fix(code-tools): audit skills redo discovery when the focus names another tree; v0.16.1

plugins/code-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "clownware-code-tools",
   "description": "Universal dev workflow skills: architecture/deployment-readiness auditing, security auditing, test-suite auditing, skill auditing, design-system auditing, accessibility auditing, dependency auditing, performance auditing, devops/CI-CD auditing, audit-fix application, plugin releasing, skill validation, ADR authoring, PR descriptions, root-cause debugging, test scaffolding, and GitHits OSS research conventions. Each skill probes the repo it runs in and degrades gracefully. Also ships a git guard hook: blocks --no-verify commits/pushes and secret-scans staged changes (gitleaks, with a pattern fallback) before every commit. And a format-on-edit dispatcher hook: one process per edit, routed by extension to Biome (biome.json-gated), goimports/gofmt, templ fmt or rustfmt.",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "license": "Apache-2.0",
   "author": {
     "name": "clownware"

plugins/code-tools/skills/a11y-audit/SKILL.md

@@ -12,6 +12,10 @@ Audit this repository's functional accessibility. Focus, if given: $ARGUMENTS
 **Framework hints:** !`out=$(grep -lE '"react"|"preact"|"vue"|"svelte"' package.json 2>/dev/null; find . -maxdepth 2 -name "*.jsx" -o -maxdepth 2 -name "*.vue" 2>/dev/null | head -1); echo "${out:-plain HTML or undetected — sweep both attribute spellings}"`
 **Interactive-handler density:** !`out=$(grep -rlE 'onClick|onclick=|@click|on:click' --include='*.html' --include='*.jsx' --include='*.tsx' --include='*.vue' --include='*.svelte' --include='*.astro' --include='*.templ' . 2>/dev/null | grep -v node_modules | head -8); echo "${out:-none found}"`
 
+The pre-fetch above ran in the session's working directory. If the focus names a different
+repo or directory, it describes the wrong tree: rerun those probes from that path and audit
+that tree instead.
+
 ## Scope
 
 This skill owns **functional** accessibility. Color contrast is design-audit's job —

plugins/code-tools/skills/arch-audit/SKILL.md

@@ -15,6 +15,10 @@ Audit this repository's architecture decisions and readiness. Focus, if given: $
 **Default branch:** !`b=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|.*/||'); [ -n "$b" ] || b=$(git branch --show-current 2>/dev/null); echo "${b:-unknown}"`
 **Deploy config:** !`ls Dockerfile docker-compose.yml fly.toml render.yaml wrangler.toml vercel.json 2>/dev/null || echo "none"`
 
+The pre-fetch above ran in the session's working directory. If the focus names a different
+repo or directory, it describes the wrong tree: rerun those probes from that path and audit
+that tree instead.
+
 ## Pipeline
 
 ### 1. Three-lens fan-out

plugins/code-tools/skills/deps-audit/SKILL.md

@@ -12,6 +12,10 @@ Audit this repository's dependencies. Focus, if given: $ARGUMENTS
 **Lockfiles:** !`out=$(find . -maxdepth 3 \( -name package-lock.json -o -name pnpm-lock.yaml -o -name yarn.lock -o -name bun.lockb -o -name poetry.lock -o -name uv.lock -o -name go.sum -o -name Cargo.lock -o -name Gemfile.lock \) -not -path "*/node_modules/*" -not -path "*/.git/*" 2>/dev/null | head -8); echo "${out:-none — every manifest is unpinned (itself a finding)}"`
 **Network:** !`if curl -s -m 4 -o /dev/null -w "%{http_code}" https://registry.npmjs.org/ 2>/dev/null | grep -q "200"; then echo "available — registry freshness + OSV advisories in scope"; else echo "unavailable — freshness/advisories become unverified coverage, not findings"; fi`
 
+The pre-fetch above ran in the session's working directory. If the focus names a different
+repo or directory, it describes the wrong tree: rerun those probes from that path and audit
+that tree instead.
+
 ## Scope
 
 Everything here reads; nothing installs, updates, or removes. Findings must hold

plugins/code-tools/skills/design-audit/SKILL.md

@@ -14,6 +14,10 @@ Audit the design system in this repository. Focus, if given: $ARGUMENTS
 **Theme scopes:** !`out=$(grep -rlE 'data-theme|prefers-color-scheme|\.dark\b|\.light\b|\.on-dark\b' --include='*.css' . 2>/dev/null | grep -v node_modules | head -5); echo "${out:-single theme}"`
 **Specimen/preview pages:** !`out=$(find . \( -name "*.card.html" -o -name "*.stories.*" -o -iname "*specimen*" \) -not -path "*/node_modules/*" 2>/dev/null | head -8); echo "${out:-none found}"`
 
+The pre-fetch above ran in the session's working directory. If the focus names a different
+repo or directory, it describes the wrong tree: rerun those probes from that path and audit
+that tree instead.
+
 ## Pipeline
 
 ### 1. Learn the system's own laws

plugins/code-tools/skills/devops-audit/SKILL.md

@@ -13,6 +13,10 @@ Audit this repository's CI/CD and deploy surface. Focus, if given: $ARGUMENTS
 **Update automation:** !`out=$(ls .github/dependabot.yml .github/dependabot.yaml renovate.json .github/renovate.json 2>/dev/null | head -2); echo "${out:-none — no dependency-update automation (finding candidate, severity by repo activity)}"`
 **Local gates:** !`out=$({ [ -d .husky ] && echo ".husky/ present"; ls Taskfile.yml Makefile 2>/dev/null; grep -oE "\"(quality|ci|check)[^\"]*\"[[:space:]]*:" package.json 2>/dev/null | head -4; } | head -6); echo "${out:-none found — no local gate surface to compare CI against}"`
 
+The pre-fetch above ran in the session's working directory. If the focus names a different
+repo or directory, it describes the wrong tree: rerun those probes from that path and audit
+that tree instead.
+
 ## Scope
 
 Everything here reads; nothing edits a workflow, config, or secret. The workflow

plugins/code-tools/skills/perf-audit/SKILL.md

@@ -13,6 +13,10 @@ Audit this repository's performance posture. Focus, if given: $ARGUMENTS
 **Build output present:** !`out=$(ls -d dist build .next out public 2>/dev/null | head -3); echo "${out:-no build output on disk — size checks need a build or are skipped (say which)}"`
 **CI workflows:** !`out=$(ls .github/workflows/ 2>/dev/null | head -6); echo "${out:-none}"`
 
+The pre-fetch above ran in the session's working directory. If the focus names a different
+repo or directory, it describes the wrong tree: rerun those probes from that path and audit
+that tree instead.
+
 ## The organizing question
 
 Not "is it fast?" — that needs a lab. The auditable question is: **does anything

plugins/code-tools/skills/security-audit/SKILL.md

@@ -17,6 +17,10 @@ Security-audit this repository. Focus, if given: $ARGUMENTS
 **Secret files on disk vs gitignore:** !`out=$(present=$(find . -maxdepth 1 -type f \( -name ".env" -o -name ".env.*" \) ! -name "*.example" ! -name "*.tpl" ! -name "*.sample" ! -name "*.template" 2>/dev/null); if [ -z "$present" ]; then echo "none present on disk (templates only or absent)"; else printf "%s\n" "$present" | while IFS= read -r f; do if git check-ignore -q "$f" 2>/dev/null; then echo "${f#./} gitignored"; else echo "${f#./} NOT gitignored — one commit from a leak"; fi; done; fi); echo "${out:-secret-file check produced no output}"`
 **Secret delivery mechanism:** !`out=$(rg -l -i "op run|op://|op inject|sops|vault kv|doppler|aws secretsmanager|gcp secret|azure keyvault|1password" .env.tpl .env.example Taskfile.yml Makefile justfile docker-compose.yml .github/workflows 2>/dev/null | head -5); echo "${out:-no secrets-manager references — plaintext env is likely the only mechanism (hardening opportunity, not a vuln)}"`
 
+The pre-fetch above ran in the session's working directory. If the focus names a different
+repo or directory, it describes the wrong tree: rerun those probes from that path and audit
+that tree instead.
+
 ## Pipeline
 
 Scale to repo size: fan out parallel read-only agents (one per lens) for anything non-trivial; work inline only for a small diff or single-package repo. If $ARGUMENTS scopes to a diff or PR, audit that surface but still check what it *reaches* (a handler change pulls in its middleware chain).

plugins/code-tools/skills/skill-audit/SKILL.md

@@ -12,6 +12,10 @@ Audit the Claude Code skills in this repository. Focus, if given: $ARGUMENTS
 **Plugin manifests:** !`out=$(find . -name plugin.json -path "*/.claude-plugin/*" -not -path "*/node_modules/*" 2>/dev/null | sort); echo "${out:-none}"`
 **Marketplace manifest:** !`out=$(ls .claude-plugin/marketplace.json 2>/dev/null); echo "${out:-none}"`
 
+The pre-fetch above ran in the session's working directory. If the focus names a different
+repo or directory, it describes the wrong tree: rerun those probes from that path and audit
+that tree instead.
+
 ## Pipeline
 
 Read every SKILL.md in full before reporting anything — findings about collisions and consistency only emerge from seeing the whole set.

plugins/code-tools/skills/test-audit/SKILL.md

@@ -15,6 +15,10 @@ Audit this repository's test suite and testing infrastructure. Focus, if given:
 **Coverage config:** !`out=$(ls codecov.yml .codecov.yml .coveragerc 2>/dev/null; grep -ril "coverage" .github/workflows/ 2>/dev/null | head -3); echo "${out:-none found}"`
 **Stated conventions:** !`out=$(grep -ril "test" CLAUDE.md CONTRIBUTING.md docs/adr/ docs/decisions/ .claude/ 2>/dev/null | head -5); echo "${out:-none — no written testing conventions (itself a finding)}"`
 
+The pre-fetch above ran in the session's working directory. If the focus names a different
+repo or directory, it describes the wrong tree: rerun those probes from that path and audit
+that tree instead.
+
 ## Pipeline
 
 Scale to repo size: for large repos, fan out parallel read-only agents (one per lens below); for small repos (<50 source files) work inline.