feat(plugin): add extract/write domain skills and refactor report template

[onlycastle]

Summary

• Add 12 new domain skills (6 extract + 6 write) for ai-collaboration, ai-control, burnout-risk, context-engineering, skill-resilience, and tool-mastery
• Refactor report template to extract 6 shared helpers, eliminating duplication between report generators and removing fragile regex-based CSS extraction
• Extend stage output schemas and unify stage name enum as single source of truth

Changes

1. feat(plugin): add new stage output schemas and unify stage name enum
2. feat(plugin): add shared skill research insights
3. feat(plugin): add six extract domain skills
4. feat(plugin): add six write domain skills
5. refactor(plugin): update analysis skills for extract/write pipeline
6. refactor(plugin): extract shared helpers from report template
7. fix(plugin): update scanner source for new skill paths
8. chore(plugin): rebuild dist artifacts
9. docs: update README uninstall guide and add report screenshots

Test Plan

• Code compiles without errors
• Existing tests pass
• New extract/write skills produce valid stage outputs
• Report HTML generation produces identical output
• Manual verification of report screenshots

---

Generated with Claude Code using /ship-it

[onlycastle]

Code Review

Found 4 issues (scored ≥ 80/100):

---

1. content stage will permanently block report generation (Score: 90)

content is listed in REQUIRED_STAGE_NAMES (stage-db.ts line 28) but is absent from STAGE_NAMES and STAGE_SCHEMAS in the shared schema package. This means:

• getStageGateIssues() will permanently report content as missing
• save_stage_output validates against z.enum(STAGE_NAMES) and would reject any attempt to save a content stage
• The stage can never be satisfied, blocking pipeline completion

content appears to be a domain-level result (stored via save_domain_results), not a stage output — it may need to be removed from REQUIRED_STAGE_NAMES or added to STAGE_NAMES.

BetterPrompt/packages/plugin/lib/stage-db.ts

Line 28 in 357f2ab

'content',

---

2. Script injection via JSON.stringify in <script> tag (Score: 80)

JSON.stringify(sessionDataByDate) is injected directly into a <script> block. JSON.stringify does not escape </script>, so a project name or session summary containing that string would terminate the script tag and allow arbitrary HTML injection.

Fix: Use JSON.stringify(...).replace(/</g, '\\u003c') to escape angle brackets.

https://github.com/onlycastle/BetterPrompt/blob/357f2ab3fdcfd4d0703a1c4b38b766ab69ad4360/packages/plugin/lib/report-template.ts

---

3. XSS via unescaped innerHTML in heatmap detail panel (Score: 80)

In showHeatmapDetail(), project names and session summaries are concatenated directly into HTML strings assigned to panel.innerHTML without escaping. A project name containing <img src=x onerror=alert(1)> would execute.

https://github.com/onlycastle/BetterPrompt/blob/357f2ab3fdcfd4d0703a1c4b38b766ab69ad4360/packages/plugin/lib/report-template.ts

---

4. REQUIRED_STAGE_NAMES diverges from STAGE_NAMES — contradicts unification intent (Score: 85)

The PR's commit message states the goal as "unify stage name enum as single source of truth" and achieves this for save-stage-output.ts. However, stage-db.ts maintains its own REQUIRED_STAGE_NAMES list that is structurally out of sync with the shared STAGE_NAMES. The two lists contain different entries, meaning the "single source of truth" goal is only partially achieved.

BetterPrompt/packages/plugin/lib/stage-db.ts

Lines 15 to 34 in 357f2ab

	export const REQUIRED_STAGE_NAMES = [
	'sessionSummaries',
	'extractAiCollaboration',
	'extractContextEngineering',
	'extractToolMastery',
	'extractBurnoutRisk',
	'extractAiControl',
	'extractSkillResilience',
	'thinkingQuality',
	'contextEfficiency',
	'communicationPatterns',
	'learningBehavior',
	'sessionOutcome',
	'content',
	'projectSummaries',
	'weeklyInsights',
	'typeClassification',
	'evidenceVerification',
	'contentWriter',
	] as const;

---

Generated with Claude Code

_{If useful, react with a thumbs-up. Otherwise, thumbs-down.}

[onlycastle]

Code Review Update

Issues 1 and 4 are false positives — upon deeper investigation, REQUIRED_STAGE_NAMES and STAGE_NAMES are intentionally separate lists serving different purposes:

• STAGE_NAMES validates inputs to save_stage_output (pipeline stages with schemas)
• REQUIRED_STAGE_NAMES gates report generation (includes domain stages saved via save_domain_results)

Both save_stage_output and save_domain_results call recordStageStatus(), so domain stages like content, thinkingQuality, etc. correctly appear in REQUIRED_STAGE_NAMES but not in STAGE_NAMES. The gate check works because status tracking is shared across both save paths.

Issues 2 and 3 (XSS) are fixed in commit 8204495:

• Added escHtml() helper using DOM text node escaping for project names and session summaries in innerHTML
• Added .replace(/</g, '\\u003c') to JSON.stringify output in <script> tag
• Updated stale module comment in stage-outputs.ts

Generated with Claude Code