open/config-audit
1
0
Fork 0
Code Issues Pull requests Releases Activity

feat(plh): flag plugin.json paths that shadow default folders (CA-PLH-015)

Browse source 
PLH now flags a plugin.json component-path key (commands/agents/outputStyles)
that replaces a default folder still present on disk — Claude Code stops
scanning that folder, so its contents are silently ignored (dead config).
Mirrors CC's /doctor & `claude plugin list` warning (v2.1.140+).

Field set pinned to the docs' "replaces" category only (Verifiseringsplikt,
code.claude.com/docs path-behavior-rules): skills is excluded (adds to the
default skills/ scan — both load) as are hooks/mcpServers/lspServers (own
merge rules); a custom path that addresses the default folder is not flagged.

Tests +5 (936->941). Scanner count unchanged (13). --json/--raw byte-stable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-19 21:46:22 +02:00
commit 7abc5a1dcb
10 changed files with 217 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
README.md
View file

@ -12,7 +12,7 @@
![Commands](https://img.shields.io/badge/commands-18-green)
![Agents](https://img.shields.io/badge/agents-6-orange)
![Hooks](https://img.shields.io/badge/hooks-4-red)
![Tests](https://img.shields.io/badge/tests-936+-brightgreen)
![Tests](https://img.shields.io/badge/tests-941+-brightgreen)
![License](https://img.shields.io/badge/license-MIT-lightgrey)
A Claude Code plugin that checks configuration health, suggests context-aware improvements, and auto-fixes issues — `CLAUDE.md`, `settings.json`, hooks, rules, MCP servers, `@imports`, and plugins. 13 deterministic scanners across 10 quality areas, context-aware feature recommendations, auto-fix with backup/rollback, a prompt-cache-aware Token Hotspots scanner with optional API-calibrated `--accurate-tokens` mode, plus cache-prefix stability, dead-tool, and cross-plugin collision detection. Zero external dependencies.
@ -372,6 +372,17 @@ By default, `/config-audit` auto-detects scope from your git context. Override w
> (group-first, one finding per command name), mirroring the COL scanner, which owns the
> analogous skill-name overlaps across *different* namespaces.
> **Plugin-folder shadowing — when a manifest path silently buries a default folder.**
> A plugin's `plugin.json` can point a component type at a custom path — `commands`,
> `agents`, and `outputStyles` all *replace* their default folder when set. So if a plugin
> declares `"commands": "./custom/"` while a `commands/` folder still exists, Claude Code
> stops scanning `commands/` entirely and everything in it silently disappears (dead config).
> PLH flags this at **medium** severity (`CA-PLH-015`), mirroring Claude Code's own warning in
> `/doctor` and `claude plugin list` (v2.1.140+). It does **not** flag `skills` — that key
> *adds to* the default `skills/` scan rather than replacing it, so both load — nor does it
> flag a custom path that points back into the default folder (e.g.
> `"commands": ["./commands/x.md"]`), because the folder is then addressed explicitly.
### CLI Tools
All tools work standalone — no Claude Code session needed: