[carlrannaberg]

Visualize’s allowed-tools frontmatter contains wildcard script paths that the Claude plugin directory flags as ALLOWED_TOOLS_BROAD. Remove the optional preapproval block so normal host permission settings govern helper execution. Helper commands remain available; users may receive additional approval prompts. Claude documents this behavior.

Update the standalone-package checker’s exact expected-field set to match. The Markdown body, remaining metadata, helper implementations, versions, and packaging are unchanged. This upstream PR does not repin or release the Display Claude plugin, and does not claim directory clearance.

Validation:

• Standalone package check passes before and after, including isolated installed-helper and browser-contrast checks.
• All 72 fixture checks, diagram/Mermaid self-tests, palette smoke, catalog freshness/tests, slide-canvas unit/overflow tests, authoring/library checks, and 35 CI syntax checks pass; both plugin manifests parse.
• Image contract/generation/routes suite passes all 59 tests on an unchanged rerun. Its 5 ms child-termination test initially failed while suites ran in parallel; no image implementation or tests were changed.
• All 22 existing offline Display plugin hook tests pass. SHA-256 and executable-mode comparisons confirm 145 Visualize script/vendor, plugin hook, and bundled jq files are unchanged.

CI: Linux validation and Windows Mermaid both pass on commit c55452d4964a635dc88f645a437103c53868dc12, attempt 1. Independent task and final reviews found no issues.

[carlrannaberg]

Superseded by display-dev/claude-plugin#6, now merged. The Display Claude plugin applies exact, quoted ${CLAUDE_PLUGIN_ROOT} helper preapprovals during synchronization and documents the plugin-only path guidance. This preserves standalone Visualize preapprovals and avoids removing them for all agents. No changes from this PR are needed for the plugin release.