Repository navigation
chore(plugin): prepare iwdp-mcp for the plugin directory - #9
Merged
Merged
Conversation
…ts checksum run.sh fetched whatever release was latest from the GitHub API and ran it unchecked, once, forever: a later release never replaced the cached binary, and nothing confirmed the download was the file goreleaser built. The plugin directory also holds a plugin whose launcher runs a file it cannot read, so a reviewer will look at exactly this. The version now comes from .claude-plugin/plugin.json, so each plugin version runs the binary from its own release tag. The download goes to a temp file, is checked against that release's checksums file, and only then is moved into place as bin/iwdp-mcp-<version>. A mismatch or a missing entry refuses to run. Unsupported OS or architecture now fails with a message instead of a 404.
…ory rules A CLAUDE.md at the plugin root is never loaded as plugin context and the validator warns about it. .claude/CLAUDE.md still loads as project memory. Also notes that run.sh now needs the tag's release to exist before that plugin version can start, and the validator rules that cause policy holds.
The directory's compliance step asks to confirm the plugin's privacy policy describes the data it handles. This one covers the first-run download from GitHub, that the server otherwise only talks to localhost, and that tool results can carry page data such as cookies and storage.
The validator warned about the missing author. Without explicit links the listing scrapes them from the README, whose first link is the CI badge.
The validator warned that there was none. The portal reads it only on the first save, so it has to land before submitting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the plugin directory validation on 7ca767f.
scripts/run.shfetched whatever release waslatestand ran it unchecked. It also never updated a cached binary after a newer release. Now it reads the version fromplugin.json, downloads that tag's asset to a temp file, checks it against the release'schecksums.txt, and only then installs it asbin/iwdp-mcp-<version>. A mismatch refuses to run. Unsupported OS/arch fails with a message. The "scripts the validator couldn't follow" hold stays by design (a launcher that downloads a binary always goes to a reviewer), but the reviewer now sees a pinned, verified download.CLAUDE.mdmoved to.claude/CLAUDE.md(root one is flagged), with notes on the release/plugin version coupling and the validator rules.PRIVACY.md: first-run GitHub download, localhost-only otherwise, tool results can carry page data (cookies, storage, network).plugin.json: author, homepage, repository, docs, support, privacy policy, license, keywords.No version bump:
run.shdownloads the release matchingplugin.json, and bumping without a tagged release would break startup.Tested
run.shfrom a path with a space: first run downloads and verifies v0.5.3, server answersinitialize; second run uses the cached binary; a forced checksum miss refuses to run and leaves nothing behind.shellcheckclean.