fix(ms-ai-architect): RX-P1 installert-modus-hardening — ${CLAUDE_PLUGIN_ROOT}-forankring + scoped agent-delegering [skip-docs]

- Forankre 115 skills/-KB-stier med ${CLAUDE_PLUGIN_ROOT}/ i 26 commands + 10 agenter
  (relative stier resolver kun dev-modus; installert fra katalog mistet subagentene KB-last)
- Foren delegering til registrert scoped navn ms-ai-architect:<agent>
  (var: architect:X feil-namespace + bare navn + general-purpose+"Read agents/X.md")
- Dropp redundant "Read/Les agents/X.md"-instruks (scoped agent auto-laster egen kropp)
- Bevar per-kommando KB-kontrakt inkl. dpia betinget data-residens-ruting (Option B)
- generate-skills: sonnet→opus (opus-direktiv), {PLUGIN_ROOT}→${CLAUDE_PLUGIN_ROOT};
  git-pathspecs holdt repo-relative
- plugin.json repository: ktg-plugin-marketplace→ms-ai-architect (polyrepo egen repo)
- validate-plugin.sh Check 6 (install-safety lint: sti + delegering + opus-only) + node-wrapper i kanonisk suite

tests/kb-update/test-validate-plugin.test.mjs

@@ -0,0 +1,25 @@
+// Wires the static plugin validator (tests/validate-plugin.sh) into the canonical
+// node --test suite so its checks — including RX-P1 Check 6 (install-mode path &
+// delegation safety) — are enforced on every suite run, not just manual invocation.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pluginRoot = join(here, '..', '..'); // tests/kb-update -> plugin root
+const script = join(pluginRoot, 'tests', 'validate-plugin.sh');
+
+test('validate-plugin.sh passes (frontmatter, encoding, KB refs, plugin.json, install-mode Check 6)', () => {
+  let out;
+  try {
+    out = execFileSync('bash', [script], { encoding: 'utf8', cwd: pluginRoot });
+  } catch (err) {
+    assert.fail(
+      `validate-plugin.sh exited ${err.status}:\n${err.stdout || ''}${err.stderr || ''}`,
+    );
+  }
+  assert.match(out, /VALIDATION PASSED/);
+  assert.doesNotMatch(out, /VALIDATION FAILED/);
+});

tests/validate-plugin.sh

@@ -277,6 +277,80 @@ fi
 
 echo ""
 
+# -------------------------------------------------------
+# Check 6: Install-mode Path & Delegation Safety (RX-P1)
+# -------------------------------------------------------
+# Bundled-file references and agent delegations must resolve when the plugin is
+# INSTALLED from a marketplace (cwd = user project, not plugin root). Relative
+# 'skills/...' paths and bare/wrong-namespace agent names silently break there.
+echo "--- Check 6: Install-mode Path & Delegation Safety ---"
+
+# 6a: every bundled 'skills/' reference must be ${CLAUDE_PLUGIN_ROOT}-anchored
+path_offenders=0
+for f in "$PLUGIN_ROOT"/commands/*.md "$PLUGIN_ROOT"/agents/*.md; do
+  [ -f "$f" ] || continue
+  rel="${f#$PLUGIN_ROOT/}"
+  # Blank out correctly-anchored refs, then flag any remaining bare 'skills/'
+  bare="$(sed 's|${CLAUDE_PLUGIN_ROOT}/skills/|__ANCHORED__/|g' "$f" | grep -nE 'skills/[a-zA-Z0-9_-]+/' || true)"
+  if [ -n "$bare" ]; then
+    while IFS= read -r bline; do
+      [ -n "$bline" ] || continue
+      lineno="${bline%%:*}"
+      fail "$rel:$lineno: bare 'skills/' path (needs \${CLAUDE_PLUGIN_ROOT}/ prefix for installed mode)"
+      path_offenders=$((path_offenders + 1))
+    done <<< "$bare"
+  fi
+done
+if [ "$path_offenders" -eq 0 ]; then
+  pass "All skills/ references are \${CLAUDE_PLUGIN_ROOT}-anchored"
+fi
+
+# 6b: command agent-delegations must use 'general-purpose' or the registered
+#     scoped name '<plugin>:<agent>' (bare names / wrong namespace break installed)
+PLUGIN_NAME="$(grep -o '"name"[^,]*' "$plugin_json" | head -1 | sed 's/.*: *"//; s/"//')"
+deleg_offenders=0
+while IFS= read -r hit; do
+  [ -n "$hit" ] || continue
+  loc="${hit%%:Task(*}"          # /abs/commands/foo.md:NN
+  token="${hit##*:Task(}"        # delegation token
+  rel="${loc%:*}"; rel="${rel#$PLUGIN_ROOT/}"
+  lineno="${loc##*:}"
+  if [ "$token" = "general-purpose" ]; then
+    continue
+  fi
+  case "$token" in
+    "$PLUGIN_NAME":*)
+      suffix="${token##*:}"
+      if [ -f "$PLUGIN_ROOT/agents/$suffix.md" ]; then
+        continue
+      else
+        fail "$rel:$lineno: Task($token) — no matching agents/$suffix.md"
+        deleg_offenders=$((deleg_offenders + 1))
+      fi
+      ;;
+    *)
+      fail "$rel:$lineno: Task($token) — use 'general-purpose' or '$PLUGIN_NAME:<agent>' (bare/wrong-namespace breaks installed mode)"
+      deleg_offenders=$((deleg_offenders + 1))
+      ;;
+  esac
+done < <(grep -noE 'Task\([a-zA-Z0-9_:.-]+' "$PLUGIN_ROOT"/commands/*.md 2>/dev/null || true)
+if [ "$deleg_offenders" -eq 0 ]; then
+  pass "All command agent-delegations use general-purpose or registered scoped names"
+fi
+
+# 6c: no sonnet/haiku pinned in Task delegations (operator directive: opus only)
+model_hits="$(grep -nE 'Task\([^)]*(sonnet|haiku)' "$PLUGIN_ROOT"/commands/*.md 2>/dev/null || true)"
+if [ -n "$model_hits" ]; then
+  while IFS= read -r mline; do
+    [ -n "$mline" ] || continue
+    fail "${mline#$PLUGIN_ROOT/}: non-opus model pinned in Task delegation"
+  done <<< "$model_hits"
+else
+  pass "No sonnet/haiku pinned in Task delegations"
+fi
+
+echo ""
+
 # -------------------------------------------------------
 # Summary
 # -------------------------------------------------------