chore: harden plugin operations and diagnostics

[amavashev]

Summary

• add a secret-safe /cycles-budget-guard:doctor command backed by the production configuration parser
• expand CI to Node 22/24 on Ubuntu, Windows, and macOS, plus strict plugin and marketplace validation, metadata consistency, and isolated installation smoke tests
• add scheduled public-repository validation/install testing, companion MCP version monitoring, Dependabot, CODEOWNERS, security guidance, issue forms, architecture, quickstart, denial proof, and troubleshooting
• prepare the coordinated v0.2.0 metadata and changelog update

Self-review remediation

• keep only exact Cycles MCP namespaces available when enforcement configuration is invalid; namespace lookalikes remain gated
• require HTTPS for non-loopback Cycles endpoints and reject query/fragment-bearing base URLs, including empty delimiters
• never follow redirects with X-Cycles-API-Key; treat 3xx reserve responses as authoritative denials instead of fail-open outages
• document the exact subject-field, environment inheritance, skip-list, fail-open, and privacy behavior, including Bash/zsh and PowerShell setup
• keep PR validation pinned to Claude Code 2.1.217 while scheduled compatibility testing strictly validates both manifests against the current release
• enforce package/plugin/marketplace/repository/issue-template metadata consistency and bound smoke, CI, and monitor execution time

Repository settings already applied

• protect main with pull-request, required-check, strict-up-to-date, and conversation-resolution requirements
• prevent force pushes and branch deletion while preserving administrator emergency bypass
• enable automatic deletion of merged branches and Dependabot security updates

Validation

• npm run lint
• npm run test:coverage — 81 tests; 96.24% statements, 92.50% branches, 100% functions, 97.46% lines
• npx --yes @anthropic-ai/claude-code@2.1.217 plugin validate .claude-plugin/plugin.json --strict
• npx --yes @anthropic-ai/claude-code@2.1.217 plugin validate .claude-plugin/marketplace.json --strict
• npm run smoke:install
• RELEASE_TAG=v0.2.0 npm run check:metadata
• npm audit --audit-level=moderate — 0 vulnerabilities
• YAML parsing, actionlint, live documentation-link and heading-anchor checks, and git diff --check

Notes

The doctor command never prints the API-key value and never adds a gate bypass. Exact Cycles tools remain the recursion-safe diagnostic path. Default fail-open behavior remains limited to 5xx responses, network failures, and the four-second timeout; invalid configuration, malformed responses, 3xx responses, and authoritative 4xx responses deny non-Cycles execution.

[amavashev]

Reviewed with independent verification of every claim (same account, so a comment rather than a formal approval). LGTM — this is a genuine hardening pass, and every stated claim checks out.

Verified by execution on the branch:

• 81/81 tests, coverage thresholds met (statements 96.24%, lines 97.46%), lint clean — reproduced locally with bare exit codes
• RELEASE_TAG=v0.2.0 npm run check:metadata, strict plugin + marketplace validation: all exit 0
• Branch protection matches the 'already applied' section exactly: 9 required checks (including the new macOS legs and Validate Claude plugin), strict up-to-date, conversation resolution, no force pushes

Verified by inspection:

• Doctor is secret-safe as claimed: outputs apiKeyConfigured boolean only; base URL/subject/unit are non-secret routing data. No gate bypass added.
• redirect: "manual" is the right call — the API key never follows a redirect, and a 3xx lands in the authoritative-deny path (status < 500) rather than fail-open. Note the intentional consequence: an http→https upgrade redirect from a proxy now denies — consistent with the new HTTPS-required policy.
• Empty-delimiter URL check (value.includes("?")) correctly catches http://x? where parsed.search is empty — a real gap in the previous validation.
• Exact-namespace early return before config parsing restores the diagnostic path under invalid config (previously my loud-deny blocked even the tools needed to FIX the config) while lookalikes still flow through gating — the regex is exact, so mcp__bicycles__* remains gated.
• Malformed-input guard sits after isConfigured, so dormant setups stay silent while configured ones deny on garbage — consistent with the exit-2 entry behavior.
• All new workflow actions SHA-pinned; no untrusted ${{ github.event.* }} interpolation.

Minor observations, non-blocking:

1. The loopback matcher admits localhost/[::1]/dotted-quad 127.x.x.x but not shorthand spellings like 127.1 — stricter is fine, just worth knowing if a dev hits it.
2. v0.2.0 metadata is staged pre-merge while main is 0.1.1 — fine for a merge-then-tag flow; just tag promptly after merge so check:metadata and the pinned AUDIT links stay coherent.

All 10 PR checks green. Ready to merge; after merge + v0.2.0 tag, the directory listing auto-mirrors the update.