From c2a927de4f3385984360ff6c0150e5ebfdfce4d1 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Tue, 1 Sep 2026 10:56:05 -0400 Subject: [PATCH 1/3] fix: drop the no-op apply action from the five check-only setups MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phase 1b of the customization-consistency program: claude-ops, skill-quality, context-budget, repo-hygiene, and session-flow setups had an `apply` action with no write path — every surface they configure is native userConfig, forbidden settings, or an external prerequisite. PLUGIN-PHILOSOPHY's Check-only carve-out already says such setups are check-only, so each now cites the carve-out, drops `apply` from its description/argument-hint/routing, and folds the former apply guidance into a remediation/reconfiguration section `check` prints. Eval prompts and the two READMEs advertising the action follow. Conformance fix to existing doctrine; no owner-doc edit. Gates: markdownlint clean, all five evals.json parse, skill-quality check-skill PASS on all five setups. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_014uBXt1tMEReShbpG5gsFUd --- plugins/claude-ops/README.md | 2 +- plugins/claude-ops/skills/setup/SKILL.md | 35 +++++++++--------- .../claude-ops/skills/setup/evals/evals.json | 2 +- plugins/context-budget/skills/setup/SKILL.md | 37 +++++++++---------- .../skills/setup/evals/evals.json | 4 +- plugins/repo-hygiene/skills/setup/SKILL.md | 37 +++++++++---------- .../skills/setup/evals/evals.json | 4 +- plugins/session-flow/skills/setup/SKILL.md | 28 +++++++------- .../skills/setup/evals/evals.json | 6 +-- plugins/skill-quality/README.md | 6 +-- plugins/skill-quality/skills/setup/SKILL.md | 31 ++++++++-------- .../skills/setup/evals/evals.json | 2 +- 12 files changed, 97 insertions(+), 97 deletions(-) diff --git a/plugins/claude-ops/README.md b/plugins/claude-ops/README.md index 3d425d3dc..6d8c2c231 100644 --- a/plugins/claude-ops/README.md +++ b/plugins/claude-ops/README.md @@ -33,7 +33,7 @@ Claude Code's native OTEL cannot see. | `/claude-ops:plugins` | Brings a machine's plugin fleet current on demand: marketplace refresh, updates for the plugins that actually load (including in-repo project/local-scope installs), new-catalog-plugin install per policy, and scope-divergence detection. Actions: `sync` (default, CLI-mediated mutations only), `audit` (read-only dry run), `converge` (the one action that can touch a committed `.claude/settings.json`. Previews and confirms per plugin first). | | `/claude-ops:morning-brief` | Prints the read-only, `gh`-based operator morning view for the current repo in one pass: open counts per queue label (`priority: needs-triage`, `status: ready`, `status: needs-decision`, `needs-human`), the gh-native merge-ready PR list (non-draft + `mergeStateStatus=CLEAN`), parked `status: needs-decision` issues with their RECOMMENDED lines, and loop-lane telemetry freshness (per-lane `last-cycle` age + `flags:`). Never mutates anything; the authoritative PR merge gate stays `/source-control:babysit-prs`. | | `/claude-ops:lanes` | Starts, restarts, stops, and reports loop lanes as named background Claude Code sessions seeded from canonical prompt files. `start` (default) / `restart` pull the repo and refresh the plugin marketplace, then launch each configured lane (`claude --bg -n `) with its per-lane `model`/`effort`; `status` shows per-lane running state and live sessionId; `stop` ends a lane via `claude stop`; `consume-restarts` is the OS-schedulable restart-request consumer. It reads each configured lane's telemetry `restart_request` and relaunches the stopped lanes that asked, through the same launcher (#1653). Acts only on sessions whose name is a configured lane. Lanes come from a JSON config (`--config`, else `$CLAUDE_OPS_LANES_CONFIG`, else `/.work/lanes.json`); prompt storage is session-local `.work` today and composes with #480 for a durable home. | -| `/claude-ops:setup` | `check` (default) reports the effective known-issues-registry and skill-usage-log destinations, their defaults, and path containment; `apply` routes personal option changes through Claude Code's plugin configuration prompt. | +| `/claude-ops:setup` | Check-only: reports the effective known-issues-registry and skill-usage-log destinations, their defaults, and path containment, and prints the guidance for routing personal option changes through Claude Code's plugin configuration prompt. | ## The audit hooks diff --git a/plugins/claude-ops/skills/setup/SKILL.md b/plugins/claude-ops/skills/setup/SKILL.md index c1eadd2ea..3a6a1922d 100644 --- a/plugins/claude-ops/skills/setup/SKILL.md +++ b/plugins/claude-ops/skills/setup/SKILL.md @@ -1,25 +1,25 @@ --- -description: "Verify claude-ops's personal path configuration for this repository, where the known-issues registry and the skill-usage log resolve, and explain how to change them through Claude Code. Use when: 'set up claude-ops', 'configure claude-ops', 'claude-ops setup', 'where does the known-issues registry live', or 'where is skill usage logged'. Actions: check (read-only verification, default) | apply (route a reconfiguration once you've chosen a destination). Re-runnable and safe." -argument-hint: "check | apply" +description: "Verify claude-ops's personal path configuration for this repository, where the known-issues registry and the skill-usage log resolve, and explain how to change them through Claude Code. Use when: 'set up claude-ops', 'configure claude-ops', 'claude-ops setup', 'where does the known-issues registry live', or 'where is skill usage logged'. Check-only: verifies, reports, and prints reconfiguration guidance; there is nothing setup may write here. Re-runnable and safe." +argument-hint: "check" user-invocable: true disable-model-invocation: true --- ## Purpose -Thin check-centric setup per the uniform setup contract (`docs/PLUGIN-PHILOSOPHY.md` -"Setup is explicit and repeatable" in the marketplace repository): `check` inspects and reports the -effective personal path options, `apply` resolves what it found. `registry_dir` and `skill_usage_dir` -are personal `userConfig` scalars owned by Claude Code's native configuration surface. Claude Code -prompts for them when the plugin is enabled, stores non-sensitive options in user settings, and ignores -`pluginConfigs` entries in project and local settings on current releases (≥ 2.1.207). This skill never -writes them; `apply` verifies and routes. +Check-only setup under the Check-only carve-out (`docs/PLUGIN-PHILOSOPHY.md` "Setup is explicit +and repeatable" in the marketplace repository): this plugin's configuration surface contains no +writable artifact, so `check` verifies, reports, and prints the reconfiguration guidance below, +and no `apply` is offered because there is nothing it could conformingly write. `registry_dir` and +`skill_usage_dir` are personal `userConfig` scalars owned by Claude Code's native configuration +surface. Claude Code prompts for them when the plugin is enabled, stores non-sensitive options in +user settings, and ignores `pluginConfigs` entries in project and local settings on current +releases (≥ 2.1.207). This skill never writes them. Official contract (verified 2026-07-18): . -Action routing: no argument or `check` runs the check; `apply` runs the check first, then the -reconfiguration guidance below. Both are non-interactive, never prompt when the action is given. +Action routing: no argument or `check` runs the check. Non-interactive, never prompts. ## `check` (read-only) @@ -51,13 +51,14 @@ table, one remediation line per FAIL. Do not modify anything. either separator, and any existing symlink path that resolves outside that base. Do not normalize an invalid value into acceptance, and do not run any operation that would use an invalid destination. 4. **Personal-vs-project**. INFO: both options are personal, user-scoped preferences, not tracked team - policy. Note the per-machine-vs-repository-resident tradeoff so the reader can choose in `apply`. + policy. Note the per-machine-vs-repository-resident tradeoff so the reader can choose a + destination via the guidance below. -## `apply` (idempotent) +## Reconfiguration guidance (printed by `check`; the operator applies it) -Run `check`, then resolve what it found. This skill has no legitimate write of its own, the two -options live in Claude Code's native config surface, which setup must not hand-edit, so `apply` is -verify-and-route: +The two options live in Claude Code's native config surface, which setup must not hand-edit +(Check-only carve-out, native `userConfig` class), so `check` closes by routing rather than +writing: - **Uncontained value (FAIL):** the destination is invalid; do not use it. Direct the user to set a contained project-relative path through the reconfiguration path below, then rerun `check`. @@ -91,7 +92,7 @@ verify-and-route: After any reconfiguration, rerun `check` in a **fresh session** and report both observed effective destinations, never claim an unobserved change, and never read a same-session `check` still showing the old value as a failed write (see the reconfiguration note above for why it does). Re-running -`apply` when both destinations are contained (or defaulted) changes nothing and reports +`check` when both destinations are contained (or defaulted) changes nothing and reports "already configured". ## What this skill does NOT do diff --git a/plugins/claude-ops/skills/setup/evals/evals.json b/plugins/claude-ops/skills/setup/evals/evals.json index 11facb3b4..6b176e508 100644 --- a/plugins/claude-ops/skills/setup/evals/evals.json +++ b/plugins/claude-ops/skills/setup/evals/evals.json @@ -17,7 +17,7 @@ { "id": 2, "name": "routes-reconfiguration-through-claude", - "prompt": "/claude-ops:setup apply\n\nKeep the known-issues registry in this repository.", + "prompt": "/claude-ops:setup\n\nKeep the known-issues registry in this repository.", "expected_output": "Recommends a portable project-relative path from repository evidence, directs the user to Claude Code's plugin configuration prompt, and verifies the rendered value on rerun before claiming success.", "files": [], "expectations": [ diff --git a/plugins/context-budget/skills/setup/SKILL.md b/plugins/context-budget/skills/setup/SKILL.md index 449f976c5..dfbf206f8 100644 --- a/plugins/context-budget/skills/setup/SKILL.md +++ b/plugins/context-budget/skills/setup/SKILL.md @@ -1,24 +1,23 @@ --- -description: "Verify context-budget's external prerequisites on this machine: `node`, which both the always-on settings-write checkpoint hook and the measurement engine depend on; the Claude Code CLI the engine measures against; and the optional Agent SDK that enables exact mode. Then report the effective settings-write-ask toggle. Use when: 'set up context-budget', 'configure context-budget', 'is context-budget working', 'why did the settings-write ask not prompt', 'why is the audit not exact', or an audit run reported a missing prerequisite. Actions: check (read-only verification, default) | apply (point at each remediation; installs nothing). Re-runnable and safe." -argument-hint: "check | apply" +description: "Verify context-budget's external prerequisites on this machine: `node`, which both the always-on settings-write checkpoint hook and the measurement engine depend on; the Claude Code CLI the engine measures against; and the optional Agent SDK that enables exact mode. Then report the effective settings-write-ask toggle. Use when: 'set up context-budget', 'configure context-budget', 'is context-budget working', 'why did the settings-write ask not prompt', 'why is the audit not exact', or an audit run reported a missing prerequisite. Check-only: verifies, reports, and points at each remediation; installs nothing and there is nothing setup may write here. Re-runnable and safe." +argument-hint: "check" user-invocable: true disable-model-invocation: true --- ## Purpose -Thin check-centric setup per the uniform setup contract (`docs/PLUGIN-PHILOSOPHY.md` -"Setup is explicit and repeatable" in the marketplace repository): `check` inspects and reports, -`apply` points at what it found. The warrant is criterion (b), external prerequisites: `node`, -the Claude Code CLI -the engine pins and measures against, and the optional `@anthropic-ai/claude-agent-sdk` that -enables exact mode, none of which a native configuration prompt can see, and each of which setup -can only verify. The `settings_write_ask_enabled` option is a native `userConfig` toggle whose only -stored home is the `pluginConfigs` this contract forbids setup to write, so this -setup is check-only: `apply` installs nothing, writes nothing, and is idempotent by construction. +Check-only setup under the Check-only carve-out (`docs/PLUGIN-PHILOSOPHY.md` "Setup is explicit +and repeatable" in the marketplace repository): this plugin's configuration surface contains no +writable artifact, so `check` inspects, reports, and points at each remediation, and no `apply` is +offered because there is nothing it could conformingly write. The warrant is the carve-out's +external-prerequisites class: `node`, the Claude Code CLI the engine pins and measures against, +and the optional `@anthropic-ai/claude-agent-sdk` that enables exact mode, none of which a native +configuration prompt can see, and each of which setup can only verify. The +`settings_write_ask_enabled` option is a native `userConfig` toggle whose only stored home is the +`pluginConfigs` this contract forbids setup to write. -Action routing: no argument or `check` runs the check; `apply` runs the check first, then points at -each remediation. Both are non-interactive. Never prompt when the action is given. +Action routing: no argument or `check` runs the check. Non-interactive, never prompts. ## `check` (read-only) @@ -61,12 +60,12 @@ Install nothing. checkpoint is deliberately off and step 1's `node` finding downgrades to INFO for the hook (it stays FAIL for the engine). -## `apply` (idempotent) +## Remediation guidance (printed by `check`; the operator applies it) -Run `check`, then point at each resolution. Every prerequisite here is a system tool or an operator -install, and the one option lives in Claude Code's native configuration surface, so `apply` writes -nothing and installs nothing. Re-running it after everything passes changes nothing and reports -"already configured": +Every prerequisite here is a system tool or an operator install, and the one option lives in +Claude Code's native configuration surface (Check-only carve-out, external-prerequisites and +native-`userConfig` classes), so `check` closes by pointing at each resolution rather than +writing. Re-running it after everything passes changes nothing and reports "already configured": - **Missing `node`:** the platform's own install channel (). This plugin never downloads a runtime. On Windows, confirm the hook's environment resolves the same @@ -98,6 +97,6 @@ nothing and installs nothing. Re-running it after everything passes changes noth ## What this skill does NOT do - Run a measurement, attribution, or ledger operation. That is `/context-budget:audit`. -- Install `node`, the CLI, or the Agent SDK, during either `check` or `apply`. Guidance only. +- Install `node`, the CLI, or the Agent SDK. Guidance only. - Write the plugin cache, Claude Code user settings, or `pluginConfigs`. Nor any other Claude Code settings surface. diff --git a/plugins/context-budget/skills/setup/evals/evals.json b/plugins/context-budget/skills/setup/evals/evals.json index 2f70c60ce..a563af1b2 100644 --- a/plugins/context-budget/skills/setup/evals/evals.json +++ b/plugins/context-budget/skills/setup/evals/evals.json @@ -44,7 +44,7 @@ { "id": 4, "name": "never-installs-agent-sdk-unasked", - "prompt": "/context-budget:setup apply — the Agent SDK does not resolve so exact mode is unavailable. Just install it for me so my audits are exact.", + "prompt": "/context-budget:setup — the Agent SDK does not resolve so exact mode is unavailable. Just install it for me so my audits are exact.", "expected_output": "Prints the one-time npm install command marked as the operator's own and does not run it, because it needs network access. Reports the absent SDK as INFO, not a defect.", "files": [], "expectations": [ @@ -71,7 +71,7 @@ { "id": 6, "name": "headless-toggle-change-reruns-install-never-uninstalls", - "prompt": "/context-budget:setup apply — I want settings_write_ask_enabled set to false, headless. I cannot use the interactive configure prompt from this session.", + "prompt": "/context-budget:setup — I want settings_write_ask_enabled set to false, headless. I cannot use the interactive configure prompt from this session.", "expected_output": "Routes the headless option change to a plain `claude plugin install context-budget@ -s --config settings_write_ask_enabled=false` rerun against the already-installed plugin, refuses the uninstall-and-reinstall route, stamps the claim with the CLI version it was verified against, and closes by rerunning check in a fresh session to report the observed value.", "files": [], "expectations": [ diff --git a/plugins/repo-hygiene/skills/setup/SKILL.md b/plugins/repo-hygiene/skills/setup/SKILL.md index a45c07411..9d02fd276 100644 --- a/plugins/repo-hygiene/skills/setup/SKILL.md +++ b/plugins/repo-hygiene/skills/setup/SKILL.md @@ -1,25 +1,23 @@ --- -description: "Verify repo-hygiene's external prerequisites on this machine — `git`, which the scan, git, stash, and tree tiers and the tracked-file guarantee all rest on, and the optional `ghq` the fleet batch actions enumerate repositories from — and report the effective destructive-guard toggle and the scope it actually applies at. Use when: 'set up repo-hygiene', 'configure repo-hygiene', 'is repo-hygiene working', 'is the destructive guard on', 'why did tree-batch find no repos', or before a first clean on a new machine. Actions: check (read-only verification, default) | apply (point at each remediation; installs nothing). Re-runnable and safe." -argument-hint: "check | apply" +description: "Verify repo-hygiene's external prerequisites on this machine — `git`, which the scan, git, stash, and tree tiers and the tracked-file guarantee all rest on, and the optional `ghq` the fleet batch actions enumerate repositories from — and report the effective destructive-guard toggle and the scope it actually applies at. Use when: 'set up repo-hygiene', 'configure repo-hygiene', 'is repo-hygiene working', 'is the destructive guard on', 'why did tree-batch find no repos', or before a first clean on a new machine. Check-only: verifies, reports, and points at each remediation; installs nothing and there is nothing setup may write here. Re-runnable and safe." +argument-hint: "check" user-invocable: true disable-model-invocation: true --- ## Purpose -Thin check-centric setup per the uniform setup contract (`docs/PLUGIN-PHILOSOPHY.md` -"Setup is explicit and repeatable" in the marketplace repository): `check` inspects and reports, -`apply` points at what it found. The warrant is criterion (b), external prerequisites. `git`, -which every -git-touching tier of `/repo-hygiene:clean` and the tracked-file safety guarantee depend on, and the -optional `ghq` the fleet batch actions enumerate repositories from. Neither of which a native -configuration prompt can see, and each of which setup can only verify. The -`clean_destructive_guard_enabled` option is a native `userConfig` toggle whose only stored home is -the `pluginConfigs` this contract forbids setup to write, so this setup is check-only: `apply` -installs nothing, writes nothing, and is idempotent by construction. +Check-only setup under the Check-only carve-out (`docs/PLUGIN-PHILOSOPHY.md` "Setup is explicit +and repeatable" in the marketplace repository): this plugin's configuration surface contains no +writable artifact, so `check` inspects, reports, and points at each remediation, and no `apply` is +offered because there is nothing it could conformingly write. The warrant is the carve-out's +external-prerequisites class: `git`, which every git-touching tier of `/repo-hygiene:clean` and +the tracked-file safety guarantee depend on, and the optional `ghq` the fleet batch actions +enumerate repositories from — neither visible to a native configuration prompt, each verifiable +only. The `clean_destructive_guard_enabled` option is a native `userConfig` toggle whose only +stored home is the `pluginConfigs` this contract forbids setup to write. -Action routing: no argument or `check` runs the check; `apply` runs the check first, then points at -each remediation. Both are non-interactive, never prompt when the action is given. +Action routing: no argument or `check` runs the check. Non-interactive, never prompts. ## `check` (read-only) @@ -63,11 +61,12 @@ Install nothing, and run no mutating tier. per-repository value of this toggle. To vary the behavior for one repository, enable or disable the plugin in that project's `enabledPlugins` instead. -## `apply` (idempotent) +## Remediation guidance (printed by `check`; the operator applies it) -Run `check`, then point at each resolution. Both prerequisites are system tools and the one option -lives in Claude Code's native configuration surface, so `apply` writes nothing and installs -nothing. Re-running it after everything passes changes nothing and reports "already configured": +Both prerequisites are system tools and the one option lives in Claude Code's native +configuration surface (Check-only carve-out, external-prerequisites and native-`userConfig` +classes), so `check` closes by pointing at each resolution rather than writing. Re-running it +after everything passes changes nothing and reports "already configured": - **Missing `git`:** the platform's own install channel (). This plugin never downloads a tool. @@ -93,6 +92,6 @@ nothing. Re-running it after everything passes changes nothing and reports "alre - Scan, clean, prune, or reset anything. Those are `/repo-hygiene:clean`'s tiers, with their own dry-run-first and confirmation contract. -- Install `git`, `ghq`, or any tool, during either `check` or `apply`. Guidance only. +- Install `git`, `ghq`, or any tool. Guidance only. - Write the plugin cache, Claude Code user settings, or `pluginConfigs`. Nor any other Claude Code settings surface. diff --git a/plugins/repo-hygiene/skills/setup/evals/evals.json b/plugins/repo-hygiene/skills/setup/evals/evals.json index eebe62e11..14b61292d 100644 --- a/plugins/repo-hygiene/skills/setup/evals/evals.json +++ b/plugins/repo-hygiene/skills/setup/evals/evals.json @@ -57,7 +57,7 @@ { "id": 5, "name": "per-repository-disable-is-enabledplugins-not-project-config", - "prompt": "/repo-hygiene:setup apply — I want the destructive guard on everywhere except one repository. Add clean_destructive_guard_enabled=false to that project's settings for me.", + "prompt": "/repo-hygiene:setup — I want the destructive guard on everywhere except one repository. Add clean_destructive_guard_enabled=false to that project's settings for me.", "expected_output": "Refuses both halves: setup writes no settings surface, and a project-scope value would be inert anyway — plugin option values are read from user, --settings, and managed settings only, so there is no per-repository value of this toggle. Routes the per-repository intent to disabling the plugin in that project's enabledPlugins instead.", "files": [], "expectations": [ @@ -70,7 +70,7 @@ { "id": 6, "name": "headless-toggle-change-reruns-install-never-uninstalls", - "prompt": "/repo-hygiene:setup apply — turn clean_destructive_guard_enabled back on headlessly. I cannot use the interactive configure prompt from this session.", + "prompt": "/repo-hygiene:setup — turn clean_destructive_guard_enabled back on headlessly. I cannot use the interactive configure prompt from this session.", "expected_output": "Routes the headless option change to a plain `claude plugin install repo-hygiene@ -s --config clean_destructive_guard_enabled=true` rerun against the already-installed plugin, refuses the uninstall-and-reinstall route, stamps the claim with the CLI version it was verified against, and closes by rerunning check in a fresh session to report the observed toggle value.", "files": [], "expectations": [ diff --git a/plugins/session-flow/skills/setup/SKILL.md b/plugins/session-flow/skills/setup/SKILL.md index 58a937fd5..00f06d57a 100644 --- a/plugins/session-flow/skills/setup/SKILL.md +++ b/plugins/session-flow/skills/setup/SKILL.md @@ -1,23 +1,23 @@ --- -description: "Verify the session-flow observer's runtime prerequisites and configuration for this machine. Use when: 'set up session-flow', 'configure the observer', 'is the observer working', the SessionStart observer isn't arming, or the observer hook reported a missing prerequisite. Actions: check (read-only verification, default) | apply (resolve what check found). Re-runnable and safe; only the observer substrate has prerequisites, the other thirteen skills are zero-config." -argument-hint: "check | apply" +description: "Verify the session-flow observer's runtime prerequisites and configuration for this machine. Use when: 'set up session-flow', 'configure the observer', 'is the observer working', the SessionStart observer isn't arming, or the observer hook reported a missing prerequisite. Check-only: verifies, reports, and offers each remediation; installs nothing and there is nothing setup may write here. Re-runnable and safe; only the observer substrate has prerequisites, the other thirteen skills are zero-config." +argument-hint: "check" user-invocable: true disable-model-invocation: true --- ## Purpose -Thin check-centric setup per the uniform setup contract (`docs/PLUGIN-PHILOSOPHY.md` -"Setup is explicit and repeatable" in the marketplace repository): `check` inspects and reports, -`apply` resolves. Only the **detached observer** (see +Check-only setup under the Check-only carve-out (`docs/PLUGIN-PHILOSOPHY.md` "Setup is explicit +and repeatable" in the marketplace repository): this plugin's configuration surface contains no +writable artifact, so `check` inspects, reports, and offers each remediation, and no `apply` is +offered because there is nothing it could conformingly write. Only the **detached observer** (see [`${CLAUDE_PLUGIN_ROOT}/reference/observer.md`](${CLAUDE_PLUGIN_ROOT}/reference/observer.md)) has -runtime prerequisites and configuration; the other skills are zero-config. The observer's tunables are -all native `userConfig`, and its remaining prerequisites are system tools (Python 3.10+, `jq`), so -`apply` is guidance-and-verify with **no write path**: it installs nothing and edits nothing (writing -`pluginConfigs` is what the setup contract forbids). +runtime prerequisites and configuration; the other skills are zero-config. The observer's tunables +are all native `userConfig` (the carve-out's native-`userConfig` class), and its remaining +prerequisites are system tools (Python 3.10+, `jq` — the external-prerequisites class), so setup +installs nothing and edits nothing (writing `pluginConfigs` is what the setup contract forbids). -Action routing: no argument or `check` runs the check; `apply` runs the check first, then offers the -resolution for each finding. Both are non-interactive, never prompt when the action is given. +Action routing: no argument or `check` runs the check. Non-interactive, never prompts. ## `check` (read-only) @@ -55,10 +55,10 @@ and note that re-enabling restores the FAIL semantics. 5. **Hook registration**. INFO: confirm the plugin is enabled for this project (`/plugin` → Installed) rather than parsing settings files. The SessionStart hook only auto-arms when `observer_enabled` is on. -## `apply` +## Remediation guidance (printed by `check`; the operator applies it) -No write path. Run `check`, then for each FAIL offer the remediation: install the missing tool, or route -observer reconfiguration through Claude Code's native flow. +No write path. For each FAIL, `check` closes by offering the remediation: install the missing +tool, or route observer reconfiguration through Claude Code's native flow. Do not write the plugin cache, Claude Code user settings, or `pluginConfigs`. Reconfiguring the observer's `userConfig` keys has exactly two routes, and both work on an already diff --git a/plugins/session-flow/skills/setup/evals/evals.json b/plugins/session-flow/skills/setup/evals/evals.json index 3206f6074..423de92ad 100644 --- a/plugins/session-flow/skills/setup/evals/evals.json +++ b/plugins/session-flow/skills/setup/evals/evals.json @@ -16,9 +16,9 @@ }, { "id": 2, - "name": "apply-has-no-write-path-routes-to-native-configure", - "prompt": "/session-flow:setup apply", - "expected_output": "Runs the check first, then for each finding offers only guidance (install the missing tool, or reconfigure via Claude Code's native /plugin configure session-flow@). It never writes pluginConfigs, mutates user settings, or edits the installed plugin cache.", + "name": "check-has-no-write-path-routes-to-native-configure", + "prompt": "/session-flow:setup", + "expected_output": "Runs the check, then for each finding offers only guidance (install the missing tool, or reconfigure via Claude Code's native /plugin configure session-flow@). It never writes pluginConfigs, mutates user settings, or edits the installed plugin cache.", "files": [], "expectations": [ "Runs the check before offering any resolution", diff --git a/plugins/skill-quality/README.md b/plugins/skill-quality/README.md index 2f8914ba7..b722f8110 100644 --- a/plugins/skill-quality/README.md +++ b/plugins/skill-quality/README.md @@ -12,7 +12,7 @@ phrase, which quietly degrades a skill's auto-invocation. Check 3 compares the t | Skill | What it does | |---|---| | `/skill-quality:check` | Runs the contract gate (`check`), reports the shared listing budget (`listing-budget`), or schema-validates and quality-lints evals (`validate-evals`) for one skill, a set of roots, or every skill. | -| `/skill-quality:setup` | `check` (default) resolves and verifies the skills directory; `apply` routes a non-default `skills_root` change through Claude Code. | +| `/skill-quality:setup` | Check-only: resolves and verifies the skills directory and prints the guidance for routing a non-default `skills_root` change through Claude Code. | ## Checks @@ -85,8 +85,8 @@ the setup skill neither writes nor persists it. When your skills live at the def configuration is needed: ```shell -/skill-quality:setup # check (default): resolve + verify the skills directory (re-runnable) -/skill-quality:setup apply # route a non-default skills_root change through Claude Code +/skill-quality:setup # check-only: resolve + verify the skills directory (re-runnable); + # prints how to route a skills_root change through Claude Code ``` ## Evals schema + quality lint diff --git a/plugins/skill-quality/skills/setup/SKILL.md b/plugins/skill-quality/skills/setup/SKILL.md index ef1bcbe21..716028a35 100644 --- a/plugins/skill-quality/skills/setup/SKILL.md +++ b/plugins/skill-quality/skills/setup/SKILL.md @@ -1,24 +1,25 @@ --- -description: "Verify where this repository's skills live for skill-quality, the resolved skills_root, and explain how to change the personal skills_root option through Claude Code. Use when: 'set up skill-quality', 'configure skill-quality', or the checker reports a missing skills directory. Actions: check (read-only verification, default) | apply (route a skills_root change once you've chosen a location). Re-runnable and safe." -argument-hint: "check | apply" +description: "Verify where this repository's skills live for skill-quality, the resolved skills_root, and explain how to change the personal skills_root option through Claude Code. Use when: 'set up skill-quality', 'configure skill-quality', or the checker reports a missing skills directory. Check-only: verifies, reports, and prints reconfiguration guidance; there is nothing setup may write here. Re-runnable and safe." +argument-hint: "check" user-invocable: true disable-model-invocation: true --- ## Purpose -Thin check-centric setup per the uniform setup contract (`docs/PLUGIN-PHILOSOPHY.md` -"Setup is explicit and repeatable" in the marketplace repository): `check` resolves and verifies the -skills root, `apply` resolves what it found. `skills_root` is a personal `userConfig` scalar owned by -Claude Code's native configuration surface. Claude Code prompts for it when the plugin is enabled, -stores non-sensitive options in user settings, and ignores project/local `pluginConfigs` entries on -current releases (≥ 2.1.207). This skill never writes it; `apply` verifies and routes. +Check-only setup under the Check-only carve-out (`docs/PLUGIN-PHILOSOPHY.md` "Setup is explicit +and repeatable" in the marketplace repository): this plugin's configuration surface contains no +writable artifact, so `check` resolves and verifies the skills root and prints the reconfiguration +guidance below, and no `apply` is offered because there is nothing it could conformingly write. +`skills_root` is a personal `userConfig` scalar owned by Claude Code's native configuration +surface. Claude Code prompts for it when the plugin is enabled, stores non-sensitive options in +user settings, and ignores project/local `pluginConfigs` entries on current releases (≥ 2.1.207). +This skill never writes it. Official contract (verified 2026-07-18): . -Action routing: no argument or `check` runs the check; `apply` runs the check first, then the -reconfiguration guidance. Both are non-interactive. Never prompt when the action is given. +Action routing: no argument or `check` runs the check. Non-interactive, never prompts. ## `check` (read-only) @@ -33,11 +34,11 @@ remediation per FAIL. Do not modify anything. directory and skill count; FAIL when it is absent or empty, with the resolution result in the remediation line. Never claim success for a missing directory. -## `apply` (idempotent) +## Reconfiguration guidance (printed by `check`; the operator applies it) -Run `check`, then resolve what it found. This skill has no legitimate write of its own. `skills_root` -lives in Claude Code's native config surface, which setup must not hand-edit, so `apply` is -verify-and-route: +This skill has no legitimate write of its own. `skills_root` lives in Claude Code's native config +surface, which setup must not hand-edit (Check-only carve-out, native `userConfig` class), so +`check` closes by routing rather than writing: - **Skills not found / wrong root (FAIL):** if the skills live somewhere other than the resolved root, the personal `skills_root` should point there. Reconfigure through the path below, then rerun `check`. @@ -60,7 +61,7 @@ After any reconfiguration, rerun `check` **in a fresh session** and verify by in `/skill-quality:check` via the Skill tool, without turning setup into the full quality audit. The fresh session is not optional: the rendered `${user_config.skills_root}` is injected when this skill loads, so a same-session rerun still resolves the OLD root and would report a correct write as a -failure. Re-running `apply` when the root resolves and enumerates changes nothing and reports +failure. Re-running `check` when the root resolves and enumerates changes nothing and reports "already configured". ## What this skill does NOT do diff --git a/plugins/skill-quality/skills/setup/evals/evals.json b/plugins/skill-quality/skills/setup/evals/evals.json index 9bb83518e..3c3581838 100644 --- a/plugins/skill-quality/skills/setup/evals/evals.json +++ b/plugins/skill-quality/skills/setup/evals/evals.json @@ -16,7 +16,7 @@ { "id": 2, "name": "non-default-location-routes-through-claude", - "prompt": "Our skills live under packages/agent/skills. /skill-quality:setup apply", + "prompt": "Our skills live under packages/agent/skills. /skill-quality:setup", "expected_output": "Verifies the non-default root non-interactively, routes the persistent skills_root change through Claude Code's plugin configuration prompt (headless: a plain claude plugin install ... --config skills_root= rerun, never an uninstall), optionally explains the one-run CHECK_SKILL_SKILLS_ROOT override, and never persists either mechanism itself.", "files": [], "expectations": [ From db47ed86afbdc77347bef79d45a911bcc2f8300d Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Tue, 1 Sep 2026 14:21:26 -0400 Subject: [PATCH 2/3] chore: bump the five plugins Phase 1b touched and record the change Patch bumps for claude-ops, skill-quality, context-budget, repo-hygiene, session-flow with a matching CHANGELOG entry each, per the changelog-parity gate's published-version-reuse rule. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_014uBXt1tMEReShbpG5gsFUd --- plugins/claude-ops/.claude-plugin/plugin.json | 2 +- plugins/claude-ops/CHANGELOG.md | 6 ++++++ plugins/context-budget/.claude-plugin/plugin.json | 2 +- plugins/context-budget/CHANGELOG.md | 6 ++++++ plugins/repo-hygiene/.claude-plugin/plugin.json | 2 +- plugins/repo-hygiene/CHANGELOG.md | 6 ++++++ plugins/session-flow/.claude-plugin/plugin.json | 2 +- plugins/session-flow/CHANGELOG.md | 6 ++++++ plugins/skill-quality/.claude-plugin/plugin.json | 2 +- plugins/skill-quality/CHANGELOG.md | 6 ++++++ 10 files changed, 35 insertions(+), 5 deletions(-) diff --git a/plugins/claude-ops/.claude-plugin/plugin.json b/plugins/claude-ops/.claude-plugin/plugin.json index 09c546922..bde046614 100644 --- a/plugins/claude-ops/.claude-plugin/plugin.json +++ b/plugins/claude-ops/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json", "name": "claude-ops", - "version": "0.38.3", + "version": "0.38.4", "description": "Claude Code operations toolkit. Twelve skills: audit-skill-visibility (audit whether each installed skill is actually VISIBLE to the model, and diagnose why most of a fleet never gets used — a skill is invisible when its description is dropped by Claude Code's skill-listing context budget, which drops descriptions least-invoked-first so an unused skill loses the keywords that would let it be matched, from skills genuinely not wanted, from skills the run cannot observe at all; computes whether the listing overflows from documented settings, and withholds every cold verdict the data cannot support rather than reporting absence of data as absence of use), inventory (read-only enumeration of the complete invocable surface — every built-in CLI command with aliases and hidden/gated status, every bundled skill, and every component of every installed plugin across all marketplaces; reads the shipped binary because upstream publishes no built-in command list, and carries an integrity verdict so a drifted build reports counts as floors rather than silently short totals), audit-install-state (read-only audit of the machine-scope ~/.claude installation directory and ~/.claude.json — full inventory split into an authored surface and rolled-up bulk trees, product-managed retention vs genuinely unmanaged state, filename-scheme resolution before any process-liveness check, and deliberate/mid-experiment detection; reports, never deletes), audit-performance (read-only slowness-diagnostic capture run at the moment the machine or a session feels slow: CLI version, retention-sweep health including the silent unparsable-settings pause, a timed census walk of the install tree as a sweep-cost proxy, active-session and plugin-fleet counts, a process census, and the fan-out layer, which covers a load-labelled no-op spawn baseline, every hook that will fire bucketed per-tool-call versus per-turn with its invocation shape, the configured statusline, subagent concurrency and spawn-depth ceilings against documented defaults, whether running sessions predate the settings file they are judged by, and orphan attribution by parent liveness rather than age; read against a bundled known-performance-issues reference that also records the causes tested and cleared; separates the four documented suspects of accumulated state, version regression, component bloat, and per-spawn fan-out cost, and routes remediation out; reports, never mutates, and never executes a discovered hook or statusline command), audit-native-overlap (map native Claude Code surfaces — built-in CLI commands, bundled skills, plugin-backed built-ins, session-provided skills — against the current repo's plugin skills and agents, so a custom component never silently duplicates what Claude Code itself ships; bare invocation is a read-only overlap report carrying the extraction's integrity floors and a shared-listing-budget exposure section, verdicts are human-gated in a committed store rendered into a generated registry whose every row carries an observable recheck trigger, and only an explicit apply step bakes presence-gated native references into descriptions and Boundary sections), observability (read locally captured telemetry — OTEL store, collector, hook-event JSONL, ccusage — with trend reports and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and integrate them into the current repo), plugins (bring a machine's plugin fleet current on demand — marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view — queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action — an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry lives. Plus a family of eight advisory *-audit hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures, and unsurfaced hook failures — the last also warns the user via systemMessage, since a hook that fails to launch enforces nothing and Claude Code surfaces the failure to nobody) that emit the shared hook-telemetry envelope, and a reference sink that maps envelopes into the hook-events.jsonl the observability skill reads.", "author": { "name": "Melodic Software", diff --git a/plugins/claude-ops/CHANGELOG.md b/plugins/claude-ops/CHANGELOG.md index a090e6e73..cc58c28f8 100644 --- a/plugins/claude-ops/CHANGELOG.md +++ b/plugins/claude-ops/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `claude-ops` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.38.4] + +### Changed + +- `setup` is check-only: the no-op `apply` action is dropped per PLUGIN-PHILOSOPHY's Check-only carve-out, and its reconfiguration guidance is now printed by `check` (#3583, customization-consistency Phase 1b). + ## [0.38.3] ### Changed diff --git a/plugins/context-budget/.claude-plugin/plugin.json b/plugins/context-budget/.claude-plugin/plugin.json index dfc1a872b..c037e0d85 100644 --- a/plugins/context-budget/.claude-plugin/plugin.json +++ b/plugins/context-budget/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json", "name": "context-budget", - "version": "0.6.10", + "version": "0.6.11", "description": "Measure a Claude Code session's fixed startup context payload per item, on the consumer's machine at a pinned, version-stamped binary — including per-tool attribution of the built-in tool pools that /context reports only as lump sums, derived live by A/B bare-name-deny differencing with enforced comparability rules (skill-listing signature, one mode, one binary), an SDK-primary exact meter degrading to a version-aware headless /context parser and then to an honest structured error (never a wrong number), and a per-project measure-toggle-remeasure ledger under the plugin data directory recording every lever's real before/after delta. Report-only: prints exact config, applies nothing.", "author": { "name": "Melodic Software", diff --git a/plugins/context-budget/CHANGELOG.md b/plugins/context-budget/CHANGELOG.md index e8eaabe95..fed218ae4 100644 --- a/plugins/context-budget/CHANGELOG.md +++ b/plugins/context-budget/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to the `context-budget` plugin. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.6.11] + +### Changed + +- `setup` is check-only: the no-op `apply` action is dropped per PLUGIN-PHILOSOPHY's Check-only carve-out, and its reconfiguration guidance is now printed by `check` (#3583, customization-consistency Phase 1b). + ## [0.6.10] ### Changed diff --git a/plugins/repo-hygiene/.claude-plugin/plugin.json b/plugins/repo-hygiene/.claude-plugin/plugin.json index bafb9cbf4..bd72cb78b 100644 --- a/plugins/repo-hygiene/.claude-plugin/plugin.json +++ b/plugins/repo-hygiene/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json", "name": "repo-hygiene", - "version": "0.10.11", + "version": "0.10.12", "description": "Repo hygiene action-router: /repo-hygiene:clean sweeps reclaimable caches, build artifacts, and stale git metadata, and can realign the working tree to a fresh-pull state — dry-run-first, with destructive tiers gated behind explicit confirmation and a session-scoped destructive-command guard. Ecosystem targets are detected at runtime; secrets, runtime dependencies, and skill data are preserved by default.", "author": { "name": "Melodic Software", diff --git a/plugins/repo-hygiene/CHANGELOG.md b/plugins/repo-hygiene/CHANGELOG.md index c75612c17..255ac7ff4 100644 --- a/plugins/repo-hygiene/CHANGELOG.md +++ b/plugins/repo-hygiene/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `repo-hygiene` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.10.12] + +### Changed + +- `setup` is check-only: the no-op `apply` action is dropped per PLUGIN-PHILOSOPHY's Check-only carve-out, and its reconfiguration guidance is now printed by `check` (#3583, customization-consistency Phase 1b). + ## [0.10.11] ### Changed diff --git a/plugins/session-flow/.claude-plugin/plugin.json b/plugins/session-flow/.claude-plugin/plugin.json index cf5407a30..a33e2d2cf 100644 --- a/plugins/session-flow/.claude-plugin/plugin.json +++ b/plugins/session-flow/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json", "name": "session-flow", - "version": "0.32.6", + "version": "0.32.7", "description": "Session-lifecycle toolkit of fourteen skills: workflow (navigate a staged dev workflow and suggest the next stage), handoff (write a save-point and resume prompt for /clear-and-resume), continue-in-background (delegate the task to a fresh background agent that continues it now — same save-point engine as handoff, delivered by launching a detached claude --bg session seeded with the resume prompt; launches only on explicit user request), keep-going (recover and continue after any interruption OR when live off-thread work looks stalled — inventory off-thread work, inspect its real output, act only on evidence, then continue; after a usage limit lifts it continues rather than summarizing-and-stalling), find-handoff (recover a lost handoff after /clear — when the resume prompt was written but never copied — via a read-only detection ladder: known-location glob of the handoffs dir, then a bounded, recency-ranked transcript scan for the handoff directive and dashed-rail markers, then a confirm-before-resume gate; surfaces only the resume prompt + metadata, never raw transcript content), clean-stop (get to a durable, linked stopping point before the machine may go away — sweep every repo/worktree for uncommitted, unpushed, or PR-less work, push it durable, put breadcrumbs in PR/issue bodies, then give a free-and-clear verdict), retro (structured end-of-session retrospective with transcript metrics and learning codification), running-retro (in-flight retrospective checkpoints that spawn a subagent to analyze the transcript so far and append classified findings to a cumulative running ledger — capture and route only, the live counterpart to retro; also owns a detached-observer substrate that can watch a session out-of-band and run the checkpoint autonomously after the session ends), orient (read-only session orientation — synthesize where we stand, what we are doing, and why, from durable + off-thread state the built-in /recap never sees: ledgers, handoffs, workflow checklists, running-retro ledgers, open PRs and work-items, and git), orchestrate (arm a session or worker with proactive-orchestration imperatives), reanchor (verify a session's working assumptions are still true against live reality — referenced PRs/issues/branches, base-branch drift, renamed/version-drifted surfaces, stale memory-tier files, and the goal a handoff records, compared across the chain so a re-derived goal reports as drift — before building on them), reconcile (retire finished off-thread work and reconcile this session's task ledger with reality — the prune-and-reconcile counterpart to keep-going's resume: inventory the work this session spawned, inspect its real state, retire the finished and close proven-done tasks, auto-settling the finished and gating any kill of still-running work; sibling sessions in the project are reported read-only), setup (check-centric verification of the observer's runtime prerequisites and configuration), and show-options (lay out which skills fit this moment as a ranked, nothing-hidden menu — a shortlist per bucket plus the complete remainder by name, resolved from the full installed catalog rather than the truncated in-context listing, so the human decides and no option is withheld for looking already-done).", "author": { "name": "Melodic Software", diff --git a/plugins/session-flow/CHANGELOG.md b/plugins/session-flow/CHANGELOG.md index 3aa808824..fe201570a 100644 --- a/plugins/session-flow/CHANGELOG.md +++ b/plugins/session-flow/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog — session-flow plugin +## [0.32.7] + +### Changed + +- `setup` is check-only: the no-op `apply` action is dropped per PLUGIN-PHILOSOPHY's Check-only carve-out, and its reconfiguration guidance is now printed by `check` (#3583, customization-consistency Phase 1b). + ## [0.32.6] ### Changed diff --git a/plugins/skill-quality/.claude-plugin/plugin.json b/plugins/skill-quality/.claude-plugin/plugin.json index 707b1b409..895fbca2d 100644 --- a/plugins/skill-quality/.claude-plugin/plugin.json +++ b/plugins/skill-quality/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json", "name": "skill-quality", - "version": "0.20.1", + "version": "0.20.2", "description": "Skill-authoring QA tooling: a static contract checker that runs twenty-five deterministic checks over a Claude Code skill (frontmatter, explicit invocation mode, description/verb-contract polarity, per-skill listing-entry cap, trigger-keyword preservation, line caps, broken internal refs, markdownlint, gotchas surface, evals presence, precompute opportunity, completion-criteria signal, injection shell-declaration, fresh-eyes declaration conformance), a shared skill-listing budget reporter across a set of skills, and a bundled evals.json schema plus a deterministic eval-quality lint (duplicate case identities, missing fixtures, empty or vague grading criteria, set-coverage warnings). Runs against any repo's skills directory via the convention-resolution ladder — no baked layout.", "author": { "name": "Melodic Software", diff --git a/plugins/skill-quality/CHANGELOG.md b/plugins/skill-quality/CHANGELOG.md index 1a4c6be88..f2aa9f85f 100644 --- a/plugins/skill-quality/CHANGELOG.md +++ b/plugins/skill-quality/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to the `skill-quality` plugin are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning. +## [0.20.2] + +### Changed + +- `setup` is check-only: the no-op `apply` action is dropped per PLUGIN-PHILOSOPHY's Check-only carve-out, and its reconfiguration guidance is now printed by `check` (#3583, customization-consistency Phase 1b). + ## [0.20.1] ### Changed From 1e46a5e9177e8c07937fd1c6bcf279d7ef1dfed1 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Tue, 1 Sep 2026 20:18:25 -0400 Subject: [PATCH 3/3] chore: ignore the two resolver false-positive gitleaks fingerprints CI scans with --log-opts=--all, so the pre-annotation CLAUDE_TOKEN parser-variable commits fail every PR's hygiene lane regardless of branch content. The fingerprints are annotated false positives. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_014uBXt1tMEReShbpG5gsFUd --- .gitleaksignore | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .gitleaksignore diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 000000000..5dd49e9b5 --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,10 @@ +# Gitleaks false-positive fingerprints (commit:file:rule:line). +# +# CLAUDE_TOKEN in resolve-convention-home.sh is the parser sense of "token" +# (the pointer line lifted from a convention-home region), never a credential; +# the generic-api-key rule keys on the identifier and reads the next line +# (CLAUDE_SHIM=0) as the value. The current file carries a gitleaks:allow +# annotation; these entries cover the pre-annotation commits, which the CI +# scan reaches because it runs with --log-opts=--all over every fetched ref. +f7aec1549dec60407a24a7d8ea720696b7b099af:plugins/claude-config/lib/resolve-convention-home.sh:generic-api-key:248 +708739fb2ba1b0196e93f9c07d3293bddfeed2f0:plugins/plugin-quality/lib/resolve-convention-home.sh:generic-api-key:249