Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

docs(conventions): limit which route rows a routing-as-data team file may add

Aperta
  • Qualcosa non va?
#6,642 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
Mezza giornata
Idoneità per principianti
35/100
Tipo di issue
Documentazione
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
json, yaml
Ambito
authorization, documentation

Direzione di ricerca

Start in the Team layer section of docs/conventions/routing-as-data/README.md, where routing.rows and the kind: tool row are described, and read the team-file JSON Schema guidance and the convention CHANGELOG policy next. Done means the section states which row ids a team file may re-rank or add, excludes new kind: tool rows, the schema guidance matches, and a CHANGELOG entry records the right version bump. The DX lane (#6302) must co-sign, so expect to resolve the bump and wording with maintainers first.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

needs-human needs-triage

Problem

The routing-as-data convention (docs/conventions/routing-as-data/README.md, Team layer, added in
#6640) lets a consumer repo's <home>/<plugin>.yaml add route rows through routing.rows. A
kind: tool row has a free-form id, and /user-interface:design says "for a tool route, call that
tool". If an adopter implements the team layer as written, a cloned, untrusted repo can add a row
that steers the agent at any tool or skill. The doc frames the team file as data, but an added row
is more than look and conventions.

Nothing reads a team file yet, and every tool call still passes the session's permissions, so there
is no exposure today. The limit should be in the convention before the first adopter implements the
team layer.

Source: the security review run before #6640 was marked ready (OWASP A04 design note, medium
confidence, prospective).

Proposed change

State in the Team layer section that routing.rows may only re-rank or add rows whose id matches a
bundled row or an installed plugin or skill, and that a team file may not add a new kind: tool
row. Add the matching rule to the team-file JSON Schema guidance. The rule decides whether the doc
needs a major or minor version bump, per its CHANGELOG policy.

Acceptance criteria

  • The Team layer section states which rows a team file may add, and excludes new kind: tool rows.
  • The convention CHANGELOG records the change with the right version bump.
  • The DX lane (#6302) co-signs, since it adopts the same team layer.

Related

  • #6640 (adds the convention), #6483 (its issue)
  • #6302 (DX), #6306 (user-experience), #5906 (customization home)
Lingua principale
Shell
Stelle
22
Fork
2
Merge medio
7h 8m
PR unite (30g)
874

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di melodic-software/claude-code-plugins

Tutte le issue di melodic-software/claude-code-plugins

Issue simili

Altre issue su Shell/Bash

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.