From 9fd14aee995b7ca6da1f7cca7911c0d8f7f2f1df Mon Sep 17 00:00:00 2001 From: Kjell Tore Guttormsen Date: Fri, 19 Jun 2026 21:58:00 +0200 Subject: [PATCH] docs(plan): mark v5.4.0 Feature 2 DONE + dropped-claim note [skip-docs] CA-PLH-016 shipped (76d5eda). Records that the plan's unverified "CC suggests the parent directory" error text was dropped (not in primary docs). Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8 --- docs/v5.4.0-release-plan.md | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/docs/v5.4.0-release-plan.md b/docs/v5.4.0-release-plan.md index ebe93bd..aa70be8 100644 --- a/docs/v5.4.0-release-plan.md +++ b/docs/v5.4.0-release-plan.md @@ -78,11 +78,16 @@ must be pinned before coding). Checkpoint STATE + this plan after each feature. - **Tests:** fixture plugin with both `"commands": "custom/"` AND a `commands/` folder → flagged; fixture with only one of the two → not flagged; fixture with no component keys → not flagged. -### Feature 2 — PLH `skills:`-array validation (`CA-PLH-016`) -- **What:** when `plugin.json` has a `skills:` array, validate each entry resolves to an existing - **directory inside the plugin root**. Flag: non-string entry, missing path, path that is a file - not a directory, path escaping the plugin root. Mirrors `claude plugin validate` (~2.1.145; the - CC error suggests the parent directory when an entry points at a file). +### Feature 2 — PLH `skills:`-array validation (`CA-PLH-016`) ✅ DONE (commit `76d5eda`) +- **Verifiseringsplikt correction (2026-06-19):** the plan's claim that the CC error "suggests the + parent directory when an entry points at a file" is **not** in the primary docs — dropped. The + finding asserts only the four primary-source-verified conditions. Escape backed by docs' + path-traversal rule (*"Installed plugins cannot reference files outside their directory … such as + `../shared-utils`"*). string|array normalized, so a non-string top-level value (e.g. `42`) is + caught as one non-string entry. +3 tests (941→944), suite green, self-audit A/A, count 13. +- **What:** when `plugin.json` has a `skills:` field (string|array), validate each entry resolves to + an existing **directory inside the plugin root**. One finding per bad entry, `problem` ∈ + {`non-string`, `escapes-root`, `not-found`, `not-a-directory`}. Mirrors `claude plugin validate`. - **Where:** `scanners/plugin-health-scanner.mjs` (read `parsed.skills` after the parse-success guard). - **Severity:** MEDIUM (broken/partly-broken plugin manifest). `category: 'plugin-hygiene'`.