[dmmdea]

Intent

The skill hint should suggest only skills the model can load. It suggested three kinds it cannot, and it hid one kind it should have shown.

What changed

• Plugin from two marketplaces (over-hide). enabledPlugins is merged per name@marketplace key, and a plugin name counts as enabled when any of its keys is. Before, keys were merged by bare name, so with name@a: false and name@b: true the result depended on Go map iteration order, and the plugin's skills were hidden on some prompts only.
• Old plugin version (stale suggestions). A plugin skill is now judged by the installed copy its path sits in, with that copy's own enabled bit. A path under no installed copy belongs to a previous version that an update left in the cache, so it is hidden.
• Missing file or disable-model-invocation. For the few ranked candidates, SKILL.md is read inside the hook's deadline. A missing file, or frontmatter with disable-model-invocation: true, hides the candidate. filterInvocable stays pure, and these ids are still logged as hidden.
• mr-index.
  • A discovery-owned plugin root that installed_plugins.json no longer lists for its pack is now superseded and triggers rediscovery. Before, an update left the old version directory in place, Stale saw it as live, and the index kept serving the old skills.
  • When one plugin is installed from several marketplaces, discovery keeps only the copies enabled in settings.json, so harvest's first-wins dedup cannot keep the disabled copy.

Real run

Run against a real config in which one plugin is installed from two marketplaces (one key true, one false) and its newest version marks 3 skills disable-model-invocation. Same 4 prompts for both binaries, usage log redirected:

• Deployed mr-hook (5a8186a):
  • The enabled plugin's skills were missing in 1–3 of 6 runs per prompt.
  • A disable-model-invocation skill surfaced in 5 of 6 runs of its prompt.
• Rebuilt mr-hook:
  • The enabled skills surfaced in 5 of 5 runs per prompt, the same set every run.
  • The 3 disabled skills never surfaced.
  • Against an index still pinned to the previous plugin version, nothing from that stale copy surfaced.
• Rebuilt mr-index refresh, on a copy of an index and roots.json pinned to the previous version:
  • It reported the superseded root and rediscovered.
  • It landed on the enabled marketplace's copy: 11 skills, all from the installed version.

Tests

None added. The existing suite runs in CI. go build ./... and go vet on the changed packages are clean.

Risk

• Hint-time cost is at most k small file reads (8 KiB each) inside the existing deadline.
• If installed_plugins.json carries no installPath, the old name-level rule applies unchanged.

🤖 Generated with Claude Code