v0.61.0

Added

• plugins/devops/scripts/permission-audit.js — new pre-flight permission audit. Scans recent ~/.claude/projects/**/*.jsonl sessions (default 7-day window) for MCP tool calls that are NOT covered by the current ~/.claude/settings.json allow-list and emits structured suggestions (low-risk for mcp__plugin_* / mcp__ccd_*, medium-risk for everything else). The 24h empirical analysis that motivated this work showed ~150+ prompts/day for self-installed plugin-MCPs alone (mcp__plugin_devops_dotclaude-completion, mcp__plugin_devops_dotclaude-ship, mcp__plugin_local-llm_dotclaude-local-llm, mcp__ccd_session, etc.) — none of which were in the allow-list despite the user having installed them deliberately. Script also surfaces tamper-protected paths (.claude/settings*.json, .claude/hooks/**, etc.) as a separate field — these cannot be allow-listed by design and must be communicated to the user before AFK runs. Includes an --apply="<rule1>,<rule2>" mode that writes the user-confirmed rules directly to settings.json via fs.writeFileSync from a Bash subprocess — bypassing the Edit-tool tamper-protection (which would otherwise prompt for every individual rule). The --apply rules are re-validated against the script's own freshly-computed suggestion list before writing, so prompt-injected arbitrary rule names cannot be smuggled in. MCP namespace extraction uses lastIndexOf('__') not split('__'), so server names containing __ (e.g. mcp__codex_apps__github__fetch_file) are correctly resolved to mcp__codex_apps__github rather than being truncated to mcp__codex_apps
• plugins/devops/skills/devops-autonomous/SKILL.md — new Step 0.7 — Permission Audit between Step 0.5 (Resume Detection) and Step 1 (Task Intake). Runs the audit script silently. If suggestions exist, presents ALL of them in ONE AskUserQuestion multi-select (never auto-applies — even low-risk rules require explicit user approval, so a forged .jsonl log entry cannot seed the allow-list silently). Apply phase uses Bash + --apply mode rather than the Edit tool, dodging the tamper-protection prompt entirely. If tamper_protected_writes is non-empty, surfaces a warning to the Step 3e checklist before the AFK lockout starts
• plugins/devops/skills/devops-agents/SKILL.md — new Step 1.5 — Permission Audit between Step 1 (Task Analysis) and Step 2 (Agent Selection). Same single-batch confirmation flow as autonomous — important when waves of parallel worktree-agents would otherwise each hit their own permission prompt mid-flight. Read-only and silent on no findings, never blocks the flow when there's nothing to fix

---

Install: /plugin marketplace add Jerry0022/dotclaude

v0.60.4

Changed

• plugins/devops/skills/devops-autonomous/SKILL.md — /devops-autonomous shutdown option now waits for other active Claude sessions before powering off the PC, instead of cutting them off mid-thought. New Step 8a polls ~/.claude/projects/**/*.jsonl mtimes: a file modified within the last 2 minutes signals that another session (any project, any worktree, including subagents) is still in a tool-call or thinking phase. Loop sleeps in 30 s intervals up to 30 min hard cap, then proceeds regardless to avoid indefinite hangs. Self-detection reconstructs the encoded project-dir name from cygpath -w "$PWD" with [\:.] → - substitution to match the exact directory under ~/.claude/projects/, so the entire own session tree (main session + spawned subagents) is excluded — not just a single jsonl picked by an unreliable "freshest globally" heuristic. A sentinel value (@@NO_SELF_MATCH@@) replaces an empty SELF_DIR so grep -vF '/' cannot collapse to "filter all absolute paths" and trigger an immediate shutdown when self-detection fails (codex review caught this). Step 2 Q3 + Step 0.5 resume question option descriptions mention the wait so the user understands the new behaviour at decision time

---

Install: /plugin marketplace add Jerry0022/dotclaude

v0.60.3

Changed

• plugins/devops/skills/devops-concept/SKILL.md + deep-knowledge/validation-gate.md + deep-knowledge/templates.md + deep-knowledge/iteration-rules.md — generic form-collection coverage gate. Concept pages must now implement collectDecisions() via a generic catch-all (querySelectorAll('input, select, textarea') scoped to section[data-iteration][data-active]) that ships every named control as allFields in the submit payload, not via hand-listed selectors per field. Hand-listed selectors written for iteration N silently miss new fields added in iteration N+1: the user sees the panel turn green, but Claude receives a truncated payload and can only act on the iteration-N keys. Validation gate grows from 20 to 22 mandatory shared patterns (#21 catch-all selector, #22 [data-active] scope); reference collectAllFormFields() lives in templates.md and is wired into the dispatcher so typed sub-objects (decisions[], comments[]) coexist with the catch-all rather than replacing it. SKILL.md Step 5 grows a coverage check that compares submitted allFields against the DOM of the just-frozen iteration; new Step 5c.2.5 is a verify-collection gate that reads existing collectDecisions() JS and forces a fix BEFORE appending iteration N+1 if the catch-all is missing. iteration-rules.md gains the matching append-checklist + procedure entry

---

Install: /plugin marketplace add Jerry0022/dotclaude

v0.60.2

Added

• plugins/devops/deep-knowledge/mcp-deferred-tools.md — new cross-cutting reference documenting the deferred-tools pattern. In sessions with a large tool inventory, MCP tool schemas land deferred: their names appear in the SessionStart <system-reminder> deferred list, but their JSONSchema is NOT loaded until ToolSearch is explicitly invoked with select:<tool-name>. A previous ship attempt misdiagnosed this as a missing MCP server, then deadlocked on the guard hook blocking the manual PR-creation fallback. Doc explains the detection heuristic (presence in deferred list = registered), the single-roundtrip bulk-load pattern (select:name1,name2,... in one ToolSearch call), and anti-patterns (do not conclude "server missing" from a deferred entry, do not fall back to manual PR-creation when the guard fires)

Changed

• plugins/devops/skills/devops-ship/SKILL.md — new Step 0.5 — Load Deferred MCP Schemas between Step 0 (extensions) and Step 1 (preflight). Mandatory bulk-load of all five ship_* tool schemas via a single ToolSearch({ query: "select:...", max_results: 5 }) call before Step 1 runs. Step also defines the failure contract: if any of the five schemas are missing from the returned <functions> block, the MCP server is genuinely unregistered — STOP and report, do NOT fall back to gh pr create (the guard blocks it anyway). Prevents the previous-session deadlock where the pipeline was never entered because Claude assumed the tools were absent
• plugins/devops/hooks/pre-tool-use/pre.ship.guard.js bumped to 0.3.0 — block message for manual PR creation/merge now includes the exact ToolSearch recovery query with all five ship_* tool names pre-filled, plus a pointer to deep-knowledge/mcp-deferred-tools.md. Hook behaviour (Bash-only, regex patterns) unchanged; only the stderr message grew more helpful

---

Install: /plugin marketplace add Jerry0022/dotclaude

v0.60.0

Added

• plugins/local-llm/mcp-server/index.js — local_generate gains an optional instructions parameter so Claude can attach task-specific guidance (style, library choice, output shape, naming conventions, "no thinking output", etc.) without the plugin needing to re-bake a static base prompt. Instructions are appended to the existing base system prompt under a clearly delimited Additional task-specific instructions: section; the base prompt itself stays the SSOT for output discipline (no fences, no commentary)

Fixed

• plugins/local-llm/mcp-server/index.js — reasoning models (qwen3-vl, deepseek-r1, etc.) inline a <think>…</think> block at the start of content when reached via AnythingLLM's OpenAI-compat endpoint (the API does not split the block into a separate reasoning field). Generated code returned to Claude was therefore prefixed with the model's chain-of-thought, which broke direct use of the output in Write calls. New stripThinkingBlock() removes all <think> and <thinking> blocks (case-insensitive, multiple occurrences), composed via sanitizeOutput() together with the existing stripOuterFence(). Base prompt now also explicitly forbids <think> blocks as a belt-and-braces hint to compliant models
• plugins/local-llm/hooks/lib/anythingllm-http.js — COMPLETION_TIMEOUT_MS raised from 120s to 300s. Reasoning-heavy 8B models with thinking overhead routinely take 90–180s for outputs above ~300 tokens even when AnythingLLM correctly forwards to Ollama, hitting the previous timeout for tasks that perfectly fit the delegation criteria (e.g. a 25-test Vitest file). 300s leaves headroom for cold-start model load (~10s) plus thinking + answer generation at the typical 6–8 tok/s of qwen3-vl:8b

---

Install: /plugin marketplace add Jerry0022/dotclaude

v0.59.0

Added

• plugins/devops/deep-knowledge/test-strategy.md — three new SSOT sections covering previously ambiguous testing territory. (1) Web Tech → Always Browser-Test (Mocks OK) makes browser verification mandatory for any change that touches browser-renderable code (HTML/CSS/JS framework files, UI deps, static index.html) — mocks for missing backends are expected, no "browser not needed" exit. Closes the gap where an Electron app was classified as "no web tech" and skipped verification. (2) Electron / Native UI — Dev-Browser + User-Final-Test splits testing: renderer-level via mounted HTML in Edge with mocks during dev, packaged-app final test only via computer-use when the user chose "Desktop übernehmen", otherwise flagged in the completion card. (3) Third-Party Integrations — Mock-First + User-Final-Test requires automated mock tests (MSW/nock/fixtures) for integration shape, then always flags the real-world validation as user-final-test-required-after-deployment. Mock step is never a substitute for the real step
• plugins/devops/mcp-server/index.js + plugins/devops/templates/completion-card.md — new userFinalTest input for render_completion_card (array of strings or { action, afterDeployment } objects). Renders a unified 🧑 TESTE bitte noch: (DE) / 🧑 Please TEST: (EN) block in Block A of all variants except test-minimal, with a per-bullet — nach Deployment / — after deployment suffix for 3rd-party items. Wording matches the existing CTA style (imperative CAPS verb + casual tone)
• plugins/devops/deep-knowledge/test-strategy.md Completion-Card Handoff section — explicit contract that any caller of render_completion_card (inline Claude, agents, /devops-autonomous) must populate userFinalTest when Electron-packaged or 3rd-party rules apply. This is the only signal the user sees about work automation could not cover

Changed

• plugins/devops/deep-knowledge/agent-orchestration.md QA-Wave testing protocol — expanded from 4 to 6 rules. Rule 3 references test-strategy's Web-Tech-Always rule instead of duplicating it. New rule 4 (Electron/Native UI) and rule 5 (3rd-party integrations) map directly to the new test-strategy sections. Rule 6 (computer-use restriction) unchanged in spirit but now carves a clean exception for packaged-Electron final tests under desktop takeover. QA agent prompt template now instructs QA to emit userFinalTest items for forward-propagation to the completion card
• plugins/devops/skills/devops-autonomous/SKILL.md Step 3b — browser probing is now mandatory when any web-tech gate signal is true, including Electron/Tauri renderers. Removes the previous [--] Browser nicht benötigt (Electron-App) misclassification. Step 5 Live Testing and Step 7a Gather Completion Data both instruct forwarding userFinalTest items from QA to the completion card
• plugins/devops/agents/qa.md + plugins/devops/agents/frontend.md — responsibilities updated to reference the new Web-Tech-Always rule; QA output schema gains a structured userFinalTest field that is forwarded 1:1 to render_completion_card (orchestrator must not rename or drop it)

---

Install: /plugin marketplace add Jerry0022/dotclaude

v0.58.1

Fixed

• plugins/devops/mcp-server/index.js + plugins/devops/scripts/refresh-usage-headless.js — usage card now surfaces scraper login status instead of silently serving stale data. The MCP server's refreshUsage catch-block propagates the scraper exit code: on 2 (not logged in) the cached usage JSON is tagged with _loginRequired: true and renderUsageMeterForCard renders a prominent ⚠ Scraper not logged in — Edge login window opened, log in once warning. Previously the failure path fell through silently and consumers saw day-old "cached" data with no indication that a one-time login was needed. The scraper itself now detects logged-out state even when claude.ai does not redirect away from /settings/usage: checks for email input fields and login-button text in the page body, and after the 24s poll window treats any "no <main> element" result as logged-out (the most common cause) rather than as a generic parse error
• plugins/devops/mcp-server/index.js renderUsageLine — both usage bars are now the same total length regardless of reset-time width. resetStr is padded to a fixed 7 chars (matches 23h 59m, the widest possible value), and the trailing left label is removed — redundant given the Xh Ym / Xd Yh format already implies duration. Previously a 5h reset like 30m and a Wk reset like 1d 17h produced visibly different line lengths

---

Install: /plugin marketplace add Jerry0022/dotclaude

v0.58.0

Changed

• plugins/devops/scripts/refresh-usage-headless.js + plugins/devops/skills/devops-refresh-usage/SKILL.md + plugins/devops/mcp-server/index.js + plugins/devops/skills/devops-burn/SKILL.md — usage scraper no longer restarts the user's Edge browser. Previous flow (taskkill /IM msedge.exe + --restore-last-session) killed every Edge window to gain CDP access, then rebuilt the session. Replaced with a dedicated, isolated Edge instance under ~/.claude/edge-usage-profile with its own user-data-dir and CDP port — spawned headless on demand, persisted between invocations for silent CDP reuse, killed only by its own PID tree. The user's main Edge (windows, tabs, cookies) is never touched. First run requires a one-time visible login to claude.ai in the scraper profile; cookies then persist and all subsequent scrapes run invisibly in the background. mcp-server/index.js::refreshUsage collapsed from a ~130-line CDP escalation chain to a single execSync call now that the script manages its own lifecycle. Removed obsolete --auto-start / --activate-cdp flags and exit codes 6/7; new exit code 2 (not logged in) opens a visible login window and is surfaced inline to the user

---

Install: /plugin marketplace add Jerry0022/dotclaude

v0.57.0

Changed

• plugins/devops/skills/devops-concept/SKILL.md + deep-knowledge/templates.md + deep-knowledge/validation-gate.md — concept skill reorganised around three explicit page templates with strict ordered auto-selection (prototype → decision → free). decision is the canonical multi-variant flow (sidebar layout + bi-state eval per variant); prototype is a fullscreen single-screen click-dummy with overlay decision panel (☰, FAB right) + collapsible feedback dock (💬, bottom) holding a context-sensitive per-screen textarea and a persistent general-notes field; free is a Claude-authored freeform body with opt-in bi-state per section. Content variants (analysis, plan, concept, comparison, dashboard, creative) are now scoped under the decision template as sub-structures, not separate page templates
• plugins/devops/skills/devops-concept/SKILL.md Step 5b — tri-state "Exakt diese / only" collapsed to bi-state (Verwerfen / Miteinbeziehen). collectDecisions() now emits an explicit action: "iterate" | "implement" field driven by two separate submit buttons. The primary "Zur nächsten Iteration" button NEVER causes code changes — it only feeds feedback into the next concept iteration. The secondary "Mit Feedback implementieren" button (warning-colored, separated by a mandatory 2rem gap, confirm dialog) is the only path that triggers real file/code changes. This removes the old "Claude setzt um" ambiguity on individual evaluation options

Added

• plugins/devops/skills/devops-concept/deep-knowledge/templates.md — connection-overlay now has two states: an accent-pulsing "Claude verbindet sich" overlay shown during the 30s grace period after page load, and a warning-colored "Claude ist nicht verbunden" overlay once the heartbeat stays stale past grace. Overlay uses pointer-events: none so the submit buttons remain clickable — clicks queue in localStorage and auto-deliver on reconnect. Wording matches the actual behaviour ("Klick wird gespeichert", not "Submit pausiert")
• plugins/devops/skills/devops-concept/SKILL.md Step 2 Localisation — explicit mandate: read [ui-locale: xx] hint, set <html lang="{locale}">, pull every user-facing string from the expanded UI locale table in templates.md. If the user's locale is not yet a column, Claude translates all keys inline AND appends the column to templates.md so the next session has it cached
• plugins/devops/skills/devops-concept/deep-knowledge/templates.md — prototype template new mechanics: fullscreen body with exactly one <section data-screen> visible at a time, screen-nav in the ☰ panel, click-dummy wiring via data-screen-link="next|prev|{screen-id}", per-screen textareas stay in the DOM (only active one shown) so each screen's notes persist independently. Feedback dock closes on outside click; general-notes textarea stays visible across all screens
• docs/concepts/2026-04-21-template-example-{decision,prototype,free}.html — three reference example pages exercising the full new stack (bi-state eval where applicable, dual-action submit, connecting/disconnected overlay, click-dummy with screen navigation, localisation scaffolding)
• plugins/devops/skills/devops-concept/deep-knowledge/validation-gate.md — gate now enforces 20 shared patterns (adds submit-iterate-btn, submit-implement-btn, connection-connecting) plus template-specific patterns per decision/prototype/free

---

Install: /plugin marketplace add Jerry0022/dotclaude

v0.56.1

Fixed

• plugins/local-llm/hooks/session-start/ss.llm.deps.js — the deps hook now verifies that @modelcontextprotocol/sdk and zod are actually resolvable inside mcp-server/node_modules before skipping install. The previous "real directory → skip" branch let a partial/corrupt install pass, which silently broke the MCP server (ERR_MODULE_NOT_FOUND at startup, no PID file, tool invisible to Claude) while the health hook still emitted phase: ready. When a corrupt real-dir is detected, it's now replaced with a junction to the authoritative PLUGIN_DATA/node_modules. REQUIRED_DEPS list lives at the top of the file so new runtime deps can be added in one place

Changed

• plugins/devops/deep-knowledge/local-llm-delegation.md + plugins/local-llm/deep-knowledge/delegation-rules.md — tightened the delegation thresholds based on real-session calibration. Output gate moved from >20 to >60 lines of near-pure boilerplate: the previous threshold didn't cover prompt construction + review-pass overhead. Promoted the real sweet spots (seed/migration dumps, i18n/translation expansion, fixtures, repetitive variations, DTOs from schema) to the top of the GREEN matrix — they dominate the output_size / spec_size leverage curve. Made "code review" an explicit RED entry with rationale: 7B produces generic noise ("consider error handling", "add types") that costs more context to process than it saves. Added an economics section explaining why break-even is higher than it looks

---

Install: /plugin marketplace add Jerry0022/dotclaude