Desloppify Files

This release bundles all 11 skill overlays for one-step global install via desloppify setup, and fixes false positives across three detectors — orphaned, hardcoded_secret_name, and cycles — based on community reports.

31 files changed | 7 commits | 6,539 tests passing

Headline Feature

Bundled Skill Overlays with desloppify setup

All 11 agent skill files (Claude, Cursor, Copilot, Codex, Droid, Windsurf, Gemini, AMP, Hermes, OpenCode, Skill) are now bundled in the package and installed globally via desloppify setup. No network access needed — the command copies bundled docs to the right locations so agents discover desloppify across all projects. A pre-commit hook and make sync-docs target keep bundled copies in sync with docs/.

The README now points to desloppify setup as the primary install path, with update-skill as a per-project fallback.

Bug Fixes

• Orphaned detector false positives — Files with __all__ exports are now recognized as intentional public API surfaces and excluded from orphan detection. Closes [#496], reported by @Git-on-my-level.
• hardcoded_secret_name false positives — Added entropy heuristic to filter non-secret values: field name constants (token_usage), sentinel strings, and label prefixes (agent_workspace@) are no longer flagged. Closes [#496].
• Cycles detector TYPE_CHECKING false positives — Imports inside if TYPE_CHECKING: blocks are now marked as deferred and excluded from cycle detection. From @Git-on-my-level's comment on [#496].
• Assessment crash on corrupted state — store_assessments now guards against raw int values in state with isinstance check before calling .get(). Closes [#465], reported by @Vuk97.
• fix_debug_logs negative-index corruption — Added lower-bound guard (start < 0) matching the pattern in all sibling fixers. Prevents silent wrong-line edits when entry["line"] is 0. Cherry-picked from PR [#499] by @cpjet64.
• .gitignore CLAUDE.md/AGENTS.md scope — Patterns now anchored to repo root (/CLAUDE.md) so subdirectory copies aren't ignored.

Refactoring & Internal

• Review pipeline improvements — Added bias-to-action guidance: confirmed bugs get implemented immediately instead of deferred. Stage 3 now collects open questions for the maintainer instead of guessing. Hard rule: decisions are presented for approval before execution.

Community

Thanks to @Git-on-my-level for the detailed false-positive reports across three detectors (#496), @Vuk97 for reproducing the assessment crash (#465) and language detection bug (#466), and @cpjet64 for the fix_debug_logs guard (PR [#499]).