fix(repo-hygiene): widen AskUserQuestion fallback for dontAsk denial

[kyle-sexton]

Summary

Mirror the #2016 disk-hygiene confirmation-gate prose fix in repo-hygiene: the inline-question fallback must trigger when AskUserQuestion is absent, denied, or otherwise unusable — not only when it is absent.

Fix

• Update plugins/repo-hygiene/skills/clean/SKILL.md confirmation gate question-surface rule to match the corrected dontAsk / deny / disallowed-tools wording.
• Bump plugin to 0.10.1 with CHANGELOG entry.

Verification

Prose-only change; no shell/python suites map to this file. Reviewed against the live permissions docs claim cited in #2088 and the merged disk-hygiene sibling wording.

Related

Fixes #2088 (completes the three-item sweep alongside #2252 and #2254).

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 39s —— View job

---

Security Review

• Gather context (fetch diff, read changed files)
• Analyze changes for security issues
• Post findings

Scope: plugins/repo-hygiene/.claude-plugin/plugin.json, plugins/repo-hygiene/CHANGELOG.md, plugins/repo-hygiene/skills/clean/SKILL.md (diff vs origin/main).

Summary: This PR is a prose-only correction to the clean skill's confirmation-gate wording, plus a version bump and changelog entry. No workflow files, scripts, or executable code are touched — nothing in scope for command/SQL/path/template injection, secrets handling, or GitHub Actions permissions/trigger patterns.

The actual behavioral change tightens a security-relevant guard rather than loosening one: it widens the condition for falling back to an inline (non-fabricatable) question from "AskUserQuestion is absent" to "absent, denied, or otherwise unusable" — closing a gap where a dontAsk session could silently leave the destructive-confirmation gate unsatisfied instead of asking. That's a net risk reduction, consistent with the description of mirroring the disk-hygiene (#2016) fix.

No security issues found in the changed files. No CRITICAL/IMPORTANT/SUGGESTION findings to report.

[claude]

Claude finished @kyle-sexton's task in 1m 11s —— View job

---

Code Review

• Gather context (diff, CLAUDE.md, REVIEW.md, sibling disk-hygiene fix(disk-hygiene): make the confirmation gate answerable and the alias probe reachable #2016 wording)
• Review changed files for correctness and alignment with guidelines
• Post findings

Scope: plugins/repo-hygiene/.claude-plugin/plugin.json, plugins/repo-hygiene/CHANGELOG.md, plugins/repo-hygiene/skills/clean/SKILL.md (prose-only, no runnable code).

Summary

This does exactly what it says: it widens the repo-hygiene clean confirmation-gate's question-surface fallback so it triggers on absent, denied, or otherwise unusable AskUserQuestion — not just absent.

Correctness verified:

• The new SKILL.md line 93 wording is byte-for-byte identical to the merged sibling fix in plugins/disk-hygiene/skills/clean/SKILL.md (line 79–85), confirming the "mirrors fix(disk-hygiene): make the confirmation gate answerable and the alias probe reachable #2016" claim rather than just taking it on faith.
• The dontAsk behavior described (tool stays visible in the pool but every call fails, vs. a bare-name deny/disallowed-tools entry which removes it from context entirely) matches the distinction already established and merged in the disk-hygiene sibling fix, and is internally consistent with the new "absent, denied, or otherwise unusable" fallback trigger.
• plugin.json version bump (0.10.0 → 0.10.1) is an appropriate patch-level bump for a doc/prose fix, and no other file in the repo (e.g. .claude-plugin/marketplace.json) references the plugin's version number, so no sync was missed.
• Only one occurrence of the stale "absent" wording existed in the plugin (grep for AskUserQuestion across plugins/repo-hygiene/**/*.md confirms it), so nothing was left un-migrated.

Minor, non-blocking observation: the new CHANGELOG.md entry (lines 10–18) is a paraphrase of the disk-hygiene entry rather than a verbatim mirror — e.g. it drops the (fetched 2026-08-08) citation date and the quoted "removes the tool from Claude's context entirely" doc excerpt, and closes with a cross-reference to disk-hygiene (#2016) instead of restating the reasoning. This is a reasonable editorial choice (avoids duplicating the full citation and instead points to the origin fix) and not something I'd block on — flagging only for awareness in case verbatim-mirroring was intended:

claude-code-plugins/plugins/repo-hygiene/CHANGELOG.md

Lines 10 to 18 in 9dddf89

	- **The confirmation gate fell back to an inline question only when `AskUserQuestion` was
	*absent*.** Permission mode `dontAsk` "auto-denies tools unless pre-approved … `AskUserQuestion` …
	denied even if you've allowed them"
	([permissions](https://code.claude.com/docs/en/permissions)), which leaves the tool visible in the
	pool while every call fails; only a bare-name deny rule removes it from context entirely. Keying
	the fallback on absence let a `dontAsk` session pick a tool it cannot use and leave the destructive
	confirmation gate unsatisfied rather than asking inline. The fallback now triggers on absent,
	denied, **or otherwise unusable** — including a denial discovered only by calling it — mirroring
	the sibling fix in `disk-hygiene` (#2016).

No correctness, architecture, error-handling, or test-coverage issues found — this is a scoped prose fix with no executable code, consistent with the "prose-only, no shell/python suites map to this file" verification note (author-claimed, not independently re-run by me since there is no test suite to run against this change).

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.