rkd/claude-plugins
Watch
3
0
Fork
You've already forked claude-plugins
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(rkd): keep the sign-in token out of transcripts; name the MCP server chat #4

Merged
dozken merged 1 commit from fix/no-token-in-status-and-chat-server into main 2026-09-20 15:12:23 +02:00
Conversation 0 Commits 1 Files changed 10 +36 -19
dozken commented 2026-09-20 15:05:24 +02:00
Owner
Copy link

Summary

Two fixes to the 0.2.x plugin, found while testing it:

  1. The sign-in token no longer ends up in transcripts. /rkd:configure's status step told Claude to read .env, which holds the host token. In one real run Claude read it directly after Bash was denied, so the token sat in that session's context. Status now uses the plugin's status tool, falling back to grep -c for a count. The skill and the channel's own instructions both say never to open that file, and the skill no longer lists Read.
  2. The MCP server is named chat, not rkd. Claude Code names tools mcp__plugin_<plugin>_<server>__<tool>, so plugin rkd + server rkd gave mcp__plugin_rkd_rkd__reply. It is now mcp__plugin_rkd_chat__reply and the allow rule is "mcp__plugin_rkd_chat".

Version 0.2.2. Follow-up to #3.

Type of change

  • Bug fix
  • New feature
  • Refactor / cleanup (no user-visible change)
  • UI / UX
  • Build, CI, or tooling
  • Docs

Test plan

Automated:

  • pnpm test (83), pnpm typecheck, pnpm check:dist, Node 20 handshake smoke, claude plugin validate --strict

Manual:

  • Ran /rkd:configure headlessly (claude -p --output-format stream-json) and searched the whole event stream for this machine's token: 0 occurrences, on Haiku and on Sonnet. Sonnet called the status tool and answered correctly; the tool calls contain no read of .env
  • Restarted the channel session on 0.2.2: it registers as plugin:rkd:chat, and an @claude_code request is answered with no approval prompt, so the migrated allow rule works

Review checklist

  • No secrets, tokens, or personal URLs added
  • README and skill updated

Migrations and breaking changes

Anyone who allowed mcp__plugin_rkd_rkd must change the rule to mcp__plugin_rkd_chat, or every reply asks for approval again. Only us so far, which is why this is done now.

Notes for the reviewer

  • Haiku ignored the status tool and invented a rkdh login command in one run; Sonnet followed the skill. Worth knowing if someone runs the skill on a small model.
  • The skill's fallback is one plain grep -c with the resolved path. A compound command with || and variables was denied in headless mode, and the model then wrongly concluded "not signed in".

https://claude.ai/code/session_01GdkP2Y3vcxcGz5XCFFWW16

## Summary Two fixes to the 0.2.x plugin, found while testing it: 1. **The sign-in token no longer ends up in transcripts.** `/rkd:configure`'s status step told Claude to read `.env`, which holds the host token. In one real run Claude read it directly after Bash was denied, so the token sat in that session's context. Status now uses the plugin's `status` tool, falling back to `grep -c` for a count. The skill and the channel's own instructions both say never to open that file, and the skill no longer lists `Read`. 2. **The MCP server is named `chat`, not `rkd`.** Claude Code names tools `mcp__plugin_<plugin>_<server>__<tool>`, so plugin `rkd` + server `rkd` gave `mcp__plugin_rkd_rkd__reply`. It is now `mcp__plugin_rkd_chat__reply` and the allow rule is `"mcp__plugin_rkd_chat"`. Version 0.2.2. Follow-up to #3. ## Type of change - [x] Bug fix - [ ] New feature - [x] Refactor / cleanup (no user-visible change) - [ ] UI / UX - [ ] Build, CI, or tooling - [x] Docs ## Test plan Automated: - [x] `pnpm test` (83), `pnpm typecheck`, `pnpm check:dist`, Node 20 handshake smoke, `claude plugin validate --strict` Manual: - [x] Ran `/rkd:configure` headlessly (`claude -p --output-format stream-json`) and searched the whole event stream for this machine's token: **0 occurrences**, on Haiku and on Sonnet. Sonnet called the `status` tool and answered correctly; the tool calls contain no read of `.env` - [x] Restarted the channel session on 0.2.2: it registers as `plugin:rkd:chat`, and an `@claude_code` request is answered with no approval prompt, so the migrated allow rule works ## Review checklist - [x] No secrets, tokens, or personal URLs added - [x] README and skill updated ## Migrations and breaking changes Anyone who allowed `mcp__plugin_rkd_rkd` must change the rule to `mcp__plugin_rkd_chat`, or every reply asks for approval again. Only us so far, which is why this is done now. ## Notes for the reviewer - Haiku ignored the `status` tool and invented a `rkdh login` command in one run; Sonnet followed the skill. Worth knowing if someone runs the skill on a small model. - The skill's fallback is one plain `grep -c` with the resolved path. A compound command with `||` and variables was denied in headless mode, and the model then wrongly concluded "not signed in". https://claude.ai/code/session_01GdkP2Y3vcxcGz5XCFFWW16
fix(rkd): keep the sign-in token out of transcripts; name the MCP server chat
All checks were successful
CI / rkd-plugin (pull_request) Successful in 33s
Details
b0b3c33614 
/rkd:configure's status step told Claude to read .env, which puts the
host token into the session transcript (seen in practice: the model read
the file when Bash was denied). Status now uses the plugin's status tool,
falling back to `grep -c` for a count, and the skill and the channel's
own instructions both say never to open that file. The skill pre-allows
the status tool so it doesn't prompt, and no longer lists Read.

Renamed the MCP server from rkd to chat. Claude Code names tools
mcp__plugin_<plugin>_<server>__<tool>, so plugin rkd + server rkd read
as mcp__plugin_rkd_rkd__reply. It is now mcp__plugin_rkd_chat__reply, and
the allow rule is "mcp__plugin_rkd_chat". Done now because nobody else
has 0.2.x installed, and changing tool names later would break their
permission rules.

Claude-Session: https://claude.ai/code/session_01GdkP2Y3vcxcGz5XCFFWW16
dozken merged commit 6070bb7e51 into main 2026-09-20 15:12:23 +02:00
dozken deleted branch fix/no-token-in-status-and-chat-server 2026-09-20 15:12:23 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rkd/claude-plugins!4
No description provided.