Defame1297
b4f5881973
plugins/bin/.mcp.json declared the obsidian server as `npx @bitbonsai/mcpvault@latest`, so an unpinned third-party npm package was fetched and executed at every session start. The apm-consumed install promoted that string to committed repo-root content in .mcp.json, giving every clone the same unpinned execution. Pinned to 0.15.0, the version `latest` currently resolves to. bin 1.1.2 -> 1.1.3 and marketplace 0.4.0 -> 0.4.1, following the mappingbb9158destablishes and3bfdf58confirms: the marketplace takes the same bump severity as the highest-severity package bump. kyberforge is not bumped here, so executables.allow's `kyberforge#1.5.0` key is untouched. The pin is not live for this working copy until this lands on the remote and `apm update` re-resolves — apm.lock.yaml still records 1.1.2 and `@latest`, because the six dependencies resolve from the remote rather than from the tree beside them. Correct for a fresh clone immediately. .gitignore gains /.claude-plugin/plugin.json: a bare `apm pack` emits a root-package manifest there that has never been tracked on any branch. Scoped to the file, since the sibling marketplace.json is compiled output that is committed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT
55 lines
1.5 KiB
Plaintext
55 lines
1.5 KiB
Plaintext
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Editor
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# Logs and temp
|
|
*.log
|
|
*.tmp
|
|
/tmp/
|
|
|
|
# Environment
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# Node (if tooling is added later)
|
|
node_modules/
|
|
|
|
# Claude Code local settings (machine-specific)
|
|
.claude/settings.local.json
|
|
|
|
# APM dependencies
|
|
apm_modules/
|
|
|
|
# APM install output — deployed copies of released plugin content, regenerated
|
|
# by `apm install`. The authoring source is plugins/<name>/.apm/; committing a
|
|
# deployed copy would add a third mirror of the same skills to drift against.
|
|
.claude/skills/
|
|
.claude/agents/
|
|
|
|
# APM hook deployment output — `apm install` copies each package's referenced
|
|
# hook scripts here and tracks its own settings.json entries in the sidecar.
|
|
# Regenerated on every install; the authoring source is
|
|
# plugins/<name>/.apm/hooks/ (ADR-0019).
|
|
.claude/hooks/
|
|
.claude/apm-hooks.json
|
|
|
|
# `apm pack` bundle output. The pre-push gate runs pack with --dry-run, so this
|
|
# only appears after a bare `apm pack` during a release; it is not repo content.
|
|
build/
|
|
|
|
# `apm pack`'s manifest for the *root* package. Emitted beside the marketplace
|
|
# manifest by a bare `apm pack`, and never tracked on any branch — the repo's
|
|
# own paths hide it, since sync-plugin-content.sh redirects `apm pack -o` to a
|
|
# scratch tree and the apm-pack-check-clean pre-push hook runs --dry-run. Scoped
|
|
# to the file, not the directory: the sibling .claude-plugin/marketplace.json is
|
|
# compiled output that IS committed and must stay tracked.
|
|
/.claude-plugin/plugin.json
|