plugin-directory-preflight 0.2.0

The gate now catches what the 0.1.0 gate missed while a second plugin (unmistakable) went through the scan. Replayed over that plugin's first scanned commit, it names every cause the scan named. On the commit that finally had no holds, it reports nothing.

Gate changes:

• A command word between single pipes is a command on its own. A pipe-joined list of plain English words that includes one is caught.
• The whole-environment rule reads test files too (comments were already read).
• A script that names an image or a font that exists in the repository fails. Documents naming one are fine.
• The host-beside-environment rule applies to scripts only. A Markdown file may hold tester links.

Docs: new rows in the scan-rules reference, a staging step for a scratch repository, a known conflict with typescript-patterns-enforcer, and a stop rule for the RUNTIME_FETCH_EXEC warning.

Install: /plugin marketplace add gagoar/plugin-directory-preflight, then /plugin install plugin-directory-preflight@plugin-directory-preflight. Node 22.6 or later runs the scripts as they are. There is no binary in this release.

v0.1.0

First release. A skill and four scripts for getting a plugin through the plugin directory's upload scan.

• check-plugin-safety.ts: the gate, nine checks (unscoped grants, whole-environment reads, committed binaries, big files, command words alone, credential-named placeholders, image globs, a host beside an environment reference, and a self-check)
• install-gate.ts: copy the gate and a CI workflow into a plugin repo; --check reports drift
• read-report.ts: a scan report in a screenful, with the files that could be masking a hold
• make-probe.ts: pin a stubborn hold to one line with a throwaway repo in about three uploads
• skills/check: the workflow, with references on the scan's rules, bundling third-party code and the AI policy review

The gate is an approximation built from observed behavior, not the directory's scan.