From 2f9d391b95750c54a189f871cdba4370770b4a17 Mon Sep 17 00:00:00 2001 From: Kjell Tore Guttormsen Date: Sat, 20 Jun 2026 10:15:22 +0200 Subject: [PATCH] =?UTF-8?q?release:=20v5.4.1=20=E2=80=94=20scanner-correct?= =?UTF-8?q?ness=20patch=20(HKV/RUL/PLH)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bundles four primary-source-verified scanner fixes since v5.4.0: - HKV: +Setup/UserPromptExpansion/PostToolBatch; removed post-session (a self-hosted-runner lifecycle hook, not a settings.json event) - RUL: globs-rule wording corrected (only paths: is documented) - PLH: optional model/tools/name/allowed-tools no longer required; CLAUDE.md component-section required only for shipped components Count stays 13, --json/--raw byte-stable, suite 954, self-audit A/A, --check-readme passed. Version-history + CHANGELOG updated; badges bumped. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8 --- .claude-plugin/plugin.json | 2 +- CHANGELOG.md | 26 ++++++++++++++++++++++++++ README.md | 3 ++- 3 files changed, 29 insertions(+), 2 deletions(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 5e493a7..3a3a48a 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "config-audit", "description": "Multi-agent workflow for analyzing, reporting, and optimizing Claude Code configuration across your entire machine", - "version": "5.4.0", + "version": "5.4.1", "author": { "name": "Kjell Tore Guttormsen" }, diff --git a/CHANGELOG.md b/CHANGELOG.md index 8138395..9c37870 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [5.4.1] - 2026-06-20 + +### Summary +Scanner-correctness patch. Five primary-source-verified fixes to the PLH, HKV, and RUL scanners — +no new scanner, no command or output-format change (scanner count stays **13**; `--json` and `--raw` +remain byte-stable). All fixes are anchored to the live Claude Code docs (`code.claude.com/docs`, +docs map 2026-06-19) per the project's verification duty. + +### Fixed +- **HKV hook events** — added `Setup`, `UserPromptExpansion`, and `PostToolBatch` to the valid-event + set (verified against `hooks.md`); a valid hook using one of these was wrongly flagged + "Unknown hook event … will never fire", which could lead a user to delete a working hook. The + "(N total)" hint in the recommendation is now derived from the set so it cannot drift. +- **HKV `post-session`** — removed from the valid-event set. The 2.1.169 changelog `post-session` + hook is a **self-hosted-runner** workspace-lifecycle hook (runs after the session, before the + workspace is deleted), **not** a `settings.json` hook event — it is absent from `hooks.md` (all + settings.json events are PascalCase). A bogus `post-session` settings hook is now correctly flagged. +- **RUL `globs` rule** — reworded the finding. Only `paths:` is documented as the rule-scoping + field; whether Claude Code ever read `globs` is unverified, so the previous "deprecated/legacy" + framing overclaimed. The finding (and its humanizer entry) now steer to the documented `paths:` + field without asserting deprecation. The coupled fix-engine title match was updated in lockstep. +- **PLH required frontmatter** — `model`/`tools`/`name`/`allowed-tools` are optional per the CC + agent/command docs; a missing one is no longer flagged. +- **PLH CLAUDE.md component sections** — a commands/agents/hooks section is required only for a + component the plugin actually ships. + ## [5.4.0] - 2026-06-19 ### Summary diff --git a/README.md b/README.md index 9d78c0c..4778709 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ *AI-generated: all code produced by Claude Code through dialog-driven development. [Full disclosure →](../../README.md#ai-generated-code-disclosure)* -![Version](https://img.shields.io/badge/version-5.4.0-blue) +![Version](https://img.shields.io/badge/version-5.4.1-blue) ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple) ![Scanners](https://img.shields.io/badge/scanners-13-cyan) ![Commands](https://img.shields.io/badge/commands-18-green) @@ -647,6 +647,7 @@ This plugin is cautious by design — configuration files are important, and a b | Version | Date | Highlights | |---------|------|-----------| +| **5.4.1** | 2026-06-20 | Scanner-correctness patch (count stays **13**, `--json`/`--raw` byte-stable). HKV: added `Setup`/`UserPromptExpansion`/`PostToolBatch` to the valid-event set (a valid hook using one was wrongly flagged "will never fire"), and **removed** `post-session` (the 2.1.169 `post-session` is a self-hosted-runner workspace-lifecycle hook, **not** a settings.json event — absent from `hooks.md`; verified 2026-06-20). RUL: globs-rule wording corrected — only `paths:` is documented, so the finding drops the unverified "deprecated/legacy" claim and steers to the documented field. PLH: optional `model`/`tools`/`name`/`allowed-tools` frontmatter no longer required; CLAUDE.md component-section required only for components the plugin actually ships. 954 tests | | **5.4.0** | 2026-06-19 | Plugin-hygiene & settings-validation hardening. Three additive findings extend existing PLH and SET scanners (count stays **13**): PLH plugin-folder shadowing (`CA-PLH-015` — a `plugin.json` component-path key in the *replaces* set `commands`/`agents`/`outputStyles` pointing at a custom path while the default folder still exists) mirroring CC's `/doctor` & `claude plugin list` warning; PLH `skills:`-array validation (`CA-PLH-016` — each entry must resolve to a directory in the plugin root; flags `non-string`/`escapes-root`/`not-found`/`not-a-directory`) mirroring `claude plugin validate`; SET `autoMode` structure (only `environment`/`allow`/`soft_deny`/`hard_deny` string arrays) + dead-config (`autoMode` in shared `.claude/settings.json` is not read by CC). `--json`/`--raw` byte-stable. 949 tests | | **5.3.0** | 2026-06-19 | Permission-rule & plugin-hygiene hardening. Five additive scanner findings extend existing scanners (count stays **13**): DIS forbidden-param rules (`Tool(param:value)` on a canonicalizing field — deny/ask = false security, allow = dead config) and ineffective allow-wildcards + `Tool(*)` deny-all; CML context-window-scaled 40.0k-char CLAUDE.md budget mirroring CC's startup warning; PLH plugin namespace collision (two plugins declaring the same `name`); feature-gap `disableBundledSkills` lever under skill-listing pressure. PLH cross-plugin command-name overlap reframed HIGH → LOW (namespacing keeps both reachable). `--json`/`--raw` byte-stable. 936 tests | | **5.2.0** | 2026-06-18 | CC 2.1.114→181 compatibility + skill-listing budget. New orchestrated scanner **SKL** (`CA-SKL-001` 1,536-char listing cap, `CA-SKL-002` listing-budget sum) → 13 orchestrated scanners. Five validators refreshed for CC 2.1.114–181 settings/hook surface (`xhigh` effort, `MessageDisplay` + post-session events, 28 hook events). False positives eliminated in MCP (auto-injected/POSIX env vars, invented `trust` field) and permissions (param-aware DIS/CNF). Hermetic HOME isolation across all CLI-spawning tests. 875 tests |