PLAN § v8.1.3 punkt 5. watch-cron.mjs started the orchestrator with
cwd = pluginRoot, so every watched project was outside cwd, i.e. not the
caller's own working tree, and its .llm-security-ignore / policy.json
were dropped: the user saw findings they had already suppressed. The
orchestrator now runs with cwd = the target dir (its parent for a file);
a relative target.path still resolves against pluginRoot as before.
The scope test's entropy blob is now fixed instead of random: one run
with a random blob reported zero findings for both projects, probably a
blob starting with `/` (skipped as a path, 1 in 64). Red on 002c0ba with
the fixed blob, verified.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each test fails on fd7de23:
- own-working-tree: venv site-packages, vendor/, config-dir skills/
(punkt 1); ~/.claude/plugins next to $CLAUDE_CONFIG_DIR and a leading
~ in the variable (punkt 2); NODE_MODULES case variant and a
case-mismatched parent segment (punkt 3, closes v8.1.2 punkt 4).
- watch-cron-scope: a watched project's own ignore file is honored
(punkt 5).
- av-surface (b2): no runnable base64-to-shell line with a short
command blob (addendum a; 3 hits today).
- doc-consistency: scanner-reference Knowledge Files matches knowledge/
(addendum b); ci-cd-guide makes no offline claim (addendum c).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
