v3.38.5 — .brain skip, --repo passthrough, secret regex
Fixes
#2911 — ruflo-adr's ADR importer indexed thousands of foreign ADRs from ruvnet-brain's cloned repos, burying the project's own. SKIP_DIRS omitted .brain, which holds shallow clones of ~50 external repos, many with their own docs/adr/. Since .brain sorts before docs, the project's own ADRs landed dead last in the walk order — an interrupted run could index hundreds of foreign ADRs and zero of the project's own. Added .brain to SKIP_DIRS. Also fixed the plugin's own smoke test, which hard-coded its regression-test-file count and broke on the new test file this fix added.
#2963 — github_issue_track's create/update/close/list actions validated the caller-supplied owner/repo but never passed them to gh. gh silently resolved the target repository from the current working directory's git remote instead — a caller supplying owner/repo expecting an operation to land in that specific repository had no guarantee it did. Now passes --repo <owner>/<repo> to gh whenever both are supplied.
#2931 — security scan's hardcoded-secret detection missed common real-world Stripe/OpenAI key shapes. The regex required 20+ characters after the sk-/sk_live_/sk_test_ prefix (missing shorter-but-real keys) and a quote literally adjacent to the prefix (missing the very common Authorization: "Bearer sk_live_..." shape, where the quote sits next to "Bearer", not the key). Replaced with lookaround word-boundaries and a lower length floor.