open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

fix(plh): downgrade cross-plugin command-name overlap to low ambiguity

Browse source 
Commands are namespaced (/name:command), so a command name shared by two
differently-named plugins keeps both reachable — it is ambiguity, not a hard
conflict. The check now mirrors COL's plugin-vs-plugin skill finding: severity
LOW (was HIGH), category plugin-hygiene, COL-shaped details.namespaces, and a
group-first shape (one finding per command name listing every namespace, not
pairwise). It keys on the declared namespace (was folder basename) and fires
only across 2+ distinct namespaces — when plugins share a declared name, the
namespace-collision finding (medium) is the right signal, so this stays silent.

Removes the inaccurate "only one wins" humanizer entry. Adds fixtures
(duplicate-command-name; a shared command in duplicate-plugin-name's colliding
namespace) and 4 tests. Suite 932->936. self-audit A 97 / A 100, scanners 13.
This commit is contained in:
Kjell Tore Guttormsen 2026-06-19 15:30:35 +02:00
commit 0874188fe4
13 changed files with 160 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scanners/lib/humanizer-data.mjs
View file

@ -659,11 +659,6 @@ export const TRANSLATIONS = {
description: 'The settings block tells Claude what tools and model the agent should use.',
recommendation: 'Add a settings block (delimited by `---`) at the top of the file.',
},
'Cross-plugin command name conflict': {
title: 'Two plugins both define a command with the same name',
description: 'When two plugins use the same command name, only one wins.',
recommendation: 'Rename the command in one of the plugins, or disable the one you don\'t need.',
},
'No plugins found': {
title: 'No plugins are installed in this location',
description: 'The location was checked but contains no plugins (or no plugins Claude Code recognizes).',
@ -723,6 +718,14 @@ export const TRANSLATIONS = {
recommendation: 'Add the missing setting shown in the details.',
},
},
{
regex: /^Command name ".+" used by multiple plugins$/,
translation: {
title: 'Several plugins define a command with the same name',
description: 'Each plugin\'s commands are namespaced (like `/plugin:command`), so they all still work — but a shared command name makes error messages, search results, and the command listing ambiguous about which plugin you mean.',
recommendation: 'Rename the command in one of the plugins so each name points to a single plugin.',
},
},
{
regex: /^Plugin namespace collision:/,
translation: {

50
scanners/plugin-health-scanner.mjs
View file

@ -350,10 +350,16 @@ export async function scan(targetPath) {
allFindings.push(...result.findings);
}
// Cross-plugin checks: command name conflicts
const commandNames = new Map(); // name → plugin
// Cross-plugin checks: command-name ambiguity across DIFFERENT plugin namespaces.
// Commands are namespaced by the plugin's declared name (/name:command), so a
// shared command name across DIFFERENT plugins is ambiguity — not a hard
// conflict — mirroring COL's plugin-vs-plugin skill check (low). When two
// plugins share the SAME declared namespace, the namespace-collision finding
// below already covers it, so this check keys on the namespace and fires only
// when a command name spans 2+ DISTINCT namespaces.
const commandsByNamespace = new Map(); // cmdName → Map<namespace, { path }>
for (let idx = 0; idx < pluginResults.length; idx++) {
const pr = pluginResults[idx];
const namespace = pluginResults[idx].declaredName || basename(pluginDirs[idx]);
const commandsDir = join(pluginDirs[idx], 'commands');
try {
const entries = await readdir(commandsDir);
@ -363,22 +369,36 @@ export async function scan(targetPath) {
const { frontmatter } = parseFrontmatter(content);
if (frontmatter && frontmatter.name) {
const cmdName = frontmatter.name;
if (commandNames.has(cmdName)) {
allFindings.push(finding({
scanner: SCANNER,
severity: SEVERITY.high,
title: 'Cross-plugin command name conflict',
description: `Command "${cmdName}" exists in both "${commandNames.get(cmdName)}" and "${pr.name}"`,
file: filePath,
recommendation: `Rename one of the conflicting commands to avoid ambiguity`,
}));
} else {
commandNames.set(cmdName, pr.name);
}
if (!commandsByNamespace.has(cmdName)) commandsByNamespace.set(cmdName, new Map());
const nsMap = commandsByNamespace.get(cmdName);
if (!nsMap.has(namespace)) nsMap.set(namespace, { path: filePath });
}
}
} catch { /* no commands dir */ }
}
for (const [cmdName, nsMap] of commandsByNamespace) {
if (nsMap.size < 2) continue; // single namespace → no cross-plugin ambiguity
const entries = [...nsMap.entries()].map(([namespace, v]) => ({ namespace, path: v.path }));
const namespaceList = entries.map(e => e.namespace).join(', ');
allFindings.push(finding({
scanner: SCANNER,
severity: SEVERITY.low,
title: `Command name "${cmdName}" used by multiple plugins`,
description:
`${entries.length} plugins (${namespaceList}) expose a command named "${cmdName}". ` +
'Even when invocation is namespaced via /plugin:command, shared names create ambiguity ' +
'in error messages, search results, and the command listing.',
file: entries[0].path,
evidence: `name="${cmdName}"; plugins=${entries.map(e => e.namespace).join(',')}`,
recommendation:
'Coordinate command naming across plugins, or rename one to clarify intent. The shared ' +
'name forces every reader to disambiguate by plugin.',
category: 'plugin-hygiene',
details: {
namespaces: entries.map(e => ({ source: `plugin:${e.namespace}`, name: cmdName, path: e.path })),
},
}));
}
// Cross-plugin checks: plugin namespace (declared name) collisions.
// Claude Code namespaces every plugin component by the plugin's declared