diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index bd0d8ad..b8e2292 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "config-audit", "description": "Multi-agent workflow for analyzing, reporting, and optimizing Claude Code configuration across your entire machine", - "version": "5.5.0", + "version": "5.6.0", "author": { "name": "Kjell Tore Guttormsen" }, diff --git a/CHANGELOG.md b/CHANGELOG.md index 0bc933c..8bec6ea 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,46 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [5.6.0] - 2026-06-20 + +### Summary +"Steering-model II" — the per-mechanism **load-pattern** and **compaction-survival** model lands +end-to-end across enumeration, the `manifest` / `tokens` token accounting, and a new output-style +scanner. v5.5.0 shipped A+E (additive to existing scanners); this release adds the **Foundation** +those features needed, plus **B** (load-pattern accounting) and **C** (the new `CA-OST` family, +scanner count 13 → **14**). Every new claim is anchored to the live Claude Code docs +(`code.claude.com/docs`) per the project's verification duty. + +### Added +- **Foundation — active-config-reader enumeration + load-pattern model.** `active-config-reader` + now enumerates **rules**, **agents**, and **output styles** (alongside the existing + CLAUDE.md / plugins / skills / hooks / MCP). Each source carries a `loadPattern` + (`always` / `on-demand` / `external`), `survivesCompaction`, and `derivationConfidence`, derived + from the published loading model. The frontmatter parser additionally reads YAML **block + sequences** (`paths:` as a `- item` list), resolving a pre-existing RUL false-positive. +- **C — output-style scanner (`CA-OST`, scanner count 13 → 14).** New orchestrated scanner: + `CA-OST-001` (MEDIUM) a user/project custom output style missing `keep-coding-instructions: true` + (defaults false) silently strips Claude Code's built-in software-engineering instructions when + active (V10); `CA-OST-002` (LOW) a **plugin** output style with `force-for-plugin: true` overrides + the user's selected `outputStyle` (V11); `CA-OST-003` (MEDIUM) a settings `outputStyle` matching + no built-in (Default / Explanatory / Learning / Proactive) nor discovered custom style is dead + config. + +### Changed +- **B — load-pattern accounting in `manifest` and `tokens`.** `manifest` now reports + **component-level** token sources (the coarse plugin roll-up that double-counted its own + skills / rules / agents is gone), tags every source with the load-pattern triple, and leads with + an **always-loaded subtotal** ("≈X tokens enter context every turn before you type"). + `token-hotspots` annotates each ranked hotspot with its load pattern. `manifest`'s `total` changes + (de-duplicated) — the intended correctness fix. + +### Notes +- **Byte-stability.** `--json` / `--raw` stay byte-stable for the original 13 scanners. The frozen + v5.0.0 snapshots are **preserved**: B2's additive hotspot fields and C's additive OST scanner + entry are stripped at compare time (`tests/helpers/strip-hotspot-load-pattern.mjs`, + `tests/helpers/strip-added-scanner.mjs`); only the SC-5 default-output snapshots are regenerated. + Suite 1023 pass, self-audit A/A (config 93, plugin 100), readmeCheck passed. + ## [5.5.0] - 2026-06-20 ### Summary diff --git a/README.md b/README.md index 86fb9fe..fae7dfa 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ *AI-generated: all code produced by Claude Code through dialog-driven development. [Full disclosure →](../../README.md#ai-generated-code-disclosure)* -![Version](https://img.shields.io/badge/version-5.5.0-blue) +![Version](https://img.shields.io/badge/version-5.6.0-blue) ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple) ![Scanners](https://img.shields.io/badge/scanners-14-cyan) ![Commands](https://img.shields.io/badge/commands-18-green) @@ -648,6 +648,7 @@ This plugin is cautious by design — configuration files are important, and a b | Version | Date | Highlights | |---------|------|-----------| +| **5.6.0** | 2026-06-20 | "Steering-model II" — the load-pattern / compaction-survival model lands end-to-end. **Foundation:** `active-config-reader` now enumerates rules, agents, and output styles (alongside CLAUDE.md/plugins/skills/hooks/MCP), each tagged `loadPattern` (always / on-demand / external) + `survivesCompaction` from the published loading model; the frontmatter parser also reads YAML block sequences (`paths:` lists). **B (load-pattern accounting):** `manifest` reports component-level sources (the double-counting plugin roll-up is gone), tags every source with the load-pattern triple, and leads with an **always-loaded subtotal** ("tokens that enter context every turn"); `token-hotspots` annotates each ranked hotspot with its load pattern. **C (output styles):** new orchestrated **OST** scanner (count 13→**14**) — `CA-OST-001` a custom style stripping built-in coding instructions (missing `keep-coding-instructions: true`, V10), `CA-OST-002` a plugin style with `force-for-plugin: true` overriding the user's `outputStyle` (V11), `CA-OST-003` a settings `outputStyle` resolving to no known style (dead config). Doc-verified; frozen v5.0.0 snapshots preserved via strip-helpers, SC-5 regenerated. 1023 tests | | **5.5.0** | 2026-06-20 | "Steering-model I" — two additive compaction-durability / dead-config findings (count stays **13**, `--json`/`--raw` byte-stable). Per the official "what survives compaction" model: RUL flags a large (>50-line) **path-scoped** rule not re-injected after compaction (LOW); CML flags a **nested** (subdir) CLAUDE.md not re-injected after compaction (LOW). PLH flags a plugin agent setting `hooks`/`mcpServers`/`permissionMode` — Claude Code ignores these for plugin subagents, so it's dead config (`permissionMode` = MEDIUM false-security, `hooks`/`mcpServers` = LOW). Known limitation: the frontmatter parser reads inline `paths:` but not YAML block sequences (deferred to v5.6 Foundation). 961 tests | | **5.4.1** | 2026-06-20 | Scanner-correctness patch (count stays **13**, `--json`/`--raw` byte-stable). HKV: added `Setup`/`UserPromptExpansion`/`PostToolBatch` to the valid-event set (a valid hook using one was wrongly flagged "will never fire"), and **removed** `post-session` (the 2.1.169 `post-session` is a self-hosted-runner workspace-lifecycle hook, **not** a settings.json event — absent from `hooks.md`; verified 2026-06-20). RUL: globs-rule wording corrected — only `paths:` is documented, so the finding drops the unverified "deprecated/legacy" claim and steers to the documented field. PLH: optional `model`/`tools`/`name`/`allowed-tools` frontmatter no longer required; CLAUDE.md component-section required only for components the plugin actually ships. 954 tests | | **5.4.0** | 2026-06-19 | Plugin-hygiene & settings-validation hardening. Three additive findings extend existing PLH and SET scanners (count stays **13**): PLH plugin-folder shadowing (`CA-PLH-015` — a `plugin.json` component-path key in the *replaces* set `commands`/`agents`/`outputStyles` pointing at a custom path while the default folder still exists) mirroring CC's `/doctor` & `claude plugin list` warning; PLH `skills:`-array validation (`CA-PLH-016` — each entry must resolve to a directory in the plugin root; flags `non-string`/`escapes-root`/`not-found`/`not-a-directory`) mirroring `claude plugin validate`; SET `autoMode` structure (only `environment`/`allow`/`soft_deny`/`hard_deny` string arrays) + dead-config (`autoMode` in shared `.claude/settings.json` is not read by CC). `--json`/`--raw` byte-stable. 949 tests |