[Bakhomious]

Step plugin-check (docs/plan.md §0): baton checks the plugin's folder before each copilot starts, so that a role can't turn the guard off for the panes that start after it (risk 12). It follows the orchestrator's trust-gap note on #34: plugin.write reused an existing plugin-<hash> folder without looking at its files.

What it does

Decision 53:

• plugin.Write uses a folder that has the plugin's name only if it is a real folder (not a symlink to one) and its files hash to the plugin's: paths in the folder and contents, as the binary's are hashed. A folder with a changed, extra or missing file, or with anything but folders and regular files (a symlink, say), and anything else under the name, stays as it is.
• The plugin then goes under the next name, plugin-<hash>-1 up to -7; with all eight taken, the pane fails and says why. baton never replaces a folder (Go's os.Rename refuses to), so a starting copilot never finds the folder missing and goes on without hooks and with the default agent (risk 10). Panes that start at once converge on the same new name.
• A role's pane writes the plugin again after its wait, just before it becomes copilot. A failure there leaves the work picked up, as a copilot that fails to start does (decision 38).
• baton hook guard denies a role's create and edit in baton's cache folder, as in baton's folder, and fails when it can't find the user's cache folder.

The hash format changed (paths relative to the folder, regular files only), so the plugin's folder name changes once.

Checks

• Tests: changed_test.go (8 kinds of change, each giving -1 and keeping the changed folder as the role left it, and many panes at once after a change), the keep test (same folder, same inode), recrafted hash pairs, refusal rows (a symlink in the tree, a name too long for the disk, a file at each of the 8 names); the guard's cache rows × create/edit and its failure without a cache folder; the pane's re-check after the wait and its failure. internal/plugin 100%, internal/cli 99.8%, total 99.3%.
• Probes: 19 mutants, all caught.
• Smoke with the built binary, a temp HOME and a stand-in copilot, no tmux: the first pane gets plugin-<hash>; after a change to hooks.json, -1, and -1 again; the changed folder stays as it was; the guard denies an edit of -1's hooks.json with the cache reason, says nothing for a repo file, and fails without HOME.

Known gaps

bash can still change the plugin's files after a pane's check, while its copilot starts or runs, or through a hard link (risk 2, for belt). Changed folders stay in the cache. A Finder .DS_Store in a folder costs one more folder.

Decision 53 is a lead's call, flagged for the end review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud