Background
plugin.json declares a useBeads boolean in userConfig (default true) so users can disable Beads task persistence and run Flow in degraded mode. As of #TBD (the manifest fix that wired up userConfig reads), the SessionStart hook (hooks/detect-env.sh and hooks/detect-env.ps1) honors this toggle: detect_beads() and active_work() both short-circuit when CLAUDE_PLUGIN_OPTION_USEBEADS != true.
However, direct bd invocations elsewhere in the plugin are still ungated. If a user disables Beads via /config, the SessionStart context correctly reports "disabled," but slash commands and skills can still try to shell out to bd and either succeed (defeating the toggle) or fail noisily (if bd isn't installed).
Scope
Audit and gate all direct bd call sites in:
commands/ — every *.md slash command that invokes bd in a bash block
skills/ — every skill that calls bd directly or instructs the agent to
tools/ — any Python helpers that shell out to bd
agents/ — agent prompts that assume bd availability
For each site, either:
- Skip cleanly when
useBeads=false (preferred for non-interactive contexts), or
- Surface a clear "Beads is disabled" message and exit with a non-error status (preferred for slash commands the user explicitly invoked).
Per the Plugins Reference, the env var CLAUDE_PLUGIN_OPTION_USEBEADS is available to all plugin subprocesses, and \${user_config.useBeads} is available for template substitution in command/MCP/LSP configs.
Acceptance criteria
Related
- Manifest fix and SessionStart hook gating (the
useBeads toggle was introduced there but only enforced in detect-env.{sh,ps1})
Background
plugin.jsondeclares auseBeadsboolean inuserConfig(defaulttrue) so users can disable Beads task persistence and run Flow in degraded mode. As of #TBD (the manifest fix that wired upuserConfigreads), the SessionStart hook (hooks/detect-env.shandhooks/detect-env.ps1) honors this toggle:detect_beads()andactive_work()both short-circuit whenCLAUDE_PLUGIN_OPTION_USEBEADS != true.However, direct
bdinvocations elsewhere in the plugin are still ungated. If a user disables Beads via/config, the SessionStart context correctly reports "disabled," but slash commands and skills can still try to shell out tobdand either succeed (defeating the toggle) or fail noisily (ifbdisn't installed).Scope
Audit and gate all direct
bdcall sites in:commands/— every*.mdslash command that invokesbdin a bash blockskills/— every skill that callsbddirectly or instructs the agent totools/— any Python helpers that shell out tobdagents/— agent prompts that assumebdavailabilityFor each site, either:
useBeads=false(preferred for non-interactive contexts), orPer the Plugins Reference, the env var
CLAUDE_PLUGIN_OPTION_USEBEADSis available to all plugin subprocesses, and\${user_config.useBeads}is available for template substitution in command/MCP/LSP configs.Acceptance criteria
\bbd\bacrosscommands/,skills/,tools/,agents/returns no ungated invocationsuseBeads=falseand invoking each affected command produces a clean "disabled" message instead of abd: command not founderror or silent success.ps1mirrors existRelated
useBeadstoggle was introduced there but only enforced indetect-env.{sh,ps1})