Skip to content

feat(#7008): accept .claude-plugin/plugin.json in lock URL stripping - #7030

Open
fullsend-ai-coder[bot] wants to merge 1 commit into
mainfrom
agent/7008-claude-plugin-locktreedirname
Open

feat(#7008): accept .claude-plugin/plugin.json in lock URL stripping#7030
fullsend-ai-coder[bot] wants to merge 1 commit into
mainfrom
agent/7008-claude-plugin-locktreedirname

Conversation

@fullsend-ai-coder

Copy link
Copy Markdown
Contributor

Summary

Update lockTreeDirName in internal/cli/lock.go to correctly handle the .claude-plugin/plugin.json marker path when deriving plugin directory names from raw content URLs. Previously, a URL ending in .claude-plugin/plugin.json would incorrectly return .claude-plugin as the directory name instead of the actual plugin root.

Related Issue

Closes #7008

Changes

  • Add two-level marker stripping in lockTreeDirName: when plugin.json is found inside a .claude-plugin/ directory, strip both path segments to get the plugin root
  • Update function docstring to document the new marker path
  • Add two test cases: successful stripping of .claude-plugin/plugin.json and rejection when it appears at the repo root

The other two touch points mentioned in the issue are already handled:

  • compose.go fetch gate: pluginformat.DetectTree already checks both plugin.json and .claude-plugin/plugin.json
  • bootstrap_scan.go injection scan: scanPluginTree walks the entire directory tree, so all files (including .claude-plugin/plugin.json) are already scanned

Testing

  • gofmt and go vet pass
  • TestLockTreeDirName passes (9/9 cases including 2 new)
  • lockTreeDirName has 100% function coverage
  • Broader lock-related tests pass (TestResolveFromLock_*, TestLockCommand_*)

Closes #7008

Post-script verification

  • Branch is not main/master (agent/7008-claude-plugin-locktreedirname)
  • Secret scan passed (gitleaks — 403540d77c8c32f89ec7e813bf68c7ff016f582e..HEAD)
  • PR body secret scan passed (gitleaks — no-git)

lockTreeDirName strips known marker files (SKILL.md, plugin.json)
from raw content URLs to derive the plugin directory name. When
the URL path ends in .claude-plugin/plugin.json (the Claude Code
plugin spec location), stripping only plugin.json left
".claude-plugin" as the directory name instead of the actual
plugin root. Add a check for the .claude-plugin intermediate
directory and strip two path segments so the caller gets the
correct plugin root name.

The other two touch points the issue identified (compose.go
fetch gate and bootstrap_scan.go injection scan) are already
handled: pluginformat.DetectTree checks both marker locations,
and scanPluginTree walks the entire directory tree.

Note: pre-commit hooks could not run (sandbox network
restriction blocked remote hook repos). gofmt and go vet
passed via direct execution.

Closes #7008
@fullsend-ai-coder
fullsend-ai-coder Bot requested a review from a team as a code owner September 4, 2026 21:44
@fullsend-ai-coder fullsend-ai-coder Bot added the ready-for-review Triggers review agent dispatch label Sep 4, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 4, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 9:46 PM UTC · Completed 10:02 PM UTC

Commit: c67ca21 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.41

@codecov

codecov Bot commented Sep 4, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@fullsend-ai-review fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Sep 4, 2026
@fullsend-ai-review

Copy link
Copy Markdown

Risk Assessment: moderate (2/5)

Details

Small, focused feature PR (2 files, 29 lines) by bot author with no protected paths or security-sensitive files; Tier 2 git history shows high multi-author contention and fix/revert frequency on these actively worked files, elevating the score above the Tier 1 baseline.

@fullsend-ai-review

Copy link
Copy Markdown

Review

Findings

Low

  • [Code organization] internal/cli/lock.go:1161 — The added conditional block introduces a second dir == "." check after modifying dir via path.Dir(dir). The second check guards against a distinct edge case (.claude-plugin/plugin.json at repo root) and is functionally necessary, but the nested defensive pattern slightly reduces readability.

@fullsend-ai-review fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-for-merge All reviewers approved — ready to merge ready-for-review Triggers review agent dispatch risk/moderate PR risk: moderate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Accept .claude-plugin/plugin.json as plugin manifest location in fetch gate

1 participant