feat: add fable-5-playbook plugin - #59
Conversation
Ships Claude Fable 5's operating doctrine as an on-demand knowledge skill: core standing instructions plus twelve trigger-routed chapters and an Opus-adaptation chapter for non-Fable models. The source skill was already repo-agnostic; the only content deltas are a description compressed to two sentences and one typo fix (misframed). Co-Authored-By: Claude <noreply@anthropic.com>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_1f826892-9eb2-471b-8680-bb8696fb89ce) |
|
Claude finished @kyle-sexton's task in 4m 0s —— View job PR Review —
|
| Surface | Verdict |
|---|---|
| Code execution (hooks/scripts) | ✅ None |
| Remote MCP servers | ✅ None |
userConfig / credential handling |
✅ None |
| Cache isolation | ${CLAUDE_PLUGIN_ROOT} (Finding 1) |
| Data egress / telemetry | ✅ None |
| Provenance / third-party trust | ✅ Author matches; MIT; no SaaS delegation |
Finding 1 is the only open item before this can ship.
…playbook # Conflicts: # .claude-plugin/marketplace.json # README.md
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_935ed33c-4be3-4483-83ac-7e7ddf72d5c7) |
|
Claude finished @kyle-sexton's task in 1m 40s —— View job PR Review —
|
| Surface | Verdict |
|---|---|
| Code execution (hooks/scripts) | ✅ None |
| Remote MCP servers | ✅ None |
userConfig / credential handling |
✅ None |
| Cache isolation | ${CLAUDE_PLUGIN_ROOT} (Finding 1) |
| Data egress / telemetry | ✅ None |
| Third-party trust / PII | ✅ None |
One open item: qualify the context file paths, then this is ready to ship.
There was a problem hiding this comment.
Risk: medium. Cursor Bugbot did not complete successfully (check skipped), so automated review is incomplete. Human review is needed before merge; no reviewers were assigned because no suitable non-author reviewers are available in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 03fa9893a7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ## Externalize conclusions when they stabilize | ||
|
|
||
| - **Write each expensive conclusion to a durable work note the moment it stabilizes** — not at session end, when the middle of the session is already degraded and the note becomes a reconstruction of what you think you knew. |
There was a problem hiding this comment.
Route durable notes outside consumer repos
When this chapter fires for a long session or a conclusion that took more than ~5 tool calls, the skill makes writing a “durable work note” mandatory, but the plugin has no configured/documented storage path and its README describes it as having no state. In a marketplace install, a model following this instruction in an arbitrary consumer project has to choose where to create or update that note, which can leave unexpected untracked or committed artifacts in the user’s repo even though they only loaded a knowledge skill. Please make the note write ask-first/configured, or route it to a documented plugin data location.
Useful? React with 👍 / 👎.
Closes melodic-software/medley#1296. Publishes the `firecrawl` plugin per `docs/MIGRATION-PLAYBOOK.md` (per-plugin gate + acceptance security review). ## What ships - `plugins/firecrawl/` — one skill (`/firecrawl:firecrawl`): wraps the `firecrawl-cli` binary for scrape/search/crawl/map/parse/interact/agent/monitor with the core write-to-disk-then-Read pattern (results land in tempfiles via `-o`; the agent reads only the needed slice — 32–35× token savings vs the MCP per the Scalekit benchmark cited in the skill). - `context/commands.md` (full flag tables, carried verbatim), `context/configuration.md` + `context/update-flow.md` (adapted repo-agnostic). - Maintainer-facing `scripts/update.sh` (`--check` read-only CLI-version + upstream-SHA drift report; `--apply` npm upgrade + `UPSTREAM.md` rewrite behind approval gates; never touches SKILL.md — content integration is a gated manual step) with a new self-contained `update.test.sh` (17 checks, network-free). - `UPSTREAM.md` sidecar (SHA-tracking sync state + rollback version). - Marketplace entry: `category: utilities`. Explicit `version: 0.1.0` in `plugin.json` only. ## Gate evidence - `claude plugin validate ./plugins/firecrawl --strict` — PASS; catalog `--strict` — PASS - `claude plugin details` token cost: **~253 tok always-on**, ~4.9k on-invoke - `update.test.sh` 17/17 PASS; shellcheck (repo rcfile) clean; shfmt clean; markdownlint 0 errors; typos clean; editorconfig-checker clean - Smoke test via `--plugin-dir` — PASS: skill body loaded, answered the write-to-disk flag (`-o`) from the body, namespace confirmed as `firecrawl:firecrawl`. The smoke run surfaced two real headless-permission defects that are fixed in this PR: a credential-shaped `printenv FIRECRAWL_API_KEY` preamble line was rejected by permission preflight (removed — `firecrawl --status` already reports auth), and the status/sync preamble lines needed narrow `allowed-tools` grants (`Bash(command -v firecrawl*)`, `Bash(firecrawl --status*)`, `Bash(grep -m1 *UPSTREAM.md*)`). Caveat: in a fully sandboxed scratch dir the preamble lines may still fall back to their error text; the skill body loads and functions regardless. ## Security review (playbook acceptance) - No hooks, no MCP servers, no agents, no `userConfig`. - Data egress (normal invocation): the user-installed `firecrawl-cli` calls `api.firecrawl.dev` (or a self-hosted `FIRECRAWL_API_URL`) — that is the plugin's documented purpose. The credential is the consumer-owned `FIRECRAWL_API_KEY` env var; never stored in or written by the plugin. Env-var auth is preferred over `firecrawl login`/`config` explicitly to avoid a second credential store. - Data egress (update path, maintainer-invoked only): `registry.npmjs.org` (version metadata) + `www.firecrawl.dev` (upstream skill source, hashed in a tmpdir). `npm install -g` and any SKILL.md rewrite sit behind two explicit approval gates; `--check` is read-only. - The skill hard-prohibits `firecrawl init` (would install a parallel MCP + skill copy) and documents the login/config divergence risk. - Cache isolation: script resolves paths relative to itself; preamble reads its own `UPSTREAM.md` via the skill-dir substitution; no `../` reach-outs. - No PII / secrets. Merge note: open PRs #53, #56, #57, #59 also touch `marketplace.json` + root `README.md` — merge serially; later ones need a conflict-merge of the two shared files. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > New plugin steers agents toward external Firecrawl API egress and credit use via a user-installed CLI and `FIRECRAWL_API_KEY`; maintainer `--apply` runs `npm install -g`, but there are no hooks/MCP and updates are gated. > > **Overview** > **Adds a new `firecrawl` plugin** to the marketplace and root catalog, shipping `/firecrawl:firecrawl` as the maintained `firecrawl-cli` integration (scrape, search, crawl, map, parse, interact, agent, monitor) instead of the Firecrawl MCP. > > The skill centers on **write-to-disk then `Read`** (`-o` tempfiles) with escalation tables for when to use Firecrawl vs WebFetch, narrow **`allowed-tools`** for the status/sync preamble (`firecrawl --status`, `UPSTREAM.md` grep), and prohibitions against `firecrawl init` / login-style config drift. Supporting **`context/`** docs cover flags, env defaults, and the maintainer update pipeline; **`UPSTREAM.md`** records upstream SHA and CLI rollback versions. > > **Maintainer tooling:** `scripts/update.sh` (`--check` read-only drift vs npm + upstream skill; `--apply` global `npm install` + `UPSTREAM.md` rewrite only, not `SKILL.md`) and network-free **`update.test.sh`** regression checks. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 3184b4e. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude <noreply@anthropic.com>


Closes melodic-software/medley#1293.
Publishes the
fable-5-playbookplugin perdocs/MIGRATION-PLAYBOOK.md(per-plugin gate + acceptance security review).What ships
plugins/fable-5-playbook/— one knowledge skill (/fable-5-playbook:fable-5-playbook): Claude Fable 5's operating doctrine, authored by Fable 5 as introspected standing instructions. Core doctrine arms the session on invocation; twelve trigger-routed chapters undercontext/(calibration, reasoning-moves, problem-framing, planning, execution, debugging, orchestration, verification, communication, recovery, context-economy, trust-and-authority) pluscontext/opus-adaptation.mdfor non-Fable models.category: learning, tagsknowledge+ component tags. Explicitversion: 0.1.0inplugin.jsononly.mis-framed→misframed).Gate evidence
claude plugin validate ./plugins/fable-5-playbook --strict— PASS;claude plugin validate . --strict(catalog) — PASSclaude plugin detailstoken cost: ~207 tok always-on, ~4.7k on-invoke (single skill)--plugin-dirsmoke test in a clean non-source repo — PASS: skill invoked, answered the four meta-rules (Precedence, One home per doctrine, Model adaptation, Silent application), namespace confirmed asfable-5-playbook:fable-5-playbookSecurity review (playbook acceptance)
userConfig, no scripts, no state, zero network access.context/*.mdself-citations); no../reach-outs.Merge note: open PRs #53, #56, #57 also touch
marketplace.json+ rootREADME.md— merge serially; later ones rebase/merge the two shared files (this branch is based on post-context7 main, so it conflicts only with those unmerged siblings).Note
Low Risk
Markdown-only plugin packaging and catalog updates; no executable code, credentials, or runtime side effects beyond skill text loaded into Claude Code.
Overview
Adds the
fable-5-playbookplugin to the marketplace and root catalog — a pure knowledge skill (no hooks, MCP, scripts, oruserConfig) that arms sessions with Claude Fable 5’s operating doctrine.SKILL.mdloads core standing instructions on invoke (bare /full/ chapter name), defines four meta-rules, effort floors, a chapter routing table, and cites twelve on-demandcontext/*.mdchapters (calibration through trust-and-authority) plus mandatoryopus-adaptation.mdfor non-Fable models. PluginREADME.mdandplugin.json(0.1.0, learning category) document install and scope.Reviewed by Cursor Bugbot for commit 03fa989. Bugbot is set up for automated code reviews on this repo. Configure here.