feat(claude-ops): add plugins skill for plugin-fleet sync/audit/converge

[kyle-sexton]

No linked issue.

Summary

• Adds /claude-ops:plugins — an action-routed skill (sync default / audit read-only / converge explicit scope consolidation) that brings a machine's Claude Code plugin fleet current: marketplace refresh, updates to plugins that actually load (including in-repo project/local-scope installs), new-catalog-plugin install per an install_new policy, and scope-divergence detection/reporting — never silently fixing drift.
• Core is fleet-state.sh, a read-only, TDD-built state-inspection script (14 tests / 29 assertions) that reconciles installed_plugins.json / known_marketplaces.json against a project's cwd, handling Windows-vs-Git-Bash path normalization and separating benign same-version multi-scope installs from actionable version divergence.
• claude-ops bumped 0.8.0 → 0.9.0; new install_new userConfig option.

Verification

• /verification:confirm ran end-to-end: Stage 1 (bash + markdown ecosystems, full validate-plugins.sh, check-skill.sh, script test suite) all green; Stage 2 outcome verdict from a fresh-context (non-authoring) verifier agent: CONFIRMED, all 6 plan-phase acceptance criteria hold.
• The verifier's one real finding (docs overclaimed enable-state-mismatch detection when fleet-state.sh only exposes the merged effective value, not each scope's raw map) is fixed in this PR — see context/converge.md / SKILL.md / evals.json.
• Known, disclosed gap (documented in docs/topics/plugin-fleet-sync-skill/PLAN.md's Phase 6 evidence): audit is live-verified end-to-end against this repo and a second real repo. sync's in-repo update step (Step 2, the plan's own "primary value path") and converge were never exercised against real divergence this session — both would require mutating a real repo outside this one, which needs an explicit decision at that time, not a unilateral one here.
• Locally mirrored every CI hygiene/plugin-gate lane: shellcheck, shfmt, markdownlint, typos, gitleaks, editorconfig, exec-bit, hook-utils-sync, cross-plugin-source-drift, full plugin contract-test suite, manifest/catalog validation — all pass.

Plan

Full phase-by-phase plan, evidence, and acceptance criteria: docs/topics/plugin-fleet-sync-skill/PLAN.md.

Related

None — self-contained plan/design/implementation cycle for a new skill, not tied to an existing issue, ADR, or decision-log entry.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 96981c38bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 114e31845b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f403c5207a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 4m 27s —— View job

---

Code Review — feat(claude-ops): plugins skill

• Gather context and understand the request
• Read changed files (diff + key implementation files)
• Review fleet-state.sh (correctness, error handling, edge cases)
• Review fleet-state.test.sh (test coverage, jq-path issues)
• Review skill context files (sync.md, converge.md, SKILL.md)
• Review plugin.json manifest and config changes
• Assess CLAUDE.md design-rule compliance
• Post findings

---

Overall the design is solid — fleet-state.sh is well-structured, the read-only/CLI-only discipline is maintained throughout, the Windows path normalization handling is a genuine gotcha that's explicitly addressed, and the explicit-confirm gate in converge is exactly right. The test suite is above average for this codebase.

That said, I found two confirmed bugs (one severe, one latent on certain CI configurations) and three correctness/documentation gaps that will cause silent misbehavior in production use. Details below, most-severe first.

---

🔴 Bug — require_json inside emit_marketplace silently corrupts the entire --all output

fleet-state.sh:212

When --all is running, each marketplace is collected via:

block=$(emit_marketplace "$n" || true)
result=$(jq -c --arg n "$n" --argjson b "$block" '. + {($n): $b}' <<<"$result")

The || true handles emit_marketplace returning non-zero via return 1 — and every early-return path in the function correctly emits a JSON error object first. But require_json at line 212 uses exit 2, not return 1. exit inside $(...) kills only the subshell, so || true catches the non-zero code — but $block is empty (the error went to stderr, nothing landed on stdout). Then --argjson b "" is invalid JSON, jq fails, $result is set to empty. On the next iteration <<<$result passes empty input to jq, which fails again. The cascade means one marketplace with a malformed marketplace.json silently wipes the entire --all output.

The existing --all test doesn't exercise this path — it tests a missing catalog fixture (the ! -f branch, which correctly returns 1 with a JSON error object), not a malformed catalog file that passes the file-exists check but fails jq empty.

The fix: replace the require_json "$catalog_json" call inside emit_marketplace with the same inline error-emit-and-return 1 pattern the other early paths use. The fail-loud guarantee (require_json's purpose) still holds for the pre-function top-level calls outside emit_marketplace; it's only inside the per-marketplace function that exit needs to become an error object + return 1.

Fix this →

---

🔴 Bug — jq PATH stripping removes bash on systems where both live in /usr/bin

fleet-state.test.sh:360-364

The f403c52 commit correctly fixed the "strip only the first jq directory" defect (where a second jq copy remained on GitHub Actions). The current logic:

[[ -n "$dir" && -x "$dir/jq" ]] && continue

…drops any PATH entry that contains a jq executable. On Debian/Ubuntu (apt install jq), jq lives in /usr/bin — which is also where bash lives. Dropping /usr/bin means bash "$SCRIPT" inside run_state fails with env: 'bash': No such file or directory, and the case never reaches the jq required message it's supposed to verify.

The fix needs to keep bash reachable while hiding jq. The cleanest approach for a test fixture: create a temp bin/ dir with a stub jq that exits non-zero, prepend it to PATH, and keep the real PATH intact:

fake_bin="$TEST_TMPDIR/no-jq-bin"
mkdir -p "$fake_bin"
printf '#!/usr/bin/env bash\nexit 127\n' > "$fake_bin/jq"
chmod +x "$fake_bin/jq"
out=$(run_state "$case_dir" "PATH=$fake_bin:$PATH")

This shadows jq without touching directories bash depends on. Fix this →

---

🟡 Correctness — missing_from_enabled includes installs from unrelated projects

fleet-state.sh:254-258

installed_ids (line 242) is built from ALL install records in installed_plugins.json, spanning every projectPath. But known_at_mp (line 254) only covers ids mentioned in user settings + the current project's settings. Any plugin installed at project/local scope in a different repo — but absent from user settings and the current project — falls into installed_ids - known_at_mp and appears in missing_from_enabled. This would prompt sync to run claude plugin enable from the wrong working tree.

Fix: compute missing_from_enabled only from install records where scope == "user" or currentProject == true, not from the full installed_ids. Fix this →

---

🟡 Algorithm gap — single-scope project installs never get updated by sync

sync.md:41-42

Step 2 of sync only updates currentProject: true entries that also appear in divergences[] with versionsMatch: false. A divergences[] entry requires length > 1 (multiple scope records for the same id). A plugin installed only at project scope in the current repo — no user-scope baseline, no other project scopes — has exactly one install record, so no divergence entry is produced. Step 3 only sweeps scope == "user". Result: a project-only install that's behind the marketplace version is never touched by either step, silently left stale.

The fix for the doc: Step 2's gate should be "any currentProject: true entry that is behind the marketplace's catalog version" — not "has a divergence entry." The comparison baseline is the catalog, not another scope. Fix this →

---

🟡 Doc inconsistency — sync Step 2 gate uses env var; fleet-state.sh uses git fallback

sync.md:32

Step 2 says "Only when CLAUDE_PROJECT_DIR is set." But fleet-state.sh explicitly handles the case where CLAUDE_PROJECT_DIR is absent (lines 119-123), falling back to git rev-parse --show-toplevel, and this is verified by the test at line 253-285. In a headless -p session without the env var, fleet-state.sh correctly sets currentProject: true — but the skill, following sync.md's gate, would skip Step 2 entirely.

The correct gate is: does fleet-state.sh's output contain any entry with currentProject: true? Not whether the env var is set. Fix this →

---

🟡 Design gap — converge cross-project rows lack cwd context

converge.md:37

The proposed claude plugin uninstall <id> -s project / claude plugin update <id> -s <scope> commands are scoped to a project directory. installed_plugins.json can contain divergence records from multiple repos. When a divergence record belongs to a different projectPath, running these commands from the current working directory operates on the current repo's install — not the row's projectPath. The result is either a no-op (plugin isn't installed at project scope here) or the wrong repo's pin is removed.

The doc should either (a) restrict converge to currentProject: true rows and note that cross-machine/cross-project rows require running the command from that project's directory, or (b) show the commands prefixed with cd <row.scopes[].projectPath>. The PR description's disclosed gap ("converge was never exercised against real divergence this session") means this is untested behavior. Fix this →

---

⚪ Unverifiable claim — /reload-plugins --force

scope-semantics.md:56-59 / sync.md:98 / SKILL.md:113

The skill asserts (in three places) that /reload-plugins has no --force flag, citing a verification against code.claude.com/docs/en/plugins-reference. The Codex automated review disputes this, citing the discover-plugins page as mentioning --force for plugins with MCP servers. Per CLAUDE.md's fresh-docs mandate, whichever page was fetched during development should be re-fetched before this lands to confirm the claim is still accurate — if --force exists, advising users not to pass it will give them incorrect reload guidance for MCP-backed plugins.

---

Minor notes

• fleet-state.sh:100 — the jq -r 'has("plugins") and (...)' check validates the top-level shape but doesn't assert that .plugins values are arrays. If CC ever changes the per-id value from [{...}] to {...}, the script would silently misprocess it. Given the explicit fail-loud philosophy, this seems worth a more complete shape check, though it's a minor concern.
• plugin.json — install_new userConfig addition is clean. The "enum in prose" workaround for the missing enum manifest type is well-documented and consistent with scope-semantics.md.
• CLAUDE.md compliance — All design rules observed: no hardcoded paths, ${CLAUDE_PLUGIN_ROOT}/${CLAUDE_PLUGIN_DATA} used correctly, no PII, version bumped (0.8.0 → 0.9.0). The repo-agnostic rule is satisfied by the dynamic marketplace resolution via fleet-state.sh.

---

Summary: Two confirmed bugs need fixes before merge (the --all corruption via require_json/exit 2 and the jq-test bash-path stripping). The three correctness/doc gaps are real but lower-urgency — the single-scope-project-install gap and the cross-project converge path both only manifest against divergence scenarios the PR author correctly flags as untested. The CLAUDE_PROJECT_DIR gate doc inconsistency is the most likely to confuse an LLM agent following the skill docs.

[claude]

Claude finished @kyle-sexton's task in 3m 41s —— View job

---

Re-review after 88bd1ec — feat(claude-ops): plugins skill

• Gather context — read latest commits and changed files
• Check if 🔴 require_json/exit 2 bug in emit_marketplace was fixed
• Check if 🔴 jq-PATH/bash-stripping bug in fleet-state.test.sh was fixed (88bd1ec)
• Re-assess 🟡 correctness/doc gaps
• Post updated findings

---

What the latest commits fixed

88bd1ec — jq-missing test (🔴 Bug 2) ✅ FIXED

The path-filtering approach is replaced with a clean isolated $safe_bin_dir that holds only copies of bash, dirname, and any colocated DLLs — jq is deliberately absent. hook-utils.sh sources safely under this minimal PATH (all top-level statements are function definitions + a return-based double-source guard; command -v jq inside it returns 0 on miss rather than erroring). The fleet-state.sh jq check fires correctly, the test verifies exit 2 and the "jq required" message. This is the right fix.

114e318, f403c52, 96981c3, 56ca78b, ecdd76c — CI hygiene, executable bits, enable-state-mismatch overclaiming correction. No substantive logic changes relevant to the prior review findings.

---

What is still open

🔴 Bug — require_json inside emit_marketplace still uses exit 2 (merge blocker)

fleet-state.sh:212 — unchanged. The original finding still holds verbatim:

• require_json at lines 87–96 uses exit 2 on a failed jq empty check.
• Inside emit_marketplace, this fires inside the $(emit_marketplace "$n" || true) subshell.
• The subshell exits 2; || true catches the non-zero code; $block is empty string.
• jq -c --argjson b "$block" gets an empty string as JSON input → jq fails → $result goes empty.
• Every subsequent iteration fails the same way; the entire --all output is silently wiped by one malformed marketplace.json.

The --all test case at line 291–306 still only tests a missing catalog fixture (the [[ ! -f "$fixture" ]] branch, which correctly returns 1 with a JSON error object). It does not exercise a present-but-malformed catalog file hitting require_json. The bug path has no test coverage.

The fix: inside emit_marketplace, replace the require_json call with the same inline error-emit + return 1 pattern the other early-return paths use, and add a test case with a present-but-malformed catalog in --all mode. Fix this →

---

🟡 missing_from_enabled still spans all projects — fleet-state.sh:241-258

installed_ids (line 242) is still built from .[].id across all install records, including project-scope installs from other repos. known_at_mp (line 254) only covers ids mentioned in user settings + the current project's settings, so cross-project project-scope installs land in missing_from_enabled. Unchanged from the prior review.

🟡 sync.md Step 2 gate still uses CLAUDE_PROJECT_DIR instead of currentProject: true — sync.md:32

fleet-state.sh falls back to git rev-parse when CLAUDE_PROJECT_DIR is absent, and the test at line 253–285 verifies this. The skill doc's gate should key on currentProject: true in the output, not on whether the env var is set. Unchanged.

🟡 sync.md Step 2 divergence gate misses single-scope project installs — sync.md:40

A plugin installed only at project scope in the current repo has exactly one install record → no divergences[] entry → Step 2's gate skips it → a stale project-only install is never updated. Unchanged.

🟡 converge.md Step 2 missing cwd context — converge.md:37

claude plugin uninstall/update -s project is directory-scoped. When a divergence row's scopes[].projectPath doesn't match cwd, the command targets the wrong repo or silently no-ops. The doc doesn't surface this. Unchanged.

⚪ /reload-plugins --force claim still needs fresh-doc verification — scope-semantics.md:55-60 / sync.md:99

The claim "no --force flag exists" is asserted in three places. CLAUDE.md's fresh-docs mandate requires this to be re-verified by fetching the current plugins-reference page before merge. If --force exists for MCP-backed plugin reloads (as the Codex review suggested), advising users to omit it gives incorrect guidance.

---

Summary

One commit since the prior review: 88bd1ec correctly fixes the jq-missing test case with a safe copy-based isolated PATH — that 🔴 is resolved. The other 🔴 (require_json/exit 2 inside emit_marketplace) is still present and still the blocking issue. The three 🟡 doc/logic gaps and the ⚪ unverified claim are unchanged.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 88bd1ecda7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 706633bba5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0d6f1f73f5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Re-review after 0d6f1f7 — feat(claude-ops): plugins skill

• Gather context — read latest commits and open issues
• Review fleet-state.sh for case-sensitive path matching issue
• Review sync.md Step 5 scope restriction gap
• Check all previously-open findings against current HEAD
• Verify CLAUDE.md fresh-docs mandate compliance
• Post findings

---

What the latest commits fixed

0d6f1f7 — converge stale-user-pin risk ✅ FIXED

converge.md Step 2 now correctly compares scopes[].version to find the actual highest version before choosing a strategy. The old "does a user entry exist → uninstall project" heuristic that could regress a project: 0.9.0 / user: 0.8.0 divergence to the older user pin is replaced with proper semver-comparison-gated logic. The (cd "<scopes[].projectPath>" && ...) wrapping for out-of-cwd project commands is explicit throughout. Both findings from the prior review that drove this commit are resolved.

348dd52 — defaultEnabled: false auto-enable prevention ✅ FIXED

fleet-state.sh now reads defaultEnabled per catalog entry and excludes those ids from missing_from_enabled. Confirmed: the fix reads from the same $catalog_json already parsed for the catalog list, so no additional file access is needed. Test coverage added and confirmed red/green.

---

Two new open findings (from Codex review on 0d6f1f7)

🟡 ascii_downcase in the currentProject jq filter is unconditional — bypasses hook::normalize_path's OS gate

fleet-state.sh:252-254

hook::normalize_path (in hook-utils.sh:35-48) is explicitly OS-gated: it only folds case on OSTYPE = msys*/cygwin*/win32, and the comment explains exactly why — on a case-sensitive POSIX filesystem /c/Repo and /c/repo are distinct directories, and folding them collapses a legitimate boundary. On POSIX hosts, hook::normalize_path passes through unchanged.

But the jq filter that computes currentProject applies ascii_downcase to both sides unconditionally:

((.projectPath | gsub("\\\\";"/") | ascii_downcase) == ($cur | ascii_downcase))

$cur (built from hook::normalize_path "$(hook::physical_path "$PROJECT_ROOT")") is the OS-correctly-normalized path — no lowercasing on Linux. But this jq filter re-lowercases it anyway. On a case-sensitive Linux filesystem with two sibling directories that differ only by case (e.g. /work/repo vs /work/Repo), an install record whose projectPath is /work/Repo would be marked currentProject: true when the session is standing in /work/repo, which is a different directory. The consequence: verifiable_ids and missing_from_enabled include the wrong install record, and Step 2 / Step 5 of sync would target the current directory for a plugin belonging to a sibling.

resolve_default_marketplace (line 169-175) avoids this by trying an exact-match first before falling back to the case-folded form — only the currentProject filter uses the all-or-nothing downcase.

The fix: plumb OSTYPE through to jq (or detect Windows once in bash and pass a boolean flag), and apply ascii_downcase only when the flag is true. The existing hook::normalize_path logic already encodes the correct rule — this should mirror it rather than reinvent a looser version.

Fix this →%2C%20pass%20it%20as%20--argjson%20ci%20%22%24ci_compare%22%2C%20and%20replace%20the%20unconditional%20ascii_downcase%20comparison%20with%3A%20if%20%24ci%20then%20((.projectPath%20%7C%20gsub(%22%5C%5C%5C%5C%22%3B%22%2F%22)%20%7C%20ascii_downcase)%20%3D%3D%20(%24cur%20%7C%20ascii_downcase))%20else%20((.projectPath%20%7C%20gsub(%22%5C%5C%5C%5C%22%3B%22%2F%22))%20%3D%3D%20%24cur)%20end.%20Branch%3A%20feat%2Fclaude-ops-plugins-skill&repo=melodic-software/claude-code-plugins)

---

🟡 sync.md Step 5 iterates all scopes — must restrict to readable scopes

sync.md:107-111

fleet-state.sh correctly restricts missing_from_enabled to verifiable ids (line 283: scope == "user" OR currentProject == true) — so the list of ids is sound. But Step 5's instruction says: "for each remaining id, and for each scope where that id has an install record (from installed[]) but no raw entry in that scope's own enabledPlugins map."

installed[] contains ALL scope records, including currentProject: false records from other repos. Consider: plugin alpha@market1 has a user-scope install (correctly in missing_from_enabled) and a project-scope install in /other/repo (with currentProject: false). Step 5 would:

1. See the scope: "project", currentProject: false, projectPath: "/other/repo" entry in installed[]
2. Check whether it has a raw entry in "that scope's own enabledPlugins map" — project_map reflects only the current directory's .claude/settings.json, not /other/repo's, so the answer is false
3. Conclude it should run claude plugin enable alpha@market1 -s project — which modifies the current directory's settings, not /other/repo's

The fix is one sentence added to Step 5: restrict "for each scope" to only records where scope == "user" OR currentProject == true — the same restriction verifiable_ids already applies. Records with currentProject: false belong to other repos whose settings files were never read; treating their absence from the local project_map as a "gap to fill" is a false positive.

Fix this →

---

Status of all prior findings

Finding	Status
🔴 require_json/exit 2 corrupts --all output	✅ Fixed e5f1b37
🔴 jq-missing test strips bash from PATH	✅ Fixed 88bd1ec
🟡 missing_from_enabled spans all projects	✅ Fixed e5f1b37
🟡 sync.md Step 2 gates on CLAUDE_PROJECT_DIR env var	✅ Fixed 706633b
🟡 sync.md Step 2 divergence gate misses single-scope installs	✅ Fixed 706633b
🟡 converge.md missing cwd context for cross-project commands	✅ Fixed 706633b
⚪ /reload-plugins --force claim unverified	✅ Fixed 706633b
🟡 defaultEnabled: false plugins auto-enabled by Step 5	✅ Fixed 348dd52
🟡 converge could regress to stale user pin	✅ Fixed 0d6f1f7
🟡 ascii_downcase unconditional in currentProject filter	Open
🟡 sync.md Step 5 iterates all scopes (including other-repo)	Open

---

Summary

Two 🟡 findings remain. Neither is a merge blocker at the severity of the prior two 🔴s — the case-sensitivity issue only manifests on POSIX systems with case-differing sibling directories (genuinely unusual), and the Step 5 scope-restriction gap is a doc-level fix for the scan already correctly scoping the missing_from_enabled list. Both are real and worth fixing before this skill sees broad use, but the core script logic and the previously-breaking test paths are all solid.

View job run | Branch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1de4658fe0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d751174e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 5m 12s —— View job

---

Re-review after 6d75117 — feat(claude-ops): plugins skill

• Gather context — read latest commits and open findings
• Check fleet-state.sh:273 — missing_from_install all-scope gap (Codex finding from 1de4658)
• Check fleet-state.sh:102 — per-plugin shape drift (Codex finding on HEAD)
• Check fleet-state.sh:352 — missing marketplace arg before shift (Codex finding on HEAD)
• Verify 6d75117 case-fold test fix is correct
• Compile full findings table
• Post final review

---

What 6d75117 fixed

Case-fold test OS-awareness ✅ FIXED

The test at lines 316–333 now passes two explicit OSTYPE overrides rather than relying on the host's ambient value:

• OSTYPE="linux-gnu" → asserts currentProject: false (case-sensitive POSIX: differently-cased sibling must NOT match)
• OSTYPE="msys" → asserts currentProject: true (case-insensitive Windows: must still match, no regression)

This is the right fix and is deterministic across CI (ubuntu) and any dev host. The companion script logic in fleet-state.sh (lines 169–173) correctly gates case_insensitive_os on ${OSTYPE:-}, and both resolve_default_marketplace and the currentProject filter consume the $ci flag rather than applying ascii_downcase unconditionally.

---

Three open findings

🟡 missing_from_install uses all-scope installed_ids, not user-scope only — fleet-state.sh:272–282

installed_ids (line 273) is [.[].id] | unique from the full installed array, which contains records for ALL scopes — including a project-scope install in the current repo. So a plugin installed only at project scope (not at user scope) IS in installed_ids and therefore NOT in missing_from_install. Sync Step 4 (sync.md:77–85) uses missing_from_install to drive claude plugin install <id> -s user — but a project-only install is invisible to it, so the user-scope gap is never presented regardless of the install_new policy.

This has been open since the Codex review on 1de4658 and has had no response. Whether the fix belongs in the script (redefine missing_from_install as catalog - user_scope_installed - opted_out) or in sync.md (Step 4 should additionally consider ids installed only at non-user scope) is a design call — but the current behavior silently omits a real install gap from the output field sync consumes.

Fix this →

---

🟡 Per-plugin shape validation only checks top-level type — fleet-state.sh:100–102

The shape check at line 100 validates that .plugins is an object, but not that each plugin entry is an array. If an individual entry drifts to a non-array type, the jq filter at lines 252–270 runs .value[] on it and fails. Since the assignment is in a command substitution (installed=$(... | jq -cs '.')) and the script has set -uo pipefail but not set -e, the jq failure is swallowed: installed becomes empty and the script exits 0 with installed: [] and a spurious missing_from_install. The fail-loud guarantee the comment at line 82 promises doesn't hold below the top-level object check.

The fix is a deeper shape assertion at lines 100–103:

if [[ "$(jq -r 'has("plugins") and (.plugins | type == "object") and
     (.plugins | to_entries | all(.value | type == "array"))' "$INSTALLED_JSON")" != "true" ]]; then

Fix this →

---

🟡 --marketplace with no name silently infinite-loops — fleet-state.sh:347–353

When invoked as fleet-state.sh --marketplace (no name), $# = 1, $1 = "--marketplace", TARGET = "", and shift 2 fails (bash: "can't shift that many") — returning exit code 1 without modifying $@. Since the script has no set -e, execution continues, the while loop body exits, and the next iteration still sees $1 = "--marketplace". The loop repeats forever. The guard at line 375 (if [[ -z "$TARGET" ]]) is never reached.

The fix: check and exit early inside the --marketplace branch before any shift:

--marketplace)
  MODE="single"
  TARGET="${2:-}"
  if [[ -z "$TARGET" ]]; then
    echo "ERROR: --marketplace requires a name" >&2
    exit 2
  fi
  shift 2
  ;;

This is only triggered by malformed manual invocation (the skill always passes a name), but the infinite-loop failure mode is worse than a clean error exit. Fix this →

---

Full findings status

Finding	Status
🔴 require_json/exit 2 corrupts --all output	✅ Fixed e5f1b37
🔴 jq-missing test strips bash from PATH	✅ Fixed 88bd1ec
🟡 missing_from_enabled spans all projects	✅ Fixed e5f1b37
🟡 sync.md Step 2 gates on CLAUDE_PROJECT_DIR env var	✅ Fixed 706633b
🟡 sync.md Step 2 divergence gate misses single-scope installs	✅ Fixed 706633b
🟡 converge.md missing cwd context for cross-project commands	✅ Fixed 706633b
⚪ /reload-plugins --force claim unverified	✅ Fixed 706633b
🟡 defaultEnabled: false plugins auto-enabled by Step 5	✅ Fixed 348dd52
🟡 converge could regress to stale user pin	✅ Fixed 0d6f1f7
🟡 ascii_downcase unconditional in currentProject filter	✅ Fixed 6b42033
🟡 sync.md Step 5 iterates all scopes (including other-repo)	✅ Fixed 1de4658
🟡 Case-fold test fails on case-sensitive CI host	✅ Fixed 6d75117
🟡 missing_from_install uses all-scope ids, misses user-scope gap	Open (from 1de4658 Codex, unanswered)
🟡 Per-plugin shape drift not caught by shape check	Open (from HEAD Codex)
🟡 --marketplace with no name infinite-loops	Open (from HEAD Codex)

---

Summary

6d75117 correctly closes the case-fold test OS-awareness finding with a clean explicit-OSTYPE approach. All prior 🔴 and 🟡 findings from the full review cycle are resolved. The remaining three are genuine but none rises to the severity of the earlier blockers — the infinite-loop is only reachable on malformed manual invocation, the shape-drift check is a defensive-robustness gap, and the missing_from_install semantic question is a design clarification. The core script logic, test suite (17/17 cases), and skill documents are solid.
| Branch