- Added agents field pointing to ./agents directory (10 agents)
- Added hooks field pointing to ./hooks/hooks.json
- These were supported but not declared, potentially causing
agents not to load when installed as a plugin
Addresses part of #88 (rules still need manual install per
upstream limitation - filed anthropics/claude-code#21163)
- fix(utils.js): prevent command injection in commandExists() by using
spawnSync instead of execSync with string interpolation, and validate
input to only allow alphanumeric chars, dash, underscore, dot (#42)
- fix(utils.js): add security documentation to runCommand() warning
against passing user-controlled input
- fix(setup-package-manager.js): replace <script> and <binary> with
[script-name] and [binary-name] to avoid XSS scanner false positives (#43)
- fix(doc-updater.md): replace invalid 'npx ts-morph' with correct
'npx tsx scripts/codemaps/generate.ts' since ts-morph is a library,
not a CLI tool (#51)
Fixes#42, #43, #51
Previously hooks were not loaded when the plugin was installed because
plugin.json didn't declare the hooks path. This caused errors like:
"Stop hook error: .../skills/continuous-learning/evaluate-session.sh: No such file"
The hooks are defined in hooks/hooks.json and use JS implementations in
scripts/hooks/ directory.
Stop hook fires after every response, SessionEnd fires only when
session actually terminates. This was causing session-end.sh and
evaluate-session.sh to run on every response instead of at session end.
Fixes issue reported by user about hooks triggering every response.
Claude Code automatically loads hooks/hooks.json from the plugin directory.
Explicitly specifying it in plugin.json causes a duplicate hooks error:
Duplicate hooks file detected: ./hooks/hooks.json resolves to already-loaded
file .../hooks/hooks.json. The standard hooks/hooks.json is loaded
automatically, so manifest.hooks should only reference additional hook files.
Fixes#29
Relative paths like ./hooks/... fail when the plugin is installed
because hooks run in the project directory, not the plugin directory.
Using ${CLAUDE_PLUGIN_ROOT} ensures scripts are found regardless of
where the plugin is installed.
Fixed paths:
- hooks/strategic-compact/suggest-compact.sh
- hooks/memory-persistence/pre-compact.sh
- hooks/memory-persistence/session-start.sh
- hooks/memory-persistence/session-end.sh
- skills/continuous-learning/evaluate-session.sh
Using './' lets Claude Code use the already-cloned marketplace repo
directly instead of fetching from GitHub again. This avoids potential
double-fetch issues and simplifies the installation.
Fixes 'Invalid schema: plugins.0.source: Invalid input' error when
installing via /plugin marketplace add. The source field needs to be
a GitHub source object, not a relative path, when the plugin is at
the repo root.
Affaan Mustafa