# nobrainer-tech-flow 2.7.3: clear the Claude directory's automatic-check warnings

Release date: 2026-10-25.

The module set (eighteen), workflow guidance and hooks do not change. One optional helper
changes how it receives a key, one sentence in the writing skill changes wording, and the
distribution repository ships fewer documentation files.

## Why

The Claude plugin directory scans `nobrainer-tech/nobrainer-tech-flow-plugin`, which is
built from this repository's release ZIP. Its automatic checks reported, for 2.7.2:

- "Uses a credential from the user's machine" on `typed_decisions.py`, `docs/INSTALL.md`
  and the Claude manifest. The optional Jev helper read the TypeSafe key from an
  environment variable named with `--key-env` and sent it as a bearer token.
- "Contains a download-and-run command" on `skills/nobrainer-writing/SKILL.md` (a `curl`
  command described inside a `bash` block) and on `docs/INSTALL.md` (the `npx`
  install commands).
- "Image or font file that the plugin's code could run" on `docs/releases/v2.5.0.md` and
  on the three manifests that name `assets/plugin-logo.png`.
- "Field from another tool's manifest" (`icon`) and three "Unrecognized field" findings in
  `plugin.json`.

## What changes

- `skills/nobrainer-tech-flow/scripts/typed_decisions.py` reads no credential from the
  machine. For Jev, the user pipes the key on stdin with `--key-stdin`; only the first
  line is read (at most 4096 characters), and requests then come from `--request`. The
  key reaches only the Jev worker, on its stdin, never argv or the output. `--key-env`
  is removed: it now stops with `KEY_ENV_REMOVED_USE_KEY_STDIN` (exit 2) without reading
  any variable. The worker child gets a fixed allowlist of non-secret variables (path,
  home, temp, locale, Python, Hugging Face cache, proxy and certificate settings)
  instead of everything except names that look like credentials.
- `skills/nobrainer-tech-flow/references/optional-decisions.md` documents the piped key.
- `skills/nobrainer-writing/SKILL.md` and `references/brief-artifacts.md` ask for the
  API request as a `curl` command in a fenced code block; the required proof is the same.
- `docs/RELEASING.md` step 4: the distribution repository export keeps only
  `docs/CHAT_PLUGINS.md` and `docs/PRIVACY.md` from `docs/`, the two files its README and
  manifests link. `docs/INSTALL.md`, the other guides and `docs/releases/` stay in this
  repository (dropping only some would leave broken relative links); the README links
  the canonical installation guide.

## Distribution repository and manifests

- The distribution repository's Claude manifest drops its `icon` field (a separate
  distribution-repository PR): the icon moves to `.claude-plugin/icon.png`, where the
  directory looks for it, as a byte-identical copy of `assets/plugin-logo.png`. With the
  field removed and that file present, `claude plugin validate --profile directory
  --strict` (Claude Code 2.1.310) passes; with neither, it reports `ICON_MISSING`.
- The `privacyPolicyUrl`, `supportUrl` and `termsOfServiceUrl` fields stay. The Claude
  Code plugin manifest reference lists them as directory listing fields that Anthropic's
  directory reads and Claude Code ignores; validators older than Claude Code 2.1.281
  report them as unknown, and the current local validator reports nothing for them.
- The root `plugin.json` and `.codex-plugin/plugin.json` keep naming
  `assets/plugin-logo.png` as the OpenAI interface logo. That finding asks a reviewer to
  look at a 512 px PNG.
- The canonical repository keeps `docs/INSTALL.md` with its `npx` commands; it is the
  installation guide.

## Verification record

- `tests/test_typed_decisions.py`: the helper ignores `TYPESAFE_API_KEY` and any other
  variable, the source has no environment read for a key, the worker environment is the
  allowlist, a piped key reaches only the Jev worker and never the output, a piped key is
  one bounded line, `--key-stdin` without `--request` is `INVALID_INPUT`, and `--key-env`
  stops with `KEY_ENV_REMOVED_USE_KEY_STDIN`.
- A direct run with `TYPESAFE_API_KEY` set and no piped key returns `CORE_FALLBACK` with
  `MISSING_TYPESAFE_API_KEY`.
- `python3 scripts/validate_skills.py` and `--suite`, the full test suite, the plugin ZIP
  build and `git diff --check` pass before merge.