[kyle-sexton]

Closes #11980

Summary

Under claude plugin eval, the sandbox denies Grep and Glob on a plugin's own directory, and the design skill searched there for its settings and for animation techniques. Those denials made both sides of #11549's round 2 INVALID. This change has design reach plugin files only by the paths it and concerns.json name, and says where its settings live when detect cannot run.

Fix

• plugins/user-interface/skills/design/SKILL.md (Gotchas): with no shell or no node, take every resolved setting from reference/defaults.yaml; reach plugin files only by named paths, never Grep or Glob the plugin's directory, search the project instead.
• plugins/user-interface/reference/animation/catalog.md: one sentence after the opening says the resolved animation: config is detect's config.values.animation, or the animation: block of reference/defaults.yaml when detect cannot run.
• .changes/user-interface/fix-11980-plugin-root-search-9b2d4e17.md.

Verification

Decision rule written before any run. Sides: plugins/user-interface at main, and this branch. Cases: the four whose #11549 round-2 traces held plugin-root denials, with the design skill named in the prompt, identical on both sides. Glob and Grep allowed; claude plugin eval --runs 3 --scaffold --ablation none --judge-model opus, Claude Code 2.1.316.

case	base: plugin-root searches, mean	head: plugin-root searches, mean
accessibility-mobile-nav-drawer	0, 1.00	0, 1.00
motion-spokes-via-design	2, 1.00	0, 1.00
theming-dark-mode-toggle	1, 1.00	0, 1.00
web-expand-content-height	2, 0.89	0, 1.00
gate (run-validity.py --runs 3 --scaffolded)	INVALID, 5 denials	VALID, 0 denials

The first candidate banned only settings searches and left one technique search (accordion|interpolate-size|...) denied; an amendment recorded before the second run widened the gotcha to every plugin-root Grep or Glob, and the head column is that second run. check-skill.sh passes design (0 errors; its existing length warnings plus a 2-line growth warning).

Related

• user-interface: back the design spoke cap with observed evidence or remove it #11549 (the eval this blocked)
• fix(evals): let run-validity gate a base side whose unfired runs are the measured change #11979 / fix(evals): let run-validity gate a base side whose unfired runs are the measured change #11982 (the other eval-validity fix from the same work)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T16:52:36.437574Z	d951f7d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed c839eed57b41e482792f432beaa0035396537d77: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Security review (incremental, d951f7d..c839eed)

No security issues found.

What changed

• plugins/user-interface/skills/design/SKILL.md: the rule "Never Grep or Glob the plugin's directory" now reads "Never Grep or Glob the plugin's root". It also lets the skill list one named directory, ${CLAUDE_PLUGIN_ROOT}/reference/types/.
• .changes/user-interface/fix-11980-plugin-root-search-9b2d4e17.md: the changelog line now says "root" to match.

Instruction-surface check. The skill change loosens a standing instruction slightly, so I checked it by what it does. The rule controls where the design skill looks for its own reference files, and it exists so eval runs stop hitting the sandbox's search denials. It is not a guardrail on a destructive, credential, publishing or trust action. Without it, the skill can list one read-only reference directory inside its own installed plugin. That reaches no secret, token, outside service or write path. The rule against searching the plugin root broadly still stands, and searches still go to the project. I did not consult the instruction exception register file because nothing in this change comes near its protected classes.

• Untrusted content: the PR context contains no text addressed to the review lane.
• Not in scope for this change: no workflow, token, trusted-actor, kill-switch, merge-hold or plugin-manifest file changed in this increment.
• Neither changed file matches a trusted path.

critical-findings: 0

[github-actions]

claude-review: 1 inline finding(s) on d951f7dc68cff96fd077c9775b7346ef4c542d47; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed c839eed57b41e482792f432beaa0035396537d77: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Incremental review (d951f7d → c839eed): no findings

I read every hunk of both files in scope: .changes/user-interface/fix-11980-plugin-root-search-9b2d4e17.md and plugins/user-interface/skills/design/SKILL.md. I used the full PR diff and the PR context only for background.

What changed

• The design skill's Gotchas line used to say "Never Grep or Glob the plugin's directory". It now says "the plugin's root". It also adds that the only directory the skill may list is the one it names, ${CLAUDE_PLUGIN_ROOT}/reference/types/.
• The changelog fragment now says "root" too, so it matches the skill.

Assessment

• This removes a real conflict. Step 3 (SKILL.md#L69) tells the model to "List ${CLAUDE_PLUGIN_ROOT}/reference/types/". The old wording banned any Grep or Glob of the plugin's directory, which would also have blocked that listing. With the narrower wording, the gotcha and Step 3 agree.
• It also fits issue fix(user-interface): stop plugin-root Grep and Glob denials from voiding design-skill evals #11980's problem statement. That issue says the eval sandbox denies Grep and Glob on the plugin root, but allows "Read of named plugin files and Glob of plugin subdirectories". So listing the named reference/types/ subdirectory doesn't bring back the denial this PR fixes.
• The fragment stays at bump: patch, which fits a wording fix to guidance.

Closing issue #11980

• Criterion 1 ("the user-interface skills stop searching their plugin root (they read the paths concerns.json and routing.json name)"): the new gotcha states this, and the narrowing doesn't weaken it.
• Criterion 2 (a design-skill eval with Glob and Grep available gates without plugin-root denials): the PR body reports VALID with 0 denials. That is the author's claim and I could not check it here. The verification table also shows an earlier run, before this incremental narrowing; I can't confirm the head-column run used this exact wording. No test in the repository would fail if this guidance regressed, but the gate is an eval run, not a unit-testable behavior, so I'm not reporting it as a separate finding.

No plugin manifests changed. Neither file in scope matches a trusted-path glob. I found no embedded directives in the PR context.