skills-doctor 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -6,6 +6,32 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-07-05
+
+### Added
+
+- Added static eval file validation for malformed or weak `evals/evals.json` files, including invalid JSON, invalid shape, missing prompts, missing expected output, weak assertions, and missing baseline guidance.
+- Added local/global same-name skill shadowing warnings so users can see when a project skill likely overrides a user-level skill.
+- Added deeper static script-interface findings for missing implementation help support, undocumented structured output, missing stderr diagnostics guidance, and potentially unbounded script output.
+
+### Fixed
+
+- Aligned the packaged `skills-doctor` Agent Skill wrapper with scanner standards by using installed CLI commands and adding realistic wrapper evals.
+
+## [0.6.1] - 2026-07-05
+
+### Changed
+
+- Updated repair handoff prompts to tell agents that findings are static analyzer diagnostics and should be judged for real issues or false positives before editing.
+
+### Fixed
+
+- Cleared React Doctor JSON deep-clone warnings in report-shape tests by using `structuredClone`.
+- Cleared React Doctor warnings for immutable sorting helpers, independent Codex usage pressure reads, and security detector patterns that were mistaken for plugin updater execution.
+- Cleared React Doctor performance warnings by parallelizing independent filesystem reads and combining redundant array passes in scan, usage, report, and rule helpers.
+- Required package-level secret exfiltration findings to connect secret-read and network-egress facts from the same artifact, and included all related chain capabilities in the finding summary.
+- Reduced security false positives for prompt-injection text that appears as negated guidance, quoted examples, anti-patterns, or research notes while preserving operational prompt override, exfiltration, remote execution, and destructive-command findings.
+
 ## [0.6.0] - 2026-07-04
 
 ### Added

package/README.md

@@ -40,13 +40,13 @@ Skills Doctor is also available as an agent-facing skill wrapper at `skills/skil
 
 Use the `skills-doctor` skill when people ask for an agent workflow to:
 
-- audit skills with `npx skills-doctor@latest --json` for deterministic, machine-readable output.
-- launch interactive repair handoff through `npx skills-doctor@latest` after explicit consent.
+- audit skills with `skills-doctor --json` for deterministic, machine-readable output.
+- launch interactive repair handoff through `skills-doctor` after explicit consent.
 
 The CLI is the primary source of rule logic and output shape.
 The skill wrapper is a convenience entrypoint so agents can discover and invoke the same scanner from within skill workflows.
 When installed from npm, the wrapper is shipped at `node_modules/skills-doctor/skills/skills-doctor/SKILL.md`.
-Copy or reference that file from an agent skill directory when you want an agent to discover the workflow, but keep scans delegated to `npx skills-doctor@latest` or the installed `skills-doctor` binary.
+Copy or reference that file from an agent skill directory when you want an agent to discover the workflow, but keep scans delegated to the installed `skills-doctor` binary.
 
 ## What It Scans
 
@@ -85,8 +85,9 @@ the Agent Skills standards from <https://agentskills.io/home>, including:
 - non-generic skill bodies with concrete workflow structure
 - progressive disclosure for large or referenced material
 - referenced `references/`, `scripts/`, and `assets/` files
-- script guidance that is non-interactive and reproducible
-- eval guidance for non-trivial skills
+- script guidance that is non-interactive, reproducible, documented, and bounded
+- eval file quality for non-trivial skills, including JSON shape, realistic prompts, expected outputs, assertions, and baseline guidance
+- local/global same-name skills where project-level skills likely shadow user-level skills
 - divergent same-name skills across Claude and Codex/agents roots
 - suspicious security patterns across the skill package, including prompt
   override, permission bypass, secret access, exfiltration chains, destructive
@@ -230,6 +231,12 @@ Codex prompts or assistant transcript text.
 
 ## Release Checklist
 
+Refresh the consolidated upstream Agent Skills reference when source docs change:
+
+```bash
+node scripts/build-agentskills-unified-doc.mjs
+```
+
 Before tagging a release:
 
 ```bash

package/dist/cli/utils/launch-agent.d.ts

@@ -1,5 +1,5 @@
 import type { PromptAdapter } from "./prompts.js";
-export declare const REPAIR_AGENT_IDS: readonly ["claude", "codex"];
+declare const REPAIR_AGENT_IDS: readonly ["claude", "codex"];
 export type RepairAgentId = (typeof REPAIR_AGENT_IDS)[number];
 export type CommandInvocation = {
     readonly command: string;
@@ -30,4 +30,5 @@ export type SpawnInvocationOptions = {
 };
 export declare const buildRepairAgentSpawnInvocation: (agentId: RepairAgentId, prompt: string, options?: SpawnInvocationOptions) => CommandInvocation;
 export declare const launchRepairAgent: RepairAgentLauncher;
+export {};
 //# sourceMappingURL=launch-agent.d.ts.map

package/dist/cli/utils/launch-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launch-agent.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/launch-agent.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,eAAO,MAAM,gBAAgB,8BAA+B,CAAC;AAE7D,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACrF,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,KACR,OAAO,CAAC,MAAM,CAAC,CAAC;AAiBrB,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,UAAS,yBAA8B,KACtC,OAAO,CAAC,SAAS,WAAW,EAAE,CAUhC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,OAAO,sBAAsB,KAC5B,OAAO,CAAC,WAAW,GAAG,SAAS,CA2CjC,CAAC;AAEF,eAAO,MAAM,0BAA0B,GACrC,SAAS,aAAa,EACtB,QAAQ,MAAM,KACb,iBAMF,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAI,SAAS,aAAa,KAAG,MAGjE,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;CACjD,CAAC;AAEF,eAAO,MAAM,+BAA+B,GAC1C,SAAS,aAAa,EACtB,QAAQ,MAAM,EACd,UAAS,sBAA2B,KACnC,iBAWF,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,mBAO/B,CAAC"}
+{"version":3,"file":"launch-agent.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/launch-agent.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,QAAA,MAAM,gBAAgB,8BAA+B,CAAC;AAEtD,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACrF,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,KACR,OAAO,CAAC,MAAM,CAAC,CAAC;AAiBrB,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,UAAS,yBAA8B,KACtC,OAAO,CAAC,SAAS,WAAW,EAAE,CAUhC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,OAAO,sBAAsB,KAC5B,OAAO,CAAC,WAAW,GAAG,SAAS,CA2CjC,CAAC;AAEF,eAAO,MAAM,0BAA0B,GACrC,SAAS,aAAa,EACtB,QAAQ,MAAM,KACb,iBAMF,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAI,SAAS,aAAa,KAAG,MAGjE,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;CACjD,CAAC;AAEF,eAAO,MAAM,+BAA+B,GAC1C,SAAS,aAAa,EACtB,QAAQ,MAAM,EACd,UAAS,sBAA2B,KACnC,iBAWF,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,mBAO/B,CAAC"}

package/dist/cli/utils/launch-agent.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { BackToMainMenuError, CliInputError } from "./handle-error.js";
 import { isCommandAvailable } from "./is-command-available.js";
 import { BACK_TO_MAIN_MENU_VALUE, backToMainMenuChoice } from "./prompts.js";
-export const REPAIR_AGENT_IDS = ["claude", "codex"];
+const REPAIR_AGENT_IDS = ["claude", "codex"];
 const REPAIR_AGENT_CONFIG = {
     claude: {
         id: "claude",

package/dist/domain/analyze-skill-usage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-skill-usage.d.ts","sourceRoot":"","sources":["../../src/domain/analyze-skill-usage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AACnF,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9D,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,QAAQ,GACR,mBAAmB,GACnB,qBAAqB,GACrB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACjE,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,QAAQ,CAAC,eAAe,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACjE,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxD,CAAC;AAoBF,eAAO,MAAM,iBAAiB,GAC5B,OAAO,sBAAsB,KAC5B,OAAO,CAAC,kBAAkB,CA6C5B,CAAC"}
+{"version":3,"file":"analyze-skill-usage.d.ts","sourceRoot":"","sources":["../../src/domain/analyze-skill-usage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AACnF,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9D,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,QAAQ,GACR,mBAAmB,GACnB,qBAAqB,GACrB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACjE,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,QAAQ,CAAC,eAAe,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACjE,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxD,CAAC;AAoBF,eAAO,MAAM,iBAAiB,GAC5B,OAAO,sBAAsB,KAC5B,OAAO,CAAC,kBAAkB,CAkE5B,CAAC"}

package/dist/domain/analyze-skill-usage.js

@@ -11,18 +11,36 @@ export const analyzeSkillUsage = async (input) => {
     const phraseMap = buildPhraseMap(catalog);
     const events = [];
     let readableSourceCount = 0;
-    for (const sourcePath of sourcePaths) {
-        const content = await readFile(sourcePath, "utf8").catch((error) => {
+    const sourceContents = await Promise.all(sourcePaths.map(async (sourcePath) => {
+        try {
+            return { sourcePath, content: await readFile(sourcePath, "utf8") };
+        }
+        catch (error) {
+            return {
+                sourcePath,
+                diagnostic: {
+                    code: "usage-source-unreadable",
+                    severity: "warning",
+                    message: error instanceof Error ? error.message : `Unable to read ${sourcePath}`,
+                    path: sourcePath,
+                },
+            };
+        }
+    }));
+    for (const { sourcePath, content, diagnostic } of sourceContents) {
+        if (diagnostic !== undefined) {
+            diagnostics.push(diagnostic);
+            continue;
+        }
+        if (content === undefined) {
             diagnostics.push({
                 code: "usage-source-unreadable",
                 severity: "warning",
-                message: error instanceof Error ? error.message : `Unable to read ${sourcePath}`,
+                message: `Unable to read ${sourcePath}`,
                 path: sourcePath,
             });
-            return undefined;
-        });
-        if (content === undefined)
             continue;
+        }
         readableSourceCount += 1;
         events.push(...parseUsageSource({ sourcePath, content, aliasMap, phraseMap, diagnostics }));
     }
@@ -302,8 +320,14 @@ const extractAssistantText = (record) => {
 const collectText = (value) => {
     if (typeof value === "string")
         return value;
-    if (Array.isArray(value))
-        return value.map(collectText).filter(Boolean).join("\n");
+    if (Array.isArray(value)) {
+        return value
+            .flatMap((item) => {
+            const text = collectText(item);
+            return text ? [text] : [];
+        })
+            .join("\n");
+    }
     if (!isRecord(value))
         return "";
     return collectText(value.text ?? value.content);
@@ -404,7 +428,12 @@ const duplicateSkillNames = (catalog) => {
     for (const skill of catalog) {
         counts.set(skill.skillName, (counts.get(skill.skillName) ?? 0) + 1);
     }
-    return new Set([...counts.entries()].filter(([, count]) => count > 1).map(([skillName]) => skillName));
+    const duplicateNames = new Set();
+    for (const [skillName, count] of counts) {
+        if (count > 1)
+            duplicateNames.add(skillName);
+    }
+    return duplicateNames;
 };
 const compareUsageSummaries = (left, right) => {
     const usageDifference = right.usageCount - left.usageCount;

package/dist/domain/build-handoff-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-handoff-prompt.d.ts","sourceRoot":"","sources":["../../src/domain/build-handoff-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,OAAO,EAAa,MAAM,YAAY,CAAC;AAKrD,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,OAAO,uBAAuB,KAAG,MA2EnE,CAAC"}
+{"version":3,"file":"build-handoff-prompt.d.ts","sourceRoot":"","sources":["../../src/domain/build-handoff-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,OAAO,EAAa,MAAM,YAAY,CAAC;AAKrD,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,OAAO,uBAAuB,KAAG,MA8EnE,CAAC"}

package/dist/domain/build-handoff-prompt.js

@@ -20,7 +20,7 @@ export const buildHandoffPrompt = (input) => {
     else {
         lines.push("Full findings report: unavailable; use the inline findings below.");
     }
-    lines.push("", "Repair rules grounded in docs/SKILLS_SPEC.md:", "- Preserve unrelated user changes and existing skill intent.", "- Edit skill files directly; do not invent new requirements outside the skill spec.", "- Keep SKILL.md concise and move large examples, scripts, and references into progressively disclosed files.", "- Ensure frontmatter has a valid kebab-case name and a specific trigger-oriented description.", "- Make referenced resources/scripts real, deterministic, non-interactive by default, and safe for agents.", "- Verify by rerunning `skills-doctor` or an equivalent scan after edits.", "", "Top grouped findings:");
+    lines.push("", "Repair rules grounded in docs/SKILLS_SPEC.md:", "- Treat findings as static analyzer diagnostics, not definitive proof that the skill is broken or malicious.", "- Use judgment before editing: inspect the cited files, evidence, confidence, rationale, and counterevidence, then decide whether each finding is real, partially applicable, or a false positive.", "- Fix real issues with the smallest skill-spec-aligned change; leave likely false positives or intentionally acceptable patterns unchanged and explain that decision in your final report.", "- Preserve unrelated user changes and existing skill intent.", "- Edit skill files directly; do not invent new requirements outside the skill spec.", "- Keep SKILL.md concise and move large examples, scripts, and references into progressively disclosed files.", "- Ensure frontmatter has a valid kebab-case name and a specific trigger-oriented description.", "- Make referenced resources/scripts real, deterministic, non-interactive by default, and safe for agents.", "- Verify by rerunning `skills-doctor` or an equivalent scan after edits.", "", "Top grouped findings:");
     for (const [index, group] of groups.entries()) {
         lines.push("", `${index + 1}. ${group.skillLabel} (${group.findings.length} finding${group.findings.length === 1 ? "" : "s"})`, `   File: ${group.skillPath}`);
         for (const finding of group.findings.slice(0, MAX_INLINE_FINDINGS_PER_GROUP)) {
@@ -56,7 +56,7 @@ const groupFindingsBySkill = (findings) => {
         right.findings.length - left.findings.length ||
         left.skillPath.localeCompare(right.skillPath));
 };
-const sortFindings = (findings) => [...findings].sort((left, right) => severityScore(right) - severityScore(left) ||
+const sortFindings = (findings) => findings.toSorted((left, right) => severityScore(right) - severityScore(left) ||
     left.skillPath.localeCompare(right.skillPath) ||
     left.ruleId.localeCompare(right.ruleId));
 const severityScore = (finding) => {

package/dist/domain/build-report.js

@@ -11,6 +11,11 @@ export const buildScanReport = (input) => {
     const diagnosticErrorCount = countDiagnosticSeverity(input.scan.diagnostics, "error");
     const hasErrorDiagnostics = diagnosticErrorCount > 0;
     const qualityFindingsBySkillPath = indexFindingsBySkillPath(qualityFindings);
+    const diagnosticErrorCodes = [];
+    for (const diagnostic of input.scan.diagnostics) {
+        if (diagnostic.severity === "error")
+            diagnosticErrorCodes.push(diagnostic.code);
+    }
     return {
         schemaVersion: 1,
         ok: errorCount === 0 && !hasErrorDiagnostics,
@@ -28,11 +33,7 @@ export const buildScanReport = (input) => {
         errorCount,
         warningCount,
         adviceCount,
-        score: calculateScore(scoreFindings, {
-            diagnosticErrorCodes: input.scan.diagnostics
-                .filter((diagnostic) => diagnostic.severity === "error")
-                .map((diagnostic) => diagnostic.code),
-        }),
+        score: calculateScore(scoreFindings, { diagnosticErrorCodes }),
         skills: input.scan.skills.map((skill) => {
             const skillFindings = qualityFindingsBySkillPath.get(skill.skillPath) ?? [];
             return {

package/dist/domain/discover-skill-artifacts.js

@@ -43,46 +43,47 @@ const readRootSymlinkArtifact = async (skill, rootRealPath) => {
     };
 };
 const walkSkillArtifacts = async (skillDir, rootRealPath) => {
-    const artifacts = [];
     const visitedDirectories = new Set();
     const walk = async (directoryPath) => {
         const directoryRealPath = await realpath(directoryPath).catch(() => undefined);
         if (directoryRealPath !== undefined) {
             if (visitedDirectories.has(directoryRealPath))
-                return;
+                return [];
             visitedDirectories.add(directoryRealPath);
         }
         const entries = await readdir(directoryPath, { withFileTypes: true }).catch(() => []);
-        const sortedEntries = [...entries].sort((left, right) => left.name.localeCompare(right.name));
-        for (const entry of sortedEntries) {
+        const sortedEntries = entries.toSorted((left, right) => left.name.localeCompare(right.name));
+        const artifactsByEntry = await Promise.all(sortedEntries.map(async (entry) => {
             if (IGNORED_DIRECTORY_NAMES.has(entry.name))
-                continue;
+                return [];
+            const entryArtifacts = [];
             const artifactPath = path.join(directoryPath, entry.name);
             const relativePath = normalizeRelativePath(path.relative(skillDir, artifactPath));
             const artifact = await readArtifact(skillDir, rootRealPath, artifactPath, relativePath);
             if (artifact !== undefined)
-                artifacts.push(artifact);
+                entryArtifacts.push(artifact);
             const entryStats = await lstat(artifactPath).catch(() => undefined);
             if (entryStats === undefined)
-                continue;
+                return entryArtifacts;
             if (entryStats.isDirectory()) {
-                await walk(artifactPath);
-                continue;
+                entryArtifacts.push(...(await walk(artifactPath)));
+                return entryArtifacts;
             }
             if (!entryStats.isSymbolicLink())
-                continue;
+                return entryArtifacts;
             const targetRealPath = await realpath(artifactPath).catch(() => undefined);
             if (targetRealPath !== undefined &&
                 rootRealPath !== undefined &&
                 isPathInside(rootRealPath, targetRealPath)) {
                 const targetStats = await stat(artifactPath).catch(() => undefined);
                 if (targetStats?.isDirectory() === true)
-                    await walk(artifactPath);
+                    entryArtifacts.push(...(await walk(artifactPath)));
             }
-        }
+            return entryArtifacts;
+        }));
+        return artifactsByEntry.flat();
     };
-    await walk(skillDir);
-    return artifacts;
+    return walk(skillDir);
 };
 const readArtifact = async (skillDir, rootRealPath, artifactPath, relativePath) => {
     const stats = await lstat(artifactPath).catch(() => undefined);

package/dist/domain/discover-skill-roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover-skill-roots.d.ts","sourceRoot":"","sources":["../../src/domain/discover-skill-roots.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACxD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,OAAO,uBAAuB,KAC7B,OAAO,CAAC,wBAAwB,CAmDlC,CAAC"}
+{"version":3,"file":"discover-skill-roots.d.ts","sourceRoot":"","sources":["../../src/domain/discover-skill-roots.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACxD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,OAAO,uBAAuB,KAC7B,OAAO,CAAC,wBAAwB,CAqDlC,CAAC"}

package/dist/domain/discover-skill-roots.js

@@ -30,15 +30,16 @@ export const discoverSkillRoots = async (input) => {
             source: "custom",
         })),
     ];
+    const candidatesWithStatus = await Promise.all(candidates.map(async (candidate) => ({
+        candidate,
+        exists: await isDirectory(candidate.rootPath),
+    })));
     const roots = [];
     const diagnostics = [];
-    for (const candidate of candidates) {
-        const exists = await isDirectory(candidate.rootPath);
-        if (exists) {
+    for (const { candidate, exists } of candidatesWithStatus) {
+        if (exists)
             roots.push(candidate);
-            continue;
-        }
-        if (candidate.source === "custom") {
+        else if (candidate.source === "custom") {
             diagnostics.push({
                 code: "skill-root-not-found",
                 severity: "warning",

package/dist/domain/discover-usage-sources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover-usage-sources.d.ts","sourceRoot":"","sources":["../../src/domain/discover-usage-sources.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAEzE,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;CACtB,KAAK,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAC;AAE3C,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;CACjD,CAAC;AAaF,eAAO,MAAM,oBAAoB,GAC/B,QAAO,yBAA8B,KACpC,OAAO,CAAC,0BAA0B,CA4CpC,CAAC"}
+{"version":3,"file":"discover-usage-sources.d.ts","sourceRoot":"","sources":["../../src/domain/discover-usage-sources.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAEzE,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;CACtB,KAAK,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAC;AAE3C,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;CACjD,CAAC;AAaF,eAAO,MAAM,oBAAoB,GAC/B,QAAO,yBAA8B,KACpC,OAAO,CAAC,0BAA0B,CAiDpC,CAAC"}

package/dist/domain/discover-usage-sources.js

@@ -22,17 +22,22 @@ export const discoverUsageSources = async (input = {}) => {
         ...sessionFiles.map((candidate) => candidate.filePath),
         ...(historyFile === undefined ? [] : [historyFile.filePath]),
     ];
-    const jsonlPressure = await detectJsonlPressure({
-        files: [...sessionFiles, ...(historyFile === undefined ? [] : [historyFile])],
-        maxFileBytes,
-        diagnostics,
-    });
-    const sqlitePressure = await readSqlitePressure({
-        sqlitePath,
-        since,
-        readSqlitePressure: input.readSqlitePressure,
-        diagnostics,
-    });
+    const jsonlDiagnostics = [];
+    const sqliteDiagnostics = [];
+    const [jsonlPressure, sqlitePressure] = await Promise.all([
+        detectJsonlPressure({
+            files: [...sessionFiles, ...(historyFile === undefined ? [] : [historyFile])],
+            maxFileBytes,
+            diagnostics: jsonlDiagnostics,
+        }),
+        readSqlitePressure({
+            sqlitePath,
+            since,
+            readSqlitePressure: input.readSqlitePressure,
+            diagnostics: sqliteDiagnostics,
+        }),
+    ]);
+    diagnostics.push(...jsonlDiagnostics, ...sqliteDiagnostics);
     return {
         usageSourcePaths,
         diagnostics,
@@ -57,20 +62,16 @@ const findJsonlFiles = async (input) => {
     });
     if (entries === undefined)
         return [];
-    const files = [];
-    for (const entry of entries) {
+    const filesByEntry = await Promise.all(entries.map(async (entry) => {
         const entryPath = path.join(input.directory, entry.name);
-        if (entry.isDirectory()) {
-            files.push(...(await findJsonlFiles({ ...input, directory: entryPath })));
-            continue;
-        }
+        if (entry.isDirectory())
+            return findJsonlFiles({ ...input, directory: entryPath });
         if (!entry.isFile() || !entry.name.endsWith(".jsonl"))
-            continue;
+            return [];
         const candidate = await fileIfExists(entryPath, input.since, input.diagnostics);
-        if (candidate !== undefined)
-            files.push(candidate);
-    }
-    return files.sort(compareCandidateFiles);
+        return candidate === undefined ? [] : [candidate];
+    }));
+    return filesByEntry.flat().sort(compareCandidateFiles);
 };
 const fileIfExists = async (filePath, since, diagnostics) => {
     const stats = await stat(filePath).catch((error) => {
@@ -100,9 +101,7 @@ const fileIfExists = async (filePath, since, diagnostics) => {
     return { filePath, modifiedAt: stats.mtime };
 };
 const detectJsonlPressure = async (input) => {
-    let warningCount = 0;
-    const warningTimestamps = [];
-    for (const file of input.files) {
+    const pressureByFile = await Promise.all(input.files.map(async (file) => {
         const content = await readTail(file.filePath, input.maxFileBytes).catch((error) => {
             input.diagnostics.push({
                 code: "usage-source-unreadable",
@@ -113,7 +112,9 @@ const detectJsonlPressure = async (input) => {
             return undefined;
         });
         if (content === undefined)
-            continue;
+            return { warningCount: 0, warningTimestamps: [] };
+        let warningCount = 0;
+        const warningTimestamps = [];
         for (const line of content.split(/\r?\n/)) {
             if (!line.includes(CONTEXT_BUDGET_WARNING))
                 continue;
@@ -122,6 +123,13 @@ const detectJsonlPressure = async (input) => {
             if (timestamp !== undefined)
                 warningTimestamps.push(timestamp);
         }
+        return { warningCount, warningTimestamps };
+    }));
+    let warningCount = 0;
+    const warningTimestamps = [];
+    for (const pressure of pressureByFile) {
+        warningCount += pressure.warningCount;
+        warningTimestamps.push(...pressure.warningTimestamps);
     }
     return {
         warningCount,

package/dist/domain/read-codex-disabled-skill-config.js

@@ -95,8 +95,8 @@ export const parseCodexDisabledSkillConfig = (content) => {
     }
     flush();
     return {
-        paths: [...disabledPaths].sort((left, right) => left.localeCompare(right)),
-        names: [...disabledNames].sort((left, right) => left.localeCompare(right)),
+        paths: Array.from(disabledPaths).toSorted((left, right) => left.localeCompare(right)),
+        names: Array.from(disabledNames).toSorted((left, right) => left.localeCompare(right)),
     };
 };
 export const normalizeSkillPath = (skillPath) => path.resolve(skillPath);

package/dist/domain/rule-catalog.d.ts

@@ -181,6 +181,26 @@ export declare const ruleCatalog: readonly [{
     readonly severity: "warning";
     readonly categories: readonly ["scripts"];
     readonly description: "Referenced script has risky operations without safety flags.";
+}, {
+    readonly ruleId: "script-implementation-without-help";
+    readonly severity: "advice";
+    readonly categories: readonly ["scripts"];
+    readonly description: "Skill guidance mentions --help but the referenced script lacks apparent help support.";
+}, {
+    readonly ruleId: "script-output-contract-missing";
+    readonly severity: "advice";
+    readonly categories: readonly ["scripts"];
+    readonly description: "Structured script output is not documented in nearby skill guidance.";
+}, {
+    readonly ruleId: "script-diagnostics-channel-missing";
+    readonly severity: "advice";
+    readonly categories: readonly ["scripts"];
+    readonly description: "Structured-output script guidance does not separate diagnostics from data.";
+}, {
+    readonly ruleId: "script-output-unbounded";
+    readonly severity: "advice";
+    readonly categories: readonly ["scripts"];
+    readonly description: "Script guidance or implementation suggests large output without bounds.";
 }, {
     readonly ruleId: "unpinned-package-runner";
     readonly severity: "advice";
@@ -201,6 +221,41 @@ export declare const ruleCatalog: readonly [{
     readonly severity: "advice";
     readonly categories: readonly ["evals"];
     readonly description: "Non-trivial skill lacks evals/evals.json.";
+}, {
+    readonly ruleId: "invalid-evals-json";
+    readonly severity: "warning";
+    readonly categories: readonly ["evals"];
+    readonly description: "evals/evals.json is unreadable or not valid JSON.";
+}, {
+    readonly ruleId: "invalid-evals-shape";
+    readonly severity: "warning";
+    readonly categories: readonly ["evals"];
+    readonly description: "evals/evals.json lacks required root fields or valid eval case shape.";
+}, {
+    readonly ruleId: "eval-missing-prompt";
+    readonly severity: "warning";
+    readonly categories: readonly ["evals"];
+    readonly description: "An eval case lacks a non-empty realistic prompt.";
+}, {
+    readonly ruleId: "eval-missing-expected-output";
+    readonly severity: "warning";
+    readonly categories: readonly ["evals"];
+    readonly description: "An eval case lacks a concrete expected_output.";
+}, {
+    readonly ruleId: "eval-weak-assertions";
+    readonly severity: "warning";
+    readonly categories: readonly ["evals"];
+    readonly description: "Eval assertions are empty, malformed, or too vague.";
+}, {
+    readonly ruleId: "eval-missing-baseline-guidance";
+    readonly severity: "advice";
+    readonly categories: readonly ["evals"];
+    readonly description: "Mature eval material lacks baseline or previous-version comparison guidance.";
+}, {
+    readonly ruleId: "local-global-skill-shadowing";
+    readonly severity: "warning";
+    readonly categories: readonly ["portability"];
+    readonly description: "A global skill is likely shadowed by a same-name project-local skill.";
 }, {
     readonly ruleId: "SKILL001_PROMPT_OVERRIDE";
     readonly severity: "warning";

package/dist/domain/rule-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule-catalog.d.ts","sourceRoot":"","sources":["../../src/domain/rule-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6YwB,CAAC"}
+{"version":3,"file":"rule-catalog.d.ts","sourceRoot":"","sources":["../../src/domain/rule-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgdwB,CAAC"}

package/dist/domain/rule-catalog.js

@@ -209,6 +209,30 @@ export const ruleCatalog = [
         categories: ["scripts"],
         description: "Referenced script has risky operations without safety flags.",
     },
+    {
+        ruleId: "script-implementation-without-help",
+        severity: "advice",
+        categories: ["scripts"],
+        description: "Skill guidance mentions --help but the referenced script lacks apparent help support.",
+    },
+    {
+        ruleId: "script-output-contract-missing",
+        severity: "advice",
+        categories: ["scripts"],
+        description: "Structured script output is not documented in nearby skill guidance.",
+    },
+    {
+        ruleId: "script-diagnostics-channel-missing",
+        severity: "advice",
+        categories: ["scripts"],
+        description: "Structured-output script guidance does not separate diagnostics from data.",
+    },
+    {
+        ruleId: "script-output-unbounded",
+        severity: "advice",
+        categories: ["scripts"],
+        description: "Script guidance or implementation suggests large output without bounds.",
+    },
     {
         ruleId: "unpinned-package-runner",
         severity: "advice",
@@ -233,6 +257,48 @@ export const ruleCatalog = [
         categories: ["evals"],
         description: "Non-trivial skill lacks evals/evals.json.",
     },
+    {
+        ruleId: "invalid-evals-json",
+        severity: "warning",
+        categories: ["evals"],
+        description: "evals/evals.json is unreadable or not valid JSON.",
+    },
+    {
+        ruleId: "invalid-evals-shape",
+        severity: "warning",
+        categories: ["evals"],
+        description: "evals/evals.json lacks required root fields or valid eval case shape.",
+    },
+    {
+        ruleId: "eval-missing-prompt",
+        severity: "warning",
+        categories: ["evals"],
+        description: "An eval case lacks a non-empty realistic prompt.",
+    },
+    {
+        ruleId: "eval-missing-expected-output",
+        severity: "warning",
+        categories: ["evals"],
+        description: "An eval case lacks a concrete expected_output.",
+    },
+    {
+        ruleId: "eval-weak-assertions",
+        severity: "warning",
+        categories: ["evals"],
+        description: "Eval assertions are empty, malformed, or too vague.",
+    },
+    {
+        ruleId: "eval-missing-baseline-guidance",
+        severity: "advice",
+        categories: ["evals"],
+        description: "Mature eval material lacks baseline or previous-version comparison guidance.",
+    },
+    {
+        ruleId: "local-global-skill-shadowing",
+        severity: "warning",
+        categories: ["portability"],
+        description: "A global skill is likely shadowed by a same-name project-local skill.",
+    },
     {
         ruleId: "SKILL001_PROMPT_OVERRIDE",
         severity: "warning",

package/dist/domain/rules/quality.d.ts

@@ -4,6 +4,19 @@ export type QualityRuleOptions = {
     readonly resourceExists?: ((skill: SkillRecord, referencePath: string) => Promise<boolean>) | undefined;
     readonly resourceStatus?: ((skill: SkillRecord, referencePath: string) => Promise<ResourceStatus>) | undefined;
     readonly evalsExist?: ((skill: SkillRecord) => Promise<boolean>) | undefined;
+    readonly inspectEvals?: ((skill: SkillRecord) => Promise<EvalInspection>) | undefined;
+};
+export type EvalInspection = {
+    readonly status: "missing";
+} | {
+    readonly status: "unreadable";
+    readonly message: string;
+} | {
+    readonly status: "invalid-json";
+    readonly message: string;
+} | {
+    readonly status: "valid";
+    readonly value: unknown;
 };
 export declare const validateQualityRules: (skills: readonly SkillRecord[], options?: QualityRuleOptions) => Promise<Finding[]>;
 //# sourceMappingURL=quality.d.ts.map