Claude Code plugin + --version + install.sh checksum-safety (v4.1.0), reconciled onto v4.0.0

[JordanCoin]

What this is

The novel half of an April "v3.3.0" effort, reconciled onto the v4.0.0 security release rather than merged blindly. Most of the original branch's security content turned out to be redundant with (or weaker than) the parallel v4.0.0 hardening that landed via #64/#65, so it was dropped. What remains is what v4.0.0 doesn't have.

What's new (not on main)

• Claude Code plugin — .claude-plugin/marketplace.json, plugin/** (manifest, README, four /foia-* commands, skills/openfoia/SKILL.md). Lets a human install the CLI + an agent copilot that knows every command. Every documented openfoia … invocation was validated against the live v4.0.0 CLI.
• --version / -V — root CLI callback wired to openfoia.__version__ (v4.0.0 had none).
• openfoia graph … --no-text + a plaintext-export warning — graph HTML embeds full document text; this makes omitting it a choice and warns when it's included.
• install.sh asset-name anchor — v4.0.0 greps browser_download_url.*${name} unanchored; once glyph-api ships .sha256 assets this can match the checksum file as the binary. Now an anchored grep -Eo on the exact asset name. Simulated against a release JSON with both assets → selects only the binary.
• test_plugin.py (plugin drift test) + test_security.py (graph-escape / offline-UI, adapted to v4.0.0's stricter escape).
• Housekeeping: bump → 4.1.0, pyyaml in dev, CHANGELOG.md, air-gap web-UI note, untrack generated test_graph.html.

What was deliberately dropped (v4.0.0 does it better)

• Our server.py rewrite + 5 bound tests: v4.0.0 achieves the same properties via HTTP headers (CSP default-src 'self', Referer-Policy: no-referrer, Cache-Control: no-store, non-loopback Host rejection) and covers them in test_security_network.py / test_security_injection.py. Independently verified: no coverage lost.
• Our graph escape_for_script: v4.0.0's escape_json_for_script escapes &,<,>,U+2028/9 — a strict superset. Kept theirs.
• Our THREAT_MODEL "Known gaps" + crossref-attribution edits: every gap is already fixed in v4.0.0; the correction is already in its text.

SKILL.md drift caught

v4.0.0 added a top-level egress-status command (Tor egress reporting) our skill didn't document — added. No other invocation had drifted.

Validation

• Offline suite: 281 passed, 20 skipped, 5 failed. The 5 are pre-existing on pristine main — GLiNER/ollama extraction tests that need model downloads / network, blocked by conftest. Baseline was 5 failed, 255 passed; this PR adds 26 passing tests, zero new failures. (Those 5 pass only on a machine with the models + ollama + network.)
• ruff check . clean · ruff format --check clean (pre-commit enforced).
• openfoia --version → 4.1.0.
• Hostile-graph render (</script>…, <!--<script>, entity label Acme </script> & Co): no breakout, no raw < in the data line, round-trips intact — v4.0.0's escape holds.

Reviewed

Underlying fixes went through an independent Opus review (both SHIP) before reconciliation; the two riskiest reconciliation decisions (dropped-server-tests coverage, install.sh anchor) were independently re-verified against v4.0.0.

Related

• Feeds the search-substrate direction in Epic: Private search substrate — safe web + records search for humans AND agents #66 (the plugin/skill is the delivery path for a private-search tool).
• Pairs with glyph-api v0.6.0 (extraction quality jump) — its CI publishes pdf-extract binaries + the .sha256 files this install.sh fix makes safe.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.