open/config-audit
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

docs(plan): mark v5.4.0 Feature 2 DONE + dropped-claim note [skip-docs]

Browse source 
CA-PLH-016 shipped (76d5eda). Records that the plan's unverified "CC suggests
the parent directory" error text was dropped (not in primary docs).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-19 21:58:00 +02:00
commit 9fd14aee99
1 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/v5.4.0-release-plan.md
View file

@ -78,11 +78,16 @@ must be pinned before coding). Checkpoint STATE + this plan after each feature.
- **Tests:** fixture plugin with both `"commands": "custom/"` AND a `commands/` folder → flagged;
fixture with only one of the two → not flagged; fixture with no component keys → not flagged.
### Feature 2 — PLH `skills:`-array validation (`CA-PLH-016`)
- **What:** when `plugin.json` has a `skills:` array, validate each entry resolves to an existing
**directory inside the plugin root**. Flag: non-string entry, missing path, path that is a file
not a directory, path escaping the plugin root. Mirrors `claude plugin validate` (~2.1.145; the
CC error suggests the parent directory when an entry points at a file).
### Feature 2 — PLH `skills:`-array validation (`CA-PLH-016`) ✅ DONE (commit `76d5eda`)
- **Verifiseringsplikt correction (2026-06-19):** the plan's claim that the CC error "suggests the
parent directory when an entry points at a file" is **not** in the primary docs — dropped. The
finding asserts only the four primary-source-verified conditions. Escape backed by docs'
path-traversal rule (*"Installed plugins cannot reference files outside their directory … such as
`../shared-utils`"*). string|array normalized, so a non-string top-level value (e.g. `42`) is
caught as one non-string entry. +3 tests (941→944), suite green, self-audit A/A, count 13.
- **What:** when `plugin.json` has a `skills:` field (string|array), validate each entry resolves to
an existing **directory inside the plugin root**. One finding per bad entry, `problem` ∈
{`non-string`, `escapes-root`, `not-found`, `not-a-directory`}. Mirrors `claude plugin validate`.
- **Where:** `scanners/plugin-health-scanner.mjs` (read `parsed.skills` after the parse-success
guard).
- **Severity:** MEDIUM (broken/partly-broken plugin manifest). `category: 'plugin-hygiene'`.