v2 hardening: shared-state locking, generated slash commands, name validation, version normalization

[d6veteran]

Closes all five findings from an adversarial review of the codebase. Each was delegated to the persona whose lane it sits in, working from profiles installed through the documented git clone + bash install.sh path.

Tests: 136 → 163. shellcheck clean.

1. The parallel-sessions feature was losing data (the important one)

~/.claude/branches/INDEX.md and ~/.claude/CLAUDE.md are shared across every session on the machine, and nothing serialized writes to them. Measured at 40-way concurrency, five runs, every run lost data: 23–29 of 40 rows survived, 5–8 of 20 status updates applied. An independent 12-way probe reproduced it at 8/12.

Two things the review got wrong, both caught by Akira:

The review reasoned that >> appends in branch start were safe because POSIX makes an O_APPEND write atomic. That reasoning is correct and irrelevant. The appends were never torn — they were erased, by a rewriter's rename landing after their append. Atomicity of an append says nothing about its survival. That's why the appenders need the lock too.

The review also never looked at CLAUDE.md. block_install greps for its start marker, misses it against an unlanded concurrent write, takes the append path, and writes a duplicate block. Two of five runs produced up to four CLAUDE-TEAM blocks, after which get_active reads a corrupted awk range.

Approach: mkdir directory lock. flock is absent from stock macOS, and a flock-with-mkdir-fallback design doesn't exclude itself, so a host with mixed invocations silently loses mutual exclusion — with the fallback running only on the platform CI doesn't cover it. Accepted cost is owning liveness: EXIT/INT/TERM traps, a dead-PID rule, and a 120s ceiling for the reboot/PID-reuse case.

Verification beat reasoning twice in the same change. The first implementation treated "no owner record" as stale. Every live holder passes through that state between its mkdir and its record write, so contenders broke live locks 73 times per run. It also treated "no lock directory" as stale, so contenders removed directories other contenders had just created. Review caught neither; the harness caught both.

Also fixed in passing: awk > tmp && mv reported success when awk failed (set -e exempts a failing command in an && list), so branch done printed "marked as merged" without changing the index.

2. commands/ is now generated

It was hand-maintained while ~95% derivable, and the drift test already contained the transformation as a checker. Now a generator. Profiles gained a ## Greeting section — the only non-derivable part — excised from the subagents.

Alex overruled the brief here, correctly. Offered a choice between extending generate-agents.sh and adding a sibling script, he extended it: claude-team sync and install.sh both invoke that one script, so a sibling would never run on either path and sync would install a slash command lagging the edit that triggered it.

Verified byte-identical: 11/17 exact, 6 differing by one deleted blank line — precisely the files commit 6d9bb89 hand-synced.

3. Name validation (downgraded, then fixed anyway)

Morgan rated the path traversal Low / Informational as a vulnerability and refused to inflate it: the CLI runs as the invoking user, reads with that user's permissions, and appends .md, so every reachable file is one the caller can already cat.

He fixed it on correctness grounds instead. use ../gtm exited 0, printed a success line with an empty name, and pinned a non-profile into ~/.claude/CLAUDE.md where every future session reads it. That's the real defect, and it's what the tests assert.

He also checked sanitize_branch_for_path, found git's check-ref-format already rejects .., and left it alone — a control reducing no risk is a liability.

4. Greeting kept out of the global pin

## Greeting in profiles meant claude-team use akira wrote "Greet the user briefly as Akira" into the global pin, so every new session would greet forever. Excised from use, deliberately kept in launch: use pins a default, launch starts a session, and that's the moment a greeting is for.

5. Version normalization

plugin.json said 0.7.0, README said v0.6 (current), ROADMAP said Shipping Now — v0.6. Now 2.0.0 throughout.

Toni put the major bump where the break actually is: v0.7 carried a behavioral breaking change (slash commands stopped writing ~/.claude/CLAUDE.md), and today's three merges finish that arc. No v1 release is fabricated — the repo has zero git tags, so v1 is presented as the first generation, not a dated release. The April roadmap row still reads "v0.6 shipping" and stays verbatim.

Also corrected: the "82-test suite" claim had been wrong since early July (DEVLOG's own v0.7 entry already said 98).

Not fixed, deliberately

The CLI symlink into the clone. If the clone moves, the CLI and hook break loudly — and loud is correct. The install genuinely is broken, bash install.sh repairs it, and silencing it would hide real breakage. The symlink buys git pull updating the CLI with no reinstall.

Mistakes made and recorded

• I broke CI lint and shipped it in 00b82aa — three shellcheck findings in tests/run.sh, two a bare done read as a loop terminator. The rest of the suite already quotes "done". Morgan caught it from an adjacent file.
• Morgan's suggested fix for one was wrong — quoting ${spec%%:*} would pass coordinator on as one argument and break the test. Right finding, wrong fix, which is the argument for verifying a subagent's patch rather than applying it.
• A control test passed for the wrong reason. The first attempt to prove the traversal tests meaningful ran against a scratch tree without gtm.md, so the traversal resolved to nothing and everything passed on unfixed code. The suite now asserts the target exists first.

Dogfooding note

Installing the team validated the same-day install fixes end to end. It also surfaced a gap: Claude Code registers subagent types at session start, so seventeen freshly installed agents were invisible to the running session — while the installer prints "Subagents installed (delegate with...)" as though they're live. install-commands correctly says slash commands need no restart. The one that does need a restart is the one that doesn't say so. Not fixed here; worth a one-line installer change.

---

Generated by Claude Code