bloat(#236): audit script scans .claude/skills/ (consumer install path) - #320
Merged
Merged
Conversation
scripts/audit-session-load.sh scanned only root skills/*/SKILL.md. But cli/init.js:32-35 copies SKILL.md files to .claude/skills/<name>/ SKILL.md at install time, so the audit was silently invisible to bloat in real consumer projects. Mirrors the existing .claude/hooks/ pattern. Caught by Codex strategic review on the bloat-sweep continuation question — it pointed at the asymmetry between hooks (dual-path scanned) and skills (root-only). Implementation plan went through a second Codex round for sign-off; ships with all 4 deltas applied: - inventory comment block updated to mention .claude/skills/ - new test uses existing make_temp + make_file_with_size helpers - new test wired into the explicit-call runner block - Python predicate uses path.endswith() not substring match Will double-count in dogfood (where .claude/skills/ symlinks back to skills/), same trade-off as the existing hooks scan accepts. No version bump: scripts/ + tests/ are not in package.json files list, so this never reaches npm consumers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Last #236 cleanup: fix a measurement blind spot in
scripts/audit-session-load.sh. The audit scanned only rootskills/*/SKILL.md, butcli/init.js:32-35copies SKILL.md files to.claude/skills/<name>/SKILL.mdat install time. So the audit was silently invisible to bloat in real consumer projects — only the dev-maintainer dual-purpose layout was checked.(Replaces #319, which got stranded after origin/main was force-updated mid-flow.)
Caught by Codex strategic review on the "should we keep going on bloat?" question. Codex flagged the asymmetry between hooks (already dual-path scanned via
.claude/hooks/block) and skills (root-only). Mirrors that existing pattern.Why this matters
tests/test-audit-session-load.sh:174enforces "wizard repo's own SKILL.md files all stay below 5000-token threshold." A consumer who customized their.claude/skills/sdlc/SKILL.mdto >5K tokens would never trip the audit's TRIM flag — the tool wouldn't see them. That undermines the audit's own Prove-It framing ("a tool that surfaces real issues whose owner ignores them is just a louder lint warning").Implementation (Codex-signed-off, 4 deltas applied)
scripts/audit-session-load.sh: new.claude/skills/scan block mirroring.claude/hooks/.tests/test-audit-session-load.sh: newtest_audit_scans_consumer_install_layoutusing existingmake_temp+make_file_with_sizehelpers.path.endswith("/.claude/skills/sdlc/SKILL.md")+flag == "TRIM"(strict, not substring match).Test plan
tests/test-audit-session-load.sh— 10/10 PASS (was 9/9, +1 new regression). TDD RED confirmed.tests/test-cli.sh— 78/78 PASStests/test-plugin.sh— 25/25 PASStests/test-doc-consistency.sh— 35/35 PASStests/test-workflow-triggers.sh— 169/169 PASSLive audit shows both layouts inventoried. Dogfood double-counts (
.claude/skills/symlinks resolve to same files asskills/) — same trade-off the.claude/hooks/scan already accepts.No version bump
scripts/+tests/aren't inpackage.jsonfiles:. Same precedent as orphan-delete PR #318.Close-out
Final #236 PR for this session. Combined session impact: