The /trekreview re-review's high-effort deep read of 30-fix-references.mjs
surfaced 2 MAJOR (both pre-existing in the original delivery, not remediation
regressions):
- PLAN_EXECUTE_DRIFT: the rewriter set repository.url but left a monorepo-relative
repository.directory (e.g. llm-security's plugins/llm-security) intact, so the
standalone package.json/plugin.json shipped a directory pointing nowhere. Now
dropped in BOTH the plugin.json (3a) and package.json (3b) object branches;
idempotency preserved (gated on 'directory' in repository).
- MISSING_TEST: the package.json rewrite branch only ran against voyage/llm-security
but the only test used graceful-handoff (no package.json) — unguarded. Added a test
driving both branches against a synthetic llm-security extract (pre-init .git,
fixtures carrying repository.directory), asserting reconciliation + directory-drop
on both files + idempotency.
Independent code-correctness reviewer re-verified both RESOLVED, no new issue.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Kjell Tore Guttormsen
85a8ee345e