New COL scanner detects skill-name collisions across plugins and
between user-level skills (~/.claude/skills/) and plugin-bundled
skills. Skill identity is the directory basename — matches how
enumerateSkills resolves names.
Detection rules (per docs/v5-namespace-research.md, confidence: medium):
- Plugin-vs-plugin same skill name → severity low (CA-COL-001)
- User-vs-plugin same skill name → severity medium (CA-COL-001)
- Plugin-vs-built-in collisions: out of scope for v5.0.0 (insufficient
verification — recorded for v5.0.1 follow-up).
Findings carry details.namespaces array with {source, name, path} for
every conflicting source — supports per-collision reporting downstream.
output.mjs: finding() helper now passes through optional `details`
field (scanner-specific structured payload).
scoring.mjs: COL → "Plugin Hygiene" (new area, 10 total). Posture test
updated from 9 → 10 area scores.
.gitignore: docs/v5-namespace-research.md is local-only (Step 22a
research output, gitignored per plan).
Fixture collision-plugins/fake-home/ has user skill `review` colliding
with plugin-a + plugin-b's `review` (medium severity), plus plugin-c's
unique `summarize` (no collision).
[skip-docs] reason: v5 plan fences off README/CLAUDE.md badge updates
to Session 5; Forgejo pre-commit-docs-gate hook requires this tag.
Tests: 617 → 625 (+8).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
25 lines
509 B
Text
25 lines
509 B
Text
# Local configuration (contains machine-specific settings)
|
|
config-audit.local.md
|
|
*.local.md
|
|
.claude/settings.local.json
|
|
|
|
# Secrets
|
|
.env
|
|
*.key
|
|
*.pem
|
|
credentials.*
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
# Test fixtures intentionally include fake node_modules for tool-count detection
|
|
!tests/fixtures/**/node_modules/
|
|
!tests/fixtures/**/node_modules/**
|
|
|
|
# Development prompts
|
|
S*-PROMPT.md
|
|
|
|
# Plugin state (managed by plugin)
|
|
.config-audit/
|
|
|
|
# v5 namespace research (local-only spike output)
|
|
docs/v5-namespace-research.md
|