open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

feat(set): validate autoMode structure + flag it in shared settings (CA-SET)

Browse source 
settings-validator now validates the autoMode block (auto-mode classifier
config). Structure (medium): autoMode must be an object whose only keys are
environment/allow/soft_deny/hard_deny, each a string array ("$defaults" is a
valid entry); flags not-an-object, unknown-subkey, not-string-array. Dead-config
(low): Claude Code does not read autoMode from shared project settings
(.claude/settings.json), so an autoMode block committed there has no effect —
keyed on file.scope === 'project'.

Both premises primary-source-verified (code.claude.com/docs/en/auto-mode-config).
The plan's "test per-file scope first" gate passed: ConfigFile already carries
scope. SET is in the orchestrator; SC-5 re-checked, byte-equal (snapshot fixture
has no autoMode). Fixtures force-added (.claude/ is gitignored).

Tests +5 (944->949). Scanner count unchanged (13). --json/--raw byte-stable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-19 22:14:26 +02:00
commit 3633571c7e
8 changed files with 225 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

13
README.md
View file

@ -12,7 +12,7 @@
![Commands](https://img.shields.io/badge/commands-18-green)
![Agents](https://img.shields.io/badge/agents-6-orange)
![Hooks](https://img.shields.io/badge/hooks-4-red)
![Tests](https://img.shields.io/badge/tests-944+-brightgreen)
![Tests](https://img.shields.io/badge/tests-949+-brightgreen)
![License](https://img.shields.io/badge/license-MIT-lightgrey)
A Claude Code plugin that checks configuration health, suggests context-aware improvements, and auto-fixes issues — `CLAUDE.md`, `settings.json`, hooks, rules, MCP servers, `@imports`, and plugins. 13 deterministic scanners across 10 quality areas, context-aware feature recommendations, auto-fix with backup/rollback, a prompt-cache-aware Token Hotspots scanner with optional API-calibrated `--accurate-tokens` mode, plus cache-prefix stability, dead-tool, and cross-plugin collision detection. Zero external dependencies.
@ -393,6 +393,17 @@ By default, `/config-audit` auto-detects scope from your git context. Override w
> `claude plugin validate`. Note `skills` *adds to* the default `skills/` scan, so a custom path
> here is never a shadow — it just has to resolve to a real folder.
> **`autoMode` validation — structure and the shared-settings blind spot.** The SET scanner
> checks the auto-mode classifier config two ways. **Structure:** `autoMode` must be an object
> whose only keys are `environment`, `allow`, `soft_deny`, and `hard_deny`, each a list of
> plain-text rule strings (the literal `"$defaults"` is allowed). An unknown sub-key (e.g. a
> typo'd `hard_denies`), a non-object value, or a sub-key that isn't a string array is flagged
> **medium** — a typo'd key silently drops those rules. **Scope:** Claude Code does **not** read
> `autoMode` from *shared* project settings (`.claude/settings.json`) — "a checked-in repo cannot
> inject its own allow rules" — so an `autoMode` block committed there is dead config (**low**);
> it only takes effect in user (`~/.claude/settings.json`), local (`.claude/settings.local.json`),
> or managed settings.
### CLI Tools
All tools work standalone — no Claude Code session needed: