v1.10.0 — audit fix campaign (1.6.0–1.10.0 consolidated)

[1.10.0] — 2026-05-05

Added

• scripts/hooks/_lib.sh — shared helper sourced by every PostToolUse hook script. Provides _hook_normalize_path that rebases relative path entries from CLAUDE_FILE_PATHS onto $CLAUDE_PROJECT_DIR before any [ -f ] / [ -d ] test. Prevents silent skipped checks when the runtime cwd is not aligned with the project root. (audit Doc2 #1)
• scripts/validate.sh allowed-tools enforcement — every skill must now declare allowed-tools in frontmatter unless it is on the explicit ALLOWED_TOOLS_EXEMPT list (using-godot-superpowers, subagent-dev-mode, game-brainstorming). Validator FAILs on missing field for any other skill. Closes the documentation gap that let four foundation skills ship without the allowed-tools constraint that all other skills observed. (audit AUDIT.md #1)
• README.md "Portability across clients" section — lists which tool-name primitives map across Claude Code / Copilot CLI / Cursor / Codex, and is explicit that hooks + MCP wiring are Claude Code conventions and do not transfer 1:1. (audit Doc3 portability)

Fixed

• Hook scripts (scripts/hooks/dep-integrity.sh, verifier-reminder.sh, check-tscn.sh, gdformat-gd.sh) now source _lib.sh and call _hook_normalize_path after the trim step, before the file-existence test. Closes the path-normalization gap from audit Doc2 #1.
• agents/game-designer.md callout tension — the agent carries the standard "Authoritative source" callout and says "don't write GDScript code or class names" further down. Added a follow-up blockquote that makes the resolution explicit: design docs cite Resource names, system concepts, and version claims, and those must remain API-accurate even when no code is emitted. The rule is "verify named-API claims," not "verify only when shipping code." (audit AUDIT.md #2)
• skills/subagent-dev-mode/SKILL.md Researcher row — Explore model column changed from hardcoded sonnet to IDE default. The host's default for the built-in Explore subagent can change between Claude Code releases; hardcoding a model name was a forward-compat hazard. (audit Doc4 2.2)
• Caveman-mode references marked optional in skills/subagent-dev-mode/SKILL.md (line 105) and agents/orchestrator.md (line 144) — the feature is provided by the external superpowers plugin and was previously cited without the dependency note. Drop-in users without that plugin would have read it as a documented behavior of this plugin. (audit Doc3 + Doc4 2.1)

Changed

• scripts/validate.sh count drift detection rewritten — replaced indiscriminate [0-9]+ skills / [0-9]+ subagents regex (which matched any prose mention of those numbers) with check_count_anchored that targets only canonical positions: CLAUDE.md tree comments + ## Skill catalog (N) / ## Agent catalog (N) headers, README.md ### N skills / ### N subagents H3 headers, and the marketplace.json description prefix. Each anchor regex contains a single (...) capture group; bash =~ + BASH_REMATCH[1] extracts the number. No more false positives from prose. (audit Doc3 validator)
• scripts/validate.sh exempt-set DRY — extracted the design-only-skill list (skills that never emit Godot 4.x API) into a single DESIGN_ONLY_SKILLS array used by both the callout-presence skip and the callout-absence enforcement loops. Adding a new design-only skill is now a one-line edit instead of two. Same refactor introduces a tiny _in_array helper. (audit Doc3 validator DRY)
• CHANGELOG.md 1.6.0 / 1.7.0 / 1.8.0 backfilled — three placeholder "undocumented maintenance" entries replaced with one consolidated [1.6.0] – [1.8.0] entry that lists the cumulative deltas (2 new agents, 4 new skills, hook script extraction, orchestrator integration step) reconstructed by diffing the v1.5.0 git tag against the v1.8.1 working tree. Per-version assignment is documented as unrecoverable from git. Going-forward rule: every version bump must land with a tagged commit and a dedicated changelog entry. (audit AUDIT.md #3)

Why

• Audit pass identified medium / low residual issues: silent path-handling failure mode in hooks, fragile validator regex that could mask real drift, validator inconsistency around allowed-tools coverage, doc references to optional external features without dependency notes, hardcoded model name that drifts with the host, and three placeholder CHANGELOG entries that gave no context for any regression that traced to that range. None individually critical; together they degraded the plugin's self-describability and resilience to upstream changes. This release is corrective + tooling — no new skills, no new agents.