claude-code-docs: review follow-ups carried over from upstream #301

Four bot findings from #297 point at code that #297 moved unchanged from pleaseai/claude-code-docs@72ef109. None of them was introduced by the move, so they are tracked here instead of growing #297.

Findings

1. Docs root with trailing slash is rewritten (bug)

plugins/claude-code-docs/hooks/rewrite-docs-url.sh rewrites https://code.claude.com/docs/ to https://code.claude.com/docs.md, even though its comment says the docs root must be left alone. With the trailing slash stripped, rest is empty but the case still matches. Reproduced locally; https://code.claude.com/docs without the slash is correctly left untouched. Fix: guard the empty rest, and add the trailing-slash root to hooks/rewrite-docs-url.test.sh.

From cubic: #297 (comment)

2. Hook auto-allows the rewritten WebFetch (design decision)

The hook returns permissionDecision: "allow", so a rewritten code.claude.com/docs fetch skips WebFetch's permission prompt. The upstream README documented this as intentional. The scope is narrow (only code.claude.com/docs/<locale>/<page>), but whether a hook should grant permission rather than only rewrite updatedInput is worth deciding explicitly.

From cubic: #297 (comment)

3. DOCS does not persist across separate Bash calls (skill text)

skills/claude-code-docs/SKILL.md sets DOCS="$(ask src …)/docs" in one fenced block and uses $DOCS in later blocks. When an agent runs those blocks as separate Bash tool calls, the variable is gone. Fix: inline the ask src call in each command, or tell the agent to echo the resolved path and reuse it literally.

From Codex: #297 (comment)

4. plugin.json has no repository field (P3)

The source-of-truth manifest omits repository, so the generated Codex, Cursor and Antigravity manifests don't say where the code lives. Add "repository": "https://github.com/pleaseai/claude-code-plugins", then rerun bun scripts/cli.ts multi-format.

From cubic: #297 (comment)