feat: consolidate orphan branch plugins (bash-command-rejection, spec-validation)

[nsheaps]

Summary

• Cherry-picked 2 new plugins from orphan branches that had no associated PRs
• Cleaned up 12 stale/merged branches total (7 already-merged orphans + 5 closed/merged PR branches)

Plugins Added

1. bash-command-rejection — PreToolUse hook that blocks &&, |, ; chaining in Bash commands. Enforces single-command execution for permission granularity. Includes # CHAINED: bypass pattern and SKILL.md with alternatives.
2. spec-validation — Hooks for enforcing spec-based development: UserPromptSubmit captures requirements, PostToolUse validates against specs on TodoWrite. Includes rules and skills for spec management.

Branches Cleaned Up

Deleted (already merged, 0 commits ahead): 7 branches

• claude/command-help-skill-*, claude/github-action-auth-*, claude/github-actions-ci-workflow-*, claude/linear-mcp-sync-plugin-*, claude/safety-evaluation-plugin-*, claude/sync-settings-plugin-*, claude/task-parallelization-plugin-*

Deleted (closed/merged PRs): 5 branches

• claude/commit-command-plugin-* (PR Create Claude commit command plugin #1 merged), claude/fix-review-bot-thread-resolution (PR fix: improve review bot thread resolution behavior #112 closed), claude/plugin-rule-injection-* (PR feat(plugins): add lead-researcher plugin for coordinated deep research #37 closed), nate/backup (PR hold #3 closed), test/version-bump-workflow-v2 (PR test: validate version bump workflow v2 (no loop) #80 closed)

Deleted (consolidated into this PR): 2 branches

• claude/bash-command-rejection-plugin-oDcpr, claude/add-spec-validation-plugin-UCFsY

Deleted (stale, content already on main): 1 branch

• claude/add-memory-manager-readme-oiYWF (README already exists on main, CI/CD changes 1112 commits stale)

Not Touched (have open PRs)

• docs/safe-settings-write-follow-ups (docs(statusline): document EXIT trap contract and STATUSLINE_SCRIPT coupling #165), feat/consolidate-todo-plugins (feat: consolidate todo plugins into unified task-management plugin #134), feat/granola-ai-plugin (feat(granola-ai): add plugin for Granola.ai MCP server #123), nate/worktree-switcher-improvements (feat(claude-tools): move worktree-switcher to homebrew-devsetup #116), claude/issue-creation-auto-planning (feat(workflows): add issue creation auto-planning #93), claude/datadog-otel-setup-1768872579 (feat: add datadog-otel-setup plugin and plugin settings framework #110), claude/docker-compose-grafana-otel-k20wO (Set up Docker Compose for Grafana and OTEL telemetry #36)

Test plan

• Verify bash-command-rejection hook correctly blocks chained commands
• Verify spec-validation hooks fire on UserPromptSubmit and PostToolUse
• Confirm no conflicts with existing plugins on main

🤖 Generated with Claude Code

[github-actions]

Plugin Version Status

Versions are auto-bumped in PRs. Manual bumps to higher versions are preserved.

Plugin	Base	Current	Action
bash-command-rejection	0.0.0	0.1.0	Already bumped
spec-validation	0.0.0	1.0.0	Already bumped

[henry-nsheaps]

❌ Some changes need to be made — this PR is merged, so these are follow-up fixes for main

❌ spec-validation hooks never fire — no hooks/hooks.json manifest (thread)
❌ bash-command-rejection double-loads its hook — "hooks" field at the standard path violates repo rule (thread)
⚠️ Both plugin.json files point at nsheaps/.ai instead of nsheaps/ai-mktpl (thread 1, thread 2)
⚠️ grep -v drafts vs draft/ mismatch (thread); broad regex (thread); missing set -euo pipefail (thread)
✅ bash-command-rejection hook logic, # CHAINED: bypass, and docs are solid; the ;-header mismatch was fixed
✅ Both plugins follow the required directory structure with thorough README/SKILL docs

🖱️ Click to expand for full details

Review context

Review #6. The PR was merged at commit fd9cd44 with no fixes applied for any of the previously-raised feedback. I re-verified every finding against the merged file contents — all are still present on main, so the items below are follow-ups for a new PR. My five prior review summaries have been minimized; the inline threads remain open because the issues remain.

Critical — correctness

These two structural bugs mean one plugin is inert and the other double-loads, so this is not "clean" despite being merged.

1. spec-validation hooks are never registered. The plugin ships scripts under hooks/UserPromptSubmit/*.sh and hooks/PostToolUse/*.sh but has no hooks/hooks.json manifest and no "hooks" field in plugin.json. Claude Code plugins discover hooks only through a hooks.json manifest — the directory-per-event layout is the project-level .claude/hooks/ convention, not the plugin convention. As merged, neither hook executes. Fix: add plugins/spec-validation/hooks/hooks.json mapping the events to the scripts and rely on auto-discovery (no plugin.json field). Detail + example in the inline thread.

2. bash-command-rejection double-loads its hook. plugin.json declares "hooks": "./hooks/hooks.json" and ships that file at the auto-discovered standard path. Per .claude/rules/plugin-hooks-organization.md this produces duplicate-loading errors and is what mise run validate is meant to catch. I confirmed it is the only plugin in the repo doing this — drop the field. See the inline thread.

Bugs / warnings

3. Wrong repository URLs — both plugin.json files set homepage/repository (and spec-validation's author.url) to https://github.com/nsheaps/.ai, but this marketplace is nsheaps/ai-mktpl. Suggested fixes are in the existing threads (bash, spec) and were never applied.
4. grep -v drafts (plural) vs draft/ (singular) in validate-against-spec.sh — the filter meant to exclude archived specs doesn't match the documented directory name, so draft specs still trigger the reminder (thread).
5. Overly broad prompt match in capture-requirements.sh — the verb list (fix|update|change|write|make|…) fires on conversational prompts ("can you explain how to update…"), injecting spec-guidance noise on nearly every turn (thread).
6. Inconsistent shell safety — spec-validation scripts omit set -euo pipefail while bash-command-rejection uses it (thread).

What's good ✅

• bash-command-rejection/reject-chained-commands.sh is clear and defensive: # CHAINED: bypass checked first, || correctly preserved via a placeholder before the | check, helpful deny messages, and a graceful fallback when the shared lib is absent (dependency note).
• The ;-header/behavior mismatch flagged in the first review was fixed (the header no longer lists ; as allowed). Minor leftover: the edit duplicated the # Allowed patterns: block — worth tidying.
• README/SKILL documentation is thorough, and the branch-cleanup bookkeeping in the PR description (including the "not touched / open PRs" list) is detailed and accurate.

Scoring

• Code Quality 55% — two structural correctness bugs (inert plugin −20%, duplicate load −15%), wrong URLs that survived four prior reviews (−5%), drafts/draft bug (−3%), broad regex + missing safety flags (−2%).
• Security N/A — bash-command-rejection is itself a guardrail; no security-sensitive surface introduced, no user-data handling.
• Simplicity 85% — straightforward scripts; the duplicated # Allowed patterns: header block and the broad regex are the only smells, neither is complexity.
• Confidence 92% — verified the plugin hooks conventions, the URL mismatch, and the uniqueness of the duplicate-load directly against the repo and its rules. Slight residual uncertainty only on exact Claude Code plugin-discovery internals.

Recommended follow-ups (the changes are already on main — best handled in a new PR):

• Add plugins/spec-validation/hooks/hooks.json so the hooks actually run, then verify both UserPromptSubmit and PostToolUse fire.
• Remove the "hooks" field from bash-command-rejection/.claude-plugin/plugin.json.
• Fix the nsheaps/.ai → nsheaps/ai-mktpl URLs in both plugin.json files.
• Correct grep -v drafts → grep -v draft, narrow the capture-requirements.sh regex, and add set -euo pipefail to the spec hooks.
• Tidy the duplicated # Allowed patterns: header block in reject-chained-commands.sh.

Notes:¹²³

Footnotes

1. Workflow Run: https://github.com/nsheaps/ai-mktpl/actions/runs/27073277829/attempts/1 ↩

2. PR: nsheaps/ai-mktpl#168 ↩

3. Plugin hooks organization rule ↩