Skip to content

v2.4.2 — Claude Code regression fixes + audit hardening

Choose a tag to compare

View all tags
@psypeal psypeal released this 02 Jul 06:20
· 5 commits to main since this release
v2.4.2
3270d29

Why this release matters

v2.4.1 was broken on Claude Code — upgrade immediately. Its Codex-compatibility rewrite replaced ${CLAUDE_PLUGIN_ROOT} with a bash-fallback form that Claude Code's template substitution does not recognize, which broke every scripted step of every command. v2.4.2 restores full Claude Code operation and completes the marketplace rename that v2.4.1 started.

Fixed — v2.4.1 regressions

  • ${CLAUDE_PLUGIN_ROOT} restored in all commands, agents, and skills. hooks/hooks.json keeps the Codex fallback form (hooks receive the variable as an environment variable, so it resolves safely there).
  • Marketplace rename completed: the root manifest now declares name: knowledge-vault / 2.4.2 (it was left at claude-knowledge-vault / 2.4.0, so the README's install commands pointed at a marketplace that didn't exist and update checks never surfaced 2.4.1). The duplicate in-plugin marketplace.json is gone.
  • Codex MCP detection now reads the real Codex config (~/.codex/config.toml [mcp_servers]) instead of files Codex never writes.

Fixed — hardening from the full v2.4.0 audit

  • /process clippings now enter raw/.manifest.json — previously they were silently skipped by /compile and erased by the next index rebuild.
  • /enrich-references can actually find candidates: ingest-zotero.sh now writes has_fulltext (and accepts a type param instead of hardcoding paper).
  • PageIndex setup no longer writes an empty .env when ANTHROPIC_API_KEY is unset — the old behavior made detection report PageIndex as configured while every tree build silently failed.
  • Shell-into-Python injection removed from update-frontmatter.sh / index-append.sh / vault-status.sh — paths and slugs with apostrophes are now safe.
  • Manifest is validated before raw files are written (no more orphaned raw files after a corrupt manifest).
  • init.sh creates the documented inbox/ drop location; /init stops instead of overwriting preferences.md on re-run.
  • build-tree.sh probes all required Python deps (PyPDF2, yaml) and matches PageIndex's output naming for non-lowercase .PDF files.
  • detect-mcp-sources.sh scans .mcp.json (fixes Sci-Hub never being detected), deduplicates, and tolerates malformed config files.
  • /cleanup backfill verifies every recovered file is a real PDF; Zotero fulltext (text, not bytes) is no longer saved as a fake .pdf.
  • /ingest no longer double-builds (or impossibly pre-builds) PageIndex trees; /process confirms before batch tree-building >3 PDFs; /query tier 4 preflights pdftotext.
  • Friendlier one-line errors replace Python tracebacks in render-tree-outline.sh, rebuild-index.sh, update-state.sh, and the session hook.
  • Docs: retracted the stale "No PDFs are stored in the vault" claim (v2.4 deliberately preserves originals), real tree.json shape shown, repo-root LICENSE added, VENDORED.md update recipe excludes the user's .env.

Migration

Added the marketplace before the rename? One-time re-add:

/plugin marketplace remove claude-knowledge-vault
/plugin marketplace add psypeal/knowledge-vault
/plugin install knowledge-vault@knowledge-vault

Known limitations (vendored PageIndex, upstream)

No page cap / concurrency limit on very large PDFs; retry exhaustion can yield empty summaries; scanned image-only PDFs still spend tokens producing a junk tree. Tracked for a future vendored update.

🤖 Generated with Claude Code

Assets 2
Loading