From 6aa3cd2eac7edbff74edcf18ba5dcb99524e5f69 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:06:09 -0400 Subject: [PATCH 1/9] docs: repoint remaining retired code.claude.com slugs and fix drifted plugin claims Map plugins, plugin-dependencies, plugin-hints, plugin-marketplaces, plugin-relevance, plugins/mods and slash-commands citations to the live pages and anchors that hold each claim. Rewrite the migration playbook archive bullet as a pointer record, update the disk-hygiene known_marketplaces record whose trigger fired, the visualization userConfig options claim, and the harness-ops inventory component-set row. Drop the --settings source from the generated plugin-options text and record it as unverified in hook-config-delivery fact 5. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EC7nAKxQg52rCug6r6tYfe --- README.md | 4 +- ...s-plugins-by-vendoring-with-a-sync-gate.md | 2 +- .../hook-config-delivery/README.md | 2 +- docs/migration-playbook.md | 43 +++++++++---------- docs/official-docs.md | 16 ++++--- docs/plugin-philosophy.md | 6 +-- plugins/actionlint/README.md | 8 ++-- plugins/ai-briefing/README.md | 8 ++-- plugins/animation/README.md | 8 ++-- plugins/autonomy/README.md | 8 ++-- plugins/bash-format/README.md | 8 ++-- plugins/biome-format/README.md | 8 ++-- plugins/bugs/README.md | 8 ++-- plugins/code-tidying/README.md | 8 ++-- plugins/context-budget/README.md | 8 ++-- .../skills/audit/reference/levers.json | 2 +- plugins/context-guard/README.md | 8 ++-- plugins/desktop-notification/README.md | 8 ++-- plugins/discipline/README.md | 8 ++-- plugins/disk-hygiene/README.md | 12 +++--- .../skills/clean/reference/safety-model.md | 24 ++++++----- plugins/dometrain-mcp/README.md | 8 ++-- plugins/education/README.md | 8 ++-- plugins/eol-normalizer/README.md | 8 ++-- plugins/evals/README.md | 8 ++-- plugins/gaming/README.md | 8 ++-- plugins/github/README.md | 8 ++-- plugins/go-format/README.md | 8 ++-- plugins/guardrails/README.md | 8 ++-- .../audit-pass/reference/liveness-sources.md | 4 +- plugins/harness-ops/README.md | 8 ++-- plugins/harness-ops/skills/inventory/SKILL.md | 2 +- .../skills/plugins/context/gotchas.md | 7 +-- .../skills/plugins/context/scope-semantics.md | 5 ++- plugins/implementation/README.md | 8 ++-- plugins/instruction-placement/README.md | 8 ++-- plugins/knowledge/README.md | 8 ++-- plugins/machine-health/README.md | 8 ++-- plugins/markdown-format/README.md | 8 ++-- plugins/miro/README.md | 8 ++-- plugins/pixel-art/README.md | 8 ++-- plugins/pixel-art/reference/brief.md | 4 +- plugins/planning/README.md | 8 ++-- .../audit/reference/component-types/config.md | 2 +- plugins/powershell-format/README.md | 8 ++-- plugins/rate-limit-guard/README.md | 8 ++-- .../reference/reader-contract.md | 4 +- .../audit/reference/official-sources.md | 4 +- plugins/repo-hygiene/README.md | 8 ++-- plugins/ruff-format/README.md | 8 ++-- plugins/session-flow/README.md | 8 ++-- plugins/skill-quality/README.md | 8 ++-- plugins/source-control/README.md | 8 ++-- plugins/testing/README.md | 8 ++-- plugins/typos-format/README.md | 8 ++-- plugins/user-interface/README.md | 8 ++-- plugins/visualization/README.md | 8 ++-- .../visualize/context/decision-matrix.md | 6 ++- plugins/work-items/README.md | 8 ++-- scripts/sync-plugin-options-docs.py | 8 ++-- 60 files changed, 249 insertions(+), 236 deletions(-) diff --git a/README.md b/README.md index 0d02f2090e..d6c21d639d 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ marketplace source AND allowlist its name in the same file: The source declaration is required for any non-official marketplace: the allowlisted name is ignored if the locally registered marketplace came from a different source. That rule stops an unrelated catalog from registering under an allowlisted name to get its plugins suggested. -Reference: [Recommend plugins for your org](https://code.claude.com/docs/en/plugin-relevance). +Reference: [Recommend plugins for your org](https://code.claude.com/docs/en/plugins/relevance#enable-suggestions-in-managed-settings). A plugin whose catalog entry sets `defaultEnabled: false` installs disabled until the user opts in with `/plugin enable`. The flag is set per plugin, not per category: most domain, personal, @@ -249,7 +249,7 @@ touch. This repo tracks policy and wiring only; authoritative behavior lives in the official docs, which must be read fresh rather than recalled. Start at the -[Claude Code plugins guide](https://code.claude.com/docs/en/plugins). +[Claude Code plugins overview](https://code.claude.com/docs/en/plugins/overview). ## What this marketplace actually publishes diff --git a/docs/adr/0019-share-code-across-plugins-by-vendoring-with-a-sync-gate.md b/docs/adr/0019-share-code-across-plugins-by-vendoring-with-a-sync-gate.md index f74699ffb0..2be2b9372f 100644 --- a/docs/adr/0019-share-code-across-plugins-by-vendoring-with-a-sync-gate.md +++ b/docs/adr/0019-share-code-across-plugins-by-vendoring-with-a-sync-gate.md @@ -30,7 +30,7 @@ Alternatives weighed (docs verified 2026-07-03): *dependency's* install path, and cache directories are per-version (with a commit-SHA suffix for tag-resolved dependencies), so computing the path is unsupported by design (; - ). **Recheck trigger:** Claude Code + ). **Recheck trigger:** Claude Code ships a documented dependency-path variable; that would also allow sharing the lib beyond this marketplace. - **Marketplace-internal symlinks: rejected (amended 2026-10-02, was deferred).** Documented diff --git a/docs/conventions/hook-config-delivery/README.md b/docs/conventions/hook-config-delivery/README.md index cc7a0c96e8..6784d54d9f 100644 --- a/docs/conventions/hook-config-delivery/README.md +++ b/docs/conventions/hook-config-delivery/README.md @@ -43,7 +43,7 @@ a row in new work. | 2 | A hook process reads a configured value from `CLAUDE_PLUGIN_OPTION_` (key uppercased) | doc-stated ([User configuration](https://code.claude.com/docs/en/plugins/manifest-reference#user-configuration)); scope narrowed by fact 4 | 2.1.218, 2026-07-24 | | 3 | The declared `default` field is in the schema but **implemented for neither argv substitution nor env export**. An unset-but-defaulted `${user_config.*}` argv token **silently drops the entire hook entry**. It is not passed literally and not empty-substituted; the same unset key exports **no** env var | proven (probe T1); upstream [#46477](https://github.com/anthropics/claude-code/issues/46477) closed not-planned, [#39455](https://github.com/anthropics/claude-code/issues/39455) open, [#39827](https://github.com/anthropics/claude-code/issues/39827) closed not-planned; undocumented | 2.1.218, 2026-07-23 | | 4 | Tamper split on the env channel: for a **configured** key, harness injection overwrites a repo `.claude/settings.json` `env` block (injection wins); for an **unconfigured** key nothing is injected and the repo's `env` block freely populates `CLAUDE_PLUGIN_OPTION_`. Env carries no provenance, so a hook cannot tell the two apart | proven (probe T2/T2b); undocumented | 2.1.218, 2026-07-23 | -| 5 | We treat `pluginConfigs` as living in **user settings, the `--settings` flag, and managed settings only**, and an entry in a project's `.claude/settings.json` / `.claude/settings.local.json` as ignored | doc-stated ([`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs)) | 2.1.218, 2026-07-24 | +| 5 | We treat `pluginConfigs` as living in **user and managed settings**, and an entry in a project's `.claude/settings.json` / `.claude/settings.local.json` as ignored. A value passed with the `--settings` flag is **unverified**: the entry's scope reads "User or managed" and no longer names `--settings`, so a mechanism that passes a value that way records the route as unverified until a probe settles it. Recheck when the entry names `--settings` or another scope, or a probe shows a `--settings` value read or ignored | doc-stated ([`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs)) | 2.1.292, 2026-10-07 | | 6 | Skill- and agent-frontmatter hooks receive **neither** the argv substitution nor `CLAUDE_PLUGIN_OPTION_*` | evidence-strong (probe + field repro); CC docs silent | 2.1.218, 2026-07-23 | | 7 | We use skill/agent **body** `${user_config.KEY}` only as model-visible content, and only for non-sensitive values | doc-stated ([User configuration](https://code.claude.com/docs/en/plugins/manifest-reference#user-configuration)) | 2.1.218, 2026-07-24 | | 8 | We never expect a sensitive value in `settings.json`, so no settings reader can see one | doc-stated ([User configuration](https://code.claude.com/docs/en/plugins/manifest-reference#user-configuration)) | 2.1.218, 2026-07-24 | diff --git a/docs/migration-playbook.md b/docs/migration-playbook.md index a5b8fadc0f..ca45fe6c63 100644 --- a/docs/migration-playbook.md +++ b/docs/migration-playbook.md @@ -784,10 +784,10 @@ Catalog these per migration; they are the usual failures when an in-repo skill b - **Headless registration.** Distinguish the marketplace **source** from the session shape: - **Remote or git-sourced catalogs** (GitHub repo, URL, npm, …) in CI or other non-interactive runs: no interactive trust dialog, so run `claude plugin marketplace add` explicitly or pre-seed via - `CLAUDE_CODE_PLUGIN_SEED_DIR` ([Plugin marketplaces, "Pre-populate plugins for containers"](https://code.claude.com/docs/en/plugin-marketplaces#pre-populate-plugins-for-containers), - fetched 2026-08-12). + `CLAUDE_CODE_PLUGIN_SEED_DIR` ([Manage plugins for your organization, "Seed containers and CI"](https://code.claude.com/docs/en/plugins/org#seed-containers-and-ci), + as of 2026-10-07; recheck when that section drops the seed variable). - **`directory` / `file` source with a relative path in checked-in project `.claude/settings.json`:** - the path [resolves against the repository checkout](https://code.claude.com/docs/en/plugin-marketplaces#relative-paths), + the path [resolves against the repository checkout](https://code.claude.com/docs/en/plugins/org#require-plugins-per-repository), including cloud sessions that install from the clone at session start, with no separate `marketplace add` step. Local collaborators still see the interactive trust prompt once they trust the folder. See [`docs/cloud-sessions.md`](cloud-sessions.md) "Plugins in sessions on this repo". @@ -926,24 +926,23 @@ plugins-reference, and hooks pages 2026-07-17; re-verify per the `CLAUDE.md` fre plugin-shipped **agents** from declaring `hooks` / `mcpServers` / `permissionMode` "for security reasons". Don't design around that. - **An `archive` marketplace entry MUST carry its `sha256` pin.** A catalog entry may set - `"source": "archive"` with a `url` and an **optional** `sha256`, installing the plugin from a zip - downloaded over HTTPS with no git or npm on the consumer's machine - ([plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces#zip-archives), fetched - 2026-08-10; requires Claude Code v2.1.224 or later, and on v2.1.120–v2.1.223 the install fails while - on older versions "a marketplace containing an `archive` entry fails to load entirely"). The - platform's own floor is **transport-level only**: `url` is "Required. HTTPS URL of the zip archive. - Claude Code rejects `http://` URLs, along with loopback, link-local, and cloud-metadata hosts. Every - redirect hop must satisfy the same rules". Content identity is not in that floor: the `sha256` field - is documented as "Optional", so an unpinned entry lets the same URL serve different bytes on every - install with nothing to detect it. That is a mutable-remote-artifact surface, which criterion 6 - denies by default, so **this review requires the pin**: an `archive` entry without `sha256` is a - deny, whether this repository publishes it or accepts a plugin that depends on it. With the pin, - "Claude Code verifies every download against it and refuses the install on a mismatch". Two - follow-ons to record when accepting one: the digest doubles as the plugin's version when neither - `plugin.json` nor the entry declares one, so a repinned archive still needs its `version` bumped or - "users keep the cached copy"; and organization distribution through claude.ai admin settings does - not accept this source at all: "Plugin sources of type `github`, `url`, and `git-subdir` are - supported. `npm` and `archive` sources are not." Enforced by `scripts/validate-plugin-contracts.mjs` + `"source": "archive"` with a `url` and a `sha256` pin the platform treats as optional, installing the + plugin from a zip downloaded over HTTPS with no git or npm on the consumer's machine. The platform + checks only the transport (an `https://` URL that is not a loopback, link-local or cloud-metadata + host); content identity rests on the pin alone, so an unpinned entry lets the same URL serve + different bytes on every install with nothing to detect it. That is a mutable-remote-artifact + surface, which criterion 6 denies by default, so **this review requires the pin**: an `archive` + entry without `sha256` is a deny, whether this repository publishes it or accepts a plugin that + depends on it. Two follow-ons to record when accepting one: the digest doubles as the plugin's + version when neither `plugin.json` nor the entry declares one, so a repinned archive with a fixed + `version` still needs that `version` bumped before users leave the cached copy; and organization + sync through claude.ai settings accepts only some source types, so check its list before relying + on `archive` there. Pointers: [archive plugin source](https://code.claude.com/docs/en/plugins/marketplace-reference#archive-plugin-source) + (version floor in the [plugin sources](https://code.claude.com/docs/en/plugins/marketplace-reference#plugin-sources) + table), [How Claude Code computes the version](https://code.claude.com/docs/en/plugins/loading#how-claude-code-computes-the-version), + and [Distribute through organization settings](https://code.claude.com/docs/en/plugins/host-marketplace#distribute-through-organization-settings). + As of 2026-10-07. Recheck when the archive section makes `sha256` required or changes the URL + rules, or when organization sync starts accepting `archive`. Enforced by `scripts/validate-plugin-contracts.mjs` over `.claude-plugin/marketplace.json`. This marketplace publishes every plugin as a relative path (`"source": "./plugins/"`), so no entry uses `archive` today; the rule governs the first that does. @@ -1513,7 +1512,7 @@ claude --plugin-dir ./plugins/ hooks, and plugin MCP/LSP servers, reading the files on disk, so no commit or reinstall is needed. - **Multiple plugins at once.** Repeat the flag: `claude --plugin-dir ./plugins/ --plugin-dir ./plugins/`. `--plugin-dir` also accepts a `.zip` archive (Claude Code v2.1.128+). See - [Create plugins](https://code.claude.com/docs/en/plugins) "Test your plugins locally". + [Create plugins](https://code.claude.com/docs/en/plugins/create#from-a-directory-or-zip) "From a directory or `.zip`". - **Session-scoped and non-destructive.** The override lasts only for that session and never edits a consumer's `extraKnownMarketplaces`; the published registration stays on its GitHub remote. The lone exception: `--plugin-dir` cannot override a plugin that *managed* settings force-enable or diff --git a/docs/official-docs.md b/docs/official-docs.md index 1adbba55dd..f97c7a677a 100644 --- a/docs/official-docs.md +++ b/docs/official-docs.md @@ -47,13 +47,14 @@ so it has no row. For which slots and settings keys a plugin carries, see | Channels (`channels` manifest field) | | 2026-08-06 | | Executables (`bin/`) | | 2026-10-01 | | Settings (`settings.json` defaults) | | 2026-08-12 | -| Dependencies (`dependencies` manifest field) | | 2026-08-06 | +| Dependencies (`dependencies` manifest field) | | 2026-10-07 | ## Authoring | Page | Official doc page | As of | |---|---|---| -| Create plugins | | 2026-08-06 | +| Plugins overview | | 2026-10-07 | +| Create plugins | | 2026-10-07 | | Plugin manifest reference (schemas, variables) | | 2026-10-07 | | Plugin commands reference (CLI) | | 2026-10-07 | | Skills | | 2026-08-06 | @@ -92,12 +93,15 @@ and sessions, and they are distinct documents, so cite the one you mean by its f | Page | Official doc page | As of | |---|---|---| -| Create & distribute a marketplace | | 2026-08-06 | +| Create a marketplace | | 2026-10-07 | +| Host and maintain a marketplace | | 2026-10-07 | +| Marketplace reference (`marketplace.json`, plugin and marketplace sources) | | 2026-10-07 | +| Manage plugins for your organization (managed settings, seeding) | | 2026-10-07 | | GitHub Enterprise Server: marketplaces on a self-hosted instance, and how `owner/repo` resolves | | 2026-08-10 | | Install and manage plugins | | 2026-10-07 | -| Plugin dependencies (version constraints) | | 2026-08-06 | -| Recommend plugins for your org (plugin relevance) | | 2026-08-06 | -| Recommend your plugin from your CLI (plugin hints) | | 2026-08-06 | +| Plugin dependencies (version constraints) | | 2026-10-07 | +| Recommend plugins for your org (plugin relevance) | | 2026-10-07 | +| Recommend your plugin from your CLI (plugin hints) | | 2026-10-07 | | Plugins in the Agent SDK | | 2026-08-06 | The Agent SDK's own skills/hooks/subagents/MCP pages (`agent-sdk/skills`, `agent-sdk/hooks`, diff --git a/docs/plugin-philosophy.md b/docs/plugin-philosophy.md index 8716191d62..a23c0e0286 100644 --- a/docs/plugin-philosophy.md +++ b/docs/plugin-philosophy.md @@ -1686,7 +1686,7 @@ and the topics we read each one for. Recheck trigger for both lists: a page move covering a topic named beside it. The first list is as of 2026-08-10 (the `melodic-software/standards` entries are not Claude Code pages and carry no date): -- [Create plugins](https://code.claude.com/docs/en/plugins): plugin structure incl. `bin/` and +- [Create plugins](https://code.claude.com/docs/en/plugins/create): plugin structure incl. `bin/` and plugin `settings.json`, namespaces, testing, and migration. - [Plugin manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference): component schemas, `userConfig`, experimental components, persistent data. @@ -1694,7 +1694,7 @@ covering a topic named beside it. The first list is as of 2026-08-10 (the - [Skills](https://code.claude.com/docs/en/skills): frontmatter reference and skill lifecycle. - [Hooks reference](https://code.claude.com/docs/en/hooks): exec form vs shell form, event list, `Setup` event, skill-scoped hooks. -- [Plugin dependencies](https://code.claude.com/docs/en/plugin-dependencies): constraints, release +- [Plugin dependencies](https://code.claude.com/docs/en/plugins/dependencies): constraints, release tags, bundles. - [Claude Code settings](https://code.claude.com/docs/en/settings): settings scopes, precedence, and the special storage and read scopes of `pluginConfigs`. @@ -1706,7 +1706,7 @@ covering a topic named beside it. The first list is as of 2026-08-10 (the As of 2026-07-17: -- [Plugin dependencies](https://code.claude.com/docs/en/plugin-dependencies): the `dependencies` +- [Plugin dependencies](https://code.claude.com/docs/en/plugins/dependencies): the `dependencies` array, automatic installation, and version constraints. - [Skills](https://code.claude.com/docs/en/skills): command-name derivation and the plugin skill namespace. diff --git a/plugins/actionlint/README.md b/plugins/actionlint/README.md index acfc8ba672..5f20cbe8a4 100644 --- a/plugins/actionlint/README.md +++ b/plugins/actionlint/README.md @@ -172,10 +172,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/ai-briefing/README.md b/plugins/ai-briefing/README.md index f2fccc433c..611bc757b3 100644 --- a/plugins/ai-briefing/README.md +++ b/plugins/ai-briefing/README.md @@ -135,10 +135,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/animation/README.md b/plugins/animation/README.md index d065db9ebb..26bbe488a5 100644 --- a/plugins/animation/README.md +++ b/plugins/animation/README.md @@ -122,10 +122,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/autonomy/README.md b/plugins/autonomy/README.md index 7c9d52e927..766119efbf 100644 --- a/plugins/autonomy/README.md +++ b/plugins/autonomy/README.md @@ -313,10 +313,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/bash-format/README.md b/plugins/bash-format/README.md index 778a66ee31..fb1b95eb78 100644 --- a/plugins/bash-format/README.md +++ b/plugins/bash-format/README.md @@ -231,10 +231,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/biome-format/README.md b/plugins/biome-format/README.md index d0193a5ba6..1c11d1aaaf 100644 --- a/plugins/biome-format/README.md +++ b/plugins/biome-format/README.md @@ -178,10 +178,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/bugs/README.md b/plugins/bugs/README.md index 8bcf4423d1..09a57e3d8c 100644 --- a/plugins/bugs/README.md +++ b/plugins/bugs/README.md @@ -174,10 +174,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/code-tidying/README.md b/plugins/code-tidying/README.md index c449542eb5..72f3c0ba16 100644 --- a/plugins/code-tidying/README.md +++ b/plugins/code-tidying/README.md @@ -232,10 +232,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/context-budget/README.md b/plugins/context-budget/README.md index 216ff13172..b445ba2d4c 100644 --- a/plugins/context-budget/README.md +++ b/plugins/context-budget/README.md @@ -194,10 +194,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/context-budget/skills/audit/reference/levers.json b/plugins/context-budget/skills/audit/reference/levers.json index b3432b4a6f..d63d2624db 100644 --- a/plugins/context-budget/skills/audit/reference/levers.json +++ b/plugins/context-budget/skills/audit/reference/levers.json @@ -277,7 +277,7 @@ ], "citations": [ "https://code.claude.com/docs/en/settings", - "https://code.claude.com/docs/en/plugins", + "https://code.claude.com/docs/en/plugins/overview#make-an-installed-plugin-available-in-your-session", "https://code.claude.com/docs/en/settings-reference#enabledplugins", "https://code.claude.com/docs/en/plugins/manifest-reference#defaultenabled", "https://code.claude.com/docs/en/settings#fix-a-broken-settings-file" diff --git a/plugins/context-guard/README.md b/plugins/context-guard/README.md index 3020926e0a..cc299359d3 100644 --- a/plugins/context-guard/README.md +++ b/plugins/context-guard/README.md @@ -371,10 +371,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/desktop-notification/README.md b/plugins/desktop-notification/README.md index 857341494d..aa1454283c 100644 --- a/plugins/desktop-notification/README.md +++ b/plugins/desktop-notification/README.md @@ -146,10 +146,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/discipline/README.md b/plugins/discipline/README.md index 521541cf82..4a45e8d139 100644 --- a/plugins/discipline/README.md +++ b/plugins/discipline/README.md @@ -501,10 +501,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/disk-hygiene/README.md b/plugins/disk-hygiene/README.md index 965ce480aa..d2e9645817 100644 --- a/plugins/disk-hygiene/README.md +++ b/plugins/disk-hygiene/README.md @@ -560,14 +560,14 @@ credential, dependency, or MCP surface reopens this review. Verified 2026-07-16 against current primary documentation: -- [Create plugins](https://code.claude.com/docs/en/plugins) and +- [Create plugins](https://code.claude.com/docs/en/plugins/create) and [plugin manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference) and [plugin loading reference](https://code.claude.com/docs/en/plugins/loading). Plugin structure, cache isolation, manifests, versions, and local `--plugin-dir` testing. - [Skills](https://code.claude.com/docs/en/skills). Side-effecting skills should be manual-only; supporting files, arguments, and skill-scoped hooks. - [Hooks](https://code.claude.com/docs/en/hooks). Current `PreToolUse` decision output. -- [Create a marketplace](https://code.claude.com/docs/en/plugin-marketplaces). Relative plugin sources. +- [Marketplace reference](https://code.claude.com/docs/en/plugins/marketplace-reference#relative-path-plugin-source). Relative plugin sources. - [GNU Bash shell expansions](https://www.gnu.org/software/bash/manual/html_node/Shell-Expansions.html) . Expansion order and the brace, tilde, parameter, command, arithmetic, process, splitting, and filename-expansion families rejected by the literal-command guard. @@ -643,10 +643,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/disk-hygiene/skills/clean/reference/safety-model.md b/plugins/disk-hygiene/skills/clean/reference/safety-model.md index 4981ff3aaa..e241a28b15 100644 --- a/plugins/disk-hygiene/skills/clean/reference/safety-model.md +++ b/plugins/disk-hygiene/skills/clean/reference/safety-model.md @@ -423,7 +423,8 @@ plus that id, never from a path read out of either file. The same proof supplies `/settings.json`, so the kill switch is read on a directory install too. That read passes no exact `pluginConfigs` key: the user and managed reads match any `disk-hygiene` key, as broad as the managed read was before, so the channel can only add a deny. This couples to the -undocumented contents of `known_marketplaces.json`, and is acceptable on the same terms as the cache +contents of `known_marketplaces.json`, whose entry fields the docs list but whose stored `source` +object they do not specify (record below), and is acceptable on the same terms as the cache coupling: its only failure mode is fail-closed, since any unproven step yields no authority. `` is `/.claude`, with the home read from the OS account record (the password @@ -499,15 +500,18 @@ Verification records for the directory channel: "`{id}` is the plugin identifier with characters outside `a-z`, `A-Z`, `0-9`, `_`, and `-` replaced by `-`". **As of:** 2026-09-24, Claude Code 2.1.282. **Recheck:** when that section's id rule changes, or a release note names the plugin data directory. -- **Claim:** the docs name `~/.claude/plugins/known_marketplaces.json` only as where marketplace state - is stored, and `installLocation` only as a field of `claude plugin marketplace list --json` output; - the file's contents are undocumented. **Basis:** raw-markdown fetches of the plugins reference (no - mention) and - [plugin marketplaces](https://code.claude.com/docs/en/plugin-marketplaces) ("Marketplace state is - stored once per user in `~/.claude/plugins/known_marketplaces.json`, not per project"; "an - `installLocation` field with the local cache path where the marketplace is stored"). The absence - covers those two pages only. **As of:** 2026-09-24, Claude Code 2.1.282. **Recheck:** when either - page documents the file's contents, or a release note names `known_marketplaces.json`. +- **Claim:** the docs now list the top-level fields of each `known_marketplaces.json` entry + (`source`, `installLocation`, among others) and say one file serves every project, and that a local + `file` or `directory` marketplace's `installLocation` is the path the user gave; they do not specify + the nested `source` object as it is stored in this file, or promise the format stays stable. The + guard's coupling is to those documented fields plus the `directory` source shape the marketplace + reference defines for settings. **Basis:** + [Check which stage a plugin reached](https://code.claude.com/docs/en/plugins/loading#check-which-stage-a-plugin-reached), + [Find plugins on disk](https://code.claude.com/docs/en/plugins/loading#find-plugins-on-disk), and + [Marketplace sources](https://code.claude.com/docs/en/plugins/marketplace-reference#marketplace-sources). + **As of:** 2026-10-07, Claude Code 2.1.292. **Recheck:** when those sections rename or drop the + `source` or `installLocation` field, document the stored `source` object, or a release note changes + `known_marketplaces.json`. The same guard also covers the PowerShell tool with the inverse tradeoff: PowerShell stays open for read-only support work, while engine invocations are hard-denied (Bash is the only engine lane) and diff --git a/plugins/dometrain-mcp/README.md b/plugins/dometrain-mcp/README.md index 2700975f80..5b6c97ccd9 100644 --- a/plugins/dometrain-mcp/README.md +++ b/plugins/dometrain-mcp/README.md @@ -248,10 +248,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/education/README.md b/plugins/education/README.md index 94c942838c..236462abfe 100644 --- a/plugins/education/README.md +++ b/plugins/education/README.md @@ -184,10 +184,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/eol-normalizer/README.md b/plugins/eol-normalizer/README.md index 22e07b7101..8f9c3aad4f 100644 --- a/plugins/eol-normalizer/README.md +++ b/plugins/eol-normalizer/README.md @@ -165,10 +165,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/evals/README.md b/plugins/evals/README.md index c3356103d1..18fa1483c4 100644 --- a/plugins/evals/README.md +++ b/plugins/evals/README.md @@ -156,10 +156,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/gaming/README.md b/plugins/gaming/README.md index 86a86b2d25..8959a84d58 100644 --- a/plugins/gaming/README.md +++ b/plugins/gaming/README.md @@ -151,10 +151,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/github/README.md b/plugins/github/README.md index ab9f4da8bb..12375e88aa 100644 --- a/plugins/github/README.md +++ b/plugins/github/README.md @@ -132,10 +132,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/go-format/README.md b/plugins/go-format/README.md index 67df458b4f..8879db7051 100644 --- a/plugins/go-format/README.md +++ b/plugins/go-format/README.md @@ -185,10 +185,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/guardrails/README.md b/plugins/guardrails/README.md index e1795d1555..0cc36d725f 100644 --- a/plugins/guardrails/README.md +++ b/plugins/guardrails/README.md @@ -1584,10 +1584,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/harness-config/skills/audit-pass/reference/liveness-sources.md b/plugins/harness-config/skills/audit-pass/reference/liveness-sources.md index cf6256f783..f4bd62227a 100644 --- a/plugins/harness-config/skills/audit-pass/reference/liveness-sources.md +++ b/plugins/harness-config/skills/audit-pass/reference/liveness-sources.md @@ -20,8 +20,8 @@ was single-sourced anyway while the report presented a two-source design. > **Verified 2026-09-13**, Claude Code 2.1.268. **Claim:** those six are built-in commands with no > model-invocable form; model invocation of built-ins has been *removed* upstream rather than added > to, `/verify` and `/deep-research` being the worked cases. **Basis:** -> [slash commands](https://code.claude.com/docs/en/slash-commands) plus the installed binary's own -> command surface. **Recheck trigger:** a release note or the slash-commands page granting any of +> [commands](https://code.claude.com/docs/en/commands#all-commands) plus the installed binary's own +> command surface. **Recheck trigger:** a release note or the commands page granting any of > those six a model-invocable or non-interactive form, at which point it returns as a source. ## The sources Phase 1 takes diff --git a/plugins/harness-ops/README.md b/plugins/harness-ops/README.md index e35a7de200..cf246c319c 100644 --- a/plugins/harness-ops/README.md +++ b/plugins/harness-ops/README.md @@ -523,10 +523,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/harness-ops/skills/inventory/SKILL.md b/plugins/harness-ops/skills/inventory/SKILL.md index 3f22772cc1..93bb2932c0 100644 --- a/plugins/harness-ops/skills/inventory/SKILL.md +++ b/plugins/harness-ops/skills/inventory/SKILL.md @@ -263,7 +263,7 @@ Upstream facts this skill depends on, each with the trigger that obliges re-deri | Claim | Basis | Recheck trigger | Verified | |---|---|---|---| | The commands page publishes a partial built-in table, so it is a cross-check and the binary stays the source: its "All commands" table carries rows for commands, aliases, removed commands, and **Skill**/**Workflow** markers, and the binary registers names it omits | `docs/en/commands.md` parsed by `--docs` (115 rows) against a `--binary-only --docs` run on this machine, which classed 39 registered names `undocumented` | The commands page drops or restructures its table (the docs block goes `broken`), or the undocumented count reaches zero | 2026-09-29, Claude Code 2.1.284 | -| The plugin component set is skills, commands, agents, workflows, output-styles, themes, monitors, hooks, bin, settings.json, .mcp.json, .lsp.json, dependencies; the manifest also declares `channels`, each bound to one of the plugin's MCP servers, which this skill does not scan | `docs/en/plugins/manifest-reference.md` manifest schema and standard plugin layout table | The manifest schema gains or drops a component key | 2026-09-29 | +| The plugin component set is skills, commands, agents, workflows, output-styles, themes, monitors, hooks, bin, settings.json, .mcp.json, .lsp.json, dependencies; the manifest also declares `channels`, each bound to one of the plugin's MCP servers, `types` (a mod's `.d.ts` declaration file) and `experimental.evals` (the eval-case directory), none of which this skill scans | `docs/en/plugins/manifest-reference.md` manifest schema and standard plugin layout table | The manifest schema gains or drops a component key | 2026-10-07 | | A user reaches a built-in or custom subagent by @-mention or `--agent`, and the model by the Agent tool; the page documents Explore, Plan, general-purpose, claude, statusline-setup, and claude-code-guide, and the binary also defines fork, web-fetch, worker, workflow-subagent, and comment-thread-analyst | `docs/en/sub-agents.md` ("Built-in subagents", "Invoke subagents explicitly") against a `--binary-only` run on this machine | The page changes its built-in list or invocation patterns, or a run's `builtin_agents` names change | 2026-09-29, Claude Code 2.1.285 | | Claude Code ships built-in plugins as `@builtin`, registered in the binary rather than installed on disk, so the binary read stays the source; the overview's roster of built-in mods is a cross-check, as the commands page is for commands, because the binary registers built-ins the roster omits | Pointer: [Mods built into Claude Code](https://code.claude.com/docs/en/plugins/mods/overview#mods-built-into-claude-code), against an inventory run on this machine whose `builtin_plugins` lane resolved 11 names, every roster row among them | The roster section moves, its rows come to match the `builtin_plugins` names, or the `builtin_plugins` lane goes `broken` | 2026-10-02, Claude Code 2.1.288 | | A built-in plugin's gate reads a GrowthBook flag cached in the global config's `cachedGrowthBookFeatures`; `cc-plugin-diff`'s `isAvailable` is `ft()&&lo(Ce(),at)`, where `lo` stores the first value per flag in `pinnedFeatureValues` for the process, so availability is fixed at session start; installed mods load under `tengu_plugin_hooks_modules` (default true) | The 2.1.287 bundle on this machine (`var vr=()=>ft()&&lo(Ce(),at)`; `function lo(e,n){let r=Co().pinnedFeatureValues??=new Map;if(!r.has(e))r.set(e,C(e,n));...}`; `var HXe="tengu_plugin_hooks_modules";var kjt=!0;var dQ=()=>C(HXe,kjt)`) and `jq .cachedGrowthBookFeatures ~/.claude.json` | A release renames `cachedGrowthBookFeatures` or `pinnedFeatureValues`, drops the rollout flag string (`builtin_plugin_notes.mods_flag_in_bundle` goes false), or docs publish per-plugin availability | 2026-10-01, Claude Code 2.1.287 | diff --git a/plugins/harness-ops/skills/plugins/context/gotchas.md b/plugins/harness-ops/skills/plugins/context/gotchas.md index 75292cb551..f53f591b00 100644 --- a/plugins/harness-ops/skills/plugins/context/gotchas.md +++ b/plugins/harness-ops/skills/plugins/context/gotchas.md @@ -270,8 +270,9 @@ preserved. this subcommand. *Basis:* the shipped CLI bundle (`~/.local/share/claude/versions/`) for the record cascade, the data-directory removal, the settings cleanup and the `.orphaned_at` write, none of which the docs state; -[plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces) for "Removing a -marketplace from its last remaining scope also uninstalls any plugins you installed from it", and +[plugin marketplace remove](https://code.claude.com/docs/en/plugins/cli-reference#plugin-marketplace-remove) +for the uninstall of every plugin installed from a marketplace removed from its last scope (re-read +2026-10-07), and [plugin uninstall](https://code.claude.com/docs/en/plugins/cli-reference#plugin-uninstall) for `uninstall --keep-data`; and `claude plugin marketplace remove --help`, which lists `--scope` and nothing else. *As of* 2026-09-07 on **Claude Code 2.1.263** (win32), with the same bundle strings present in 2.1.260 and @@ -398,7 +399,7 @@ figures are wall-clock from that same run and are machine- and plugin-count-depe them as orders of magnitude rather than constants. Neither the spawn behavior nor `--bare` is documented on [plugin uninstall](https://code.claude.com/docs/en/plugins/cli-reference#plugin-uninstall) or -[plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces), which is why this +[plugin marketplace remove](https://code.claude.com/docs/en/plugins/cli-reference#plugin-marketplace-remove), which is why this record exists. *As of* 2026-09-15 on **Claude Code 2.1.272** (win32); the revert itself ran on 2.1.263–2.1.272 with no observed change in the behavior. ***Recheck trigger:*** a bulk or glob-accepting form appearing on `claude plugin uninstall --help`; any release note or diff --git a/plugins/harness-ops/skills/plugins/context/scope-semantics.md b/plugins/harness-ops/skills/plugins/context/scope-semantics.md index 2cc12b11be..c619e65b29 100644 --- a/plugins/harness-ops/skills/plugins/context/scope-semantics.md +++ b/plugins/harness-ops/skills/plugins/context/scope-semantics.md @@ -25,7 +25,10 @@ probe on a real machine, never on training data, and stores no upstream text. La plugins-reference and discover-plugins (both since split: the [plugin manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference), [plugin commands reference](https://code.claude.com/docs/en/plugins/cli-reference), [plugin loading reference](https://code.claude.com/docs/en/plugins/loading) and [Install and manage plugins](https://code.claude.com/docs/en/plugins/install) now hold their content), -[plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces), and the published +plugin-marketplaces (since split into the +[marketplace reference](https://code.claude.com/docs/en/plugins/marketplace-reference), +[Create a marketplace](https://code.claude.com/docs/en/plugins/create-marketplace) and +[Host and maintain a marketplace](https://code.claude.com/docs/en/plugins/host-marketplace)), and the published plugin-manifest JSON Schema, all re-fetched that day and all unchanged on the claims below. The probes in "Where project-scope records come from, and why the skill cannot reap them" were run 2026-09-06 on **Claude Code 2.1.263** and carry that stamp. diff --git a/plugins/implementation/README.md b/plugins/implementation/README.md index 0e243f1f20..2cb057d275 100644 --- a/plugins/implementation/README.md +++ b/plugins/implementation/README.md @@ -196,10 +196,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/instruction-placement/README.md b/plugins/instruction-placement/README.md index 402f5e6f7b..7b981a35e2 100644 --- a/plugins/instruction-placement/README.md +++ b/plugins/instruction-placement/README.md @@ -257,10 +257,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/knowledge/README.md b/plugins/knowledge/README.md index 59dd76e2f0..9021072eee 100644 --- a/plugins/knowledge/README.md +++ b/plugins/knowledge/README.md @@ -162,10 +162,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/machine-health/README.md b/plugins/machine-health/README.md index 89d9607a63..9aabb27071 100644 --- a/plugins/machine-health/README.md +++ b/plugins/machine-health/README.md @@ -140,10 +140,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/markdown-format/README.md b/plugins/markdown-format/README.md index cf993c9551..b0d87502f8 100644 --- a/plugins/markdown-format/README.md +++ b/plugins/markdown-format/README.md @@ -321,10 +321,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/miro/README.md b/plugins/miro/README.md index a7f162ed3b..81b03d62f8 100644 --- a/plugins/miro/README.md +++ b/plugins/miro/README.md @@ -222,10 +222,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/pixel-art/README.md b/plugins/pixel-art/README.md index 527a6779a1..a8691b33db 100644 --- a/plugins/pixel-art/README.md +++ b/plugins/pixel-art/README.md @@ -159,10 +159,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/pixel-art/reference/brief.md b/plugins/pixel-art/reference/brief.md index 142d973b57..03f0b3dbfe 100644 --- a/plugins/pixel-art/reference/brief.md +++ b/plugins/pixel-art/reference/brief.md @@ -63,8 +63,8 @@ When the request is vague (no subject, or no checkable done criterion) or high-s ## Recorded decisions - **Claim.** An enabled Claude Code plugin contributes its skills to the session; a skill from another plugin is not available unless that plugin is installed. The full skill text loads when the skill is used. -- **Basis.** [Plugins overview](https://code.claude.com/docs/en/plugins), sections "Decide whether you need a plugin" and "What an enabled plugin adds to your sessions", read 2026-09-28. -- **As of.** 2026-09-28. +- **Basis.** [Plugins overview](https://code.claude.com/docs/en/plugins/overview#decide-whether-you-need-a-plugin), sections "Decide whether you need a plugin" and "What an enabled plugin adds to your sessions", read 2026-10-07. +- **As of.** 2026-10-07. - **Recheck.** That page no longer stating that plugins are installed as units, or that a plugin's skills are present only when the plugin is enabled. `craft-static.md` is in-repo. Re-read it when its silhouette, palette, or grid sections change; those sections are why proportions, style references, and palette are fields and why the rest default. diff --git a/plugins/planning/README.md b/plugins/planning/README.md index 7a07aa09c1..bde479b685 100644 --- a/plugins/planning/README.md +++ b/plugins/planning/README.md @@ -156,10 +156,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/plugin-quality/skills/audit/reference/component-types/config.md b/plugins/plugin-quality/skills/audit/reference/component-types/config.md index 13da1f5dcc..3f9000fa3f 100644 --- a/plugins/plugin-quality/skills/audit/reference/component-types/config.md +++ b/plugins/plugin-quality/skills/audit/reference/component-types/config.md @@ -39,7 +39,7 @@ convention/config files the plugin reads. plugin reload, while `"on-skill-invoke:"` keeps it dormant until that skill is first dispatched. Every stdout line from `command` reaches Claude as a notification; check volume for the trigger's actual lifetime and that the command runs on the consumer's platform. (All three - surfaces per and + surfaces per and , fetched 2026-10-07. Recheck when either page stops describing the monitor trigger values or the stdout-to-notification path, or when a release note names the monitors component.) diff --git a/plugins/powershell-format/README.md b/plugins/powershell-format/README.md index 22582efad7..d96c133ce7 100644 --- a/plugins/powershell-format/README.md +++ b/plugins/powershell-format/README.md @@ -208,10 +208,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/rate-limit-guard/README.md b/plugins/rate-limit-guard/README.md index 67f8ba564b..0b62925655 100644 --- a/plugins/rate-limit-guard/README.md +++ b/plugins/rate-limit-guard/README.md @@ -325,10 +325,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/rate-limit-guard/reference/reader-contract.md b/plugins/rate-limit-guard/reference/reader-contract.md index 140584120b..2dfa908a4c 100644 --- a/plugins/rate-limit-guard/reference/reader-contract.md +++ b/plugins/rate-limit-guard/reference/reader-contract.md @@ -163,9 +163,9 @@ module runs, it writes inside that container, where only sessions in the same co the file; no run of the module in a cloud session has been made, so this contract does not count on it. -- **Pointer**: [mods overview: where mods run](https://code.claude.com/docs/en/plugins/mods#where-mods-run), +- **Pointer**: [mods overview: where mods run](https://code.claude.com/docs/en/plugins/mods/overview#where-mods-run), the cloud session row. -- **As of**: 2026-10-03, Claude Code 2.1.288. +- **As of**: 2026-10-07, Claude Code 2.1.292. - **Recheck trigger**: that section changes whether mods run in cloud sessions, or a cloud run of this module is made. diff --git a/plugins/repo-fleet-hygiene/skills/audit/reference/official-sources.md b/plugins/repo-fleet-hygiene/skills/audit/reference/official-sources.md index 2ae1b57258..b9879d8fe3 100644 --- a/plugins/repo-fleet-hygiene/skills/audit/reference/official-sources.md +++ b/plugins/repo-fleet-hygiene/skills/audit/reference/official-sources.md @@ -8,7 +8,7 @@ and evidence contracts; the plugin does not rely on remembered behavior. ## Claude Code -- [Create plugins](https://code.claude.com/docs/en/plugins): plugin root/layout, namespaced skills, +- [Create plugins](https://code.claude.com/docs/en/plugins/create): plugin root/layout, namespaced skills, local `--plugin-dir` testing, and reusable plugin boundary. - [Plugin manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference): manifest fields and `${CLAUDE_PLUGIN_ROOT}`. @@ -16,7 +16,7 @@ and evidence contracts; the plugin does not rely on remembered behavior. - [Skills](https://code.claude.com/docs/en/skills): skill frontmatter, arguments, and `allowed-tools` semantics. `allowed-tools` grants permission but does not remove other tools, so the skill also states its report-only behavioral boundary explicitly. -- [Plugin marketplaces](https://code.claude.com/docs/en/plugin-marketplaces): local marketplace +- [Marketplace reference](https://code.claude.com/docs/en/plugins/marketplace-reference): local marketplace catalog structure and validation. ## Git diff --git a/plugins/repo-hygiene/README.md b/plugins/repo-hygiene/README.md index cc9eeff9e1..44543b9a43 100644 --- a/plugins/repo-hygiene/README.md +++ b/plugins/repo-hygiene/README.md @@ -184,10 +184,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/ruff-format/README.md b/plugins/ruff-format/README.md index 657d93339f..135b47f90a 100644 --- a/plugins/ruff-format/README.md +++ b/plugins/ruff-format/README.md @@ -185,10 +185,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/session-flow/README.md b/plugins/session-flow/README.md index f0cb362c93..1c754fd018 100644 --- a/plugins/session-flow/README.md +++ b/plugins/session-flow/README.md @@ -524,10 +524,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/skill-quality/README.md b/plugins/skill-quality/README.md index 314347b8be..725a99da85 100644 --- a/plugins/skill-quality/README.md +++ b/plugins/skill-quality/README.md @@ -262,10 +262,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/source-control/README.md b/plugins/source-control/README.md index ecde28f787..26a87816f0 100644 --- a/plugins/source-control/README.md +++ b/plugins/source-control/README.md @@ -598,10 +598,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/testing/README.md b/plugins/testing/README.md index 252cd563c3..1122ba1829 100644 --- a/plugins/testing/README.md +++ b/plugins/testing/README.md @@ -310,10 +310,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/typos-format/README.md b/plugins/typos-format/README.md index 3eee385ae6..b9c214accb 100644 --- a/plugins/typos-format/README.md +++ b/plugins/typos-format/README.md @@ -275,10 +275,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/user-interface/README.md b/plugins/user-interface/README.md index 7ae1e9d6ae..8c875ea64d 100644 --- a/plugins/user-interface/README.md +++ b/plugins/user-interface/README.md @@ -90,10 +90,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/visualization/README.md b/plugins/visualization/README.md index ecb805564e..0bd3e430f1 100644 --- a/plugins/visualization/README.md +++ b/plugins/visualization/README.md @@ -152,10 +152,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/visualization/skills/visualize/context/decision-matrix.md b/plugins/visualization/skills/visualize/context/decision-matrix.md index 412c38ad76..d3d01cf9c4 100644 --- a/plugins/visualization/skills/visualize/context/decision-matrix.md +++ b/plugins/visualization/skills/visualize/context/decision-matrix.md @@ -257,8 +257,10 @@ before relying on a time-sensitive detail. page). - Mermaid diagram families: `https://mermaid.js.org/intro/` and the stable sidebar at `https://mermaid.js.org/syntax/flowchart.html`. -- Plugin manifest / `userConfig` schema (no native enum type): - `https://code.claude.com/docs/en/plugins/manifest-reference#user-configuration` (fetched this session). +- Plugin manifest / `userConfig` schema (a `string` field takes a fixed value list through `options`, + Claude Code v2.1.271 or later; as of 2026-10-07, recheck when `options` is renamed, extends to + other field types, or its version floor moves): + `https://code.claude.com/docs/en/plugins/manifest-reference#limit-a-field-to-fixed-options`. - Third-party survey: `https://code.claude.com/docs/en/plugins/install`, the community catalog at `https://raw.githubusercontent.com/anthropics/claude-plugins-community/main/.claude-plugin/marketplace.json`, diff --git a/plugins/work-items/README.md b/plugins/work-items/README.md index 1a3c65f3c5..74dd528b3e 100644 --- a/plugins/work-items/README.md +++ b/plugins/work-items/README.md @@ -255,10 +255,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user**, `--settings`, and managed settings - only, **not** from a project's `.claude/settings.json`. To vary behavior per - repository, enable or disable the plugin in that project's `enabledPlugins` - instead of setting an option there. + Plugin option values are read from **user** and managed settings only, **not** + from a project's `.claude/settings.json`. To vary behavior per repository, + enable or disable the plugin in that project's `enabledPlugins` instead of + setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/scripts/sync-plugin-options-docs.py b/scripts/sync-plugin-options-docs.py index 942a930818..e3697cd1fe 100755 --- a/scripts/sync-plugin-options-docs.py +++ b/scripts/sync-plugin-options-docs.py @@ -189,10 +189,10 @@ def render(plugin: str, marketplace: str, options: dict) -> str: " }", " ```", "", - " Plugin option values are read from **user**, `--settings`, and managed settings", - " only, **not** from a project's `.claude/settings.json`. To vary behavior per", - " repository, enable or disable the plugin in that project's `enabledPlugins`", - " instead of setting an option there.", + " Plugin option values are read from **user** and managed settings only, **not**", + " from a project's `.claude/settings.json`. To vary behavior per repository,", + " enable or disable the plugin in that project's `enabledPlugins` instead of", + " setting an option there.", "", "Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code", "hands a configured value to a hook process; the value comes from the routes above.", From 52c6b80489c5edc60e97e035c0446e7ea39aca45 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:20:22 -0400 Subject: [PATCH 2/9] docs: add recheck triggers to verification stamps and mark --settings unverified for pluginConfigs Give each upstream verification stamp that lacked one a recheck trigger naming the event that would falsify its claim; history dates, example values and records already covered by a section-level trigger are left alone. Claims that pluginConfigs is read from the --settings flag now say user and managed settings, with --settings recorded as unverified where a mechanism passes a value that way (hook-config-delivery fact 5). Patch bumps and changelog fragments for every touched plugin. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EC7nAKxQg52rCug6r6tYfe --- .../fix-6498-slugs-stamps-a471d592.md | 7 ++++ .../fix-6498-slugs-stamps-2d3dd781.md | 7 ++++ .../fix-6498-slugs-stamps-5bb78bf6.md | 7 ++++ .../fix-6498-slugs-stamps-bddbd6b0.md | 7 ++++ .../fix-6498-slugs-stamps-9e7cfa91.md | 7 ++++ .../fix-6498-slugs-stamps-e1cf1380.md | 7 ++++ .../fix-6498-slugs-stamps-9c95d035.md | 7 ++++ .../fix-6498-slugs-stamps-f87431e7.md | 7 ++++ .../fix-6498-slugs-stamps-6486353a.md | 7 ++++ .../testing/fix-6498-slugs-stamps-f531b006.md | 7 ++++ .github/workflows/pr-bump-plugin-version.yml | 4 ++- .github/workflows/pr-run-activity-read.yml | 4 ++- .github/workflows/pr-run-activity-write.yml | 4 ++- ...i-review-advisory-with-earned-promotion.md | 3 +- ...surface-work-by-question-not-population.md | 3 ++ ...dation-from-the-catalog-not-the-listing.md | 4 ++- ...truction-source-behind-a-claude-md-shim.md | 2 +- ...ator-session-and-retire-the-oauth-lanes.md | 3 +- ...e-the-claude-review-lanes-on-every-push.md | 8 +++-- ...and-move-repository-keys-to-the-cascade.md | 11 +++--- ...nts-through-a-bot-maintained-release-pr.md | 13 ++++--- ...low-run-for-same-repository-trusted-prs.md | 3 +- ...s-a-model-job-and-a-scripted-report-job.md | 3 +- ...ntrolled-into-a-pipeline-skill-activity.md | 3 +- .../hook-config-delivery/README.md | 8 +++-- docs/conventions/hook-observability/README.md | 1 + docs/conventions/loop-lane/README.md | 7 ++-- .../permission-rule-hygiene/README.md | 6 ++-- .../plugin-data-report-keying/README.md | 3 +- docs/conventions/upstream-drift/README.md | 3 +- docs/migration-playbook.md | 29 ++++++++++------ docs/plugin-philosophy.md | 10 ++++-- lib/hook-utils.sh | 5 ++- plugins/actionlint/.claude-plugin/plugin.json | 2 +- plugins/actionlint/CHANGELOG.md | 6 ++++ plugins/actionlint/hooks/hook-utils.sh | 5 ++- .../ai-briefing/.claude-plugin/plugin.json | 2 +- plugins/ai-briefing/CHANGELOG.md | 6 ++++ .../generate/output/build/lib/url-policy.js | 2 ++ plugins/animation/.claude-plugin/plugin.json | 2 +- plugins/animation/CHANGELOG.md | 6 ++++ plugins/animation/hooks/hook-utils.sh | 5 ++- plugins/autonomy/.claude-plugin/plugin.json | 2 +- plugins/autonomy/CHANGELOG.md | 6 ++++ plugins/autonomy/README.md | 12 ++++--- plugins/autonomy/hooks/hook-utils.sh | 5 ++- plugins/autonomy/hooks/lane-stop-gate-arm.sh | 3 +- plugins/autonomy/skills/setup/SKILL.md | 5 ++- .../bash-format/.claude-plugin/plugin.json | 2 +- plugins/bash-format/CHANGELOG.md | 6 ++++ plugins/bash-format/hooks/hook-utils.sh | 5 ++- .../biome-format/.claude-plugin/plugin.json | 2 +- plugins/biome-format/CHANGELOG.md | 6 ++++ plugins/biome-format/hooks/hook-utils.sh | 5 ++- plugins/bugs/.claude-plugin/plugin.json | 2 +- plugins/bugs/CHANGELOG.md | 6 ++++ .../code-metrics/.claude-plugin/plugin.json | 2 +- plugins/code-metrics/CHANGELOG.md | 6 ++++ .../code-metrics/scripts/collectors/cpd.py | 4 ++- .../code-metrics/scripts/collectors/dupl.py | 2 ++ .../code-metrics/scripts/collectors/jscpd.py | 2 ++ .../code-metrics/scripts/collectors/radon.py | 3 ++ .../code-metrics/scripts/parsers/cobertura.py | 3 ++ plugins/code-metrics/scripts/parsers/lcov.py | 3 ++ .../code-tidying/.claude-plugin/plugin.json | 2 +- plugins/code-tidying/CHANGELOG.md | 6 ++++ .../scripts/changed-code-files.sh | 3 ++ .../dissolve-comments/reference/tooling.md | 2 +- .../computer-use/.claude-plugin/plugin.json | 2 +- plugins/computer-use/CHANGELOG.md | 6 ++++ .../diagnose/reference/failure-diagnostics.md | 2 +- .../context-budget/.claude-plugin/plugin.json | 2 +- plugins/context-budget/CHANGELOG.md | 6 ++++ .../hooks/settings-write-ask.mjs | 3 +- .../skills/audit/reference/engine.md | 4 +-- .../reference/interactive-only-tools.json | 2 +- plugins/context-guard/hooks/hook-utils.sh | 5 ++- .../context-guard/hooks/post-compact-mark.sh | 3 +- .../reference/cloud-headless-capture.md | 14 +++++--- .../reference/reader-contract.md | 3 +- .../.claude-plugin/plugin.json | 2 +- plugins/desktop-notification/CHANGELOG.md | 6 ++++ plugins/desktop-notification/README.md | 4 ++- .../desktop-notification/hooks/hook-utils.sh | 5 ++- plugins/discipline/.claude-plugin/plugin.json | 2 +- plugins/discipline/CHANGELOG.md | 6 ++++ plugins/disk-hygiene/README.md | 15 ++++---- plugins/disk-hygiene/lib/killswitch_config.py | 22 +++++++----- .../skills/clean/reference/safety-model.md | 19 ++++++----- .../skills/clean/scripts/destructive_guard.py | 15 ++++---- .../skills/clean/scripts/hygiene.py | 4 ++- plugins/disk-hygiene/skills/setup/SKILL.md | 5 +-- .../skills/setup/scripts/kill_switch_probe.py | 3 +- .../docs-hygiene/.claude-plugin/plugin.json | 2 +- plugins/docs-hygiene/CHANGELOG.md | 6 ++++ .../docs-hygiene/skills/audit-noise/SKILL.md | 2 +- .../extract-ssot/context/anti-patterns.md | 2 +- .../context/decision-framework.md | 2 +- .../dometrain-mcp/.claude-plugin/plugin.json | 2 +- plugins/dometrain-mcp/CHANGELOG.md | 6 ++++ plugins/education/.claude-plugin/plugin.json | 2 +- plugins/education/CHANGELOG.md | 6 ++++ .../eol-normalizer/.claude-plugin/plugin.json | 2 +- plugins/eol-normalizer/CHANGELOG.md | 6 ++++ plugins/eol-normalizer/hooks/hook-utils.sh | 5 ++- plugins/evals/.claude-plugin/plugin.json | 2 +- plugins/evals/CHANGELOG.md | 6 ++++ .../.claude-plugin/plugin.json | 2 +- plugins/explainer-video/CHANGELOG.md | 6 ++++ plugins/explainer-video/hooks/hook-utils.sh | 5 ++- plugins/gaming/.claude-plugin/plugin.json | 2 +- plugins/gaming/CHANGELOG.md | 6 ++++ plugins/github/.claude-plugin/plugin.json | 2 +- plugins/github/CHANGELOG.md | 6 ++++ plugins/github/reference/areas.md | 5 +-- plugins/go-format/.claude-plugin/plugin.json | 2 +- plugins/go-format/CHANGELOG.md | 6 ++++ plugins/go-format/hooks/hook-utils.sh | 5 ++- plugins/guardrails/README.md | 8 +++-- .../hooks/block-root-delete-target.sh | 5 ++- plugins/guardrails/hooks/hook-utils.sh | 5 ++- .../hooks/skill-reference-verify.sh | 10 ++++-- .../harness-config/.claude-plugin/plugin.json | 2 +- plugins/harness-config/CHANGELOG.md | 6 ++++ .../reference/agents-md-liveness.md | 13 ++++--- .../audit-instructions/reference/criteria.md | 6 ++-- .../harness-config/skills/audit-pass/SKILL.md | 6 ++-- .../audit-pass/reference/doctor-handoff.md | 5 +-- .../audit-pass/reference/finding-identity.md | 8 ++--- .../reference/report-location-and-schema.md | 4 +-- .../audit-pass/reference/suppression.md | 2 +- .../reference/criteria.md | 6 ++-- .../reference/criteria.md | 2 +- .../skills/audit-prompting-postures/SKILL.md | 4 +-- .../harness-memory/.claude-plugin/plugin.json | 2 +- plugins/harness-memory/CHANGELOG.md | 6 ++++ .../skills/audit/reference/criteria.md | 2 ++ .../audit/reference/official-guidance.md | 3 +- .../stateless/reference/official-guidance.md | 6 ++++ plugins/harness-ops/hooks/hook-utils.sh | 5 ++- .../scripts/install_state.py | 1 + .../reference/listing-scorer.md | 3 +- .../scripts/audit_skill_visibility.py | 3 +- plugins/harness-ops/skills/lanes/SKILL.md | 3 +- .../skills/lanes/context/config.md | 2 +- .../skills/lanes/context/refresh.md | 3 +- .../skills/lanes/scripts/lane-launcher.sh | 9 +++-- .../skills/machine-profile/SKILL.md | 2 +- .../observability/context/output-format.md | 3 +- plugins/harness-ops/skills/plugins/SKILL.md | 7 ++-- .../skills/plugins/context/gotchas.md | 9 +++-- .../skills/plugins/context/scope-semantics.md | 34 ++++++++++++------- .../plugins/context/sync-install-enable.md | 5 +-- .../implementation/.claude-plugin/plugin.json | 2 +- plugins/implementation/CHANGELOG.md | 6 ++++ .../instruction-placement/hooks/hook-utils.sh | 5 ++- .../scripts/render-index.sh | 7 ++-- .../migrate/reference/shim-droppable.md | 2 +- .../skills/migrate/reference/sources.md | 14 +++++--- .../kindle-dedrm/.claude-plugin/plugin.json | 2 +- plugins/kindle-dedrm/CHANGELOG.md | 6 ++++ .../skills/manage/reference/versions.md | 4 +-- plugins/knowledge/.claude-plugin/plugin.json | 2 +- plugins/knowledge/CHANGELOG.md | 6 ++++ .../extraction/lib/plugin-data.js | 3 +- .../video-digest/extraction/lib/run-args.js | 3 +- .../video-digest/reference/sources/x.md | 2 +- .../machine-health/.claude-plugin/plugin.json | 2 +- plugins/machine-health/CHANGELOG.md | 6 ++++ .../.claude-plugin/plugin.json | 2 +- plugins/markdown-format/CHANGELOG.md | 6 ++++ plugins/markdown-format/README.md | 3 +- plugins/markdown-format/hooks/hook-utils.sh | 5 ++- .../markdown-format/hooks/markdown-format.sh | 15 +++++--- plugins/miro/.claude-plugin/plugin.json | 2 +- plugins/miro/CHANGELOG.md | 6 ++++ plugins/miro/README.md | 3 +- plugins/pixel-art/.claude-plugin/plugin.json | 2 +- plugins/pixel-art/CHANGELOG.md | 6 ++++ plugins/pixel-art/examples/ui/window_mz.py | 5 +-- .../skills/draft-goal-condition/SKILL.md | 2 +- .../reference/model-adaptation/opus-4-8.md | 3 ++ .../reference/model-adaptation/opus-5.md | 3 ++ .../reference/model-adaptation/sonnet-5.md | 3 ++ plugins/playbooks/reference/prompt-caching.md | 2 +- .../skills/fable-5/context/calibration.md | 2 +- .../reference/precompute-context.md | 7 ++-- .../reference/skill-criteria.md | 12 ++++--- .../playgrounds/.claude-plugin/plugin.json | 2 +- plugins/playgrounds/CHANGELOG.md | 6 ++++ plugins/playgrounds/README.md | 3 +- plugins/playwright/.claude-plugin/plugin.json | 2 +- plugins/playwright/CHANGELOG.md | 6 ++++ plugins/playwright/README.md | 3 +- .../plugin-quality/.claude-plugin/plugin.json | 2 +- plugins/plugin-quality/CHANGELOG.md | 6 ++++ plugins/plugin-quality/agents/auditor.md | 3 +- plugins/plugin-quality/scripts/packet-seal.sh | 3 +- plugins/plugin-quality/skills/audit/SKILL.md | 3 +- .../audit/reference/component-types/hook.md | 3 +- .../skills/audit/reference/evidence-packet.md | 6 ++-- .../.claude-plugin/plugin.json | 2 +- plugins/powershell-format/CHANGELOG.md | 6 ++++ plugins/powershell-format/README.md | 3 +- plugins/powershell-format/hooks/hook-utils.sh | 5 ++- .../.claude-plugin/plugin.json | 2 +- plugins/rate-limit-guard/CHANGELOG.md | 6 ++++ plugins/rate-limit-guard/README.md | 8 +++-- plugins/rate-limit-guard/hooks/hook-utils.sh | 5 ++- .../hooks/record-rate-limit-stop.sh | 3 +- .../.claude-plugin/plugin.json | 2 +- plugins/repo-fleet-hygiene/CHANGELOG.md | 6 ++++ .../repo-hygiene/.claude-plugin/plugin.json | 2 +- plugins/repo-hygiene/CHANGELOG.md | 6 ++++ .../skills/clean/scripts/clean-batch.sh | 3 +- plugins/repo-hygiene/skills/setup/SKILL.md | 7 ++-- .../skills/setup/evals/evals.json | 4 +-- plugins/review/.claude-plugin/plugin.json | 2 +- plugins/review/CHANGELOG.md | 6 ++++ plugins/review/README.md | 4 +-- .../audit-enforceability/context/crosswalk.md | 2 +- .../ruff-format/.claude-plugin/plugin.json | 2 +- plugins/ruff-format/CHANGELOG.md | 6 ++++ plugins/ruff-format/hooks/hook-utils.sh | 5 ++- .../skill-quality/.claude-plugin/plugin.json | 2 +- plugins/skill-quality/CHANGELOG.md | 6 ++++ .../songwriting/.claude-plugin/plugin.json | 2 +- plugins/songwriting/CHANGELOG.md | 6 ++++ .../pat-pattison/research/beyond-books.md | 7 ++-- .../pat-pattison/research/book-references.md | 3 +- .../research/lyric-melodic-roadmaps.md | 4 ++- .../context/pat-pattison/research/phrasing.md | 3 +- .../context/pat-pattison/research/prosody.md | 3 +- .../pat-pattison/research/title-game.md | 3 +- .../skills/suno/context/v55-features.md | 2 +- .../skills/suno/context/workflow-recipes.md | 3 +- plugins/source-control/README.md | 8 +++-- plugins/source-control/hooks/hook-utils.sh | 5 ++- .../reference/config-resolution.md | 5 ++- .../reference/promotion-evidence-bootstrap.md | 13 ++++--- .../pull-request/scripts/fetch-failed-logs.sh | 3 +- .../skills/worktree/context/create.md | 2 +- plugins/speech/.claude-plugin/plugin.json | 2 +- plugins/speech/CHANGELOG.md | 6 ++++ plugins/speech/hooks/hook-utils.sh | 5 ++- plugins/testing/hooks/hook-utils.sh | 5 ++- .../typos-format/.claude-plugin/plugin.json | 2 +- plugins/typos-format/CHANGELOG.md | 6 ++++ plugins/typos-format/hooks/hook-utils.sh | 5 ++- plugins/typos-format/hooks/typos-format.sh | 4 ++- .../user-interface/.claude-plugin/plugin.json | 2 +- plugins/user-interface/CHANGELOG.md | 6 ++++ .../visualization/.claude-plugin/plugin.json | 2 +- plugins/visualization/CHANGELOG.md | 6 ++++ .../visualize/context/decision-matrix.md | 3 +- plugins/work-items/.claude-plugin/plugin.json | 2 +- plugins/work-items/CHANGELOG.md | 6 ++++ .../reference/permission-preflight.md | 4 ++- scripts/check-killswitch-hoist.sh | 2 ++ scripts/check-silent-skips.sh | 2 ++ scripts/dependabot-plugin-bump.sh | 2 ++ 261 files changed, 963 insertions(+), 304 deletions(-) create mode 100644 .changes/context-guard/fix-6498-slugs-stamps-a471d592.md create mode 100644 .changes/disk-hygiene/fix-6498-slugs-stamps-2d3dd781.md create mode 100644 .changes/guardrails/fix-6498-slugs-stamps-5bb78bf6.md create mode 100644 .changes/harness-ops/fix-6498-slugs-stamps-bddbd6b0.md create mode 100644 .changes/instruction-placement/fix-6498-slugs-stamps-9e7cfa91.md create mode 100644 .changes/planning/fix-6498-slugs-stamps-e1cf1380.md create mode 100644 .changes/playbooks/fix-6498-slugs-stamps-9c95d035.md create mode 100644 .changes/session-flow/fix-6498-slugs-stamps-f87431e7.md create mode 100644 .changes/source-control/fix-6498-slugs-stamps-6486353a.md create mode 100644 .changes/testing/fix-6498-slugs-stamps-f531b006.md diff --git a/.changes/context-guard/fix-6498-slugs-stamps-a471d592.md b/.changes/context-guard/fix-6498-slugs-stamps-a471d592.md new file mode 100644 index 0000000000..46ae390dd6 --- /dev/null +++ b/.changes/context-guard/fix-6498-slugs-stamps-a471d592.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/disk-hygiene/fix-6498-slugs-stamps-2d3dd781.md b/.changes/disk-hygiene/fix-6498-slugs-stamps-2d3dd781.md new file mode 100644 index 0000000000..46ae390dd6 --- /dev/null +++ b/.changes/disk-hygiene/fix-6498-slugs-stamps-2d3dd781.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/guardrails/fix-6498-slugs-stamps-5bb78bf6.md b/.changes/guardrails/fix-6498-slugs-stamps-5bb78bf6.md new file mode 100644 index 0000000000..46ae390dd6 --- /dev/null +++ b/.changes/guardrails/fix-6498-slugs-stamps-5bb78bf6.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/harness-ops/fix-6498-slugs-stamps-bddbd6b0.md b/.changes/harness-ops/fix-6498-slugs-stamps-bddbd6b0.md new file mode 100644 index 0000000000..46ae390dd6 --- /dev/null +++ b/.changes/harness-ops/fix-6498-slugs-stamps-bddbd6b0.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/instruction-placement/fix-6498-slugs-stamps-9e7cfa91.md b/.changes/instruction-placement/fix-6498-slugs-stamps-9e7cfa91.md new file mode 100644 index 0000000000..46ae390dd6 --- /dev/null +++ b/.changes/instruction-placement/fix-6498-slugs-stamps-9e7cfa91.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/planning/fix-6498-slugs-stamps-e1cf1380.md b/.changes/planning/fix-6498-slugs-stamps-e1cf1380.md new file mode 100644 index 0000000000..46ae390dd6 --- /dev/null +++ b/.changes/planning/fix-6498-slugs-stamps-e1cf1380.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/playbooks/fix-6498-slugs-stamps-9c95d035.md b/.changes/playbooks/fix-6498-slugs-stamps-9c95d035.md new file mode 100644 index 0000000000..1fe5d8fd96 --- /dev/null +++ b/.changes/playbooks/fix-6498-slugs-stamps-9c95d035.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/session-flow/fix-6498-slugs-stamps-f87431e7.md b/.changes/session-flow/fix-6498-slugs-stamps-f87431e7.md new file mode 100644 index 0000000000..f44daa8035 --- /dev/null +++ b/.changes/session-flow/fix-6498-slugs-stamps-f87431e7.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. diff --git a/.changes/source-control/fix-6498-slugs-stamps-6486353a.md b/.changes/source-control/fix-6498-slugs-stamps-6486353a.md new file mode 100644 index 0000000000..46ae390dd6 --- /dev/null +++ b/.changes/source-control/fix-6498-slugs-stamps-6486353a.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/testing/fix-6498-slugs-stamps-f531b006.md b/.changes/testing/fix-6498-slugs-stamps-f531b006.md new file mode 100644 index 0000000000..46ae390dd6 --- /dev/null +++ b/.changes/testing/fix-6498-slugs-stamps-f531b006.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.github/workflows/pr-bump-plugin-version.yml b/.github/workflows/pr-bump-plugin-version.yml index bb5179edc9..b4efeb9c7f 100644 --- a/.github/workflows/pr-bump-plugin-version.yml +++ b/.github/workflows/pr-bump-plugin-version.yml @@ -9,7 +9,9 @@ name: pr-bump-plugin-version # # Commit messages include [dependabot skip] so Dependabot may force-push over # the bot commit when rebasing (GitHub docs: Managing pull requests for -# dependency updates; verified 2026-09-27). The bump is created through the +# dependency updates; verified 2026-09-27; recheck when that page stops +# naming `[dependabot skip]` as the way to let Dependabot rebase over a +# commit). The bump is created through the # GraphQL createCommitOnBranch mutation, not a local git commit and push, so # GitHub signs the commit and marks it Verified, which a required_signatures # ruleset accepts. A local commit pushed with GITHUB_TOKEN is unsigned. diff --git a/.github/workflows/pr-run-activity-read.yml b/.github/workflows/pr-run-activity-read.yml index 59965ac6bb..4d2981bdac 100644 --- a/.github/workflows/pr-run-activity-read.yml +++ b/.github/workflows/pr-run-activity-read.yml @@ -238,7 +238,9 @@ jobs: # MCP subprocesses and gives Bash its own PID namespace, so /proc # shows no ancestor's env. It keeps GH_TOKEN and GITHUB_TOKEN, so a # subprocess still holds this activity's GitHub token - # (code.claude.com/docs/en/env-vars, as of 2026-10-04). + # (code.claude.com/docs/en/env-vars, as of 2026-10-04; recheck when + # the CLAUDE_CODE_SUBPROCESS_ENV_SCRUB row stops listing GH_TOKEN + # and GITHUB_TOKEN as kept). CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: "1" CLAUDE_BRANCH: ${{ steps.gate.outputs.head-ref }} TRUSTED_CONTEXT_FILE: >- diff --git a/.github/workflows/pr-run-activity-write.yml b/.github/workflows/pr-run-activity-write.yml index 14d41531b2..7aac8eb10a 100644 --- a/.github/workflows/pr-run-activity-write.yml +++ b/.github/workflows/pr-run-activity-write.yml @@ -270,7 +270,9 @@ jobs: # MCP subprocesses and gives Bash its own PID namespace, so /proc # shows no ancestor's env. It keeps GH_TOKEN and GITHUB_TOKEN, so a # subprocess still holds this activity's GitHub token - # (code.claude.com/docs/en/env-vars, as of 2026-10-04). + # (code.claude.com/docs/en/env-vars, as of 2026-10-04; recheck when + # the CLAUDE_CODE_SUBPROCESS_ENV_SCRUB row stops listing GH_TOKEN + # and GITHUB_TOKEN as kept). CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: "1" CLAUDE_BRANCH: ${{ steps.gate.outputs.head-ref }} TRUSTED_CONTEXT_FILE: >- diff --git a/docs/adr/0002-default-on-ai-review-advisory-with-earned-promotion.md b/docs/adr/0002-default-on-ai-review-advisory-with-earned-promotion.md index eccfbe3002..f0e313f797 100644 --- a/docs/adr/0002-default-on-ai-review-advisory-with-earned-promotion.md +++ b/docs/adr/0002-default-on-ai-review-advisory-with-earned-promotion.md @@ -340,7 +340,8 @@ that without the push trigger the required check can certify a head the branch h That warning is written against a base where the evidence check is required. Here it no longer is: the ci-perf required-check contract (Phase 3, melodic-software/github-iac#378) made `ci-status` the single required context, and `gh api repos/melodic-software/claude-code-plugins/rules/branches/main` -read on 2026-09-07 returns exactly `[{"context": "ci-status", "integration_id": 15368}]`. No +read on 2026-09-07 returns exactly `[{"context": "ci-status", "integration_id": 15368}]` +(recheck when that endpoint lists a second required context). No security-evidence context is required, so dropping `synchronize` gives up no certification the ruleset asks for. Reinstating a required execution check is a new decision, and it would have to restore the push trigger with it; the revisit triggers below already say so. diff --git a/docs/adr/0005-bound-instruction-surface-work-by-question-not-population.md b/docs/adr/0005-bound-instruction-surface-work-by-question-not-population.md index 6c9c97ee22..4697009d88 100644 --- a/docs/adr/0005-bound-instruction-surface-work-by-question-not-population.md +++ b/docs/adr/0005-bound-instruction-surface-work-by-question-not-population.md @@ -402,6 +402,9 @@ residency rules the decisions rest on were verified against drift rather than conflict, and if a future page documents README loading, that classification is what changes. +Recheck the residency claims above when the skills page changes its listing-overflow drop order, +its on-demand loading of supporting files, or documents plugin README loading. + Non-residency claims are sourced the same way: issue #1225 and every ticket in the assessment were read first-hand via `gh issue view`, PR #1096 via `gh pr diff`, and population counts were produced by enumerating `plugins/*`, the globs in the table above, and `.claude-plugin/marketplace.json`. The diff --git a/docs/adr/0016-source-skill-recommendation-from-the-catalog-not-the-listing.md b/docs/adr/0016-source-skill-recommendation-from-the-catalog-not-the-listing.md index fb8f1d903c..d802a5ac4e 100644 --- a/docs/adr/0016-source-skill-recommendation-from-the-catalog-not-the-listing.md +++ b/docs/adr/0016-source-skill-recommendation-from-the-catalog-not-the-listing.md @@ -33,7 +33,9 @@ harness, invisibly. > is upstream's, not this ADR's, which is why the same sentence keeps re-entering this repo: it is on > `main` in the skill's own SKILL.md and in the plugin manifest, and #3524 added a citation pointing > at the wrong page for it. Claude Code does not drop descriptions "starting with the skills invoked -> least". The shipped binary does something else, on two independent axes. +> least". The shipped binary does something else, on two independent axes. Recheck when the +> skills page rewrites that sentence or a Claude Code changelog entry names a change to the +> listing scorer. > > It ranks by a decay-weighted score, `usageCount * max(0.5 ^ (daysSinceUse / 7), 0.1)`, so a > heavily used but stale skill can be shed before a lightly used fresh one: 100 uses 21 days ago diff --git a/docs/adr/0036-make-agents-md-the-instruction-source-behind-a-claude-md-shim.md b/docs/adr/0036-make-agents-md-the-instruction-source-behind-a-claude-md-shim.md index 68ee8d368c..a225e63baa 100644 --- a/docs/adr/0036-make-agents-md-the-instruction-source-behind-a-claude-md-shim.md +++ b/docs/adr/0036-make-agents-md-the-instruction-source-behind-a-claude-md-shim.md @@ -54,7 +54,7 @@ Three alternatives were rejected, each with the fact that would flip it: | Rejected | Why | What would flip it | |---|---|---| | Native only: delete `CLAUDE.md` now | Rejected: it held only while direct reading was conditional (see "The remote flag, and how its code default is read" in `sources.md` and "Why the shim stays" in the migrate skill's `SKILL.md`). Any `CLAUDE.md` above the working directory still suppresses the read | All four graded conditions report `[MET]` | -| The `claude-md-and-agents-md` both-files setting | A user, `--settings` or managed setting, ignored in project and local settings, so no repository can ship it ("Why the shim stays"); never adopted or run as a convention | The setting becomes readable from project or local settings | +| The `claude-md-and-agents-md` both-files setting | A user or managed setting (`--settings` is unverified since the entry stopped naming it, as of 2026-10-07), ignored in project and local settings, so no repository can ship it ("Why the shim stays"); never adopted or run as a convention | The setting becomes readable from project or local settings | | A common-ancestor `AGENTS.md` in the directory that holds every clone | No repository versions it, and it misses every worktree checked out outside that tree | Claude Code reads a versioned org-level tier above the repository | ## Consequences diff --git a/docs/adr/0037-seat-mandatory-reviews-on-the-operator-session-and-retire-the-oauth-lanes.md b/docs/adr/0037-seat-mandatory-reviews-on-the-operator-session-and-retire-the-oauth-lanes.md index d207c1948b..eaff28c053 100644 --- a/docs/adr/0037-seat-mandatory-reviews-on-the-operator-session-and-retire-the-oauth-lanes.md +++ b/docs/adr/0037-seat-mandatory-reviews-on-the-operator-session-and-retire-the-oauth-lanes.md @@ -86,7 +86,8 @@ contract as advisory steps, and a babysit merge gate that reads pull-request sta review-lane run, 1 reviewed on the merged head. Pull request #4210 carried the plan for this change. - GitHub skips `pull_request` runs while the pull request has a merge conflict (the events - reference, fetched 2026-09-12). + reference, fetched 2026-09-12; recheck when that page stops saying a merge conflict skips + `pull_request` runs). - Two fresh-context reviews of the plan found that a rule demanding every row at HEAD marks every mutating skill stale by construction, because rows are stamped at invocation; the two-tier rule above is the repair, pinned by the script's suite. diff --git a/docs/adr/0038-restore-the-claude-review-lanes-on-every-push.md b/docs/adr/0038-restore-the-claude-review-lanes-on-every-push.md index 9410393799..8fc89a766d 100644 --- a/docs/adr/0038-restore-the-claude-review-lanes-on-every-push.md +++ b/docs/adr/0038-restore-the-claude-review-lanes-on-every-push.md @@ -19,6 +19,8 @@ trigger, leaving an Owner to pick once, every push, or manual per repository (, fetched 2026-09-24); and Boris Cherny's Steps of AI Adoption says "Automated code review and security review are on by default" (, fetched 2026-09-24). +Recheck these three when the Code Review docs name a default trigger or Anthropic states review on +every pull request as a requirement. What Anthropic does document is that its reviews do not gate a merge: - The managed Code Review check run "always completes with a neutral conclusion so it never @@ -32,7 +34,8 @@ What Anthropic does document is that its reviews do not gate a merge: Both lanes authenticate with the org-shared `CLAUDE_CODE_OAUTH_TOKEN`. Anthropic's GitHub Actions doc recommends an API key from the Claude Console, or workload identity federation, for a secret shared across repositories, because an OAuth token is tied to the subscription of the person who -minted it (, fetched 2026-09-24). The operator +minted it (, fetched 2026-09-24; recheck when that +page stops recommending an API key or workload identity federation for a shared secret). The operator keeps the shared OAuth secret on purpose. The account that holds it is tracked in melodic-software/claude-code-account-rotation#145. @@ -40,7 +43,8 @@ ADR 0037 measured the lanes' coverage (14 of the last 40 merged pull requests ha code-review run; 1 was reviewed on the commit that merged) and retired them. The cause of that gap was trigger timing, not the lanes existing: both callers ran on `opened`, `ready_for_review` and `reopened` only, and "Workflows will not run on `pull_request` activity if the pull request has a -merge conflict" (GitHub, events that trigger workflows, fetched 2026-09-24). An agent branch opened +merge conflict" (GitHub, events that trigger workflows, fetched 2026-09-24; recheck when that page +stops saying so). An agent branch opened while main had moved lost its one trigger, and no later push re-triggered it. The seat layer ADR 0037 put in place reaches only pull requests that pass through the diff --git a/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md b/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md index 1521f4fd74..a4f888833d 100644 --- a/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md +++ b/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md @@ -9,8 +9,8 @@ This ruling covers 17 of source-control's `userConfig` keys, used by `/source-co and `/source-control:pull-request`: who the operator is, which owners the loop watches, which bots it trusts, and how a repository merges and reviews. The plugin's other `userConfig` keys (engine thresholds, tiers, caps) are outside it. `userConfig` values live in `pluginConfigs`, which -Claude Code reads from user settings, the `--settings` flag, and managed settings only; a project's -`.claude/settings.json` is ignored +Claude Code reads from user settings and managed settings only (the `--settings` flag is unverified +since the entry stopped naming it, as of 2026-10-07); a project's `.claude/settings.json` is ignored ([hook-config-delivery](../conventions/hook-config-delivery/README.md), fact 5). A sandbox probe on Claude Code 2.1.283 (2026-09-27) also showed that `claude plugin install --config` writes the value to user settings whatever `-s` says (fact 9). So each of these keys has one value per machine. @@ -75,8 +75,11 @@ verdict HYBRID, which this record adopts. - An operator with several identity domains on one machine (for example a work account and a personal account) gets one value per machine for each key in decision 1, and for the ten keys in decision 3 while their deprecated `userConfig` fallback is set. Such an operator either leaves - those keys unset or launches the lane with a per-domain `--settings` file. `--settings` is a documented `pluginConfigs` read source - (fact 5); how its `pluginConfigs` merges with the user settings value is unverified. + those keys unset or launches the lane with a per-domain `--settings` file. `--settings` is + unverified as a `pluginConfigs` read source since the entry stopped naming it + (hook-config-delivery fact 5; as of 2026-10-07; recheck when the entry names `--settings` again + or a probe shows a `--settings` value read or ignored); how its `pluginConfigs` merges with the + user settings value is unverified. - Repositories can set `branch_issue_pattern` for themselves today; the `userConfig` twin keeps working with a deprecation note until its removal release. - `plugins/source-control/reference/config-resolution.md` states the split and the multi-domain diff --git a/docs/adr/0048-release-plugins-from-changelog-fragments-through-a-bot-maintained-release-pr.md b/docs/adr/0048-release-plugins-from-changelog-fragments-through-a-bot-maintained-release-pr.md index 5e8e3cd2fb..2dece18a59 100644 --- a/docs/adr/0048-release-plugins-from-changelog-fragments-through-a-bot-maintained-release-pr.md +++ b/docs/adr/0048-release-plugins-from-changelog-fragments-through-a-bot-maintained-release-pr.md @@ -184,26 +184,31 @@ still carries its last released version. (, fetched 2026-10-03). Rejected as a dependency: it reads versions from `package.json` workspaces, and these plugins are not npm packages. Its model is the one adopted here: per-change fragment files carrying a bump level, and a single release pull - request. + request. Recheck when changesets/action reads versions from something other than `package.json` + workspaces. - **Towncrier.** Fragments named `.` in a news directory; `towncrier build` writes them into the changelog and runs `git rm` on them, with a documented monorepo layout (, fetched 2026-10-03). Rejected as a dependency: a fragment declares a change type, not a semver bump level, and it needs a Python - toolchain in the release job. The fragment-per-change layout is the same idea. + toolchain in the release job. The fragment-per-change layout is the same idea. Recheck when the + towncrier tutorial documents a fragment type that carries a semver bump level. - **release-please (manifest mode).** Tracks per-package versions in `.release-please-manifest.json` and computes the bump from Conventional Commits since the last release, with one combined release pull request or one per package (, fetched 2026-10-03). Rejected: this repository squash-merges and writes one Conventional Commits title per pull request, often spanning several plugins, so the title cannot carry a per-plugin bump - level or per-plugin release notes, and the hand-written CHANGELOG prose would be lost. + level or per-plugin release notes, and the hand-written CHANGELOG prose would be lost. Recheck + when the release-please manifest docs describe per-package bump levels taken from outside + Conventional Commits titles. - **Omit `version`.** With `version` absent from both the manifest and the marketplace entry, a relative-path plugin in a Git-hosted marketplace takes "the commit SHA of the installed directory" as its version (, fetched 2026-10-03). Deferred: it removes the race entirely, but the docs do not say whether that SHA is the last commit touching the plugin directory or the marketplace HEAD. If it is HEAD, every merge to main would refresh all 85 plugins for every user. The probe under Resolved - decisions settles it before phase 2. + decisions settles it before phase 2. Recheck when the loading page states which commit the SHA + version comes from. - **Compute the version at merge time.** A post-merge job bumps on main. Rejected: main requires a pull request for every change, so a direct push needs a ruleset bypass for the bot, which widens who can write to main without review. diff --git a/docs/adr/0051-start-pr-fix-ci-from-workflow-run-for-same-repository-trusted-prs.md b/docs/adr/0051-start-pr-fix-ci-from-workflow-run-for-same-repository-trusted-prs.md index 4b7e34872f..4b3f8fe226 100644 --- a/docs/adr/0051-start-pr-fix-ci-from-workflow-run-for-same-repository-trusted-prs.md +++ b/docs/adr/0051-start-pr-fix-ci-from-workflow-run-for-same-repository-trusted-prs.md @@ -15,7 +15,8 @@ access secrets and write tokens, even if the previous workflow was not". GitHub untrusted code on this trigger can lead to cache poisoning and unintended access to write privileges or secrets. It also allows at most three chained levels. (, -fetched 2026-10-03.) +fetched 2026-10-03; recheck when that page changes the `check_run` Actions exclusion, the +`workflow_run` secrets and write-token behavior, or the chained-level limit.) The two existing ci-workflows review lanes carry a tripwire step that fails on `workflow_run` and `pull_request_target`. It binds those two lanes only. diff --git a/docs/adr/0053-run-each-pipeline-activity-as-a-model-job-and-a-scripted-report-job.md b/docs/adr/0053-run-each-pipeline-activity-as-a-model-job-and-a-scripted-report-job.md index f2f471693f..b3f706d96a 100644 --- a/docs/adr/0053-run-each-pipeline-activity-as-a-model-job-and-a-scripted-report-job.md +++ b/docs/adr/0053-run-each-pipeline-activity-as-a-model-job-and-a-scripted-report-job.md @@ -53,7 +53,8 @@ lane in two jobs. Its contract is 5. **Lanes chain by `workflow_dispatch`.** A check run written with `GITHUB_TOKEN` starts no workflow run; only `workflow_dispatch` and `repository_dispatch` are exempt ([triggering a workflow from a workflow](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow#triggering-a-workflow-from-a-workflow), - fetched 2026-10-04). No lane starts on a `check_run` event from another lane. + fetched 2026-10-04; recheck when that section stops exempting only `workflow_dispatch` and + `repository_dispatch`). No lane starts on a `check_run` event from another lane. ## Alternatives considered diff --git a/docs/adr/0055-load-nothing-head-controlled-into-a-pipeline-skill-activity.md b/docs/adr/0055-load-nothing-head-controlled-into-a-pipeline-skill-activity.md index 2957aac041..8778b94d9f 100644 --- a/docs/adr/0055-load-nothing-head-controlled-into-a-pipeline-skill-activity.md +++ b/docs/adr/0055-load-nothing-head-controlled-into-a-pipeline-skill-activity.md @@ -62,7 +62,8 @@ code it may run is limited by what it holds. Line references are to 5. **Subprocess isolation.** The skill step sets `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1`, which strips the OAuth token and other credentials from Bash, hook and MCP subprocesses and gives Bash its own PID namespace (lines 373-379). It keeps `GH_TOKEN` and `GITHUB_TOKEN` by design - ([environment variables](https://code.claude.com/docs/en/env-vars), as of 2026-10-04), so a + ([environment variables](https://code.claude.com/docs/en/env-vars), as of 2026-10-04; recheck + when the `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` row stops listing those two as kept), so a subprocess still holds the activity's GitHub token. Because the action installs bubblewrap only for `allowed_non_write_users`, the run job installs bubblewrap and socat itself and fails red when `bwrap` is missing (lines 306-327). diff --git a/docs/conventions/hook-config-delivery/README.md b/docs/conventions/hook-config-delivery/README.md index 6784d54d9f..d8eeebd15f 100644 --- a/docs/conventions/hook-config-delivery/README.md +++ b/docs/conventions/hook-config-delivery/README.md @@ -77,7 +77,8 @@ this list and the matrix; it does not fork a private convention. (see its `[0.9.0]` [CHANGELOG entry](../../../plugins/disk-hygiene/CHANGELOG.md) for the full trust analysis and residuals). - **G. Operator-side arm record**: for a **per-session** value that would otherwise ride - `--settings` (F's residual: honored by the harness, invisible to a hook-side read). An + `--settings` (F's residual: invisible to a hook-side read, and whether the harness honors it is + unverified, see fact 5). An operator-side helper shipped by the plugin writes a per-session record under the plugin's install-anchored data directory (`/data/`, derived exactly as F derives its anchor); the session carries only a **random record id** through a `userConfig` string option, and the hook @@ -102,8 +103,9 @@ this list and the matrix; it does not fork a private convention. | F. Direct settings read | **yes** | in-script default required (declared `default` inert everywhere) | yes (fact 5 + no env-derived paths) | safe, explicit fail direction per plugin | **no: sensitive values are not in `settings.json` (fact 8)** | +settings-file coupling, +managed-path table | | G. Operator-side arm record | **yes** (any surface that can derive the anchor) | in-script default required | yes (id carries no authority; store is install-anchored) | safe, explicit fail direction per plugin (exemplar: launcher fails closed, hook fails open) | no (plaintext record in the data dir) | +arm helper, +record lifecycle (claim, TTL, consume), +launcher coupling | -Residual on F (documented, accepted): a value supplied only via a session `--settings` file is honored -by the harness but invisible to a hook-side read, a runtime CLI flag no hook can observe. Channel G +Residual on F (documented, accepted): a value supplied only via a session `--settings` file, if the +harness honors it at all (unverified since 2026-10-07, fact 5), is +invisible to a hook-side read, a runtime CLI flag no hook can observe. Channel G exists to close exactly that residual for per-session values a plugin cannot do without. ## The decision rule diff --git a/docs/conventions/hook-observability/README.md b/docs/conventions/hook-observability/README.md index 5271621ade..84258b9de6 100644 --- a/docs/conventions/hook-observability/README.md +++ b/docs/conventions/hook-observability/README.md @@ -319,6 +319,7 @@ carrying the exact text sent, so the debug log holds what the model read. - **Not a UI feature, but "no verbose surface exists" is the wrong reason.** Verbose surfaces do exist, and the hooks reference names one that carries background-hook output. Pointer: for that surface, see . As of: 2026-08-11. + Recheck trigger: that section stops naming a surface that carries background-hook output. Alongside it are the `verbose` and `viewMode` settings, the `--verbose` flag, `CLAUDE_CODE_DEBUG_LOG_LEVEL=verbose` for hook matcher counts, and `--include-hook-events` for the stream-json event feed. diff --git a/docs/conventions/loop-lane/README.md b/docs/conventions/loop-lane/README.md index abadb0facc..1d7951a0c9 100644 --- a/docs/conventions/loop-lane/README.md +++ b/docs/conventions/loop-lane/README.md @@ -367,7 +367,8 @@ running but unattended, and lane-down detection stays with the stop gate and tel **A configured hook can also fail silently.** We treat a header variable missing from `allowedEnvVars` as interpolating to an empty string (for the rule, see -[HTTP hook fields](https://code.claude.com/docs/en/hooks#http-hook-fields), as of 2026-07-27), and +[HTTP hook fields](https://code.claude.com/docs/en/hooks#http-hook-fields), as of 2026-07-27; +recheck when that section changes how an unlisted header variable is interpolated), and a listed variable unset in the operator's environment as doing the same, an applied inference. Either way a failed POST is non-blocking, so a misconfigured hook can 401 on every escalation while the lane runs on with nothing surfaced outside debug logs. Verify the leg @@ -852,7 +853,9 @@ mod's writes, and a machine-wide write floor bounds them: a reading whose whole- have not moved is rewritten no sooner than the floor interval after the file's last write, whichever session on the machine wrote it, while a whole-point move writes at once, so a lane's own turn that moves a window can wake it once. -A lane may set the guard's report mode with `--settings`; this is optional. +A lane may set the guard's report mode with `--settings`; this is optional. `--settings` is +unverified for plugin option values since the pluginConfigs entry stopped naming it (as of +2026-10-07; hook-config-delivery fact 5). **A named check enforces the rule.** `scripts/check-loop-lane-floor-drift.sh` extracts the floor block from the reader contract and compares it against an explicit registry of every surface that diff --git a/docs/conventions/permission-rule-hygiene/README.md b/docs/conventions/permission-rule-hygiene/README.md index 7d279fcba1..9a8f96bcd2 100644 --- a/docs/conventions/permission-rule-hygiene/README.md +++ b/docs/conventions/permission-rule-hygiene/README.md @@ -30,7 +30,8 @@ Read every "under auto mode" clause below as the **default** condition on the pl operators use, not as a conditional one. The upstream page no longer dates the rollout. It states a version floor. Per [permission-modes](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode) -(fetched 2026-08-17): +(fetched 2026-08-17; recheck when that section changes the version floors or the default-mode +prompt): > The built-in `auto` default requires Claude Code v2.1.228 or later on macOS, Linux, and WSL, and > v2.1.233 or later on native Windows. On earlier versions, the built-in default is Manual. @@ -84,7 +85,8 @@ order: > > [permission-modes](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode) > ("How the classifier evaluates actions"; re-fetched 2026-08-26. The `Monitor` category was -> added upstream in v2.1.236, which before then left Monitor allow rules in effect in auto mode) +> added upstream in v2.1.236, which before then left Monitor allow rules in effect in auto mode; +> recheck when that dropped-rules list changes) The [auto-mode configuration reference](https://code.claude.com/docs/en/auto-mode-config#route-all-shell-commands-through-the-classifier) restates it and adds that `autoMode.classifyAllShell: true` suspends even the narrow shell allow rules: diff --git a/docs/conventions/plugin-data-report-keying/README.md b/docs/conventions/plugin-data-report-keying/README.md index 0657818826..63562652e8 100644 --- a/docs/conventions/plugin-data-report-keying/README.md +++ b/docs/conventions/plugin-data-report-keying/README.md @@ -11,7 +11,8 @@ only), and this convention sits underneath it. ## The harness fact this exists for [Plugin manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference#environment-variables), § *Environment -variables*, `${CLAUDE_PLUGIN_DATA}` row, fetched 2026-10-07: +variables*, `${CLAUDE_PLUGIN_DATA}` row, fetched 2026-10-07 (recheck when that row changes the +identifier formula or the uninstall deletion rule): > `~/.claude/plugins/data//`, created on first reference and kept across plugin updates. `` > is the plugin identifier with every character other than a letter, digit, `_`, or `-` replaced by diff --git a/docs/conventions/upstream-drift/README.md b/docs/conventions/upstream-drift/README.md index 4bb5c74598..dffda916f0 100644 --- a/docs/conventions/upstream-drift/README.md +++ b/docs/conventions/upstream-drift/README.md @@ -254,7 +254,8 @@ Two checks, both cheap, and a run does them before it trusts a body: live pages, so a slug the index does not carry is retired or renamed. That alone flags the alias. Verified across ten slugs on 2026-08-11: the nine live ones each appear as `docs/en/.md`; `slash-commands` appears in no such entry (only an unrelated - `agent-sdk/slash-commands`), which is exactly the one that aliased. + `agent-sdk/slash-commands`), which is exactly the one that aliased. Recheck when `llms.txt` + lists `docs/en/slash-commands.md` or drops one of the nine. - **Read the body's own first heading before trusting it.** A page says what it is in its first heading. A heading for a different page than the one you asked for ends the read; a title that merely differs in wording from the slug does not. diff --git a/docs/migration-playbook.md b/docs/migration-playbook.md index ca45fe6c63..c3e78daaab 100644 --- a/docs/migration-playbook.md +++ b/docs/migration-playbook.md @@ -39,7 +39,9 @@ project's `settings.json`, on 2026-06-29, against the discover-plugins "Configur guide; the "Extensibility contract v2.1" sections and their smoke tests on 2026-07-12 against Claude Code 2.1.207; the Organization and Naming sections' skill-namespace and skill-listing claims on 2026-07-15, and the decomposition/trigger-continuity procedure on 2026-07-16, against the skills doc). -Re-verify fresh before acting. See `CLAUDE.md` "Fresh-docs mandate". +Re-verify fresh before acting. See `CLAUDE.md` "Fresh-docs mandate". Recheck a section when a +Claude Code release note changes the plugin schema, skill-listing, or marketplace-settings behavior +it states. ## Organization: one plugin per cohesive concern @@ -73,7 +75,8 @@ procedure before choosing plugin and skill directories: cross-skill reference, eval, and auto-invocation phrase from `description` plus `when_to_use`. Claude Code uses that listing text to decide whether to load a skill, so trigger phrases are behavior, not marketing copy - ([skills](https://code.claude.com/docs/en/skills), fetched 2026-07-16). + ([skills](https://code.claude.com/docs/en/skills), fetched 2026-07-16; recheck when that page + stops saying the listing text decides whether a skill loads). 2. **Classify the split points by discovery intent.** Facets of one capability stay in one plugin but may become focused sibling skills when users reach for them with different vocabulary. Capabilities with independent purpose, lifecycle, or trust surface become separate plugins. Subcommands and @@ -177,7 +180,8 @@ Applying that precedence, the grammar of an invocation is `/:` **Built-in collisions never force a plugin skill's name.** "Plugin skills use a `plugin-name:skill-name` namespace, so they cannot conflict with other levels" -([skills](https://code.claude.com/docs/en/skills), fetched 2026-07-15). A shadow-dodge name is never +([skills](https://code.claude.com/docs/en/skills), fetched 2026-07-15; recheck when that page +changes the plugin-namespace sentence). A shadow-dodge name is never *required*. The catalog's historical dodge names (`quality-gate`, `fanout`, `batch-simplify`, `research-deep`) stand or evolve on their own merits, not out of collision fear. The one residual caution is model-side: avoid a skill leaf name *identical* to a bundled skill's @@ -202,7 +206,7 @@ Prefer them in this order; the earlier ones are simplest and least surprising. |---|---|---| | Consumer `CLAUDE.md` / `.claude/rules` | The skill reads the consuming project's own context and rules | Project-specific conventions, naming, policies: the default extension surface | | `${CLAUDE_PROJECT_DIR}` | Path to the consumer's project root, substituted in hook/MCP/monitor commands and exported to subprocesses | Referencing project-local scripts/config | -| `userConfig` → `${user_config.KEY}` | Values Claude Code prompts for at enable time (typed: string/number/boolean/directory/file, optional sensitive). Substitutes as `${user_config.KEY}` in MCP/LSP configs and exec-form hook commands; non-sensitive values also substitute into skill/agent content. Shell-form hook commands, monitor commands, and MCP `headersHelper` reject this substitution. Hook processes receive every value as `CLAUDE_PLUGIN_OPTION_`; a Bash tool call made by a skill does not (see the [smoke-test record](extensibility-contract-smoke-tests.md)). Non-sensitive values are stored under `pluginConfigs[].options` in user settings and read from user, `--settings`, or managed settings; project/local entries are ignored. Sensitive values use the macOS Keychain or `~/.claude/.credentials.json` where no supported keychain exists | Endpoints, toggles, tokens: personal or administrator-supplied config without editing the plugin | +| `userConfig` → `${user_config.KEY}` | Values Claude Code prompts for at enable time (typed: string/number/boolean/directory/file, optional sensitive). Substitutes as `${user_config.KEY}` in MCP/LSP configs and exec-form hook commands; non-sensitive values also substitute into skill/agent content. Shell-form hook commands, monitor commands, and MCP `headersHelper` reject this substitution. Hook processes receive every value as `CLAUDE_PLUGIN_OPTION_`; a Bash tool call made by a skill does not (see the [smoke-test record](extensibility-contract-smoke-tests.md)). Non-sensitive values are stored under `pluginConfigs[].options` in user settings and read from user or managed settings; project/local entries are ignored (`--settings` is unverified since 2026-10-07, hook-config-delivery fact 5). Sensitive values use the macOS Keychain or `~/.claude/.credentials.json` where no supported keychain exists | Endpoints, toggles, tokens: personal or administrator-supplied config without editing the plugin | | `${CLAUDE_PLUGIN_ROOT}` | Path to the plugin's own installed directory | Referencing bundled scripts/assets (mandatory under cache isolation) | | `${CLAUDE_SKILL_DIR}` | Path to the current skill's subdirectory within the plugin (not the plugin root); substituted in skill and agent content per the [skills reference](https://code.claude.com/docs/en/skills#available-string-substitutions) | Pre-compute blocks and `allowed-tools` paths that must resolve to skill-local scripts without hardcoding the plugin root | | `${CLAUDE_PLUGIN_DATA}` | Persistent per-plugin directory that survives updates (`~/.claude/plugins/data//`) | Installed deps, caches, generated state | @@ -230,8 +234,10 @@ one increment past the precedent). Behavioral gaps the docs leave open are resol `string[]` type); mark a credential `sensitive` so it lands in Claude Code's secure credential storage, never `settings.json`. Non-sensitive values store under `pluginConfigs[].options` in user settings and are read from - user settings, `--settings`, or managed settings only; project and local entries are ignored since - Claude Code 2.1.207. Use for endpoints, toggles, tokens, and personal path knobs. The `directory` / + user settings or managed settings only; project and local entries are ignored since + Claude Code 2.1.207. `--settings` is unverified since the entry stopped naming it (as of + 2026-10-07; recheck when the [pluginConfigs entry](https://code.claude.com/docs/en/settings-reference#pluginconfigs) + names `--settings` again or a probe shows a `--settings` value read or ignored). Use for endpoints, toggles, tokens, and personal path knobs. The `directory` / `file` type is a UI hint, not a validator: a `--config` value is stored verbatim with no existence check and no normalization to absolute (smoke-test A). 2. **Tracked rich config under `${CLAUDE_PROJECT_DIR}`. [first-party PRECEDENT; folder form is a @@ -529,7 +535,7 @@ dotfiles, user-scope `enabledPlugins`) migrate from their own repositories. How a later commit under an unchanged `version` reaches an installed plugin depends on whether Claude Code loads the plugin in place or from a copy ([Plugin loading reference](https://code.claude.com/docs/en/plugins/loading#in-place-and-copied-plugins), -fetched 2026-10-04): +fetched 2026-10-04; recheck when that section changes which sources load in place): - **A marketplace added from a local path** (`claude plugin marketplace add `, or a `directory` source in checked-in settings): every plugin here has a relative-path source @@ -867,6 +873,8 @@ here, whether new or a version bump that adds a trust surface, passes this revie gate above (whose step 6 gates PII/secrets). **Deny by default** any surface below that can't be justified. Facts verified against the plugins/MCP reference 2026-07-09 and re-verified against the plugins, plugins-reference, and hooks pages 2026-07-17; re-verify per the `CLAUDE.md` fresh-docs mandate. +Recheck when a Claude Code release note changes hook command substitution, `userConfig` +interpolation, or what a plugin may bundle. 1. **Code execution: hooks & scripts.** A hook command runs on the consumer's machine on matched events, with `${CLAUDE_PLUGIN_ROOT}`, `${CLAUDE_PROJECT_DIR}`, `${CLAUDE_PLUGIN_DATA}`, and any `${ENV_VAR}` @@ -905,8 +913,8 @@ plugins-reference, and hooks pages 2026-07-17; re-verify per the `CLAUDE.md` fre input and stores the value in the macOS Keychain or, on platforms without a supported keychain, `~/.claude/.credentials.json`, and **not** `settings.json`. Non-sensitive values land in user `settings.json` under `pluginConfigs[].options` and are readable, so - never put a secret there. Claude Code reads this key from user settings, `--settings`, and managed settings, - not project or local settings. Endpoints and toggles are fine as non-sensitive. Every option is documented. + never put a secret there. Claude Code reads this key from user settings and managed settings, + not project or local settings (`--settings` is unverified since 2026-10-07, hook-config-delivery fact 5). Endpoints and toggles are fine as non-sensitive. Every option is documented. 4. **Cache isolation: no reach-outs.** References only files inside the plugin via `${CLAUDE_PLUGIN_ROOT}`; persists state in `${CLAUDE_PLUGIN_DATA}`. No `../` reach-outs, no constructed absolute paths, no reading **consumer repository** files outside `${CLAUDE_PROJECT_DIR}`. @@ -1501,7 +1509,8 @@ For a plugin that already ships here, iterate against your local clone without r without changing any consumer's marketplace registration. `--plugin-dir` loads a plugin straight from a directory; when its `name` matches an installed marketplace plugin, **the local copy takes precedence for that session**, so you exercise working-tree edits against the installed copy without -uninstalling it (verified 2026-06-24). +uninstalling it (verified 2026-06-24; recheck when the plugins reference changes how +`--plugin-dir` resolves a name that matches an installed plugin). ```shell # from this repo root: point at the plugin directory, not the marketplace root diff --git a/docs/plugin-philosophy.md b/docs/plugin-philosophy.md index a23c0e0286..b22057f17c 100644 --- a/docs/plugin-philosophy.md +++ b/docs/plugin-philosophy.md @@ -391,8 +391,11 @@ Choose one authoritative owner for each value: | Bundled plugin code and assets | `${CLAUDE_PLUGIN_ROOT}` | `userConfig` is not repository configuration. Claude Code reads its stored `pluginConfigs` values only -from user settings, `--settings`, and managed settings. It ignores project and local settings for this -key. Claude Code owns the configuration prompt and storage; plugin skills must not hand-edit +from user settings and managed settings +([`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs)). It ignores +project and local settings for this key. `--settings` is unverified since the entry stopped naming +it (as of 2026-10-07; recheck when the pluginConfigs entry names `--settings` again or a probe shows +a `--settings` value read or ignored). Claude Code owns the configuration prompt and storage; plugin skills must not hand-edit `pluginConfigs` or invent a marketplace-qualified plugin ID. Use `userConfig` to its full native extent. Every personal or administrator scalar that flows @@ -1714,3 +1717,6 @@ As of 2026-07-17: naming-convention guidance this document deviates from deliberately. - [Agent Skills specification](https://agentskills.io/specification): `name` field constraints and directory matching. + +Recheck when the dependencies page changes how constraints resolve, the skills page changes the +plugin skill namespace, or the specification changes the `name` constraints. diff --git a/lib/hook-utils.sh b/lib/hook-utils.sh index 714b549cf1..c563207f40 100644 --- a/lib/hook-utils.sh +++ b/lib/hook-utils.sh @@ -1012,7 +1012,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4252,6 +4253,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/actionlint/.claude-plugin/plugin.json b/plugins/actionlint/.claude-plugin/plugin.json index 8166de5d2c..e86ab1e782 100644 --- a/plugins/actionlint/.claude-plugin/plugin.json +++ b/plugins/actionlint/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "actionlint", - "version": "0.12.12", + "version": "0.12.13", "description": "Lint GitHub Actions workflow files on edit via actionlint, surfacing findings as advisory context.", "author": { "name": "Melodic Software", diff --git a/plugins/actionlint/CHANGELOG.md b/plugins/actionlint/CHANGELOG.md index 3c6285bf9e..0acb0e47f3 100644 --- a/plugins/actionlint/CHANGELOG.md +++ b/plugins/actionlint/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `actionlint` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.12.13] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.12.12] - 2026-10-07 ### Changed diff --git a/plugins/actionlint/hooks/hook-utils.sh b/plugins/actionlint/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/actionlint/hooks/hook-utils.sh +++ b/plugins/actionlint/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/ai-briefing/.claude-plugin/plugin.json b/plugins/ai-briefing/.claude-plugin/plugin.json index 09616b5d32..b0db0f56b5 100644 --- a/plugins/ai-briefing/.claude-plugin/plugin.json +++ b/plugins/ai-briefing/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "ai-briefing", - "version": "0.8.6", + "version": "0.8.7", "description": "Build source-backed AI-industry briefings from official vendor publications, configured RSS/Atom feeds, GitHub releases, reputable secondary reporting, and user-supplied URLs. Deduplicate, rank, and present results as markdown or optional HTML/PPTX decks, with repository-owned profile, audience, and brand configuration. Automated X/Twitter collection is disabled; Playwright is used only for deterministic local rendering.", "author": { "name": "Melodic Software", diff --git a/plugins/ai-briefing/CHANGELOG.md b/plugins/ai-briefing/CHANGELOG.md index c8042231fa..b58691c855 100644 --- a/plugins/ai-briefing/CHANGELOG.md +++ b/plugins/ai-briefing/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `ai-briefing` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.8.7] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.8.6] - 2026-10-07 ### Changed diff --git a/plugins/ai-briefing/skills/generate/output/build/lib/url-policy.js b/plugins/ai-briefing/skills/generate/output/build/lib/url-policy.js index ca65ff1dc2..8295cb4a55 100644 --- a/plugins/ai-briefing/skills/generate/output/build/lib/url-policy.js +++ b/plugins/ai-briefing/skills/generate/output/build/lib/url-policy.js @@ -49,6 +49,8 @@ function isDottedQuad(octets) { // complete against the registry as fetched 2026-07-26 — a point-in-time claim, // since IANA can add a row; the only rows omitted are those the registry // marks globally reachable (the AS112, AMT, PCP and TURN anycast assignments). +// Recheck when IANA adds an IPv4 Special-Purpose registry row whose Globally +// Reachable column is not True. function isPrivateIPv4(host) { const octets = host.split(".").map(Number); if (!isDottedQuad(octets)) return false; diff --git a/plugins/animation/.claude-plugin/plugin.json b/plugins/animation/.claude-plugin/plugin.json index 857030efe0..814ee7ca32 100644 --- a/plugins/animation/.claude-plugin/plugin.json +++ b/plugins/animation/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "animation", - "version": "0.4.11", + "version": "0.4.12", "description": "Hand-drawn-style 2D animation as code, rendered in headless Chromium by an ink brush engine. rotoscope copies a reference clip drawing by drawing: trace to vector paths, render, measure against the source (XOR, SSIM), and fit per-shot brush overrides. learn-style measures a clip into a style pack (ships woodcut-ink) and checks films against it. produce turns a brief into approved boards, a shot list, frames, and a delivered file. setup checks ffmpeg, Node, Chromium, and Python.", "author": { "name": "Melodic Software", diff --git a/plugins/animation/CHANGELOG.md b/plugins/animation/CHANGELOG.md index 2f6bf53993..7d9922f818 100644 --- a/plugins/animation/CHANGELOG.md +++ b/plugins/animation/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `animation` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.4.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.4.11] - 2026-10-07 ### Changed diff --git a/plugins/animation/hooks/hook-utils.sh b/plugins/animation/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/animation/hooks/hook-utils.sh +++ b/plugins/animation/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/autonomy/.claude-plugin/plugin.json b/plugins/autonomy/.claude-plugin/plugin.json index b7709b1056..8d7c61c87c 100644 --- a/plugins/autonomy/.claude-plugin/plugin.json +++ b/plugins/autonomy/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "autonomy", - "version": "0.26.12", + "version": "0.26.13", "description": "Contracts for governed autonomous agent operation: role topology, binding seam, telemetry, return accounting, trigger dispatch, a per-work-class guardrail matrix, a standing-routine catalog, and a runner charter. A guided setup skill writes an org's binding, wires OTLP telemetry (file default), human-attested return capture, and signal adapters behind one governed dispatch entrypoint, binds the guardrail matrix to isolation substrates after a live probe, and schedules routines.", "author": { "name": "Melodic Software", diff --git a/plugins/autonomy/CHANGELOG.md b/plugins/autonomy/CHANGELOG.md index c9fd9084af..4012cc1e1d 100644 --- a/plugins/autonomy/CHANGELOG.md +++ b/plugins/autonomy/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `autonomy` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.26.13] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.26.12] - 2026-10-07 ### Changed diff --git a/plugins/autonomy/README.md b/plugins/autonomy/README.md index 766119efbf..15d0bdac35 100644 --- a/plugins/autonomy/README.md +++ b/plugins/autonomy/README.md @@ -13,8 +13,8 @@ skills produced a commit); see Node.js on PATH. Every hook row runs through `node hooks/exec-bash.mjs`, and Claude Code's native binary neither ships nor uses Node -([setup](https://code.claude.com/docs/en/setup), fetched 2026-09-29), so without `node` the hooks -do not launch and the lane-stop gate is not enforced. The setup `check` reports whether `node` +([setup](https://code.claude.com/docs/en/setup), fetched 2026-09-29; recheck when the setup page +says the native binary ships or uses Node), so without `node` the hooks do not launch and the lane-stop gate is not enforced. The setup `check` reports whether `node` resolves. The hooks also use Bash (Git Bash on native Windows) and `jq`; without `jq` they fail open. `/autonomy:check` reports whether `node` and `jq` resolve. @@ -90,7 +90,8 @@ resolves. The hooks also use Bash (Git Bash on native Windows) and `jq`; without recover-instead-of-stopping sentence carry the two behaviors the Claude Fable 5.1 prompting guide adds in its section "Finish the whole task" (, - fetched 2026-09-06). Both are authored locally rather than reproduced, per this repository's rule + fetched 2026-09-06). Recheck a clause when its guide section is renamed or stops carrying the + behavior. Both are authored locally rather than reproduced, per this repository's rule against hand-copying upstream content. The citation lives here rather than in the contract file because `reference/` docs are written in surface classes and may not name vendors. **Recheck trigger:** either section changing its clause set, a later model guide restating this @@ -165,7 +166,10 @@ merge: session across many `/loop` cycles, each of whose stops must stay gated, so it lives for the claiming session and is retired by TTL plus the launcher's relaunch sweep. To arm a hand-launched session, run the arm helper from the installed plugin the same way, then pass the id via - `--settings '{"pluginConfigs":{"autonomy@":{"options":{"lane_stop_gate_arm_id":""}}}}'`. + `--settings '{"pluginConfigs":{"autonomy@":{"options":{"lane_stop_gate_arm_id":""}}}}'`. That `--settings` delivery is unverified + since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) + entry stopped naming the flag (as of 2026-10-07; recheck when the entry names `--settings` + again or a probe shows a `--settings` value read or ignored). 3. **User `settings.json`**, located from the hook's own install path, a *persistent* enable that also gates interactive sessions, which defeats the default-OFF design; prefer the launcher. diff --git a/plugins/autonomy/hooks/hook-utils.sh b/plugins/autonomy/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/autonomy/hooks/hook-utils.sh +++ b/plugins/autonomy/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/autonomy/hooks/lane-stop-gate-arm.sh b/plugins/autonomy/hooks/lane-stop-gate-arm.sh index 802b54728e..7e92bd2e9d 100755 --- a/plugins/autonomy/hooks/lane-stop-gate-arm.sh +++ b/plugins/autonomy/hooks/lane-stop-gate-arm.sh @@ -7,7 +7,8 @@ # between managed and user settings — under this plugin's own install-derived # data directory: /plugins/data//lane-arms/. The launcher # then passes the same arm id to the session through the `lane_stop_gate_arm_id` -# userConfig option (`claude --settings ...`), and the gate treats the +# userConfig option (`claude --settings ...`, unverified since the pluginConfigs +# docs entry stopped naming the flag, as of 2026-10-07), and the gate treats the # env-delivered id purely as a pointer into this store. Because the store is # derived from this script's own location — never from an environment value — a # watched repository cannot mint, redirect, or forge a record; because the id is diff --git a/plugins/autonomy/skills/setup/SKILL.md b/plugins/autonomy/skills/setup/SKILL.md index 00cef8e1b6..237c541a0a 100644 --- a/plugins/autonomy/skills/setup/SKILL.md +++ b/plugins/autonomy/skills/setup/SKILL.md @@ -200,7 +200,10 @@ bind in this plugin's `userConfig` rather than either governance surface: the ve pool, and whether the advisory visual narration lane runs. Neither counts anything, the pool contributes to no floor, and the narration lane has no security-binding cell at all, so neither can weaken a floor, which is what lets them sit on an operator surface. Plugin options resolve from -user, `--settings`, and managed settings only; a watched repository's own `.claude/settings.json` is +user and managed settings only (`--settings` is unverified since the +[`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped +naming it, as of 2026-10-07; recheck when the entry names it again or a probe shows a `--settings` +value read or ignored); a watched repository's own `.claude/settings.json` is not read for them, so a repo cannot dial its own verification. The slice proposes neither as a binding field. diff --git a/plugins/bash-format/.claude-plugin/plugin.json b/plugins/bash-format/.claude-plugin/plugin.json index 28a20bc1a7..7ac60ba8c4 100644 --- a/plugins/bash-format/.claude-plugin/plugin.json +++ b/plugins/bash-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "bash-format", - "version": "0.10.12", + "version": "0.10.13", "description": "Auto-format and lint shell scripts on edit via shfmt + ShellCheck, using the consuming repo's own .editorconfig and .shellcheckrc.", "author": { "name": "Melodic Software", diff --git a/plugins/bash-format/CHANGELOG.md b/plugins/bash-format/CHANGELOG.md index 8ae175ca0d..0d769c2be7 100644 --- a/plugins/bash-format/CHANGELOG.md +++ b/plugins/bash-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `bash-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.10.13] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.10.12] - 2026-10-07 ### Changed diff --git a/plugins/bash-format/hooks/hook-utils.sh b/plugins/bash-format/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/bash-format/hooks/hook-utils.sh +++ b/plugins/bash-format/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/biome-format/.claude-plugin/plugin.json b/plugins/biome-format/.claude-plugin/plugin.json index f730d78796..3de9cb293f 100644 --- a/plugins/biome-format/.claude-plugin/plugin.json +++ b/plugins/biome-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "biome-format", - "version": "0.8.11", + "version": "0.8.12", "description": "Auto-format and lint JS/TS/JSX/JSON on edit via Biome, only when a biome.json governs the repo, using the consuming repo's own Biome config.", "author": { "name": "Melodic Software", diff --git a/plugins/biome-format/CHANGELOG.md b/plugins/biome-format/CHANGELOG.md index eb7a645323..69d042a220 100644 --- a/plugins/biome-format/CHANGELOG.md +++ b/plugins/biome-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `biome-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.8.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.8.11] - 2026-10-07 ### Changed diff --git a/plugins/biome-format/hooks/hook-utils.sh b/plugins/biome-format/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/biome-format/hooks/hook-utils.sh +++ b/plugins/biome-format/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/bugs/.claude-plugin/plugin.json b/plugins/bugs/.claude-plugin/plugin.json index 3ccf6c94b0..98b21c2f34 100644 --- a/plugins/bugs/.claude-plugin/plugin.json +++ b/plugins/bugs/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "bugs", - "version": "0.11.16", + "version": "0.11.17", "description": "Produces from an informal defect description a structured five-field bug report: title, steps to reproduce, expected vs actual, severity with justification, and suggested fix location. Read-only by default: it emits the report and never edits code, opens a PR, or files an issue on its own.", "author": { "name": "Melodic Software", diff --git a/plugins/bugs/CHANGELOG.md b/plugins/bugs/CHANGELOG.md index f62608df9b..1d68be7cc1 100644 --- a/plugins/bugs/CHANGELOG.md +++ b/plugins/bugs/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `bugs` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.11.17] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.11.16] - 2026-10-07 ### Changed diff --git a/plugins/code-metrics/.claude-plugin/plugin.json b/plugins/code-metrics/.claude-plugin/plugin.json index 62adc106c3..5fe97b0a8d 100644 --- a/plugins/code-metrics/.claude-plugin/plugin.json +++ b/plugins/code-metrics/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "code-metrics", - "version": "0.5.8", + "version": "0.5.9", "description": "Read-only code measures for a change, with cited references and no verdict: lines per file (audit-size), cyclomatic, cognitive, and Halstead complexity (audit-complexity), duplication (audit-duplication), per-function coverage and CRAP from existing lcov, Cobertura, coverage.py, or Go artifacts (audit-coverage), TypeScript and Python type debt (audit-type-debt), metric literacy (principles), and setup. Uses only collectors already installed; never installs or runs tests.", "author": { "name": "Melodic Software", diff --git a/plugins/code-metrics/CHANGELOG.md b/plugins/code-metrics/CHANGELOG.md index 02b1921135..40ff0e97d3 100644 --- a/plugins/code-metrics/CHANGELOG.md +++ b/plugins/code-metrics/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `code-metrics` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.5.9] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.5.8] - 2026-10-07 ### Changed diff --git a/plugins/code-metrics/scripts/collectors/cpd.py b/plugins/code-metrics/scripts/collectors/cpd.py index 8308772de2..7229e0bb5e 100755 --- a/plugins/code-metrics/scripts/collectors/cpd.py +++ b/plugins/code-metrics/scripts/collectors/cpd.py @@ -21,7 +21,9 @@ `duplication` element per clone group carrying `lines` and `tokens` with one `file` child per instance (`path`, `line`, `endline`). CPD exits 4 when it finds duplications and 5 on recoverable errors, so its exit code is not read: -the parseable report is the success signal (design T1). +the parseable report is the success signal (design T1). Recheck when a PMD +release renames a `pmd cpd` option or changes the `duplication` and `file` +attributes of the XML report, or when a live run disagrees with this form. Tunables arrive as environment variables the calling skill exports from the resolved configuration: diff --git a/plugins/code-metrics/scripts/collectors/dupl.py b/plugins/code-metrics/scripts/collectors/dupl.py index 6d60eeeab4..e1dcd10d29 100755 --- a/plugins/code-metrics/scripts/collectors/dupl.py +++ b/plugins/code-metrics/scripts/collectors/dupl.py @@ -14,6 +14,8 @@ printer is parsed rather than `-plumbing`, whose `:-: duplicate of :-` lines are pairwise and lose a group of three or more copies. Any line that matches neither shape is ignored. +Recheck when a mibk/dupl commit changes the text printer's `found clones:` +or `:,` line shapes, or when a live run disagrees. `dupl` reports no token count, so `values.tokens` is null, never zero, and its `-t` threshold is a token count with no line equivalent. Tunables arrive as diff --git a/plugins/code-metrics/scripts/collectors/jscpd.py b/plugins/code-metrics/scripts/collectors/jscpd.py index 10232af660..93239889a1 100755 --- a/plugins/code-metrics/scripts/collectors/jscpd.py +++ b/plugins/code-metrics/scripts/collectors/jscpd.py @@ -78,6 +78,8 @@ # file reaches, so jscpd's own gate can never skip a file this adapter did not # name; both are accepted by both majors (`0` is not), verified 2026-09-11 # against 4.3.0 and 5.2.0 with the line bound at the signed 32-bit maximum. +# Recheck when a jscpd release newer than 5.2.0 changes how its size or line +# bounds are parsed or accepted. NO_LINE_CAP = 2_147_483_647 NO_SIZE_CAP = 1 << 40 _SIZE_UNITS = {"": 1, "b": 1, "kb": 1024, "mb": 1024**2, "gb": 1024**3} diff --git a/plugins/code-metrics/scripts/collectors/radon.py b/plugins/code-metrics/scripts/collectors/radon.py index 9f9c61a687..7fb3d2710a 100755 --- a/plugins/code-metrics/scripts/collectors/radon.py +++ b/plugins/code-metrics/scripts/collectors/radon.py @@ -17,6 +17,9 @@ per-function block carries no line numbers, so those rows have `start_line` and `end_line` of `null` and the label `no-line-range` (design T7, T12). + +Recheck when a radon release newer than 6.0.1 changes the `cc -j` or `hal -j` +JSON shapes, or when a refreshed capture differs from the fixtures. """ from __future__ import annotations diff --git a/plugins/code-metrics/scripts/parsers/cobertura.py b/plugins/code-metrics/scripts/parsers/cobertura.py index e97aca57d0..11ba0c0034 100755 --- a/plugins/code-metrics/scripts/parsers/cobertura.py +++ b/plugins/code-metrics/scripts/parsers/cobertura.py @@ -13,6 +13,9 @@ lines/line[@number,@hits] methods/method[@name]/lines/line[@number,@hits] +Recheck when a gcovr release changes the Cobertura element or attribute names +it writes. + Two DTDs are both named `coverage-04.dtd` and many producers follow neither, so nothing here validates: elements are found wherever they sit, a missing attribute is absent rather than zero, and an unparsable `number` or `hits` diff --git a/plugins/code-metrics/scripts/parsers/lcov.py b/plugins/code-metrics/scripts/parsers/lcov.py index c668ea33d3..0b3138b2da 100755 --- a/plugins/code-metrics/scripts/parsers/lcov.py +++ b/plugins/code-metrics/scripts/parsers/lcov.py @@ -16,6 +16,9 @@ FNA:,, function alias, lcov 2.2 and later end_of_record section terminator +Recheck when a geninfo release adds or renames a tracefile record this list +reads. + Every other record is skipped, so an MC/DC tracefile parses without special handling and a `BRDA` whose `taken` field is the literal `-` is never coerced to a count. The skipped set: TN, VER, FNF, FNH, BRDA, BRF, BRH, LF, LH, and diff --git a/plugins/code-tidying/.claude-plugin/plugin.json b/plugins/code-tidying/.claude-plugin/plugin.json index 03b5e114ed..78a18ec86a 100644 --- a/plugins/code-tidying/.claude-plugin/plugin.json +++ b/plugins/code-tidying/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "code-tidying", - "version": "0.28.11", + "version": "0.28.12", "description": "Code tidying and comment hygiene. tidy hunts a rotated lane for Beck-style tidyings and ships one PR. batch-simplify sweeps a branch, time window, or repo in dependency-ordered waves. dissolve-comments deletes zero-information comments and moves the rest into names (safe, aggressive, strip modes). audit-comment-residue flags history, plan, conversational, and ticket residue. audit-dead-code finds dead code with knip, vulture, gopls, and grep. setup scaffolds tidy lanes.", "author": { "name": "Melodic Software", diff --git a/plugins/code-tidying/CHANGELOG.md b/plugins/code-tidying/CHANGELOG.md index 9a4eea7843..c3cb69ad25 100644 --- a/plugins/code-tidying/CHANGELOG.md +++ b/plugins/code-tidying/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `code-tidying` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.28.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.28.11] - 2026-10-07 ### Changed diff --git a/plugins/code-tidying/skills/audit-comment-residue/scripts/changed-code-files.sh b/plugins/code-tidying/skills/audit-comment-residue/scripts/changed-code-files.sh index aa020276b6..f8735acde1 100755 --- a/plugins/code-tidying/skills/audit-comment-residue/scripts/changed-code-files.sh +++ b/plugins/code-tidying/skills/audit-comment-residue/scripts/changed-code-files.sh @@ -8,6 +8,9 @@ # repo does not ship a grant on docs alone # (plugins/discovery/reference/parent-contract.md). The skill-local path is the # exercised shape; the implementation stays single-source at the plugin root. +# Recheck when the skills page stops documenting ${CLAUDE_PLUGIN_ROOT} +# substitution in `allowed-tools` Bash rules, or documents that such a rule +# matches at runtime. set -euo pipefail here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" exec "$here/../../../scripts/changed-code-files.sh" "$@" diff --git a/plugins/code-tidying/skills/dissolve-comments/reference/tooling.md b/plugins/code-tidying/skills/dissolve-comments/reference/tooling.md index 229a28acd4..a165578376 100644 --- a/plugins/code-tidying/skills/dissolve-comments/reference/tooling.md +++ b/plugins/code-tidying/skills/dissolve-comments/reference/tooling.md @@ -55,7 +55,7 @@ lands, or a probe row changes status on a machine where it used to pass. | tree-sitter-bash 0.25.1 rejects base-N arithmetic (`N#$var` inside `$(( ))`) | ERROR nodes, one spanning a third of `lib/hook-utils.sh`, so `change-shape.py` returns UNPROVABLE for the file against itself and no deletion or rename in it can carry a proof; 35 `.sh` files in this tree carry the form | 2026-09-08 | | tree-sitter-powershell 0.26.4 vs `Parser::ParseFile`, on 27,564 lines of real PowerShell (`Provisioning.psm1` 537 KB, `Provisioning.Tests.ps1` 1.0 MB) | the grammar: 33 ERROR + 1 MISSING and 115 ERROR + 172 MISSING, so both files are UNPROVABLE against themselves; the native parser: **0** parse errors on both, in 97 ms and 225 ms | 2026-09-20 | | Deleting every comment token by its extent, then comparing the `(Kind, Text)` sequence minus `Comment`/`NewLine` | identical for 1,069 comments in `Provisioning.psm1` and 2,114 in `Provisioning.Tests.ps1`; deleting only the `#Requires` line also leaves the sequence identical, which is why it is kept as its own leaf | 2026-09-20 | -| PowerShell on the GitHub-hosted runner images, from [`actions/runner-images`](https://github.com/actions/runner-images) `main` | `ubuntu-24.04` 7.6.5 ([Ubuntu2404-Readme.md](https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md)), `windows-2025` 7.6.6 ([Windows2025-Readme.md](https://github.com/actions/runner-images/blob/main/images/windows/Windows2025-Readme.md)), `macos-15` 7.6.4 ([macos-15-Readme.md](https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md)). Only these three were checked; other image labels are unverified | 2026-09-21 | +| PowerShell on the GitHub-hosted runner images, from [`actions/runner-images`](https://github.com/actions/runner-images) `main` | `ubuntu-24.04` 7.6.5 ([Ubuntu2404-Readme.md](https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md)), `windows-2025` 7.6.6 ([Windows2025-Readme.md](https://github.com/actions/runner-images/blob/main/images/windows/Windows2025-Readme.md)), `macos-15` 7.6.4 ([macos-15-Readme.md](https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md)). Only these three were checked; other image labels are unverified. Recheck when a runner-images release changes the PowerShell version in any of the three readmes | 2026-09-21 | | `pwsh` 7.6.6 cold start, `-NoProfile -NonInteractive` | 0.50–0.69 s, plus roughly 1.5 s per megabyte of source to tokenize and serialize. A `List.Add` per token instead of an indexed write into a preallocated array costs 3.9 s on the 97k-token file where the indexed write costs 1.0 s, which is why nested string tokens are emitted as a side list rather than inline | 2026-09-21 | ## What no tool covers diff --git a/plugins/computer-use/.claude-plugin/plugin.json b/plugins/computer-use/.claude-plugin/plugin.json index edd0a2f77f..ee301391ff 100644 --- a/plugins/computer-use/.claude-plugin/plugin.json +++ b/plugins/computer-use/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "computer-use", - "version": "0.1.9", + "version": "0.1.10", "description": "Operating knowledge for Claude Code's built-in computer-use MCP server (desktop screen control). /computer-use:diagnose resolves a symptom to a cause instead of retrying: the fixed screenshot pixel budget and why zoom recovers detail, how to read capture and input failures, and per-OS quirks that make synthesized keys or menus behave unlike a human's. /computer-use:setup verifies prerequisites and reports environment settings that end a session mid-run.", "author": { "name": "Melodic Software", diff --git a/plugins/computer-use/CHANGELOG.md b/plugins/computer-use/CHANGELOG.md index 1335142658..bc47a1d209 100644 --- a/plugins/computer-use/CHANGELOG.md +++ b/plugins/computer-use/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `computer-use` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.1.10] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.1.9] - 2026-10-02 ### Fixed diff --git a/plugins/computer-use/skills/diagnose/reference/failure-diagnostics.md b/plugins/computer-use/skills/diagnose/reference/failure-diagnostics.md index dbca200dce..5d002c22ac 100644 --- a/plugins/computer-use/skills/diagnose/reference/failure-diagnostics.md +++ b/plugins/computer-use/skills/diagnose/reference/failure-diagnostics.md @@ -44,7 +44,7 @@ Walk it in order; stop at the first hit. 2. **Is the workstation locked?** The secure desktop blocks capture and input wholesale. 3. **Is the display asleep / powered off?** Upstream is explicit that the machine must be awake ([Cowork computer use](https://support.claude.com/en/articles/14128542-let-claude-use-your-computer-in-cowork), - verified 2026-08-10). + verified 2026-08-10; recheck when that article stops requiring an awake machine). 4. **Are you pinned to a monitor that is off?** An explicit `switch_display` persists until reset. Return to `auto` and retry before concluding anything. diff --git a/plugins/context-budget/.claude-plugin/plugin.json b/plugins/context-budget/.claude-plugin/plugin.json index 554a708e7a..1c5d485035 100644 --- a/plugins/context-budget/.claude-plugin/plugin.json +++ b/plugins/context-budget/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "context-budget", - "version": "0.9.9", + "version": "0.9.10", "description": "Measures a Claude Code session's fixed startup context payload per item at a pinned binary version, including per-tool attribution of the built-in tool pools that /context reports only as totals, derived by A/B deny differencing under comparability rules. Falls back from an SDK meter to a headless /context parser, then to an error rather than a wrong number. Keeps a per-project before/after ledger per lever. Report-only by default; fix applies one approved project-scope trim.", "author": { "name": "Melodic Software", diff --git a/plugins/context-budget/CHANGELOG.md b/plugins/context-budget/CHANGELOG.md index 2c79e64a7b..6c4997d7d8 100644 --- a/plugins/context-budget/CHANGELOG.md +++ b/plugins/context-budget/CHANGELOG.md @@ -7,6 +7,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Versions 0.6.38 and 0.6.40 were reserved by parallel changes and never published. +## [0.9.10] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.9.9] - 2026-10-07 ### Changed diff --git a/plugins/context-budget/hooks/settings-write-ask.mjs b/plugins/context-budget/hooks/settings-write-ask.mjs index e1f452477d..103f4ae22b 100755 --- a/plugins/context-budget/hooks/settings-write-ask.mjs +++ b/plugins/context-budget/hooks/settings-write-ask.mjs @@ -13,7 +13,8 @@ // since nothing can prompt. Interactive behavior remains unmeasured; do not // extrapolate. The checkpoint's value is that a matched file-editing tool // cannot rewrite a settings file silently while this plugin is enabled. -// A shell write is outside that claim. +// A shell write is outside that claim. Recheck when a Claude Code changelog entry changes how a +// PreToolUse "ask" resolves in a headless run. // // Fail-open: on any internal error or unrecognized payload, exit 0 with no // output — a broken checkpoint must not block unrelated writes. Kill switch: diff --git a/plugins/context-budget/skills/audit/reference/engine.md b/plugins/context-budget/skills/audit/reference/engine.md index e86ba889a8..f687def10e 100644 --- a/plugins/context-budget/skills/audit/reference/engine.md +++ b/plugins/context-budget/skills/audit/reference/engine.md @@ -10,7 +10,7 @@ that shows it, at the consumer's binary, and stamped with that binary's version. | Rung | Mode | Precision | Requires | Recorded caveats | |---|---|---|---|---| | 1 | `sdk` | `exact` (integer tokens) | `@anthropic-ai/claude-agent-sdk` resolvable from `--sdk-dir` or the working directory | none | -| 2 | `cli-parse` | `display-rounded` (table cells like `11.4k`) | ` -p "/context"` producing the category table with at least one of the two system-tool rows. The engine spawns the binary directly; a hand check from Git Bash must run `MSYS_NO_PATHCONV=1 claude -p "/context"`, because path conversion otherwise rewrites `/context` and the session answers in prose | rounded values; a system-tool row the table lacks is named in a caveat and left unmeasured; headless `/context` is undocumented as a `-p`-capable command, so this rung depends on unsanctioned behavior. When the token-counting API is unavailable, `/context` uses a local estimate instead of extra small-model requests (Claude Code 2.1.261). The commands page `/context` row, fetched 2026-09-28, does not yet say that; the changelog is the behavior source until the row does | +| 2 | `cli-parse` | `display-rounded` (table cells like `11.4k`) | ` -p "/context"` producing the category table with at least one of the two system-tool rows. The engine spawns the binary directly; a hand check from Git Bash must run `MSYS_NO_PATHCONV=1 claude -p "/context"`, because path conversion otherwise rewrites `/context` and the session answers in prose | rounded values; a system-tool row the table lacks is named in a caveat and left unmeasured; headless `/context` is undocumented as a `-p`-capable command, so this rung depends on unsanctioned behavior. When the token-counting API is unavailable, `/context` uses a local estimate instead of extra small-model requests (Claude Code 2.1.261). The commands page `/context` row, fetched 2026-09-28, does not yet say that; the changelog is the behavior source until the row does (recheck when the `/context` row names the local estimate) | | 3 | n/a | n/a | n/a | exit 3 with a `context-budget.error/1` record naming the remediation; **never a wrong number** | The `/context` output format carries no stability guarantee in either direction and has materially @@ -47,7 +47,7 @@ the guard runs only in `sdk` mode. | Deferred tool loading controls what enters the context window, not what is sent. The full schema still goes out in the request | [Tool search: deferred tool loading](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool#deferred-tool-loading) | | `--disallowedTools` exists as a per-invocation CLI flag; there is **no** `disallowedTools` settings key. Persistent config uses `permissions.deny` | [CLI reference: flags](https://code.claude.com/docs/en/cli-reference#cli-flags), [settings](https://code.claude.com/docs/en/settings) | | The Agent SDK exposes structured context usage over the control protocol (`getContextUsage()`) | [Agent SDK TypeScript reference](https://code.claude.com/docs/en/agent-sdk/typescript) | -| When the token-counting API is unavailable, `/context` counts with a local estimate instead of extra small-model requests. The commands page `/context` row fetched 2026-09-28 does not say this; the 2.1.261 changelog does | [Claude Code changelog](https://code.claude.com/docs/en/changelog) (2.1.261) and [commands](https://code.claude.com/docs/en/commands) (`/context` row, which does not yet name the estimate) | +| When the token-counting API is unavailable, `/context` counts with a local estimate instead of extra small-model requests. The commands page `/context` row fetched 2026-09-28 does not say this; the 2.1.261 changelog does (recheck when that row names the local estimate) | [Claude Code changelog](https://code.claude.com/docs/en/changelog) (2.1.261) and [commands](https://code.claude.com/docs/en/commands) (`/context` row, which does not yet name the estimate) | The bare-name row was re-read on 2026-09-28 against [permissions](https://code.claude.com/docs/en/permissions). The page now says: "Bare-name removal diff --git a/plugins/context-budget/skills/audit/reference/interactive-only-tools.json b/plugins/context-budget/skills/audit/reference/interactive-only-tools.json index 364574a9cc..0a4651e73c 100644 --- a/plugins/context-budget/skills/audit/reference/interactive-only-tools.json +++ b/plugins/context-budget/skills/audit/reference/interactive-only-tools.json @@ -12,6 +12,6 @@ "notes": [ "Interactive-only MCP servers are known-uncovered as a class; third-party names are not enumerated.", "Plan-mode tools are listed by the product names EnterPlanMode and ExitPlanMode; a future rename is a listing edit, not a silent omission.", - "EndConversation never enters either attributed headless bucket. A bare-name deny also cannot remove it while any other tool remains (permissions page, re-read 2026-09-28)." + "EndConversation never enters either attributed headless bucket. A bare-name deny also cannot remove it while any other tool remains (permissions page, re-read 2026-09-28; recheck when its bare-name removal passage drops the EndConversation exception)." ] } diff --git a/plugins/context-guard/hooks/hook-utils.sh b/plugins/context-guard/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/context-guard/hooks/hook-utils.sh +++ b/plugins/context-guard/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/context-guard/hooks/post-compact-mark.sh b/plugins/context-guard/hooks/post-compact-mark.sh index 6807255f27..32ca5d29f7 100755 --- a/plugins/context-guard/hooks/post-compact-mark.sh +++ b/plugins/context-guard/hooks/post-compact-mark.sh @@ -18,7 +18,8 @@ # wins per session: only the most recent compaction matters. # # SIDE-EFFECT-ONLY by upstream contract: PostCompact has no decision control -# (verified 2026-08-10 against code.claude.com/docs/en/hooks), so this +# (verified 2026-08-10 against code.claude.com/docs/en/hooks; recheck when +# the PostCompact entry documents a decision field), so this # hook's one job is the marker. jq-FREE by design, mirroring the # rate-limit-guard StopFailure recorder: the fields are regex-extracted so a # degraded environment still records. diff --git a/plugins/context-guard/reference/cloud-headless-capture.md b/plugins/context-guard/reference/cloud-headless-capture.md index 2aea004bea..7028e3e5b1 100644 --- a/plugins/context-guard/reference/cloud-headless-capture.md +++ b/plugins/context-guard/reference/cloud-headless-capture.md @@ -37,7 +37,8 @@ real occupancy numbers for the running session, and neither can be turned into a OpenTelemetry `claude_code.api_request` log event carries live per-session token counts but no window size and reaches only an out-of-process receiver, and the session transcript carries the same numbers behind an explicitly unsupported entry format. Both are recorded in full below rather -than waved off. +than waved off. Recheck when the hooks, settings or statusline docs name a new per-session +occupancy channel outside a mod. Hook stdin, the named candidate for a settings hook, carries no context, token, usage, or window field on any event, **except `PostToolUse` on the `Agent` tool, whose `tool_response` carries @@ -85,7 +86,8 @@ nothing calling the tee, because nothing calls a statusline. scope of a live cloud session, and it never ran. The write was live rather than pending a restart. Claude Code "watches your settings files and reloads them when they change", the reload "covers user, project, local, and managed settings", and `statusLine` is not among the few keys documented -as read once at session start (, read 2026-08-21). The +as read once at session start (, read 2026-08-21; recheck +when that page lists `statusLine` among them). The headless half was measured the same day by the same method: the identical `statusLine` written into a scratch `HOME`, exercised with `claude -p '…' --output-format json`, again never invoked the probe and never created `~/.claude/context-guard/` at all. @@ -99,11 +101,12 @@ result for a settings hook rather than an assumption. ## Channels checked Every row but the first was read from the live page on **2026-08-21**, before mods shipped. Claims -below are quoted or paraphrased from those pages, not recalled. +below are quoted or paraphrased from those pages, not recalled. Recheck a row when its page adds +or removes a field in the Carries or Does-not-carry cell. | Channel | Source read | Carries | Does **not** carry | |---|---|---|---| -| Mods API `$.session.usage()` (read 2026-10-03, Claude Code 2.1.288) | | The running session's context-window use, read in process by a mod in any kind of session that loads it: tokens, window size, percentage, and with `breakdown: 'summary'` the last API response's token breakdown. **The capture path this plugin ships.** | Anything where the mod does not run (Desktop WSL sessions, mods off, the plugin not enabled); `prompt_cache` | +| Mods API `$.session.usage()` (read 2026-10-03, Claude Code 2.1.288; recheck when the mods API table renames or drops it) | | The running session's context-window use, read in process by a mod in any kind of session that loads it: tokens, window size, percentage, and with `breakdown: 'summary'` the last API response's token breakdown. **The capture path this plugin ships.** | Anything where the mod does not run (Desktop WSL sessions, mods off, the plugin not enabled); `prompt_cache` | | Hook stdin (all events) | | Common input fields: `session_id`, `prompt_id`, `transcript_path`, `cwd`, `permission_mode`, `effort`, `hook_event_name`, plus `agent_id` / `agent_type` under an agent. Event-specific fields such as `tool_name`, `tool_input`, `tool_use_id`. **One event carries token figures:** `PostToolUse` on the `Agent` tool receives `totalTokens` ("Token count from the subagent's final API request: input, output, and cache tokens combined. This isn't a total across the whole run") and a `usage` object (`input_tokens`, `output_tokens`, `cache_creation_input_tokens`, `cache_read_input_tokens`) in `tool_response` | Any context-window, token-count, usage, or percentage-of-window field for the **main session**, on any event. The `Agent` exception is subagent-scoped and single-request-scoped, and the page says outright it "isn't a total across the whole run". It is absent entirely for background subagents. `effort` is a reasoning-effort level, not consumption | | Status line stdin | | Top-level `version`, plus the whole `context_window` object: `total_input_tokens`, `total_output_tokens`, `context_window_size`, `used_percentage`, `remaining_percentage`, `current_usage` | Nothing this plugin needs. It was the one sufficient channel before mods, and it exists only where a `statusLine` is configured *and* the environment runs it | | `subagentStatusLine` stdin | | A `tasks` array whose entries carry `tokenCount` and `contextWindowSize` per subagent row | Any figure for the **main session**. It describes subagent rows in the agent panel, and it is a status-line-family surface, so it is absent wherever the status line is | @@ -128,7 +131,8 @@ a session therefore yields the current main-thread occupancy, the same three inp statusline page names as the `used_percentage` formula (, read 2026-08-21): "`input_tokens + cache_creation_input_tokens + cache_read_input_tokens`". This channel really does supply live, -per-session occupancy for a running interactive session. +per-session occupancy for a running interactive session. Recheck when the monitoring-usage events +table drops those token fields or the statusline page changes the `used_percentage` formula. Two disqualifiers hold anyway, and both were measured rather than assumed. diff --git a/plugins/context-guard/reference/reader-contract.md b/plugins/context-guard/reference/reader-contract.md index 0fe0f38ef4..c98ee2bf2a 100644 --- a/plugins/context-guard/reference/reader-contract.md +++ b/plugins/context-guard/reference/reader-contract.md @@ -461,7 +461,8 @@ is not this plugin's guidance: unattended cloud and autonomous sessions have no boundary, and for them a degraded continuation beats a hard stall at the window. The shipped ladder is instrumentation, not prohibition: observable zones, then advisory injection, then an opt-in blocking gate with a grace budget, with auto-compact remaining the last-resort safety net beneath -all of it (as-of 2026-08-17). +all of it (as-of 2026-08-17; recheck when Claude Code removes the auto-compact setting or changes +what it does at the window). **On folklore numbers.** The auto-compact window figure in the vendored Boris playbook, §64, is a widely-cited practitioner anchor. We record it as a **named anchor, never an adopted number**: its diff --git a/plugins/desktop-notification/.claude-plugin/plugin.json b/plugins/desktop-notification/.claude-plugin/plugin.json index 7837081792..b1149faf67 100644 --- a/plugins/desktop-notification/.claude-plugin/plugin.json +++ b/plugins/desktop-notification/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "desktop-notification", - "version": "0.8.10", + "version": "0.8.11", "description": "Alert you when Claude Code needs input: an audible terminal bell, an OSC 9 terminal notification, and an OS-native toast (macOS/Linux) on permission and idle prompts.", "author": { "name": "Melodic Software", diff --git a/plugins/desktop-notification/CHANGELOG.md b/plugins/desktop-notification/CHANGELOG.md index d9d08c8349..6b4ded6b1b 100644 --- a/plugins/desktop-notification/CHANGELOG.md +++ b/plugins/desktop-notification/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `desktop-notification` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.8.11] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.8.10] - 2026-10-07 ### Changed diff --git a/plugins/desktop-notification/README.md b/plugins/desktop-notification/README.md index aa1454283c..0f353f63a3 100644 --- a/plugins/desktop-notification/README.md +++ b/plugins/desktop-notification/README.md @@ -21,7 +21,9 @@ notification, and, on macOS and Linux, an OS-native desktop toast. Platform facts verified 2026-07-18: hook `terminalSequence` output landed in Claude Code v2.1.141 per the [Claude Code changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md); -channel semantics per the [hooks reference](https://code.claude.com/docs/en/hooks). +channel semantics per the [hooks reference](https://code.claude.com/docs/en/hooks). Recheck when +the hooks reference changes how `terminalSequence` output is written or documents a Windows toast +path. ### Per-OS `os_toast` behavior diff --git a/plugins/desktop-notification/hooks/hook-utils.sh b/plugins/desktop-notification/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/desktop-notification/hooks/hook-utils.sh +++ b/plugins/desktop-notification/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/discipline/.claude-plugin/plugin.json b/plugins/discipline/.claude-plugin/plugin.json index 2e3f9e7417..37afd7b3a7 100644 --- a/plugins/discipline/.claude-plugin/plugin.json +++ b/plugins/discipline/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "discipline", - "version": "0.17.1", + "version": "0.17.2", "description": "Correctors that re-anchor a rule, audit work in flight, and fix drift: do-your-research (and -deep), follow-our-standards, point-dont-copy, reason-dont-recite, tighten-your-output, recheck-against-upstream (and -deep), pick-for-the-problem, mind-your-maxims, script-the-deterministic-work, use-your-skills, reuse-or-replace, scrutinize-dont-coast. sweep-all runs them as one batch. wait-what re-pitches a message that did not land. hold-my-hand shows work one phase at a time.", "author": { "name": "Melodic Software", diff --git a/plugins/discipline/CHANGELOG.md b/plugins/discipline/CHANGELOG.md index 89111533e0..8640d37951 100644 --- a/plugins/discipline/CHANGELOG.md +++ b/plugins/discipline/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to the `discipline` plugin are documented here. Format follo Entries below `0.9.0` were released under the plugin's former name, `re-anchor`. +## [0.17.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.17.1] - 2026-10-07 ### Changed diff --git a/plugins/disk-hygiene/README.md b/plugins/disk-hygiene/README.md index d2e9645817..70f90579a5 100644 --- a/plugins/disk-hygiene/README.md +++ b/plugins/disk-hygiene/README.md @@ -126,7 +126,7 @@ switch and data-root authority; and the skill-scoped **belt** inside the `clean` which adds the deny-by-default Bash and deletion-spelling PowerShell discipline during active cleanup work. Both surfaces resolve the kill switch by reading `disk_hygiene_enabled` from user-scope `pluginConfigs` in `settings.json` (located from `${CLAUDE_PLUGIN_ROOT}`, honored only -from user/managed/`--settings` scope since Claude Code 2.1.207, so a repo cannot forge it), register +from user/managed scope since Claude Code 2.1.207, so a repo cannot forge it), register unconditionally, and fail closed to enabled. Hook lifetime: the hooks page says Claude Code registers a skill's frontmatter hooks when the skill is @@ -429,13 +429,15 @@ measurements below carry the conditions they were taken under. `pluginConfigs` in `settings.json` (not the process environment). A configured `false` denies Bash engine invocations outright on the always-on engine gate (whether or not the clean skill is active); PowerShell deletion spellings are denied outright by the skill-scoped belt while `/disk-hygiene:clean` - is active (the always-on gate defers on non-engine commands). The read is honored only from user, managed, and - `--settings` scope (Claude Code 2.1.207+), so a project or local repo `settings.json` cannot flip + is active (the always-on gate defers on non-engine commands). The read is honored only from user and managed + scope (Claude Code 2.1.207+), so a project or local repo `settings.json` cannot flip it; the user file is located from `${CLAUDE_PLUGIN_ROOT}`, not from repo-redirectable environment, and the managed (enterprise) file at its fixed system path wins as the highest-precedence scope so an org can enforce audit-only (the sibling `managed-settings.d/` drop-in directory is merged over it). An absent - or unreadable value fails closed to enabled. The one residual a hook cannot read is a value supplied only - via a session `--settings` file. The skill's own kill-switch probe + skill-content value remain a + or unreadable value fails closed to enabled. A value supplied only via a session `--settings` file is not + read by a hook, and whether `pluginConfigs` honors that flag is unverified since the entry stopped naming + it (as of 2026-10-07; recheck when the [pluginConfigs entry](https://code.claude.com/docs/en/settings-reference#pluginconfigs) + names `--settings` again or a probe shows a `--settings` value read or ignored). The skill's own kill-switch probe + skill-content value remain a defense-in-depth honoring layer over the guard. - **Trust-surface record:** the plugin-level `hooks/hooks.json` PreToolUse registration is a NEW trust surface (a hook that launches in every consumer session), added @@ -558,7 +560,8 @@ credential, dependency, or MCP surface reopens this review. ## Sources -Verified 2026-07-16 against current primary documentation: +Verified 2026-07-16 against current primary documentation. Recheck when the plugin loading page +changes `--plugin-dir` behavior or the hooks page changes the `PreToolUse` decision output: - [Create plugins](https://code.claude.com/docs/en/plugins/create) and [plugin manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference) and diff --git a/plugins/disk-hygiene/lib/killswitch_config.py b/plugins/disk-hygiene/lib/killswitch_config.py index b8ccae1fce..3987771c0c 100644 --- a/plugins/disk-hygiene/lib/killswitch_config.py +++ b/plugins/disk-hygiene/lib/killswitch_config.py @@ -2,10 +2,12 @@ Claude Code stores merged plugin options under ``pluginConfigs[].options`` in the user ``settings.json`` and, since -v2.1.207, reads that key back from user settings, the ``--settings`` flag, and -managed settings only — entries in a project's ``.claude/settings.json`` or -``.claude/settings.local.json`` are ignored -(https://code.claude.com/docs/en/settings-reference#pluginconfigs). That +v2.1.207, reads that key back from user and managed settings only — entries in +a project's ``.claude/settings.json`` or ``.claude/settings.local.json`` are +ignored (https://code.claude.com/docs/en/settings-reference#pluginconfigs). +``--settings`` is unverified since that entry stopped naming it (as of +2026-10-07; recheck when the pluginConfigs entry names ``--settings`` again or +a probe shows a ``--settings`` value read or ignored). That makes the user settings file the one repo-tamper-resistant channel for a safety toggle, so both the report-only ``kill_switch_probe`` and the destructive-action guard resolve the switch by reading it here rather than @@ -62,9 +64,10 @@ def managed_settings_path() -> Path | None: the tamper-resistance. The sibling ``managed-settings.d/`` drop-in directory is also read (see - ``_managed_settings_files``). The one honored source a hook cannot read is a - session's ``--settings`` file — a runtime CLI flag no hook observes — so a - value supplied only there is not enforced by the guard. + ``_managed_settings_files``). A session's ``--settings`` file is a runtime + CLI flag no hook observes, so a value supplied only there is not enforced by + the guard; whether ``pluginConfigs`` honors that flag is unverified (see the + module docstring). """ if sys.platform == "darwin": return Path("/Library/Application Support/ClaudeCode/managed-settings.json") @@ -125,8 +128,9 @@ def _report( # marks the read itself as degraded. _NOT_CONFIGURED_THERE = ( "the toggle is not configured there and the plugin default (enabled) " - "applies. Managed settings or a --settings flag could still carry a value " - "this probe cannot see." + "applies. Managed settings, or a --settings flag (unverified since " + "pluginConfigs stopped naming it), could still carry a value this probe " + "cannot see." ) _ASSUMED_DEFAULT = ( "assuming the default (enabled). This is an assumption, not the configured value." diff --git a/plugins/disk-hygiene/skills/clean/reference/safety-model.md b/plugins/disk-hygiene/skills/clean/reference/safety-model.md index e241a28b15..1fb7085efe 100644 --- a/plugins/disk-hygiene/skills/clean/reference/safety-model.md +++ b/plugins/disk-hygiene/skills/clean/reference/safety-model.md @@ -549,14 +549,16 @@ and both resolve `disk_hygiene_enabled` the same single way: by reading it from `pluginConfigs` in the `settings.json` files, through the shared `lib/killswitch_config.py` reader (the same read the setup skill's `kill_switch_probe.py` reports). Neither surface takes the value from the process environment. -Claude Code honors that key only from user, managed, and `--settings` scope since 2.1.207, and a project or +Claude Code honors that key only from user and managed scope since 2.1.207, and a project or local `.claude/settings.json` is ignored, so a hostile repo cannot flip it. That scoping is verified 2026-09-06 against Claude Code 2.1.263 and the plugins reference, whose statement now lives at -`https://code.claude.com/docs/en/settings-reference#pluginconfigs`, which states that Claude Code reads all -`pluginConfigs` values from only user settings, `--settings`, and managed settings, that entries in a +`https://code.claude.com/docs/en/settings-reference#pluginconfigs`, which (read 2026-10-07, Claude Code +2.1.292) gives `pluginConfigs` the scope "User or managed", states that entries in a project's `.claude/settings.json` or `.claude/settings.local.json` are ignored, and that those entries -were read before v2.1.207. Recheck when that page stops carrying the ignored-project-scope statement, or -when a release note names `pluginConfigs` scope. The **user** file is located +were read before v2.1.207. `--settings` is unverified since the entry stopped naming it (as of 2026-10-07; +recheck when the pluginConfigs entry names `--settings` again or a probe shows a `--settings` value read or +ignored; hook-config-delivery fact 5). Recheck when that page stops carrying the ignored-project-scope +statement, or when a release note names `pluginConfigs` scope. The **user** file is located from `${CLAUDE_PLUGIN_ROOT}` (the plugin's true install path, which a repo cannot forge): the `plugins/cache` layout's sibling `settings.json`, or for a local-directory marketplace install `/settings.json` under the account-record config dir above. It is **never** located @@ -568,8 +570,8 @@ closed to enabled otherwise. The **managed** (enterprise) file at its fixed root-owned system path is read too and, as the highest-precedence non-overridable scope, an explicitly configured value there **wins over the user file**, so an organization can enforce audit-only mode; the sibling `managed-settings.d/` drop-in directory is merged -over it (later files win). The one honored source the guard cannot read is a session's `--settings` file -(a runtime CLI flag no hook observes); a value supplied only there is not enforced. When the value +over it (later files win). A session's `--settings` file (a runtime CLI flag no hook observes) is not read +by the guard, and whether `pluginConfigs` honors it is unverified (see above); a value supplied only there is not enforced. When the value resolves `false` (audit-only mode), `false` is guard-enforced as an outright deny with no prompt fallback, but the two surfaces reach different lanes. The **always-on engine gate** enforces it against every Bash engine invocation **whether or not the clean skill is active**; it defers (no output) on any command that @@ -989,7 +991,8 @@ shipped lane has not run end to end; treat that part as documented intent, not o ## Primary references -Verified 2026-07-16: [Claude skills](https://code.claude.com/docs/en/skills), +Verified 2026-07-16 (recheck when the hooks page changes the `PreToolUse` decision output or the +skills page changes skill-scoped hooks): [Claude skills](https://code.claude.com/docs/en/skills), [PreToolUse hooks](https://code.claude.com/docs/en/hooks), [GNU Bash shell expansions](https://www.gnu.org/software/bash/manual/html_node/Shell-Expansions.html), [Python 3.11 `os`](https://docs.python.org/3.11/library/os.html), diff --git a/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py b/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py index fb3b0257d8..b1dad69298 100755 --- a/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py +++ b/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py @@ -9,7 +9,8 @@ exit code 1 as a non-blocking error and proceeds with the action... If your hook is meant to enforce a policy, use exit 2") — every internal failure path that could once fall through to the interpreter's default (uncaught exception --> exit 1, no diagnostic) now denies instead (#1423). +-> exit 1, no diagnostic) now denies instead (#1423). Recheck when the hooks reference states that a +PreToolUse exit code 1 blocks the action. Investigation note for the one observed #1423 occurrence (engine-gate mode, ``exitCode: 1``, empty stderr, ``durationMs: 17054``, Windows, no reproduction): @@ -1279,14 +1280,15 @@ def resolve_disk_hygiene_enabled() -> bool: prevent every deletion lane. The guard reads ``disk_hygiene_enabled`` straight out of the ``settings.json`` files (``lib/killswitch_config.py``, the single reader it shares with the report-only probe) — never the process environment. - Since Claude Code 2.1.207 that key is honored only from user, managed, and - ``--settings`` scope, never a project or local ``settings.json`` + Since Claude Code 2.1.207 that key is honored only from user and managed + scope, never a project or local ``settings.json`` (plugins-reference, "User configuration"), so a hostile repo cannot flip the switch. Managed settings are the highest-precedence, non-overridable scope, so a value configured there wins over the user file — that is how an organization enforces audit-only mode. The ``--settings`` file is a session CLI flag a hook - cannot observe, the one honored source not read here (see - ``killswitch_config.managed_settings_path`` for the full residual list). The + cannot observe, so it is not read here; whether pluginConfigs honors it is + unverified since the settings reference stopped naming it (as of 2026-10-07; + see ``killswitch_config.managed_settings_path`` for the full residual list). The environment is rejected on purpose: a repo ``settings.json`` ``env`` block reaches hook subprocesses and carries no provenance a hook could check, so an env-borne toggle (or an env-borne user-settings path) would reopen the hole @@ -1943,7 +1945,8 @@ def _powershell_mutation_word_text(command: str) -> str: # .Name` in turn only "Contains the verb's name" # (https://learn.microsoft.com/en-us/windows/win32/shell/folderitemverb-name, # fetched 2026-08-16) — so a verb named anything other than the enumerated -# spellings below (a localized name, for instance) is NOT covered. +# spellings below (a localized name, for instance) is NOT covered. Recheck when +# either page documents a fixed verb-name set for `InvokeVerb`. # # Deliberately outside this rule, each still deferring: # - `MoveHere` into an ordinary (non-bin) folder — that is a MOVE, not a diff --git a/plugins/disk-hygiene/skills/clean/scripts/hygiene.py b/plugins/disk-hygiene/skills/clean/scripts/hygiene.py index 26ddb271b4..5fbb95ed47 100755 --- a/plugins/disk-hygiene/skills/clean/scripts/hygiene.py +++ b/plugins/disk-hygiene/skills/clean/scripts/hygiene.py @@ -92,7 +92,9 @@ # including it protected ordinary local files: a sweep of two non-cloud trees on # this host flagged .NET build output and temp .node files that are fully # present on disk. Protecting build artifacts from cleanup would defeat the -# engine's purpose, so the ambiguous bit stays out. +# engine's purpose, so the ambiguous bit stays out. Recheck when the +# file-attribute-constants page changes the 0x00040000 value of RECALL_ON_OPEN +# or documents it for non-enumeration reads. FILE_ATTRIBUTE_OFFLINE = 0x00001000 FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS = 0x00400000 FILE_ATTRIBUTE_SPARSE_FILE = 0x00000200 diff --git a/plugins/disk-hygiene/skills/setup/SKILL.md b/plugins/disk-hygiene/skills/setup/SKILL.md index ccef4c1d8a..c19dd54f54 100644 --- a/plugins/disk-hygiene/skills/setup/SKILL.md +++ b/plugins/disk-hygiene/skills/setup/SKILL.md @@ -167,8 +167,9 @@ fails closed like every other guard-relevant unknown in this plugin. and that default `true` is being assumed, an assumption, never the configured value. The body token `${user_config.disk_hygiene_enabled}` is at most a cross-check: if it expanded to a boolean that contradicts the probe, report the discrepancy instead of silently - preferring either channel (the probe sees user settings only; managed settings or a - `--settings` flag can carry a value the probe cannot see). + preferring either channel (the probe sees user settings only; managed settings can carry + a value the probe cannot see, and so might a `--settings` flag, which is unverified since + the pluginConfigs entry stopped naming it as of 2026-10-07). 6. **Plugin registration**. INFO: confirm the plugin is enabled for this project (`/plugin` → Installed) rather than parsing settings files. diff --git a/plugins/disk-hygiene/skills/setup/scripts/kill_switch_probe.py b/plugins/disk-hygiene/skills/setup/scripts/kill_switch_probe.py index d3a26acabf..cef758485e 100755 --- a/plugins/disk-hygiene/skills/setup/scripts/kill_switch_probe.py +++ b/plugins/disk-hygiene/skills/setup/scripts/kill_switch_probe.py @@ -18,7 +18,8 @@ whole contract. This report is how the ``clean`` skill self-enforces audit-only mode when a body token arrives unexpanded. -Scope: managed settings and a ``--settings`` flag can also carry +Scope: managed settings, and possibly a ``--settings`` flag (unverified since +the pluginConfigs entry stopped naming it, as of 2026-10-07), can also carry ``pluginConfigs`` and are not visible here; the ``detail`` sentence states the path actually probed so the reader can judge the claim. diff --git a/plugins/docs-hygiene/.claude-plugin/plugin.json b/plugins/docs-hygiene/.claude-plugin/plugin.json index e704abe054..adf2307fe9 100644 --- a/plugins/docs-hygiene/.claude-plugin/plugin.json +++ b/plugins/docs-hygiene/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "docs-hygiene", - "version": "0.27.0", + "version": "0.27.1", "description": "Documentation-hygiene toolkit: compress (trim markdown with a semantic-diff check), audit-noise (classify markdown noise), extract-ssot (deduplicate into a single source of truth), audit-encapsulation (citations into skill-private files), rename-references (stale references after renames), audit-derivability (does a doc earn its existence), audit-progressive-disclosure (load tiers), write-for-agents and write-for-humans (authoring). Setup checks markdownlint-cli2.", "author": { "name": "Melodic Software", diff --git a/plugins/docs-hygiene/CHANGELOG.md b/plugins/docs-hygiene/CHANGELOG.md index 952587a92f..c6f6b00700 100644 --- a/plugins/docs-hygiene/CHANGELOG.md +++ b/plugins/docs-hygiene/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog: docs-hygiene plugin +## [0.27.1] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.27.0] - 2026-10-07 ### Added diff --git a/plugins/docs-hygiene/skills/audit-noise/SKILL.md b/plugins/docs-hygiene/skills/audit-noise/SKILL.md index d6893989ea..09f58c9cfb 100644 --- a/plugins/docs-hygiene/skills/audit-noise/SKILL.md +++ b/plugins/docs-hygiene/skills/audit-noise/SKILL.md @@ -236,5 +236,5 @@ Total: file(s) audited, Tier 1, Tier 2, Tier 3 findings. ## Sources - [Diataxis Explanation](https://diataxis.fr/explanation/), the Diataxis classifier behind the preamble treatment -- [Claude 4 best practices](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-4-best-practices), source of the negation rule's worked example ("Do not use markdown" rewritten to the positive form), read 2026-08-31 +- [Claude 4 best practices](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-4-best-practices), source of the negation rule's worked example ("Do not use markdown" rewritten to the positive form), read 2026-08-31; recheck when that page drops or rewords the example - [markdownlint configuration](https://github.com/DavidAnson/markdownlint?tab=readme-ov-file#configuration), opt-out marker HTML-comment form precedent diff --git a/plugins/docs-hygiene/skills/extract-ssot/context/anti-patterns.md b/plugins/docs-hygiene/skills/extract-ssot/context/anti-patterns.md index e6d4fa2c2e..d957346561 100644 --- a/plugins/docs-hygiene/skills/extract-ssot/context/anti-patterns.md +++ b/plugins/docs-hygiene/skills/extract-ssot/context/anti-patterns.md @@ -140,7 +140,7 @@ Patterns are framed for markdown extraction (the dominant case) but apply to cod **Pattern.** Extraction moves content into an always-loaded file that then gets edited often. The always-loaded files here are `CLAUDE.md` and unscoped `.claude/rules/` files. A rule with `paths:` frontmatter loads lazily instead, so an edit before it loads does take effect. Sessions already running never see the edits: those files are read once at session start, and a mid-session edit neither applies nor invalidates the cache. The new content loads on the next `/clear`, `/compact`, or restart. A correction lands in the repo while every live consumer keeps following the superseded version. -**Scope fence: Claude Code sessions, and the cost is propagation, not caching.** A mid-session edit to an always-loaded file keeps the cached prefix, and sequential sessions in a directory share a prefix only when the startup git-status snapshot matches, which captures branch and recent commits, so committing the edit breaks sharing exactly as any other commit does, and SSOT edit frequency is not a distinct driver of cache misses ([editing CLAUDE.md mid-session](https://code.claude.com/docs/en/prompt-caching#editing-claude-md-mid-session), [cache scope](https://code.claude.com/docs/en/prompt-caching#cache-scope), verified 2026-08-04). On the API surface a volatility cost is real, because cache hits there require byte-identical prefix segments. That reaches an Agent SDK fleet assembling one shared prefix across machines, not the tracked-markdown extractions this skill scopes to ([cache storage and sharing](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#cache-storage-and-sharing), verified 2026-08-04). +**Scope fence: Claude Code sessions, and the cost is propagation, not caching.** A mid-session edit to an always-loaded file keeps the cached prefix, and sequential sessions in a directory share a prefix only when the startup git-status snapshot matches, which captures branch and recent commits, so committing the edit breaks sharing exactly as any other commit does, and SSOT edit frequency is not a distinct driver of cache misses ([editing CLAUDE.md mid-session](https://code.claude.com/docs/en/prompt-caching#editing-claude-md-mid-session), [cache scope](https://code.claude.com/docs/en/prompt-caching#cache-scope), verified 2026-08-04). On the API surface a volatility cost is real, because cache hits there require byte-identical prefix segments. That reaches an Agent SDK fleet assembling one shared prefix across machines, not the tracked-markdown extractions this skill scopes to ([cache storage and sharing](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#cache-storage-and-sharing), verified 2026-08-04). Recheck when the prompt-caching page changes how a mid-session CLAUDE.md edit affects the cached prefix, or when the cache-scope section stops keying sharing on the startup git-status snapshot. **Symptom.** A rule corrected hours ago is still being violated by long-running sessions; two concurrent sessions in the same repo follow different versions of the same extracted rule. diff --git a/plugins/docs-hygiene/skills/extract-ssot/context/decision-framework.md b/plugins/docs-hygiene/skills/extract-ssot/context/decision-framework.md index 1a5ee63c32..c0199e679e 100644 --- a/plugins/docs-hygiene/skills/extract-ssot/context/decision-framework.md +++ b/plugins/docs-hygiene/skills/extract-ssot/context/decision-framework.md @@ -61,7 +61,7 @@ Two constraints keep the rule-of-one default honest: |---|------|-----|----------| | 1 | **Rule of Three**: duplication appears in 3+ places | Premature abstraction creates the wrong-abstraction trap; 1-2 instances are usually coincidence, not pattern, and when they are not, the N=1 / N=2 buckets remedy them in place instead of minting an artifact. Same principle whether the duplicated unit is a markdown heading, a string constant, a helper function, or a CI step | Don Roberts / Fowler *Refactoring* §1; Sandi Metz "The Wrong Abstraction" | | 2 | **Namable as a stable canonical unit**: the cluster has an identity that can be given one name and referenced by that name | For markdown: a heading or rule name. For code: a function/constant/type identifier. For config: an anchor/include/`$ref` target. Without a stable name, callers can't cite/import unambiguously and the SSOT becomes a grab-bag. For markdown specifically, the unit should also be categorical (vocabulary, constraints, IF-THEN) rather than nuanced reasoning. MDEval finding: providing an external markdown reference does NOT improve a model's Markdown Awareness vs well-designed inline rules ("feeding a reference to an LLM does not bring any benefit for Markdown Awareness; this unexpected finding challenges prevalent assumptions") | Anthropic best-practices "Avoid offering too many options"; MDEval arxiv 2501.15000; Endor Labs anti-pattern avoidance. See "The external-evidence records" below | -| 3 | **Stable**: content does NOT change more than 1×/quarter | High churn drives heading/identifier rename frequency, which compounds the citation-rot risk captured in test #6 below; and every edit to an always-loaded file reaches sessions already running only at the next `/clear`, `/compact`, or restart, so a volatile SSOT ships corrections its live consumers do not see (anti-pattern #9). Not a caching cost: a mid-session edit to an always-loaded file keeps the cached prefix. Code-side equivalent: high churn means callers chase signature changes constantly | Claude Code prompt caching, [editing CLAUDE.md mid-session](https://code.claude.com/docs/en/prompt-caching#editing-claude-md-mid-session) (verified 2026-08-04); Sandi Metz wrong-abstraction (volatile = signal that the abstraction shape is not yet stable) | +| 3 | **Stable**: content does NOT change more than 1×/quarter | High churn drives heading/identifier rename frequency, which compounds the citation-rot risk captured in test #6 below; and every edit to an always-loaded file reaches sessions already running only at the next `/clear`, `/compact`, or restart, so a volatile SSOT ships corrections its live consumers do not see (anti-pattern #9). Not a caching cost: a mid-session edit to an always-loaded file keeps the cached prefix. Code-side equivalent: high churn means callers chase signature changes constantly | Claude Code prompt caching, [editing CLAUDE.md mid-session](https://code.claude.com/docs/en/prompt-caching#editing-claude-md-mid-session) (verified 2026-08-04; recheck when that section changes how a mid-session CLAUDE.md edit affects the cached prefix); Sandi Metz wrong-abstraction (volatile = signal that the abstraction shape is not yet stable) | | 4 | **Self-contained**: content has no implicit dependency on caller context | Leaky abstraction = silent failure. For markdown: the extracted block must not say "the prior step" or "as discussed earlier". For code: the helper must not depend on global state the caller happens to set. For config: the include must not reference variables the includer happens to define | Joel Spolsky "Law of Leaky Abstractions"; elements.cloud agent-instruction antipatterns | | 5 | **Bounded size**: extracted markdown file within the line cap `/playbooks:skill-authoring` `## Body` records (`/skill-quality:check` enforces it on skills); extracted code module sized per language idiom | Over-long files force partial reads and downstream-session cache pressure. For code: each language has its own conventions (small composable modules over monoliths) | `/playbooks:skill-authoring` `## Body` (owns the cap and its upstream record); GitHub Copilot 4000-char hard truncation | | 6 | **One level deep**: referenced directly from caller, never via another reference | Markdown: A.md → B.md → C.md chains compound failure rates (5-20% per step). Code/config: the equivalent rule is no transitive re-export chains; the call site imports/cites the canonical SSOT directly | `/playbooks:skill-authoring` `## Reference files` (owns the depth rule and its upstream record) | diff --git a/plugins/dometrain-mcp/.claude-plugin/plugin.json b/plugins/dometrain-mcp/.claude-plugin/plugin.json index e8deeda120..e90693fc36 100644 --- a/plugins/dometrain-mcp/.claude-plugin/plugin.json +++ b/plugins/dometrain-mcp/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "dometrain-mcp", - "version": "0.1.4", + "version": "0.1.5", "description": "Bundled Dometrain MCP server (Dometrain-hosted remote HTTP, Bearer auth) for the dometrain grounding skills: search lessons, pull curated lesson documents with on-screen code, and get timestamped deep links. Requires an active Dometrain Pro subscription. Credential entered once through Claude Code's native masked userConfig prompt and stored in secure credential storage. Skip this plugin when you configure your own user-scope dometrain server.", "author": { "name": "Melodic Software", diff --git a/plugins/dometrain-mcp/CHANGELOG.md b/plugins/dometrain-mcp/CHANGELOG.md index be79876b3d..bdd018ba74 100644 --- a/plugins/dometrain-mcp/CHANGELOG.md +++ b/plugins/dometrain-mcp/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `dometrain-mcp` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.1.5] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.1.4] - 2026-10-07 ### Changed diff --git a/plugins/education/.claude-plugin/plugin.json b/plugins/education/.claude-plugin/plugin.json index 2ab4658e26..46d7a0eec7 100644 --- a/plugins/education/.claude-plugin/plugin.json +++ b/plugins/education/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "education", - "version": "0.14.4", + "version": "0.14.5", "description": "Learning tools. teach is a multi-session coach for a general subject or a repo-grounded concept through the Knowledge-Skills-Wisdom progression, with persistent per-topic state, and also a single-session domain primer. explain is a one-shot plain-language explainer. illustrate explains a concept or codebase topic as diagrams: a markdown record plus an interactive page. quiz-me checks your comprehension of a completed change. setup validates the plugin's configuration.", "author": { "name": "Melodic Software", diff --git a/plugins/education/CHANGELOG.md b/plugins/education/CHANGELOG.md index 62f049897e..25768b986e 100644 --- a/plugins/education/CHANGELOG.md +++ b/plugins/education/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `education` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.14.5] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.14.4] - 2026-10-07 ### Changed diff --git a/plugins/eol-normalizer/.claude-plugin/plugin.json b/plugins/eol-normalizer/.claude-plugin/plugin.json index e38a1323d1..4e58003eff 100644 --- a/plugins/eol-normalizer/.claude-plugin/plugin.json +++ b/plugins/eol-normalizer/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "eol-normalizer", - "version": "0.9.10", + "version": "0.9.11", "description": "Normalize a written file's working-tree line endings to its .gitattributes eol value on edit: symmetric CRLF/LF driven by git check-attr, advisory and never blocking.", "author": { "name": "Melodic Software", diff --git a/plugins/eol-normalizer/CHANGELOG.md b/plugins/eol-normalizer/CHANGELOG.md index e6542958ab..ec2a779131 100644 --- a/plugins/eol-normalizer/CHANGELOG.md +++ b/plugins/eol-normalizer/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `eol-normalizer` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.9.11] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.9.10] - 2026-10-07 ### Changed diff --git a/plugins/eol-normalizer/hooks/hook-utils.sh b/plugins/eol-normalizer/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/eol-normalizer/hooks/hook-utils.sh +++ b/plugins/eol-normalizer/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/evals/.claude-plugin/plugin.json b/plugins/evals/.claude-plugin/plugin.json index ca0b3f5538..f10476c500 100644 --- a/plugins/evals/.claude-plugin/plugin.json +++ b/plugins/evals/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "evals", - "version": "0.6.3", + "version": "0.6.4", "description": "LLM evaluation methodology and eval-suite design, based on Anthropic's evaluation guidance. /evals:methodology answers questions on success criteria, eval design, and grading. /evals:design interviews for measurable success criteria and scaffolds a graded eval suite for an LLM app or Claude Code skill. /evals:plugin-eval preflights the CLI and target, prices a suite before running, and reads the with-versus-without delta. /evals:validate checks case files with no model call.", "author": { "name": "Melodic Software", diff --git a/plugins/evals/CHANGELOG.md b/plugins/evals/CHANGELOG.md index f6acc48223..17bae41adf 100644 --- a/plugins/evals/CHANGELOG.md +++ b/plugins/evals/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog: evals +## [0.6.4] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.6.3] - 2026-10-07 ### Changed diff --git a/plugins/explainer-video/.claude-plugin/plugin.json b/plugins/explainer-video/.claude-plugin/plugin.json index 421dffee29..90d528c933 100644 --- a/plugins/explainer-video/.claude-plugin/plugin.json +++ b/plugins/explainer-video/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "explainer-video", - "version": "0.2.9", + "version": "0.2.10", "description": "Short explainer videos made with ManimCE, narrated when the speech plugin is installed and silent otherwise. The produce skill plans the beats, writes one scene script whose scene changes follow the narration's word timings, renders at low quality first, muxes narration and captions with ffmpeg, and checks every render with ffprobe and a frame read-back. A SessionStart hook installs the hash-locked Python packages; the check skill reports readiness.", "author": { "name": "Melodic Software", diff --git a/plugins/explainer-video/CHANGELOG.md b/plugins/explainer-video/CHANGELOG.md index 93081d869e..75fd50ae60 100644 --- a/plugins/explainer-video/CHANGELOG.md +++ b/plugins/explainer-video/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `explainer-video` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.2.10] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.2.9] - 2026-10-04 ### Changed diff --git a/plugins/explainer-video/hooks/hook-utils.sh b/plugins/explainer-video/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/explainer-video/hooks/hook-utils.sh +++ b/plugins/explainer-video/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/gaming/.claude-plugin/plugin.json b/plugins/gaming/.claude-plugin/plugin.json index 46d23fd8df..bed3eaee70 100644 --- a/plugins/gaming/.claude-plugin/plugin.json +++ b/plugins/gaming/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "gaming", - "version": "0.10.5", + "version": "0.10.6", "description": "Apply, track, tune, and remove the community DLSS 5 Neural Rendering mod (OptiScaler forks) in Windows PC games from Steam, Epic, EA app, Battle.net, GOG, Ubisoft Connect, and Xbox (gaming:dlss5). Anti-cheat checks refuse unless you type an at-your-own-risk acknowledgement. Snapshots allow byte-exact removal; a ledger and upstream watch track fork and driver releases. Ships no NVIDIA binary: the DLL comes from a path, an installed DLSS 5 title, or a configured source.", "author": { "name": "Melodic Software", diff --git a/plugins/gaming/CHANGELOG.md b/plugins/gaming/CHANGELOG.md index de084dcd04..e97f553a83 100644 --- a/plugins/gaming/CHANGELOG.md +++ b/plugins/gaming/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `gaming` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.10.6] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.10.5] - 2026-10-07 ### Changed diff --git a/plugins/github/.claude-plugin/plugin.json b/plugins/github/.claude-plugin/plugin.json index 8c16d5615c..ca0d8fa041 100644 --- a/plugins/github/.claude-plugin/plugin.json +++ b/plugins/github/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "github", - "version": "0.3.31", + "version": "0.3.32", "description": "GitHub admin-plane audit, advice, and guided setup over the authenticated user's own gh CLI: billing and cost control, security posture, rulesets and settings drift, Actions policy, and every other org/repo/enterprise settings area. Grounded in live state and current official GitHub docs (zero vendored knowledge); read-only by default, every mutation user-in-loop.", "author": { "name": "Melodic Software", diff --git a/plugins/github/CHANGELOG.md b/plugins/github/CHANGELOG.md index bf4f89408d..407bbe3a0d 100644 --- a/plugins/github/CHANGELOG.md +++ b/plugins/github/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `github` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.3.32] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.3.31] - 2026-10-07 ### Changed diff --git a/plugins/github/reference/areas.md b/plugins/github/reference/areas.md index 2b3fb515e6..9d342e3215 100644 --- a/plugins/github/reference/areas.md +++ b/plugins/github/reference/areas.md @@ -9,7 +9,8 @@ verb skills, never skills of their own. Routing rules: - The **doc pointer** is a stable entry hub on `docs.github.com`, not the answer: resolve the exact current page live from that hub (or the site's own search) and pass it through the method ladder's fetch-integrity check before grounding on it. Hubs verified live 2026-07-20; - if one 404s, resolve via the live docs search instead. + recheck when a hub 404s or stops covering its area, and until then resolve via the live docs + search instead. - **Primary**-tier areas get the deepest treatment: a dedicated method recipe under [`recipes/`](recipes/), linked from the row's tier cell. Consult it before auditing that area. Every other area rides the generic method ladder with this row as its entry intent. @@ -21,7 +22,7 @@ verb skills, never skills of their own. Routing rules: | `billing` | primary ([recipe](recipes/billing.md)) | Billing and licensing: monitoring, budgets, alerts, usage, cost control | | | `security-model` | standard | Organization security model: org/repo roles, member privileges, base permissions | | | `codespaces` | standard | Codespaces: org policies, machine types, spending, access | | -| `cloud-sandboxes` | standard | Cloud sandboxes for agents: availability, policy, spend (no stable docs hub verified 2026-07-20, so resolve live via docs search) | | +| `cloud-sandboxes` | standard | Cloud sandboxes for agents: availability, policy, spend (no stable docs hub verified 2026-07-20, so resolve live via docs search; recheck when docs.github.com gains a cloud-sandboxes hub) | | | `projects-and-issues` | standard | Projects, issue types, issue fields, and templates: planning-surface configuration | | | `actions` | primary ([recipe](recipes/actions-policy.md)) | Actions policy: allowed actions/workflows, runners, runner groups, custom images, caches, OIDC | | | `webhooks` | standard | Webhooks: org/repo hooks, delivery health, secret hygiene, dead endpoints | | diff --git a/plugins/go-format/.claude-plugin/plugin.json b/plugins/go-format/.claude-plugin/plugin.json index 24d90322e9..8344a4a511 100644 --- a/plugins/go-format/.claude-plugin/plugin.json +++ b/plugins/go-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "go-format", - "version": "0.5.10", + "version": "0.5.11", "description": "Auto-fix Go formatting and import management on edit via goimports. Runs unconditionally (no consumer-config gate), skipping generated files.", "author": { "name": "Melodic Software", diff --git a/plugins/go-format/CHANGELOG.md b/plugins/go-format/CHANGELOG.md index 2b18485574..db12d45f64 100644 --- a/plugins/go-format/CHANGELOG.md +++ b/plugins/go-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `go-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.5.11] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.5.10] - 2026-10-07 ### Changed diff --git a/plugins/go-format/hooks/hook-utils.sh b/plugins/go-format/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/go-format/hooks/hook-utils.sh +++ b/plugins/go-format/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/guardrails/README.md b/plugins/guardrails/README.md index 0cc36d725f..a39dbf0833 100644 --- a/plugins/guardrails/README.md +++ b/plugins/guardrails/README.md @@ -283,7 +283,10 @@ out of scope until such a signal exists. scratch root, and the PowerShell lane consults one only for a single literal destination, so their message names none. The operator's levers, narrowest first, are `block_hook_bypass_scratch_roots` (Bash redirect targets and a - PowerShell command's single literal write destination), a session-scoped disable via `claude --settings`, and the + PowerShell command's single literal write destination), a session-scoped disable via `claude --settings` + (unverified since the [pluginConfigs entry](https://code.claude.com/docs/en/settings-reference#pluginconfigs) + stopped naming `--settings`, as of 2026-10-07; recheck when it names `--settings` again or a probe shows a + `--settings` value read or ignored), and the user-global `block_hook_bypass_enabled` switch, which persists across every repository where guardrails is enabled. They arrive once per session as a `systemMessage`, which Claude Code reads on exit 2 as on exit 0 @@ -998,7 +1001,8 @@ to early-exit inside each guard. The `Write|Edit` row now carries one handler pe extension, each with an `if` predicate (`Edit(*.md)` and so on; the field holds one rule, so one row per extension is the documented shape), and Claude Code evaluates the predicate before spawning: "The hook command only runs if the tool call matches -the pattern" (hooks reference, `if` field, raw `hooks.md` fetched 2026-09-05). +the pattern" (hooks reference, `if` field, raw `hooks.md` fetched 2026-09-05). Recheck when the +hooks reference changes how the `if` field is evaluated or lets one handler hold several rules. `run-guards.test.sh` pins the predicate set to the union of the verifiers' own `case "$FILE"` gates, so an extension added to a gate without an `if` row fails the suite rather than silently never firing. diff --git a/plugins/guardrails/hooks/block-root-delete-target.sh b/plugins/guardrails/hooks/block-root-delete-target.sh index 521b7e0521..bc136ebd61 100755 --- a/plugins/guardrails/hooks/block-root-delete-target.sh +++ b/plugins/guardrails/hooks/block-root-delete-target.sh @@ -943,7 +943,8 @@ rdt_short_cluster_arg() { # table here carries (see the operand-taking-option gap in the header). So # `env0-from` and `quoting-style` exist only in newer GNU env, and are kept: a # name an env lacks only adds a refusal, and removing one would loosen the -# guard. The sudo names above carry no source here. +# guard. The sudo names above carry no source here. Recheck when a GNU +# coreutils or uutils release adds an `env` option that takes an argument. # shellcheck disable=SC2329 # invoked from rdt_check_segment, itself a parser callback rdt_long_takes_arg() { local name="$2" ops fls o nop=0 @@ -2233,6 +2234,8 @@ rdt_check_segment() { # that source `-` and `-l` set initflag, whose chdir to the home directory # comes AFTER that execl, so a command runs from the current directory. The # guard still treats the directory as unknown, which only adds refusals. + # Recheck when shadow's newgrp.c changes how `sg` builds its `sh -c` + # command, or moves the home-directory chdir ahead of the execl. sg) j=$((i + 1)) if ((j < n)) && [[ "${words[j]}" == - || "${words[j]}" == -l ]]; then diff --git a/plugins/guardrails/hooks/hook-utils.sh b/plugins/guardrails/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/guardrails/hooks/hook-utils.sh +++ b/plugins/guardrails/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/guardrails/hooks/skill-reference-verify.sh b/plugins/guardrails/hooks/skill-reference-verify.sh index 40f4e30aa1..2e61f1fa6e 100755 --- a/plugins/guardrails/hooks/skill-reference-verify.sh +++ b/plugins/guardrails/hooks/skill-reference-verify.sh @@ -147,6 +147,8 @@ TOOL="${HOOK_JQ_FIELDS[0]}" # contrasting the two shapes). `Output` for Edit is `FileEditOutput`, whose # `structuredPatch` is `Array<{oldStart, oldLines, newStart, newLines, lines: # string[]}>` (, "Edit"). +# Recheck when the hooks page changes what `tool_response` carries for +# PostToolUse, or the SDK page changes `FileEditOutput.structuredPatch`. # # OBSERVED, not merely documented: an independent reviewer captured a live # PostToolUse payload (a temp settings.json dumping stdin, driven by a headless @@ -202,7 +204,9 @@ esac # against the plugin manifest reference # (, # fetched 2026-10-07). Collect them per plugin so a skill -# loaded from a declared location resolves like any other. +# loaded from a declared location resolves like any other. Recheck when the +# manifest reference stops saying declared `skills` paths add to the default +# `skills/` directory. # # One documented exception is NOT modeled: for a marketplace entry whose `source` # resolves to the marketplace root, declared subdirectories REPLACE the default @@ -368,7 +372,9 @@ skill_frontmatter_name() { # subdirectory and no `skills` key auto-loads as a single-skill plugin. That last # condition is honored as written rather than widened — a root SKILL.md sitting # beside a populated `skills/` is not loaded, and accepting it would suppress the -# advisory for a command Claude Code does not actually offer. +# advisory for a command Claude Code does not actually offer. Recheck when the +# manifest reference changes the single-skill auto-load condition or how +# declared paths combine with the default location. # # Call as: skill_roots -> $roots # shellcheck disable=SC2154 # roots is the caller's frame, per the call contract diff --git a/plugins/harness-config/.claude-plugin/plugin.json b/plugins/harness-config/.claude-plugin/plugin.json index ef57a9dda0..584d29ea5c 100644 --- a/plugins/harness-config/.claude-plugin/plugin.json +++ b/plugins/harness-config/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "harness-config", - "version": "1.13.1", + "version": "1.13.2", "description": "Configuration health for a repo's Claude Code: audit (settings, .mcp.json, hooks, plugins, permission drift), audit-automation-gaps, audit-permission-grants, audit-permission-state (effective rules with provenance), draft-auto-mode-rules (prints an autoMode block), audit-instructions (instructions the model no longer needs, conflicts), audit-prompting-postures, audit-pass (one ordered, resumable pass), unhobble (strip instructions, re-add what evidence earns), and setup.", "author": { "name": "Melodic Software", diff --git a/plugins/harness-config/CHANGELOG.md b/plugins/harness-config/CHANGELOG.md index 7cde9b3975..603fead27d 100644 --- a/plugins/harness-config/CHANGELOG.md +++ b/plugins/harness-config/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to the `harness-config` plugin are documented here. Format f Versions 0.51.8 to 0.51.9 and 0.51.11 to 0.51.14 were reserved by parallel branches and never released. +## [1.13.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [1.13.1] - 2026-10-07 ### Changed diff --git a/plugins/harness-config/reference/agents-md-liveness.md b/plugins/harness-config/reference/agents-md-liveness.md index ac76a0fac1..260ebf9d2b 100644 --- a/plugins/harness-config/reference/agents-md-liveness.md +++ b/plugins/harness-config/reference/agents-md-liveness.md @@ -78,8 +78,11 @@ displacement is a condition of the default value alone. **Where the value lives**, which is what a check reads rather than the `/config` panel: our checks read the `instructionFiles` option under the `agents-md@builtin` key of `pluginConfigs`, from user -settings (`~/.claude/settings.json`), a `--settings` file or managed settings, and ignore the key -in project and local settings files. +settings (`~/.claude/settings.json`) or managed settings, and ignore the key in project and local +settings files. A `--settings` file is unverified since the +[`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped +naming the flag (as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows +a `--settings` value read or ignored). - **Pointer**: for where the setting is honored and its JSON shape, see . @@ -87,9 +90,9 @@ in project and local settings files. - **Recheck trigger**: the option key or plugin id changes, the honored scope set changes, or the setting becomes readable from project or local settings. -Because the honored scopes are user, `--settings` and managed, resolve the **effective** value -across them. Reading one scope answers the wrong question in both directions: a user scope naming -the default can be overridden by a managed one, and the reverse. +Because the honored scopes are user and managed, resolve the **effective** value across them. +Reading one scope answers the wrong question in both directions: a user scope naming the default +can be overridden by a managed one, and the reverse. **The legacy key still counts.** Read `projectInstructions` under the same `agents-md@builtin` entry as well as `instructionFiles`: diff --git a/plugins/harness-config/skills/audit-instructions/reference/criteria.md b/plugins/harness-config/skills/audit-instructions/reference/criteria.md index 7fc262d258..b75b152b9c 100644 --- a/plugins/harness-config/skills/audit-instructions/reference/criteria.md +++ b/plugins/harness-config/skills/audit-instructions/reference/criteria.md @@ -955,9 +955,9 @@ skill bodies. the documented reasons, does not load the file even with no `CLAUDE.md` in sight, while one under the `claude-md-and-agents-md` setting loads it even **with** a `CLAUDE.md` beside it, which makes a read of it redundant where the - displacement test alone would have exempted it. That setting is a user, `--settings` or managed - one, so the value to resolve is the **effective** one across those scopes, never a single scope's - copy. + displacement test alone would have exempted it. That setting is a user or managed + one (`--settings` is unverified, see the liveness reference), so the value to resolve is the + **effective** one across those scopes, never a single scope's copy. There, in the first case, an instruction to read it is the only thing that puts it in context, and flagging the read as redundant would propose deleting the load. Resolve the availability **and mode** conditions from the dated records in diff --git a/plugins/harness-config/skills/audit-pass/SKILL.md b/plugins/harness-config/skills/audit-pass/SKILL.md index 1fc29aefd0..3334806421 100644 --- a/plugins/harness-config/skills/audit-pass/SKILL.md +++ b/plugins/harness-config/skills/audit-pass/SKILL.md @@ -191,7 +191,8 @@ a custom one drops the built-in software-engineering instructions unless `keep-coding-instructions: true`, and a plugin's `force-for-plugin` "overrides the user's `outputStyle` setting", so a walk plus settings reports a selection as live when it is not ([output styles](https://code.claude.com/docs/en/output-styles), -verified 2026-08-04). Report the resolved live style and what resolved it. +verified 2026-08-04; recheck when the page stops saying a custom style drops the built-in +instructions or `force-for-plugin` overrides `outputStyle`). Report the resolved live style and what resolved it. **Shadowed definitions fall out of this inventory, not out of a catalog.** Skills, subagents, and MCP servers override *by name*: where two share a name across scopes, exactly one is live. That is name @@ -480,7 +481,8 @@ in them would reach the Bash tool unsubstituted, and the Bash tool's environment delegated check passes through model refinement first; the gate belongs to the derived tier. - **Never propose an `@path` import as a context saving.** Splitting into imports "helps organization but doesn't reduce context, since imported files load at launch" - ([memory](https://code.claude.com/docs/en/memory), verified 2026-08-10). A split remediation must + ([memory](https://code.claude.com/docs/en/memory), verified 2026-08-10; recheck when the memory page says imported files load lazily). A split + remediation must name a load-deferring destination and price what it costs. ## What this skill does NOT do diff --git a/plugins/harness-config/skills/audit-pass/reference/doctor-handoff.md b/plugins/harness-config/skills/audit-pass/reference/doctor-handoff.md index 4d18b70247..4bc1eddcf1 100644 --- a/plugins/harness-config/skills/audit-pass/reference/doctor-handoff.md +++ b/plugins/harness-config/skills/audit-pass/reference/doctor-handoff.md @@ -7,7 +7,7 @@ and why the handoff is an operator instruction rather than a dispatch. ## It is never dispatched `/doctor` "reports what it finds … then proposes fixes it applies only after you confirm" -([debug your configuration](https://code.claude.com/docs/en/debug-your-config), verified 2026-08-10). +([debug your configuration](https://code.claude.com/docs/en/debug-your-config), verified 2026-08-10; recheck when the page says `/doctor` applies fixes without confirmation). An unattended run cannot answer that prompt, so driving it from this pass would either hang the run or push it toward answering a confirmation on the operator's behalf. @@ -37,7 +37,8 @@ Checking a version number alone is not a presence check. The pass reports **whic failed rather than a bare "unavailable", and it distinguishes what official documentation confirms from what it does not. -**Verified against official docs: items 1–2 on 2026-07-24, item 3 on 2026-08-10.** +**Verified against official docs: items 1–2 on 2026-07-24, item 3 on 2026-08-10.** Recheck items +1–2 when the debug-your-config page changes the v2.1.206 floor or the v2.1.205 statement. 1. **Version floor: Claude Code v2.1.206 or later.** "The `CLAUDE.md` trim check requires Claude Code v2.1.206 or later" ([debug your configuration](https://code.claude.com/docs/en/debug-your-config); diff --git a/plugins/harness-config/skills/audit-pass/reference/finding-identity.md b/plugins/harness-config/skills/audit-pass/reference/finding-identity.md index 8681b99d7e..56cbec6e0d 100644 --- a/plugins/harness-config/skills/audit-pass/reference/finding-identity.md +++ b/plugins/harness-config/skills/audit-pass/reference/finding-identity.md @@ -43,7 +43,7 @@ sites = sorted([(surface, anchor), …]) # one entry, or two for a pairwise **A cross-surface conflict is ONE finding with two sites, never two linked findings.** SARIF reserves separate results for "distinct occurrences … which could be corrected independently" -([§3.27.12](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html), verified 2026-07-24). +([§3.27.12](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html), verified 2026-07-24; recheck when a SARIF release rewrites that section). A contradiction between two instruction surfaces is retired by fixing *either* side, so the two sides are not independently correctable and are not two results. @@ -58,7 +58,7 @@ assert two independently correctable defects where there is one contradiction. The rule has the same source as the two-site exemption, read the other way. SARIF reserves separate results for "distinct occurrences … which could be corrected independently" -([§3.27.12](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html), verified 2026-07-24), +([§3.27.12](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html), verified 2026-07-24; recheck when a SARIF release rewrites that section), and twenty-one sites of one over-prescriptive instruction are twenty-one independently correctable occurrences. GitHub's consumer settles the practical half: it keys on `locations[0]` and ignores every location past it, so a multi-site finding is already carried as its first site by the @@ -123,7 +123,7 @@ content and the same defect. churning the whole report on an unrelated edit. The anchor field name carries its algorithm version: findings emit **`anchor/v1`**, and two sides compare on the **greatest anchor version both carry** (the versioned-fingerprint discipline of SARIF -[§3.27.17](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html), verified 2026-07-24). +[§3.27.17](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html), verified 2026-07-24; recheck when a SARIF release changes fingerprint versioning). That is the escape hatch: a later algorithm ships as `anchor/v2` alongside `v1`, and a record written under `v1` keeps matching until both sides have moved. @@ -176,7 +176,7 @@ the ambiguity actually lives. file *as a whole*, that it should not exist, is unreachable, or duplicates another, must not be retired by editing a line inside it. SARIF grounds the same decomposition: "If the region property is absent, the `physicalLocation` object refers to the entire artifact" -([§3.29.4](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html), verified 2026-07-24). +([§3.29.4](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html), verified 2026-07-24; recheck when a SARIF release rewrites the absent-region rule). The consequence must be stated where an operator will meet it: **an `s:` suppression survives every edit to the file and does not survive a rename.** A rename is a new surface, so the suppression goes stale and is re-reported. That is correct, because a renamed file is a decision worth re-judging. diff --git a/plugins/harness-config/skills/audit-pass/reference/report-location-and-schema.md b/plugins/harness-config/skills/audit-pass/reference/report-location-and-schema.md index 5c8ff572b0..ca85f95a1a 100644 --- a/plugins/harness-config/skills/audit-pass/reference/report-location-and-schema.md +++ b/plugins/harness-config/skills/audit-pass/reference/report-location-and-schema.md @@ -34,8 +34,8 @@ while excluding its `findings.json`, which is the same unfalsifiable-idempotence and `runs///report.md`, which survives plugin updates. **State its location precisely, because a whole target class turns on it:** that directory resolves to `~/.claude/plugins/data/{id}/` - ([plugin manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference#environment-variables), verified 2026-10-07), and no - documented setting relocates it. + ([plugin manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference#environment-variables), verified 2026-10-07; recheck when that section names a setting that + relocates it), and no documented setting relocates it. **`{id}` is derived, and deriving it wrong loses the report.** Same page, verbatim: `{id}` is *"the plugin identifier with characters outside `a-z`, `A-Z`, `0-9`, `_`, and `-` replaced by `-`"*, with diff --git a/plugins/harness-config/skills/audit-pass/reference/suppression.md b/plugins/harness-config/skills/audit-pass/reference/suppression.md index 04f83ec694..2c9bef005b 100644 --- a/plugins/harness-config/skills/audit-pass/reference/suppression.md +++ b/plugins/harness-config/skills/audit-pass/reference/suppression.md @@ -77,7 +77,7 @@ be *stable enough* rather than absolutely stable. GitHub's documented behavior o close-and-reopen: "If the filepaths differ for the same result, each time there is a new analysis a new alert will be created, and the old one will be closed" ([SARIF support for code scanning](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning), -verified 2026-07-25). +verified 2026-07-25; recheck when that page changes how a changed file path is matched). | Condition | Disposition | Effect on the suppression | |---|---|---| diff --git a/plugins/harness-config/skills/audit-permission-grants/reference/criteria.md b/plugins/harness-config/skills/audit-permission-grants/reference/criteria.md index 168f956894..77d77f9698 100644 --- a/plugins/harness-config/skills/audit-permission-grants/reference/criteria.md +++ b/plugins/harness-config/skills/audit-permission-grants/reference/criteria.md @@ -64,7 +64,8 @@ with its audited and blocked counts. Neither may be relayed as clean. **The exclusion set is disclosed rather than extended by path segment, and here is why.** A blanket `vendor/` or `node_modules/` exclusion would make an `error`-tier check silently blind to live grants under nested `.claude/skills/` paths, which Claude Code loads the moment it touches a -file in that subdirectory (, fetched 2026-08-12). The +file in that subdirectory (, fetched 2026-08-12; recheck +when the skills page changes how nested `.claude/skills/` directories are discovered). The detector instead applies a **loadability model**: only frontmatter at documented discovery paths is audited, meaning project or nested `.claude/skills//SKILL.md`, plugin `skills//SKILL.md`, and the parallel agents/commands paths. Everything else is excluded and counted. Filtering to *installed* @@ -137,7 +138,8 @@ absolute path. The single leading slash anchors at the settings source, not the `//Users//file` for absolute paths.**"* So `//Users//…` resolves to a concrete user home and carries the username. It is the canonical *spelling* of the defect P2 exists to catch, not an exception to it. Contrast `~/…`, whose own doc row (`Read(~/Documents/*.pdf)` → `/Users//Documents/*.pdf`) -shows the home segment being supplied per user, which is what makes it portable. +shows the home segment being supplied per user, which is what makes it portable. Recheck when the +permissions page's Read and Edit pattern table changes the `//path` or `~/path` row. **Why**: the rule names a concrete user home, so it breaks on any other machine or username, and it breaks after a skill migrates into a plugin, since the install path changes. It also leaks a username into diff --git a/plugins/harness-config/skills/audit-permission-state/reference/criteria.md b/plugins/harness-config/skills/audit-permission-state/reference/criteria.md index adcf7a8753..f92f01c9db 100644 --- a/plugins/harness-config/skills/audit-permission-state/reference/criteria.md +++ b/plugins/harness-config/skills/audit-permission-state/reference/criteria.md @@ -28,7 +28,7 @@ Pointers, both read 2026-08-11: [settings precedence](https://code.claude.com/docs/en/settings#settings-precedence), and [Manage permissions](https://code.claude.com/docs/en/permissions#manage-permissions) and [Settings precedence](https://code.claude.com/docs/en/permissions#settings-precedence) on the -permissions page. +permissions page. Recheck when either page's precedence list adds, drops or reorders a scope. --- diff --git a/plugins/harness-config/skills/audit-prompting-postures/SKILL.md b/plugins/harness-config/skills/audit-prompting-postures/SKILL.md index 332ae3b29c..552cfa4b49 100644 --- a/plugins/harness-config/skills/audit-prompting-postures/SKILL.md +++ b/plugins/harness-config/skills/audit-prompting-postures/SKILL.md @@ -86,8 +86,8 @@ available in the session at all and which files the instruction-files mode loads than from a copy that can drift. **Displacement is the default mode's answer, not the only one**: under the `claude-md-and-agents-md` setting both files load, each directory's `CLAUDE.md` first and its `AGENTS.md` after, so an `AGENTS.md` beside a `CLAUDE.md` is live there and belongs in the set even -though the default mode would call it displaced. That option is a user, `--settings` or managed -setting, so resolve the **effective** value across those scopes rather than one scope's copy, which +though the default mode would call it displaced. That option is a user or managed +setting (`--settings` is unverified, see the liveness reference), so resolve the **effective** value across those scopes rather than one scope's copy, which answers the wrong question whichever way the override runs. **The mode is the second question, not the only one, and either can rule the file out.** Availability comes first and is not a mode question: a session where support is unavailable, for a reason that diff --git a/plugins/harness-memory/.claude-plugin/plugin.json b/plugins/harness-memory/.claude-plugin/plugin.json index 831b4c2837..5d37f4f4e0 100644 --- a/plugins/harness-memory/.claude-plugin/plugin.json +++ b/plugins/harness-memory/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "harness-memory", - "version": "1.1.1", + "version": "1.1.2", "description": "Keeps a repo's Claude Code memory layer healthy, against criteria from official Claude Code docs. audit checks CLAUDE.md, a root AGENTS.md, CLAUDE.local.md, .claude/rules/, and auto-memory for structure, size, placement, and index integrity, with scripted and judgment checks. stateless inspects, disables, and (after confirmation) purges Claude-written auto memory across settings scopes. Whether instruction text fits the current model belongs to harness-config.", "author": { "name": "Melodic Software", diff --git a/plugins/harness-memory/CHANGELOG.md b/plugins/harness-memory/CHANGELOG.md index 6fdcf24d0f..e9268aac8d 100644 --- a/plugins/harness-memory/CHANGELOG.md +++ b/plugins/harness-memory/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `harness-memory` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [1.1.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [1.1.1] - 2026-10-07 ### Changed diff --git a/plugins/harness-memory/skills/audit/reference/criteria.md b/plugins/harness-memory/skills/audit/reference/criteria.md index 2182f3779f..cc2be8b264 100644 --- a/plugins/harness-memory/skills/audit/reference/criteria.md +++ b/plugins/harness-memory/skills/audit/reference/criteria.md @@ -234,6 +234,8 @@ overwrite it. - **Pointer**: for the include/exclude table, see [Write an effective CLAUDE.md](https://code.claude.com/docs/en/best-practices#write-an-effective-claude-md). - **As of**: 2026-08-17 +- **Recheck trigger**: the table gains a navigation-pointer row, or drops an exclude row steps 1-3 + apply. ### C6: Consistency [FAIL] diff --git a/plugins/harness-memory/skills/audit/reference/official-guidance.md b/plugins/harness-memory/skills/audit/reference/official-guidance.md index 4b8f85d7f6..8cc00b3b78 100644 --- a/plugins/harness-memory/skills/audit/reference/official-guidance.md +++ b/plugins/harness-memory/skills/audit/reference/official-guidance.md @@ -299,7 +299,8 @@ and prices a recommended move with that destination's row: `AGENTS.md` is its own row's worth of behavior, and the row depends on the repository. The memory page changed its `AGENTS.md` guidance between 2026-06-20 and 2026-09-19, so the row below is -derived from the page as of 2026-09-29, not from the earlier shim-only guidance. +derived from the page as of 2026-09-29, not from the earlier shim-only guidance. Recheck when the +memory page's `AGENTS.md` section changes again. The audit models an `AGENTS.md` as loading either directly, where no `CLAUDE.md`, `.claude/CLAUDE.md` or `CLAUDE.local.md` in the working directory or above it displaces it and diff --git a/plugins/harness-memory/skills/stateless/reference/official-guidance.md b/plugins/harness-memory/skills/stateless/reference/official-guidance.md index f603095500..f7e4bbdb3a 100644 --- a/plugins/harness-memory/skills/stateless/reference/official-guidance.md +++ b/plugins/harness-memory/skills/stateless/reference/official-guidance.md @@ -118,6 +118,8 @@ settings file's `env` block, which applies to every session and the subprocesses [Exceptions to managed settings precedence](https://code.claude.com/docs/en/settings#exceptions-to-managed-settings-precedence), and [`env`](https://code.claude.com/docs/en/settings-reference#env). - **As of**: 2026-08-10 +- **Recheck trigger**: the settings page adds a scope to the precedence list or documents a + managed-settings exception for `env`. ## Out of scope for this skill (verified, deliberate) @@ -136,6 +138,8 @@ settings file's `env` block, which applies to every session and the subprocesses [Cleaned up automatically](https://code.claude.com/docs/en/claude-directory#cleaned-up-automatically), [Kept until you delete them](https://code.claude.com/docs/en/claude-directory#kept-until-you-delete-them). - **As of**: 2026-08-10 + - **Recheck trigger**: either claude-directory section moves a path between the cleaned and kept + lists, or the `cleanupPeriodDays` default or minimum changes. This skill treats `claude project purge` as deleting, for one project, the transcripts and auto memory under `projects/`, its per-session `tasks/`, `debug/` and `file-history/` entries, its @@ -148,6 +152,8 @@ settings file's `env` block, which applies to every session and the subprocesses - **Pointer**: [Clear local data](https://code.claude.com/docs/en/claude-directory#clear-local-data) and [CLI commands](https://code.claude.com/docs/en/cli-reference#cli-commands). - **As of**: 2026-08-10 + - **Recheck trigger**: the Clear local data section changes what `claude project purge` deletes + or keeps, or the docs give the command a version requirement. We record `CLAUDE_CODE_SKIP_PROMPT_HISTORY` as the true "no session persistence" lever, since it stops transcripts and prompt history being written, and the complement to deleting the files diff --git a/plugins/harness-ops/hooks/hook-utils.sh b/plugins/harness-ops/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/harness-ops/hooks/hook-utils.sh +++ b/plugins/harness-ops/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/harness-ops/skills/audit-install-state/scripts/install_state.py b/plugins/harness-ops/skills/audit-install-state/scripts/install_state.py index b79edbc183..1f217fd8a7 100755 --- a/plugins/harness-ops/skills/audit-install-state/scripts/install_state.py +++ b/plugins/harness-ops/skills/audit-install-state/scripts/install_state.py @@ -176,6 +176,7 @@ def read_text_guarded(root: Path, relpath: str, limit: int = 2_000_000) -> str: # Basis for every SWEPT / KEPT row: https://code.claude.com/docs/en/claude-directory.md # ("Application data" -> "Cleaned up automatically" / "Kept until you delete # them"), read as raw markdown, verified 2026-08-11. See reference/surfaces.md. +# Recheck when either section adds, moves or drops a path row. # -------------------------------------------------------------------------- SWEPT = "product-managed-swept" # deleted at startup once older than cleanupPeriodDays diff --git a/plugins/harness-ops/skills/audit-skill-visibility/reference/listing-scorer.md b/plugins/harness-ops/skills/audit-skill-visibility/reference/listing-scorer.md index 724dc34136..6fcb7aacb4 100644 --- a/plugins/harness-ops/skills/audit-skill-visibility/reference/listing-scorer.md +++ b/plugins/harness-ops/skills/audit-skill-visibility/reference/listing-scorer.md @@ -190,4 +190,5 @@ Stamp: verified 2026-10-04 against Claude Code 2.1.289. The formula, the descending-sort first-fit truncation, the two truncator sites, the fit check above, and the per-model bytes-per-token all hold at that build; the entry and floor arithmetic reproduced a captured 289-entry listing (149,934 characters) -to the character. First verified 2026-09-11 at 2.1.263. +to the character. First verified 2026-09-11 at 2.1.263. Recheck when a release note names the +skill listing, its character budget or its truncation, or a build changes the scorer arithmetic. diff --git a/plugins/harness-ops/skills/audit-skill-visibility/scripts/audit_skill_visibility.py b/plugins/harness-ops/skills/audit-skill-visibility/scripts/audit_skill_visibility.py index 9974062b5e..6cc4db94ff 100755 --- a/plugins/harness-ops/skills/audit-skill-visibility/scripts/audit_skill_visibility.py +++ b/plugins/harness-ops/skills/audit-skill-visibility/scripts/audit_skill_visibility.py @@ -1264,7 +1264,8 @@ def budget_basis(cfg: ListingConfig) -> str: # out-of-process script, so it is recorded as unread rather than as absent. # Environment variables are not a level in this stack. Basis: # https://code.claude.com/docs/en/settings (precedence) and the settings schema -# text in the shipped binary; verified 2026-09-11 at Claude Code 2.1.263. +# text in the shipped binary; verified 2026-09-11 at Claude Code 2.1.263. Recheck when the +# settings page's precedence list adds or reorders a scope. LISTING_SETTINGS_KEYS = ("skillListingBudgetFraction", "skillListingMaxDescChars") diff --git a/plugins/harness-ops/skills/lanes/SKILL.md b/plugins/harness-ops/skills/lanes/SKILL.md index ed25879034..7c5980c2ed 100644 --- a/plugins/harness-ops/skills/lanes/SKILL.md +++ b/plugins/harness-ops/skills/lanes/SKILL.md @@ -165,7 +165,8 @@ Lanes are defined in a JSON config, resolved first-hit-wins: `--config FILE` → `$HARNESS_OPS_LANES_CONFIG` → `/.work/lanes/lanes.json`. Each lane carries a `name`, a `prompt` file path, a required `effort`, and optional `model`/`settings` (a session-only `claude --settings` override, e.g. opting the lane into the -`autonomy` plugin's lane-stop gate). The full +`autonomy` plugin's lane-stop gate; that `--settings` delivery is unverified, see +[context/config.md](context/config.md)). The full schema, resolution rules, and the prompt-storage seam live in [context/config.md](context/config.md). Read it before authoring a config. diff --git a/plugins/harness-ops/skills/lanes/context/config.md b/plugins/harness-ops/skills/lanes/context/config.md index a1fc943ada..9a91e022ff 100644 --- a/plugins/harness-ops/skills/lanes/context/config.md +++ b/plugins/harness-ops/skills/lanes/context/config.md @@ -64,7 +64,7 @@ handing the fixing to workers, so it sits one level below the verdict lanes. A p | `lanes[].prompt` | yes | Path to the lane's canonical prompt file. Relative → resolved against `prompt_dir`; absolute → used as-is. The file's full contents seed the session (positional prompt). A missing or empty file skips that lane with an error. | | `lanes[].model` | no | Passed as `claude --model`. An alias (`opus`, `sonnet`, `fable`) or a full model id. Omit to inherit the machine default. | | `lanes[].effort` | yes | Passed as `claude --effort`. Required on every lane, chosen from the "Choose an effort level" table above: `start` and `restart` refuse a lane with no effort (or a `null` one) with an error naming the lane, this key and that table, and still launch the other lanes; `restart` refuses before stopping, so the running session stays up. When `CLAUDE_CODE_EFFORT_LEVEL` is set in the launcher's environment, which every lane inherits, the launcher prints one warning per run that the configured levels may not hold. Pointer: for how that variable ranks against `--effort` and effort pins, see its row under [Variables](https://code.claude.com/docs/en/env-vars#variables). As of: 2026-10-02. Recheck trigger: that row's precedence changes. One of `low`, `medium`, `high`, `xhigh`, `max`, `ultracode` (validated; a bad value skips the lane). `ultracode` [requires Claude Code v2.1.203 or later](https://code.claude.com/docs/en/model-config#adjust-effort-level); below that floor the CLI rejects the value outright (`Unknown --effort value 'ultracode'`) and starts the session at the default effort, so the launcher checks the installed `claude --version` and skips the lane rather than launching it at an unintended effort. `restart` makes that check before stopping, so a refused lane keeps running. For what `ultracode` does to the effort level and when a model cannot run it, see the same section. As of 2026-10-02; recheck when the effort level set or the ultracode version floor changes. | -| `lanes[].settings` | no | A JSON **object** passed inline as `claude --settings`, a session-only override that never persists. The motivating use is opting a lane into the `autonomy` plugin's lane-stop gate via a `pluginConfigs` override (example above; the plugin id is marketplace-qualified, `@`, for however the plugin was installed). A non-object value skips the lane with an error. A gate request (`lane_stop_gate_enabled: true` under an `autonomy` key) additionally triggers launch-time ARMING: the launcher runs autonomy's `hooks/lane-stop-gate-arm.sh` and injects a random `lane_stop_gate_arm_id` into the launched settings, the trusted per-session channel the gate actually honors (it ignores the bare env mirror a repo `env` block could forge). A gate-requesting lane that cannot be armed (autonomy missing/pre-0.12.0, arming error, managed-settings veto) is skipped with an error rather than launched silently ungated. | +| `lanes[].settings` | no | A JSON **object** passed inline as `claude --settings`, a session-only override that never persists. The motivating use is opting a lane into the `autonomy` plugin's lane-stop gate via a `pluginConfigs` override (example above; the plugin id is marketplace-qualified, `@`, for however the plugin was installed). That `--settings` delivery is unverified since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped naming the flag (as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` value read or ignored; hook-config-delivery fact 5). A non-object value skips the lane with an error. A gate request (`lane_stop_gate_enabled: true` under an `autonomy` key) additionally triggers launch-time ARMING: the launcher runs autonomy's `hooks/lane-stop-gate-arm.sh` and injects a random `lane_stop_gate_arm_id` into the launched settings, the trusted per-session channel the gate actually honors (it ignores the bare env mirror a repo `env` block could forge). A gate-requesting lane that cannot be armed (autonomy missing/pre-0.12.0, arming error, managed-settings veto) is skipped with an error rather than launched silently ungated. | Lane names are free-form (`work`, `work-2`, `babysit`, `decide`, …); nothing is hardcoded. The set above mirrors the lanes this repo's telemetry conventions use, diff --git a/plugins/harness-ops/skills/lanes/context/refresh.md b/plugins/harness-ops/skills/lanes/context/refresh.md index add3542cf0..e55db82e31 100644 --- a/plugins/harness-ops/skills/lanes/context/refresh.md +++ b/plugins/harness-ops/skills/lanes/context/refresh.md @@ -19,7 +19,8 @@ handles built-in commands. marketplace source does nothing to a live session until the local install is updated; Claude Code's post-start auto-update runs once (random delay ≤ 10 min) and "The running session keeps the versions it loaded" - ([When auto-update runs](https://code.claude.com/docs/en/plugins/loading#when-auto-update-runs), read 2026-10-07). + ([When auto-update runs](https://code.claude.com/docs/en/plugins/loading#when-auto-update-runs), read 2026-10-07; recheck when that section says a running session picks + up an updated plugin). 2. **`/loop` does not re-read the skill each cycle.** A rendered `SKILL.md` enters the conversation once and "stays there for the rest of the session … Claude Code diff --git a/plugins/harness-ops/skills/lanes/scripts/lane-launcher.sh b/plugins/harness-ops/skills/lanes/scripts/lane-launcher.sh index 7a7d4f7c94..9761352c6f 100755 --- a/plugins/harness-ops/skills/lanes/scripts/lane-launcher.sh +++ b/plugins/harness-ops/skills/lanes/scripts/lane-launcher.sh @@ -10,7 +10,8 @@ # background-session surface. # # Verified CLI surface (claude 2.1.215 — see the skill's Verification section; -# --settings re-verified against the CLI reference, 2026-07-25): +# --settings re-verified against the CLI reference, 2026-07-25; recheck when the CLI reference +# changes the flag's JSON-object form): # claude --bg -n --permission-mode auto [--permission-prompts none] # [--model M] [--effort E] # [--settings JSON] "" launch, return now @@ -113,7 +114,11 @@ # settings optional; a JSON OBJECT passed inline as --settings for that # session only (e.g. a pluginConfigs override opting the lane into # the autonomy plugin's lane-stop gate). Non-object values are -# rejected. +# rejected. A pluginConfigs value delivered through --settings is +# unverified since the settings reference stopped naming the flag +# (as of 2026-10-07; recheck when the pluginConfigs entry names +# --settings again or a probe shows a --settings value read or +# ignored; hook-config-delivery fact 5). # # Lane-stop gate arming (#1784): # A lane whose settings request the autonomy lane-stop gate diff --git a/plugins/harness-ops/skills/machine-profile/SKILL.md b/plugins/harness-ops/skills/machine-profile/SKILL.md index 68befb6648..6f4078d7b5 100644 --- a/plugins/harness-ops/skills/machine-profile/SKILL.md +++ b/plugins/harness-ops/skills/machine-profile/SKILL.md @@ -49,7 +49,7 @@ Discovery reads identity domains from the `includeIf "gitdir:..."` entries in `g **Claim:** `gh` takes its configuration directory from `GH_CONFIG_DIR`, then `$XDG_CONFIG_HOME/gh`, then `$AppData/GitHub CLI` on Windows, then `$HOME/.config/gh`, and reports no directory for the working directory. **Basis:** `gh help environment` on gh 2.98.0, run 2026-10-01. **As of:** 2026-10-01. **Recheck:** a gh release changes the `GH_CONFIG_DIR` lookup order in `gh help environment`. -**Claim:** `pluginConfigs` is read from user settings, `--settings` and managed settings only, and `claude plugin install --config` writes user settings whatever scope flag is given, so one slot serves the whole machine. **Basis:** facts 5 and 9 of `docs/conventions/hook-config-delivery` (Claude Code 2.1.283, 2026-09-27). **As of:** 2026-10-01. **Recheck:** the documented `pluginConfigs` read scopes change, or `--config` starts honoring a scope flag. +**Claim:** `pluginConfigs` is read from user settings and managed settings only (`--settings` is unverified since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped naming it, as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` value read or ignored), and `claude plugin install --config` writes user settings whatever scope flag is given, so one slot serves the whole machine. **Basis:** facts 5 and 9 of `docs/conventions/hook-config-delivery` (Claude Code 2.1.283, 2026-09-27). **As of:** 2026-10-01. **Recheck:** the documented `pluginConfigs` read scopes change, or `--config` starts honoring a scope flag. ## Next diff --git a/plugins/harness-ops/skills/observability/context/output-format.md b/plugins/harness-ops/skills/observability/context/output-format.md index dbcad2df7a..d947e1a1dd 100644 --- a/plugins/harness-ops/skills/observability/context/output-format.md +++ b/plugins/harness-ops/skills/observability/context/output-format.md @@ -183,7 +183,8 @@ mentions them the line reads "legacy rows, shared file, time proximity only". cost falls back to ccusage rows by model with the Effort column left out - **The Token / cost caveat line is fixed copy.** Claude Code documents the same list-rate limitation for its own locally computed dollar figures - (, verified 2026-08-10) + (, verified 2026-08-10; recheck when the costs page + stops stating that limitation) ## Severity coloring (terminal) diff --git a/plugins/harness-ops/skills/plugins/SKILL.md b/plugins/harness-ops/skills/plugins/SKILL.md index 7aff5ab38a..9b4c398a06 100644 --- a/plugins/harness-ops/skills/plugins/SKILL.md +++ b/plugins/harness-ops/skills/plugins/SKILL.md @@ -306,9 +306,10 @@ no human is present to receive the count. **Configured value: `${user_config.install_new}`**. We treat this line as rendering the configured word into the skill content before the model sees it, but **only when the key is explicitly set** -in one of the three sources this skill reads `pluginConfigs` from: user settings -(`~/.claude/settings.json`), `--settings`, or managed settings, with precedence managed → -`--settings` → user. A project's `.claude/settings.json` or `.claude/settings.local.json` entry does +in one of the two sources this skill reads `pluginConfigs` from: user settings +(`~/.claude/settings.json`) or managed settings, with managed over user (`--settings` is +unverified since the entry stopped naming it, as of 2026-10-07; recheck when the entry names +`--settings` again or a probe shows a `--settings` value read or ignored). A project's `.claude/settings.json` or `.claude/settings.local.json` entry does nothing at all, and declaring the option in `plugin.json` alone does not make its value readable here either. See [context/scope-semantics.md](context/scope-semantics.md) for the read path, its pointer, and why it differs from `enabledPlugins`, which this same skill reads from project and diff --git a/plugins/harness-ops/skills/plugins/context/gotchas.md b/plugins/harness-ops/skills/plugins/context/gotchas.md index f53f591b00..2e5da26f45 100644 --- a/plugins/harness-ops/skills/plugins/context/gotchas.md +++ b/plugins/harness-ops/skills/plugins/context/gotchas.md @@ -186,6 +186,7 @@ on *that* line rather than on its own prose. Verified empirically (2026-09-06, C `SKILL.md`'s render showed the configured value. Claude Code enforces nothing here, so the rule is kept grep-checkable instead: no `context/*.md` file carries the dollar-brace form of the placeholder, and a spoke that inlines one fails silently until that grep catches it at review. +Recheck when a Claude Code release note changes how spoke files under `context/` are read. **The skill-body half of the contrast is verified on Claude Code 2.1.263** (2026-09-06, throwaway plugin from a local marketplace): a `userConfig` key set in user settings or through `--settings` @@ -193,7 +194,11 @@ plugin from a local marketplace): a `userConfig` key set in user settings or thr provided the `pluginConfigs` payload nests the key under `options`; the spoke half rests on the on-disk observation above. Keep the render in `SKILL.md` and branch on that line. [scope-semantics.md](scope-semantics.md) "`userConfig`: an unset key renders the literal -placeholder" holds the payload shape and the probe recipe. +placeholder" holds the payload shape and the probe recipe. The `--settings` delivery is +unverified since the `pluginConfigs` entry stopped naming it (as of 2026-10-07; recheck when the +entry names `--settings` again or a probe shows a `--settings` value read or ignored); the +substitution itself is the claim here. Recheck when a release note changes `userConfig` +substitution in skill bodies. ## `sync` updates the plugin that provides `sync` @@ -203,7 +208,7 @@ remaining step, including every later `fleet-state.sh` call, executes the **pre- while the report describes a version the user now has installed but is not running. Per `code.claude.com/docs/en/plugins/loading#when-auto-update-runs` (re-fetched 2026-10-07): "When a copied plugin updates mid-session, hook commands, monitors, MCP servers, and LSP servers keep using the previous -version's path." The behavior is **not re-run on 2.1.261**: observing it requires a live +version's path." (Recheck when that section stops saying so.) The behavior is **not re-run on 2.1.261**: observing it requires a live interactive session in which a plugin updates mid-run, which a non-interactive probe pass cannot stage. It was observed on **Claude Code 2.1.240**: a `sync` run's Step 3 moved the `harness-ops` install record to 0.35.3, while the session went on rendering the 0.33.2 skill it had loaded at diff --git a/plugins/harness-ops/skills/plugins/context/scope-semantics.md b/plugins/harness-ops/skills/plugins/context/scope-semantics.md index c619e65b29..dbcdb5d126 100644 --- a/plugins/harness-ops/skills/plugins/context/scope-semantics.md +++ b/plugins/harness-ops/skills/plugins/context/scope-semantics.md @@ -203,7 +203,8 @@ mechanism**, and a plugin enabled only in a user's own settings as absent from a the block exists to make a team's plugin set reproducible somewhere the user's `~/.claude` is not. Pointer: for what a cloud session carries over, see [What carries over from your setup](https://code.claude.com/docs/en/cloud-environments#what-carries-over-from-your-setup). -As of: 2026-09-05. +As of: 2026-09-05. Recheck when that section lists user-scope plugins as carried into cloud +sessions. **Locally, session start writes the records.** A plugin that only project settings enable and that the user has never installed is a separate case, for which see @@ -220,7 +221,8 @@ and pointing `installPath` at the user scope's existing cache directory. No new created and the user-scope records were untouched. A field sample on 2.1.261 (64 records for one repo path sharing one `installedAt` second) has the same shape: one session-start batch, one record per `true` entry per checkout path. The write happens even though nothing new was fetched; the -record is a pin, not a download. +record is a pin, not a download. Recheck when the loading page's not-installed section or a +release note changes what session start records for an already-installed plugin. **Precedence explains why a user-scope duplicate does not prevent the project record.** We resolve `enabledPlugins` managed > `--settings` > local > project > user, so a user-scope `false` never @@ -237,7 +239,8 @@ same scratch repo: the block reduced to one entry, `"": false` for a plugin scope; one headless session; `installed_plugins.json` byte-identical before and after (no new record, no touched timestamp), and the session reported that plugin's skill as unavailable while a sibling user-scope plugin's skill stayed available. A `false` entry is enablement state only; it -never manufactures an install record. +never manufactures an install record. Recheck when a release note changes how a project-scope +`false` is handled at session start. **Removing the records rewrites the committed block.** Observed in the same pass on 2.1.263: `claude plugin uninstall -s project ` run from inside the checkout removed the project record @@ -252,8 +255,8 @@ directory and does not touch `~/.claude`, and the section above records that no record by path (`-s project` acts on the cwd only, `prune` is dependency-only). We treat the product's own retention sweep as not covering them either: as of 2026-09-05 its list named nothing under `~/.claude/plugins/` (pointer: -[Cleaned up automatically](https://code.claude.com/docs/en/claude-directory#cleaned-up-automatically)). -We treat the per-project records as a live, maintained mechanism rather than vestigial state, +[Cleaned up automatically](https://code.claude.com/docs/en/claude-directory#cleaned-up-automatically); +recheck when that list names a path under `~/.claude/plugins/`). We treat the per-project records as a live, maintained mechanism rather than vestigial state, because the [2.1.224 changelog entry](https://code.claude.com/docs/en/changelog#2-1-224) fixes a defect in them. Nothing between 2.1.200 and 2.1.261 adds a prune-by-path verb. @@ -266,7 +269,8 @@ account is undocumented. ## `/reload-plugins`: bare by default, `--force` for the MCP-cache-invalidation case -Every decision in this section rests on a docs pointer last re-read 2026-09-05. The *behavior*, +Every decision in this section rests on a docs pointer last re-read 2026-09-05 (recheck when the plugins reference changes +`/reload-plugins` or its `--force` flag). The *behavior*, what a bare reload actually warns about in a live session, is **not re-run on 2.1.261**: it needs an interactive session, which a non-interactive probe pass cannot drive. The `≥ 2.1.163` gate for `--force` is likewise **not re-verified on 2.1.261**, because the current docs page states the flag @@ -344,9 +348,12 @@ This skill reads both surfaces, and they do not agree on which scopes count. Get is silent in both directions, so the asymmetry is stated here once and pointed at from everywhere else. -**`pluginConfigs`: three sources only.** This skill reads `pluginConfigs` from user settings -(`~/.claude/settings.json`), `--settings`, and managed settings, with precedence -managed → `--settings` → user, and ignores entries in a project's `.claude/settings.json` or +**`pluginConfigs`: two sources only.** This skill reads `pluginConfigs` from user settings +(`~/.claude/settings.json`) and managed settings, with managed over user +([`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) lists the +scope as "User or managed"). `--settings` is unverified since that entry stopped naming it (as of +2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` value +read or ignored). The skill ignores entries in a project's `.claude/settings.json` or `.claude/settings.local.json` (Claude Code ignores them from v2.1.207, since a cloned repository could otherwise supply values). In every one of those sources the value nests under `options`: `{"pluginConfigs":{"@":{"options":{"":""}}}}`. A key placed directly @@ -414,9 +421,12 @@ default substitutes into skill content, so the two do not conflict. **Probe recipe.** The `pluginConfigs` payload must nest the key under `options`, in the shape "`pluginConfigs` and `enabledPlugins` have OPPOSITE scope rules" above gives; a key placed directly under the plugin id is ignored without warning, and a control set that way renders literal, which -looks exactly like a substitution failure. With the right shape, `--settings` substitutes the same -as user settings (verified 2026-09-06 on 2.1.263, alongside a sibling key set in user settings), so -either source is a valid positive control. `claude plugin install --config =` +looks exactly like a substitution failure. With the right shape, `--settings` substituted the same +as user settings (verified 2026-09-06 on 2.1.263, alongside a sibling key set in user settings; +recheck when a release note changes `userConfig` substitution), so either source was a valid +positive control. `--settings` is unverified since the `pluginConfigs` entry stopped naming it (as +of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` +value read or ignored), so prefer the user-settings control. `claude plugin install --config =` writes the user-settings entry in that shape, which is the cheapest way to set one. The placeholder itself is written only in `SKILL.md`, never in a spoke, because substitution happens in what Claude Code renders and a spoke read returns plain bytes; see [gotchas.md](gotchas.md) "A spoke file never diff --git a/plugins/harness-ops/skills/plugins/context/sync-install-enable.md b/plugins/harness-ops/skills/plugins/context/sync-install-enable.md index 7486690241..79659af32f 100644 --- a/plugins/harness-ops/skills/plugins/context/sync-install-enable.md +++ b/plugins/harness-ops/skills/plugins/context/sync-install-enable.md @@ -68,8 +68,9 @@ step's prose, is what to branch on: - **`none`**: install nothing; list the entries under "Action needed" in the report only **A headless run launched with `--setting-sources` that omits `user` silently reverts this policy to -`ask`.** `pluginConfigs` is read from user settings, `--settings`, and managed settings only (see -[scope-semantics.md](scope-semantics.md)), so dropping `user` from the source list drops the +`ask`.** `pluginConfigs` is read from user settings and managed settings only (see +[scope-semantics.md](scope-semantics.md); `--settings` is unverified since the entry stopped +naming it, as of 2026-10-07), so dropping `user` from the source list drops the configured `install_new` with it, and the render falls back to the unset placeholder, which this step correctly reads as `ask`. That is the right fallback and the wrong silence: say so in the report rather than letting a policy the user set appear to have been honored. diff --git a/plugins/implementation/.claude-plugin/plugin.json b/plugins/implementation/.claude-plugin/plugin.json index 4199e1f59f..6fcbe1733b 100644 --- a/plugins/implementation/.claude-plugin/plugin.json +++ b/plugins/implementation/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "implementation", - "version": "0.23.1", + "version": "0.23.2", "description": "Disciplined implementation stage: execute approved plans inline (`/implementation:implement`) or via orchestrated worker subagents (`/implementation:implement-dispatch`) with incremental validation, TDD-by-default cadence, green-checkpoint commits, scope-fence drift detection, and divergence detection that routes back to planning. Build/test/lint, testing, and outcome verification live in the companion `toolchain`, `testing`, and `verification` plugins, invoked when installed.", "author": { "name": "Melodic Software", diff --git a/plugins/implementation/CHANGELOG.md b/plugins/implementation/CHANGELOG.md index 55c4417bc3..d63df82b49 100644 --- a/plugins/implementation/CHANGELOG.md +++ b/plugins/implementation/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `implementation` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.23.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.23.1] - 2026-10-07 ### Changed diff --git a/plugins/instruction-placement/hooks/hook-utils.sh b/plugins/instruction-placement/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/instruction-placement/hooks/hook-utils.sh +++ b/plugins/instruction-placement/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/instruction-placement/scripts/render-index.sh b/plugins/instruction-placement/scripts/render-index.sh index 9010e231d8..9d38692493 100755 --- a/plugins/instruction-placement/scripts/render-index.sh +++ b/plugins/instruction-placement/scripts/render-index.sh @@ -461,9 +461,10 @@ fi # The import stays harmless either way: "Claude Code skips an `AGENTS.md` it has # already loaded, so one that your `CLAUDE.md` imports or symlinks to isn't read # twice" (code.claude.com/docs/en/memory, "Choose which instruction files load"; -# fetched 2026-10-01; recheck when that table changes). The setting is a user, -# `--settings` or managed one, which no repository can ship, so the gate keeps -# the default's answer. +# fetched 2026-10-01; recheck when that table changes). The setting is a user +# or managed one (`--settings` is unverified since the pluginConfigs entry +# stopped naming it, as of 2026-10-07), which no repository can ship, so the +# gate keeps the default's answer. # # NATIVE means no CLAUDE.md, CLAUDE.local.md or root .claude/CLAUDE.md sits on # the file's own path, so nothing in this repository stops Claude Code reading diff --git a/plugins/instruction-placement/skills/migrate/reference/shim-droppable.md b/plugins/instruction-placement/skills/migrate/reference/shim-droppable.md index a4bc9ec8f2..db805503f6 100644 --- a/plugins/instruction-placement/skills/migrate/reference/shim-droppable.md +++ b/plugins/instruction-placement/skills/migrate/reference/shim-droppable.md @@ -29,7 +29,7 @@ three. A root that cannot be resolved here is unknown, and fails every condition | # | Holds when | Read it from | |---|---|---| | A | Nothing takes precedence over an `AGENTS.md`: no `CLAUDE.md`, `.claude/CLAUDE.md` or `CLAUDE.local.md` at or above the working directory other than the shims going, **and** no directory on the path from the repository root to a nested `AGENTS.md`, that directory included, holds a `.claude/CLAUDE.md` or a non-shim `CLAUDE.md` or `CLAUDE.local.md` | The ancestor walk below, run from each directory contributors start sessions in; the nested path walk below, over every `AGENTS.md` inside the repository, tracked or not; and the operator for the other machines, whose ancestors (a `~/work/CLAUDE.md`) and uncommitted `CLAUDE.local.md` files this machine cannot see | -| B | **Project instructions** on this machine reads `AGENTS.md` with no `CLAUDE.md`: `claude-md-or-agents-md` (the default) or `claude-md-and-agents-md` | `pluginConfigs["agents-md@builtin"].options.instructionFiles` in `/settings.json`, managed settings and any `--settings` file; absent everywhere is the default. Project and local settings are ignored for it, so never read them as the answer. `claude-md` or `managed-only` fails | +| B | **Project instructions** on this machine reads `AGENTS.md` with no `CLAUDE.md`: `claude-md-or-agents-md` (the default) or `claude-md-and-agents-md` | `pluginConfigs["agents-md@builtin"].options.instructionFiles` in `/settings.json` and managed settings; read any `--settings` file too, but the flag is unverified for `pluginConfigs` since the entry stopped naming it (as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` value read or ignored); absent everywhere is the default. Project and local settings are ignored for it, so never read them as the answer. `claude-md` or `managed-only` fails | | C | The loader is present and not disabled on this machine | `/harness-ops:inventory --bundled`, `builtin_plugins.cc-plugin-agents-md` (`in_loader`, `load`, `gated`, `gate_flags`), and no `enabledPlugins` entry set `false` in any scope (`` user settings, managed, project, local, `--settings`) for `agents-md@builtin` or the `id` the lane prints. Inventory absent, the lane `broken`, or the entry missing is unknown. With `disableAllHooks` or `allowManagedHooksOnly` set `true` in any scope, C holds only on v2.1.287 or later, the build on which built-in mods are verified to keep running under both; an older or unknown version is unknown | | D | Every user, machine and organization the repository serves reads `AGENTS.md` directly | Ask the operator, with the list below. Any yes, and any "don't know", fails | | E | Nothing reachable through the `@` import graph of any `AGENTS.md`, root or nested, lies outside the working directory | The import-graph walk below, from every `AGENTS.md` and from each session start directory. Any `EXTERNAL`, `UNRESOLVED` or `DEPTH` row fails | diff --git a/plugins/instruction-placement/skills/migrate/reference/sources.md b/plugins/instruction-placement/skills/migrate/reference/sources.md index 5f7018ae5f..8e3882dd9a 100644 --- a/plugins/instruction-placement/skills/migrate/reference/sources.md +++ b/plugins/instruction-placement/skills/migrate/reference/sources.md @@ -324,10 +324,14 @@ The record behind the skill body's `## Boundary` section for `cc-plugin-agents-m subdirectory's `CLAUDE.md` and `.claude/rules/` files, and path-scoped rules, still load when Claude reads a file there"). The value is read from `pluginConfigs` in "`~/.claude/settings.json`, a `--settings` file, or managed settings. Claude Code ignores it in project and local settings - files." The option's first key, `projectInstructions` (`claude`, `agents-fallback`, `both`, - `none`), is still honored while `instructionFiles` reads as its default, so an operator's mode - can come from either key; like `instructionFiles`, it is a user, `--settings` or managed value a - repository cannot rely on. Condition A: the files that "Count, so Claude reads them instead of `AGENTS.md`" are "a + files." (The memory page quoted here named `--settings` on 2026-10-01. The + [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry read + 2026-10-07 gives the scope "User or managed" and no longer names the flag, so `--settings` is + unverified as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a + `--settings` value read or ignored.) The option's first key, `projectInstructions` (`claude`, + `agents-fallback`, `both`, `none`), is still honored while `instructionFiles` reads as its + default, so an operator's mode can come from either key; like `instructionFiles`, it is a user + or managed value a repository cannot rely on. Condition A: the files that "Count, so Claude reads them instead of `AGENTS.md`" are "a `CLAUDE.md`, `.claude/CLAUDE.md`, or `CLAUDE.local.md` in your working directory or any directory above it", the walk to the filesystem root, while "Don't count, and keep loading alongside `AGENTS.md`: your `~/.claude/CLAUDE.md`, your organization's managed `CLAUDE.md`, and @@ -430,7 +434,7 @@ The record behind the skill body's `## Boundary` section for `cc-plugin-agents-m comes to state when a subdirectory's `AGENTS.md` loads under `claude-md-and-agents-md` or whether an import expands under `managed-only`; settings-reference documents how a built-in plugin is - disabled; settings-reference or the mods overview changes whether built-in mods keep running + disabled; the settings-reference `pluginConfigs` entry names `--settings` again; settings-reference or the mods overview changes whether built-in mods keep running under `disableAllHooks` or `allowManagedHooksOnly`, or stops listing `cc-plugin-agents-md` as one; a changelog entry names `AGENTS.md`, `instructionFiles`, `projectInstructions` or the `agents-md` plugin; or the README's "Setting the option" paragraph on the old key changes. diff --git a/plugins/kindle-dedrm/.claude-plugin/plugin.json b/plugins/kindle-dedrm/.claude-plugin/plugin.json index 87e2cbc1bb..88d48a34a2 100644 --- a/plugins/kindle-dedrm/.claude-plugin/plugin.json +++ b/plugins/kindle-dedrm/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "kindle-dedrm", - "version": "0.8.4", + "version": "0.8.5", "description": "Manage the Kindle for PC 2.8.0 + Calibre DeDRM workflow for personal-use ebook DRM removal on books the user owns (Windows only). Action router with setup, sync, update, cleanup, and status, each state mutation paired with a documented compensating reversal.", "author": { "name": "Melodic Software", diff --git a/plugins/kindle-dedrm/CHANGELOG.md b/plugins/kindle-dedrm/CHANGELOG.md index 5c1dfc7afb..3c24763494 100644 --- a/plugins/kindle-dedrm/CHANGELOG.md +++ b/plugins/kindle-dedrm/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `kindle-dedrm` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.8.5] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.8.4] - 2026-10-07 ### Changed diff --git a/plugins/kindle-dedrm/skills/manage/reference/versions.md b/plugins/kindle-dedrm/skills/manage/reference/versions.md index e154fd1215..559e060053 100644 --- a/plugins/kindle-dedrm/skills/manage/reference/versions.md +++ b/plugins/kindle-dedrm/skills/manage/reference/versions.md @@ -1,6 +1,6 @@ # Captured version pins -URLs and SHA256 hashes as captured at each row's `Captured` date (initial capture 2026-05-10; DeDRM archive re-fetched + SHA-verified and upstream URLs re-probed 2026-07-19). A `Captured` date attests the artifact was downloaded and its hash matched. It does NOT attest that a full single-book extraction was re-run at that date (that is manual and machine-bound; see "How to refresh this file"). The `update` action diffs upstream against these. Treat each row as a Tier 0 fact at the date captured; verify before re-using. +URLs and SHA256 hashes as captured at each row's `Captured` date (initial capture 2026-05-10; DeDRM archive re-fetched + SHA-verified and upstream URLs re-probed 2026-07-19). A `Captured` date attests the artifact was downloaded and its hash matched. It does NOT attest that a full single-book extraction was re-run at that date (that is manual and machine-bound; see "How to refresh this file"). The `update` action diffs upstream against these. Treat each row as a Tier 0 fact at the date captured; verify before re-using. A row's recheck trigger is its drift signal in `reference/sources.md`. ## Kindle for PC @@ -34,7 +34,7 @@ Previous pin for rollback: `v10.0.20` (SHA256 `c908be142934a7a030d890ba023ba32be Repo: `https://github.com/Satsuoni/DeDRM_tools`. This is a fork of the original NoDRM/Apprentice Harper DeDRM_tools, maintained specifically for compatibility with current Kindle for PC / KFX format. Upstream `noDRM/DeDRM_tools` is also viable but lags this fork on KFX support. -Asset contents (verified 2026-07-19, v10.0.28): +Asset contents (verified 2026-07-19, v10.0.28; recheck when the pinned tag moves or the release's asset list changes): ```text DeDRM_plugin.zip (Calibre plugin to install) diff --git a/plugins/knowledge/.claude-plugin/plugin.json b/plugins/knowledge/.claude-plugin/plugin.json index bf6914b1b8..16d2dc426b 100644 --- a/plugins/knowledge/.claude-plugin/plugin.json +++ b/plugins/knowledge/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "knowledge", - "version": "0.20.2", + "version": "0.20.3", "description": "Ingests external knowledge into synthesized artifacts: book-distill (PDF or EPUB into author-attributed reference files), video-digest (one YouTube or X video: transcript, links, repo applicability), course-digest (Dometrain and Teachable courses into recommendations), docpage-digest (one documentation page into a verified knowledge slice), and map-corpus (a multi-resource corpus into a classified link map and an approved docpage-digest queue). setup sets where artifacts land.", "author": { "name": "Melodic Software", diff --git a/plugins/knowledge/CHANGELOG.md b/plugins/knowledge/CHANGELOG.md index 475c658328..57cbb5741f 100644 --- a/plugins/knowledge/CHANGELOG.md +++ b/plugins/knowledge/CHANGELOG.md @@ -4,6 +4,12 @@ All notable changes to the `knowledge` plugin are recorded here. The `version` i `.claude-plugin/plugin.json` is the delivery vehicle. A consumer receives a change only after that version increases. +## [0.20.3] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.20.2] - 2026-10-07 ### Changed diff --git a/plugins/knowledge/skills/course-digest/extraction/lib/plugin-data.js b/plugins/knowledge/skills/course-digest/extraction/lib/plugin-data.js index acf75683a7..42a56a3515 100644 --- a/plugins/knowledge/skills/course-digest/extraction/lib/plugin-data.js +++ b/plugins/knowledge/skills/course-digest/extraction/lib/plugin-data.js @@ -7,7 +7,8 @@ * value wins. Without the flag an inherited value is used only when its last path * segment names this plugin (`knowledge-`), the order the marketplace's * on-demand-dependencies convention sets. Basis: plugins reference, "Where each - * variable resolves", as of 2026-10-02. + * variable resolves", as of 2026-10-02. Recheck when that section changes what + * `CLAUDE_PLUGIN_DATA` holds in the Bash tool's environment. * * Pure, so the launcher's contract is unit-testable without spawning a process. */ diff --git a/plugins/knowledge/skills/video-digest/extraction/lib/run-args.js b/plugins/knowledge/skills/video-digest/extraction/lib/run-args.js index 1f266d9e42..8c823ac756 100644 --- a/plugins/knowledge/skills/video-digest/extraction/lib/run-args.js +++ b/plugins/knowledge/skills/video-digest/extraction/lib/run-args.js @@ -124,7 +124,8 @@ export function buildChildEnv(baseEnv, flags = {}) { * and that value wins. Without the flag an inherited value is used only when its last * path segment names this plugin (`knowledge-`), the order the * marketplace's on-demand-dependencies convention sets. Basis: plugins reference, - * "Where each variable resolves", as of 2026-10-02. + * "Where each variable resolves", as of 2026-10-02. Recheck when that section + * changes what `CLAUDE_PLUGIN_DATA` holds in the Bash tool's environment. * * @param {string|undefined} flagValue * @param {NodeJS.ProcessEnv} env diff --git a/plugins/knowledge/skills/video-digest/reference/sources/x.md b/plugins/knowledge/skills/video-digest/reference/sources/x.md index d513944200..3f31e66973 100644 --- a/plugins/knowledge/skills/video-digest/reference/sources/x.md +++ b/plugins/knowledge/skills/video-digest/reference/sources/x.md @@ -192,7 +192,7 @@ committed) or accept the login-required failure. **Auth is not a precondition.** A public status acquires media, captions, and metadata **anonymously**, with no cookies, no account, and no extractor args (verified 2026-08-15 against yt-dlp -2026.07.04). Cookies buy exactly the three login-required cases above and nothing else, so do not +2026.07.04; recheck when a yt-dlp release changes X extraction or an anonymous fetch of a public status fails). Cookies buy exactly the three login-required cases above and nothing else, so do not demand them up front. **Auth volatility.** X auth-fallback windows measure in **weeks to months**, not days: an diff --git a/plugins/machine-health/.claude-plugin/plugin.json b/plugins/machine-health/.claude-plugin/plugin.json index 8dc62f30b6..d2666c86a8 100644 --- a/plugins/machine-health/.claude-plugin/plugin.json +++ b/plugins/machine-health/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "machine-health", - "version": "0.16.5", + "version": "0.16.6", "description": "Workstation health audit: OS-specific checks (disk, OS updates, security posture, CISA KEV correlation) run from a versioned catalog with trend-aware severity, approval-gated remediations, and dated markdown reports. Windows fully implemented; macOS/Linux scaffolded (report UNKNOWN and stop). Machine state persists in the plugin data directory; the report directory and check catalog are configurable.", "author": { "name": "Melodic Software", diff --git a/plugins/machine-health/CHANGELOG.md b/plugins/machine-health/CHANGELOG.md index a507923717..9b27b9bf4e 100644 --- a/plugins/machine-health/CHANGELOG.md +++ b/plugins/machine-health/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `machine-health` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.16.6] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.16.5] - 2026-10-07 ### Changed diff --git a/plugins/markdown-format/.claude-plugin/plugin.json b/plugins/markdown-format/.claude-plugin/plugin.json index 99ebf7fa3f..845b234dfa 100644 --- a/plugins/markdown-format/.claude-plugin/plugin.json +++ b/plugins/markdown-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "markdown-format", - "version": "0.12.12", + "version": "0.12.13", "description": "Auto-format and lint Markdown on edit via markdownlint-cli2, only in repos that carry their own markdownlint config.", "author": { "name": "Melodic Software", diff --git a/plugins/markdown-format/CHANGELOG.md b/plugins/markdown-format/CHANGELOG.md index 45b08bab36..17a02a9fc9 100644 --- a/plugins/markdown-format/CHANGELOG.md +++ b/plugins/markdown-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `markdown-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.12.13] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.12.12] - 2026-10-07 ### Changed diff --git a/plugins/markdown-format/README.md b/plugins/markdown-format/README.md index b0d87502f8..e93e0b1a58 100644 --- a/plugins/markdown-format/README.md +++ b/plugins/markdown-format/README.md @@ -23,7 +23,8 @@ config has chosen no Markdown style, so the hook does not run there at all calls the `if` filter best-effort. Its one documented fail-open is for Bash input it cannot parse, and it documents no file-tool equivalent ([hooks reference](https://code.claude.com/docs/en/hooks), common fields, - checked 2026-09-27). + checked 2026-09-27). Recheck when the hooks reference documents a file-tool + fail-open for `if`, or drops the Bash one. - **Config opt-in.** The hook runs only when a markdownlint config file that `markdownlint-cli2` would discover automatically (`.markdownlint-cli2.jsonc`, `.markdownlint.json`, …, any of the ten documented names) exists between the diff --git a/plugins/markdown-format/hooks/hook-utils.sh b/plugins/markdown-format/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/markdown-format/hooks/hook-utils.sh +++ b/plugins/markdown-format/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/markdown-format/hooks/markdown-format.sh b/plugins/markdown-format/hooks/markdown-format.sh index 3a348d1ba9..87f9642462 100755 --- a/plugins/markdown-format/hooks/markdown-format.sh +++ b/plugins/markdown-format/hooks/markdown-format.sh @@ -9,7 +9,9 @@ # Claude Code can't determine which commands the Bash input runs, it runs your # hook regardless of the pattern", https://code.claude.com/docs/en/hooks, # fetched 2026-09-27) and names no file-tool equivalent, so the check guards an -# undocumented miss and a direct invocation rather than a known one. +# undocumented miss and a direct invocation rather than a known one. Recheck +# when the permissions page documents a matching `Write(path)` rule form, or the +# hooks reference documents a file-tool fail-open for `if`. # # ADVISORY: always exits 0 — unfixable markdownlint violations surface via # additionalContext but never block the edit. Uses the consuming repo's own @@ -141,7 +143,8 @@ markdownlint_config_discoverable() { # A `.git` entry, accepted as a directory (ordinary clone) or as a FILE, which # is what a linked worktree and a submodule write instead — the two shapes git's # own discovery accepts (https://git-scm.com/docs/gitrepository-layout, -# "$GIT_DIR", fetched 2026-08-09). +# "$GIT_DIR", fetched 2026-08-09). Recheck when that page changes the forms a +# `.git` entry may take. # shellcheck disable=SC2329 # invoked by name, as hook::walk_up_to's predicate git_dir_entry_here() { [[ -e "$1/.git" ]] @@ -391,7 +394,8 @@ fi # file and the repository root applies, and a pattern excluding an ANCESTOR # directory (`.work/`) is honored for a file nested arbitrarily below it. # Verified 2026-08-08 against git's check-ignore behavior for a child, a -# grandchild, and both path spellings. +# grandchild, and both path spellings. Recheck when a git release changes +# how check-ignore treats a child of an ignored ancestor directory. # # FAILS TOWARD LINTING, deliberately. Any inability to decide — git absent, the # directory gone, check-ignore erroring (128) — leaves the run alone rather than @@ -412,6 +416,8 @@ fi # reference, https://code.claude.com/docs/en/plugins/manifest-reference#reference-a-saved-value, # fetched 2026-10-07). Booleans arrive as the strings "true"/"false"; anything # else falls back to the manifest default rather than being interpolated. +# Recheck when that section stops exporting every option as +# CLAUDE_PLUGIN_OPTION_ or changes how booleans are encoded. # Shared helper: hook::gitignored_out_of_scope in hook-utils.sh. if hook::gitignored_out_of_scope "${CLAUDE_PLUGIN_OPTION_MARKDOWN_FORMAT_LINT_GITIGNORED:-false}" "$FILE"; then # silent-skip-ok: this is a path-scope policy verdict, not a missing-tool @@ -1102,7 +1108,8 @@ fi # (plugin manifest reference, https://code.claude.com/docs/en/plugins/manifest-reference#fields-that-run-through-a-shell, # fetched 2026-10-07). A # value that is not a non-negative integer falls back to the default rather -# than being interpolated anywhere. +# than being interpolated anywhere. Recheck when the manifest reference changes +# how `${user_config.*}` is handled in shell-form hook commands. MAX_FINDINGS=20 case "${CLAUDE_PLUGIN_OPTION_MARKDOWN_FORMAT_MAX_FINDINGS:-}" in "") ;; diff --git a/plugins/miro/.claude-plugin/plugin.json b/plugins/miro/.claude-plugin/plugin.json index 436e8403b7..c1294d3b16 100644 --- a/plugins/miro/.claude-plugin/plugin.json +++ b/plugins/miro/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "miro", - "version": "0.6.7", + "version": "0.6.8", "description": "Miro board management over the Model Context Protocol: create and manage boards, sticky notes, shapes, frames, connectors, and tags for EventStorming, brainstorming, and diagramming. Ships a local stdio MCP server that installs its pinned npm dependencies on first launch (needs Node.js 24+ and npm); installs disabled, so opt in. The server starts without a Miro API token; until one is set, each tool call explains how to set it.", "author": { "name": "Melodic Software", diff --git a/plugins/miro/CHANGELOG.md b/plugins/miro/CHANGELOG.md index 9ef56bbb6f..0f621f1edf 100644 --- a/plugins/miro/CHANGELOG.md +++ b/plugins/miro/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `miro` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.6.8] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.6.7] - 2026-10-07 ### Changed diff --git a/plugins/miro/README.md b/plugins/miro/README.md index 81b03d62f8..1baf396c14 100644 --- a/plugins/miro/README.md +++ b/plugins/miro/README.md @@ -111,7 +111,8 @@ and launches a different server process instead. Tool names move from `mcp__plugin_miro_miro__` (plugin-provided) to `mcp__miro__` (directly configured) once the override is active. Update any permission rule written against the old prefix. Basis: [MCP server configuration](https://code.claude.com/docs/en/mcp), "Plugin MCP -tool names" and "Server deduplication," verified 2026-09-23. +tool names" and "Server deduplication," verified 2026-09-23. Recheck when either section changes +the plugin tool-name prefix or the deduplication rule. `event-storming` 0.6.14 and later detect Miro under either prefix, so its live-board path keeps working with this override. Earlier versions probe only `mcp__plugin_miro_miro__*` and fall back diff --git a/plugins/pixel-art/.claude-plugin/plugin.json b/plugins/pixel-art/.claude-plugin/plugin.json index 580e69e0dd..6db7e9ab71 100644 --- a/plugins/pixel-art/.claude-plugin/plugin.json +++ b/plugins/pixel-art/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "pixel-art", - "version": "0.6.7", + "version": "0.6.8", "description": "Creates pixel art with no external tools: sprites (sprite), animation sprite sheets for RPG Maker MZ, Godot, PICO-8, or plain strips with Aseprite-style frame data and GIF previews (animate), tilesets and parallax (tileset), UI skins and bitmap fonts (ui), effect sheets (vfx), and animated scenes as one HTML file (scene). Specs are palette-locked; a humanoid kit and a Python stdlib renderer write PNG, GIF, and frame data with a render-review loop. Optional Aseprite adapter.", "author": { "name": "Melodic Software", diff --git a/plugins/pixel-art/CHANGELOG.md b/plugins/pixel-art/CHANGELOG.md index 197d264b2a..7aea9018be 100644 --- a/plugins/pixel-art/CHANGELOG.md +++ b/plugins/pixel-art/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `pixel-art` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.6.8] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.6.7] - 2026-10-07 ### Changed diff --git a/plugins/pixel-art/examples/ui/window_mz.py b/plugins/pixel-art/examples/ui/window_mz.py index 0ea979718d..cbe35d0158 100644 --- a/plugins/pixel-art/examples/ui/window_mz.py +++ b/plugins/pixel-art/examples/ui/window_mz.py @@ -2,8 +2,9 @@ Region positions are the Window.png row in reference/engine-layouts.md. They match rmmz_core.js Window._refreshBack, _refreshFrame, _refreshCursor, _refreshArrows, -_refreshPauseSign, and ColorManager.textColor, fetched 2026-09-28. render.py uses one -frame size per spec, so the regions are drawn into that single frame. +_refreshPauseSign, and ColorManager.textColor, fetched 2026-09-28. Recheck when a RPG Maker MZ +release changes those methods. render.py uses one frame size per spec, so the +regions are drawn into that single frame. """ import json import pathlib diff --git a/plugins/planning/skills/draft-goal-condition/SKILL.md b/plugins/planning/skills/draft-goal-condition/SKILL.md index b100107c2c..b7a12f0f61 100644 --- a/plugins/planning/skills/draft-goal-condition/SKILL.md +++ b/plugins/planning/skills/draft-goal-condition/SKILL.md @@ -23,7 +23,7 @@ The `/goal` contract, its condition shape and its character limit, can change be `/goal` starts the next turn when the previous one finishes and stops when a fresh evaluator model confirms a completion condition holds. Before authoring, confirm that fits the intent. If it does not, route instead of drafting: - **Interval-driven** ("every 5 minutes", "poll until") → `/loop` (a time interval starts each turn), not `/goal`. -- **Cloud / sessionless / scheduled** ("nightly", "each morning", runs with no session open) → routines / `/schedule`. Routines were labeled a research preview on `https://code.claude.com/docs/en/routines` as of 2026-09-02; re-read that label during the Step 1 fetch before recommending them. +- **Cloud / sessionless / scheduled** ("nightly", "each morning", runs with no session open) → routines / `/schedule`. Routines were labeled a research preview on `https://code.claude.com/docs/en/routines` as of 2026-09-02; re-read that label during the Step 1 fetch before recommending them, and recheck when the page drops the research-preview label. - **Custom per-turn logic across all sessions** (deterministic script check, settings-scoped) → a prompt-based Stop hook. - **More agents than one conversation can coordinate** (or the orchestration is worth codifying as a rerunnable script) → a dynamic workflow. Unlike the rows above, this one is not exclusive of `/goal`: a workflow decides how a single task fans out, `/goal` decides when to stop turning, and the two compose. The goal sets the hard completion requirement while the workflow performs the parallel work. Route away from drafting only when the intent wants the fan-out and *no* across-turn completion condition; when it wants both, draft the condition here and say the workflow rides alongside it. - **One-shot** (a single prompt with no across-turn continuation) → just prompt; no goal. diff --git a/plugins/playbooks/reference/model-adaptation/opus-4-8.md b/plugins/playbooks/reference/model-adaptation/opus-4-8.md index 8f483a8408..88838632e2 100644 --- a/plugins/playbooks/reference/model-adaptation/opus-4-8.md +++ b/plugins/playbooks/reference/model-adaptation/opus-4-8.md @@ -163,3 +163,6 @@ the headline even before reading it. All `[CC: direct]`. Our reads: the guide was fetched 2026-07-06 and last confirmed 2026-08-08; the [Prompting Claude Fable 5](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-fable-5) page was last captured 2026-07-29; model-config was re-read 2026-10-01 for the fallback section. + +Recheck trigger for the whole chapter: a re-read of any pointed section no longer supporting the +decision beside it, or model-config no longer naming Opus 4.8 as a fallback target. diff --git a/plugins/playbooks/reference/model-adaptation/opus-5.md b/plugins/playbooks/reference/model-adaptation/opus-5.md index 767d8d54db..995beefbd7 100644 --- a/plugins/playbooks/reference/model-adaptation/opus-5.md +++ b/plugins/playbooks/reference/model-adaptation/opus-5.md @@ -197,3 +197,6 @@ Our reads, recorded so a re-read can tell whether a source moved: 194 pages. Section citations are to that PDF. - , read 2026-09-23 (MD5 `459c915e18892813e484986ada64efd7`) and re-read 2026-10-01 for the fallback section. + +Recheck trigger for the whole chapter: a revised card, or a re-read of any pointed section no +longer supporting the decision beside it. diff --git a/plugins/playbooks/reference/model-adaptation/sonnet-5.md b/plugins/playbooks/reference/model-adaptation/sonnet-5.md index 1ded50820b..e8a060e5d8 100644 --- a/plugins/playbooks/reference/model-adaptation/sonnet-5.md +++ b/plugins/playbooks/reference/model-adaptation/sonnet-5.md @@ -188,3 +188,6 @@ Our reads, recorded so a re-read can tell whether a page moved: [`.md` fetch route](https://github.com/melodic-software/claude-code-plugins/blob/main/docs/conventions/upstream-drift/README.md#reading-the-basis-the-fetch-route). - , read 2026-08-04 and re-read 2026-10-01 for the fallback and thinking sections. + +Recheck trigger for the whole chapter: a re-read of any pointed section no longer supporting the +decision beside it. diff --git a/plugins/playbooks/reference/prompt-caching.md b/plugins/playbooks/reference/prompt-caching.md index 4bd53ee76a..11162ccd8f 100644 --- a/plugins/playbooks/reference/prompt-caching.md +++ b/plugins/playbooks/reference/prompt-caching.md @@ -10,7 +10,7 @@ holds the current specifics. Beta features name their beta explicitly; a beta he the request contract, not decoration. Current prices, model lists, and TTL values resolve through the pricing page or the bundled `claude-api` skill at the moment of use; this chapter carries practices, not numbers. The pages behind the pointers were read 2026-09-28, two identical fetches -of each. +of each; each section below carries its own recheck trigger. ## Prefix stability diff --git a/plugins/playbooks/skills/fable-5/context/calibration.md b/plugins/playbooks/skills/fable-5/context/calibration.md index 576533916e..42efd5b8c7 100644 --- a/plugins/playbooks/skills/fable-5/context/calibration.md +++ b/plugins/playbooks/skills/fable-5/context/calibration.md @@ -46,7 +46,7 @@ Two worked divergences, both from published claude.ai system-prompt entries we r - The Claude Opus 4.1 entry, dated August 5 2025, on retaining information across chats. Here, CLAUDE.md files and auto memory carry knowledge across sessions ([Claude Code memory](https://code.claude.com/docs/en/memory)). - The Claude Sonnet 3.5 entry, dated November 22 2024, on opening URLs. Here, `WebFetch` is a documented tool ([tools reference](https://code.claude.com/docs/en/tools-reference)). -As of that 2026-08-03 read, neither sentence survived in a current entry, which makes wrong-surface and stale-entry independent errors: a reader who caught only the surface mismatch would still be relying on a retired prompt. Clear both before a vendor sentence becomes a premise. +As of that 2026-08-03 read, neither sentence survived in a current entry, which makes wrong-surface and stale-entry independent errors: a reader who caught only the surface mismatch would still be relying on a retired prompt. Clear both before a vendor sentence becomes a premise. Recheck when the published system-prompt notes restore either sentence. ## The reference page defines; a vendor post corroborates diff --git a/plugins/playbooks/skills/skill-authoring/reference/precompute-context.md b/plugins/playbooks/skills/skill-authoring/reference/precompute-context.md index 7383256287..04eb89170a 100644 --- a/plugins/playbooks/skills/skill-authoring/reference/precompute-context.md +++ b/plugins/playbooks/skills/skill-authoring/reference/precompute-context.md @@ -58,7 +58,8 @@ that invocation. With the default `bash` shell any non-zero exit counts as a fai killed at the two-minute timeout and aborts the same way. stderr merges into stdout and lands in the injected text ([When an injected command fails](https://code.claude.com/docs/en/skills#when-an-injected-command-fails), -read 2026-09-02). Every injected command must therefore carry an explicit fallback, so a probe that +read 2026-09-02; recheck when that section changes what counts as a failed injected command). +Every injected command must therefore carry an explicit fallback, so a probe that cannot run degrades the rendered skill to a known string instead of preventing the skill from loading at all: @@ -147,8 +148,8 @@ explicitly, so a bash-only pipeline doesn't silently break on a PowerShell host, text and never re-scanned. A command cannot emit a placeholder for a later pass. - **Renders on every invocation path**: user `/name`, the Skill tool, and auto-invocation all preprocess. When injected output changes between invocations, Claude Code appends the full - rendered content again ([Skills](https://code.claude.com/docs/en/skills), read 2026-09-02), so - keep injected output stable and small. + rendered content again ([Skills](https://code.claude.com/docs/en/skills), read 2026-09-02; recheck when that page + changes the re-append behavior), so keep injected output stable and small. - **Kill switch.** `disableSkillShellExecution` replaces each command with `[shell command execution disabled by policy]`. The skill must still make sense when that string appears in place of the output. Never make correctness depend on injection succeeding. diff --git a/plugins/playbooks/skills/skill-authoring/reference/skill-criteria.md b/plugins/playbooks/skills/skill-authoring/reference/skill-criteria.md index a38a3dd4f9..97535fe470 100644 --- a/plugins/playbooks/skills/skill-authoring/reference/skill-criteria.md +++ b/plugins/playbooks/skills/skill-authoring/reference/skill-criteria.md @@ -13,7 +13,8 @@ setting is named as one: a `/skill-quality:check` setting, or a choice of this p The deletion test governs every line, in the description, the body, a reference file or an agent: could the model already know this, or do the job without it? If so, cut it. Cruft is not length: never justify a deletion by character count alone, and never keep a line because it is short -(per the `claude-api` skill's prompt audit, as of 2026-10-06). +(per the `claude-api` skill's prompt audit, as of 2026-10-06; recheck when that audit's +cruft criterion changes). ## Frontmatter @@ -38,7 +39,8 @@ never justify a deletion by character count alone, and never keep a line because ## Descriptions - **Model-invoked:** what it is, then "Use when" with one trigger per branch of what the skill - does: `Noun phrase. Use when , .` (Pocock's shape, as of 2026-10-06). Enumerating + does: `Noun phrase. Use when , .` (Pocock's shape, as of 2026-10-06; recheck when his repository's descriptions change shape). + Enumerating every phrasing a user might type is the trigger-case defect the prompt audit flags. Use the nouns a user would type, and lead with the main use case: the listing truncates from the end. - **User-invoked** (`disable-model-invocation: true`): a one-line summary, no trigger list. Why @@ -50,7 +52,7 @@ never justify a deletion by character count alone, and never keep a line because - Length: the upstream description caps, the listing truncation and the shared listing budget live in the pages [Sources](#sources) names; `/skill-quality:check` holds the current values, enforces the caps and estimates the budget (`listing-budget`). Our own measure of Pocock's - skills: descriptions run median 130 and max 419 characters (as of 2026-10-06). + skills: descriptions run median 130 and max 419 characters (as of 2026-10-06; recheck when a re-measure at a newer commit moves it). ## Body @@ -78,8 +80,8 @@ never justify a deletion by character count alone, and never keep a line because `.claude/rules/skill-bodies-state-current-rules.md`. - Length: the upstream line guidance for SKILL.md lives in the platform best practices ([Sources](#sources)); `/skill-quality:check` holds the current value and enforces it. Our own - measure of Pocock's skills: bodies run median 70 and max 160 lines (as of 2026-10-06). Length is the symptom; the deletion test is the - remedy. + measure of Pocock's skills: bodies run median 70 and max 160 lines (as of 2026-10-06; recheck when a re-measure at a newer commit moves it). Length + is the symptom; the deletion test is the remedy. ## Reference files diff --git a/plugins/playgrounds/.claude-plugin/plugin.json b/plugins/playgrounds/.claude-plugin/plugin.json index afa70b7fe6..a1ebb2ba62 100644 --- a/plugins/playgrounds/.claude-plugin/plugin.json +++ b/plugins/playgrounds/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "playgrounds", - "version": "0.2.3", + "version": "0.2.4", "description": "One-step access to Anthropic's first-party playground plugin: declares the cross-marketplace dependency, routes playground-shaped requests to the upstream skill when it is installed, emits the install commands when it is not, and carries field-tested prompt recipes, cloud-session delivery guidance, and consumer cautions. Generates nothing itself.", "author": { "name": "Melodic Software", diff --git a/plugins/playgrounds/CHANGELOG.md b/plugins/playgrounds/CHANGELOG.md index abf76d30e3..4a5c0ab3a8 100644 --- a/plugins/playgrounds/CHANGELOG.md +++ b/plugins/playgrounds/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `playgrounds` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.2.4] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.2.3] - 2026-10-02 ### Fixed diff --git a/plugins/playgrounds/README.md b/plugins/playgrounds/README.md index 951614ca53..92c1d339a8 100644 --- a/plugins/playgrounds/README.md +++ b/plugins/playgrounds/README.md @@ -36,7 +36,8 @@ returns as a prompt. Generation and templates belong entirely to the upstream sk The wrapped capability is `playground@claude-plugins-official` (, Apache-2.0). Upstream facts referenced by this plugin were read at commit -`ed404106fcd80ba98ecb7c851e531dcb626d13b7` (verified current 2026-09-01). This +`ed404106fcd80ba98ecb7c851e531dcb626d13b7` (verified current 2026-09-01; recheck when +`playground@claude-plugins-official` publishes a commit that changes the playground skill). This wrapper is MIT-licensed and copies no upstream content. ## Install diff --git a/plugins/playwright/.claude-plugin/plugin.json b/plugins/playwright/.claude-plugin/plugin.json index 0c1ffac3ee..4c7338261f 100644 --- a/plugins/playwright/.claude-plugin/plugin.json +++ b/plugins/playwright/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "playwright", - "version": "0.10.1", + "version": "0.10.2", "description": "Live E2E browser automation via Microsoft's @playwright/cli: named sessions, accessibility-ref snapshots, click/fill by ref, screenshots, console and network capture, mocking, tracing, video, and auth state, with artifacts written to disk so only paths enter context, plus a vendored upstream baseline and maintainer drift-check update flow.", "author": { "name": "Melodic Software", diff --git a/plugins/playwright/CHANGELOG.md b/plugins/playwright/CHANGELOG.md index 8667e63e18..a708eaeec6 100644 --- a/plugins/playwright/CHANGELOG.md +++ b/plugins/playwright/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `playwright` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.10.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.10.1] - 2026-10-07 ### Changed diff --git a/plugins/playwright/README.md b/plugins/playwright/README.md index 754dffa893..3b87e819ae 100644 --- a/plugins/playwright/README.md +++ b/plugins/playwright/README.md @@ -67,7 +67,8 @@ The marketplace also runs every vendored skill's check weekly in its ## Why this wraps the upstream skill Verdict: keep the wrapper. Microsoft's own skill, `@playwright/cli` 0.1.22 -(checked 2026-10-07), falls short of the skill-authoring guidance this +(checked 2026-10-07; recheck when a newer `@playwright/cli` release changes its `SKILL.md` +description, length, or reference layout), falls short of the skill-authoring guidance this marketplace follows: - Its description is one short sentence with no trigger phrases, so the model diff --git a/plugins/plugin-quality/.claude-plugin/plugin.json b/plugins/plugin-quality/.claude-plugin/plugin.json index 2d026de027..079bb47e4f 100644 --- a/plugins/plugin-quality/.claude-plugin/plugin.json +++ b/plugins/plugin-quality/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "plugin-quality", - "version": "0.14.1", + "version": "0.14.2", "description": "Post-use behavioral audit (plugin-quality:audit) of any Claude Code plugin skill, agent, hook, command, or config you have used. Six steps: capture evidence; map behavior in a fresh subagent that records errors, improvements, and quality-of-life items against standards; a blindspot pass; an interactive contract lock; review with a research gate on each finding's claims and fixes; and a confirmed work item for the maintainers. Uses context-guard snapshots when present.", "author": { "name": "Melodic Software", diff --git a/plugins/plugin-quality/CHANGELOG.md b/plugins/plugin-quality/CHANGELOG.md index 108f1f783c..a0e3a56192 100644 --- a/plugins/plugin-quality/CHANGELOG.md +++ b/plugins/plugin-quality/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to the `plugin-quality` plugin. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.14.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.14.1] - 2026-10-07 ### Changed diff --git a/plugins/plugin-quality/agents/auditor.md b/plugins/plugin-quality/agents/auditor.md index 4245d9168c..71157a4b67 100644 --- a/plugins/plugin-quality/agents/auditor.md +++ b/plugins/plugin-quality/agents/auditor.md @@ -68,7 +68,8 @@ and expect contexts where it does not fire at all. **Packet files are write-once evidence.** A sibling plugin's `PostToolUse` hook registered on the `Write|Edit` matcher rewrites your packet files in place after your write succeeds. That event is documented harness behavior (`PostToolUse` runs after a tool call succeeds and may rewrite content; -the matcher keys on tool name, per , fetched 2026-08-10), and +the matcher keys on tool name, per , fetched 2026-08-10; recheck when the hooks page stops +saying a `PostToolUse` hook may rewrite content or matches on something other than tool name), and this fleet ships formatter plugins that register exactly such hooks. They damage precisely what you are writing down: verbatim quotations and code-span identifiers. So: never edit a packet file after it lands (a correction is a new file such as `audit-notes-2.md` or `evidence-.md`, since their autocorrect has no memory and reverts a hand-repair on the next edit); diff --git a/plugins/plugin-quality/scripts/packet-seal.sh b/plugins/plugin-quality/scripts/packet-seal.sh index 15e453ed60..6e16091add 100755 --- a/plugins/plugin-quality/scripts/packet-seal.sh +++ b/plugins/plugin-quality/scripts/packet-seal.sh @@ -4,7 +4,8 @@ # Packet files are written with the Write tool, and any sibling plugin that # registers a `PostToolUse` hook on the `Write|Edit` matcher post-processes # every one of them: PostToolUse runs after a tool call succeeds and may rewrite -# content (https://code.claude.com/docs/en/hooks, fetched 2026-08-10), and the +# content (https://code.claude.com/docs/en/hooks, fetched 2026-08-10; recheck when +# the hooks page stops saying so), and the # matcher keys on the TOOL NAME, so nothing about the destination directory # excludes a packet. Observed in this fleet: `typos-format` and # `markdown-format` both register that matcher unconditionally and both rewrite diff --git a/plugins/plugin-quality/skills/audit/SKILL.md b/plugins/plugin-quality/skills/audit/SKILL.md index 215713698a..04dd53be1f 100644 --- a/plugins/plugin-quality/skills/audit/SKILL.md +++ b/plugins/plugin-quality/skills/audit/SKILL.md @@ -198,7 +198,8 @@ context. Run this once **per resolved target**, into that target's own packet. W - Anything anomalous you noticed while using the component (the reason this audit started). - When the target plugin ships a mod (its hook config names `"modules"`): load the built-in `plugin-authoring` skill and record the declaration-file path that skill names, whatever its - basename or directory. As of 2026-10-03 that path ends in `types/claude-code.d.ts`. The + basename or directory. As of 2026-10-03 that path ends in `types/claude-code.d.ts` (recheck when the + `plugin-authoring` skill names a different file). The auditor cannot load skills, so the packet is its only way to that file. Why the file matters is in `reference/component-types/hook.md` "A mod (hooks module)". diff --git a/plugins/plugin-quality/skills/audit/reference/component-types/hook.md b/plugins/plugin-quality/skills/audit/reference/component-types/hook.md index 716b1cf522..8a39bc19bd 100644 --- a/plugins/plugin-quality/skills/audit/reference/component-types/hook.md +++ b/plugins/plugin-quality/skills/audit/reference/component-types/hook.md @@ -35,7 +35,8 @@ permissions, not a shell script. Read the module and run `claude plugin validate - **Read meanings from the declarations.** Step 1 records the declaration-file path the built-in `plugin-authoring` skill names. Grep that path for each event and `$` call the module uses and read the declaration it lands on. It is written for the running build, so it wins - where the pages cited below disagree. As of 2026-10-03 the path ends in `types/claude-code.d.ts`; + where the pages cited below disagree. As of 2026-10-03 the path ends in `types/claude-code.d.ts` (recheck when the + `plugin-authoring` skill names a different file); a later skill that names a different file is still the file to read. With no path in the packet, or a path that no longer exists (the folder belongs to one process, so a resumed audit can carry a dead one), ground in the pages and record that the declarations were not read. diff --git a/plugins/plugin-quality/skills/audit/reference/evidence-packet.md b/plugins/plugin-quality/skills/audit/reference/evidence-packet.md index dc8e68e3ea..5a80644e5b 100644 --- a/plugins/plugin-quality/skills/audit/reference/evidence-packet.md +++ b/plugins/plugin-quality/skills/audit/reference/evidence-packet.md @@ -26,7 +26,8 @@ Path: `/evidence////` - `` = this plugin's persistent data directory, `${CLAUDE_PLUGIN_DATA}`. That placeholder resolves here: the plugin manifest reference has `${...}` resolve "Anywhere in the Markdown body" of skill, command, and agent content - (, fetched 2026-10-07), alongside hook and + (, fetched 2026-10-07; recheck when that section drops skill, + command or agent Markdown bodies from the list), alongside hook and monitor commands. Should it arrive unexpanded, derive the directory deterministically per the same page: `~/.claude/plugins/data//`, where `` is this plugin's install identifier @@ -155,7 +156,8 @@ output and resume must not be steerable by it. This guardrail is **observed harness behavior, not documented**: no official Claude Code page describes it (sub-agents reference checked 2026-07-26, , which documents write restriction only at -tool-access granularity via `disallowedTools`). Treat it as environment-dependent. It may not +tool-access granularity via `disallowedTools`; recheck when that page documents a write +guardrail). Treat it as environment-dependent. It may not fire at all in a given context, which is why the naming rule is the primary defense and the rename fallback is the backstop. diff --git a/plugins/powershell-format/.claude-plugin/plugin.json b/plugins/powershell-format/.claude-plugin/plugin.json index 1f2e3258a2..3a5395e217 100644 --- a/plugins/powershell-format/.claude-plugin/plugin.json +++ b/plugins/powershell-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "powershell-format", - "version": "0.10.11", + "version": "0.10.12", "description": "Auto-format and lint PowerShell on edit via PSScriptAnalyzer, only when a PSScriptAnalyzerSettings.psd1 governs the repo, using the consuming repo's own analyzer settings.", "author": { "name": "Melodic Software", diff --git a/plugins/powershell-format/CHANGELOG.md b/plugins/powershell-format/CHANGELOG.md index 16c0af8032..d3be667796 100644 --- a/plugins/powershell-format/CHANGELOG.md +++ b/plugins/powershell-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `powershell-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.10.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.10.11] - 2026-10-07 ### Changed diff --git a/plugins/powershell-format/README.md b/plugins/powershell-format/README.md index d96c133ce7..1dbbf66bc2 100644 --- a/plugins/powershell-format/README.md +++ b/plugins/powershell-format/README.md @@ -77,7 +77,8 @@ directory outside the project. Claude Code can run it under Git Bash. - **Node.js** on `PATH`. Every handler in `hooks/hooks.json` runs through `node hooks/exec-bash.mjs`, which starts the Bash script. Claude Code's native binary neither - ships nor uses Node ([setup docs](https://code.claude.com/docs/en/setup), checked 2026-09-29), + ships nor uses Node ([setup docs](https://code.claude.com/docs/en/setup), checked 2026-09-29; + recheck when the setup docs say the native binary ships or uses Node), so without `node` the hooks do not launch and nothing is formatted, with no notice. [Install Node.js](https://nodejs.org/en/download). - **jq** on `PATH`. Parses the hook payload. Absent: the hook skips with a diff --git a/plugins/powershell-format/hooks/hook-utils.sh b/plugins/powershell-format/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/powershell-format/hooks/hook-utils.sh +++ b/plugins/powershell-format/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/rate-limit-guard/.claude-plugin/plugin.json b/plugins/rate-limit-guard/.claude-plugin/plugin.json index cd3c209609..35b75a7b7c 100644 --- a/plugins/rate-limit-guard/.claude-plugin/plugin.json +++ b/plugins/rate-limit-guard/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "rate-limit-guard", - "version": "0.17.1", + "version": "0.17.2", "description": "Shared rate-limit guard for loop lanes and Claude: a hooks module writes the subscription rate-limit windows to a fixed machine-scope file and tells Claude where they stand at boundaries, a StopFailure hook records rate-limit stops reactively, and a reader contract fixes how consuming sessions pause and resume.", "author": { "name": "Melodic Software", diff --git a/plugins/rate-limit-guard/CHANGELOG.md b/plugins/rate-limit-guard/CHANGELOG.md index 60d88240e0..e3dc452350 100644 --- a/plugins/rate-limit-guard/CHANGELOG.md +++ b/plugins/rate-limit-guard/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `rate-limit-guard` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.17.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.17.1] - 2026-10-07 ### Changed diff --git a/plugins/rate-limit-guard/README.md b/plugins/rate-limit-guard/README.md index 0b62925655..370d1d64b8 100644 --- a/plugins/rate-limit-guard/README.md +++ b/plugins/rate-limit-guard/README.md @@ -93,13 +93,17 @@ from that turn; its line reaches Claude at the lane's next turn no person starte wants the lines at once may start its session with its own options through `--settings`, which can set any key user settings can, including the plugin's `pluginConfigs` entry: `{"pluginConfigs": {"rate-limit-guard@": {"options": -{"rate_limit_report_mode": "automatic"}}}}` (a `--plugin-dir` copy is keyed `@inline`). +{"rate_limit_report_mode": "automatic"}}}}` (a `--plugin-dir` copy is keyed `@inline`). The `pluginConfigs` part of that is unverified +since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) +entry stopped naming `--settings` (as of 2026-10-07). - **Pointer**: [settings: change a setting for one session](https://code.claude.com/docs/en/settings#change-a-setting-for-one-session) and the `pluginConfigs` row of [mods reference: settings and environment variables](https://code.claude.com/docs/en/plugins/mods/reference#settings-and-environment-variables). - **As of**: 2026-10-03, Claude Code 2.1.288. -- **Recheck trigger**: either section changes the scope `pluginConfigs` is read from. +- **Recheck trigger**: either section changes the scope `pluginConfigs` is read from, the + `pluginConfigs` entry names `--settings` again, or a probe shows a `--settings` value read or + ignored. ### The /rate-limit-guard command, band row and status tool diff --git a/plugins/rate-limit-guard/hooks/hook-utils.sh b/plugins/rate-limit-guard/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/rate-limit-guard/hooks/hook-utils.sh +++ b/plugins/rate-limit-guard/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/rate-limit-guard/hooks/record-rate-limit-stop.sh b/plugins/rate-limit-guard/hooks/record-rate-limit-stop.sh index e2703a6b97..3fdb9af90e 100755 --- a/plugins/rate-limit-guard/hooks/record-rate-limit-stop.sh +++ b/plugins/rate-limit-guard/hooks/record-rate-limit-stop.sh @@ -3,7 +3,8 @@ # record when a turn ends on a rate-limit API error. # # SIDE-EFFECT-ONLY: the harness ignores StopFailure output and exit codes -# entirely (hooks reference, verified 2026-08-10), so this hook's one job is +# entirely (hooks reference, verified 2026-08-10; recheck when the StopFailure +# entry documents a decision field), so this hook's one job is # the record it appends — the reactive-fallback signal consumers read when the # module's snapshot carries no usable window data (see # ../reference/reader-contract.md). The payload carries no reset or quota diff --git a/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json b/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json index 6f6cbac8e7..3c334dbfbe 100644 --- a/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json +++ b/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "repo-fleet-hygiene", - "version": "0.28.5", + "version": "0.28.6", "description": "Cross-repository Git/GitHub fleet discovery, evidence rollup, a gated apply verb, and a sync verb that fast-forwards canonical checkouts onto the remote default branch. Audit stays read-only. apply and sync mutate only with --apply plus interactive confirmation or --yes.", "author": { "name": "Melodic Software", diff --git a/plugins/repo-fleet-hygiene/CHANGELOG.md b/plugins/repo-fleet-hygiene/CHANGELOG.md index fbfe1fd2ef..1d1518c244 100644 --- a/plugins/repo-fleet-hygiene/CHANGELOG.md +++ b/plugins/repo-fleet-hygiene/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to `repo-fleet-hygiene` are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.28.6] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.28.5] - 2026-10-07 ### Changed diff --git a/plugins/repo-hygiene/.claude-plugin/plugin.json b/plugins/repo-hygiene/.claude-plugin/plugin.json index 92e4978775..2ea1bb318d 100644 --- a/plugins/repo-hygiene/.claude-plugin/plugin.json +++ b/plugins/repo-hygiene/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "repo-hygiene", - "version": "0.19.11", + "version": "0.19.12", "description": "Repo hygiene action-router: /repo-hygiene:clean sweeps reclaimable caches, build artifacts, and stale git metadata, and can realign the working tree to a fresh-pull state, dry-run-first, with destructive tiers gated behind explicit confirmation and a session-scoped destructive-command guard. Ecosystem targets are detected at runtime; secrets, runtime dependencies, and skill data are preserved by default.", "author": { "name": "Melodic Software", diff --git a/plugins/repo-hygiene/CHANGELOG.md b/plugins/repo-hygiene/CHANGELOG.md index 3bbfe72dd8..467b1003c7 100644 --- a/plugins/repo-hygiene/CHANGELOG.md +++ b/plugins/repo-hygiene/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `repo-hygiene` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.19.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.19.11] - 2026-10-07 ### Changed diff --git a/plugins/repo-hygiene/skills/clean/scripts/clean-batch.sh b/plugins/repo-hygiene/skills/clean/scripts/clean-batch.sh index 1a5a9f5c2e..528d0ee695 100755 --- a/plugins/repo-hygiene/skills/clean/scripts/clean-batch.sh +++ b/plugins/repo-hygiene/skills/clean/scripts/clean-batch.sh @@ -138,7 +138,8 @@ fail_usage() { # the skill loads. An inherited value is used only when its last path segment # names this plugin (repo-hygiene-); otherwise the plan, and the # run.* pruning beside it, would land in another plugin's data dir. Basis: -# plugins reference, "Where each variable resolves", as of 2026-10-03. +# plugins reference, "Where each variable resolves", as of 2026-10-03; recheck +# when that section changes where ${CLAUDE_PLUGIN_DATA} substitutes. plugin_data_dir() { local seg if [[ -n "$DATA_DIR_ARG" ]]; then diff --git a/plugins/repo-hygiene/skills/setup/SKILL.md b/plugins/repo-hygiene/skills/setup/SKILL.md index 231bcaceed..bf72879ed1 100644 --- a/plugins/repo-hygiene/skills/setup/SKILL.md +++ b/plugins/repo-hygiene/skills/setup/SKILL.md @@ -87,8 +87,11 @@ Install nothing, and run no mutating tier. - Report the effective `${user_config.clean_destructive_guard_enabled}` (an unexpanded token or an empty value means the manifest default `true`). The rendered value is injected when this skill loads, so a change made now is observed only in a **fresh session**. - - The option is **user-scoped**: plugin option values are read from user, `--settings`, and - managed settings only, never from a project's `.claude/settings.json`. So there is no + - The option is **user-scoped**: plugin option values are read from user and managed + settings only, never from a project's `.claude/settings.json`. `--settings` is unverified + since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) + entry stopped naming it (as of 2026-10-07; recheck when the entry names `--settings` again or + a probe shows a `--settings` value read or ignored). So there is no per-repository value of this toggle. To vary the behavior for one repository, enable or disable the plugin in that project's `enabledPlugins` instead. diff --git a/plugins/repo-hygiene/skills/setup/evals/evals.json b/plugins/repo-hygiene/skills/setup/evals/evals.json index 351c6fd5e3..b5f4711b7a 100644 --- a/plugins/repo-hygiene/skills/setup/evals/evals.json +++ b/plugins/repo-hygiene/skills/setup/evals/evals.json @@ -58,11 +58,11 @@ "id": 5, "name": "per-repository-disable-is-enabledplugins-not-project-config", "prompt": "/repo-hygiene:setup — I want the destructive guard on everywhere except one repository. Add clean_destructive_guard_enabled=false to that project's settings for me.", - "expected_output": "Refuses both halves: setup writes no settings surface, and a project-scope value would be inert anyway — plugin option values are read from user, --settings, and managed settings only, so there is no per-repository value of this toggle. Routes the per-repository intent to disabling the plugin in that project's enabledPlugins instead.", + "expected_output": "Refuses both halves: setup writes no settings surface, and a project-scope value would be inert anyway — plugin option values are read from user and managed settings only, so there is no per-repository value of this toggle. Routes the per-repository intent to disabling the plugin in that project's enabledPlugins instead.", "files": [], "expectations": [ "Refuses to write the project's settings file, pluginConfigs, or any settings surface", - "States that plugin option values are read only from user, --settings, and managed settings — never from a project's .claude/settings.json — so a project-scope pluginConfigs entry for this option is inert", + "States that plugin option values are read only from user and managed settings — never from a project's .claude/settings.json — so a project-scope pluginConfigs entry for this option is inert", "Routes the per-repository intent to enabling or disabling the plugin in that project's enabledPlugins", "Does not offer a project-scope --config write as a working alternative" ] diff --git a/plugins/review/.claude-plugin/plugin.json b/plugins/review/.claude-plugin/plugin.json index 60da07e560..ae0cb2228e 100644 --- a/plugins/review/.claude-plugin/plugin.json +++ b/plugins/review/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "review", - "version": "0.42.4", + "version": "0.42.5", "description": "Code-review toolkit: nine agents, read-only over the reviewed code, plus orchestration skills for the quality gate, fan-out, and enforceability audit (/review:audit-enforceability), a pull-request change digest with an interactive view (/review:explain-change), a fan-out sweep workflow (/review:fanout-sweep), and CI lane commands (/review:code-review, /review:security-review) for org reusable workflows.", "author": { "name": "Melodic Software", diff --git a/plugins/review/CHANGELOG.md b/plugins/review/CHANGELOG.md index 2bde67d674..11476615e6 100644 --- a/plugins/review/CHANGELOG.md +++ b/plugins/review/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `review` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.42.5] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.42.4] - 2026-10-07 ### Changed diff --git a/plugins/review/README.md b/plugins/review/README.md index 7c37b0ebef..e523d4a833 100644 --- a/plugins/review/README.md +++ b/plugins/review/README.md @@ -138,8 +138,8 @@ Invoke via `@review:` or let Claude delegate. `code-review` marketplace plugin despite the shared name. **`/review` is one of them, not this plugin**: per [code-review](https://code.claude.com/docs/en/code-review#review-a-diff-locally) (fetched 2026-08-10), "`/review` is an alias of `/code-review`; before v2.1.223, it was a separate - command that ran a single-pass, read-only review of a GitHub pull request." A bare `/review` is - that bundled reviewer, so name this plugin's skills by their namespaced commands + command that ran a single-pass, read-only review of a GitHub pull request." Recheck when that + page changes the `/review` alias note. A bare `/review` is that bundled reviewer, so name this plugin's skills by their namespaced commands (`/review:quality-gate`, `/review:fanout`) rather than abbreviating to the plugin name. The 0.18.0 removal of the bare `/` alias already made the namespaced form the only one this plugin registers. See the Boundary sections of diff --git a/plugins/review/skills/audit-enforceability/context/crosswalk.md b/plugins/review/skills/audit-enforceability/context/crosswalk.md index 75954a3733..a4a0007cd7 100644 --- a/plugins/review/skills/audit-enforceability/context/crosswalk.md +++ b/plugins/review/skills/audit-enforceability/context/crosswalk.md @@ -50,7 +50,7 @@ detector is enabled again. The same gate and the same fallback bind the rule-fam | `testing/audit/rule-snapshot-only` | `defined-diagnostic` | `analyzer-pack-rule` | already deterministic: keep the `testing:audit` detector | as above | | `testing/audit/rule-weak-oracle` | `defined-diagnostic` | `analyzer-pack-rule` | already deterministic: keep the `testing:audit` detector | as above | | `testing/audit/rule-flaky-passes-suite` | `defined-diagnostic` | `analyzer-pack-rule` | already deterministic: keep the `testing:audit` detector | no analyzer pack reads Playwright `retries` against `failOnFlakyTests` (judgment), so the detector's config read stays the check | -| `testing/audit/rule-only-not-forbidden` | `defined-diagnostic` | `analyzer-pack-rule` | the project's ESLint config | eslint-plugin-playwright `no-focused-test` flags a committed `test.only` and `test.describe.only` (rule doc fetched 2026-09-29: https://github.com/playwright-community/eslint-plugin-playwright/blob/main/docs/rules/no-focused-test.md) | +| `testing/audit/rule-only-not-forbidden` | `defined-diagnostic` | `analyzer-pack-rule` | the project's ESLint config | eslint-plugin-playwright `no-focused-test` flags a committed `test.only` and `test.describe.only` (rule doc fetched 2026-09-29: https://github.com/playwright-community/eslint-plugin-playwright/blob/main/docs/rules/no-focused-test.md; recheck when that rule doc changes what it flags) | | `ai-slop/audit/rule-em-dash` | `defined-diagnostic` | `analyzer-pack-rule` | already deterministic: keep the `ai-slop:audit` detector | the producing detector is itself the deterministic check, so the cheapest rung is the one already running; hold its severity rather than rebuild it | | `ai-slop/audit/rule-emoji-formatting` | `defined-diagnostic` | `analyzer-pack-rule` | already deterministic: keep the `ai-slop:audit` detector | as above: the detector fires this rule from a pattern, not a judgment | | `ai-slop/audit/rule-curly-artifacts` | `defined-diagnostic` | `analyzer-pack-rule` | already deterministic: keep the `ai-slop:audit` detector | as above | diff --git a/plugins/ruff-format/.claude-plugin/plugin.json b/plugins/ruff-format/.claude-plugin/plugin.json index f5c50b6bd3..83205bd555 100644 --- a/plugins/ruff-format/.claude-plugin/plugin.json +++ b/plugins/ruff-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "ruff-format", - "version": "0.9.11", + "version": "0.9.12", "description": "Auto-format and lint Python on edit via Ruff, only when a Ruff config governs the repo, using the consuming repo's own Ruff config.", "author": { "name": "Melodic Software", diff --git a/plugins/ruff-format/CHANGELOG.md b/plugins/ruff-format/CHANGELOG.md index 3301c09aff..99455c1bdd 100644 --- a/plugins/ruff-format/CHANGELOG.md +++ b/plugins/ruff-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `ruff-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.9.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.9.11] - 2026-10-07 ### Changed diff --git a/plugins/ruff-format/hooks/hook-utils.sh b/plugins/ruff-format/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/ruff-format/hooks/hook-utils.sh +++ b/plugins/ruff-format/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/skill-quality/.claude-plugin/plugin.json b/plugins/skill-quality/.claude-plugin/plugin.json index b52d08b512..8ceffa9f2e 100644 --- a/plugins/skill-quality/.claude-plugin/plugin.json +++ b/plugins/skill-quality/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "skill-quality", - "version": "0.29.1", + "version": "0.29.2", "description": "Skill-authoring QA tooling (skill-quality:check): a static contract checker running twenty-nine deterministic checks over a Claude Code skill (frontmatter, invocation mode, description, listing cap, trigger keywords, line caps, broken refs, markdownlint, gotchas, evals), a shared skill-listing budget reporter, an evals.json schema with an eval-quality lint, and a measure-invocation harness that scores description auto-invocation probes on train and validation splits.", "author": { "name": "Melodic Software", diff --git a/plugins/skill-quality/CHANGELOG.md b/plugins/skill-quality/CHANGELOG.md index 7a0a51fef0..bcf481deaa 100644 --- a/plugins/skill-quality/CHANGELOG.md +++ b/plugins/skill-quality/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `skill-quality` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.29.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.29.1] - 2026-10-07 ### Changed diff --git a/plugins/songwriting/.claude-plugin/plugin.json b/plugins/songwriting/.claude-plugin/plugin.json index 318be2a0c5..f1b70e32ee 100644 --- a/plugins/songwriting/.claude-plugin/plugin.json +++ b/plugins/songwriting/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "songwriting", - "version": "1.6.5", + "version": "1.6.6", "description": "Songwriting craft companion: nine concern-scoped lyric-craft skills (workflow router, rhyme, object-writing, metaphor, meter-prosody, song-form, co-write, diagnose, practice) applying Pat Pattison's methods, with an object-writing agent that performs the sensory exercise itself and per-skill emission boundaries that route generation to the skill that owns it, plus Suno v5.5 prompt engineering (style prompts, tagged lyrics, genre templates, troubleshooting).", "author": { "name": "Melodic Software", diff --git a/plugins/songwriting/CHANGELOG.md b/plugins/songwriting/CHANGELOG.md index 0c2fc016ef..6da2124d2f 100644 --- a/plugins/songwriting/CHANGELOG.md +++ b/plugins/songwriting/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `songwriting` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [1.6.6] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [1.6.5] - 2026-10-04 ### Changed diff --git a/plugins/songwriting/context/pat-pattison/research/beyond-books.md b/plugins/songwriting/context/pat-pattison/research/beyond-books.md index 981b0ff989..ce48cfccb1 100644 --- a/plugins/songwriting/context/pat-pattison/research/beyond-books.md +++ b/plugins/songwriting/context/pat-pattison/research/beyond-books.md @@ -26,7 +26,7 @@ sources where verifiable. **Course:** *Songwriting*, taught by Pat Pattison via Coursera + Berklee Online. Available in English, Spanish, and Portuguese. -**URL:** (verified 2026-05-13, specialization page; individual `/learn/songwriting` course page returns 404 post-2026 restructure) +**URL:** (verified 2026-05-13, specialization page; individual `/learn/songwriting` course page returns 404 post-2026 restructure; recheck when Coursera restores that course page or changes the specialization's four-module format) **Enrollment:** 1.5M+ since 2013 **Format:** 4 modules, ~13 hours total @@ -59,7 +59,8 @@ Online. Available in English, Spanish, and Portuguese. ## Berklee Online: Pat's courses -Course codes verified via Berklee Online catalog (2026-05-10): +Course codes verified via Berklee Online catalog (2026-05-10; recheck when the catalog renumbers +or retitles a course listed here): | Code | Title | Notes | |---|---|---| @@ -132,7 +133,7 @@ replace. URL: The full set of Pat-authored short-form lyric tips on the official site, -verified 2026-05-10: +verified 2026-05-10 (recheck when the Lyric Tips page adds or removes a tip): | Tip | Distinctive content | |---|---| diff --git a/plugins/songwriting/context/pat-pattison/research/book-references.md b/plugins/songwriting/context/pat-pattison/research/book-references.md index 7ee56cfbf0..943f2fe370 100644 --- a/plugins/songwriting/context/pat-pattison/research/book-references.md +++ b/plugins/songwriting/context/pat-pattison/research/book-references.md @@ -203,7 +203,8 @@ four books: `front-heavy` / `back-heavy` are Pat's, coined in his patpattison.com column "The Art of Phrasing" (fetched and read 2026-08-11, -), which defines both: +; recheck when the column's wording changes or a +book edition adopts the terms), which defines both: > "We'll call phrases that start on the downbeat of a bar, or pick up to the > downbeat, front-heavy." diff --git a/plugins/songwriting/context/pat-pattison/research/lyric-melodic-roadmaps.md b/plugins/songwriting/context/pat-pattison/research/lyric-melodic-roadmaps.md index e4e35eb1b2..62c1e0429d 100644 --- a/plugins/songwriting/context/pat-pattison/research/lyric-melodic-roadmaps.md +++ b/plugins/songwriting/context/pat-pattison/research/lyric-melodic-roadmaps.md @@ -27,7 +27,9 @@ return **zero**. It is, however, genuinely Pat's, from outside the books. The article "Lyric and Melodic Phrases" was fetched and read on 2026-08-11 at -, and it uses "roadmap" + (recheck this and the quotes below +attributed to it or to "The Art of Phrasing" when either page's wording or numbered options +change), and it uses "roadmap" throughout as its governing metaphor. The "maximum meaning" quote below is **confirmed verbatim** against that page, and the three fixes below are **Pat's own numbered options**, not this file's invention. See that section. diff --git a/plugins/songwriting/context/pat-pattison/research/phrasing.md b/plugins/songwriting/context/pat-pattison/research/phrasing.md index 9d75115f16..557b057680 100644 --- a/plugins/songwriting/context/pat-pattison/research/phrasing.md +++ b/plugins/songwriting/context/pat-pattison/research/phrasing.md @@ -566,7 +566,8 @@ artifacts; verified against `raw/`. Do not correct them.) ## Front-heavy and back-heavy phrases -**Non-book material, and the source has now been READ (2026-08-11).** +**Non-book material, and the source has now been READ (2026-08-11; recheck when the column's +wording changes or a book edition adopts the terms).** "Front-heavy," "back-heavy" and "body language" return **zero hits across all four books**. That is because the frame is from Pat's patpattison.com column "The Art of Phrasing" (), which diff --git a/plugins/songwriting/context/pat-pattison/research/prosody.md b/plugins/songwriting/context/pat-pattison/research/prosody.md index 7325b0902e..1503ad7977 100644 --- a/plugins/songwriting/context/pat-pattison/research/prosody.md +++ b/plugins/songwriting/context/pat-pattison/research/prosody.md @@ -1262,7 +1262,8 @@ verbatim wording for the two title-targeting drills is given below because the ## Motion creates e-motion: the motion controllers -**The column has now been READ. Corrected 2026-08-11.** Fetched at +**The column has now been READ. Corrected 2026-08-11 (recheck when the column is revised to +enumerate controllers).** Fetched at (Pat Pattison, 17 October 2012). Chapters 18-19 do not contain a four-controller list, and **neither does the column.** What the column actually diff --git a/plugins/songwriting/context/pat-pattison/research/title-game.md b/plugins/songwriting/context/pat-pattison/research/title-game.md index 8b16ba6d13..0c4d9e1b01 100644 --- a/plugins/songwriting/context/pat-pattison/research/title-game.md +++ b/plugins/songwriting/context/pat-pattison/research/title-game.md @@ -3,7 +3,8 @@ Pat Pattison's documented Title Game exercise, used as a co-write warmup and as a solo title-generation drill. Source: Songwriter Trysts podcast episode 40 (verified web research 2026-05-10), the most detailed public -documentation of the mechanics. +documentation of the mechanics. Recheck when Pat documents the Title Game in a book or on +patpattison.com. > **Sourcing note.** The Title Game does **not** appear in *Writing > Better Lyrics* (2009) or *Songwriting Without Boundaries* (2011). An diff --git a/plugins/songwriting/skills/suno/context/v55-features.md b/plugins/songwriting/skills/suno/context/v55-features.md index dc4c716748..20617c74a7 100644 --- a/plugins/songwriting/skills/suno/context/v55-features.md +++ b/plugins/songwriting/skills/suno/context/v55-features.md @@ -118,7 +118,7 @@ Char-limit rows verified 2026-07-18 against third-party testers ([hookgenius cha - **Stem rows verified 2026-08-08** against . Free reads "No stem separation". Pro carries "2 stem separation types (Auto; Split from mix)"; Premier carries "3 stem separation types (… and Advanced split)". Auto Split / Split from Mix / Advanced Split are three **modes**, not track counts; Auto Split yields up to 12 stems. - Free-tier generation runs on **v4.5-all**, not v5.5 (third-party report: TechRadar). -**Recheck trigger:** Suno publishes a release note or blog post naming a model version after v5.5 (superseding the March 26 2026 baseline this file is pinned to), **or** `suno.com/pricing` changes any row in the Subscription tier matrix above (Voices, Custom Models, Studio, stem separation, audio upload), **or** `suno.com/release-notes` resolves the Free-plan Voices trial's missing `Web` tag one way or the other, **or** the hookgenius / aimusicapi character-limit consensus this file cites revises its figures, **or** an official Suno page states field-length limits directly. Not a date. +**Recheck trigger:** Suno publishes a release note or blog post naming a model version after v5.5 (superseding the March 26 2026 baseline this file is pinned to), **or** `suno.com/pricing` changes any row in the Subscription tier matrix above (Voices, Custom Models, Studio, stem separation, audio upload), **or** `suno.com/release-notes` resolves the Free-plan Voices trial's missing `Web` tag one way or the other, **or** the hookgenius / aimusicapi character-limit consensus this file cites revises its figures, **or** an official Suno page states field-length limits directly, **or** `help.suno.com` articles 11362369 or 11362305 change the Voices clip-length, privacy, or Custom Models figures cited above. Not a date. ## Sources diff --git a/plugins/songwriting/skills/suno/context/workflow-recipes.md b/plugins/songwriting/skills/suno/context/workflow-recipes.md index 78d69c3663..47514c8cb4 100644 --- a/plugins/songwriting/skills/suno/context/workflow-recipes.md +++ b/plugins/songwriting/skills/suno/context/workflow-recipes.md @@ -77,7 +77,8 @@ Suno documents none of these techniques. They are probabilistic rather than dete 8. (Optional) Stem export → external DAW for final mix 9. Export full mix -**Upload limits** (verified 2026-07-18 against ): +**Upload limits** (verified 2026-07-18 against ; recheck when that page +changes a tier's max upload): | Tier | Max upload | |------|-----------| diff --git a/plugins/source-control/README.md b/plugins/source-control/README.md index 26a87816f0..a5c6e54fae 100644 --- a/plugins/source-control/README.md +++ b/plugins/source-control/README.md @@ -341,7 +341,8 @@ fails when a gate feeds its payload to a reader by here-string. - **Node.js** on `PATH`. Every hook row launches through `node hooks/exec-bash.mjs`, and Claude Code's native binary neither ships nor uses Node - ([setup](https://code.claude.com/docs/en/setup), fetched 2026-09-29). Without `node` the hooks do + ([setup](https://code.claude.com/docs/en/setup), fetched 2026-09-29; recheck when the setup page + says the native binary ships or uses Node). Without `node` the hooks do not launch and the PR-linkage and worktree gates are not enforced. The setup `check` reports whether `node` resolves. @@ -492,8 +493,9 @@ distinct across concurrent instances; two lanes on one machine each need an expl opaque id if a machine name should not be published in a public tracker. **`promotion_evidence_binding`, `promotion_evidence_root`, `promotion_evidence_source`, -`promotion_evidence_checker`.** Each is honored from user, `--settings`, or managed plugin settings -only, never from `.claude/source-control.md` or any repository file. Contract: +`promotion_evidence_checker`.** Each is honored from user or managed plugin settings +only (`--settings` is unverified since the `pluginConfigs` entry stopped naming it, as of +2026-10-07), never from `.claude/source-control.md` or any repository file. Contract: [promotion-evidence-bootstrap.md](skills/babysit-loop/reference/promotion-evidence-bootstrap.md). The binding is the binding argument of the autonomy plugin's `check-security-binding.mjs`. The probe root is the protected evidence surface the seam resolves isolation probe transcripts against. diff --git a/plugins/source-control/hooks/hook-utils.sh b/plugins/source-control/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/source-control/hooks/hook-utils.sh +++ b/plugins/source-control/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/source-control/reference/config-resolution.md b/plugins/source-control/reference/config-resolution.md index 5838b84c21..676779114e 100644 --- a/plugins/source-control/reference/config-resolution.md +++ b/plugins/source-control/reference/config-resolution.md @@ -144,7 +144,10 @@ deliberate and both surfaces coexist: `userConfig` keeps the personal and machin babysit-prs mechanic documents (watched owners, self logins, engine thresholds); this surface holds the lane policy a team reviews and tracks. Because `pluginConfigs` is read from user settings, each `babysit_*` `userConfig` key has one value per machine: an operator with several identity domains -leaves those keys unset or launches the lane with a per-domain `--settings` file. Which keys stay in +leaves those keys unset or launches the lane with a per-domain `--settings` file (unverified for +plugin options since the `pluginConfigs` entry stopped naming the flag, as of 2026-10-07; recheck +when the entry names `--settings` again or a probe shows a `--settings` value read or ignored). +Which keys stay in `userConfig` and which move to this surface is recorded in [0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md](https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md). Loop keys carry the `babysit_loop_` prefix so the two key families sharing one file stay distinguishable. diff --git a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-bootstrap.md b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-bootstrap.md index eb5f4d610f..cae3ec30e2 100644 --- a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-bootstrap.md +++ b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-bootstrap.md @@ -26,7 +26,10 @@ config ([`setup/SKILL.md`](https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/plugins/autonomy/skills/setup/SKILL.md) "Agent-unwritable bootstrap for security resolution", not restated here). The lane receives their locations through the four plugin options below. Claude Code reads plugin options from user -settings, the `--settings` flag, and managed settings only, and ignores a project's +settings and managed settings only (the `--settings` flag is unverified since the +[`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped +naming it, as of 2026-10-07; recheck when the entry names it again or a probe shows a +`--settings` value read or ignored), and ignores a project's `.claude/settings.json` for them ([hook-config-delivery](https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/docs/conventions/hook-config-delivery/README.md) fact 5). The lane takes them from the option values substituted into the babysit-loop skill body @@ -48,8 +51,8 @@ stays unknown. Never put a secret in one of these options. The options say where a surface is; they do not make it unwritable. A user settings file is writable by any agent running as that user, so a location kept there is only as protected as that -file. Managed settings, or a `--settings` file the executor owns, keep the location out of the -agent's reach too. Whether a deployment meets the requirement is the operator's to establish. This +file. Managed settings keep the location out of the agent's reach too (a `--settings` file the +executor owns would, if the flag carries plugin options; that is unverified, see above). Whether a deployment meets the requirement is the operator's to establish. This file states the requirement and does not certify a deployment. ## The four surfaces @@ -160,8 +163,8 @@ absent. A set value is compliant only when it is: - **Claim:** the checker takes the binding document, `--evidence`, and `--probe-evidence-root` on one usage line. With no root, every L2/L3 entry is unproven under a reason beginning `no --probe-evidence-root configured`. An evidence file that is unreadable or not a JSON array - resolves every cell effective-unpromoted. Plugin options are read only from user settings, - `--settings`, and managed settings, a repository's `env` block can populate the + resolves every cell effective-unpromoted. Plugin options are read only from user settings + and managed settings (`--settings` is unverified, see above), a repository's `env` block can populate the `CLAUDE_PLUGIN_OPTION_*` variable of an unset option, and a skill body's option placeholders substitute into model-visible content, non-sensitive values only. - **Basis:** `plugins/autonomy/skills/setup/scripts/check-security-binding.mjs` (`Usage:` comment, diff --git a/plugins/source-control/skills/pull-request/scripts/fetch-failed-logs.sh b/plugins/source-control/skills/pull-request/scripts/fetch-failed-logs.sh index 11b4b67a40..678e22205b 100755 --- a/plugins/source-control/skills/pull-request/scripts/fetch-failed-logs.sh +++ b/plugins/source-control/skills/pull-request/scripts/fetch-failed-logs.sh @@ -332,7 +332,8 @@ if ! unzip -q "$ZIP_PATH" -d "$EXTRACT_DIR" 2>/dev/null; then exit 4 fi -# Real GitHub Actions ZIP layout (verified 2026-05-08 against run 25505236665): +# Real GitHub Actions ZIP layout (verified 2026-05-08 against run 25505236665; +# recheck when GitHub changes the run-log archive layout): # TOP-LEVEL: _.txt consolidated step log (errors live here) # PER-JOB: /system.txt agent metadata only # Errors appear in the top-level consolidated files. Walk all *.txt recursively diff --git a/plugins/source-control/skills/worktree/context/create.md b/plugins/source-control/skills/worktree/context/create.md index 4e24069eba..5705459ed5 100644 --- a/plugins/source-control/skills/worktree/context/create.md +++ b/plugins/source-control/skills/worktree/context/create.md @@ -84,7 +84,7 @@ Two steps: the helper creates and places the worktree; `EnterWorktree(path:)` en 1. **Run the shared helper** (it computes the external path, runs `git worktree add`, arms the `git worktree lock` liveness guard with a reason naming the helper, host, and start time, so a cleanup sweep sees the worktree as claimed and plain `git worktree remove` refuses it, and copies `.worktreeinclude` files). Add `--base-ref head` only when the effective Claude `worktree.baseRef` setting is `head` (see [Base branch](#base-branch)); otherwise omit it. - Treat `${user_config.worktree_root}` substitution into skill content as **raw text, not shell-escaped**. That is this plugin's reading, not a quoted doc span: [plugin manifest reference § Reference a saved value](https://code.claude.com/docs/en/plugins/manifest-reference#reference-a-saved-value) (fetched 2026-10-07, quoted with link markup removed) says `${user_config.KEY}` is "substituted in MCP server config, LSP server config, exec-form hook `args`, and skill and agent content" and documents no escaping for it, and [§ Fields that run through a shell](https://code.claude.com/docs/en/plugins/manifest-reference#fields-that-run-through-a-shell) has shell-form hook commands, monitor commands, and `headersHelper` reject `${user_config.*}` "because the field's value is passed to a shell that would re-parse the substituted value". Skill content gets no such guard. A configured value containing a single quote (e.g. `~/worktrees/O'Connor`), `$`, or a backtick breaks out of any shell literal we write around it, and **no heredoc delimiter is safe either**: a value whose own body contains a line equal to the delimiter ends the heredoc early and the shell parses the remainder as commands. The value must therefore never reach a shell parser at all. Write it with the **`Write` tool**: the content travels as a JSON string parameter, so every byte lands verbatim and no delimiter, quote, or metacharacter can terminate anything. Then hand the file to `--fallback-root-file` (the machine-global plugin-option rung). Never inline the substitution in a `--root` / `--fallback-root` shell literal or a heredoc body. Explicit `--root`/`--root-file` remains for per-invocation overrides; the skill's plugin option must not use that rung, or it would outrank `worktreeroot.path` ([reference/worktree-root-convention.md](../../../reference/worktree-root-convention.md)). + Treat `${user_config.worktree_root}` substitution into skill content as **raw text, not shell-escaped**. That is this plugin's reading, not a quoted doc span: [plugin manifest reference § Reference a saved value](https://code.claude.com/docs/en/plugins/manifest-reference#reference-a-saved-value) (fetched 2026-10-07, quoted with link markup removed; recheck when that section documents escaping for `${user_config.*}` in skill content) says `${user_config.KEY}` is "substituted in MCP server config, LSP server config, exec-form hook `args`, and skill and agent content" and documents no escaping for it, and [§ Fields that run through a shell](https://code.claude.com/docs/en/plugins/manifest-reference#fields-that-run-through-a-shell) has shell-form hook commands, monitor commands, and `headersHelper` reject `${user_config.*}` "because the field's value is passed to a shell that would re-parse the substituted value". Skill content gets no such guard. A configured value containing a single quote (e.g. `~/worktrees/O'Connor`), `$`, or a backtick breaks out of any shell literal we write around it, and **no heredoc delimiter is safe either**: a value whose own body contains a line equal to the delimiter ends the heredoc early and the shell parses the remainder as commands. The value must therefore never reach a shell parser at all. Write it with the **`Write` tool**: the content travels as a JSON string parameter, so every byte lands verbatim and no delimiter, quote, or metacharacter can terminate anything. Then hand the file to `--fallback-root-file` (the machine-global plugin-option rung). Never inline the substitution in a `--root` / `--fallback-root` shell literal or a heredoc body. Explicit `--root`/`--root-file` remains for per-invocation overrides; the skill's plugin option must not use that rung, or it would outrank `worktreeroot.path` ([reference/worktree-root-convention.md](../../../reference/worktree-root-convention.md)). Four steps: diff --git a/plugins/speech/.claude-plugin/plugin.json b/plugins/speech/.claude-plugin/plugin.json index b75cbef302..99b0e10d8b 100644 --- a/plugins/speech/.claude-plugin/plugin.json +++ b/plugins/speech/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "speech", - "version": "0.2.9", + "version": "0.2.10", "description": "Text-to-speech narration. The narrate skill turns a script into narration.wav plus words.json, a start and end time for every word. The default kokoro backend runs Kokoro-82M locally with onnxruntime. The optional elevenlabs backend sends the text to the third-party ElevenLabs API (ELEVENLABS_API_KEY) after showing a cost estimate; an organization can forbid it. You install espeak-ng (GPL-3.0). A hook installs the Python packages; setup downloads the models; check reports missing prerequisites.", "author": { "name": "Melodic Software", diff --git a/plugins/speech/CHANGELOG.md b/plugins/speech/CHANGELOG.md index ee95879d6a..1eb4145840 100644 --- a/plugins/speech/CHANGELOG.md +++ b/plugins/speech/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `speech` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.2.10] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.2.9] - 2026-10-07 ### Changed diff --git a/plugins/speech/hooks/hook-utils.sh b/plugins/speech/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/speech/hooks/hook-utils.sh +++ b/plugins/speech/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/testing/hooks/hook-utils.sh b/plugins/testing/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/testing/hooks/hook-utils.sh +++ b/plugins/testing/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/typos-format/.claude-plugin/plugin.json b/plugins/typos-format/.claude-plugin/plugin.json index dba13f79bc..2b128580a4 100644 --- a/plugins/typos-format/.claude-plugin/plugin.json +++ b/plugins/typos-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "typos-format", - "version": "0.9.11", + "version": "0.9.12", "description": "Spell-check on edit via typos-cli, unconditionally. Report-only by default, honoring the consuming repo's own typos configuration when one is present.", "author": { "name": "Melodic Software", diff --git a/plugins/typos-format/CHANGELOG.md b/plugins/typos-format/CHANGELOG.md index 01cef34d53..298af641b9 100644 --- a/plugins/typos-format/CHANGELOG.md +++ b/plugins/typos-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `typos-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.9.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.9.11] - 2026-10-07 ### Changed diff --git a/plugins/typos-format/hooks/hook-utils.sh b/plugins/typos-format/hooks/hook-utils.sh index f1bc3abe68..fa60ac5eeb 100644 --- a/plugins/typos-format/hooks/hook-utils.sh +++ b/plugins/typos-format/hooks/hook-utils.sh @@ -1014,7 +1014,8 @@ hook::in_git_working_tree() { # TRACKED file matching an ignore pattern reads as not ignored: a file under # version control is part of the reviewable artifact whatever the patterns say. # Exit 0 = ignored, 1 = not ignored, 128 = error; only 0 answers true. -# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28) +# https://git-scm.com/docs/git-check-ignore (fetched 2026-09-28; recheck when +# that page changes the exit codes or the tracked-file behavior without --no-index) # # FAILS TOWARD ACTING. Git absent, the directory gone, no repository, or a # check-ignore error all answer false, so the hook runs as before. A skip that @@ -4254,6 +4255,8 @@ hook::git_invocation() { # `alias.bugreport = commit` cannot slip through. git 2.51+ honors # `alias.whatchanged = commit` (t/t0014-alias.sh). A name not listed here is # still probed: skipping a non-builtin would miss a real alias. +# Recheck when the git-config page stops saying aliases that hide builtins are +# ignored, or git.c marks another command DEPRECATED. hook::git_subcommand_ignores_alias() { case "$1" in add | am | annotate | apply | archive | bisect | blame | branch | bundle | \ diff --git a/plugins/typos-format/hooks/typos-format.sh b/plugins/typos-format/hooks/typos-format.sh index ac683865f2..b3dfe868d8 100755 --- a/plugins/typos-format/hooks/typos-format.sh +++ b/plugins/typos-format/hooks/typos-format.sh @@ -183,7 +183,9 @@ fi # passed to a shell that would re-parse the substituted value" — and every # option is exported to hook processes as CLAUDE_PLUGIN_OPTION_ anyway # (plugin manifest reference, https://code.claude.com/docs/en/plugins/manifest-reference#fields-that-run-through-a-shell, -# re-fetched 2026-10-07). +# re-fetched 2026-10-07). Recheck when the manifest reference changes how +# `${user_config.*}` is handled in shell-form hook commands, or stops exporting +# every option as CLAUDE_PLUGIN_OPTION_. # Same idiom as the hoisted kill switch at the top. Only the literal "true" # means write — the mutating direction must be the one that needs the exact # opt-in spelling, so a typo'd or half-set option value stays report-only. diff --git a/plugins/user-interface/.claude-plugin/plugin.json b/plugins/user-interface/.claude-plugin/plugin.json index 3274fe52b1..ef9cc98785 100644 --- a/plugins/user-interface/.claude-plugin/plugin.json +++ b/plugins/user-interface/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "user-interface", - "version": "0.1.3", + "version": "0.1.4", "description": "Front door for interface design: terminal and CLI output, TUIs, prompt themes, Claude Code mods, web and app UI. design detects the project's own design system and the design tools installed, routes each concern to the best present source with the project first, and supplies its own guidance where nothing covers the concern. Terminal guidance is its own contribution.", "author": { "name": "Melodic Software", diff --git a/plugins/user-interface/CHANGELOG.md b/plugins/user-interface/CHANGELOG.md index 31e0280c36..9a86f9ba08 100644 --- a/plugins/user-interface/CHANGELOG.md +++ b/plugins/user-interface/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `user-interface` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.1.4] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. + ## [0.1.3] - 2026-10-07 ### Changed diff --git a/plugins/visualization/.claude-plugin/plugin.json b/plugins/visualization/.claude-plugin/plugin.json index 5792af30c1..9b7df27683 100644 --- a/plugins/visualization/.claude-plugin/plugin.json +++ b/plugins/visualization/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "visualization", - "version": "0.11.5", + "version": "0.11.6", "description": "Visualization skills. visualize picks the form (mermaid diagram, markdown table, SVG/CSS chart, ASCII/Unicode art, or a rendered page) and the medium (terminal, local HTML file, or published Artifact) for what is in the conversation, asking only when the target is ambiguous. present builds a slide deck from the account's claude.ai Slides Artifact type behind a publish gate, with a markdown outline as the record. Chart craft and artifact design route to those capabilities when installed.", "author": { "name": "Melodic Software", diff --git a/plugins/visualization/CHANGELOG.md b/plugins/visualization/CHANGELOG.md index ed3047d035..838be789ea 100644 --- a/plugins/visualization/CHANGELOG.md +++ b/plugins/visualization/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `visualization` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.11.6] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.11.5] - 2026-10-07 ### Changed diff --git a/plugins/visualization/skills/visualize/context/decision-matrix.md b/plugins/visualization/skills/visualize/context/decision-matrix.md index d3d01cf9c4..32e9340304 100644 --- a/plugins/visualization/skills/visualize/context/decision-matrix.md +++ b/plugins/visualization/skills/visualize/context/decision-matrix.md @@ -232,7 +232,8 @@ owned by the plugin README's future-change section. ## Sources and verification Verified 2026-07-22 via a research fan-out over official documentation; re-fetch -before relying on a time-sensitive detail. +before relying on a time-sensitive detail, and recheck when the interactive-mode page changes +what terminal Markdown rendering covers. - Terminal Markdown rendering (code-block syntax highlighting, hyperlinks): `https://code.claude.com/docs/en/interactive-mode.md`. diff --git a/plugins/work-items/.claude-plugin/plugin.json b/plugins/work-items/.claude-plugin/plugin.json index a1c7e8e5e0..b13fc499e4 100644 --- a/plugins/work-items/.claude-plugin/plugin.json +++ b/plugins/work-items/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "work-items", - "version": "0.49.7", + "version": "0.49.8", "description": "Work items through a provider-neutral tracker seam (github, local-markdown, jira, gitea, linear adapters): track (dashboard, creation, race-safe claims, recurring-schedule checks, stale-lease audits), scan-todos, decompose (plans into vertical-slice items), ship (route a spec container), triage (raw intake and unsolicited PRs), work, work-loop (autonomous PR-only drain), attend-queue (escalations), onboard-adapter (new tracker adapter), and setup (binds the provider).", "author": { "name": "Melodic Software", diff --git a/plugins/work-items/CHANGELOG.md b/plugins/work-items/CHANGELOG.md index cd97d449e4..cab7246aec 100644 --- a/plugins/work-items/CHANGELOG.md +++ b/plugins/work-items/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `work-items` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.49.8] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.49.7] - 2026-10-07 ### Changed diff --git a/plugins/work-items/reference/permission-preflight.md b/plugins/work-items/reference/permission-preflight.md index 7036f32bd0..76e9022f40 100644 --- a/plugins/work-items/reference/permission-preflight.md +++ b/plugins/work-items/reference/permission-preflight.md @@ -111,7 +111,9 @@ floor, whose destructive-verb rules are flag-scoped (`git push --force …`) rat **resolved through worktrees to the main checkout**, and the rule applies to sessions anywhere in that repository, every linked worktree included, however the worktree was created ([permissions](https://code.claude.com/docs/en/permissions#permission-system), -[worktrees](https://code.claude.com/docs/en/worktrees); both fetched 2026-08-10). The main +[worktrees](https://code.claude.com/docs/en/worktrees); both fetched 2026-08-10; recheck when +either page changes where "Yes, don't ask again" saves the rule or how it resolves through +worktrees). The main checkout's local file is therefore part of a fresh worker worktree's effective settings, and the preflight reads it in **every** mode, but only once it has **verified** which directory that is. diff --git a/scripts/check-killswitch-hoist.sh b/scripts/check-killswitch-hoist.sh index 26feb1f86b..566a08baff 100755 --- a/scripts/check-killswitch-hoist.sh +++ b/scripts/check-killswitch-hoist.sh @@ -190,6 +190,8 @@ done # async row on those four is still scanned. SessionStart is scanned: that page # says only that "Exit code 2 isn't honored for this event", and nowhere that a # SessionStart hook runs in the background or does not delay the session. +# Recheck when that section changes the list of events that ignore `async: true` +# or says a SessionStart hook can run without delaying the session. SYNC_ONLY_EVENTS=" UserPromptSubmit UserPromptExpansion PreModelSwitch MessageDisplay " blocking=() unreadable=() diff --git a/scripts/check-silent-skips.sh b/scripts/check-silent-skips.sh index dc8c4c8eb3..718a328634 100755 --- a/scripts/check-silent-skips.sh +++ b/scripts/check-silent-skips.sh @@ -41,6 +41,8 @@ # to the debug log only, never the transcript, and Claude never sees it" — so # it reaches neither the user nor the agent on any path this gate inspects. # A `>&2`-only notice on such a path is invisible regardless of intent. +# Recheck when the hooks reference says exit-0 stderr reaches the transcript or +# the model. # # This is a grep-level tripwire, not a semantic proof: it does not chase # helper-function bodies and does not flag a positive-form diff --git a/scripts/dependabot-plugin-bump.sh b/scripts/dependabot-plugin-bump.sh index bec88800bb..6e16e9fdd3 100755 --- a/scripts/dependabot-plugin-bump.sh +++ b/scripts/dependabot-plugin-bump.sh @@ -17,6 +17,8 @@ # - Claude Code plugin version delivery (code.claude.com/docs/en/plugins/loading) # - scripts/check-changelog-parity.sh --check-bump (never relaxes for bots) # - Tracker consensus: keep the gate; generalize dependabot-miro-bundle.yml +# Recheck when the GitHub page stops naming [dependabot skip] or the Claude +# Code plugin-loading page stops tying update delivery to the version string. set -euo pipefail SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" From aaae6c646e4c046f0006182fd1f05104f00dfa99 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:30:21 -0400 Subject: [PATCH 3/9] docs(harness-ops): name the live plugin pages in two remaining citations Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EC7nAKxQg52rCug6r6tYfe --- .../skills/audit-install-state/reference/name-schemes.md | 6 +++--- plugins/harness-ops/skills/plugins/context/gotchas.md | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/plugins/harness-ops/skills/audit-install-state/reference/name-schemes.md b/plugins/harness-ops/skills/audit-install-state/reference/name-schemes.md index dc4a71853f..99d4c91259 100644 --- a/plugins/harness-ops/skills/audit-install-state/reference/name-schemes.md +++ b/plugins/harness-ops/skills/audit-install-state/reference/name-schemes.md @@ -49,10 +49,10 @@ the default is what keeps the engine correct on an install it has never seen. marker per enabled plugin version, all carrying the same PID for one session. - **Basis.** The Claude Code CHANGELOG (entry 2.1.169) calls these files `.in_use` PID lock files and describes a daily sweep of stale markers from crashed sessions; on every audited tree the - number matched the live session's PID. No docs page (claude-directory.md, plugins-reference.md, - plugin-marketplaces.md) carries a row. + number matched the live session's PID. No docs page (claude-directory.md, plugins/manifest-reference.md, + plugins/create-marketplace.md) carries a row. - **As of.** 2026-09-11, Claude Code 2.1.268. -- **Recheck trigger.** claude-directory.md or plugins-reference.md gains an `.in_use` row, or the +- **Recheck trigger.** claude-directory.md or plugins/manifest-reference.md gains an `.in_use` row, or the CHANGELOG names the file again. Because a plugin cache holds one marker per enabled version, the engine groups `pid_typed` rows by diff --git a/plugins/harness-ops/skills/plugins/context/gotchas.md b/plugins/harness-ops/skills/plugins/context/gotchas.md index 2e5da26f45..16ae3d8f40 100644 --- a/plugins/harness-ops/skills/plugins/context/gotchas.md +++ b/plugins/harness-ops/skills/plugins/context/gotchas.md @@ -282,7 +282,7 @@ for the uninstall of every plugin installed from a marketplace removed from its and `claude plugin marketplace remove --help`, which lists `--scope` and nothing else. *As of* 2026-09-07 on **Claude Code 2.1.263** (win32), with the same bundle strings present in 2.1.260 and 2.1.261, so the behavior is not version-gated. ***Recheck trigger:*** any release note or -`plugin-marketplaces` / `plugins-reference` change touching marketplace removal, `--keep-data`, the +`plugins/cli-reference` / `plugins/marketplace-reference` / `plugins/manifest-reference` change touching marketplace removal, `--keep-data`, the persistent data directory, or the settings cleanup cascade; or a keep-data flag appearing on `claude plugin marketplace remove --help`. From c5c9dbe6b4b01d182c8251575f0d5c0fb54799a3 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:39:50 -0400 Subject: [PATCH 4/9] fix(autonomy,github): keep the org name out of the changelog entries Both plugins forbid naming the org or fleet repos; cite the issue by number. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EC7nAKxQg52rCug6r6tYfe --- plugins/autonomy/CHANGELOG.md | 2 +- plugins/github/CHANGELOG.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/autonomy/CHANGELOG.md b/plugins/autonomy/CHANGELOG.md index 4012cc1e1d..05dcc08c76 100644 --- a/plugins/autonomy/CHANGELOG.md +++ b/plugins/autonomy/CHANGELOG.md @@ -7,7 +7,7 @@ All notable changes to the `autonomy` plugin are documented here. Format follows ### Changed -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. +- **Upstream records (#6498).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. ## [0.26.12] - 2026-10-07 diff --git a/plugins/github/CHANGELOG.md b/plugins/github/CHANGELOG.md index 407bbe3a0d..9a42050ddc 100644 --- a/plugins/github/CHANGELOG.md +++ b/plugins/github/CHANGELOG.md @@ -7,7 +7,7 @@ All notable changes to the `github` plugin are documented here. Format follows ### Changed -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. +- **Upstream records (#6498).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. ## [0.3.31] - 2026-10-07 From 0fa74aed5864dc2e9ef59077d8c59f7f463431fc Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:41:31 -0400 Subject: [PATCH 5/9] docs(disk-hygiene): cite settings-reference#pluginconfigs in the guard docstring Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EC7nAKxQg52rCug6r6tYfe --- plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py b/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py index b1dad69298..f17a193bb4 100755 --- a/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py +++ b/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py @@ -1282,7 +1282,8 @@ def resolve_disk_hygiene_enabled() -> bool: reader it shares with the report-only probe) — never the process environment. Since Claude Code 2.1.207 that key is honored only from user and managed scope, never a project or local ``settings.json`` - (plugins-reference, "User configuration"), so a hostile repo cannot flip the + (https://code.claude.com/docs/en/settings-reference#pluginconfigs, as of + 2026-10-07), so a hostile repo cannot flip the switch. Managed settings are the highest-precedence, non-overridable scope, so a value configured there wins over the user file — that is how an organization enforces audit-only mode. The ``--settings`` file is a session CLI flag a hook From 6620ebd5ad6ba4277d1005abb24d735c99f7b3f6 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 13:07:17 -0400 Subject: [PATCH 6/9] docs: restore --settings as a plugin-option source in the generated README text The settings guide (change-a-setting-for-one-session, as of 2026-10-07) says --settings can set any key user settings can set, and pluginConfigs is a user-scope key. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EC7nAKxQg52rCug6r6tYfe --- plugins/actionlint/README.md | 8 ++++---- plugins/ai-briefing/README.md | 8 ++++---- plugins/animation/README.md | 8 ++++---- plugins/autonomy/README.md | 8 ++++---- plugins/bash-format/README.md | 8 ++++---- plugins/biome-format/README.md | 8 ++++---- plugins/bugs/README.md | 8 ++++---- plugins/code-tidying/README.md | 8 ++++---- plugins/context-budget/README.md | 8 ++++---- plugins/context-guard/README.md | 8 ++++---- plugins/desktop-notification/README.md | 8 ++++---- plugins/discipline/README.md | 8 ++++---- plugins/disk-hygiene/README.md | 8 ++++---- plugins/dometrain-mcp/README.md | 8 ++++---- plugins/education/README.md | 8 ++++---- plugins/eol-normalizer/README.md | 8 ++++---- plugins/evals/README.md | 8 ++++---- plugins/gaming/README.md | 8 ++++---- plugins/github/README.md | 8 ++++---- plugins/go-format/README.md | 8 ++++---- plugins/guardrails/README.md | 8 ++++---- plugins/harness-ops/README.md | 8 ++++---- plugins/implementation/README.md | 8 ++++---- plugins/instruction-placement/README.md | 8 ++++---- plugins/knowledge/README.md | 8 ++++---- plugins/machine-health/README.md | 8 ++++---- plugins/markdown-format/README.md | 8 ++++---- plugins/miro/README.md | 8 ++++---- plugins/pixel-art/README.md | 8 ++++---- plugins/planning/README.md | 8 ++++---- plugins/powershell-format/README.md | 8 ++++---- plugins/rate-limit-guard/README.md | 8 ++++---- plugins/repo-hygiene/README.md | 8 ++++---- plugins/ruff-format/README.md | 8 ++++---- plugins/session-flow/README.md | 8 ++++---- plugins/skill-quality/README.md | 8 ++++---- plugins/source-control/README.md | 8 ++++---- plugins/testing/README.md | 8 ++++---- plugins/typos-format/README.md | 8 ++++---- plugins/user-interface/README.md | 8 ++++---- plugins/visualization/README.md | 8 ++++---- plugins/work-items/README.md | 8 ++++---- scripts/sync-plugin-options-docs.py | 8 ++++---- 43 files changed, 172 insertions(+), 172 deletions(-) diff --git a/plugins/actionlint/README.md b/plugins/actionlint/README.md index 5f20cbe8a4..acfc8ba672 100644 --- a/plugins/actionlint/README.md +++ b/plugins/actionlint/README.md @@ -172,10 +172,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/ai-briefing/README.md b/plugins/ai-briefing/README.md index 611bc757b3..f2fccc433c 100644 --- a/plugins/ai-briefing/README.md +++ b/plugins/ai-briefing/README.md @@ -135,10 +135,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/animation/README.md b/plugins/animation/README.md index 26bbe488a5..d065db9ebb 100644 --- a/plugins/animation/README.md +++ b/plugins/animation/README.md @@ -122,10 +122,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/autonomy/README.md b/plugins/autonomy/README.md index 15d0bdac35..6928b6ad86 100644 --- a/plugins/autonomy/README.md +++ b/plugins/autonomy/README.md @@ -317,10 +317,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/bash-format/README.md b/plugins/bash-format/README.md index fb1b95eb78..778a66ee31 100644 --- a/plugins/bash-format/README.md +++ b/plugins/bash-format/README.md @@ -231,10 +231,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/biome-format/README.md b/plugins/biome-format/README.md index 1c11d1aaaf..d0193a5ba6 100644 --- a/plugins/biome-format/README.md +++ b/plugins/biome-format/README.md @@ -178,10 +178,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/bugs/README.md b/plugins/bugs/README.md index 09a57e3d8c..8bcf4423d1 100644 --- a/plugins/bugs/README.md +++ b/plugins/bugs/README.md @@ -174,10 +174,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/code-tidying/README.md b/plugins/code-tidying/README.md index 72f3c0ba16..c449542eb5 100644 --- a/plugins/code-tidying/README.md +++ b/plugins/code-tidying/README.md @@ -232,10 +232,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/context-budget/README.md b/plugins/context-budget/README.md index b445ba2d4c..216ff13172 100644 --- a/plugins/context-budget/README.md +++ b/plugins/context-budget/README.md @@ -194,10 +194,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/context-guard/README.md b/plugins/context-guard/README.md index cc299359d3..3020926e0a 100644 --- a/plugins/context-guard/README.md +++ b/plugins/context-guard/README.md @@ -371,10 +371,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/desktop-notification/README.md b/plugins/desktop-notification/README.md index 0f353f63a3..1d7e448800 100644 --- a/plugins/desktop-notification/README.md +++ b/plugins/desktop-notification/README.md @@ -148,10 +148,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/discipline/README.md b/plugins/discipline/README.md index 4a45e8d139..521541cf82 100644 --- a/plugins/discipline/README.md +++ b/plugins/discipline/README.md @@ -501,10 +501,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/disk-hygiene/README.md b/plugins/disk-hygiene/README.md index 70f90579a5..d82aef084a 100644 --- a/plugins/disk-hygiene/README.md +++ b/plugins/disk-hygiene/README.md @@ -646,10 +646,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/dometrain-mcp/README.md b/plugins/dometrain-mcp/README.md index 5b6c97ccd9..2700975f80 100644 --- a/plugins/dometrain-mcp/README.md +++ b/plugins/dometrain-mcp/README.md @@ -248,10 +248,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/education/README.md b/plugins/education/README.md index 236462abfe..94c942838c 100644 --- a/plugins/education/README.md +++ b/plugins/education/README.md @@ -184,10 +184,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/eol-normalizer/README.md b/plugins/eol-normalizer/README.md index 8f9c3aad4f..22e07b7101 100644 --- a/plugins/eol-normalizer/README.md +++ b/plugins/eol-normalizer/README.md @@ -165,10 +165,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/evals/README.md b/plugins/evals/README.md index 18fa1483c4..c3356103d1 100644 --- a/plugins/evals/README.md +++ b/plugins/evals/README.md @@ -156,10 +156,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/gaming/README.md b/plugins/gaming/README.md index 8959a84d58..86a86b2d25 100644 --- a/plugins/gaming/README.md +++ b/plugins/gaming/README.md @@ -151,10 +151,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/github/README.md b/plugins/github/README.md index 12375e88aa..ab9f4da8bb 100644 --- a/plugins/github/README.md +++ b/plugins/github/README.md @@ -132,10 +132,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/go-format/README.md b/plugins/go-format/README.md index 8879db7051..67df458b4f 100644 --- a/plugins/go-format/README.md +++ b/plugins/go-format/README.md @@ -185,10 +185,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/guardrails/README.md b/plugins/guardrails/README.md index a39dbf0833..7f4cc93f18 100644 --- a/plugins/guardrails/README.md +++ b/plugins/guardrails/README.md @@ -1588,10 +1588,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/harness-ops/README.md b/plugins/harness-ops/README.md index cf246c319c..e35a7de200 100644 --- a/plugins/harness-ops/README.md +++ b/plugins/harness-ops/README.md @@ -523,10 +523,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/implementation/README.md b/plugins/implementation/README.md index 2cb057d275..0e243f1f20 100644 --- a/plugins/implementation/README.md +++ b/plugins/implementation/README.md @@ -196,10 +196,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/instruction-placement/README.md b/plugins/instruction-placement/README.md index 7b981a35e2..402f5e6f7b 100644 --- a/plugins/instruction-placement/README.md +++ b/plugins/instruction-placement/README.md @@ -257,10 +257,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/knowledge/README.md b/plugins/knowledge/README.md index 9021072eee..59dd76e2f0 100644 --- a/plugins/knowledge/README.md +++ b/plugins/knowledge/README.md @@ -162,10 +162,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/machine-health/README.md b/plugins/machine-health/README.md index 9aabb27071..89d9607a63 100644 --- a/plugins/machine-health/README.md +++ b/plugins/machine-health/README.md @@ -140,10 +140,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/markdown-format/README.md b/plugins/markdown-format/README.md index e93e0b1a58..c696936b81 100644 --- a/plugins/markdown-format/README.md +++ b/plugins/markdown-format/README.md @@ -322,10 +322,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/miro/README.md b/plugins/miro/README.md index 1baf396c14..d8d824b50a 100644 --- a/plugins/miro/README.md +++ b/plugins/miro/README.md @@ -223,10 +223,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/pixel-art/README.md b/plugins/pixel-art/README.md index a8691b33db..527a6779a1 100644 --- a/plugins/pixel-art/README.md +++ b/plugins/pixel-art/README.md @@ -159,10 +159,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/planning/README.md b/plugins/planning/README.md index bde479b685..7a07aa09c1 100644 --- a/plugins/planning/README.md +++ b/plugins/planning/README.md @@ -156,10 +156,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/powershell-format/README.md b/plugins/powershell-format/README.md index 1dbbf66bc2..e4a43d9acc 100644 --- a/plugins/powershell-format/README.md +++ b/plugins/powershell-format/README.md @@ -209,10 +209,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/rate-limit-guard/README.md b/plugins/rate-limit-guard/README.md index 370d1d64b8..53fa4c587c 100644 --- a/plugins/rate-limit-guard/README.md +++ b/plugins/rate-limit-guard/README.md @@ -329,10 +329,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/repo-hygiene/README.md b/plugins/repo-hygiene/README.md index 44543b9a43..cc9eeff9e1 100644 --- a/plugins/repo-hygiene/README.md +++ b/plugins/repo-hygiene/README.md @@ -184,10 +184,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/ruff-format/README.md b/plugins/ruff-format/README.md index 135b47f90a..657d93339f 100644 --- a/plugins/ruff-format/README.md +++ b/plugins/ruff-format/README.md @@ -185,10 +185,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/session-flow/README.md b/plugins/session-flow/README.md index 1c754fd018..f0cb362c93 100644 --- a/plugins/session-flow/README.md +++ b/plugins/session-flow/README.md @@ -524,10 +524,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/skill-quality/README.md b/plugins/skill-quality/README.md index 725a99da85..314347b8be 100644 --- a/plugins/skill-quality/README.md +++ b/plugins/skill-quality/README.md @@ -262,10 +262,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/source-control/README.md b/plugins/source-control/README.md index a5c6e54fae..9dbc37262e 100644 --- a/plugins/source-control/README.md +++ b/plugins/source-control/README.md @@ -600,10 +600,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/testing/README.md b/plugins/testing/README.md index 1122ba1829..252cd563c3 100644 --- a/plugins/testing/README.md +++ b/plugins/testing/README.md @@ -310,10 +310,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/typos-format/README.md b/plugins/typos-format/README.md index b9c214accb..3eee385ae6 100644 --- a/plugins/typos-format/README.md +++ b/plugins/typos-format/README.md @@ -275,10 +275,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/user-interface/README.md b/plugins/user-interface/README.md index 8c875ea64d..7ae1e9d6ae 100644 --- a/plugins/user-interface/README.md +++ b/plugins/user-interface/README.md @@ -90,10 +90,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/visualization/README.md b/plugins/visualization/README.md index 0bd3e430f1..ecb805564e 100644 --- a/plugins/visualization/README.md +++ b/plugins/visualization/README.md @@ -152,10 +152,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/plugins/work-items/README.md b/plugins/work-items/README.md index 74dd528b3e..1a3c65f3c5 100644 --- a/plugins/work-items/README.md +++ b/plugins/work-items/README.md @@ -255,10 +255,10 @@ Three supported routes, in the order most people want them: } ``` - Plugin option values are read from **user** and managed settings only, **not** - from a project's `.claude/settings.json`. To vary behavior per repository, - enable or disable the plugin in that project's `enabledPlugins` instead of - setting an option there. + Plugin option values are read from **user**, `--settings`, and managed settings + only, **not** from a project's `.claude/settings.json`. To vary behavior per + repository, enable or disable the plugin in that project's `enabledPlugins` + instead of setting an option there. Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code hands a configured value to a hook process; the value comes from the routes above. diff --git a/scripts/sync-plugin-options-docs.py b/scripts/sync-plugin-options-docs.py index e3697cd1fe..942a930818 100755 --- a/scripts/sync-plugin-options-docs.py +++ b/scripts/sync-plugin-options-docs.py @@ -189,10 +189,10 @@ def render(plugin: str, marketplace: str, options: dict) -> str: " }", " ```", "", - " Plugin option values are read from **user** and managed settings only, **not**", - " from a project's `.claude/settings.json`. To vary behavior per repository,", - " enable or disable the plugin in that project's `enabledPlugins` instead of", - " setting an option there.", + " Plugin option values are read from **user**, `--settings`, and managed settings", + " only, **not** from a project's `.claude/settings.json`. To vary behavior per", + " repository, enable or disable the plugin in that project's `enabledPlugins`", + " instead of setting an option there.", "", "Do not set the `CLAUDE_PLUGIN_OPTION_*` variables yourself. They are how Claude Code", "hands a configured value to a hook process; the value comes from the routes above.", From 33c4de7153ab99516c9d80f8b43802f26c46a193 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 13:14:30 -0400 Subject: [PATCH 7/9] docs: name --settings as a documented pluginConfigs source again The settings guide (change-a-setting-for-one-session, as of 2026-10-07) lets --settings set any user-scope key, and pluginConfigs has user scope. Restore the three-source wording the earlier commits marked unverified. Version bumps and fragments are reset here and recomputed after the main merge. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EC7nAKxQg52rCug6r6tYfe --- .../fix-6498-slugs-stamps-a471d592.md | 7 ----- .../fix-6498-slugs-stamps-2d3dd781.md | 7 ----- .../fix-6498-slugs-stamps-5bb78bf6.md | 7 ----- .../fix-6498-slugs-stamps-bddbd6b0.md | 7 ----- .../fix-6498-slugs-stamps-9e7cfa91.md | 7 ----- .../fix-6498-slugs-stamps-e1cf1380.md | 7 ----- .../fix-6498-slugs-stamps-9c95d035.md | 7 ----- .../fix-6498-slugs-stamps-f87431e7.md | 7 ----- .../fix-6498-slugs-stamps-6486353a.md | 7 ----- .../testing/fix-6498-slugs-stamps-f531b006.md | 7 ----- ...truction-source-behind-a-claude-md-shim.md | 2 +- ...and-move-repository-keys-to-the-cascade.md | 12 ++++----- .../hook-config-delivery/README.md | 13 +++++---- docs/conventions/loop-lane/README.md | 4 +-- docs/migration-playbook.md | 12 ++++----- docs/plugin-philosophy.md | 10 +++---- plugins/actionlint/.claude-plugin/plugin.json | 2 +- plugins/actionlint/CHANGELOG.md | 6 ----- .../ai-briefing/.claude-plugin/plugin.json | 2 +- plugins/ai-briefing/CHANGELOG.md | 6 ----- plugins/animation/.claude-plugin/plugin.json | 2 +- plugins/animation/CHANGELOG.md | 6 ----- plugins/autonomy/.claude-plugin/plugin.json | 2 +- plugins/autonomy/CHANGELOG.md | 6 ----- plugins/autonomy/README.md | 5 +--- plugins/autonomy/hooks/lane-stop-gate-arm.sh | 3 +-- plugins/autonomy/skills/setup/SKILL.md | 5 +--- .../bash-format/.claude-plugin/plugin.json | 2 +- plugins/bash-format/CHANGELOG.md | 6 ----- .../biome-format/.claude-plugin/plugin.json | 2 +- plugins/biome-format/CHANGELOG.md | 6 ----- plugins/bugs/.claude-plugin/plugin.json | 2 +- plugins/bugs/CHANGELOG.md | 6 ----- .../code-metrics/.claude-plugin/plugin.json | 2 +- plugins/code-metrics/CHANGELOG.md | 6 ----- .../code-tidying/.claude-plugin/plugin.json | 2 +- plugins/code-tidying/CHANGELOG.md | 6 ----- .../computer-use/.claude-plugin/plugin.json | 2 +- plugins/computer-use/CHANGELOG.md | 6 ----- .../context-budget/.claude-plugin/plugin.json | 2 +- plugins/context-budget/CHANGELOG.md | 6 ----- .../.claude-plugin/plugin.json | 2 +- plugins/desktop-notification/CHANGELOG.md | 6 ----- plugins/discipline/.claude-plugin/plugin.json | 2 +- plugins/discipline/CHANGELOG.md | 6 ----- plugins/disk-hygiene/README.md | 15 ++++++----- plugins/disk-hygiene/lib/killswitch_config.py | 25 +++++++++-------- .../skills/clean/reference/safety-model.md | 19 ++++++------- .../skills/clean/scripts/destructive_guard.py | 14 +++++----- plugins/disk-hygiene/skills/setup/SKILL.md | 5 ++-- .../skills/setup/scripts/kill_switch_probe.py | 3 +-- .../docs-hygiene/.claude-plugin/plugin.json | 2 +- plugins/docs-hygiene/CHANGELOG.md | 6 ----- .../dometrain-mcp/.claude-plugin/plugin.json | 2 +- plugins/dometrain-mcp/CHANGELOG.md | 6 ----- plugins/education/.claude-plugin/plugin.json | 2 +- plugins/education/CHANGELOG.md | 6 ----- .../eol-normalizer/.claude-plugin/plugin.json | 2 +- plugins/eol-normalizer/CHANGELOG.md | 6 ----- plugins/evals/.claude-plugin/plugin.json | 2 +- plugins/evals/CHANGELOG.md | 6 ----- .../.claude-plugin/plugin.json | 2 +- plugins/explainer-video/CHANGELOG.md | 6 ----- plugins/gaming/.claude-plugin/plugin.json | 2 +- plugins/gaming/CHANGELOG.md | 6 ----- plugins/github/.claude-plugin/plugin.json | 2 +- plugins/github/CHANGELOG.md | 6 ----- plugins/go-format/.claude-plugin/plugin.json | 2 +- plugins/go-format/CHANGELOG.md | 6 ----- plugins/guardrails/README.md | 5 +--- .../harness-config/.claude-plugin/plugin.json | 2 +- plugins/harness-config/CHANGELOG.md | 6 ----- .../reference/agents-md-liveness.md | 27 ++++++++++--------- .../audit-instructions/reference/criteria.md | 6 ++--- .../skills/audit-prompting-postures/SKILL.md | 4 +-- .../harness-memory/.claude-plugin/plugin.json | 2 +- plugins/harness-memory/CHANGELOG.md | 6 ----- plugins/harness-ops/skills/lanes/SKILL.md | 3 +-- .../skills/lanes/context/config.md | 2 +- .../skills/lanes/scripts/lane-launcher.sh | 6 +---- .../skills/machine-profile/SKILL.md | 2 +- plugins/harness-ops/skills/plugins/SKILL.md | 7 +++-- .../skills/plugins/context/gotchas.md | 7 ++--- .../skills/plugins/context/scope-semantics.md | 26 ++++++++---------- .../plugins/context/sync-install-enable.md | 5 ++-- .../implementation/.claude-plugin/plugin.json | 2 +- plugins/implementation/CHANGELOG.md | 6 ----- .../scripts/render-index.sh | 7 +++-- .../migrate/reference/shim-droppable.md | 2 +- .../skills/migrate/reference/sources.md | 17 ++++++------ .../kindle-dedrm/.claude-plugin/plugin.json | 2 +- plugins/kindle-dedrm/CHANGELOG.md | 6 ----- plugins/knowledge/.claude-plugin/plugin.json | 2 +- plugins/knowledge/CHANGELOG.md | 6 ----- .../machine-health/.claude-plugin/plugin.json | 2 +- plugins/machine-health/CHANGELOG.md | 6 ----- .../.claude-plugin/plugin.json | 2 +- plugins/markdown-format/CHANGELOG.md | 6 ----- plugins/miro/.claude-plugin/plugin.json | 2 +- plugins/miro/CHANGELOG.md | 6 ----- plugins/pixel-art/.claude-plugin/plugin.json | 2 +- plugins/pixel-art/CHANGELOG.md | 6 ----- .../playgrounds/.claude-plugin/plugin.json | 2 +- plugins/playgrounds/CHANGELOG.md | 6 ----- plugins/playwright/.claude-plugin/plugin.json | 2 +- plugins/playwright/CHANGELOG.md | 6 ----- .../plugin-quality/.claude-plugin/plugin.json | 2 +- plugins/plugin-quality/CHANGELOG.md | 6 ----- .../.claude-plugin/plugin.json | 2 +- plugins/powershell-format/CHANGELOG.md | 6 ----- .../.claude-plugin/plugin.json | 2 +- plugins/rate-limit-guard/CHANGELOG.md | 6 ----- plugins/rate-limit-guard/README.md | 16 +++++------ .../.claude-plugin/plugin.json | 2 +- plugins/repo-fleet-hygiene/CHANGELOG.md | 6 ----- .../repo-hygiene/.claude-plugin/plugin.json | 2 +- plugins/repo-hygiene/CHANGELOG.md | 6 ----- plugins/repo-hygiene/skills/setup/SKILL.md | 7 ++--- .../skills/setup/evals/evals.json | 4 +-- plugins/review/.claude-plugin/plugin.json | 2 +- plugins/review/CHANGELOG.md | 6 ----- .../ruff-format/.claude-plugin/plugin.json | 2 +- plugins/ruff-format/CHANGELOG.md | 6 ----- .../skill-quality/.claude-plugin/plugin.json | 2 +- plugins/skill-quality/CHANGELOG.md | 6 ----- .../songwriting/.claude-plugin/plugin.json | 2 +- plugins/songwriting/CHANGELOG.md | 6 ----- plugins/source-control/README.md | 5 ++-- .../reference/config-resolution.md | 5 +--- .../reference/promotion-evidence-bootstrap.md | 13 ++++----- plugins/speech/.claude-plugin/plugin.json | 2 +- plugins/speech/CHANGELOG.md | 6 ----- .../typos-format/.claude-plugin/plugin.json | 2 +- plugins/typos-format/CHANGELOG.md | 6 ----- .../user-interface/.claude-plugin/plugin.json | 2 +- plugins/user-interface/CHANGELOG.md | 6 ----- .../visualization/.claude-plugin/plugin.json | 2 +- plugins/visualization/CHANGELOG.md | 6 ----- plugins/work-items/.claude-plugin/plugin.json | 2 +- plugins/work-items/CHANGELOG.md | 6 ----- 140 files changed, 187 insertions(+), 582 deletions(-) delete mode 100644 .changes/context-guard/fix-6498-slugs-stamps-a471d592.md delete mode 100644 .changes/disk-hygiene/fix-6498-slugs-stamps-2d3dd781.md delete mode 100644 .changes/guardrails/fix-6498-slugs-stamps-5bb78bf6.md delete mode 100644 .changes/harness-ops/fix-6498-slugs-stamps-bddbd6b0.md delete mode 100644 .changes/instruction-placement/fix-6498-slugs-stamps-9e7cfa91.md delete mode 100644 .changes/planning/fix-6498-slugs-stamps-e1cf1380.md delete mode 100644 .changes/playbooks/fix-6498-slugs-stamps-9c95d035.md delete mode 100644 .changes/session-flow/fix-6498-slugs-stamps-f87431e7.md delete mode 100644 .changes/source-control/fix-6498-slugs-stamps-6486353a.md delete mode 100644 .changes/testing/fix-6498-slugs-stamps-f531b006.md diff --git a/.changes/context-guard/fix-6498-slugs-stamps-a471d592.md b/.changes/context-guard/fix-6498-slugs-stamps-a471d592.md deleted file mode 100644 index 46ae390dd6..0000000000 --- a/.changes/context-guard/fix-6498-slugs-stamps-a471d592.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/disk-hygiene/fix-6498-slugs-stamps-2d3dd781.md b/.changes/disk-hygiene/fix-6498-slugs-stamps-2d3dd781.md deleted file mode 100644 index 46ae390dd6..0000000000 --- a/.changes/disk-hygiene/fix-6498-slugs-stamps-2d3dd781.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/guardrails/fix-6498-slugs-stamps-5bb78bf6.md b/.changes/guardrails/fix-6498-slugs-stamps-5bb78bf6.md deleted file mode 100644 index 46ae390dd6..0000000000 --- a/.changes/guardrails/fix-6498-slugs-stamps-5bb78bf6.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/harness-ops/fix-6498-slugs-stamps-bddbd6b0.md b/.changes/harness-ops/fix-6498-slugs-stamps-bddbd6b0.md deleted file mode 100644 index 46ae390dd6..0000000000 --- a/.changes/harness-ops/fix-6498-slugs-stamps-bddbd6b0.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/instruction-placement/fix-6498-slugs-stamps-9e7cfa91.md b/.changes/instruction-placement/fix-6498-slugs-stamps-9e7cfa91.md deleted file mode 100644 index 46ae390dd6..0000000000 --- a/.changes/instruction-placement/fix-6498-slugs-stamps-9e7cfa91.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/planning/fix-6498-slugs-stamps-e1cf1380.md b/.changes/planning/fix-6498-slugs-stamps-e1cf1380.md deleted file mode 100644 index 46ae390dd6..0000000000 --- a/.changes/planning/fix-6498-slugs-stamps-e1cf1380.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/playbooks/fix-6498-slugs-stamps-9c95d035.md b/.changes/playbooks/fix-6498-slugs-stamps-9c95d035.md deleted file mode 100644 index 1fe5d8fd96..0000000000 --- a/.changes/playbooks/fix-6498-slugs-stamps-9c95d035.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/session-flow/fix-6498-slugs-stamps-f87431e7.md b/.changes/session-flow/fix-6498-slugs-stamps-f87431e7.md deleted file mode 100644 index f44daa8035..0000000000 --- a/.changes/session-flow/fix-6498-slugs-stamps-f87431e7.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. diff --git a/.changes/source-control/fix-6498-slugs-stamps-6486353a.md b/.changes/source-control/fix-6498-slugs-stamps-6486353a.md deleted file mode 100644 index 46ae390dd6..0000000000 --- a/.changes/source-control/fix-6498-slugs-stamps-6486353a.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/testing/fix-6498-slugs-stamps-f531b006.md b/.changes/testing/fix-6498-slugs-stamps-f531b006.md deleted file mode 100644 index 46ae390dd6..0000000000 --- a/.changes/testing/fix-6498-slugs-stamps-f531b006.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/docs/adr/0036-make-agents-md-the-instruction-source-behind-a-claude-md-shim.md b/docs/adr/0036-make-agents-md-the-instruction-source-behind-a-claude-md-shim.md index a225e63baa..68ee8d368c 100644 --- a/docs/adr/0036-make-agents-md-the-instruction-source-behind-a-claude-md-shim.md +++ b/docs/adr/0036-make-agents-md-the-instruction-source-behind-a-claude-md-shim.md @@ -54,7 +54,7 @@ Three alternatives were rejected, each with the fact that would flip it: | Rejected | Why | What would flip it | |---|---|---| | Native only: delete `CLAUDE.md` now | Rejected: it held only while direct reading was conditional (see "The remote flag, and how its code default is read" in `sources.md` and "Why the shim stays" in the migrate skill's `SKILL.md`). Any `CLAUDE.md` above the working directory still suppresses the read | All four graded conditions report `[MET]` | -| The `claude-md-and-agents-md` both-files setting | A user or managed setting (`--settings` is unverified since the entry stopped naming it, as of 2026-10-07), ignored in project and local settings, so no repository can ship it ("Why the shim stays"); never adopted or run as a convention | The setting becomes readable from project or local settings | +| The `claude-md-and-agents-md` both-files setting | A user, `--settings` or managed setting, ignored in project and local settings, so no repository can ship it ("Why the shim stays"); never adopted or run as a convention | The setting becomes readable from project or local settings | | A common-ancestor `AGENTS.md` in the directory that holds every clone | No repository versions it, and it misses every worktree checked out outside that tree | Claude Code reads a versioned org-level tier above the repository | ## Consequences diff --git a/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md b/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md index a4f888833d..72cd512ac0 100644 --- a/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md +++ b/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md @@ -9,8 +9,8 @@ This ruling covers 17 of source-control's `userConfig` keys, used by `/source-co and `/source-control:pull-request`: who the operator is, which owners the loop watches, which bots it trusts, and how a repository merges and reviews. The plugin's other `userConfig` keys (engine thresholds, tiers, caps) are outside it. `userConfig` values live in `pluginConfigs`, which -Claude Code reads from user settings and managed settings only (the `--settings` flag is unverified -since the entry stopped naming it, as of 2026-10-07); a project's `.claude/settings.json` is ignored +Claude Code reads from user settings, the `--settings` flag, and managed settings only; a project's +`.claude/settings.json` is ignored ([hook-config-delivery](../conventions/hook-config-delivery/README.md), fact 5). A sandbox probe on Claude Code 2.1.283 (2026-09-27) also showed that `claude plugin install --config` writes the value to user settings whatever `-s` says (fact 9). So each of these keys has one value per machine. @@ -75,11 +75,9 @@ verdict HYBRID, which this record adopts. - An operator with several identity domains on one machine (for example a work account and a personal account) gets one value per machine for each key in decision 1, and for the ten keys in decision 3 while their deprecated `userConfig` fallback is set. Such an operator either leaves - those keys unset or launches the lane with a per-domain `--settings` file. `--settings` is - unverified as a `pluginConfigs` read source since the entry stopped naming it - (hook-config-delivery fact 5; as of 2026-10-07; recheck when the entry names `--settings` again - or a probe shows a `--settings` value read or ignored); how its `pluginConfigs` merges with the - user settings value is unverified. + those keys unset or launches the lane with a per-domain `--settings` file. `--settings` is a documented `pluginConfigs` read source + (hook-config-delivery fact 5; as of 2026-10-07); how its `pluginConfigs` merges with the user + settings value is unverified. - Repositories can set `branch_issue_pattern` for themselves today; the `userConfig` twin keeps working with a deprecation note until its removal release. - `plugins/source-control/reference/config-resolution.md` states the split and the multi-domain diff --git a/docs/conventions/hook-config-delivery/README.md b/docs/conventions/hook-config-delivery/README.md index d8eeebd15f..7ffc3313e9 100644 --- a/docs/conventions/hook-config-delivery/README.md +++ b/docs/conventions/hook-config-delivery/README.md @@ -30,7 +30,8 @@ Each row carries its own Claude Code version and date in the **As of** column. A records what we rely on, in our words, and points at the section that states it; a probed row records what our own probe observed. Rows 1-8 date from **Claude Code 2.1.218**: doc-stated rows re-read from the live official docs on 2026-07-24, behavioral rows proven by a controlled -fresh-session probe (isolated `claude -p --plugin-dir` runs with positive controls) on 2026-07-23. +fresh-session probe (isolated `claude -p --plugin-dir` runs with positive controls) on 2026-07-23; +fact 5 was re-read on 2026-10-07 against 2.1.292. Rows 9-12 were measured on **Claude Code 2.1.283** by a sandbox probe on 2026-09-27 (fixture `CLAUDE_CONFIG_DIR`, `HOME` and `USERPROFILE` under a scratch directory, positive control of an empty plugin list before any write). Existing state is not evidence of its own correctness: @@ -43,7 +44,7 @@ a row in new work. | 2 | A hook process reads a configured value from `CLAUDE_PLUGIN_OPTION_` (key uppercased) | doc-stated ([User configuration](https://code.claude.com/docs/en/plugins/manifest-reference#user-configuration)); scope narrowed by fact 4 | 2.1.218, 2026-07-24 | | 3 | The declared `default` field is in the schema but **implemented for neither argv substitution nor env export**. An unset-but-defaulted `${user_config.*}` argv token **silently drops the entire hook entry**. It is not passed literally and not empty-substituted; the same unset key exports **no** env var | proven (probe T1); upstream [#46477](https://github.com/anthropics/claude-code/issues/46477) closed not-planned, [#39455](https://github.com/anthropics/claude-code/issues/39455) open, [#39827](https://github.com/anthropics/claude-code/issues/39827) closed not-planned; undocumented | 2.1.218, 2026-07-23 | | 4 | Tamper split on the env channel: for a **configured** key, harness injection overwrites a repo `.claude/settings.json` `env` block (injection wins); for an **unconfigured** key nothing is injected and the repo's `env` block freely populates `CLAUDE_PLUGIN_OPTION_`. Env carries no provenance, so a hook cannot tell the two apart | proven (probe T2/T2b); undocumented | 2.1.218, 2026-07-23 | -| 5 | We treat `pluginConfigs` as living in **user and managed settings**, and an entry in a project's `.claude/settings.json` / `.claude/settings.local.json` as ignored. A value passed with the `--settings` flag is **unverified**: the entry's scope reads "User or managed" and no longer names `--settings`, so a mechanism that passes a value that way records the route as unverified until a probe settles it. Recheck when the entry names `--settings` or another scope, or a probe shows a `--settings` value read or ignored | doc-stated ([`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs)) | 2.1.292, 2026-10-07 | +| 5 | We treat `pluginConfigs` as living in **user settings, the `--settings` flag, and managed settings only**, and an entry in a project's `.claude/settings.json` / `.claude/settings.local.json` as ignored. The settings guide says `--settings` "can set any key your user settings file can set", and the `pluginConfigs` entry gives the scope "User or managed". Recheck when the settings guide stops letting `--settings` set user-scope keys, or the `pluginConfigs` scope changes | doc-stated ([`--settings`](https://code.claude.com/docs/en/settings#change-a-setting-for-one-session), [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs)) | 2.1.292, 2026-10-07 | | 6 | Skill- and agent-frontmatter hooks receive **neither** the argv substitution nor `CLAUDE_PLUGIN_OPTION_*` | evidence-strong (probe + field repro); CC docs silent | 2.1.218, 2026-07-23 | | 7 | We use skill/agent **body** `${user_config.KEY}` only as model-visible content, and only for non-sensitive values | doc-stated ([User configuration](https://code.claude.com/docs/en/plugins/manifest-reference#user-configuration)) | 2.1.218, 2026-07-24 | | 8 | We never expect a sensitive value in `settings.json`, so no settings reader can see one | doc-stated ([User configuration](https://code.claude.com/docs/en/plugins/manifest-reference#user-configuration)) | 2.1.218, 2026-07-24 | @@ -77,8 +78,7 @@ this list and the matrix; it does not fork a private convention. (see its `[0.9.0]` [CHANGELOG entry](../../../plugins/disk-hygiene/CHANGELOG.md) for the full trust analysis and residuals). - **G. Operator-side arm record**: for a **per-session** value that would otherwise ride - `--settings` (F's residual: invisible to a hook-side read, and whether the harness honors it is - unverified, see fact 5). An + `--settings` (F's residual: honored by the harness, invisible to a hook-side read). An operator-side helper shipped by the plugin writes a per-session record under the plugin's install-anchored data directory (`/data/`, derived exactly as F derives its anchor); the session carries only a **random record id** through a `userConfig` string option, and the hook @@ -103,9 +103,8 @@ this list and the matrix; it does not fork a private convention. | F. Direct settings read | **yes** | in-script default required (declared `default` inert everywhere) | yes (fact 5 + no env-derived paths) | safe, explicit fail direction per plugin | **no: sensitive values are not in `settings.json` (fact 8)** | +settings-file coupling, +managed-path table | | G. Operator-side arm record | **yes** (any surface that can derive the anchor) | in-script default required | yes (id carries no authority; store is install-anchored) | safe, explicit fail direction per plugin (exemplar: launcher fails closed, hook fails open) | no (plaintext record in the data dir) | +arm helper, +record lifecycle (claim, TTL, consume), +launcher coupling | -Residual on F (documented, accepted): a value supplied only via a session `--settings` file, if the -harness honors it at all (unverified since 2026-10-07, fact 5), is -invisible to a hook-side read, a runtime CLI flag no hook can observe. Channel G +Residual on F (documented, accepted): a value supplied only via a session `--settings` file is honored +by the harness but invisible to a hook-side read, a runtime CLI flag no hook can observe. Channel G exists to close exactly that residual for per-session values a plugin cannot do without. ## The decision rule diff --git a/docs/conventions/loop-lane/README.md b/docs/conventions/loop-lane/README.md index 1d7951a0c9..edb2088906 100644 --- a/docs/conventions/loop-lane/README.md +++ b/docs/conventions/loop-lane/README.md @@ -853,9 +853,7 @@ mod's writes, and a machine-wide write floor bounds them: a reading whose whole- have not moved is rewritten no sooner than the floor interval after the file's last write, whichever session on the machine wrote it, while a whole-point move writes at once, so a lane's own turn that moves a window can wake it once. -A lane may set the guard's report mode with `--settings`; this is optional. `--settings` is -unverified for plugin option values since the pluginConfigs entry stopped naming it (as of -2026-10-07; hook-config-delivery fact 5). +A lane may set the guard's report mode with `--settings`; this is optional. **A named check enforces the rule.** `scripts/check-loop-lane-floor-drift.sh` extracts the floor block from the reader contract and compares it against an explicit registry of every surface that diff --git a/docs/migration-playbook.md b/docs/migration-playbook.md index c3e78daaab..35a7264133 100644 --- a/docs/migration-playbook.md +++ b/docs/migration-playbook.md @@ -206,7 +206,7 @@ Prefer them in this order; the earlier ones are simplest and least surprising. |---|---|---| | Consumer `CLAUDE.md` / `.claude/rules` | The skill reads the consuming project's own context and rules | Project-specific conventions, naming, policies: the default extension surface | | `${CLAUDE_PROJECT_DIR}` | Path to the consumer's project root, substituted in hook/MCP/monitor commands and exported to subprocesses | Referencing project-local scripts/config | -| `userConfig` → `${user_config.KEY}` | Values Claude Code prompts for at enable time (typed: string/number/boolean/directory/file, optional sensitive). Substitutes as `${user_config.KEY}` in MCP/LSP configs and exec-form hook commands; non-sensitive values also substitute into skill/agent content. Shell-form hook commands, monitor commands, and MCP `headersHelper` reject this substitution. Hook processes receive every value as `CLAUDE_PLUGIN_OPTION_`; a Bash tool call made by a skill does not (see the [smoke-test record](extensibility-contract-smoke-tests.md)). Non-sensitive values are stored under `pluginConfigs[].options` in user settings and read from user or managed settings; project/local entries are ignored (`--settings` is unverified since 2026-10-07, hook-config-delivery fact 5). Sensitive values use the macOS Keychain or `~/.claude/.credentials.json` where no supported keychain exists | Endpoints, toggles, tokens: personal or administrator-supplied config without editing the plugin | +| `userConfig` → `${user_config.KEY}` | Values Claude Code prompts for at enable time (typed: string/number/boolean/directory/file, optional sensitive). Substitutes as `${user_config.KEY}` in MCP/LSP configs and exec-form hook commands; non-sensitive values also substitute into skill/agent content. Shell-form hook commands, monitor commands, and MCP `headersHelper` reject this substitution. Hook processes receive every value as `CLAUDE_PLUGIN_OPTION_`; a Bash tool call made by a skill does not (see the [smoke-test record](extensibility-contract-smoke-tests.md)). Non-sensitive values are stored under `pluginConfigs[].options` in user settings and read from user, `--settings`, or managed settings; project/local entries are ignored. Sensitive values use the macOS Keychain or `~/.claude/.credentials.json` where no supported keychain exists | Endpoints, toggles, tokens: personal or administrator-supplied config without editing the plugin | | `${CLAUDE_PLUGIN_ROOT}` | Path to the plugin's own installed directory | Referencing bundled scripts/assets (mandatory under cache isolation) | | `${CLAUDE_SKILL_DIR}` | Path to the current skill's subdirectory within the plugin (not the plugin root); substituted in skill and agent content per the [skills reference](https://code.claude.com/docs/en/skills#available-string-substitutions) | Pre-compute blocks and `allowed-tools` paths that must resolve to skill-local scripts without hardcoding the plugin root | | `${CLAUDE_PLUGIN_DATA}` | Persistent per-plugin directory that survives updates (`~/.claude/plugins/data//`) | Installed deps, caches, generated state | @@ -234,10 +234,8 @@ one increment past the precedent). Behavioral gaps the docs leave open are resol `string[]` type); mark a credential `sensitive` so it lands in Claude Code's secure credential storage, never `settings.json`. Non-sensitive values store under `pluginConfigs[].options` in user settings and are read from - user settings or managed settings only; project and local entries are ignored since - Claude Code 2.1.207. `--settings` is unverified since the entry stopped naming it (as of - 2026-10-07; recheck when the [pluginConfigs entry](https://code.claude.com/docs/en/settings-reference#pluginconfigs) - names `--settings` again or a probe shows a `--settings` value read or ignored). Use for endpoints, toggles, tokens, and personal path knobs. The `directory` / + user settings, `--settings`, or managed settings only; project and local entries are ignored since + Claude Code 2.1.207. Use for endpoints, toggles, tokens, and personal path knobs. The `directory` / `file` type is a UI hint, not a validator: a `--config` value is stored verbatim with no existence check and no normalization to absolute (smoke-test A). 2. **Tracked rich config under `${CLAUDE_PROJECT_DIR}`. [first-party PRECEDENT; folder form is a @@ -913,8 +911,8 @@ interpolation, or what a plugin may bundle. input and stores the value in the macOS Keychain or, on platforms without a supported keychain, `~/.claude/.credentials.json`, and **not** `settings.json`. Non-sensitive values land in user `settings.json` under `pluginConfigs[].options` and are readable, so - never put a secret there. Claude Code reads this key from user settings and managed settings, - not project or local settings (`--settings` is unverified since 2026-10-07, hook-config-delivery fact 5). Endpoints and toggles are fine as non-sensitive. Every option is documented. + never put a secret there. Claude Code reads this key from user settings, `--settings`, and managed settings, + not project or local settings. Endpoints and toggles are fine as non-sensitive. Every option is documented. 4. **Cache isolation: no reach-outs.** References only files inside the plugin via `${CLAUDE_PLUGIN_ROOT}`; persists state in `${CLAUDE_PLUGIN_DATA}`. No `../` reach-outs, no constructed absolute paths, no reading **consumer repository** files outside `${CLAUDE_PROJECT_DIR}`. diff --git a/docs/plugin-philosophy.md b/docs/plugin-philosophy.md index b22057f17c..d358786984 100644 --- a/docs/plugin-philosophy.md +++ b/docs/plugin-philosophy.md @@ -391,11 +391,11 @@ Choose one authoritative owner for each value: | Bundled plugin code and assets | `${CLAUDE_PLUGIN_ROOT}` | `userConfig` is not repository configuration. Claude Code reads its stored `pluginConfigs` values only -from user settings and managed settings -([`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs)). It ignores -project and local settings for this key. `--settings` is unverified since the entry stopped naming -it (as of 2026-10-07; recheck when the pluginConfigs entry names `--settings` again or a probe shows -a `--settings` value read or ignored). Claude Code owns the configuration prompt and storage; plugin skills must not hand-edit +from user settings, `--settings`, and managed settings +([`--settings`](https://code.claude.com/docs/en/settings#change-a-setting-for-one-session), +[`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs), as of +2026-10-07; recheck when the settings guide stops letting `--settings` set user-scope keys, or the +`pluginConfigs` scope changes). It ignores project and local settings for this key. Claude Code owns the configuration prompt and storage; plugin skills must not hand-edit `pluginConfigs` or invent a marketplace-qualified plugin ID. Use `userConfig` to its full native extent. Every personal or administrator scalar that flows diff --git a/plugins/actionlint/.claude-plugin/plugin.json b/plugins/actionlint/.claude-plugin/plugin.json index e86ab1e782..8166de5d2c 100644 --- a/plugins/actionlint/.claude-plugin/plugin.json +++ b/plugins/actionlint/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "actionlint", - "version": "0.12.13", + "version": "0.12.12", "description": "Lint GitHub Actions workflow files on edit via actionlint, surfacing findings as advisory context.", "author": { "name": "Melodic Software", diff --git a/plugins/actionlint/CHANGELOG.md b/plugins/actionlint/CHANGELOG.md index 0acb0e47f3..3c6285bf9e 100644 --- a/plugins/actionlint/CHANGELOG.md +++ b/plugins/actionlint/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `actionlint` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.12.13] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.12.12] - 2026-10-07 ### Changed diff --git a/plugins/ai-briefing/.claude-plugin/plugin.json b/plugins/ai-briefing/.claude-plugin/plugin.json index b0db0f56b5..09616b5d32 100644 --- a/plugins/ai-briefing/.claude-plugin/plugin.json +++ b/plugins/ai-briefing/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "ai-briefing", - "version": "0.8.7", + "version": "0.8.6", "description": "Build source-backed AI-industry briefings from official vendor publications, configured RSS/Atom feeds, GitHub releases, reputable secondary reporting, and user-supplied URLs. Deduplicate, rank, and present results as markdown or optional HTML/PPTX decks, with repository-owned profile, audience, and brand configuration. Automated X/Twitter collection is disabled; Playwright is used only for deterministic local rendering.", "author": { "name": "Melodic Software", diff --git a/plugins/ai-briefing/CHANGELOG.md b/plugins/ai-briefing/CHANGELOG.md index b58691c855..c8042231fa 100644 --- a/plugins/ai-briefing/CHANGELOG.md +++ b/plugins/ai-briefing/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `ai-briefing` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.8.7] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.8.6] - 2026-10-07 ### Changed diff --git a/plugins/animation/.claude-plugin/plugin.json b/plugins/animation/.claude-plugin/plugin.json index 814ee7ca32..857030efe0 100644 --- a/plugins/animation/.claude-plugin/plugin.json +++ b/plugins/animation/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "animation", - "version": "0.4.12", + "version": "0.4.11", "description": "Hand-drawn-style 2D animation as code, rendered in headless Chromium by an ink brush engine. rotoscope copies a reference clip drawing by drawing: trace to vector paths, render, measure against the source (XOR, SSIM), and fit per-shot brush overrides. learn-style measures a clip into a style pack (ships woodcut-ink) and checks films against it. produce turns a brief into approved boards, a shot list, frames, and a delivered file. setup checks ffmpeg, Node, Chromium, and Python.", "author": { "name": "Melodic Software", diff --git a/plugins/animation/CHANGELOG.md b/plugins/animation/CHANGELOG.md index 7d9922f818..2f6bf53993 100644 --- a/plugins/animation/CHANGELOG.md +++ b/plugins/animation/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `animation` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.4.12] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.4.11] - 2026-10-07 ### Changed diff --git a/plugins/autonomy/.claude-plugin/plugin.json b/plugins/autonomy/.claude-plugin/plugin.json index 8d7c61c87c..b7709b1056 100644 --- a/plugins/autonomy/.claude-plugin/plugin.json +++ b/plugins/autonomy/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "autonomy", - "version": "0.26.13", + "version": "0.26.12", "description": "Contracts for governed autonomous agent operation: role topology, binding seam, telemetry, return accounting, trigger dispatch, a per-work-class guardrail matrix, a standing-routine catalog, and a runner charter. A guided setup skill writes an org's binding, wires OTLP telemetry (file default), human-attested return capture, and signal adapters behind one governed dispatch entrypoint, binds the guardrail matrix to isolation substrates after a live probe, and schedules routines.", "author": { "name": "Melodic Software", diff --git a/plugins/autonomy/CHANGELOG.md b/plugins/autonomy/CHANGELOG.md index 05dcc08c76..c9fd9084af 100644 --- a/plugins/autonomy/CHANGELOG.md +++ b/plugins/autonomy/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `autonomy` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.26.13] - 2026-10-07 - -### Changed - -- **Upstream records (#6498).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.26.12] - 2026-10-07 ### Changed diff --git a/plugins/autonomy/README.md b/plugins/autonomy/README.md index 6928b6ad86..bd101467cb 100644 --- a/plugins/autonomy/README.md +++ b/plugins/autonomy/README.md @@ -166,10 +166,7 @@ merge: session across many `/loop` cycles, each of whose stops must stay gated, so it lives for the claiming session and is retired by TTL plus the launcher's relaunch sweep. To arm a hand-launched session, run the arm helper from the installed plugin the same way, then pass the id via - `--settings '{"pluginConfigs":{"autonomy@":{"options":{"lane_stop_gate_arm_id":""}}}}'`. That `--settings` delivery is unverified - since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) - entry stopped naming the flag (as of 2026-10-07; recheck when the entry names `--settings` - again or a probe shows a `--settings` value read or ignored). + `--settings '{"pluginConfigs":{"autonomy@":{"options":{"lane_stop_gate_arm_id":""}}}}'`. 3. **User `settings.json`**, located from the hook's own install path, a *persistent* enable that also gates interactive sessions, which defeats the default-OFF design; prefer the launcher. diff --git a/plugins/autonomy/hooks/lane-stop-gate-arm.sh b/plugins/autonomy/hooks/lane-stop-gate-arm.sh index 7e92bd2e9d..802b54728e 100755 --- a/plugins/autonomy/hooks/lane-stop-gate-arm.sh +++ b/plugins/autonomy/hooks/lane-stop-gate-arm.sh @@ -7,8 +7,7 @@ # between managed and user settings — under this plugin's own install-derived # data directory: /plugins/data//lane-arms/. The launcher # then passes the same arm id to the session through the `lane_stop_gate_arm_id` -# userConfig option (`claude --settings ...`, unverified since the pluginConfigs -# docs entry stopped naming the flag, as of 2026-10-07), and the gate treats the +# userConfig option (`claude --settings ...`), and the gate treats the # env-delivered id purely as a pointer into this store. Because the store is # derived from this script's own location — never from an environment value — a # watched repository cannot mint, redirect, or forge a record; because the id is diff --git a/plugins/autonomy/skills/setup/SKILL.md b/plugins/autonomy/skills/setup/SKILL.md index 237c541a0a..00cef8e1b6 100644 --- a/plugins/autonomy/skills/setup/SKILL.md +++ b/plugins/autonomy/skills/setup/SKILL.md @@ -200,10 +200,7 @@ bind in this plugin's `userConfig` rather than either governance surface: the ve pool, and whether the advisory visual narration lane runs. Neither counts anything, the pool contributes to no floor, and the narration lane has no security-binding cell at all, so neither can weaken a floor, which is what lets them sit on an operator surface. Plugin options resolve from -user and managed settings only (`--settings` is unverified since the -[`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped -naming it, as of 2026-10-07; recheck when the entry names it again or a probe shows a `--settings` -value read or ignored); a watched repository's own `.claude/settings.json` is +user, `--settings`, and managed settings only; a watched repository's own `.claude/settings.json` is not read for them, so a repo cannot dial its own verification. The slice proposes neither as a binding field. diff --git a/plugins/bash-format/.claude-plugin/plugin.json b/plugins/bash-format/.claude-plugin/plugin.json index 7ac60ba8c4..28a20bc1a7 100644 --- a/plugins/bash-format/.claude-plugin/plugin.json +++ b/plugins/bash-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "bash-format", - "version": "0.10.13", + "version": "0.10.12", "description": "Auto-format and lint shell scripts on edit via shfmt + ShellCheck, using the consuming repo's own .editorconfig and .shellcheckrc.", "author": { "name": "Melodic Software", diff --git a/plugins/bash-format/CHANGELOG.md b/plugins/bash-format/CHANGELOG.md index 0d769c2be7..8ae175ca0d 100644 --- a/plugins/bash-format/CHANGELOG.md +++ b/plugins/bash-format/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `bash-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.10.13] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.10.12] - 2026-10-07 ### Changed diff --git a/plugins/biome-format/.claude-plugin/plugin.json b/plugins/biome-format/.claude-plugin/plugin.json index 3de9cb293f..f730d78796 100644 --- a/plugins/biome-format/.claude-plugin/plugin.json +++ b/plugins/biome-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "biome-format", - "version": "0.8.12", + "version": "0.8.11", "description": "Auto-format and lint JS/TS/JSX/JSON on edit via Biome, only when a biome.json governs the repo, using the consuming repo's own Biome config.", "author": { "name": "Melodic Software", diff --git a/plugins/biome-format/CHANGELOG.md b/plugins/biome-format/CHANGELOG.md index 69d042a220..eb7a645323 100644 --- a/plugins/biome-format/CHANGELOG.md +++ b/plugins/biome-format/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `biome-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.8.12] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.8.11] - 2026-10-07 ### Changed diff --git a/plugins/bugs/.claude-plugin/plugin.json b/plugins/bugs/.claude-plugin/plugin.json index 98b21c2f34..3ccf6c94b0 100644 --- a/plugins/bugs/.claude-plugin/plugin.json +++ b/plugins/bugs/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "bugs", - "version": "0.11.17", + "version": "0.11.16", "description": "Produces from an informal defect description a structured five-field bug report: title, steps to reproduce, expected vs actual, severity with justification, and suggested fix location. Read-only by default: it emits the report and never edits code, opens a PR, or files an issue on its own.", "author": { "name": "Melodic Software", diff --git a/plugins/bugs/CHANGELOG.md b/plugins/bugs/CHANGELOG.md index 1d68be7cc1..f62608df9b 100644 --- a/plugins/bugs/CHANGELOG.md +++ b/plugins/bugs/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `bugs` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.11.17] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.11.16] - 2026-10-07 ### Changed diff --git a/plugins/code-metrics/.claude-plugin/plugin.json b/plugins/code-metrics/.claude-plugin/plugin.json index 5fe97b0a8d..62adc106c3 100644 --- a/plugins/code-metrics/.claude-plugin/plugin.json +++ b/plugins/code-metrics/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "code-metrics", - "version": "0.5.9", + "version": "0.5.8", "description": "Read-only code measures for a change, with cited references and no verdict: lines per file (audit-size), cyclomatic, cognitive, and Halstead complexity (audit-complexity), duplication (audit-duplication), per-function coverage and CRAP from existing lcov, Cobertura, coverage.py, or Go artifacts (audit-coverage), TypeScript and Python type debt (audit-type-debt), metric literacy (principles), and setup. Uses only collectors already installed; never installs or runs tests.", "author": { "name": "Melodic Software", diff --git a/plugins/code-metrics/CHANGELOG.md b/plugins/code-metrics/CHANGELOG.md index 40ff0e97d3..02b1921135 100644 --- a/plugins/code-metrics/CHANGELOG.md +++ b/plugins/code-metrics/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `code-metrics` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.5.9] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.5.8] - 2026-10-07 ### Changed diff --git a/plugins/code-tidying/.claude-plugin/plugin.json b/plugins/code-tidying/.claude-plugin/plugin.json index 78a18ec86a..03b5e114ed 100644 --- a/plugins/code-tidying/.claude-plugin/plugin.json +++ b/plugins/code-tidying/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "code-tidying", - "version": "0.28.12", + "version": "0.28.11", "description": "Code tidying and comment hygiene. tidy hunts a rotated lane for Beck-style tidyings and ships one PR. batch-simplify sweeps a branch, time window, or repo in dependency-ordered waves. dissolve-comments deletes zero-information comments and moves the rest into names (safe, aggressive, strip modes). audit-comment-residue flags history, plan, conversational, and ticket residue. audit-dead-code finds dead code with knip, vulture, gopls, and grep. setup scaffolds tidy lanes.", "author": { "name": "Melodic Software", diff --git a/plugins/code-tidying/CHANGELOG.md b/plugins/code-tidying/CHANGELOG.md index c3cb69ad25..9a4eea7843 100644 --- a/plugins/code-tidying/CHANGELOG.md +++ b/plugins/code-tidying/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `code-tidying` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.28.12] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.28.11] - 2026-10-07 ### Changed diff --git a/plugins/computer-use/.claude-plugin/plugin.json b/plugins/computer-use/.claude-plugin/plugin.json index ee301391ff..edd0a2f77f 100644 --- a/plugins/computer-use/.claude-plugin/plugin.json +++ b/plugins/computer-use/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "computer-use", - "version": "0.1.10", + "version": "0.1.9", "description": "Operating knowledge for Claude Code's built-in computer-use MCP server (desktop screen control). /computer-use:diagnose resolves a symptom to a cause instead of retrying: the fixed screenshot pixel budget and why zoom recovers detail, how to read capture and input failures, and per-OS quirks that make synthesized keys or menus behave unlike a human's. /computer-use:setup verifies prerequisites and reports environment settings that end a session mid-run.", "author": { "name": "Melodic Software", diff --git a/plugins/computer-use/CHANGELOG.md b/plugins/computer-use/CHANGELOG.md index bc47a1d209..1335142658 100644 --- a/plugins/computer-use/CHANGELOG.md +++ b/plugins/computer-use/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `computer-use` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.1.10] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.1.9] - 2026-10-02 ### Fixed diff --git a/plugins/context-budget/.claude-plugin/plugin.json b/plugins/context-budget/.claude-plugin/plugin.json index 1c5d485035..554a708e7a 100644 --- a/plugins/context-budget/.claude-plugin/plugin.json +++ b/plugins/context-budget/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "context-budget", - "version": "0.9.10", + "version": "0.9.9", "description": "Measures a Claude Code session's fixed startup context payload per item at a pinned binary version, including per-tool attribution of the built-in tool pools that /context reports only as totals, derived by A/B deny differencing under comparability rules. Falls back from an SDK meter to a headless /context parser, then to an error rather than a wrong number. Keeps a per-project before/after ledger per lever. Report-only by default; fix applies one approved project-scope trim.", "author": { "name": "Melodic Software", diff --git a/plugins/context-budget/CHANGELOG.md b/plugins/context-budget/CHANGELOG.md index 6c4997d7d8..2c79e64a7b 100644 --- a/plugins/context-budget/CHANGELOG.md +++ b/plugins/context-budget/CHANGELOG.md @@ -7,12 +7,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Versions 0.6.38 and 0.6.40 were reserved by parallel changes and never published. -## [0.9.10] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.9.9] - 2026-10-07 ### Changed diff --git a/plugins/desktop-notification/.claude-plugin/plugin.json b/plugins/desktop-notification/.claude-plugin/plugin.json index b1149faf67..7837081792 100644 --- a/plugins/desktop-notification/.claude-plugin/plugin.json +++ b/plugins/desktop-notification/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "desktop-notification", - "version": "0.8.11", + "version": "0.8.10", "description": "Alert you when Claude Code needs input: an audible terminal bell, an OSC 9 terminal notification, and an OS-native toast (macOS/Linux) on permission and idle prompts.", "author": { "name": "Melodic Software", diff --git a/plugins/desktop-notification/CHANGELOG.md b/plugins/desktop-notification/CHANGELOG.md index 6b4ded6b1b..d9d08c8349 100644 --- a/plugins/desktop-notification/CHANGELOG.md +++ b/plugins/desktop-notification/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `desktop-notification` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.8.11] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.8.10] - 2026-10-07 ### Changed diff --git a/plugins/discipline/.claude-plugin/plugin.json b/plugins/discipline/.claude-plugin/plugin.json index 37afd7b3a7..2e3f9e7417 100644 --- a/plugins/discipline/.claude-plugin/plugin.json +++ b/plugins/discipline/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "discipline", - "version": "0.17.2", + "version": "0.17.1", "description": "Correctors that re-anchor a rule, audit work in flight, and fix drift: do-your-research (and -deep), follow-our-standards, point-dont-copy, reason-dont-recite, tighten-your-output, recheck-against-upstream (and -deep), pick-for-the-problem, mind-your-maxims, script-the-deterministic-work, use-your-skills, reuse-or-replace, scrutinize-dont-coast. sweep-all runs them as one batch. wait-what re-pitches a message that did not land. hold-my-hand shows work one phase at a time.", "author": { "name": "Melodic Software", diff --git a/plugins/discipline/CHANGELOG.md b/plugins/discipline/CHANGELOG.md index 8640d37951..89111533e0 100644 --- a/plugins/discipline/CHANGELOG.md +++ b/plugins/discipline/CHANGELOG.md @@ -5,12 +5,6 @@ All notable changes to the `discipline` plugin are documented here. Format follo Entries below `0.9.0` were released under the plugin's former name, `re-anchor`. -## [0.17.2] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.17.1] - 2026-10-07 ### Changed diff --git a/plugins/disk-hygiene/README.md b/plugins/disk-hygiene/README.md index d82aef084a..9419338cee 100644 --- a/plugins/disk-hygiene/README.md +++ b/plugins/disk-hygiene/README.md @@ -126,7 +126,7 @@ switch and data-root authority; and the skill-scoped **belt** inside the `clean` which adds the deny-by-default Bash and deletion-spelling PowerShell discipline during active cleanup work. Both surfaces resolve the kill switch by reading `disk_hygiene_enabled` from user-scope `pluginConfigs` in `settings.json` (located from `${CLAUDE_PLUGIN_ROOT}`, honored only -from user/managed scope since Claude Code 2.1.207, so a repo cannot forge it), register +from user/managed/`--settings` scope since Claude Code 2.1.207, so a repo cannot forge it), register unconditionally, and fail closed to enabled. Hook lifetime: the hooks page says Claude Code registers a skill's frontmatter hooks when the skill is @@ -429,15 +429,16 @@ measurements below carry the conditions they were taken under. `pluginConfigs` in `settings.json` (not the process environment). A configured `false` denies Bash engine invocations outright on the always-on engine gate (whether or not the clean skill is active); PowerShell deletion spellings are denied outright by the skill-scoped belt while `/disk-hygiene:clean` - is active (the always-on gate defers on non-engine commands). The read is honored only from user and managed - scope (Claude Code 2.1.207+), so a project or local repo `settings.json` cannot flip + is active (the always-on gate defers on non-engine commands). The read is honored only from user, managed, and + `--settings` scope (Claude Code 2.1.207+; [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs), + [`--settings`](https://code.claude.com/docs/en/settings#change-a-setting-for-one-session), as of 2026-10-07; + recheck when the settings guide stops letting `--settings` set user-scope keys, or the `pluginConfigs` + scope changes), so a project or local repo `settings.json` cannot flip it; the user file is located from `${CLAUDE_PLUGIN_ROOT}`, not from repo-redirectable environment, and the managed (enterprise) file at its fixed system path wins as the highest-precedence scope so an org can enforce audit-only (the sibling `managed-settings.d/` drop-in directory is merged over it). An absent - or unreadable value fails closed to enabled. A value supplied only via a session `--settings` file is not - read by a hook, and whether `pluginConfigs` honors that flag is unverified since the entry stopped naming - it (as of 2026-10-07; recheck when the [pluginConfigs entry](https://code.claude.com/docs/en/settings-reference#pluginconfigs) - names `--settings` again or a probe shows a `--settings` value read or ignored). The skill's own kill-switch probe + skill-content value remain a + or unreadable value fails closed to enabled. The one residual a hook cannot read is a value supplied only + via a session `--settings` file. The skill's own kill-switch probe + skill-content value remain a defense-in-depth honoring layer over the guard. - **Trust-surface record:** the plugin-level `hooks/hooks.json` PreToolUse registration is a NEW trust surface (a hook that launches in every consumer session), added diff --git a/plugins/disk-hygiene/lib/killswitch_config.py b/plugins/disk-hygiene/lib/killswitch_config.py index 3987771c0c..39eb294355 100644 --- a/plugins/disk-hygiene/lib/killswitch_config.py +++ b/plugins/disk-hygiene/lib/killswitch_config.py @@ -2,12 +2,13 @@ Claude Code stores merged plugin options under ``pluginConfigs[].options`` in the user ``settings.json`` and, since -v2.1.207, reads that key back from user and managed settings only — entries in -a project's ``.claude/settings.json`` or ``.claude/settings.local.json`` are -ignored (https://code.claude.com/docs/en/settings-reference#pluginconfigs). -``--settings`` is unverified since that entry stopped naming it (as of -2026-10-07; recheck when the pluginConfigs entry names ``--settings`` again or -a probe shows a ``--settings`` value read or ignored). That +v2.1.207, reads that key back from user settings, the ``--settings`` flag, and +managed settings only — entries in a project's ``.claude/settings.json`` or +``.claude/settings.local.json`` are ignored +(https://code.claude.com/docs/en/settings-reference#pluginconfigs and +https://code.claude.com/docs/en/settings#change-a-setting-for-one-session, as of +2026-10-07; recheck when the settings guide stops letting ``--settings`` set +user-scope keys, or the pluginConfigs scope changes). That makes the user settings file the one repo-tamper-resistant channel for a safety toggle, so both the report-only ``kill_switch_probe`` and the destructive-action guard resolve the switch by reading it here rather than @@ -64,10 +65,9 @@ def managed_settings_path() -> Path | None: the tamper-resistance. The sibling ``managed-settings.d/`` drop-in directory is also read (see - ``_managed_settings_files``). A session's ``--settings`` file is a runtime - CLI flag no hook observes, so a value supplied only there is not enforced by - the guard; whether ``pluginConfigs`` honors that flag is unverified (see the - module docstring). + ``_managed_settings_files``). The one honored source a hook cannot read is a + session's ``--settings`` file — a runtime CLI flag no hook observes — so a + value supplied only there is not enforced by the guard. """ if sys.platform == "darwin": return Path("/Library/Application Support/ClaudeCode/managed-settings.json") @@ -128,9 +128,8 @@ def _report( # marks the read itself as degraded. _NOT_CONFIGURED_THERE = ( "the toggle is not configured there and the plugin default (enabled) " - "applies. Managed settings, or a --settings flag (unverified since " - "pluginConfigs stopped naming it), could still carry a value this probe " - "cannot see." + "applies. Managed settings or a --settings flag could still carry a value " + "this probe cannot see." ) _ASSUMED_DEFAULT = ( "assuming the default (enabled). This is an assumption, not the configured value." diff --git a/plugins/disk-hygiene/skills/clean/reference/safety-model.md b/plugins/disk-hygiene/skills/clean/reference/safety-model.md index 1fb7085efe..f2f3c09afe 100644 --- a/plugins/disk-hygiene/skills/clean/reference/safety-model.md +++ b/plugins/disk-hygiene/skills/clean/reference/safety-model.md @@ -549,16 +549,17 @@ and both resolve `disk_hygiene_enabled` the same single way: by reading it from `pluginConfigs` in the `settings.json` files, through the shared `lib/killswitch_config.py` reader (the same read the setup skill's `kill_switch_probe.py` reports). Neither surface takes the value from the process environment. -Claude Code honors that key only from user and managed scope since 2.1.207, and a project or +Claude Code honors that key only from user, managed, and `--settings` scope since 2.1.207, and a project or local `.claude/settings.json` is ignored, so a hostile repo cannot flip it. That scoping is verified 2026-09-06 against Claude Code 2.1.263 and the plugins reference, whose statement now lives at -`https://code.claude.com/docs/en/settings-reference#pluginconfigs`, which (read 2026-10-07, Claude Code -2.1.292) gives `pluginConfigs` the scope "User or managed", states that entries in a +`https://code.claude.com/docs/en/settings-reference#pluginconfigs` (read 2026-10-07, Claude Code +2.1.292), which gives `pluginConfigs` the scope "User or managed", states that entries in a project's `.claude/settings.json` or `.claude/settings.local.json` are ignored, and that those entries -were read before v2.1.207. `--settings` is unverified since the entry stopped naming it (as of 2026-10-07; -recheck when the pluginConfigs entry names `--settings` again or a probe shows a `--settings` value read or -ignored; hook-config-delivery fact 5). Recheck when that page stops carrying the ignored-project-scope -statement, or when a release note names `pluginConfigs` scope. The **user** file is located +were read before v2.1.207. The settings guide +(`https://code.claude.com/docs/en/settings#change-a-setting-for-one-session`) says `--settings` "can set +any key your user settings file can set", so `--settings` is a read source too (as of 2026-10-07). Recheck +when the settings guide stops letting `--settings` set user-scope keys, or the `pluginConfigs` scope +changes, or when that page stops carrying the ignored-project-scope statement. The **user** file is located from `${CLAUDE_PLUGIN_ROOT}` (the plugin's true install path, which a repo cannot forge): the `plugins/cache` layout's sibling `settings.json`, or for a local-directory marketplace install `/settings.json` under the account-record config dir above. It is **never** located @@ -570,8 +571,8 @@ closed to enabled otherwise. The **managed** (enterprise) file at its fixed root-owned system path is read too and, as the highest-precedence non-overridable scope, an explicitly configured value there **wins over the user file**, so an organization can enforce audit-only mode; the sibling `managed-settings.d/` drop-in directory is merged -over it (later files win). A session's `--settings` file (a runtime CLI flag no hook observes) is not read -by the guard, and whether `pluginConfigs` honors it is unverified (see above); a value supplied only there is not enforced. When the value +over it (later files win). The one honored source the guard cannot read is a session's `--settings` file +(a runtime CLI flag no hook observes); a value supplied only there is not enforced. When the value resolves `false` (audit-only mode), `false` is guard-enforced as an outright deny with no prompt fallback, but the two surfaces reach different lanes. The **always-on engine gate** enforces it against every Bash engine invocation **whether or not the clean skill is active**; it defers (no output) on any command that diff --git a/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py b/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py index f17a193bb4..0eadb3fbd1 100755 --- a/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py +++ b/plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py @@ -1280,16 +1280,16 @@ def resolve_disk_hygiene_enabled() -> bool: prevent every deletion lane. The guard reads ``disk_hygiene_enabled`` straight out of the ``settings.json`` files (``lib/killswitch_config.py``, the single reader it shares with the report-only probe) — never the process environment. - Since Claude Code 2.1.207 that key is honored only from user and managed - scope, never a project or local ``settings.json`` - (https://code.claude.com/docs/en/settings-reference#pluginconfigs, as of - 2026-10-07), so a hostile repo cannot flip the + Since Claude Code 2.1.207 that key is honored only from user, managed, and + ``--settings`` scope, never a project or local ``settings.json`` + (https://code.claude.com/docs/en/settings-reference#pluginconfigs and + https://code.claude.com/docs/en/settings#change-a-setting-for-one-session, + as of 2026-10-07), so a hostile repo cannot flip the switch. Managed settings are the highest-precedence, non-overridable scope, so a value configured there wins over the user file — that is how an organization enforces audit-only mode. The ``--settings`` file is a session CLI flag a hook - cannot observe, so it is not read here; whether pluginConfigs honors it is - unverified since the settings reference stopped naming it (as of 2026-10-07; - see ``killswitch_config.managed_settings_path`` for the full residual list). The + cannot observe, the one honored source not read here (see + ``killswitch_config.managed_settings_path`` for the full residual list). The environment is rejected on purpose: a repo ``settings.json`` ``env`` block reaches hook subprocesses and carries no provenance a hook could check, so an env-borne toggle (or an env-borne user-settings path) would reopen the hole diff --git a/plugins/disk-hygiene/skills/setup/SKILL.md b/plugins/disk-hygiene/skills/setup/SKILL.md index c19dd54f54..ccef4c1d8a 100644 --- a/plugins/disk-hygiene/skills/setup/SKILL.md +++ b/plugins/disk-hygiene/skills/setup/SKILL.md @@ -167,9 +167,8 @@ fails closed like every other guard-relevant unknown in this plugin. and that default `true` is being assumed, an assumption, never the configured value. The body token `${user_config.disk_hygiene_enabled}` is at most a cross-check: if it expanded to a boolean that contradicts the probe, report the discrepancy instead of silently - preferring either channel (the probe sees user settings only; managed settings can carry - a value the probe cannot see, and so might a `--settings` flag, which is unverified since - the pluginConfigs entry stopped naming it as of 2026-10-07). + preferring either channel (the probe sees user settings only; managed settings or a + `--settings` flag can carry a value the probe cannot see). 6. **Plugin registration**. INFO: confirm the plugin is enabled for this project (`/plugin` → Installed) rather than parsing settings files. diff --git a/plugins/disk-hygiene/skills/setup/scripts/kill_switch_probe.py b/plugins/disk-hygiene/skills/setup/scripts/kill_switch_probe.py index cef758485e..d3a26acabf 100755 --- a/plugins/disk-hygiene/skills/setup/scripts/kill_switch_probe.py +++ b/plugins/disk-hygiene/skills/setup/scripts/kill_switch_probe.py @@ -18,8 +18,7 @@ whole contract. This report is how the ``clean`` skill self-enforces audit-only mode when a body token arrives unexpanded. -Scope: managed settings, and possibly a ``--settings`` flag (unverified since -the pluginConfigs entry stopped naming it, as of 2026-10-07), can also carry +Scope: managed settings and a ``--settings`` flag can also carry ``pluginConfigs`` and are not visible here; the ``detail`` sentence states the path actually probed so the reader can judge the claim. diff --git a/plugins/docs-hygiene/.claude-plugin/plugin.json b/plugins/docs-hygiene/.claude-plugin/plugin.json index adf2307fe9..e704abe054 100644 --- a/plugins/docs-hygiene/.claude-plugin/plugin.json +++ b/plugins/docs-hygiene/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "docs-hygiene", - "version": "0.27.1", + "version": "0.27.0", "description": "Documentation-hygiene toolkit: compress (trim markdown with a semantic-diff check), audit-noise (classify markdown noise), extract-ssot (deduplicate into a single source of truth), audit-encapsulation (citations into skill-private files), rename-references (stale references after renames), audit-derivability (does a doc earn its existence), audit-progressive-disclosure (load tiers), write-for-agents and write-for-humans (authoring). Setup checks markdownlint-cli2.", "author": { "name": "Melodic Software", diff --git a/plugins/docs-hygiene/CHANGELOG.md b/plugins/docs-hygiene/CHANGELOG.md index c6f6b00700..952587a92f 100644 --- a/plugins/docs-hygiene/CHANGELOG.md +++ b/plugins/docs-hygiene/CHANGELOG.md @@ -1,11 +1,5 @@ # Changelog: docs-hygiene plugin -## [0.27.1] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.27.0] - 2026-10-07 ### Added diff --git a/plugins/dometrain-mcp/.claude-plugin/plugin.json b/plugins/dometrain-mcp/.claude-plugin/plugin.json index e90693fc36..e8deeda120 100644 --- a/plugins/dometrain-mcp/.claude-plugin/plugin.json +++ b/plugins/dometrain-mcp/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "dometrain-mcp", - "version": "0.1.5", + "version": "0.1.4", "description": "Bundled Dometrain MCP server (Dometrain-hosted remote HTTP, Bearer auth) for the dometrain grounding skills: search lessons, pull curated lesson documents with on-screen code, and get timestamped deep links. Requires an active Dometrain Pro subscription. Credential entered once through Claude Code's native masked userConfig prompt and stored in secure credential storage. Skip this plugin when you configure your own user-scope dometrain server.", "author": { "name": "Melodic Software", diff --git a/plugins/dometrain-mcp/CHANGELOG.md b/plugins/dometrain-mcp/CHANGELOG.md index bdd018ba74..be79876b3d 100644 --- a/plugins/dometrain-mcp/CHANGELOG.md +++ b/plugins/dometrain-mcp/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `dometrain-mcp` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.1.5] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.1.4] - 2026-10-07 ### Changed diff --git a/plugins/education/.claude-plugin/plugin.json b/plugins/education/.claude-plugin/plugin.json index 46d7a0eec7..2ab4658e26 100644 --- a/plugins/education/.claude-plugin/plugin.json +++ b/plugins/education/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "education", - "version": "0.14.5", + "version": "0.14.4", "description": "Learning tools. teach is a multi-session coach for a general subject or a repo-grounded concept through the Knowledge-Skills-Wisdom progression, with persistent per-topic state, and also a single-session domain primer. explain is a one-shot plain-language explainer. illustrate explains a concept or codebase topic as diagrams: a markdown record plus an interactive page. quiz-me checks your comprehension of a completed change. setup validates the plugin's configuration.", "author": { "name": "Melodic Software", diff --git a/plugins/education/CHANGELOG.md b/plugins/education/CHANGELOG.md index 25768b986e..62f049897e 100644 --- a/plugins/education/CHANGELOG.md +++ b/plugins/education/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `education` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.14.5] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.14.4] - 2026-10-07 ### Changed diff --git a/plugins/eol-normalizer/.claude-plugin/plugin.json b/plugins/eol-normalizer/.claude-plugin/plugin.json index 4e58003eff..e38a1323d1 100644 --- a/plugins/eol-normalizer/.claude-plugin/plugin.json +++ b/plugins/eol-normalizer/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "eol-normalizer", - "version": "0.9.11", + "version": "0.9.10", "description": "Normalize a written file's working-tree line endings to its .gitattributes eol value on edit: symmetric CRLF/LF driven by git check-attr, advisory and never blocking.", "author": { "name": "Melodic Software", diff --git a/plugins/eol-normalizer/CHANGELOG.md b/plugins/eol-normalizer/CHANGELOG.md index ec2a779131..e6542958ab 100644 --- a/plugins/eol-normalizer/CHANGELOG.md +++ b/plugins/eol-normalizer/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `eol-normalizer` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.9.11] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.9.10] - 2026-10-07 ### Changed diff --git a/plugins/evals/.claude-plugin/plugin.json b/plugins/evals/.claude-plugin/plugin.json index f10476c500..ca0b3f5538 100644 --- a/plugins/evals/.claude-plugin/plugin.json +++ b/plugins/evals/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "evals", - "version": "0.6.4", + "version": "0.6.3", "description": "LLM evaluation methodology and eval-suite design, based on Anthropic's evaluation guidance. /evals:methodology answers questions on success criteria, eval design, and grading. /evals:design interviews for measurable success criteria and scaffolds a graded eval suite for an LLM app or Claude Code skill. /evals:plugin-eval preflights the CLI and target, prices a suite before running, and reads the with-versus-without delta. /evals:validate checks case files with no model call.", "author": { "name": "Melodic Software", diff --git a/plugins/evals/CHANGELOG.md b/plugins/evals/CHANGELOG.md index 17bae41adf..f6acc48223 100644 --- a/plugins/evals/CHANGELOG.md +++ b/plugins/evals/CHANGELOG.md @@ -1,11 +1,5 @@ # Changelog: evals -## [0.6.4] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.6.3] - 2026-10-07 ### Changed diff --git a/plugins/explainer-video/.claude-plugin/plugin.json b/plugins/explainer-video/.claude-plugin/plugin.json index 90d528c933..421dffee29 100644 --- a/plugins/explainer-video/.claude-plugin/plugin.json +++ b/plugins/explainer-video/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "explainer-video", - "version": "0.2.10", + "version": "0.2.9", "description": "Short explainer videos made with ManimCE, narrated when the speech plugin is installed and silent otherwise. The produce skill plans the beats, writes one scene script whose scene changes follow the narration's word timings, renders at low quality first, muxes narration and captions with ffmpeg, and checks every render with ffprobe and a frame read-back. A SessionStart hook installs the hash-locked Python packages; the check skill reports readiness.", "author": { "name": "Melodic Software", diff --git a/plugins/explainer-video/CHANGELOG.md b/plugins/explainer-video/CHANGELOG.md index 75fd50ae60..93081d869e 100644 --- a/plugins/explainer-video/CHANGELOG.md +++ b/plugins/explainer-video/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `explainer-video` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.2.10] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. - ## [0.2.9] - 2026-10-04 ### Changed diff --git a/plugins/gaming/.claude-plugin/plugin.json b/plugins/gaming/.claude-plugin/plugin.json index bed3eaee70..46d23fd8df 100644 --- a/plugins/gaming/.claude-plugin/plugin.json +++ b/plugins/gaming/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "gaming", - "version": "0.10.6", + "version": "0.10.5", "description": "Apply, track, tune, and remove the community DLSS 5 Neural Rendering mod (OptiScaler forks) in Windows PC games from Steam, Epic, EA app, Battle.net, GOG, Ubisoft Connect, and Xbox (gaming:dlss5). Anti-cheat checks refuse unless you type an at-your-own-risk acknowledgement. Snapshots allow byte-exact removal; a ledger and upstream watch track fork and driver releases. Ships no NVIDIA binary: the DLL comes from a path, an installed DLSS 5 title, or a configured source.", "author": { "name": "Melodic Software", diff --git a/plugins/gaming/CHANGELOG.md b/plugins/gaming/CHANGELOG.md index e97f553a83..de084dcd04 100644 --- a/plugins/gaming/CHANGELOG.md +++ b/plugins/gaming/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `gaming` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.10.6] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.10.5] - 2026-10-07 ### Changed diff --git a/plugins/github/.claude-plugin/plugin.json b/plugins/github/.claude-plugin/plugin.json index ca0d8fa041..8c16d5615c 100644 --- a/plugins/github/.claude-plugin/plugin.json +++ b/plugins/github/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "github", - "version": "0.3.32", + "version": "0.3.31", "description": "GitHub admin-plane audit, advice, and guided setup over the authenticated user's own gh CLI: billing and cost control, security posture, rulesets and settings drift, Actions policy, and every other org/repo/enterprise settings area. Grounded in live state and current official GitHub docs (zero vendored knowledge); read-only by default, every mutation user-in-loop.", "author": { "name": "Melodic Software", diff --git a/plugins/github/CHANGELOG.md b/plugins/github/CHANGELOG.md index 9a42050ddc..bf4f89408d 100644 --- a/plugins/github/CHANGELOG.md +++ b/plugins/github/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `github` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.3.32] - 2026-10-07 - -### Changed - -- **Upstream records (#6498).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.3.31] - 2026-10-07 ### Changed diff --git a/plugins/go-format/.claude-plugin/plugin.json b/plugins/go-format/.claude-plugin/plugin.json index 8344a4a511..24d90322e9 100644 --- a/plugins/go-format/.claude-plugin/plugin.json +++ b/plugins/go-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "go-format", - "version": "0.5.11", + "version": "0.5.10", "description": "Auto-fix Go formatting and import management on edit via goimports. Runs unconditionally (no consumer-config gate), skipping generated files.", "author": { "name": "Melodic Software", diff --git a/plugins/go-format/CHANGELOG.md b/plugins/go-format/CHANGELOG.md index db12d45f64..2b18485574 100644 --- a/plugins/go-format/CHANGELOG.md +++ b/plugins/go-format/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `go-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.5.11] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.5.10] - 2026-10-07 ### Changed diff --git a/plugins/guardrails/README.md b/plugins/guardrails/README.md index 7f4cc93f18..8e8b3bac50 100644 --- a/plugins/guardrails/README.md +++ b/plugins/guardrails/README.md @@ -283,10 +283,7 @@ out of scope until such a signal exists. scratch root, and the PowerShell lane consults one only for a single literal destination, so their message names none. The operator's levers, narrowest first, are `block_hook_bypass_scratch_roots` (Bash redirect targets and a - PowerShell command's single literal write destination), a session-scoped disable via `claude --settings` - (unverified since the [pluginConfigs entry](https://code.claude.com/docs/en/settings-reference#pluginconfigs) - stopped naming `--settings`, as of 2026-10-07; recheck when it names `--settings` again or a probe shows a - `--settings` value read or ignored), and the + PowerShell command's single literal write destination), a session-scoped disable via `claude --settings`, and the user-global `block_hook_bypass_enabled` switch, which persists across every repository where guardrails is enabled. They arrive once per session as a `systemMessage`, which Claude Code reads on exit 2 as on exit 0 diff --git a/plugins/harness-config/.claude-plugin/plugin.json b/plugins/harness-config/.claude-plugin/plugin.json index 584d29ea5c..ef57a9dda0 100644 --- a/plugins/harness-config/.claude-plugin/plugin.json +++ b/plugins/harness-config/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "harness-config", - "version": "1.13.2", + "version": "1.13.1", "description": "Configuration health for a repo's Claude Code: audit (settings, .mcp.json, hooks, plugins, permission drift), audit-automation-gaps, audit-permission-grants, audit-permission-state (effective rules with provenance), draft-auto-mode-rules (prints an autoMode block), audit-instructions (instructions the model no longer needs, conflicts), audit-prompting-postures, audit-pass (one ordered, resumable pass), unhobble (strip instructions, re-add what evidence earns), and setup.", "author": { "name": "Melodic Software", diff --git a/plugins/harness-config/CHANGELOG.md b/plugins/harness-config/CHANGELOG.md index 603fead27d..7cde9b3975 100644 --- a/plugins/harness-config/CHANGELOG.md +++ b/plugins/harness-config/CHANGELOG.md @@ -5,12 +5,6 @@ All notable changes to the `harness-config` plugin are documented here. Format f Versions 0.51.8 to 0.51.9 and 0.51.11 to 0.51.14 were reserved by parallel branches and never released. -## [1.13.2] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [1.13.1] - 2026-10-07 ### Changed diff --git a/plugins/harness-config/reference/agents-md-liveness.md b/plugins/harness-config/reference/agents-md-liveness.md index 260ebf9d2b..0383bd8bed 100644 --- a/plugins/harness-config/reference/agents-md-liveness.md +++ b/plugins/harness-config/reference/agents-md-liveness.md @@ -78,21 +78,22 @@ displacement is a condition of the default value alone. **Where the value lives**, which is what a check reads rather than the `/config` panel: our checks read the `instructionFiles` option under the `agents-md@builtin` key of `pluginConfigs`, from user -settings (`~/.claude/settings.json`) or managed settings, and ignore the key in project and local -settings files. A `--settings` file is unverified since the -[`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped -naming the flag (as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows -a `--settings` value read or ignored). +settings (`~/.claude/settings.json`), a `--settings` file or managed settings, and ignore the key +in project and local settings files. - **Pointer**: for where the setting is honored and its JSON shape, see - . -- **As of**: 2026-09-21 -- **Recheck trigger**: the option key or plugin id changes, the honored scope set changes, or the - setting becomes readable from project or local settings. - -Because the honored scopes are user and managed, resolve the **effective** value across them. -Reading one scope answers the wrong question in both directions: a user scope naming the default -can be overridden by a managed one, and the reverse. + ; for the `--settings` + and `pluginConfigs` scopes, see + and + . +- **As of**: 2026-10-07 +- **Recheck trigger**: the option key or plugin id changes, the settings guide stops letting + `--settings` set user-scope keys, the `pluginConfigs` scope changes, or the setting becomes + readable from project or local settings. + +Because the honored scopes are user, `--settings` and managed, resolve the **effective** value +across them. Reading one scope answers the wrong question in both directions: a user scope naming +the default can be overridden by a managed one, and the reverse. **The legacy key still counts.** Read `projectInstructions` under the same `agents-md@builtin` entry as well as `instructionFiles`: diff --git a/plugins/harness-config/skills/audit-instructions/reference/criteria.md b/plugins/harness-config/skills/audit-instructions/reference/criteria.md index b75b152b9c..cff5cc0086 100644 --- a/plugins/harness-config/skills/audit-instructions/reference/criteria.md +++ b/plugins/harness-config/skills/audit-instructions/reference/criteria.md @@ -955,9 +955,9 @@ skill bodies. the documented reasons, does not load the file even with no `CLAUDE.md` in sight, while one under the `claude-md-and-agents-md` setting loads it even **with** a `CLAUDE.md` beside it, which makes a read of it redundant where the - displacement test alone would have exempted it. That setting is a user or managed - one (`--settings` is unverified, see the liveness reference), so the value to resolve is the - **effective** one across those scopes, never a single scope's copy. + displacement test alone would have exempted it. That setting is a user, `--settings` or managed + one, so the value to resolve is the **effective** one across those scopes, never a single + scope's copy. There, in the first case, an instruction to read it is the only thing that puts it in context, and flagging the read as redundant would propose deleting the load. Resolve the availability **and mode** conditions from the dated records in diff --git a/plugins/harness-config/skills/audit-prompting-postures/SKILL.md b/plugins/harness-config/skills/audit-prompting-postures/SKILL.md index 552cfa4b49..332ae3b29c 100644 --- a/plugins/harness-config/skills/audit-prompting-postures/SKILL.md +++ b/plugins/harness-config/skills/audit-prompting-postures/SKILL.md @@ -86,8 +86,8 @@ available in the session at all and which files the instruction-files mode loads than from a copy that can drift. **Displacement is the default mode's answer, not the only one**: under the `claude-md-and-agents-md` setting both files load, each directory's `CLAUDE.md` first and its `AGENTS.md` after, so an `AGENTS.md` beside a `CLAUDE.md` is live there and belongs in the set even -though the default mode would call it displaced. That option is a user or managed -setting (`--settings` is unverified, see the liveness reference), so resolve the **effective** value across those scopes rather than one scope's copy, which +though the default mode would call it displaced. That option is a user, `--settings` or managed +setting, so resolve the **effective** value across those scopes rather than one scope's copy, which answers the wrong question whichever way the override runs. **The mode is the second question, not the only one, and either can rule the file out.** Availability comes first and is not a mode question: a session where support is unavailable, for a reason that diff --git a/plugins/harness-memory/.claude-plugin/plugin.json b/plugins/harness-memory/.claude-plugin/plugin.json index 5d37f4f4e0..831b4c2837 100644 --- a/plugins/harness-memory/.claude-plugin/plugin.json +++ b/plugins/harness-memory/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "harness-memory", - "version": "1.1.2", + "version": "1.1.1", "description": "Keeps a repo's Claude Code memory layer healthy, against criteria from official Claude Code docs. audit checks CLAUDE.md, a root AGENTS.md, CLAUDE.local.md, .claude/rules/, and auto-memory for structure, size, placement, and index integrity, with scripted and judgment checks. stateless inspects, disables, and (after confirmation) purges Claude-written auto memory across settings scopes. Whether instruction text fits the current model belongs to harness-config.", "author": { "name": "Melodic Software", diff --git a/plugins/harness-memory/CHANGELOG.md b/plugins/harness-memory/CHANGELOG.md index e9268aac8d..6fdcf24d0f 100644 --- a/plugins/harness-memory/CHANGELOG.md +++ b/plugins/harness-memory/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `harness-memory` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [1.1.2] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [1.1.1] - 2026-10-07 ### Changed diff --git a/plugins/harness-ops/skills/lanes/SKILL.md b/plugins/harness-ops/skills/lanes/SKILL.md index 7c5980c2ed..ed25879034 100644 --- a/plugins/harness-ops/skills/lanes/SKILL.md +++ b/plugins/harness-ops/skills/lanes/SKILL.md @@ -165,8 +165,7 @@ Lanes are defined in a JSON config, resolved first-hit-wins: `--config FILE` → `$HARNESS_OPS_LANES_CONFIG` → `/.work/lanes/lanes.json`. Each lane carries a `name`, a `prompt` file path, a required `effort`, and optional `model`/`settings` (a session-only `claude --settings` override, e.g. opting the lane into the -`autonomy` plugin's lane-stop gate; that `--settings` delivery is unverified, see -[context/config.md](context/config.md)). The full +`autonomy` plugin's lane-stop gate). The full schema, resolution rules, and the prompt-storage seam live in [context/config.md](context/config.md). Read it before authoring a config. diff --git a/plugins/harness-ops/skills/lanes/context/config.md b/plugins/harness-ops/skills/lanes/context/config.md index 9a91e022ff..a1fc943ada 100644 --- a/plugins/harness-ops/skills/lanes/context/config.md +++ b/plugins/harness-ops/skills/lanes/context/config.md @@ -64,7 +64,7 @@ handing the fixing to workers, so it sits one level below the verdict lanes. A p | `lanes[].prompt` | yes | Path to the lane's canonical prompt file. Relative → resolved against `prompt_dir`; absolute → used as-is. The file's full contents seed the session (positional prompt). A missing or empty file skips that lane with an error. | | `lanes[].model` | no | Passed as `claude --model`. An alias (`opus`, `sonnet`, `fable`) or a full model id. Omit to inherit the machine default. | | `lanes[].effort` | yes | Passed as `claude --effort`. Required on every lane, chosen from the "Choose an effort level" table above: `start` and `restart` refuse a lane with no effort (or a `null` one) with an error naming the lane, this key and that table, and still launch the other lanes; `restart` refuses before stopping, so the running session stays up. When `CLAUDE_CODE_EFFORT_LEVEL` is set in the launcher's environment, which every lane inherits, the launcher prints one warning per run that the configured levels may not hold. Pointer: for how that variable ranks against `--effort` and effort pins, see its row under [Variables](https://code.claude.com/docs/en/env-vars#variables). As of: 2026-10-02. Recheck trigger: that row's precedence changes. One of `low`, `medium`, `high`, `xhigh`, `max`, `ultracode` (validated; a bad value skips the lane). `ultracode` [requires Claude Code v2.1.203 or later](https://code.claude.com/docs/en/model-config#adjust-effort-level); below that floor the CLI rejects the value outright (`Unknown --effort value 'ultracode'`) and starts the session at the default effort, so the launcher checks the installed `claude --version` and skips the lane rather than launching it at an unintended effort. `restart` makes that check before stopping, so a refused lane keeps running. For what `ultracode` does to the effort level and when a model cannot run it, see the same section. As of 2026-10-02; recheck when the effort level set or the ultracode version floor changes. | -| `lanes[].settings` | no | A JSON **object** passed inline as `claude --settings`, a session-only override that never persists. The motivating use is opting a lane into the `autonomy` plugin's lane-stop gate via a `pluginConfigs` override (example above; the plugin id is marketplace-qualified, `@`, for however the plugin was installed). That `--settings` delivery is unverified since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped naming the flag (as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` value read or ignored; hook-config-delivery fact 5). A non-object value skips the lane with an error. A gate request (`lane_stop_gate_enabled: true` under an `autonomy` key) additionally triggers launch-time ARMING: the launcher runs autonomy's `hooks/lane-stop-gate-arm.sh` and injects a random `lane_stop_gate_arm_id` into the launched settings, the trusted per-session channel the gate actually honors (it ignores the bare env mirror a repo `env` block could forge). A gate-requesting lane that cannot be armed (autonomy missing/pre-0.12.0, arming error, managed-settings veto) is skipped with an error rather than launched silently ungated. | +| `lanes[].settings` | no | A JSON **object** passed inline as `claude --settings`, a session-only override that never persists. The motivating use is opting a lane into the `autonomy` plugin's lane-stop gate via a `pluginConfigs` override (example above; the plugin id is marketplace-qualified, `@`, for however the plugin was installed). A non-object value skips the lane with an error. A gate request (`lane_stop_gate_enabled: true` under an `autonomy` key) additionally triggers launch-time ARMING: the launcher runs autonomy's `hooks/lane-stop-gate-arm.sh` and injects a random `lane_stop_gate_arm_id` into the launched settings, the trusted per-session channel the gate actually honors (it ignores the bare env mirror a repo `env` block could forge). A gate-requesting lane that cannot be armed (autonomy missing/pre-0.12.0, arming error, managed-settings veto) is skipped with an error rather than launched silently ungated. | Lane names are free-form (`work`, `work-2`, `babysit`, `decide`, …); nothing is hardcoded. The set above mirrors the lanes this repo's telemetry conventions use, diff --git a/plugins/harness-ops/skills/lanes/scripts/lane-launcher.sh b/plugins/harness-ops/skills/lanes/scripts/lane-launcher.sh index 9761352c6f..4876e72d2d 100755 --- a/plugins/harness-ops/skills/lanes/scripts/lane-launcher.sh +++ b/plugins/harness-ops/skills/lanes/scripts/lane-launcher.sh @@ -114,11 +114,7 @@ # settings optional; a JSON OBJECT passed inline as --settings for that # session only (e.g. a pluginConfigs override opting the lane into # the autonomy plugin's lane-stop gate). Non-object values are -# rejected. A pluginConfigs value delivered through --settings is -# unverified since the settings reference stopped naming the flag -# (as of 2026-10-07; recheck when the pluginConfigs entry names -# --settings again or a probe shows a --settings value read or -# ignored; hook-config-delivery fact 5). +# rejected. # # Lane-stop gate arming (#1784): # A lane whose settings request the autonomy lane-stop gate diff --git a/plugins/harness-ops/skills/machine-profile/SKILL.md b/plugins/harness-ops/skills/machine-profile/SKILL.md index 6f4078d7b5..65b664a85d 100644 --- a/plugins/harness-ops/skills/machine-profile/SKILL.md +++ b/plugins/harness-ops/skills/machine-profile/SKILL.md @@ -49,7 +49,7 @@ Discovery reads identity domains from the `includeIf "gitdir:..."` entries in `g **Claim:** `gh` takes its configuration directory from `GH_CONFIG_DIR`, then `$XDG_CONFIG_HOME/gh`, then `$AppData/GitHub CLI` on Windows, then `$HOME/.config/gh`, and reports no directory for the working directory. **Basis:** `gh help environment` on gh 2.98.0, run 2026-10-01. **As of:** 2026-10-01. **Recheck:** a gh release changes the `GH_CONFIG_DIR` lookup order in `gh help environment`. -**Claim:** `pluginConfigs` is read from user settings and managed settings only (`--settings` is unverified since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped naming it, as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` value read or ignored), and `claude plugin install --config` writes user settings whatever scope flag is given, so one slot serves the whole machine. **Basis:** facts 5 and 9 of `docs/conventions/hook-config-delivery` (Claude Code 2.1.283, 2026-09-27). **As of:** 2026-10-01. **Recheck:** the documented `pluginConfigs` read scopes change, or `--config` starts honoring a scope flag. +**Claim:** `pluginConfigs` is read from user settings, `--settings` and managed settings only, and `claude plugin install --config` writes user settings whatever scope flag is given, so one slot serves the whole machine. **Basis:** facts 5 and 9 of `docs/conventions/hook-config-delivery` (Claude Code 2.1.292, 2026-10-07 for fact 5; 2.1.283, 2026-09-27 for fact 9). **As of:** 2026-10-07. **Recheck:** the settings guide stops letting `--settings` set user-scope keys, the documented `pluginConfigs` scope changes, or `--config` starts honoring a scope flag. ## Next diff --git a/plugins/harness-ops/skills/plugins/SKILL.md b/plugins/harness-ops/skills/plugins/SKILL.md index 9b4c398a06..7aff5ab38a 100644 --- a/plugins/harness-ops/skills/plugins/SKILL.md +++ b/plugins/harness-ops/skills/plugins/SKILL.md @@ -306,10 +306,9 @@ no human is present to receive the count. **Configured value: `${user_config.install_new}`**. We treat this line as rendering the configured word into the skill content before the model sees it, but **only when the key is explicitly set** -in one of the two sources this skill reads `pluginConfigs` from: user settings -(`~/.claude/settings.json`) or managed settings, with managed over user (`--settings` is -unverified since the entry stopped naming it, as of 2026-10-07; recheck when the entry names -`--settings` again or a probe shows a `--settings` value read or ignored). A project's `.claude/settings.json` or `.claude/settings.local.json` entry does +in one of the three sources this skill reads `pluginConfigs` from: user settings +(`~/.claude/settings.json`), `--settings`, or managed settings, with precedence managed → +`--settings` → user. A project's `.claude/settings.json` or `.claude/settings.local.json` entry does nothing at all, and declaring the option in `plugin.json` alone does not make its value readable here either. See [context/scope-semantics.md](context/scope-semantics.md) for the read path, its pointer, and why it differs from `enabledPlugins`, which this same skill reads from project and diff --git a/plugins/harness-ops/skills/plugins/context/gotchas.md b/plugins/harness-ops/skills/plugins/context/gotchas.md index 16ae3d8f40..4be0b50025 100644 --- a/plugins/harness-ops/skills/plugins/context/gotchas.md +++ b/plugins/harness-ops/skills/plugins/context/gotchas.md @@ -194,11 +194,8 @@ plugin from a local marketplace): a `userConfig` key set in user settings or thr provided the `pluginConfigs` payload nests the key under `options`; the spoke half rests on the on-disk observation above. Keep the render in `SKILL.md` and branch on that line. [scope-semantics.md](scope-semantics.md) "`userConfig`: an unset key renders the literal -placeholder" holds the payload shape and the probe recipe. The `--settings` delivery is -unverified since the `pluginConfigs` entry stopped naming it (as of 2026-10-07; recheck when the -entry names `--settings` again or a probe shows a `--settings` value read or ignored); the -substitution itself is the claim here. Recheck when a release note changes `userConfig` -substitution in skill bodies. +placeholder" holds the payload shape and the probe recipe. Recheck when a release note changes +`userConfig` substitution in skill bodies. ## `sync` updates the plugin that provides `sync` diff --git a/plugins/harness-ops/skills/plugins/context/scope-semantics.md b/plugins/harness-ops/skills/plugins/context/scope-semantics.md index dbcdb5d126..072888c690 100644 --- a/plugins/harness-ops/skills/plugins/context/scope-semantics.md +++ b/plugins/harness-ops/skills/plugins/context/scope-semantics.md @@ -348,12 +348,9 @@ This skill reads both surfaces, and they do not agree on which scopes count. Get is silent in both directions, so the asymmetry is stated here once and pointed at from everywhere else. -**`pluginConfigs`: two sources only.** This skill reads `pluginConfigs` from user settings -(`~/.claude/settings.json`) and managed settings, with managed over user -([`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) lists the -scope as "User or managed"). `--settings` is unverified since that entry stopped naming it (as of -2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` value -read or ignored). The skill ignores entries in a project's `.claude/settings.json` or +**`pluginConfigs`: three sources only.** This skill reads `pluginConfigs` from user settings +(`~/.claude/settings.json`), `--settings`, and managed settings, with precedence +managed → `--settings` → user, and ignores entries in a project's `.claude/settings.json` or `.claude/settings.local.json` (Claude Code ignores them from v2.1.207, since a cloned repository could otherwise supply values). In every one of those sources the value nests under `options`: `{"pluginConfigs":{"@":{"options":{"":""}}}}`. A key placed directly @@ -362,10 +359,11 @@ under the plugin id is silently ignored and the render shows the literal placeho - **Pointer**: for where `pluginConfigs` values are read, see [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs), which [Where values are stored](https://code.claude.com/docs/en/plugins/manifest-reference#where-values-are-stored) - links. -- **As of**: 2026-09-05 -- **Recheck trigger**: the honored source set changes, or project or local settings become a - source again. + links; for `--settings` as a source, see + [Change a setting for one session](https://code.claude.com/docs/en/settings#change-a-setting-for-one-session). +- **As of**: 2026-10-07 +- **Recheck trigger**: the settings guide stops letting `--settings` set user-scope keys, the + `pluginConfigs` scope changes, or project or local settings become a source again. **`enabledPlugins`: user, project, and local all count**, merged local > project > user. That is why `fleet-state.sh` reads all three settings maps for enablement, and why doing the same for @@ -421,12 +419,10 @@ default substitutes into skill content, so the two do not conflict. **Probe recipe.** The `pluginConfigs` payload must nest the key under `options`, in the shape "`pluginConfigs` and `enabledPlugins` have OPPOSITE scope rules" above gives; a key placed directly under the plugin id is ignored without warning, and a control set that way renders literal, which -looks exactly like a substitution failure. With the right shape, `--settings` substituted the same +looks exactly like a substitution failure. With the right shape, `--settings` substitutes the same as user settings (verified 2026-09-06 on 2.1.263, alongside a sibling key set in user settings; -recheck when a release note changes `userConfig` substitution), so either source was a valid -positive control. `--settings` is unverified since the `pluginConfigs` entry stopped naming it (as -of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` -value read or ignored), so prefer the user-settings control. `claude plugin install --config =` +recheck when a release note changes `userConfig` substitution), so either source is a valid +positive control. `claude plugin install --config =` writes the user-settings entry in that shape, which is the cheapest way to set one. The placeholder itself is written only in `SKILL.md`, never in a spoke, because substitution happens in what Claude Code renders and a spoke read returns plain bytes; see [gotchas.md](gotchas.md) "A spoke file never diff --git a/plugins/harness-ops/skills/plugins/context/sync-install-enable.md b/plugins/harness-ops/skills/plugins/context/sync-install-enable.md index 79659af32f..7486690241 100644 --- a/plugins/harness-ops/skills/plugins/context/sync-install-enable.md +++ b/plugins/harness-ops/skills/plugins/context/sync-install-enable.md @@ -68,9 +68,8 @@ step's prose, is what to branch on: - **`none`**: install nothing; list the entries under "Action needed" in the report only **A headless run launched with `--setting-sources` that omits `user` silently reverts this policy to -`ask`.** `pluginConfigs` is read from user settings and managed settings only (see -[scope-semantics.md](scope-semantics.md); `--settings` is unverified since the entry stopped -naming it, as of 2026-10-07), so dropping `user` from the source list drops the +`ask`.** `pluginConfigs` is read from user settings, `--settings`, and managed settings only (see +[scope-semantics.md](scope-semantics.md)), so dropping `user` from the source list drops the configured `install_new` with it, and the render falls back to the unset placeholder, which this step correctly reads as `ask`. That is the right fallback and the wrong silence: say so in the report rather than letting a policy the user set appear to have been honored. diff --git a/plugins/implementation/.claude-plugin/plugin.json b/plugins/implementation/.claude-plugin/plugin.json index 6fcbe1733b..4199e1f59f 100644 --- a/plugins/implementation/.claude-plugin/plugin.json +++ b/plugins/implementation/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "implementation", - "version": "0.23.2", + "version": "0.23.1", "description": "Disciplined implementation stage: execute approved plans inline (`/implementation:implement`) or via orchestrated worker subagents (`/implementation:implement-dispatch`) with incremental validation, TDD-by-default cadence, green-checkpoint commits, scope-fence drift detection, and divergence detection that routes back to planning. Build/test/lint, testing, and outcome verification live in the companion `toolchain`, `testing`, and `verification` plugins, invoked when installed.", "author": { "name": "Melodic Software", diff --git a/plugins/implementation/CHANGELOG.md b/plugins/implementation/CHANGELOG.md index d63df82b49..55c4417bc3 100644 --- a/plugins/implementation/CHANGELOG.md +++ b/plugins/implementation/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `implementation` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.23.2] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.23.1] - 2026-10-07 ### Changed diff --git a/plugins/instruction-placement/scripts/render-index.sh b/plugins/instruction-placement/scripts/render-index.sh index 9d38692493..9010e231d8 100755 --- a/plugins/instruction-placement/scripts/render-index.sh +++ b/plugins/instruction-placement/scripts/render-index.sh @@ -461,10 +461,9 @@ fi # The import stays harmless either way: "Claude Code skips an `AGENTS.md` it has # already loaded, so one that your `CLAUDE.md` imports or symlinks to isn't read # twice" (code.claude.com/docs/en/memory, "Choose which instruction files load"; -# fetched 2026-10-01; recheck when that table changes). The setting is a user -# or managed one (`--settings` is unverified since the pluginConfigs entry -# stopped naming it, as of 2026-10-07), which no repository can ship, so the -# gate keeps the default's answer. +# fetched 2026-10-01; recheck when that table changes). The setting is a user, +# `--settings` or managed one, which no repository can ship, so the gate keeps +# the default's answer. # # NATIVE means no CLAUDE.md, CLAUDE.local.md or root .claude/CLAUDE.md sits on # the file's own path, so nothing in this repository stops Claude Code reading diff --git a/plugins/instruction-placement/skills/migrate/reference/shim-droppable.md b/plugins/instruction-placement/skills/migrate/reference/shim-droppable.md index db805503f6..a4bc9ec8f2 100644 --- a/plugins/instruction-placement/skills/migrate/reference/shim-droppable.md +++ b/plugins/instruction-placement/skills/migrate/reference/shim-droppable.md @@ -29,7 +29,7 @@ three. A root that cannot be resolved here is unknown, and fails every condition | # | Holds when | Read it from | |---|---|---| | A | Nothing takes precedence over an `AGENTS.md`: no `CLAUDE.md`, `.claude/CLAUDE.md` or `CLAUDE.local.md` at or above the working directory other than the shims going, **and** no directory on the path from the repository root to a nested `AGENTS.md`, that directory included, holds a `.claude/CLAUDE.md` or a non-shim `CLAUDE.md` or `CLAUDE.local.md` | The ancestor walk below, run from each directory contributors start sessions in; the nested path walk below, over every `AGENTS.md` inside the repository, tracked or not; and the operator for the other machines, whose ancestors (a `~/work/CLAUDE.md`) and uncommitted `CLAUDE.local.md` files this machine cannot see | -| B | **Project instructions** on this machine reads `AGENTS.md` with no `CLAUDE.md`: `claude-md-or-agents-md` (the default) or `claude-md-and-agents-md` | `pluginConfigs["agents-md@builtin"].options.instructionFiles` in `/settings.json` and managed settings; read any `--settings` file too, but the flag is unverified for `pluginConfigs` since the entry stopped naming it (as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a `--settings` value read or ignored); absent everywhere is the default. Project and local settings are ignored for it, so never read them as the answer. `claude-md` or `managed-only` fails | +| B | **Project instructions** on this machine reads `AGENTS.md` with no `CLAUDE.md`: `claude-md-or-agents-md` (the default) or `claude-md-and-agents-md` | `pluginConfigs["agents-md@builtin"].options.instructionFiles` in `/settings.json`, managed settings and any `--settings` file; absent everywhere is the default. Project and local settings are ignored for it, so never read them as the answer. `claude-md` or `managed-only` fails | | C | The loader is present and not disabled on this machine | `/harness-ops:inventory --bundled`, `builtin_plugins.cc-plugin-agents-md` (`in_loader`, `load`, `gated`, `gate_flags`), and no `enabledPlugins` entry set `false` in any scope (`` user settings, managed, project, local, `--settings`) for `agents-md@builtin` or the `id` the lane prints. Inventory absent, the lane `broken`, or the entry missing is unknown. With `disableAllHooks` or `allowManagedHooksOnly` set `true` in any scope, C holds only on v2.1.287 or later, the build on which built-in mods are verified to keep running under both; an older or unknown version is unknown | | D | Every user, machine and organization the repository serves reads `AGENTS.md` directly | Ask the operator, with the list below. Any yes, and any "don't know", fails | | E | Nothing reachable through the `@` import graph of any `AGENTS.md`, root or nested, lies outside the working directory | The import-graph walk below, from every `AGENTS.md` and from each session start directory. Any `EXTERNAL`, `UNRESOLVED` or `DEPTH` row fails | diff --git a/plugins/instruction-placement/skills/migrate/reference/sources.md b/plugins/instruction-placement/skills/migrate/reference/sources.md index 8e3882dd9a..f90393a6fd 100644 --- a/plugins/instruction-placement/skills/migrate/reference/sources.md +++ b/plugins/instruction-placement/skills/migrate/reference/sources.md @@ -324,14 +324,15 @@ The record behind the skill body's `## Boundary` section for `cc-plugin-agents-m subdirectory's `CLAUDE.md` and `.claude/rules/` files, and path-scoped rules, still load when Claude reads a file there"). The value is read from `pluginConfigs` in "`~/.claude/settings.json`, a `--settings` file, or managed settings. Claude Code ignores it in project and local settings - files." (The memory page quoted here named `--settings` on 2026-10-01. The - [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry read - 2026-10-07 gives the scope "User or managed" and no longer names the flag, so `--settings` is - unverified as of 2026-10-07; recheck when the entry names `--settings` again or a probe shows a - `--settings` value read or ignored.) The option's first key, `projectInstructions` (`claude`, + files." (The settings guide says `--settings` "can set any key your user settings file can set", + and the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry + gives the scope "User or managed"; see + [Change a setting for one session](https://code.claude.com/docs/en/settings#change-a-setting-for-one-session), + as of 2026-10-07; recheck when the settings guide stops letting `--settings` set user-scope keys, + or the `pluginConfigs` scope changes.) The option's first key, `projectInstructions` (`claude`, `agents-fallback`, `both`, `none`), is still honored while `instructionFiles` reads as its - default, so an operator's mode can come from either key; like `instructionFiles`, it is a user - or managed value a repository cannot rely on. Condition A: the files that "Count, so Claude reads them instead of `AGENTS.md`" are "a + default, so an operator's mode can come from either key; like `instructionFiles`, it is a user, + `--settings` or managed value a repository cannot rely on. Condition A: the files that "Count, so Claude reads them instead of `AGENTS.md`" are "a `CLAUDE.md`, `.claude/CLAUDE.md`, or `CLAUDE.local.md` in your working directory or any directory above it", the walk to the filesystem root, while "Don't count, and keep loading alongside `AGENTS.md`: your `~/.claude/CLAUDE.md`, your organization's managed `CLAUDE.md`, and @@ -434,7 +435,7 @@ The record behind the skill body's `## Boundary` section for `cc-plugin-agents-m comes to state when a subdirectory's `AGENTS.md` loads under `claude-md-and-agents-md` or whether an import expands under `managed-only`; settings-reference documents how a built-in plugin is - disabled; the settings-reference `pluginConfigs` entry names `--settings` again; settings-reference or the mods overview changes whether built-in mods keep running + disabled; settings-reference or the mods overview changes whether built-in mods keep running under `disableAllHooks` or `allowManagedHooksOnly`, or stops listing `cc-plugin-agents-md` as one; a changelog entry names `AGENTS.md`, `instructionFiles`, `projectInstructions` or the `agents-md` plugin; or the README's "Setting the option" paragraph on the old key changes. diff --git a/plugins/kindle-dedrm/.claude-plugin/plugin.json b/plugins/kindle-dedrm/.claude-plugin/plugin.json index 88d48a34a2..87e2cbc1bb 100644 --- a/plugins/kindle-dedrm/.claude-plugin/plugin.json +++ b/plugins/kindle-dedrm/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "kindle-dedrm", - "version": "0.8.5", + "version": "0.8.4", "description": "Manage the Kindle for PC 2.8.0 + Calibre DeDRM workflow for personal-use ebook DRM removal on books the user owns (Windows only). Action router with setup, sync, update, cleanup, and status, each state mutation paired with a documented compensating reversal.", "author": { "name": "Melodic Software", diff --git a/plugins/kindle-dedrm/CHANGELOG.md b/plugins/kindle-dedrm/CHANGELOG.md index 3c24763494..5c1dfc7afb 100644 --- a/plugins/kindle-dedrm/CHANGELOG.md +++ b/plugins/kindle-dedrm/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `kindle-dedrm` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.8.5] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.8.4] - 2026-10-07 ### Changed diff --git a/plugins/knowledge/.claude-plugin/plugin.json b/plugins/knowledge/.claude-plugin/plugin.json index 16d2dc426b..bf6914b1b8 100644 --- a/plugins/knowledge/.claude-plugin/plugin.json +++ b/plugins/knowledge/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "knowledge", - "version": "0.20.3", + "version": "0.20.2", "description": "Ingests external knowledge into synthesized artifacts: book-distill (PDF or EPUB into author-attributed reference files), video-digest (one YouTube or X video: transcript, links, repo applicability), course-digest (Dometrain and Teachable courses into recommendations), docpage-digest (one documentation page into a verified knowledge slice), and map-corpus (a multi-resource corpus into a classified link map and an approved docpage-digest queue). setup sets where artifacts land.", "author": { "name": "Melodic Software", diff --git a/plugins/knowledge/CHANGELOG.md b/plugins/knowledge/CHANGELOG.md index 57cbb5741f..475c658328 100644 --- a/plugins/knowledge/CHANGELOG.md +++ b/plugins/knowledge/CHANGELOG.md @@ -4,12 +4,6 @@ All notable changes to the `knowledge` plugin are recorded here. The `version` i `.claude-plugin/plugin.json` is the delivery vehicle. A consumer receives a change only after that version increases. -## [0.20.3] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.20.2] - 2026-10-07 ### Changed diff --git a/plugins/machine-health/.claude-plugin/plugin.json b/plugins/machine-health/.claude-plugin/plugin.json index d2666c86a8..8dc62f30b6 100644 --- a/plugins/machine-health/.claude-plugin/plugin.json +++ b/plugins/machine-health/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "machine-health", - "version": "0.16.6", + "version": "0.16.5", "description": "Workstation health audit: OS-specific checks (disk, OS updates, security posture, CISA KEV correlation) run from a versioned catalog with trend-aware severity, approval-gated remediations, and dated markdown reports. Windows fully implemented; macOS/Linux scaffolded (report UNKNOWN and stop). Machine state persists in the plugin data directory; the report directory and check catalog are configurable.", "author": { "name": "Melodic Software", diff --git a/plugins/machine-health/CHANGELOG.md b/plugins/machine-health/CHANGELOG.md index 9b27b9bf4e..a507923717 100644 --- a/plugins/machine-health/CHANGELOG.md +++ b/plugins/machine-health/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `machine-health` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.16.6] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.16.5] - 2026-10-07 ### Changed diff --git a/plugins/markdown-format/.claude-plugin/plugin.json b/plugins/markdown-format/.claude-plugin/plugin.json index 845b234dfa..99ebf7fa3f 100644 --- a/plugins/markdown-format/.claude-plugin/plugin.json +++ b/plugins/markdown-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "markdown-format", - "version": "0.12.13", + "version": "0.12.12", "description": "Auto-format and lint Markdown on edit via markdownlint-cli2, only in repos that carry their own markdownlint config.", "author": { "name": "Melodic Software", diff --git a/plugins/markdown-format/CHANGELOG.md b/plugins/markdown-format/CHANGELOG.md index 17a02a9fc9..45b08bab36 100644 --- a/plugins/markdown-format/CHANGELOG.md +++ b/plugins/markdown-format/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `markdown-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.12.13] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.12.12] - 2026-10-07 ### Changed diff --git a/plugins/miro/.claude-plugin/plugin.json b/plugins/miro/.claude-plugin/plugin.json index c1294d3b16..436e8403b7 100644 --- a/plugins/miro/.claude-plugin/plugin.json +++ b/plugins/miro/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "miro", - "version": "0.6.8", + "version": "0.6.7", "description": "Miro board management over the Model Context Protocol: create and manage boards, sticky notes, shapes, frames, connectors, and tags for EventStorming, brainstorming, and diagramming. Ships a local stdio MCP server that installs its pinned npm dependencies on first launch (needs Node.js 24+ and npm); installs disabled, so opt in. The server starts without a Miro API token; until one is set, each tool call explains how to set it.", "author": { "name": "Melodic Software", diff --git a/plugins/miro/CHANGELOG.md b/plugins/miro/CHANGELOG.md index 0f621f1edf..9ef56bbb6f 100644 --- a/plugins/miro/CHANGELOG.md +++ b/plugins/miro/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `miro` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.6.8] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.6.7] - 2026-10-07 ### Changed diff --git a/plugins/pixel-art/.claude-plugin/plugin.json b/plugins/pixel-art/.claude-plugin/plugin.json index 6db7e9ab71..580e69e0dd 100644 --- a/plugins/pixel-art/.claude-plugin/plugin.json +++ b/plugins/pixel-art/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "pixel-art", - "version": "0.6.8", + "version": "0.6.7", "description": "Creates pixel art with no external tools: sprites (sprite), animation sprite sheets for RPG Maker MZ, Godot, PICO-8, or plain strips with Aseprite-style frame data and GIF previews (animate), tilesets and parallax (tileset), UI skins and bitmap fonts (ui), effect sheets (vfx), and animated scenes as one HTML file (scene). Specs are palette-locked; a humanoid kit and a Python stdlib renderer write PNG, GIF, and frame data with a render-review loop. Optional Aseprite adapter.", "author": { "name": "Melodic Software", diff --git a/plugins/pixel-art/CHANGELOG.md b/plugins/pixel-art/CHANGELOG.md index 7aea9018be..197d264b2a 100644 --- a/plugins/pixel-art/CHANGELOG.md +++ b/plugins/pixel-art/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `pixel-art` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.6.8] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.6.7] - 2026-10-07 ### Changed diff --git a/plugins/playgrounds/.claude-plugin/plugin.json b/plugins/playgrounds/.claude-plugin/plugin.json index a1ebb2ba62..afa70b7fe6 100644 --- a/plugins/playgrounds/.claude-plugin/plugin.json +++ b/plugins/playgrounds/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "playgrounds", - "version": "0.2.4", + "version": "0.2.3", "description": "One-step access to Anthropic's first-party playground plugin: declares the cross-marketplace dependency, routes playground-shaped requests to the upstream skill when it is installed, emits the install commands when it is not, and carries field-tested prompt recipes, cloud-session delivery guidance, and consumer cautions. Generates nothing itself.", "author": { "name": "Melodic Software", diff --git a/plugins/playgrounds/CHANGELOG.md b/plugins/playgrounds/CHANGELOG.md index 4a5c0ab3a8..abf76d30e3 100644 --- a/plugins/playgrounds/CHANGELOG.md +++ b/plugins/playgrounds/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `playgrounds` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.2.4] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.2.3] - 2026-10-02 ### Fixed diff --git a/plugins/playwright/.claude-plugin/plugin.json b/plugins/playwright/.claude-plugin/plugin.json index 4c7338261f..0c1ffac3ee 100644 --- a/plugins/playwright/.claude-plugin/plugin.json +++ b/plugins/playwright/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "playwright", - "version": "0.10.2", + "version": "0.10.1", "description": "Live E2E browser automation via Microsoft's @playwright/cli: named sessions, accessibility-ref snapshots, click/fill by ref, screenshots, console and network capture, mocking, tracing, video, and auth state, with artifacts written to disk so only paths enter context, plus a vendored upstream baseline and maintainer drift-check update flow.", "author": { "name": "Melodic Software", diff --git a/plugins/playwright/CHANGELOG.md b/plugins/playwright/CHANGELOG.md index a708eaeec6..8667e63e18 100644 --- a/plugins/playwright/CHANGELOG.md +++ b/plugins/playwright/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `playwright` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.10.2] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.10.1] - 2026-10-07 ### Changed diff --git a/plugins/plugin-quality/.claude-plugin/plugin.json b/plugins/plugin-quality/.claude-plugin/plugin.json index 079bb47e4f..2d026de027 100644 --- a/plugins/plugin-quality/.claude-plugin/plugin.json +++ b/plugins/plugin-quality/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "plugin-quality", - "version": "0.14.2", + "version": "0.14.1", "description": "Post-use behavioral audit (plugin-quality:audit) of any Claude Code plugin skill, agent, hook, command, or config you have used. Six steps: capture evidence; map behavior in a fresh subagent that records errors, improvements, and quality-of-life items against standards; a blindspot pass; an interactive contract lock; review with a research gate on each finding's claims and fixes; and a confirmed work item for the maintainers. Uses context-guard snapshots when present.", "author": { "name": "Melodic Software", diff --git a/plugins/plugin-quality/CHANGELOG.md b/plugins/plugin-quality/CHANGELOG.md index a0e3a56192..108f1f783c 100644 --- a/plugins/plugin-quality/CHANGELOG.md +++ b/plugins/plugin-quality/CHANGELOG.md @@ -5,12 +5,6 @@ All notable changes to the `plugin-quality` plugin. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [0.14.2] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.14.1] - 2026-10-07 ### Changed diff --git a/plugins/powershell-format/.claude-plugin/plugin.json b/plugins/powershell-format/.claude-plugin/plugin.json index 3a5395e217..1f2e3258a2 100644 --- a/plugins/powershell-format/.claude-plugin/plugin.json +++ b/plugins/powershell-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "powershell-format", - "version": "0.10.12", + "version": "0.10.11", "description": "Auto-format and lint PowerShell on edit via PSScriptAnalyzer, only when a PSScriptAnalyzerSettings.psd1 governs the repo, using the consuming repo's own analyzer settings.", "author": { "name": "Melodic Software", diff --git a/plugins/powershell-format/CHANGELOG.md b/plugins/powershell-format/CHANGELOG.md index d3be667796..16c0af8032 100644 --- a/plugins/powershell-format/CHANGELOG.md +++ b/plugins/powershell-format/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `powershell-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.10.12] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.10.11] - 2026-10-07 ### Changed diff --git a/plugins/rate-limit-guard/.claude-plugin/plugin.json b/plugins/rate-limit-guard/.claude-plugin/plugin.json index 35b75a7b7c..cd3c209609 100644 --- a/plugins/rate-limit-guard/.claude-plugin/plugin.json +++ b/plugins/rate-limit-guard/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "rate-limit-guard", - "version": "0.17.2", + "version": "0.17.1", "description": "Shared rate-limit guard for loop lanes and Claude: a hooks module writes the subscription rate-limit windows to a fixed machine-scope file and tells Claude where they stand at boundaries, a StopFailure hook records rate-limit stops reactively, and a reader contract fixes how consuming sessions pause and resume.", "author": { "name": "Melodic Software", diff --git a/plugins/rate-limit-guard/CHANGELOG.md b/plugins/rate-limit-guard/CHANGELOG.md index e3dc452350..60d88240e0 100644 --- a/plugins/rate-limit-guard/CHANGELOG.md +++ b/plugins/rate-limit-guard/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `rate-limit-guard` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.17.2] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.17.1] - 2026-10-07 ### Changed diff --git a/plugins/rate-limit-guard/README.md b/plugins/rate-limit-guard/README.md index 53fa4c587c..f3d853bf9c 100644 --- a/plugins/rate-limit-guard/README.md +++ b/plugins/rate-limit-guard/README.md @@ -93,17 +93,15 @@ from that turn; its line reaches Claude at the lane's next turn no person starte wants the lines at once may start its session with its own options through `--settings`, which can set any key user settings can, including the plugin's `pluginConfigs` entry: `{"pluginConfigs": {"rate-limit-guard@": {"options": -{"rate_limit_report_mode": "automatic"}}}}` (a `--plugin-dir` copy is keyed `@inline`). The `pluginConfigs` part of that is unverified -since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) -entry stopped naming `--settings` (as of 2026-10-07). +{"rate_limit_report_mode": "automatic"}}}}` (a `--plugin-dir` copy is keyed `@inline`). -- **Pointer**: [settings: change a setting for one session](https://code.claude.com/docs/en/settings#change-a-setting-for-one-session) - and the `pluginConfigs` row of +- **Pointer**: [settings: change a setting for one session](https://code.claude.com/docs/en/settings#change-a-setting-for-one-session), + the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry, and + the `pluginConfigs` row of [mods reference: settings and environment variables](https://code.claude.com/docs/en/plugins/mods/reference#settings-and-environment-variables). -- **As of**: 2026-10-03, Claude Code 2.1.288. -- **Recheck trigger**: either section changes the scope `pluginConfigs` is read from, the - `pluginConfigs` entry names `--settings` again, or a probe shows a `--settings` value read or - ignored. +- **As of**: 2026-10-07, Claude Code 2.1.292. +- **Recheck trigger**: the settings guide stops letting `--settings` set user-scope keys, or the + `pluginConfigs` scope changes. ### The /rate-limit-guard command, band row and status tool diff --git a/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json b/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json index 3c334dbfbe..6f6cbac8e7 100644 --- a/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json +++ b/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "repo-fleet-hygiene", - "version": "0.28.6", + "version": "0.28.5", "description": "Cross-repository Git/GitHub fleet discovery, evidence rollup, a gated apply verb, and a sync verb that fast-forwards canonical checkouts onto the remote default branch. Audit stays read-only. apply and sync mutate only with --apply plus interactive confirmation or --yes.", "author": { "name": "Melodic Software", diff --git a/plugins/repo-fleet-hygiene/CHANGELOG.md b/plugins/repo-fleet-hygiene/CHANGELOG.md index 1d1518c244..fbfe1fd2ef 100644 --- a/plugins/repo-fleet-hygiene/CHANGELOG.md +++ b/plugins/repo-fleet-hygiene/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to `repo-fleet-hygiene` are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.28.6] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.28.5] - 2026-10-07 ### Changed diff --git a/plugins/repo-hygiene/.claude-plugin/plugin.json b/plugins/repo-hygiene/.claude-plugin/plugin.json index 2ea1bb318d..92e4978775 100644 --- a/plugins/repo-hygiene/.claude-plugin/plugin.json +++ b/plugins/repo-hygiene/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "repo-hygiene", - "version": "0.19.12", + "version": "0.19.11", "description": "Repo hygiene action-router: /repo-hygiene:clean sweeps reclaimable caches, build artifacts, and stale git metadata, and can realign the working tree to a fresh-pull state, dry-run-first, with destructive tiers gated behind explicit confirmation and a session-scoped destructive-command guard. Ecosystem targets are detected at runtime; secrets, runtime dependencies, and skill data are preserved by default.", "author": { "name": "Melodic Software", diff --git a/plugins/repo-hygiene/CHANGELOG.md b/plugins/repo-hygiene/CHANGELOG.md index 467b1003c7..3bbfe72dd8 100644 --- a/plugins/repo-hygiene/CHANGELOG.md +++ b/plugins/repo-hygiene/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `repo-hygiene` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.19.12] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.19.11] - 2026-10-07 ### Changed diff --git a/plugins/repo-hygiene/skills/setup/SKILL.md b/plugins/repo-hygiene/skills/setup/SKILL.md index bf72879ed1..231bcaceed 100644 --- a/plugins/repo-hygiene/skills/setup/SKILL.md +++ b/plugins/repo-hygiene/skills/setup/SKILL.md @@ -87,11 +87,8 @@ Install nothing, and run no mutating tier. - Report the effective `${user_config.clean_destructive_guard_enabled}` (an unexpanded token or an empty value means the manifest default `true`). The rendered value is injected when this skill loads, so a change made now is observed only in a **fresh session**. - - The option is **user-scoped**: plugin option values are read from user and managed - settings only, never from a project's `.claude/settings.json`. `--settings` is unverified - since the [`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) - entry stopped naming it (as of 2026-10-07; recheck when the entry names `--settings` again or - a probe shows a `--settings` value read or ignored). So there is no + - The option is **user-scoped**: plugin option values are read from user, `--settings`, and + managed settings only, never from a project's `.claude/settings.json`. So there is no per-repository value of this toggle. To vary the behavior for one repository, enable or disable the plugin in that project's `enabledPlugins` instead. diff --git a/plugins/repo-hygiene/skills/setup/evals/evals.json b/plugins/repo-hygiene/skills/setup/evals/evals.json index b5f4711b7a..351c6fd5e3 100644 --- a/plugins/repo-hygiene/skills/setup/evals/evals.json +++ b/plugins/repo-hygiene/skills/setup/evals/evals.json @@ -58,11 +58,11 @@ "id": 5, "name": "per-repository-disable-is-enabledplugins-not-project-config", "prompt": "/repo-hygiene:setup — I want the destructive guard on everywhere except one repository. Add clean_destructive_guard_enabled=false to that project's settings for me.", - "expected_output": "Refuses both halves: setup writes no settings surface, and a project-scope value would be inert anyway — plugin option values are read from user and managed settings only, so there is no per-repository value of this toggle. Routes the per-repository intent to disabling the plugin in that project's enabledPlugins instead.", + "expected_output": "Refuses both halves: setup writes no settings surface, and a project-scope value would be inert anyway — plugin option values are read from user, --settings, and managed settings only, so there is no per-repository value of this toggle. Routes the per-repository intent to disabling the plugin in that project's enabledPlugins instead.", "files": [], "expectations": [ "Refuses to write the project's settings file, pluginConfigs, or any settings surface", - "States that plugin option values are read only from user and managed settings — never from a project's .claude/settings.json — so a project-scope pluginConfigs entry for this option is inert", + "States that plugin option values are read only from user, --settings, and managed settings — never from a project's .claude/settings.json — so a project-scope pluginConfigs entry for this option is inert", "Routes the per-repository intent to enabling or disabling the plugin in that project's enabledPlugins", "Does not offer a project-scope --config write as a working alternative" ] diff --git a/plugins/review/.claude-plugin/plugin.json b/plugins/review/.claude-plugin/plugin.json index ae0cb2228e..60da07e560 100644 --- a/plugins/review/.claude-plugin/plugin.json +++ b/plugins/review/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "review", - "version": "0.42.5", + "version": "0.42.4", "description": "Code-review toolkit: nine agents, read-only over the reviewed code, plus orchestration skills for the quality gate, fan-out, and enforceability audit (/review:audit-enforceability), a pull-request change digest with an interactive view (/review:explain-change), a fan-out sweep workflow (/review:fanout-sweep), and CI lane commands (/review:code-review, /review:security-review) for org reusable workflows.", "author": { "name": "Melodic Software", diff --git a/plugins/review/CHANGELOG.md b/plugins/review/CHANGELOG.md index 11476615e6..2bde67d674 100644 --- a/plugins/review/CHANGELOG.md +++ b/plugins/review/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `review` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.42.5] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.42.4] - 2026-10-07 ### Changed diff --git a/plugins/ruff-format/.claude-plugin/plugin.json b/plugins/ruff-format/.claude-plugin/plugin.json index 83205bd555..f5c50b6bd3 100644 --- a/plugins/ruff-format/.claude-plugin/plugin.json +++ b/plugins/ruff-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "ruff-format", - "version": "0.9.12", + "version": "0.9.11", "description": "Auto-format and lint Python on edit via Ruff, only when a Ruff config governs the repo, using the consuming repo's own Ruff config.", "author": { "name": "Melodic Software", diff --git a/plugins/ruff-format/CHANGELOG.md b/plugins/ruff-format/CHANGELOG.md index 99455c1bdd..3301c09aff 100644 --- a/plugins/ruff-format/CHANGELOG.md +++ b/plugins/ruff-format/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `ruff-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.9.12] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.9.11] - 2026-10-07 ### Changed diff --git a/plugins/skill-quality/.claude-plugin/plugin.json b/plugins/skill-quality/.claude-plugin/plugin.json index 8ceffa9f2e..b52d08b512 100644 --- a/plugins/skill-quality/.claude-plugin/plugin.json +++ b/plugins/skill-quality/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "skill-quality", - "version": "0.29.2", + "version": "0.29.1", "description": "Skill-authoring QA tooling (skill-quality:check): a static contract checker running twenty-nine deterministic checks over a Claude Code skill (frontmatter, invocation mode, description, listing cap, trigger keywords, line caps, broken refs, markdownlint, gotchas, evals), a shared skill-listing budget reporter, an evals.json schema with an eval-quality lint, and a measure-invocation harness that scores description auto-invocation probes on train and validation splits.", "author": { "name": "Melodic Software", diff --git a/plugins/skill-quality/CHANGELOG.md b/plugins/skill-quality/CHANGELOG.md index bcf481deaa..7a0a51fef0 100644 --- a/plugins/skill-quality/CHANGELOG.md +++ b/plugins/skill-quality/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `skill-quality` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.29.2] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.29.1] - 2026-10-07 ### Changed diff --git a/plugins/songwriting/.claude-plugin/plugin.json b/plugins/songwriting/.claude-plugin/plugin.json index f1b70e32ee..318be2a0c5 100644 --- a/plugins/songwriting/.claude-plugin/plugin.json +++ b/plugins/songwriting/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "songwriting", - "version": "1.6.6", + "version": "1.6.5", "description": "Songwriting craft companion: nine concern-scoped lyric-craft skills (workflow router, rhyme, object-writing, metaphor, meter-prosody, song-form, co-write, diagnose, practice) applying Pat Pattison's methods, with an object-writing agent that performs the sensory exercise itself and per-skill emission boundaries that route generation to the skill that owns it, plus Suno v5.5 prompt engineering (style prompts, tagged lyrics, genre templates, troubleshooting).", "author": { "name": "Melodic Software", diff --git a/plugins/songwriting/CHANGELOG.md b/plugins/songwriting/CHANGELOG.md index 6da2124d2f..0c2fc016ef 100644 --- a/plugins/songwriting/CHANGELOG.md +++ b/plugins/songwriting/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `songwriting` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [1.6.6] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [1.6.5] - 2026-10-04 ### Changed diff --git a/plugins/source-control/README.md b/plugins/source-control/README.md index 9dbc37262e..94b04a3763 100644 --- a/plugins/source-control/README.md +++ b/plugins/source-control/README.md @@ -493,9 +493,8 @@ distinct across concurrent instances; two lanes on one machine each need an expl opaque id if a machine name should not be published in a public tracker. **`promotion_evidence_binding`, `promotion_evidence_root`, `promotion_evidence_source`, -`promotion_evidence_checker`.** Each is honored from user or managed plugin settings -only (`--settings` is unverified since the `pluginConfigs` entry stopped naming it, as of -2026-10-07), never from `.claude/source-control.md` or any repository file. Contract: +`promotion_evidence_checker`.** Each is honored from user, `--settings`, or managed plugin settings +only, never from `.claude/source-control.md` or any repository file. Contract: [promotion-evidence-bootstrap.md](skills/babysit-loop/reference/promotion-evidence-bootstrap.md). The binding is the binding argument of the autonomy plugin's `check-security-binding.mjs`. The probe root is the protected evidence surface the seam resolves isolation probe transcripts against. diff --git a/plugins/source-control/reference/config-resolution.md b/plugins/source-control/reference/config-resolution.md index 676779114e..5838b84c21 100644 --- a/plugins/source-control/reference/config-resolution.md +++ b/plugins/source-control/reference/config-resolution.md @@ -144,10 +144,7 @@ deliberate and both surfaces coexist: `userConfig` keeps the personal and machin babysit-prs mechanic documents (watched owners, self logins, engine thresholds); this surface holds the lane policy a team reviews and tracks. Because `pluginConfigs` is read from user settings, each `babysit_*` `userConfig` key has one value per machine: an operator with several identity domains -leaves those keys unset or launches the lane with a per-domain `--settings` file (unverified for -plugin options since the `pluginConfigs` entry stopped naming the flag, as of 2026-10-07; recheck -when the entry names `--settings` again or a probe shows a `--settings` value read or ignored). -Which keys stay in +leaves those keys unset or launches the lane with a per-domain `--settings` file. Which keys stay in `userConfig` and which move to this surface is recorded in [0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md](https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/docs/adr/0039-keep-babysit-identity-keys-in-userconfig-and-move-repository-keys-to-the-cascade.md). Loop keys carry the `babysit_loop_` prefix so the two key families sharing one file stay distinguishable. diff --git a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-bootstrap.md b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-bootstrap.md index cae3ec30e2..eb5f4d610f 100644 --- a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-bootstrap.md +++ b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-bootstrap.md @@ -26,10 +26,7 @@ config ([`setup/SKILL.md`](https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/plugins/autonomy/skills/setup/SKILL.md) "Agent-unwritable bootstrap for security resolution", not restated here). The lane receives their locations through the four plugin options below. Claude Code reads plugin options from user -settings and managed settings only (the `--settings` flag is unverified since the -[`pluginConfigs`](https://code.claude.com/docs/en/settings-reference#pluginconfigs) entry stopped -naming it, as of 2026-10-07; recheck when the entry names it again or a probe shows a -`--settings` value read or ignored), and ignores a project's +settings, the `--settings` flag, and managed settings only, and ignores a project's `.claude/settings.json` for them ([hook-config-delivery](https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/docs/conventions/hook-config-delivery/README.md) fact 5). The lane takes them from the option values substituted into the babysit-loop skill body @@ -51,8 +48,8 @@ stays unknown. Never put a secret in one of these options. The options say where a surface is; they do not make it unwritable. A user settings file is writable by any agent running as that user, so a location kept there is only as protected as that -file. Managed settings keep the location out of the agent's reach too (a `--settings` file the -executor owns would, if the flag carries plugin options; that is unverified, see above). Whether a deployment meets the requirement is the operator's to establish. This +file. Managed settings, or a `--settings` file the executor owns, keep the location out of the +agent's reach too. Whether a deployment meets the requirement is the operator's to establish. This file states the requirement and does not certify a deployment. ## The four surfaces @@ -163,8 +160,8 @@ absent. A set value is compliant only when it is: - **Claim:** the checker takes the binding document, `--evidence`, and `--probe-evidence-root` on one usage line. With no root, every L2/L3 entry is unproven under a reason beginning `no --probe-evidence-root configured`. An evidence file that is unreadable or not a JSON array - resolves every cell effective-unpromoted. Plugin options are read only from user settings - and managed settings (`--settings` is unverified, see above), a repository's `env` block can populate the + resolves every cell effective-unpromoted. Plugin options are read only from user settings, + `--settings`, and managed settings, a repository's `env` block can populate the `CLAUDE_PLUGIN_OPTION_*` variable of an unset option, and a skill body's option placeholders substitute into model-visible content, non-sensitive values only. - **Basis:** `plugins/autonomy/skills/setup/scripts/check-security-binding.mjs` (`Usage:` comment, diff --git a/plugins/speech/.claude-plugin/plugin.json b/plugins/speech/.claude-plugin/plugin.json index 99b0e10d8b..b75cbef302 100644 --- a/plugins/speech/.claude-plugin/plugin.json +++ b/plugins/speech/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "speech", - "version": "0.2.10", + "version": "0.2.9", "description": "Text-to-speech narration. The narrate skill turns a script into narration.wav plus words.json, a start and end time for every word. The default kokoro backend runs Kokoro-82M locally with onnxruntime. The optional elevenlabs backend sends the text to the third-party ElevenLabs API (ELEVENLABS_API_KEY) after showing a cost estimate; an organization can forbid it. You install espeak-ng (GPL-3.0). A hook installs the Python packages; setup downloads the models; check reports missing prerequisites.", "author": { "name": "Melodic Software", diff --git a/plugins/speech/CHANGELOG.md b/plugins/speech/CHANGELOG.md index 1eb4145840..ee95879d6a 100644 --- a/plugins/speech/CHANGELOG.md +++ b/plugins/speech/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `speech` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.2.10] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. - ## [0.2.9] - 2026-10-07 ### Changed diff --git a/plugins/typos-format/.claude-plugin/plugin.json b/plugins/typos-format/.claude-plugin/plugin.json index 2b128580a4..dba13f79bc 100644 --- a/plugins/typos-format/.claude-plugin/plugin.json +++ b/plugins/typos-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "typos-format", - "version": "0.9.12", + "version": "0.9.11", "description": "Spell-check on edit via typos-cli, unconditionally. Report-only by default, honoring the consuming repo's own typos configuration when one is present.", "author": { "name": "Melodic Software", diff --git a/plugins/typos-format/CHANGELOG.md b/plugins/typos-format/CHANGELOG.md index 298af641b9..01cef34d53 100644 --- a/plugins/typos-format/CHANGELOG.md +++ b/plugins/typos-format/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `typos-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.9.12] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.9.11] - 2026-10-07 ### Changed diff --git a/plugins/user-interface/.claude-plugin/plugin.json b/plugins/user-interface/.claude-plugin/plugin.json index ef9cc98785..3274fe52b1 100644 --- a/plugins/user-interface/.claude-plugin/plugin.json +++ b/plugins/user-interface/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "user-interface", - "version": "0.1.4", + "version": "0.1.3", "description": "Front door for interface design: terminal and CLI output, TUIs, prompt themes, Claude Code mods, web and app UI. design detects the project's own design system and the design tools installed, routes each concern to the best present source with the project first, and supplies its own guidance where nothing covers the concern. Terminal guidance is its own contribution.", "author": { "name": "Melodic Software", diff --git a/plugins/user-interface/CHANGELOG.md b/plugins/user-interface/CHANGELOG.md index 9a86f9ba08..31e0280c36 100644 --- a/plugins/user-interface/CHANGELOG.md +++ b/plugins/user-interface/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `user-interface` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.1.4] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. - ## [0.1.3] - 2026-10-07 ### Changed diff --git a/plugins/visualization/.claude-plugin/plugin.json b/plugins/visualization/.claude-plugin/plugin.json index 9b7df27683..5792af30c1 100644 --- a/plugins/visualization/.claude-plugin/plugin.json +++ b/plugins/visualization/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "visualization", - "version": "0.11.6", + "version": "0.11.5", "description": "Visualization skills. visualize picks the form (mermaid diagram, markdown table, SVG/CSS chart, ASCII/Unicode art, or a rendered page) and the medium (terminal, local HTML file, or published Artifact) for what is in the conversation, asking only when the target is ambiguous. present builds a slide deck from the account's claude.ai Slides Artifact type behind a publish gate, with a markdown outline as the record. Chart craft and artifact design route to those capabilities when installed.", "author": { "name": "Melodic Software", diff --git a/plugins/visualization/CHANGELOG.md b/plugins/visualization/CHANGELOG.md index 838be789ea..ed3047d035 100644 --- a/plugins/visualization/CHANGELOG.md +++ b/plugins/visualization/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `visualization` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.11.6] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.11.5] - 2026-10-07 ### Changed diff --git a/plugins/work-items/.claude-plugin/plugin.json b/plugins/work-items/.claude-plugin/plugin.json index b13fc499e4..a1c7e8e5e0 100644 --- a/plugins/work-items/.claude-plugin/plugin.json +++ b/plugins/work-items/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "work-items", - "version": "0.49.8", + "version": "0.49.7", "description": "Work items through a provider-neutral tracker seam (github, local-markdown, jira, gitea, linear adapters): track (dashboard, creation, race-safe claims, recurring-schedule checks, stale-lease audits), scan-todos, decompose (plans into vertical-slice items), ship (route a spec container), triage (raw intake and unsolicited PRs), work, work-loop (autonomous PR-only drain), attend-queue (escalations), onboard-adapter (new tracker adapter), and setup (binds the provider).", "author": { "name": "Melodic Software", diff --git a/plugins/work-items/CHANGELOG.md b/plugins/work-items/CHANGELOG.md index cab7246aec..cd97d449e4 100644 --- a/plugins/work-items/CHANGELOG.md +++ b/plugins/work-items/CHANGELOG.md @@ -3,12 +3,6 @@ All notable changes to the `work-items` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. -## [0.49.8] - 2026-10-07 - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. - ## [0.49.7] - 2026-10-07 ### Changed From ece5279e124eaf750487667eca246cc616038a09 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 13:16:53 -0400 Subject: [PATCH 8/9] chore: recompute version bumps and fragments for #6498 after the main merge Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EC7nAKxQg52rCug6r6tYfe --- .changes/context-guard/fix-6498-slugs-stamps-3d0b0ed1.md | 7 +++++++ .changes/disk-hygiene/fix-6498-slugs-stamps-fdd34f4b.md | 7 +++++++ .changes/guardrails/fix-6498-slugs-stamps-98540df7.md | 7 +++++++ .changes/harness-ops/fix-6498-slugs-stamps-0322886f.md | 7 +++++++ .../fix-6498-slugs-stamps-6f6d4a78.md | 7 +++++++ .changes/planning/fix-6498-slugs-stamps-655308f5.md | 7 +++++++ .changes/playbooks/fix-6498-slugs-stamps-115e34d3.md | 7 +++++++ .changes/session-flow/fix-6498-slugs-stamps-2d453a97.md | 7 +++++++ .changes/source-control/fix-6498-slugs-stamps-45382e4f.md | 7 +++++++ .changes/testing/fix-6498-slugs-stamps-fabf8db3.md | 7 +++++++ plugins/actionlint/.claude-plugin/plugin.json | 2 +- plugins/actionlint/CHANGELOG.md | 6 ++++++ plugins/ai-briefing/.claude-plugin/plugin.json | 2 +- plugins/ai-briefing/CHANGELOG.md | 6 ++++++ plugins/animation/.claude-plugin/plugin.json | 2 +- plugins/animation/CHANGELOG.md | 6 ++++++ plugins/autonomy/.claude-plugin/plugin.json | 2 +- plugins/autonomy/CHANGELOG.md | 6 ++++++ plugins/bash-format/.claude-plugin/plugin.json | 2 +- plugins/bash-format/CHANGELOG.md | 6 ++++++ plugins/biome-format/.claude-plugin/plugin.json | 2 +- plugins/biome-format/CHANGELOG.md | 6 ++++++ plugins/code-metrics/.claude-plugin/plugin.json | 2 +- plugins/code-metrics/CHANGELOG.md | 6 ++++++ plugins/code-tidying/.claude-plugin/plugin.json | 2 +- plugins/code-tidying/CHANGELOG.md | 6 ++++++ plugins/computer-use/.claude-plugin/plugin.json | 2 +- plugins/computer-use/CHANGELOG.md | 6 ++++++ plugins/context-budget/.claude-plugin/plugin.json | 2 +- plugins/context-budget/CHANGELOG.md | 6 ++++++ plugins/desktop-notification/.claude-plugin/plugin.json | 2 +- plugins/desktop-notification/CHANGELOG.md | 6 ++++++ plugins/docs-hygiene/.claude-plugin/plugin.json | 2 +- plugins/docs-hygiene/CHANGELOG.md | 6 ++++++ plugins/eol-normalizer/.claude-plugin/plugin.json | 2 +- plugins/eol-normalizer/CHANGELOG.md | 6 ++++++ plugins/explainer-video/.claude-plugin/plugin.json | 2 +- plugins/explainer-video/CHANGELOG.md | 6 ++++++ plugins/github/.claude-plugin/plugin.json | 2 +- plugins/github/CHANGELOG.md | 6 ++++++ plugins/go-format/.claude-plugin/plugin.json | 2 +- plugins/go-format/CHANGELOG.md | 6 ++++++ plugins/harness-config/.claude-plugin/plugin.json | 2 +- plugins/harness-config/CHANGELOG.md | 6 ++++++ plugins/harness-memory/.claude-plugin/plugin.json | 2 +- plugins/harness-memory/CHANGELOG.md | 6 ++++++ plugins/kindle-dedrm/.claude-plugin/plugin.json | 2 +- plugins/kindle-dedrm/CHANGELOG.md | 6 ++++++ plugins/knowledge/.claude-plugin/plugin.json | 2 +- plugins/knowledge/CHANGELOG.md | 6 ++++++ plugins/markdown-format/.claude-plugin/plugin.json | 2 +- plugins/markdown-format/CHANGELOG.md | 6 ++++++ plugins/miro/.claude-plugin/plugin.json | 2 +- plugins/miro/CHANGELOG.md | 6 ++++++ plugins/pixel-art/.claude-plugin/plugin.json | 2 +- plugins/pixel-art/CHANGELOG.md | 6 ++++++ plugins/playgrounds/.claude-plugin/plugin.json | 2 +- plugins/playgrounds/CHANGELOG.md | 6 ++++++ plugins/playwright/.claude-plugin/plugin.json | 2 +- plugins/playwright/CHANGELOG.md | 6 ++++++ plugins/plugin-quality/.claude-plugin/plugin.json | 2 +- plugins/plugin-quality/CHANGELOG.md | 6 ++++++ plugins/powershell-format/.claude-plugin/plugin.json | 2 +- plugins/powershell-format/CHANGELOG.md | 6 ++++++ plugins/rate-limit-guard/.claude-plugin/plugin.json | 2 +- plugins/rate-limit-guard/CHANGELOG.md | 6 ++++++ plugins/repo-fleet-hygiene/.claude-plugin/plugin.json | 2 +- plugins/repo-fleet-hygiene/CHANGELOG.md | 6 ++++++ plugins/repo-hygiene/.claude-plugin/plugin.json | 2 +- plugins/repo-hygiene/CHANGELOG.md | 6 ++++++ plugins/review/.claude-plugin/plugin.json | 2 +- plugins/review/CHANGELOG.md | 6 ++++++ plugins/ruff-format/.claude-plugin/plugin.json | 2 +- plugins/ruff-format/CHANGELOG.md | 6 ++++++ plugins/songwriting/.claude-plugin/plugin.json | 2 +- plugins/songwriting/CHANGELOG.md | 6 ++++++ plugins/speech/.claude-plugin/plugin.json | 2 +- plugins/speech/CHANGELOG.md | 6 ++++++ plugins/typos-format/.claude-plugin/plugin.json | 2 +- plugins/typos-format/CHANGELOG.md | 6 ++++++ plugins/visualization/.claude-plugin/plugin.json | 2 +- plugins/visualization/CHANGELOG.md | 6 ++++++ plugins/work-items/.claude-plugin/plugin.json | 2 +- plugins/work-items/CHANGELOG.md | 6 ++++++ 84 files changed, 329 insertions(+), 37 deletions(-) create mode 100644 .changes/context-guard/fix-6498-slugs-stamps-3d0b0ed1.md create mode 100644 .changes/disk-hygiene/fix-6498-slugs-stamps-fdd34f4b.md create mode 100644 .changes/guardrails/fix-6498-slugs-stamps-98540df7.md create mode 100644 .changes/harness-ops/fix-6498-slugs-stamps-0322886f.md create mode 100644 .changes/instruction-placement/fix-6498-slugs-stamps-6f6d4a78.md create mode 100644 .changes/planning/fix-6498-slugs-stamps-655308f5.md create mode 100644 .changes/playbooks/fix-6498-slugs-stamps-115e34d3.md create mode 100644 .changes/session-flow/fix-6498-slugs-stamps-2d453a97.md create mode 100644 .changes/source-control/fix-6498-slugs-stamps-45382e4f.md create mode 100644 .changes/testing/fix-6498-slugs-stamps-fabf8db3.md diff --git a/.changes/context-guard/fix-6498-slugs-stamps-3d0b0ed1.md b/.changes/context-guard/fix-6498-slugs-stamps-3d0b0ed1.md new file mode 100644 index 0000000000..1fe5d8fd96 --- /dev/null +++ b/.changes/context-guard/fix-6498-slugs-stamps-3d0b0ed1.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/disk-hygiene/fix-6498-slugs-stamps-fdd34f4b.md b/.changes/disk-hygiene/fix-6498-slugs-stamps-fdd34f4b.md new file mode 100644 index 0000000000..1fe5d8fd96 --- /dev/null +++ b/.changes/disk-hygiene/fix-6498-slugs-stamps-fdd34f4b.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/guardrails/fix-6498-slugs-stamps-98540df7.md b/.changes/guardrails/fix-6498-slugs-stamps-98540df7.md new file mode 100644 index 0000000000..1fe5d8fd96 --- /dev/null +++ b/.changes/guardrails/fix-6498-slugs-stamps-98540df7.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/harness-ops/fix-6498-slugs-stamps-0322886f.md b/.changes/harness-ops/fix-6498-slugs-stamps-0322886f.md new file mode 100644 index 0000000000..1fe5d8fd96 --- /dev/null +++ b/.changes/harness-ops/fix-6498-slugs-stamps-0322886f.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/instruction-placement/fix-6498-slugs-stamps-6f6d4a78.md b/.changes/instruction-placement/fix-6498-slugs-stamps-6f6d4a78.md new file mode 100644 index 0000000000..1fe5d8fd96 --- /dev/null +++ b/.changes/instruction-placement/fix-6498-slugs-stamps-6f6d4a78.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/planning/fix-6498-slugs-stamps-655308f5.md b/.changes/planning/fix-6498-slugs-stamps-655308f5.md new file mode 100644 index 0000000000..1fe5d8fd96 --- /dev/null +++ b/.changes/planning/fix-6498-slugs-stamps-655308f5.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/playbooks/fix-6498-slugs-stamps-115e34d3.md b/.changes/playbooks/fix-6498-slugs-stamps-115e34d3.md new file mode 100644 index 0000000000..1fe5d8fd96 --- /dev/null +++ b/.changes/playbooks/fix-6498-slugs-stamps-115e34d3.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/session-flow/fix-6498-slugs-stamps-2d453a97.md b/.changes/session-flow/fix-6498-slugs-stamps-2d453a97.md new file mode 100644 index 0000000000..f44daa8035 --- /dev/null +++ b/.changes/session-flow/fix-6498-slugs-stamps-2d453a97.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`. diff --git a/.changes/source-control/fix-6498-slugs-stamps-45382e4f.md b/.changes/source-control/fix-6498-slugs-stamps-45382e4f.md new file mode 100644 index 0000000000..1fe5d8fd96 --- /dev/null +++ b/.changes/source-control/fix-6498-slugs-stamps-45382e4f.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. diff --git a/.changes/testing/fix-6498-slugs-stamps-fabf8db3.md b/.changes/testing/fix-6498-slugs-stamps-fabf8db3.md new file mode 100644 index 0000000000..d9898c15b3 --- /dev/null +++ b/.changes/testing/fix-6498-slugs-stamps-fabf8db3.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. diff --git a/plugins/actionlint/.claude-plugin/plugin.json b/plugins/actionlint/.claude-plugin/plugin.json index 8166de5d2c..e86ab1e782 100644 --- a/plugins/actionlint/.claude-plugin/plugin.json +++ b/plugins/actionlint/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "actionlint", - "version": "0.12.12", + "version": "0.12.13", "description": "Lint GitHub Actions workflow files on edit via actionlint, surfacing findings as advisory context.", "author": { "name": "Melodic Software", diff --git a/plugins/actionlint/CHANGELOG.md b/plugins/actionlint/CHANGELOG.md index 3c6285bf9e..eadf7549e7 100644 --- a/plugins/actionlint/CHANGELOG.md +++ b/plugins/actionlint/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `actionlint` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.12.13] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.12.12] - 2026-10-07 ### Changed diff --git a/plugins/ai-briefing/.claude-plugin/plugin.json b/plugins/ai-briefing/.claude-plugin/plugin.json index 09616b5d32..b0db0f56b5 100644 --- a/plugins/ai-briefing/.claude-plugin/plugin.json +++ b/plugins/ai-briefing/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "ai-briefing", - "version": "0.8.6", + "version": "0.8.7", "description": "Build source-backed AI-industry briefings from official vendor publications, configured RSS/Atom feeds, GitHub releases, reputable secondary reporting, and user-supplied URLs. Deduplicate, rank, and present results as markdown or optional HTML/PPTX decks, with repository-owned profile, audience, and brand configuration. Automated X/Twitter collection is disabled; Playwright is used only for deterministic local rendering.", "author": { "name": "Melodic Software", diff --git a/plugins/ai-briefing/CHANGELOG.md b/plugins/ai-briefing/CHANGELOG.md index c8042231fa..0942636f2f 100644 --- a/plugins/ai-briefing/CHANGELOG.md +++ b/plugins/ai-briefing/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `ai-briefing` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.8.7] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.8.6] - 2026-10-07 ### Changed diff --git a/plugins/animation/.claude-plugin/plugin.json b/plugins/animation/.claude-plugin/plugin.json index 857030efe0..814ee7ca32 100644 --- a/plugins/animation/.claude-plugin/plugin.json +++ b/plugins/animation/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "animation", - "version": "0.4.11", + "version": "0.4.12", "description": "Hand-drawn-style 2D animation as code, rendered in headless Chromium by an ink brush engine. rotoscope copies a reference clip drawing by drawing: trace to vector paths, render, measure against the source (XOR, SSIM), and fit per-shot brush overrides. learn-style measures a clip into a style pack (ships woodcut-ink) and checks films against it. produce turns a brief into approved boards, a shot list, frames, and a delivered file. setup checks ffmpeg, Node, Chromium, and Python.", "author": { "name": "Melodic Software", diff --git a/plugins/animation/CHANGELOG.md b/plugins/animation/CHANGELOG.md index 2f6bf53993..a1f175cba6 100644 --- a/plugins/animation/CHANGELOG.md +++ b/plugins/animation/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `animation` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.4.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.4.11] - 2026-10-07 ### Changed diff --git a/plugins/autonomy/.claude-plugin/plugin.json b/plugins/autonomy/.claude-plugin/plugin.json index b7709b1056..8d7c61c87c 100644 --- a/plugins/autonomy/.claude-plugin/plugin.json +++ b/plugins/autonomy/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "autonomy", - "version": "0.26.12", + "version": "0.26.13", "description": "Contracts for governed autonomous agent operation: role topology, binding seam, telemetry, return accounting, trigger dispatch, a per-work-class guardrail matrix, a standing-routine catalog, and a runner charter. A guided setup skill writes an org's binding, wires OTLP telemetry (file default), human-attested return capture, and signal adapters behind one governed dispatch entrypoint, binds the guardrail matrix to isolation substrates after a live probe, and schedules routines.", "author": { "name": "Melodic Software", diff --git a/plugins/autonomy/CHANGELOG.md b/plugins/autonomy/CHANGELOG.md index c9fd9084af..cf217c2dd8 100644 --- a/plugins/autonomy/CHANGELOG.md +++ b/plugins/autonomy/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `autonomy` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.26.13] - 2026-10-07 + +### Changed + +- **Upstream records (#6498).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.26.12] - 2026-10-07 ### Changed diff --git a/plugins/bash-format/.claude-plugin/plugin.json b/plugins/bash-format/.claude-plugin/plugin.json index 28a20bc1a7..7ac60ba8c4 100644 --- a/plugins/bash-format/.claude-plugin/plugin.json +++ b/plugins/bash-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "bash-format", - "version": "0.10.12", + "version": "0.10.13", "description": "Auto-format and lint shell scripts on edit via shfmt + ShellCheck, using the consuming repo's own .editorconfig and .shellcheckrc.", "author": { "name": "Melodic Software", diff --git a/plugins/bash-format/CHANGELOG.md b/plugins/bash-format/CHANGELOG.md index 8ae175ca0d..92197ab4dd 100644 --- a/plugins/bash-format/CHANGELOG.md +++ b/plugins/bash-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `bash-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.10.13] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.10.12] - 2026-10-07 ### Changed diff --git a/plugins/biome-format/.claude-plugin/plugin.json b/plugins/biome-format/.claude-plugin/plugin.json index f730d78796..3de9cb293f 100644 --- a/plugins/biome-format/.claude-plugin/plugin.json +++ b/plugins/biome-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "biome-format", - "version": "0.8.11", + "version": "0.8.12", "description": "Auto-format and lint JS/TS/JSX/JSON on edit via Biome, only when a biome.json governs the repo, using the consuming repo's own Biome config.", "author": { "name": "Melodic Software", diff --git a/plugins/biome-format/CHANGELOG.md b/plugins/biome-format/CHANGELOG.md index eb7a645323..91673f1b1a 100644 --- a/plugins/biome-format/CHANGELOG.md +++ b/plugins/biome-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `biome-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.8.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.8.11] - 2026-10-07 ### Changed diff --git a/plugins/code-metrics/.claude-plugin/plugin.json b/plugins/code-metrics/.claude-plugin/plugin.json index 62adc106c3..5fe97b0a8d 100644 --- a/plugins/code-metrics/.claude-plugin/plugin.json +++ b/plugins/code-metrics/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "code-metrics", - "version": "0.5.8", + "version": "0.5.9", "description": "Read-only code measures for a change, with cited references and no verdict: lines per file (audit-size), cyclomatic, cognitive, and Halstead complexity (audit-complexity), duplication (audit-duplication), per-function coverage and CRAP from existing lcov, Cobertura, coverage.py, or Go artifacts (audit-coverage), TypeScript and Python type debt (audit-type-debt), metric literacy (principles), and setup. Uses only collectors already installed; never installs or runs tests.", "author": { "name": "Melodic Software", diff --git a/plugins/code-metrics/CHANGELOG.md b/plugins/code-metrics/CHANGELOG.md index 02b1921135..40ff0e97d3 100644 --- a/plugins/code-metrics/CHANGELOG.md +++ b/plugins/code-metrics/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `code-metrics` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.5.9] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.5.8] - 2026-10-07 ### Changed diff --git a/plugins/code-tidying/.claude-plugin/plugin.json b/plugins/code-tidying/.claude-plugin/plugin.json index 03b5e114ed..78a18ec86a 100644 --- a/plugins/code-tidying/.claude-plugin/plugin.json +++ b/plugins/code-tidying/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "code-tidying", - "version": "0.28.11", + "version": "0.28.12", "description": "Code tidying and comment hygiene. tidy hunts a rotated lane for Beck-style tidyings and ships one PR. batch-simplify sweeps a branch, time window, or repo in dependency-ordered waves. dissolve-comments deletes zero-information comments and moves the rest into names (safe, aggressive, strip modes). audit-comment-residue flags history, plan, conversational, and ticket residue. audit-dead-code finds dead code with knip, vulture, gopls, and grep. setup scaffolds tidy lanes.", "author": { "name": "Melodic Software", diff --git a/plugins/code-tidying/CHANGELOG.md b/plugins/code-tidying/CHANGELOG.md index 9a4eea7843..ccc9367672 100644 --- a/plugins/code-tidying/CHANGELOG.md +++ b/plugins/code-tidying/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `code-tidying` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.28.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.28.11] - 2026-10-07 ### Changed diff --git a/plugins/computer-use/.claude-plugin/plugin.json b/plugins/computer-use/.claude-plugin/plugin.json index edd0a2f77f..ee301391ff 100644 --- a/plugins/computer-use/.claude-plugin/plugin.json +++ b/plugins/computer-use/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "computer-use", - "version": "0.1.9", + "version": "0.1.10", "description": "Operating knowledge for Claude Code's built-in computer-use MCP server (desktop screen control). /computer-use:diagnose resolves a symptom to a cause instead of retrying: the fixed screenshot pixel budget and why zoom recovers detail, how to read capture and input failures, and per-OS quirks that make synthesized keys or menus behave unlike a human's. /computer-use:setup verifies prerequisites and reports environment settings that end a session mid-run.", "author": { "name": "Melodic Software", diff --git a/plugins/computer-use/CHANGELOG.md b/plugins/computer-use/CHANGELOG.md index 1335142658..bc47a1d209 100644 --- a/plugins/computer-use/CHANGELOG.md +++ b/plugins/computer-use/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `computer-use` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.1.10] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.1.9] - 2026-10-02 ### Fixed diff --git a/plugins/context-budget/.claude-plugin/plugin.json b/plugins/context-budget/.claude-plugin/plugin.json index 554a708e7a..1c5d485035 100644 --- a/plugins/context-budget/.claude-plugin/plugin.json +++ b/plugins/context-budget/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "context-budget", - "version": "0.9.9", + "version": "0.9.10", "description": "Measures a Claude Code session's fixed startup context payload per item at a pinned binary version, including per-tool attribution of the built-in tool pools that /context reports only as totals, derived by A/B deny differencing under comparability rules. Falls back from an SDK meter to a headless /context parser, then to an error rather than a wrong number. Keeps a per-project before/after ledger per lever. Report-only by default; fix applies one approved project-scope trim.", "author": { "name": "Melodic Software", diff --git a/plugins/context-budget/CHANGELOG.md b/plugins/context-budget/CHANGELOG.md index 2c79e64a7b..61b41baa3d 100644 --- a/plugins/context-budget/CHANGELOG.md +++ b/plugins/context-budget/CHANGELOG.md @@ -7,6 +7,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Versions 0.6.38 and 0.6.40 were reserved by parallel changes and never published. +## [0.9.10] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.9.9] - 2026-10-07 ### Changed diff --git a/plugins/desktop-notification/.claude-plugin/plugin.json b/plugins/desktop-notification/.claude-plugin/plugin.json index 7837081792..b1149faf67 100644 --- a/plugins/desktop-notification/.claude-plugin/plugin.json +++ b/plugins/desktop-notification/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "desktop-notification", - "version": "0.8.10", + "version": "0.8.11", "description": "Alert you when Claude Code needs input: an audible terminal bell, an OSC 9 terminal notification, and an OS-native toast (macOS/Linux) on permission and idle prompts.", "author": { "name": "Melodic Software", diff --git a/plugins/desktop-notification/CHANGELOG.md b/plugins/desktop-notification/CHANGELOG.md index d9d08c8349..ea5a8a2c62 100644 --- a/plugins/desktop-notification/CHANGELOG.md +++ b/plugins/desktop-notification/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `desktop-notification` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.8.11] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.8.10] - 2026-10-07 ### Changed diff --git a/plugins/docs-hygiene/.claude-plugin/plugin.json b/plugins/docs-hygiene/.claude-plugin/plugin.json index adf2307fe9..d330b5114c 100644 --- a/plugins/docs-hygiene/.claude-plugin/plugin.json +++ b/plugins/docs-hygiene/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "docs-hygiene", - "version": "0.27.1", + "version": "0.27.2", "description": "Documentation-hygiene toolkit: compress (trim markdown with a semantic-diff check), audit-noise (classify markdown noise), extract-ssot (deduplicate into a single source of truth), audit-encapsulation (citations into skill-private files), rename-references (stale references after renames), audit-derivability (does a doc earn its existence), audit-progressive-disclosure (load tiers), write-for-agents and write-for-humans (authoring). Setup checks markdownlint-cli2.", "author": { "name": "Melodic Software", diff --git a/plugins/docs-hygiene/CHANGELOG.md b/plugins/docs-hygiene/CHANGELOG.md index 548c9a8a84..52b399c6c3 100644 --- a/plugins/docs-hygiene/CHANGELOG.md +++ b/plugins/docs-hygiene/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog: docs-hygiene plugin +## [0.27.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.27.1] - 2026-10-07 ### Changed diff --git a/plugins/eol-normalizer/.claude-plugin/plugin.json b/plugins/eol-normalizer/.claude-plugin/plugin.json index e38a1323d1..4e58003eff 100644 --- a/plugins/eol-normalizer/.claude-plugin/plugin.json +++ b/plugins/eol-normalizer/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "eol-normalizer", - "version": "0.9.10", + "version": "0.9.11", "description": "Normalize a written file's working-tree line endings to its .gitattributes eol value on edit: symmetric CRLF/LF driven by git check-attr, advisory and never blocking.", "author": { "name": "Melodic Software", diff --git a/plugins/eol-normalizer/CHANGELOG.md b/plugins/eol-normalizer/CHANGELOG.md index e6542958ab..133c2c89e1 100644 --- a/plugins/eol-normalizer/CHANGELOG.md +++ b/plugins/eol-normalizer/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `eol-normalizer` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.9.11] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.9.10] - 2026-10-07 ### Changed diff --git a/plugins/explainer-video/.claude-plugin/plugin.json b/plugins/explainer-video/.claude-plugin/plugin.json index 421dffee29..90d528c933 100644 --- a/plugins/explainer-video/.claude-plugin/plugin.json +++ b/plugins/explainer-video/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "explainer-video", - "version": "0.2.9", + "version": "0.2.10", "description": "Short explainer videos made with ManimCE, narrated when the speech plugin is installed and silent otherwise. The produce skill plans the beats, writes one scene script whose scene changes follow the narration's word timings, renders at low quality first, muxes narration and captions with ffmpeg, and checks every render with ffprobe and a frame read-back. A SessionStart hook installs the hash-locked Python packages; the check skill reports readiness.", "author": { "name": "Melodic Software", diff --git a/plugins/explainer-video/CHANGELOG.md b/plugins/explainer-video/CHANGELOG.md index 93081d869e..75fd50ae60 100644 --- a/plugins/explainer-video/CHANGELOG.md +++ b/plugins/explainer-video/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `explainer-video` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.2.10] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.2.9] - 2026-10-04 ### Changed diff --git a/plugins/github/.claude-plugin/plugin.json b/plugins/github/.claude-plugin/plugin.json index 8c16d5615c..ca0d8fa041 100644 --- a/plugins/github/.claude-plugin/plugin.json +++ b/plugins/github/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "github", - "version": "0.3.31", + "version": "0.3.32", "description": "GitHub admin-plane audit, advice, and guided setup over the authenticated user's own gh CLI: billing and cost control, security posture, rulesets and settings drift, Actions policy, and every other org/repo/enterprise settings area. Grounded in live state and current official GitHub docs (zero vendored knowledge); read-only by default, every mutation user-in-loop.", "author": { "name": "Melodic Software", diff --git a/plugins/github/CHANGELOG.md b/plugins/github/CHANGELOG.md index bf4f89408d..690bc92b17 100644 --- a/plugins/github/CHANGELOG.md +++ b/plugins/github/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `github` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.3.32] - 2026-10-07 + +### Changed + +- **Upstream records (#6498).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.3.31] - 2026-10-07 ### Changed diff --git a/plugins/go-format/.claude-plugin/plugin.json b/plugins/go-format/.claude-plugin/plugin.json index 24d90322e9..8344a4a511 100644 --- a/plugins/go-format/.claude-plugin/plugin.json +++ b/plugins/go-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "go-format", - "version": "0.5.10", + "version": "0.5.11", "description": "Auto-fix Go formatting and import management on edit via goimports. Runs unconditionally (no consumer-config gate), skipping generated files.", "author": { "name": "Melodic Software", diff --git a/plugins/go-format/CHANGELOG.md b/plugins/go-format/CHANGELOG.md index 2b18485574..0b62233d2f 100644 --- a/plugins/go-format/CHANGELOG.md +++ b/plugins/go-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `go-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.5.11] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.5.10] - 2026-10-07 ### Changed diff --git a/plugins/harness-config/.claude-plugin/plugin.json b/plugins/harness-config/.claude-plugin/plugin.json index 584d29ea5c..3ccb0404da 100644 --- a/plugins/harness-config/.claude-plugin/plugin.json +++ b/plugins/harness-config/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "harness-config", - "version": "1.13.2", + "version": "1.13.3", "description": "Configuration health for a repo's Claude Code: audit (settings, .mcp.json, hooks, plugins, permission drift), audit-automation-gaps, audit-permission-grants, audit-permission-state (effective rules with provenance), draft-auto-mode-rules (prints an autoMode block), audit-instructions (instructions the model no longer needs, conflicts), audit-prompting-postures, audit-pass (one ordered, resumable pass), unhobble (strip instructions, re-add what evidence earns), and setup.", "author": { "name": "Melodic Software", diff --git a/plugins/harness-config/CHANGELOG.md b/plugins/harness-config/CHANGELOG.md index dc05d642b4..779a4e89ea 100644 --- a/plugins/harness-config/CHANGELOG.md +++ b/plugins/harness-config/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to the `harness-config` plugin are documented here. Format f Versions 0.51.8 to 0.51.9 and 0.51.11 to 0.51.14 were reserved by parallel branches and never released. +## [1.13.3] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [1.13.2] - 2026-10-07 ### Fixed diff --git a/plugins/harness-memory/.claude-plugin/plugin.json b/plugins/harness-memory/.claude-plugin/plugin.json index ee9524b613..9f44d841d3 100644 --- a/plugins/harness-memory/.claude-plugin/plugin.json +++ b/plugins/harness-memory/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "harness-memory", - "version": "1.1.3", + "version": "1.1.4", "description": "Keeps a repo's Claude Code memory layer healthy, against criteria from official Claude Code docs. audit checks CLAUDE.md, a root AGENTS.md, CLAUDE.local.md, .claude/rules/, and auto-memory for structure, size, placement, and index integrity, with scripted and judgment checks. stateless inspects, disables, and (after confirmation) purges Claude-written auto memory across settings scopes. Whether instruction text fits the current model belongs to harness-config.", "author": { "name": "Melodic Software", diff --git a/plugins/harness-memory/CHANGELOG.md b/plugins/harness-memory/CHANGELOG.md index eac6e616f5..51245b01f8 100644 --- a/plugins/harness-memory/CHANGELOG.md +++ b/plugins/harness-memory/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `harness-memory` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [1.1.4] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [1.1.3] - 2026-10-07 ### Fixed diff --git a/plugins/kindle-dedrm/.claude-plugin/plugin.json b/plugins/kindle-dedrm/.claude-plugin/plugin.json index 87e2cbc1bb..88d48a34a2 100644 --- a/plugins/kindle-dedrm/.claude-plugin/plugin.json +++ b/plugins/kindle-dedrm/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "kindle-dedrm", - "version": "0.8.4", + "version": "0.8.5", "description": "Manage the Kindle for PC 2.8.0 + Calibre DeDRM workflow for personal-use ebook DRM removal on books the user owns (Windows only). Action router with setup, sync, update, cleanup, and status, each state mutation paired with a documented compensating reversal.", "author": { "name": "Melodic Software", diff --git a/plugins/kindle-dedrm/CHANGELOG.md b/plugins/kindle-dedrm/CHANGELOG.md index 5c1dfc7afb..3c24763494 100644 --- a/plugins/kindle-dedrm/CHANGELOG.md +++ b/plugins/kindle-dedrm/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `kindle-dedrm` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.8.5] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.8.4] - 2026-10-07 ### Changed diff --git a/plugins/knowledge/.claude-plugin/plugin.json b/plugins/knowledge/.claude-plugin/plugin.json index 16d2dc426b..019cd97f44 100644 --- a/plugins/knowledge/.claude-plugin/plugin.json +++ b/plugins/knowledge/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "knowledge", - "version": "0.20.3", + "version": "0.20.4", "description": "Ingests external knowledge into synthesized artifacts: book-distill (PDF or EPUB into author-attributed reference files), video-digest (one YouTube or X video: transcript, links, repo applicability), course-digest (Dometrain and Teachable courses into recommendations), docpage-digest (one documentation page into a verified knowledge slice), and map-corpus (a multi-resource corpus into a classified link map and an approved docpage-digest queue). setup sets where artifacts land.", "author": { "name": "Melodic Software", diff --git a/plugins/knowledge/CHANGELOG.md b/plugins/knowledge/CHANGELOG.md index 4168374e37..d159724598 100644 --- a/plugins/knowledge/CHANGELOG.md +++ b/plugins/knowledge/CHANGELOG.md @@ -4,6 +4,12 @@ All notable changes to the `knowledge` plugin are recorded here. The `version` i `.claude-plugin/plugin.json` is the delivery vehicle. A consumer receives a change only after that version increases. +## [0.20.4] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.20.3] - 2026-10-07 ### Changed diff --git a/plugins/markdown-format/.claude-plugin/plugin.json b/plugins/markdown-format/.claude-plugin/plugin.json index 99ebf7fa3f..845b234dfa 100644 --- a/plugins/markdown-format/.claude-plugin/plugin.json +++ b/plugins/markdown-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "markdown-format", - "version": "0.12.12", + "version": "0.12.13", "description": "Auto-format and lint Markdown on edit via markdownlint-cli2, only in repos that carry their own markdownlint config.", "author": { "name": "Melodic Software", diff --git a/plugins/markdown-format/CHANGELOG.md b/plugins/markdown-format/CHANGELOG.md index 45b08bab36..ea34878789 100644 --- a/plugins/markdown-format/CHANGELOG.md +++ b/plugins/markdown-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `markdown-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.12.13] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.12.12] - 2026-10-07 ### Changed diff --git a/plugins/miro/.claude-plugin/plugin.json b/plugins/miro/.claude-plugin/plugin.json index 436e8403b7..c1294d3b16 100644 --- a/plugins/miro/.claude-plugin/plugin.json +++ b/plugins/miro/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "miro", - "version": "0.6.7", + "version": "0.6.8", "description": "Miro board management over the Model Context Protocol: create and manage boards, sticky notes, shapes, frames, connectors, and tags for EventStorming, brainstorming, and diagramming. Ships a local stdio MCP server that installs its pinned npm dependencies on first launch (needs Node.js 24+ and npm); installs disabled, so opt in. The server starts without a Miro API token; until one is set, each tool call explains how to set it.", "author": { "name": "Melodic Software", diff --git a/plugins/miro/CHANGELOG.md b/plugins/miro/CHANGELOG.md index 9ef56bbb6f..f538caeca1 100644 --- a/plugins/miro/CHANGELOG.md +++ b/plugins/miro/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `miro` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.6.8] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.6.7] - 2026-10-07 ### Changed diff --git a/plugins/pixel-art/.claude-plugin/plugin.json b/plugins/pixel-art/.claude-plugin/plugin.json index 580e69e0dd..6db7e9ab71 100644 --- a/plugins/pixel-art/.claude-plugin/plugin.json +++ b/plugins/pixel-art/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "pixel-art", - "version": "0.6.7", + "version": "0.6.8", "description": "Creates pixel art with no external tools: sprites (sprite), animation sprite sheets for RPG Maker MZ, Godot, PICO-8, or plain strips with Aseprite-style frame data and GIF previews (animate), tilesets and parallax (tileset), UI skins and bitmap fonts (ui), effect sheets (vfx), and animated scenes as one HTML file (scene). Specs are palette-locked; a humanoid kit and a Python stdlib renderer write PNG, GIF, and frame data with a render-review loop. Optional Aseprite adapter.", "author": { "name": "Melodic Software", diff --git a/plugins/pixel-art/CHANGELOG.md b/plugins/pixel-art/CHANGELOG.md index 197d264b2a..92cf0cfb52 100644 --- a/plugins/pixel-art/CHANGELOG.md +++ b/plugins/pixel-art/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `pixel-art` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.6.8] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.6.7] - 2026-10-07 ### Changed diff --git a/plugins/playgrounds/.claude-plugin/plugin.json b/plugins/playgrounds/.claude-plugin/plugin.json index afa70b7fe6..a1ebb2ba62 100644 --- a/plugins/playgrounds/.claude-plugin/plugin.json +++ b/plugins/playgrounds/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "playgrounds", - "version": "0.2.3", + "version": "0.2.4", "description": "One-step access to Anthropic's first-party playground plugin: declares the cross-marketplace dependency, routes playground-shaped requests to the upstream skill when it is installed, emits the install commands when it is not, and carries field-tested prompt recipes, cloud-session delivery guidance, and consumer cautions. Generates nothing itself.", "author": { "name": "Melodic Software", diff --git a/plugins/playgrounds/CHANGELOG.md b/plugins/playgrounds/CHANGELOG.md index abf76d30e3..4a5c0ab3a8 100644 --- a/plugins/playgrounds/CHANGELOG.md +++ b/plugins/playgrounds/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `playgrounds` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.2.4] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.2.3] - 2026-10-02 ### Fixed diff --git a/plugins/playwright/.claude-plugin/plugin.json b/plugins/playwright/.claude-plugin/plugin.json index 4c7338261f..e42cd8c914 100644 --- a/plugins/playwright/.claude-plugin/plugin.json +++ b/plugins/playwright/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "playwright", - "version": "0.10.2", + "version": "0.10.3", "description": "Live E2E browser automation via Microsoft's @playwright/cli: named sessions, accessibility-ref snapshots, click/fill by ref, screenshots, console and network capture, mocking, tracing, video, and auth state, with artifacts written to disk so only paths enter context, plus a vendored upstream baseline and maintainer drift-check update flow.", "author": { "name": "Melodic Software", diff --git a/plugins/playwright/CHANGELOG.md b/plugins/playwright/CHANGELOG.md index 387696563d..f658f261bb 100644 --- a/plugins/playwright/CHANGELOG.md +++ b/plugins/playwright/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `playwright` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.10.3] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.10.2] - 2026-10-07 ### Changed diff --git a/plugins/plugin-quality/.claude-plugin/plugin.json b/plugins/plugin-quality/.claude-plugin/plugin.json index 079bb47e4f..bafb5d9bff 100644 --- a/plugins/plugin-quality/.claude-plugin/plugin.json +++ b/plugins/plugin-quality/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "plugin-quality", - "version": "0.14.2", + "version": "0.14.3", "description": "Post-use behavioral audit (plugin-quality:audit) of any Claude Code plugin skill, agent, hook, command, or config you have used. Six steps: capture evidence; map behavior in a fresh subagent that records errors, improvements, and quality-of-life items against standards; a blindspot pass; an interactive contract lock; review with a research gate on each finding's claims and fixes; and a confirmed work item for the maintainers. Uses context-guard snapshots when present.", "author": { "name": "Melodic Software", diff --git a/plugins/plugin-quality/CHANGELOG.md b/plugins/plugin-quality/CHANGELOG.md index ba1b40e985..b680e889b9 100644 --- a/plugins/plugin-quality/CHANGELOG.md +++ b/plugins/plugin-quality/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to the `plugin-quality` plugin. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.14.3] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.14.2] - 2026-10-07 ### Changed diff --git a/plugins/powershell-format/.claude-plugin/plugin.json b/plugins/powershell-format/.claude-plugin/plugin.json index 1f2e3258a2..3a5395e217 100644 --- a/plugins/powershell-format/.claude-plugin/plugin.json +++ b/plugins/powershell-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "powershell-format", - "version": "0.10.11", + "version": "0.10.12", "description": "Auto-format and lint PowerShell on edit via PSScriptAnalyzer, only when a PSScriptAnalyzerSettings.psd1 governs the repo, using the consuming repo's own analyzer settings.", "author": { "name": "Melodic Software", diff --git a/plugins/powershell-format/CHANGELOG.md b/plugins/powershell-format/CHANGELOG.md index 16c0af8032..d2c5524652 100644 --- a/plugins/powershell-format/CHANGELOG.md +++ b/plugins/powershell-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `powershell-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.10.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.10.11] - 2026-10-07 ### Changed diff --git a/plugins/rate-limit-guard/.claude-plugin/plugin.json b/plugins/rate-limit-guard/.claude-plugin/plugin.json index cd3c209609..35b75a7b7c 100644 --- a/plugins/rate-limit-guard/.claude-plugin/plugin.json +++ b/plugins/rate-limit-guard/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "rate-limit-guard", - "version": "0.17.1", + "version": "0.17.2", "description": "Shared rate-limit guard for loop lanes and Claude: a hooks module writes the subscription rate-limit windows to a fixed machine-scope file and tells Claude where they stand at boundaries, a StopFailure hook records rate-limit stops reactively, and a reader contract fixes how consuming sessions pause and resume.", "author": { "name": "Melodic Software", diff --git a/plugins/rate-limit-guard/CHANGELOG.md b/plugins/rate-limit-guard/CHANGELOG.md index 60d88240e0..be937edf79 100644 --- a/plugins/rate-limit-guard/CHANGELOG.md +++ b/plugins/rate-limit-guard/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `rate-limit-guard` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.17.2] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.17.1] - 2026-10-07 ### Changed diff --git a/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json b/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json index 6f6cbac8e7..3c334dbfbe 100644 --- a/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json +++ b/plugins/repo-fleet-hygiene/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "repo-fleet-hygiene", - "version": "0.28.5", + "version": "0.28.6", "description": "Cross-repository Git/GitHub fleet discovery, evidence rollup, a gated apply verb, and a sync verb that fast-forwards canonical checkouts onto the remote default branch. Audit stays read-only. apply and sync mutate only with --apply plus interactive confirmation or --yes.", "author": { "name": "Melodic Software", diff --git a/plugins/repo-fleet-hygiene/CHANGELOG.md b/plugins/repo-fleet-hygiene/CHANGELOG.md index fbfe1fd2ef..1d1518c244 100644 --- a/plugins/repo-fleet-hygiene/CHANGELOG.md +++ b/plugins/repo-fleet-hygiene/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to `repo-fleet-hygiene` are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.28.6] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.28.5] - 2026-10-07 ### Changed diff --git a/plugins/repo-hygiene/.claude-plugin/plugin.json b/plugins/repo-hygiene/.claude-plugin/plugin.json index 92e4978775..2ea1bb318d 100644 --- a/plugins/repo-hygiene/.claude-plugin/plugin.json +++ b/plugins/repo-hygiene/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "repo-hygiene", - "version": "0.19.11", + "version": "0.19.12", "description": "Repo hygiene action-router: /repo-hygiene:clean sweeps reclaimable caches, build artifacts, and stale git metadata, and can realign the working tree to a fresh-pull state, dry-run-first, with destructive tiers gated behind explicit confirmation and a session-scoped destructive-command guard. Ecosystem targets are detected at runtime; secrets, runtime dependencies, and skill data are preserved by default.", "author": { "name": "Melodic Software", diff --git a/plugins/repo-hygiene/CHANGELOG.md b/plugins/repo-hygiene/CHANGELOG.md index 3bbfe72dd8..029534cb7a 100644 --- a/plugins/repo-hygiene/CHANGELOG.md +++ b/plugins/repo-hygiene/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `repo-hygiene` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.19.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.19.11] - 2026-10-07 ### Changed diff --git a/plugins/review/.claude-plugin/plugin.json b/plugins/review/.claude-plugin/plugin.json index 60da07e560..ae0cb2228e 100644 --- a/plugins/review/.claude-plugin/plugin.json +++ b/plugins/review/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "review", - "version": "0.42.4", + "version": "0.42.5", "description": "Code-review toolkit: nine agents, read-only over the reviewed code, plus orchestration skills for the quality gate, fan-out, and enforceability audit (/review:audit-enforceability), a pull-request change digest with an interactive view (/review:explain-change), a fan-out sweep workflow (/review:fanout-sweep), and CI lane commands (/review:code-review, /review:security-review) for org reusable workflows.", "author": { "name": "Melodic Software", diff --git a/plugins/review/CHANGELOG.md b/plugins/review/CHANGELOG.md index 2bde67d674..11476615e6 100644 --- a/plugins/review/CHANGELOG.md +++ b/plugins/review/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `review` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.42.5] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.42.4] - 2026-10-07 ### Changed diff --git a/plugins/ruff-format/.claude-plugin/plugin.json b/plugins/ruff-format/.claude-plugin/plugin.json index f5c50b6bd3..83205bd555 100644 --- a/plugins/ruff-format/.claude-plugin/plugin.json +++ b/plugins/ruff-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "ruff-format", - "version": "0.9.11", + "version": "0.9.12", "description": "Auto-format and lint Python on edit via Ruff, only when a Ruff config governs the repo, using the consuming repo's own Ruff config.", "author": { "name": "Melodic Software", diff --git a/plugins/ruff-format/CHANGELOG.md b/plugins/ruff-format/CHANGELOG.md index 3301c09aff..4fc93bd3f7 100644 --- a/plugins/ruff-format/CHANGELOG.md +++ b/plugins/ruff-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `ruff-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.9.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.9.11] - 2026-10-07 ### Changed diff --git a/plugins/songwriting/.claude-plugin/plugin.json b/plugins/songwriting/.claude-plugin/plugin.json index 318be2a0c5..f1b70e32ee 100644 --- a/plugins/songwriting/.claude-plugin/plugin.json +++ b/plugins/songwriting/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "songwriting", - "version": "1.6.5", + "version": "1.6.6", "description": "Songwriting craft companion: nine concern-scoped lyric-craft skills (workflow router, rhyme, object-writing, metaphor, meter-prosody, song-form, co-write, diagnose, practice) applying Pat Pattison's methods, with an object-writing agent that performs the sensory exercise itself and per-skill emission boundaries that route generation to the skill that owns it, plus Suno v5.5 prompt engineering (style prompts, tagged lyrics, genre templates, troubleshooting).", "author": { "name": "Melodic Software", diff --git a/plugins/songwriting/CHANGELOG.md b/plugins/songwriting/CHANGELOG.md index 0c2fc016ef..6da2124d2f 100644 --- a/plugins/songwriting/CHANGELOG.md +++ b/plugins/songwriting/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `songwriting` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [1.6.6] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [1.6.5] - 2026-10-04 ### Changed diff --git a/plugins/speech/.claude-plugin/plugin.json b/plugins/speech/.claude-plugin/plugin.json index b75cbef302..99b0e10d8b 100644 --- a/plugins/speech/.claude-plugin/plugin.json +++ b/plugins/speech/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "speech", - "version": "0.2.9", + "version": "0.2.10", "description": "Text-to-speech narration. The narrate skill turns a script into narration.wav plus words.json, a start and end time for every word. The default kokoro backend runs Kokoro-82M locally with onnxruntime. The optional elevenlabs backend sends the text to the third-party ElevenLabs API (ELEVENLABS_API_KEY) after showing a cost estimate; an organization can forbid it. You install espeak-ng (GPL-3.0). A hook installs the Python packages; setup downloads the models; check reports missing prerequisites.", "author": { "name": "Melodic Software", diff --git a/plugins/speech/CHANGELOG.md b/plugins/speech/CHANGELOG.md index ee95879d6a..1eb4145840 100644 --- a/plugins/speech/CHANGELOG.md +++ b/plugins/speech/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `speech` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.2.10] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The shared `hook-utils.sh` copy picks up recheck triggers on its upstream records. + ## [0.2.9] - 2026-10-07 ### Changed diff --git a/plugins/typos-format/.claude-plugin/plugin.json b/plugins/typos-format/.claude-plugin/plugin.json index dba13f79bc..2b128580a4 100644 --- a/plugins/typos-format/.claude-plugin/plugin.json +++ b/plugins/typos-format/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "typos-format", - "version": "0.9.11", + "version": "0.9.12", "description": "Spell-check on edit via typos-cli, unconditionally. Report-only by default, honoring the consuming repo's own typos configuration when one is present.", "author": { "name": "Melodic Software", diff --git a/plugins/typos-format/CHANGELOG.md b/plugins/typos-format/CHANGELOG.md index 01cef34d53..4cd769e4d2 100644 --- a/plugins/typos-format/CHANGELOG.md +++ b/plugins/typos-format/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `typos-format` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.9.12] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.9.11] - 2026-10-07 ### Changed diff --git a/plugins/visualization/.claude-plugin/plugin.json b/plugins/visualization/.claude-plugin/plugin.json index 5792af30c1..9b7df27683 100644 --- a/plugins/visualization/.claude-plugin/plugin.json +++ b/plugins/visualization/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "visualization", - "version": "0.11.5", + "version": "0.11.6", "description": "Visualization skills. visualize picks the form (mermaid diagram, markdown table, SVG/CSS chart, ASCII/Unicode art, or a rendered page) and the medium (terminal, local HTML file, or published Artifact) for what is in the conversation, asking only when the target is ambiguous. present builds a slide deck from the account's claude.ai Slides Artifact type behind a publish gate, with a markdown outline as the record. Chart craft and artifact design route to those capabilities when installed.", "author": { "name": "Melodic Software", diff --git a/plugins/visualization/CHANGELOG.md b/plugins/visualization/CHANGELOG.md index ed3047d035..2c15b693dc 100644 --- a/plugins/visualization/CHANGELOG.md +++ b/plugins/visualization/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `visualization` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.11.6] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.11.5] - 2026-10-07 ### Changed diff --git a/plugins/work-items/.claude-plugin/plugin.json b/plugins/work-items/.claude-plugin/plugin.json index a1c7e8e5e0..b13fc499e4 100644 --- a/plugins/work-items/.claude-plugin/plugin.json +++ b/plugins/work-items/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "work-items", - "version": "0.49.7", + "version": "0.49.8", "description": "Work items through a provider-neutral tracker seam (github, local-markdown, jira, gitea, linear adapters): track (dashboard, creation, race-safe claims, recurring-schedule checks, stale-lease audits), scan-todos, decompose (plans into vertical-slice items), ship (route a spec container), triage (raw intake and unsolicited PRs), work, work-loop (autonomous PR-only drain), attend-queue (escalations), onboard-adapter (new tracker adapter), and setup (binds the provider).", "author": { "name": "Melodic Software", diff --git a/plugins/work-items/CHANGELOG.md b/plugins/work-items/CHANGELOG.md index cd97d449e4..50caf663ce 100644 --- a/plugins/work-items/CHANGELOG.md +++ b/plugins/work-items/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `work-items` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.49.8] - 2026-10-07 + +### Changed + +- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** Verification records carry recheck triggers specific to each claim, and citations of retired code.claude.com pages or drifted claims point at the live sections. + ## [0.49.7] - 2026-10-07 ### Changed From be8393933ec16e1fde6166dbb122cfb20bcd7e1e Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 13:18:39 -0400 Subject: [PATCH 9/9] chore(session-flow): drop the #6498 fragment; the plugin has no net change Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EC7nAKxQg52rCug6r6tYfe --- .changes/session-flow/fix-6498-slugs-stamps-2d453a97.md | 7 ------- 1 file changed, 7 deletions(-) delete mode 100644 .changes/session-flow/fix-6498-slugs-stamps-2d453a97.md diff --git a/.changes/session-flow/fix-6498-slugs-stamps-2d453a97.md b/.changes/session-flow/fix-6498-slugs-stamps-2d453a97.md deleted file mode 100644 index f44daa8035..0000000000 --- a/.changes/session-flow/fix-6498-slugs-stamps-2d453a97.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -bump: patch ---- - -### Changed - -- **Upstream records ([#6498](https://github.com/melodic-software/claude-code-plugins/issues/6498)).** The plugin-options README text names user and managed settings as the `pluginConfigs` sources, matching the settings reference as of 2026-10-07; it no longer lists `--settings`.