From a0167685e9ff01250ebc3e1078869ab5e787d0b0 Mon Sep 17 00:00:00 2001
From: Eddie A Tejeda <669988+eddietejeda@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:30:57 -0700
Subject: [PATCH] fix(plugin): privacy policy links, and keep the install
 command out of the hook

- plugin.json: privacyPolicyUrl and termsOfServiceUrl, which the plugin
  directory shows on the listing. The submission form asks you to confirm
  the plugin's privacy policy, and none was linked.
- hooks/check-cli.sh: stop printing the curl | sh install command. The
  directory's validator flagged the hook under "Scripts the validator
  couldn't follow", most likely because the hook's text contains an
  installer command. The hook now points Claude to the install section of
  the skill, which already has the command, and still asks the user first.
---
 .claude-plugin/plugin.json |  2 ++
 README.md                  |  4 ++--
 hooks/check-cli.sh         | 16 +++++++---------
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 1113a67..e103d9e 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -10,5 +10,7 @@
   "homepage": "https://www.hotdata.dev",
   "repository": "https://github.com/hotdata-dev/hotdata-cli",
   "license": "MIT",
+  "privacyPolicyUrl": "https://www.hotdata.dev/privacy-policy",
+  "termsOfServiceUrl": "https://www.hotdata.dev/terms-of-service",
   "icon": "./.claude-plugin/icon.png"
 }
diff --git a/README.md b/README.md
index 3998678..d780241 100644
--- a/README.md
+++ b/README.md
@@ -58,8 +58,8 @@ What the plugin runs, sends, and fetches:
 - **SessionStart hook** (`hooks/check-cli.sh`, Claude Code and Cowork only):
   checks whether `hotdata` is on `PATH` or in `~/.hotdata/cli`. If it's only in
   `~/.hotdata/cli`, it adds that folder to `PATH` for the session. If it's
-  missing, it asks Claude to offer the installer. The hook makes no network
-  requests, installs nothing, and sends no data.
+  missing, it asks Claude to offer to install the CLI. The hook makes no
+  network requests, installs nothing, and sends no data.
 - **Installer**, only after you agree: `curl -fsSL https://hotdata.dev/install |
   HOTDATA_NO_SKILLS=1 sh` downloads the CLI from this repository's GitHub
   releases, or installs it with Homebrew if `brew` is present.
diff --git a/hooks/check-cli.sh b/hooks/check-cli.sh
index 9ada0cf..2e1dfe9 100755
--- a/hooks/check-cli.sh
+++ b/hooks/check-cli.sh
@@ -3,8 +3,11 @@
 #
 # The plugin ships the skill, not the binary. Stay silent when the CLI is
 # reachable. When it isn't, stdout becomes session context asking Claude to
-# offer the installer rather than run it: piping curl into sh on every session
+# offer an install rather than run one: installing software on every session
 # start is not something users agreed to by installing a skill.
+#
+# The install command itself lives in the skill, not here, so this hook runs
+# nothing and fetches nothing that the directory's validator has to follow.
 
 set -u
 
@@ -23,15 +26,10 @@ if [ -x "$DIST_BIN_DIR/hotdata" ]; then
     exit 0
 fi
 
-# HOTDATA_NO_SKILLS=1: the plugin already provides the skill, so the installer
-# must not add a second copy to ~/.claude/skills.
 cat <<'EOF'
 The hotdata CLI is not installed. Before running any hotdata command, tell the
-user and ask whether to install it. If they agree, run:
-
-  curl -fsSL https://hotdata.dev/install | HOTDATA_NO_SKILLS=1 sh
-
-If the binary lands in ~/.hotdata/cli, call it as ~/.hotdata/cli/hotdata for the
-rest of this session.
+user and ask whether to install it. If they agree, follow the install steps in
+the hotdata skill (the "Upgrade" section of skills/hotdata/SKILL.md), and set
+HOTDATA_NO_SKILLS=1 because this plugin already provides the skill.
 EOF
 exit 0