fix(markdown-format): correct skip-notice latch wording; add PATH diagnostic

[kyle-sexton]

Summary

• Rewords the missing-markdownlint-cli2 notice so it no longer implies a session-long skip latch: only the notice latches (skip-notices/); the binary probe re-runs on every Markdown edit.
• Appends a one-line PATH probed: diagnostic so PATH-layer misses (cloud harness / nvm prefix) are diagnosable without widening the probe into nvm layout guesses.
• Bumps markdown-format to 0.11.18 and updates CHANGELOG/README/tests.

Closes #2740

Test plan

• bash plugins/markdown-format/hooks/markdown-format.test.sh — PASS=148 FAIL=0
• Asserts notice contains there is no skip latch, PATH probed:, and does not contain skipped for this session

Related

Refs #2740 (closed by keyword above).

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 1m 28s —— View job

---

Security Review

• Gather context (PR diff, changed files)
• Run skip-gate checks
• Review changed files for security-relevant surface
• Report findings

No security issues found.

This PR is a wording/diagnostic-only change with no new attack surface:

• plugins/markdown-format/.claude-plugin/plugin.json — version bump only (0.11.17 → 0.11.18).
• plugins/markdown-format/CHANGELOG.md, README.md — documentation only.
• plugins/markdown-format/hooks/markdown-format.test.sh — test assertions only.
• plugins/markdown-format/hooks/markdown-format.sh (diff) — reworded the skip-notice string and appended a PATH probed: ${PATH:-<unset>} diagnostic line. I checked how this reaches output:
  • The message flows through hook::emit_skip_notice → hook::emit_channels (lib/hook-utils.sh), which JSON-escapes the entire string via hook::json_escape (lib/hook-utils.sh:62) before embedding it in hookSpecificOutput.additionalContext/systemMessage. Backslashes, quotes, newlines, and control bytes are all escaped/stripped, so the appended $PATH content cannot break out of the JSON structure or inject fields.
  • $PATH here is the hook process's own inherited environment, not attacker-influenced input from the PR/diff/repo content, so there's no injection vector from untrusted sources. It's a local diagnostic surfaced only to the invoking session (once per session via the existing skip-notices/ marker gate), not published anywhere externally.
  • No new file writes, commands, or network/process execution were introduced — the change is a string composition edit only.

No workflow files, permissions, or dependency pins were touched. Nothing to flag.

Branch: cursor/2740-markdown-latch-8f91

[github-actions]

Last security-reviewed head: 612d0198fb5250fe345708b2b95af9b4a8571faf. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @kyle-sexton's task in 2m 5s —— View job

---

Claude finished @kyle-sexton's task

Tasks

• Gather context (diff, CLAUDE.md, REVIEW.md, changed files)
• Run /review:code-review procedure
• Post findings

Review summary

This is the CODE-REVIEW lane. This repo carries .github/workflows/claude-security-review.yml, so security findings are out of scope here (none observed anyway).

Scope reviewed: plugins/markdown-format/hooks/markdown-format.sh, markdown-format.test.sh, README.md, CHANGELOG.md, .claude-plugin/plugin.json.

I traced the actual latch semantics to confirm the new wording is accurate, not just plausible-sounding:

• hook::notice_once only gates whether the notice fires again this session (marker file under skip-notices/).
• The MDLINT resolution block (markdown-format.sh#L487-L511) re-probes command -v markdownlint-cli2 / resolve_repo_markdownlint on every hook invocation, ungated by the notice latch.

So the new copy ("skipped for this edit... there is no skip latch") correctly describes the code, and the old copy ("skipped for this session") was the actual bug. Good fix.

• PATH probed: ${PATH:-<unset>} — confirmed PATH is never reassigned anywhere in this script, so the printed value is genuinely what the resolution probe searched, not a stale/local var.
• hook::emit_channels/hook::json_escape correctly JSON-escape the embedded literal newline before PATH probed:, so the two-channel (additionalContext + systemMessage) emission is well-formed either way.
• Version bump (0.11.17 → 0.11.18), CHANGELOG entry, and README wording are all consistent with each other and with the existing CHANGELOG format/conventions; no stale 0.11.17 references remain elsewhere in the plugin.
• New test assertions (markdown-format.test.sh lines ~891-902) correctly pin: no "skipped for this session" substring, presence of "there is no skip latch", and "PATH probed:" on both channels — this directly encodes the regression this PR fixes.

Verification: I was not able to execute bash plugins/markdown-format/hooks/markdown-format.test.sh myself in this environment (the tool call required approval that wasn't available), so the PASS=148 FAIL=0 test-plan result is author-claimed and unverified by me — I instead verified correctness by reading the hook logic and test assertions directly (above), which support the claimed behavior.

No findings. This is a small, well-scoped, accurately-described fix with matching test coverage; I found no correctness, maintainability, or convention issues to flag.
· branch cursor/2740-markdown-latch-8f91

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.