open/config-audit
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions
config-audit/tests/scanners
History
Kjell Tore Guttormsen 76d5eda101 feat(plh): validate plugin.json skills:-array entries (CA-PLH-016) 
PLH now validates each entry of a plugin.json `skills` field (string|array):
every entry must resolve to an existing directory inside the plugin root.
One finding per bad entry (medium, plugin-hygiene), problem ∈ {non-string,
escapes-root, not-found, not-a-directory}. Mirrors `claude plugin validate`.
String|array normalized so a non-string top-level value is caught too.

Verifiseringsplikt: the plan's "CC suggests the parent directory" error text
is NOT in the primary docs — dropped. Only the four primary-source-verified
conditions are asserted (escape backed by the path-traversal rule).

Tests +3 (941->944). Scanner count unchanged (13). --json/--raw byte-stable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
2026-06-19 21:56:57 +02:00
..
accurate-tokens.test.mjs test: isolate HOME in all CLI-spawning tests (close leak class) 2026-06-18 18:17:09 +02:00
cache-prefix.test.mjs feat(config-audit): cache-prefix stability scanner CPS (v5 N3) [skip-docs] 2026-05-01 07:37:54 +02:00
claude-md-linter.test.mjs feat(cml): context-window-scaled CLAUDE.md char budget (mirrors CC 40.0k warning) 2026-06-19 13:34:40 +02:00
cli-humanizer.test.mjs test(snapshots): make byte/snapshot tests hermetic + re-seed baseline 2026-06-18 12:26:00 +02:00
collision.test.mjs feat(config-audit): cross-plugin collision scanner COL (v5 N6) [skip-docs] 2026-05-01 07:46:15 +02:00
conflict-detector.test.mjs fix(permissions): param-aware DIS dead-allow + CNF conflict matching 2026-06-18 13:06:20 +02:00
disabled-in-schema.test.mjs feat(dis): flag forbidden-param permission rules CC silently ignores 2026-06-19 14:04:25 +02:00
drift-cli.test.mjs test: isolate HOME in all CLI-spawning tests (close leak class) 2026-06-18 18:17:09 +02:00
feature-gap-scanner.test.mjs feat(feature-gap): recommend disableBundledSkills under skill-listing pressure 2026-06-18 21:38:19 +02:00
fix-cli.test.mjs test(fix-cli): close missed HOME-leak — isolate spawns + lock SKL/COL out 2026-06-18 18:50:20 +02:00
fix-engine.test.mjs feat(ultraplan-local): v1.6.0 — /ultraresearch-local deep research command 2026-04-08 08:58:35 +02:00
hook-validator.test.mjs fix(hook-validator): recognize MessageDisplay + post-session events 2026-06-18 12:00:40 +02:00
import-resolver.test.mjs feat(ultraplan-local): v1.6.0 — /ultraresearch-local deep research command 2026-04-08 08:58:35 +02:00
lint-default-output.test.mjs test(snapshots): make byte/snapshot tests hermetic + re-seed baseline 2026-06-18 12:26:00 +02:00
manifest.test.mjs feat(config-audit): /config-audit manifest command (v5 N2) [skip-docs] 2026-05-01 07:32:54 +02:00
mcp-config-validator.test.mjs fix(mcp-config-validator): remove invented trust field (verify-first) 2026-06-18 14:22:56 +02:00
plugin-health-scanner.test.mjs feat(plh): validate plugin.json skills:-array entries (CA-PLH-016) 2026-06-19 21:56:57 +02:00
posture-grade-stability.test.mjs feat(skill-listing): add CA-SKL-002 aggregate listing-budget check 2026-06-18 18:06:17 +02:00
posture-humanizer.test.mjs test(snapshots): make byte/snapshot tests hermetic + re-seed baseline 2026-06-18 12:26:00 +02:00
posture.test.mjs test: isolate HOME in all CLI-spawning tests (close leak class) 2026-06-18 18:17:09 +02:00
rollback-engine.test.mjs feat(ultraplan-local): v1.6.0 — /ultraresearch-local deep research command 2026-04-08 08:58:35 +02:00
rules-validator.test.mjs feat(ultraplan-local): v1.6.0 — /ultraresearch-local deep research command 2026-04-08 08:58:35 +02:00
scan-orchestrator-humanizer.test.mjs feat(skill-listing): add SKL scanner for the skill-listing token budget 2026-06-18 17:36:28 +02:00
scan-orchestrator.test.mjs feat(ultraplan-local): v1.6.0 — /ultraresearch-local deep research command 2026-04-08 08:58:35 +02:00
self-audit.test.mjs feat(config-audit): self-audit --check-readme flag (v5 F6) [skip-docs] 2026-05-01 07:09:26 +02:00
settings-validator.test.mjs feat(skill-listing): add SKL scanner for the skill-listing token budget 2026-06-18 17:36:28 +02:00
skill-listing-scanner.test.mjs feat(skill-listing): add CA-SKL-002 aggregate listing-budget check 2026-06-18 18:06:17 +02:00
token-hotspots-cli.test.mjs test: isolate HOME in all CLI-spawning tests (close leak class) 2026-06-18 18:17:09 +02:00
token-hotspots.test.mjs fix(tokens): refresh stale "Opus 4.7" framing to model-neutral + Opus 4.8 anchor 2026-06-18 15:27:36 +02:00