Audit and harden Claude Code plugin ports #10

Activity

1. AojdevStudio

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   enhancementNew feature or requestNew feature or request

   on May 19, 2026
2. linear commented on May 19, 2026

   

   linearbot

   on May 19, 2026 – with Linear

   More actions

   AOJ-615
3. AojdevStudio commented on May 19, 2026

   

   AojdevStudio

   on May 19, 2026

   OwnerAuthor

   More actions

   This was generated by AI during triage.

   Agent Brief

   Category: enhancement
   Summary: Sync every Claude Code plugin port to its source-of-truth, wire all shipped plugins into .claude-plugin/marketplace.json and docs/catalog.md, and remove junk artifacts. Ship 9 plugins beyond the 6 already in the marketplace, for 15 plugin ports total.

   Current behavior:
   claude-code/plugins/ contains 15 plugin ports. Only 6 are wired into .claude-plugin/marketplace.json (youtube-analyzer, awesome-readme, bambu-slicer, deep-dive, ask-codex, skill-stats). Only 2 are listed in docs/catalog.md (youtube-analyzer, awesome-readme). Several plugin ports have drifted from their source-of-truth skill content (most notably linear has 5/13 workflows; harness-audit is missing 4 reference files that live in skills/harness-audit/references/ in this same repo; repo-architect and saas-standards are missing all of their content). One junk artifact exists (claude-code/plugins/babysit-pr/skills/.DS_Store). saas-standards is missing .claude-plugin/plugin.json entirely.

   Desired behavior:
   Every plugin port under claude-code/plugins/ either ships (synced to source-of-truth + wired into marketplace + catalog + has a valid .claude-plugin/plugin.json + README + at least one usable SKILL.md) or is removed from claude-code/plugins/ to a quarantine location with a note. The marketplace and catalog stay consistent with what actually ships. gitleaks and npm run check pass.

   Key interfaces / contracts:

   • .claude-plugin/plugin.json schema — name, description; must parse as JSON; name must match the plugin directory name.
   • .claude-plugin/marketplace.json .plugins[] — must contain one entry per shipped plugin. Use the existing 6 entries as the schema template.
   • docs/catalog.md "Claude Code Plugin" rows — must list one row per shipped plugin matching existing row format.
   • SKILL.md frontmatter — name must match plugin name; description should match (or be the source for) the plugin manifest description so the trigger language stays consistent across plugin.json, marketplace metadata, README, and SKILL.md.
   • Plugin port directory layout — claude-code/plugins/<plugin>/skills/<plugin>/SKILL.md plus subdirs (workflows/, references/, tools/, scripts/, assets/, cli/) that match what SKILL.md references. Either every referenced subpath exists, or the reference is removed.

   Source-of-truth sync map (use this to populate each plugin port):

   Plugin port (kebab)	Source-of-truth	Notes
   adversarial-review	repo skills/adversarial-review/	Verify port mirrors.
   awesome-readme	already shipping	Verify only.
   ask-codex	already shipping	Verify only. Add catalog row.
   babysit-pr	self-contained in port	Delete .DS_Store.
   bambu-slicer	already shipping	Verify only. Add catalog row. Do NOT stage cli/node_modules/.
   deep-dive	already shipping	Verify only. Add catalog row.
   gitworkflow	repo skills/gitworkflow/	Sync from repo source.
   gpt-image-2	self-contained in port	Verify scripts ship and execute.
   harness-audit	repo skills/harness-audit/	Repo source contains the 4 "missing" reference files (symphony-readiness.md, smoke-ticket-eval.md, workflow-template.md, stack-go.md). Sync the full references/ directory.
   harness-worktrees	repo skills/harness-worktrees/	Sync from repo source.
   linear	global ~/.claude/skills/linear/	Port has 5 workflows; global has 13 (incl. NotionSync.md). Sync workflows/, tools/linear-graphql.sh, IssueTemplate.md, LinearContext.md. Add README.md.
   repo-architect	global ~/.claude/skills/RepoArchitect/ (PascalCase)	Includes Tools/detect-agent.ts, Tools/index-tree.ts, Workflows/*.md, all references, Hooks/. Keep plugin port directory as kebab-case repo-architect/skills/repo-architect/ but rename internal Pascal-cased file paths to match what the plugin's SKILL.md references. Add README.md.
   saas-standards	global ~/.claude/skills/SaaSStandards/ (PascalCase)	Add .claude-plugin/plugin.json. Sync workflows/ (4 files), reference files, SKILL.md. Add README.md.
   skill-stats	already shipping	Verify only. Add catalog row.
   youtube-analyzer	already shipping	Verify only.

   Environment note: ~/.claude/skills/ is local to the maintainer's Mac and not in the repo. If you are running remotely (Symphony / GitHub Action / CI), the 3 global-sourced plugins (linear, repo-architect, saas-standards) will be unsyncable. In that case: halt and ask the maintainer to pre-stage the global skill content into repo skills/<name>/ first, then resume.

   Acceptance criteria:

   • Every plugin under claude-code/plugins/ either ships or is moved out of that directory.
   • Every shipped plugin has a valid .claude-plugin/plugin.json (parses as JSON, name matches directory).
   • Every shipped plugin has a README.md.
   • Every shipped plugin's SKILL.md only references files that exist on disk inside the plugin port.
   • .claude-plugin/marketplace.json .plugins[] contains one entry per shipped plugin and zero entries for unshipped ones.
   • docs/catalog.md "Claude Code Plugin" rows include one row per shipped plugin.
   • plugin.json description, marketplace description, README intro purpose statement, and SKILL.md description are consistent (same trigger language) for each plugin.
   • claude-code/plugins/babysit-pr/skills/.DS_Store is removed.
   • claude-code/plugins/bambu-slicer/cli/node_modules/ is not staged (confirm via git status --short --untracked-files=all).
   • gitleaks detect --no-git --source claude-code/plugins --config .gitleaks.toml --redact --verbose reports zero findings.
   • npm run check passes.
   • npm run pack:dry passes.
   • git status --short --untracked-files=all only shows intentional files.

   Out of scope:

   • Authoring new skill content that doesn't exist in any source-of-truth. If a plugin's SKILL.md references a file that exists nowhere (not in port, not in repo skills/, not in ~/.claude/skills/), STRIP the reference from SKILL.md rather than writing the file.
   • Refactoring the top-level skills/ directory layout.
   • Changing the Pi side of the package — only Claude Code plugin ports are in scope.
   • Renaming plugin port directories from kebab-case to PascalCase or vice versa.
   • Adding new plugins beyond the 15 already in claude-code/plugins/.

   Suggested order of execution:

   1. Delete claude-code/plugins/babysit-pr/skills/.DS_Store.
   2. Sync the 6 plugins that have a repo skills/<name>/ source: adversarial-review, gitworkflow, harness-audit, harness-worktrees (plus verify the already-shipping ones haven't drifted).
   3. Sync the 3 plugins that have only a global ~/.claude/skills/<Name>/ source: linear, repo-architect, saas-standards. Halt and escalate if running in an environment where ~/.claude/ is not accessible.
   4. Add missing READMEs for linear, repo-architect, saas-standards.
   5. Add missing plugin.json for saas-standards.
   6. Update .claude-plugin/marketplace.json — add entries for adversarial-review, babysit-pr, gitworkflow, gpt-image-2, harness-audit, harness-worktrees, linear, repo-architect, saas-standards.
   7. Update docs/catalog.md — add Claude Code Plugin rows for the 9 newly-shipped plugins plus the 4 missing rows (ask-codex, bambu-slicer, deep-dive, skill-stats).
   8. Run gates: gitleaks, npm run check, npm run pack:dry, git status --short --untracked-files=all.
   9. Open one PR with all changes. Reference this issue in the PR body.
4. AojdevStudio

   added

   ready-for-agentFully specified, ready for an AFK agentFully specified, ready for an AFK agent

   and removed

   documentationImprovements or additions to documentationImprovements or additions to documentation

   on May 19, 2026
5. AojdevStudio

   closed this as completedin #33on Jul 18, 2026
6. AojdevStudio

   added a commit that references this issue on Jul 18, 2026

   fix(plugins): complete issue #10 port hardening (#33)

   ...

   3b9ed17
7. AojdevStudio commented on Jul 18, 2026

   

   AojdevStudio

   on Jul 18, 2026

   OwnerAuthor

   More actions

   Fleet merge provenance note

   PR #33 merged into main at 2026-07-18T22:19:00Z as commit 3b9ed17d27b7d5776b2c90622d2e504ef14332a4 under GitHub actor AojdevStudio.

   The au-control-pane orchestrator did not issue a merge command, and the claudex-impl worker transcript explicitly reports that it did not issue one. GitHub's timeline contains a direct MergedEvent and no AutoMergeEnabledEvent. No review-queue verdict had been posted before the merge.

   No revert is being attempted. The merged diff is now undergoing a heightened retrospective review. Any confirmed finding will be handled through a follow-up pull request.
8. AojdevStudio

   added a commit that references this issue on Jul 19, 2026

   fix(plugins): post-merge remediation for #33 (validator hardening, pa…

   ...

   232fd85