[gitayg]

Three fixes for work-review, ideas taken from the Productizer plugin.

1. An unmeasured figure is never shown as 0

The bug: upload.mjs turned every missing figure into 0. So a week with no commits reached the hub as $0.00 per commit, and later it looked like a perfect week. Usage from a model with no known price also added $0, and nothing on the hub said the total was incomplete.

The fix:

• Uploader: sends null for anything not measured. It also sends totals.unpricedTokens, the tokens from models it has no price for.
• Hub validate(): keeps null; it still rejects anything that isn't a number.
• Team view: a median with no data is null, not 0.
• Page: shows a dash for anything not measured, including the setup counts. When some tokens have no price, the cost reads "incomplete". The trend chart leaves out snapshots with no cost instead of plotting them at $0.
• Digest email: says "not measured" in the body and leaves the cost out of the subject, never "$0.00".

2. skill-installed-twice in the setup audit

The problem: a personal or project copy of a skill doesn't replace the same skill from a plugin, because plugin skills are namespaced. Both load and compete for the same requests, and claude plugin update updates only the plugin's copy, so the two drift apart.

The fix: audit-setup.mjs now also reads installed plugin skills. It lists them without judging them, and flags any skill installed at two scopes, once per skill name. A symlink to the same file counts as one install. Skills nobody here can edit, such as two cached versions of one plugin, are not reported as overlapping. The finding has a line in references/best-practices.md, marked as our own rule because the Claude Code docs don't cover this case.

3. A plugin change needs a version bump

The problem: plugin.json sets an explicit version, and Claude Code installs an update only when that version changes. A change to the plugin that keeps the version never reaches people who already installed it.

The fix:

• plugins/releases.json: records each marketplace plugin's version and a hash of its files.
• test/plugin-releases.test.js: fails when a plugin's files change but its version doesn't.
• npm run gen:plugin-releases: refuses to record such a change, so regenerating can't cover it up.
• CLAUDE.md: a short section describing the step.

The guard caught both of this PR's commits, so work-review is now 1.1.1.

Testing

• New and updated tests: work-review-* and plugin-releases, 34 tests, all pass. The tests added for the Bugbot findings fail on the code before the fix.
• Hub page: rendered in Chromium with every figure unmeasured, with no page errors and no literal "null" or "$0" shown.
• Full npm test: 3,865 tests; 3,763 pass and 31 fail. The 31 are the same git and Docker tests that fail on a clean main in this environment, none in files this PR touches. CI's full run passes.
• Other checks: the CI watchdog scripts and both claude plugin validate --strict runs pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X2X5cmFm94J9Gz2esCZBEG

---

Note

Low Risk
Changes are scoped to the Work Review plugin, example hub, and plugin release tooling; no auth or core hosting paths, with dedicated tests for null semantics and duplicate-skill detection.

Overview
v2.125.15 tightens Work Review so missing analytics are not mistaken for zeros, adds a setup-audit finding for duplicate skills, and introduces release discipline for marketplace plugins.

Unmeasured figures → null, UI shows "—" / "incomplete"
The uploader, hub validate(), team medians, weekly digest, and hub page now preserve null for anything not measured (instead of coercing to 0). The hub accepts totals.unpricedTokens and surfaces incomplete cost when some model usage has no price. Charts skip snapshots without cost rather than plotting $0.

New skill-installed-twice setup finding
audit-setup.mjs inventories plugin-cached skills and flags the same skill name installed in two scopes (project/user vs plugin), with symlink deduping and overlap suppression; digest and best-practices docs include the fix text.

Plugin changes must bump plugin.json version
Adds plugins/releases.json, npm run gen:plugin-releases (refuses file changes without a version bump), test/plugin-releases.test.js, and CLAUDE.md guidance. work-review ships as 1.1.4 with recorded hash.

^{Reviewed by Cursor Bugbot for commit b5ddad6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[gitayg]

role-and-shadow-check failed on 2b5dc97 in one live Docker test. The failure is not this PR's.

• What failed: 1 of 3,962 tests: test/volume-seed.test.js:456, "the throwaway container is gone and its anonymous volume with it". This PR changes no Docker or volume code.
• What the test checks: it records the dangling volumes before and after copyFromImage. Any volume that appears in between counts as a leak.
• What it caught instead: the volume it reported, appcrane-vols-vrace-…-production, is the named volume of test/volume-race.test.js, which runs in parallel. That test removed its container inside the window, so its volume turned dangling at the same moment. An anonymous volume, which is what the test is meant to catch, always has a 64-character hex name.
• CI re-run: CI is already running again on the new head, 09744ae.

Proposed patch (not added to this PR):

const leakedVolumes = [...await dangling()].filter((v) => !danglingBefore.has(v) && /^[0-9a-f]{64}$/.test(v));

---

Generated by Claude Code

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 09744ae. Configure here.}