fix(claude): enable the three catalogued plugins settings never named, and gate the parity

[kyle-sexton]

No linked issue

Summary

docs/CLOUD-SESSIONS.md states that enabledPlugins "turns on the whole catalog, so this repo dogfoods everything it publishes and a regression in any plugin surfaces here first." It did not. Three plugins reached main carrying a .claude-plugin/marketplace.json entry and no .claude/settings.json key, so the catalog was 70 and the enabled set was 67.

Plugin	Added in	Enabled
ai-slop	#2892	never
context-budget	#2932	never
improvement	#2985	never

The plugin PRs on either side of them (coupling #2913, overengineering #2961) did add the settings entry, which is what an unenforced convention looks like over time.

The failure is silent by construction. .claude/cloud-bootstrap.sh computes its install set from that same map, so a cloud session comes up green reporting plugins 67 enabled with those three plugins' skills simply absent and no line of output naming what is missing — a documented guarantee with nothing behind it, and it costs exactly the dogfooding the relative directory marketplace source exists to provide.

No existing detector covers this axis for this repo:

• plugins/claude-config/skills/audit/scripts/check-plugin-drift.sh audits it for consumer repos, but resolves each marketplace through source.repo and records SKIP for one that declares none — precisely this repo's relative directory source, so it structurally cannot see this repo's own drift.
• scripts/check-plugin-manifest-presence.sh holds the catalog against the filesystem (manifest present, name matches, no unregistered directory) and says nothing about whether a catalogued plugin is ever enabled.

Fix

.claude/settings.json — adds the three missing keys in alphabetical position. Enabled set is now 70/70.

scripts/check-plugin-catalog-enablement.sh (new, plus its contract test) — holds the two sets equal in both directions, checks the layout the doc relies on, and checks that the bootstrap agrees on which marketplace this is:

1. UNENABLED PLUGIN — a catalog entry with no <name>@<marketplace> key. The class that shipped three times.
2. ORPHANED ENABLED ENTRY — a key for this marketplace naming no catalog entry. What a rename or removal leaves behind; the id resolves to nothing and the install silently no-ops.
3. UNSORTED enabledPlugins — keys out of byte order, since the alphabetical one-per-line layout is what the doc calls the reason a single plugin can be flipped to false without disturbing the rest.
4. MARKETPLACE IDENTITY MISMATCH — .claude/cloud-bootstrap.sh's hardcoded marketplace_name no longer naming the marketplace the settings file declares. Added in response to the Codex P2 below.

A key set to false passes. An explicit false is the documented off switch for the entries whose bundled MCP servers need credentials this environment has no reason to hold (miro, dometrain); an absent key is drift. Only one of those two states is silent, and the gate distinguishes them rather than forcing an off switch nobody can use.

The marketplace name is derived from extraKnownMarketplaces rather than hardcoded, so a marketplace rename cannot leave the gate quietly checking a suffix nothing uses. Two declared marketplaces exits 2 rather than guessing which catalog to hold the set against. Suffix stripping is a literal ${key%"@$MARKET"} expansion, never a sed pattern interpolating the name.

.github/workflows/ci.yml — adds plugin-catalog-enablement-gate and lists it in ci-status.needs, so it actually gates a merge. Self-test runs first, matching the sibling gates, so a broken detector cannot mask a regression behind a green lane.

docs/CLOUD-SESSIONS.md — the whole-catalog bullet now names the lane that enforces it, the identity check, and why the consumer-side detector cannot cover this.

scripts/affected-tests.test.sh — moves the .github no-suite probe off a path this PR gave a real dependency. See "Review rounds" below.

Review rounds

Three findings were raised and all three are closed. Each fix is a separate commit.

Source	Finding	Resolution
Security review (informational)	$MARKET interpolated into a sed expression, so a regex metacharacter in the marketplace name changes what the pattern matches	3fc3cbd8 — literal suffix strip
Codex (P2)	The gate derives the marketplace name while cloud-bootstrap.sh hardcodes it; a rename could pass the gate while the bootstrap installed nothing	a36bc765 — check 4 above
plugin-gate CI failure	This PR's own new reference chain broke an unrelated probe in affected-tests.test.sh	11ef3f81 — probe moved

The plugin-gate failure is worth spelling out, since it was caused by this PR rather than being incidental. affected-tests.sh treats a basename appearing in another file's text as a dependency, so this PR created the chain .github/actionlint.yaml → .claude/cloud-bootstrap.sh (its pin comment names that file) → check-plugin-catalog-enablement.sh (reads cloud-bootstrap.sh) → its suite. The probe asserted the sole .github/*.yaml file selects no suites, which held only while nothing referenced it.

Both new edges are real — the gate genuinely reads cloud-bootstrap.sh, and R3 over-selecting through a comment is the documented safe direction — so neither was severed to keep the probe convenient. The probe moves instead, which is the same resolution that block's existing comment already records for .github/workflows/ci.yml. The replacement filters candidates with a direct git grep rather than by calling affected-tests.sh, because choosing the probe with the tool under test would make the assertion tautological.

Verification

Ran locally on this branch, at head 11ef3f81:

• scripts/check-plugin-catalog-enablement.sh → green: Every one of the 70 catalogued plugins carries an enabledPlugins key for 'melodic-software'; none orphaned; keys sorted; .claude/cloud-bootstrap.sh installs that same marketplace.
• bash scripts/check-plugin-catalog-enablement.test.sh → 13/13 contract checks pass.
• bash scripts/affected-tests.test.sh → 47 pass, 0 fail.
• Reproduced the original drift first: pointed the gate at the pre-fix .claude/settings.json and it went red naming all three plugins, then green on the fixed tree.
• Confirmed each new assertion discriminates rather than decorates: the metacharacter case fails against the previous sed implementation with a false ORPHANED ENABLED ENTRY; the relocated .github probe fails when .github/* is stripped from the no-suite list via AFFECTED_TESTS_NO_SUITE.
• scripts/check-lane-coverage.sh --check → all 41 lane(s) reachable from ci-status.needs.
• actionlint, shellcheck, shfmt -d (EditorConfig-driven, matching the repo's indent_size = 2 rather than hand-passed flags), scripts/check-shell-portability.sh --paths, scripts/check-silent-skips.sh, scripts/check-plugin-manifest-presence.sh, scripts/check-changelog-parity.sh --check, scripts/validate-plugins.sh, markdownlint-cli2, typos, editorconfig-checker → all clean.

Behavioral note for reviewers: enabling context-budget activates its settings-write-ask PreToolUse hook, which forces a permission prompt on any Write/Edit targeting a Claude Code settings surface. That is the plugin working as documented and it ships a settings_write_ask_enabled kill switch, but it is a live change to sessions in this repo and worth knowing before merge.

Related

Refs #3196 — the same three plugin names appear there as an unsorted enabledPlugins tail at user scope after a /claude-ops:plugins sync. Different scope and different cause (that one is Claude Code's settings writer appending rather than inserting); this PR fixes the committed project-scope map and adds the gate. The new check's sorted-keys assertion would catch the project-scope symptom of #3196 if it ever landed here.

[claude]

Claude finished @kyle-sexton's task in 2m 1s —— View job

---

Security review

• Gather context (PR diff, changed files)
• Run /review:security-review skill
• Post findings

Scope: .claude/settings.json, .github/workflows/ci.yml, docs/CLOUD-SESSIONS.md, scripts/check-plugin-catalog-enablement.sh, scripts/check-plugin-catalog-enablement.test.sh (full diff via git show a43aa55).

No security issues found.

Notes from the review (informational, not findings):

• The new plugin-catalog-enablement-gate job in ci.yml runs under the workflow's existing pull_request trigger (not pull_request_target) with the repo-wide permissions: contents: read, checks out with persist-credentials: false, and pins actions/checkout by SHA — consistent with the sibling gates and no privilege-escalation or secret-exposure surface for fork PRs. (ci.yml#L734-L757)
• scripts/check-plugin-catalog-enablement.sh interpolates the marketplace name ($MARKET, derived from .claude/settings.json) into a sed expression at check-plugin-catalog-enablement.sh#L108. A marketplace key containing regex/sed metacharacters could make the substitution behave unexpectedly, but the value comes from a file already under this repo's own review/merge control, the job carries no secrets, and the worst case is the gate misfiring on its own CI run — not an exploitable injection across a trust boundary. Not flagged as a finding.
• The test script (check-plugin-catalog-enablement.test.sh) builds fixtures only from hardcoded literals and its own mktemp -d, with no untrusted input reaching a shell/eval context.
• No authentication, authorization, secret handling, or data-flow-from-untrusted-input code is touched by this PR; it's a config-enablement fix plus a static repo-hygiene gate.

[github-actions]

Last security-reviewed head: 11ef3f812a1b72408351bfb49d78568edb2c46d5. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a43aa550d5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 1m 11s —— View job

---

Security review

• Gather context (PR diff, changed files, prior review)
• Run /review:security-review skill
• Post findings

Scope: incremental diff since the last reviewed head. This run covers only what changed between the previously-reviewed a43aa55 and the current HEAD 3fc3cbd — one commit, touching scripts/check-plugin-catalog-enablement.sh and scripts/check-plugin-catalog-enablement.test.sh. The rest of the PR (.claude/settings.json, .github/workflows/ci.yml, docs/CLOUD-SESSIONS.md) is unchanged since the prior review and that review's "no security issues found" still applies.

No security issues found in the new commit.

The new commit replaces the sed -n "s/@${MARKET}\$//p" suffix-stripping with literal bash matching (check-plugin-catalog-enablement.sh#L107-L122):

[[ "$key" == *"@$MARKET" ]] || continue
printf '%s\n' "${key%"@$MARKET"}"

This is exactly the fix for the informational note from the prior review round (regex metacharacters in $MARKET changing sed's match semantics). Both uses quote $MARKET inside the pattern/parameter expansion (*"@$MARKET", "${key%"@$MARKET"}"), so it's a literal glob match, not a wildcard expansion — a stray * or ? in the marketplace name still can't broaden the match. No new trust-boundary crossing is introduced: $MARKET is still derived from extraKnownMarketplaces in this repo's own .claude/settings.json, under the same PR-review control as before. The accompanying test addition (check-plugin-catalog-enablement.test.sh §6b) exercises the literal-vs-regex distinction directly and passes.

Out of scope for this lane (security-only, per /review:security-review): the correctness point raised in Codex's review comment that .claude/cloud-bootstrap.sh hardcodes marketplace_name="melodic-software" while the gate derives it dynamically — that's a functional-parity bug, not a security finding, and belongs to /review:code-review.

[claude]

Claude finished @kyle-sexton's task in 1m 13s —— View job

---

Security review

• Gather context (PR diff, changed files, prior reviews)
• Run /review:security-review skill
• Post findings

Scope: incremental diff since the last reviewed head. This run covers only what changed between the previously-reviewed 3fc3cbd and the current HEAD a36bc76 — one commit ("make the enablement gate verify the bootstrap's marketplace identity"), touching docs/CLOUD-SESSIONS.md, scripts/check-plugin-catalog-enablement.sh, and scripts/check-plugin-catalog-enablement.test.sh. .claude/settings.json and .github/workflows/ci.yml are unchanged since the prior review round and that "no security issues found" still applies.

No security issues found in the new commit.

This commit is the fix for the P2 correctness gap Codex flagged: .claude/cloud-bootstrap.sh hardcodes marketplace_name while the gate derives its marketplace name dynamically from extraKnownMarketplaces, so a rename could pass the gate while leaving the bootstrap installing nothing. The fix adds a fourth check block (check-plugin-catalog-enablement.sh#L167-L193) that reads the bootstrap's marketplace_name="..." assignment with sed -n 's/^marketplace_name="\([^"]*\)".*/\1/p' and string-compares it against $MARKET.

Reviewed for the same injection class the prior round flagged as informational on the sibling suffix-stripping code:

• No trust-boundary crossing. $BOOTSTRAP (.claude/cloud-bootstrap.sh) and $SETTINGS are both repo-committed files under this PR's own review/merge control — same as every other input this gate reads. No external or attacker-influenced data reaches this script.
• The sed pattern is a fixed literal, not built from $MARKET or any other runtime value — it extracts bootstrap_name from the bootstrap file's own content. Nothing is interpolated into the regex, so the metacharacter concern that applied to the earlier $MARKET-in-sed code (fixed in 3fc3cbd) doesn't apply here: there's no variable substitution into a sed/regex context anywhere in this new block.
• The subsequent comparison ([[ "$bootstrap_name" != "$MARKET" ]]) is a quoted literal [[ ]] string comparison, not == glob matching and not eval/command substitution of untrusted content — no injection surface.
• BOOTSTRAP itself comes from PLUGIN_CATALOG_ENABLEMENT_BOOTSTRAP:-.claude/cloud-bootstrap.sh, the same test-only-override pattern as MARKETPLACE/SETTINGS already reviewed; .github/workflows/ci.yml invokes the script with no env override, so CI always resolves the real path.
• Missing/unparseable bootstrap fails closed (exit 2 / UNREADABLE BOOTSTRAP IDENTITY, errors+=1) rather than skipping — consistent with this gate's existing silent-skip-avoidance design, not a new fail-open path.
• Test additions in check-plugin-catalog-enablement.test.sh (§6c and the two adjacent cases) build fixtures only from hardcoded literals and mktemp -d, same as the rest of the suite — no untrusted input reaching a shell/eval context there either.

docs/CLOUD-SESSIONS.md changes are prose-only, describing the new check; no security-relevant content.

[claude]

Claude finished @kyle-sexton's task in 46s —— View job

---

Security review

• Gather context (PR diff, changed files, prior reviews)
• Run /review:security-review skill
• Post findings

Scope: incremental diff since the last reviewed head. This run covers only what changed between the previously-reviewed a36bc76 and the current HEAD 11ef3f8 — one commit ("move the .github no-suite probe off a path a suite now claims"), touching only scripts/affected-tests.test.sh. .claude/settings.json, .github/workflows/ci.yml, docs/CLOUD-SESSIONS.md, scripts/check-plugin-catalog-enablement.sh, and scripts/check-plugin-catalog-enablement.test.sh are unchanged since the prior review round and that round's "no security issues found" still applies.

No security issues found in the new commit.

The change replaces a single hardcoded .github/*.yaml probe path with a loop that scans .github/*.yaml and .github/*.yml candidates and picks the first one with no incoming reference from any grepped source file (affected-tests.test.sh#L580-L603):

mapfile -t wf_candidates < <(cd "$REPO_ROOT" && git ls-files '.github/*.yaml' '.github/*.yml')
wf_yaml=()
for c in ${wf_candidates[@]+"${wf_candidates[@]}"}; do
  if ! (cd "$REPO_ROOT" && git grep -q -F -- "${c##*/}" \
    -- '*.sh' '*.bash' '*.js' '*.mjs' '*.cjs' '*.py' '*.ps1' '*.psm1') 2>/dev/null; then
    wf_yaml=("$c")
    break
  fi
done

This is test-only tooling with no trust-boundary crossing:

• Candidates come from git ls-files — this repo's own committed tree, not attacker-influenced input.
• The git grep uses -F (fixed-string match), so a filename containing regex metacharacters can't alter match semantics — no injection class here, unlike the sed-interpolation pattern fixed earlier in this PR (3fc3cbd).
• The matched basename ("${c##*/}") is passed as a -- -delimited literal argument to git grep, not interpolated into a shell string or eval'd.
• No secrets, credentials, or CI trust-boundary logic touched; this only affects which fixture path a local/CI test exercises.

No other files changed in this commit, so the rest of the PR's prior review findings stand unchanged.

[claude]

Claude finished @kyle-sexton's task in 37s —— View job

---

Code review — skipped

• Gather context (PR diff, changed files, prior reviews)
• Invoke /review:code-review skill and follow its instructions
• Post findings

Result: skipped, per the skill's skip gate.

The /review:code-review skill's skip gate stops early — posting nothing else — when "PR is closed or not open." The pre-fetched context for this invocation reports PR State: MERGED for #3235, so that condition is met: there's no open PR left to attach a code review to.

For reference, this PR already went through three rounds of /review:security-review (see the earlier Claude comments above) and one round of Codex code review, whose P2 finding (the enablement gate deriving its marketplace name dynamically while .claude/cloud-bootstrap.sh hardcoded marketplace_name="melodic-software") was confirmed and fixed in a36bc765 before merge. Nothing further to add here.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.