return the canonical path so scanSkillFile
+        // fails closed as `unscannable` (no new behavior).
+    }
+    return canonical;
+}
+/**
+ * Resolve a declared skill entry to an absolute directory and verify it stays
+ * inside the scan root — both lexically (`../../x`, absolute paths) and by
+ * realpath, so an in-tree symlink cannot redirect the declared read outside the
+ * staged clone (JD-003). Throws when the entry escapes; the caller denies.
+ */
+async function resolveContained(rootAbs, rootReal, entry) {
+    const entryAbs = path.resolve(rootAbs, entry);
+    // Lexical containment — catches `../outside` and absolute entries.
+    const rel = path.relative(rootAbs, entryAbs);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+        throw new Error(`skillguard: declared skill path escapes scan root — ${entry}`);
+    }
+    // Realpath containment — catches a directory inside the tree whose real
+    // location is outside it. A missing declared dir (later `unscannable`) has
+    // no realpath yet; its lexical containment above is then the whole guard.
+    let real;
+    try {
+        real = await fs.realpath(entryAbs);
+    }
+    catch {
+        return entryAbs;
+    }
+    const relReal = path.relative(rootReal, real);
+    if (relReal.startsWith("..") || path.isAbsolute(relReal)) {
+        throw new Error(`skillguard: declared skill path escapes scan root — ${entry}`);
+    }
+    return entryAbs;
+}
 // =============================================================================
 // Report formatting
 // =============================================================================
@@ -346,6 +636,12 @@ export function formatScanReport(result) {
     lines.push(`Verdict: ${verdict.toUpperCase()}`);
     lines.push(`Findings: ${summary.total} (${summary.critical} critical, ${summary.high} high, ${summary.moderate} moderate, ${summary.low} low)`);
     lines.push("");
+    if (result.notes && result.notes.length > 0) {
+        lines.push("--- Notes ---");
+        for (const note of result.notes)
+            lines.push(`  ${note}`);
+        lines.push("");
+    }
     if (threats.length > 0) {
         lines.push("--- Threats ---");
         for (const t of threats) {
@@ -354,7 +650,11 @@ export function formatScanReport(result) {
             lines.push(`  Context: ${t.context}`);
         }
     }
-    if (verdict === "block") {
+    if (verdict === "unscannable") {
+        lines.push("");
+        lines.push("REJECTED: File could not be fully scanned, so it cannot be certified safe. Not installed.");
+    }
+    else if (verdict === "block") {
         lines.push("");
         lines.push("BLOCKED: Critical threats detected. Review and remove before installing.");
     }
@@ -367,11 +667,14 @@ export function formatScanReport(result) {
 export function formatBatchReport(results) {
     const lines = [];
     const blocked = results.filter((r) => r.verdict === "block");
+    const unscannable = results.filter((r) => r.verdict === "unscannable");
     const warned = results.filter((r) => r.verdict === "warn");
     const passed = results.filter((r) => r.verdict === "pass");
     lines.push(`=== SkillGuard Batch Scan ===`);
     lines.push(`Scanned: ${results.length} skill(s)`);
-    lines.push(`Blocked: ${blocked.length}`);
+    lines.push(`Rejected: ${blocked.length + unscannable.length}`);
+    lines.push(`  Blocked (threats): ${blocked.length}`);
+    lines.push(`  Unscannable (not certified): ${unscannable.length}`);
     lines.push(`Warned: ${warned.length}`);
     lines.push(`Passed: ${passed.length}`);
     lines.push("");

package/dist/types/index.d.ts

@@ -226,6 +226,11 @@ export interface SkillBudgetEntry {
     skillName: string;
     skillPath: string;
     tokens: number;
+    /**
+     * Set when the SKILL.md could not be fully read (binary, oversized, I/O
+     * error) — `tokens` is then partial or zero and should be read with care.
+     */
+    note?: string;
 }
 export interface SkillBudgetSuggestion {
     /** Skills to disable in this suggestion set */
@@ -271,6 +276,13 @@ export interface SkillScore {
     grade: SkillGrade;
     threshold: number;
     passing: boolean;
+    /**
+     * Set when the SKILL.md could not be read (binary, oversized, I/O error). The
+     * numeric dimensions are then meaningless placeholders (all `0`, never a
+     * computed grade or `safety: 100`); callers must surface the file as unread
+     * rather than as a scored skill. `passing` is always `false` in this state.
+     */
+    unread?: string;
 }
 export interface SkillRegistryGateResult {
     skillName: string;
@@ -287,6 +299,12 @@ export interface SkillBenchmarkResult {
     skillName: string;
     checks: SkillBenchmarkCheck[];
     passRate: number;
+    /**
+     * Set when the SKILL.md could not be read (binary, oversized, I/O error). No
+     * checks were run (`checks` is empty, `passRate` is `0`); callers must surface
+     * the file as unread rather than as a benchmarked skill that failed every check.
+     */
+    unread?: string;
 }
 declare const WORKFLOW_FORMAT: {
     readonly DOT: "dot";

package/dist/ui/AutoSkills.d.ts

@@ -3,7 +3,9 @@ interface AutoSkillsProps {
     projectDir: string;
     skillsDir?: string;
     dryRun?: boolean;
+    /** Bypass the skillguard gate for unscannable sources ONLY — block always refuses (D5) */
+    force?: boolean;
 }
-export default function AutoSkills({ projectDir, skillsDir, dryRun, }: AutoSkillsProps): React.JSX.Element;
+export default function AutoSkills({ projectDir, skillsDir, dryRun, force, }: AutoSkillsProps): React.JSX.Element;
 export {};
 //# sourceMappingURL=AutoSkills.d.ts.map

package/dist/ui/AutoSkills.js

@@ -2,10 +2,11 @@ import { Box, Text, useApp, useInput } from "ink";
 import Spinner from "ink-spinner";
 import React, { useCallback, useEffect, useState } from "react";
 import { autoInstallSkills } from "../lib/auto-skill-install.js";
+import { formatScanReport } from "../lib/skill-scanner.js";
 import { useCIMode } from "./CIContext.js";
 import Header from "./Header.js";
 import { theme } from "./theme.js";
-export default function AutoSkills({ projectDir, skillsDir, dryRun, }) {
+export default function AutoSkills({ projectDir, skillsDir, dryRun, force = false, }) {
     const { exit } = useApp();
     const isCI = useCIMode();
     const [result, setResult] = useState(null);
@@ -20,6 +21,7 @@ export default function AutoSkills({ projectDir, skillsDir, dryRun, }) {
             skillsSourceDir: skillsDir,
             skillsTargetDir: skillsDir,
             dryRun: dryRun ?? false,
+            force,
         })
             .then((r) => {
             setResult(r);
@@ -29,7 +31,7 @@ export default function AutoSkills({ projectDir, skillsDir, dryRun, }) {
             setError(String(e));
             setLoading(false);
         });
-    }, [projectDir, skillsDir, dryRun]);
+    }, [projectDir, skillsDir, dryRun, force]);
     useEffect(() => {
         runDetection();
     }, [runDetection]);
@@ -116,6 +118,19 @@ export default function AutoSkills({ projectDir, skillsDir, dryRun, }) {
                     React.createElement(Text, { dimColor: true, color: theme.warning },
                         "  ",
                         "not found in source")))))),
+                result.blocked.length > 0 && (React.createElement(Box, { flexDirection: "column" }, result.blocked.map((scan) => (React.createElement(Box, { key: `blocked-${scan.skillName}`, flexDirection: "column" },
+                    React.createElement(Box, { marginLeft: 4 },
+                        React.createElement(Text, { color: theme.error },
+                            "\u2717",
+                            " ",
+                            scan.skillName,
+                            " \u2014 refused")),
+                    React.createElement(Box, { marginLeft: 6 },
+                        React.createElement(Text, { color: theme.muted, dimColor: true }, formatScanReport(scan)
+                            .split("\n")
+                            .map((l) => l.trim())
+                            .filter(Boolean)
+                            .join(" | ")))))))),
                 totalSkills === 0 && (React.createElement(Box, { marginLeft: 4 },
                     React.createElement(Text, { color: theme.muted }, "No skills recommended for this stack")))))),
         !loading && (React.createElement(Box, { marginTop: 1 },

package/dist/ui/Plugin.d.ts

@@ -4,7 +4,9 @@ interface PluginProps {
     target?: string;
     dryRun: boolean;
     codex?: boolean;
+    /** Bypass the skillguard gate for unscannable sources ONLY — block always refuses (D5) */
+    force?: boolean;
 }
-export default function Plugin({ action, target, dryRun, codex, }: PluginProps): React.JSX.Element;
+export default function Plugin({ action, target, dryRun, codex, force, }: PluginProps): React.JSX.Element;
 export {};
 //# sourceMappingURL=Plugin.d.ts.map

package/dist/ui/Plugin.js

@@ -16,7 +16,7 @@ const STATUS_COLOR = {
     error: theme.error,
     skipped: theme.muted,
 };
-export default function Plugin({ action, target, dryRun, codex = false, }) {
+export default function Plugin({ action, target, dryRun, codex = false, force = false, }) {
     const [steps, setSteps] = useState([]);
     const [done, setDone] = useState(false);
     const onStep = (step) => {
@@ -44,7 +44,7 @@ export default function Plugin({ action, target, dryRun, codex = false, }) {
                             });
                             break;
                         }
-                        await runPluginAdd(target, dryRun, onStep);
+                        await runPluginAdd(target, dryRun, onStep, { force });
                         break;
                     case "remove":
                         if (!target) {
@@ -106,7 +106,7 @@ export default function Plugin({ action, target, dryRun, codex = false, }) {
                             });
                             break;
                         }
-                        await runPluginImport(target, dryRun, onStep);
+                        await runPluginImport(target, dryRun, onStep, force);
                         break;
                     case "export-skills":
                         if (target === "global") {
@@ -129,7 +129,7 @@ export default function Plugin({ action, target, dryRun, codex = false, }) {
             setDone(true);
         };
         run();
-    }, [action, target, dryRun]);
+    }, [action, target, dryRun, force]);
     return (React.createElement(Box, { flexDirection: "column", padding: 1 },
         React.createElement(Box, { marginBottom: 1 },
             React.createElement(Text, { bold: true, color: theme.primary }, "javi-forge"),

package/dist/ui/Skills.js

@@ -66,13 +66,18 @@ export default function Skills({ mode, budget, deep, skillsDir }) {
                         result.budget.budget,
                         " tokens",
                         result.budget.overBudget ? " (OVER BUDGET)" : "")),
-                result.budget.entries.map((entry) => (React.createElement(Box, { key: entry.skillName, marginLeft: 4 },
-                    React.createElement(Text, { color: theme.muted }, entry.skillName),
-                    React.createElement(Text, { color: theme.muted, dimColor: true },
-                        "  ",
-                        "~",
-                        entry.tokens,
-                        " tokens")))),
+                result.budget.entries.map((entry) => (React.createElement(Box, { key: entry.skillName, flexDirection: "column", marginLeft: 4 },
+                    React.createElement(Box, null,
+                        React.createElement(Text, { color: entry.note ? theme.warning : theme.muted }, entry.skillName),
+                        React.createElement(Text, { color: theme.muted, dimColor: true },
+                            "  ",
+                            "~",
+                            entry.tokens,
+                            " tokens")),
+                    entry.note && (React.createElement(Box, { marginLeft: 2 },
+                        React.createElement(Text, { color: theme.warning },
+                            "! ",
+                            entry.note)))))),
                 result.budget.suggestions.map((s, i) => (React.createElement(Box, { key: `suggestion-${i}`, marginLeft: 4 },
                     React.createElement(Text, { color: theme.warning },
                         "! ",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.26.0",
+	"version": "1.28.0",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {
@@ -85,12 +85,16 @@
 		"overrides": {
 			"handlebars": "^4.7.9",
 			"picomatch": "^4.0.4",
-			"brace-expansion": "^5.0.5",
+			"brace-expansion": "^5.0.9",
 			"lodash": "^4.18.0",
 			"lodash-es": "^4.18.0",
-			"fast-uri": "^3.1.2",
-			"postcss": "^8.5.10",
-			"vite": "^8.0.5"
+			"fast-uri": "^3.1.5",
+			"postcss": "^8.5.18",
+			"vite": "^8.0.16",
+			"js-yaml": "^4.3.1",
+			"nanoid": "^3.3.17",
+			"undici": "^7.29.0",
+			"ws": "^8.21.0"
 		}
 	}
 }