fix(claude-ops): make install_new userConfig prose substitution-safe (#2522)

[kyle-sexton]

Fixes #2522

Summary

The install_new userConfig paragraph in plugins/claude-ops/skills/plugins/SKILL.md embedded ${user_config.install_new} inside explanatory prose about the unset state. Claude Code substitutes every occurrence, so when the key is set (e.g. to all) the paragraph falsely claims it still renders as the literal placeholder — right after the Configured value line already shows the real value.

This PR rewrites the explanation so only the Configured value line keeps the live ${user_config.install_new} token. Surrounding sentences describe the placeholder by shape (${user_config.…}) or by reference to that line, staying readable whether the key is set or unset.

Bumps claude-ops to 0.31.10 (0.31.9 reserved for in-flight hook-utils sync on #2450).

Test plan

• No automated tests cover this prose contract.
• Manual review: unset render — Configured value line shows the placeholder token; explanatory prose does not embed a second live ${user_config.install_new}.
• Manual review: set render (e.g. all) — Configured value line shows all; explanatory prose still correctly describes unset behavior.

Related

• claude-ops plugins skill: the install_new userConfig paragraph is self-referential and unreadable once the key is set #2522

[claude]

Claude finished @kyle-sexton's task in 30s —— View job

---

Security Review

• Gather context (diff against origin/main)
• Apply skip gate
• Post result

Skip gate: no security-relevant surface. This PR changes only:

• plugins/claude-ops/.claude-plugin/plugin.json — version bump 0.31.8 → 0.31.10
• plugins/claude-ops/CHANGELOG.md — changelog entry
• plugins/claude-ops/skills/plugins/SKILL.md — prose rewording so the install_new userConfig explanation no longer embeds a second live ${user_config.install_new} substitution site inside its own unset-state explanation, keeping only the Configured value line as the live substitution point

No code, permissions, workflow triggers, injection surfaces, or trust boundaries are touched — this is a documentation-clarity fix. No security issues found.

[github-actions]

Last security-reviewed head: 34eb89ad56bf0e9946aa3c86317487ccb3f140a7. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @cursor[bot]'s task in 53s —— View job

---

Security Review

• Gather context (gh pr diff against origin/main)
• Apply skip gate
• Post result

Skip gate: no security-relevant surface. This PR changes only:

• plugins/claude-ops/.claude-plugin/plugin.json — version bump 0.31.9 → 0.31.10
• plugins/claude-ops/CHANGELOG.md — changelog entry documenting the fix
• plugins/claude-ops/skills/plugins/SKILL.md — prose rewording so the install_new userConfig explanation describes the substitution placeholder by shape/reference instead of embedding a second live ${user_config.install_new} token, keeping only the Configured value line as the substitution site

No code, permissions, workflow triggers, injection surfaces, or trust boundaries are touched — this is a documentation-clarity fix. No security issues found.

[claude]

Claude finished @kyle-sexton's task in 49s —— View job

---

Security Review

• Gather context (gh pr diff against origin/main)
• Apply skip gate
• Post result

Skip gate: no security-relevant surface. This PR changes only:

• plugins/claude-ops/.claude-plugin/plugin.json — version bump 0.31.9 → 0.31.10
• plugins/claude-ops/CHANGELOG.md — changelog entry
• plugins/claude-ops/skills/plugins/SKILL.md — prose rewording so the install_new userConfig explanation no longer embeds a second live ${user_config.install_new} substitution site inside its own unset-state explanation, keeping only the Configured value line as the live substitution point

No code, permissions, workflow triggers, injection surfaces, or trust boundaries are touched — this is a documentation-clarity fix. No security issues found.

[claude]

Claude finished @kyle-sexton's task in 1m 14s —— View job

---

Code Review (/review:code-review)

• Gather context (gh pr diff, read the full install_new section in context)
• Apply skip gate
• Review diff against code-review criteria
• Post result

Scope: 3 files — plugins/claude-ops/.claude-plugin/plugin.json (version bump), plugins/claude-ops/CHANGELOG.md (entry), plugins/claude-ops/skills/plugins/SKILL.md (prose rewrite). Pure documentation/prose change, no code or logic touched.

Verification performed:

• Read the full ## userConfig: install_new section (plugins/claude-ops/skills/plugins/SKILL.md, lines 128–153) in the merged, post-diff state. Confirmed only the Configured value line (L140) still embeds a live ${user_config.install_new} substitution; the surrounding explanatory sentences (L144–153) now refer to the placeholder by shape (${user_config.…}) or by pointing back at "the Configured value line" rather than re-embedding the live token — this matches the PR's stated fix for claude-ops plugins skill: the install_new userConfig paragraph is self-referential and unreadable once the key is set #2522 and reads correctly for both the unset and set (e.g. all) render paths.
• Checked version sequencing: plugin.json base was 0.31.9 (already claimed by the merged hook-utils fix, commit 5e83b3c, matching the existing ## [0.31.9] CHANGELOG entry for fix(hook-utils): scope read_file_path to git worktrees when project dir unset #2450/formatter hooks: 9 siblings share the out-of-tree noise gap #972 fixed for markdown-format only #1091), so bumping to 0.31.10 here is correct and doesn't collide with that in-flight work.
• CHANGELOG entry accurately describes the change and cross-references claude-ops plugins skill: the install_new userConfig paragraph is self-referential and unreadable once the key is set #2522.

No correctness, maintainability, or documentation-accuracy issues found. This is a narrowly-scoped, internally consistent prose fix — no findings to report.

Note: no linter/build applies to this Markdown-only change, so nothing further was run beyond reading the rendered result.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.