Best possible solution:

Land the guard derivation after normal required checks confirm the script and focused Vitest test pass, keeping the curated deprecated SDK inventory as the single source of truth with explicit root/private aliases.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a scripts/test cleanup PR rather than a reported runtime bug. Source inspection confirmed the current hard-coded guard and the existing curated inventory that the PR derives from.

Is this the best way to solve the issue?

Yes; deriving the guard from the existing curated inventory is narrower and less drift-prone than maintaining a second manual list, and the explicit extras preserve root/private alias handling.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 912fdfbedd5a.

Label changes:

• add P3: This is a low-risk scripts/test guardrail cleanup with no runtime behavior, user data, provider, auth, or message-delivery change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable; this is a maintainer-labeled scripts/test guardrail PR with no user-visible runtime behavior to prove in a real setup.

Label justifications:

• P3: This is a low-risk scripts/test guardrail cleanup with no runtime behavior, user data, provider, auth, or message-delivery change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable; this is a maintainer-labeled scripts/test guardrail PR with no user-visible runtime behavior to prove in a real setup.

PR surface:

Tests +23, Other +12. Total +35 across 3 files.

What I checked:

• Current main checked: The checkout is on current main at the review target SHA. (912fdfbedd5a)
• Repository policy applied: Root AGENTS.md was read fully; its ClawSweeper policy treats maintainer as a protected label and requires scoped guides for touched paths. (AGENTS.md:16, 912fdfbedd5a)
• Scoped scripts guide applied: scripts/AGENTS.md was read and its wrapper/test guidance matches the PR's script and run-vitest validation path. (scripts/AGENTS.md:3, 912fdfbedd5a)
• Current guard is hard-coded: Current main still hard-codes 13 deprecated plugin SDK module specifiers in the plugin-sdk-compat-subpaths rule, so the PR is not already implemented on main. (scripts/check-deprecated-api-usage.mjs:131, 912fdfbedd5a)
• Curated deprecated SDK inventory exists: The deprecated public plugin SDK subpath inventory is already maintained as JSON and contains the broader curated list the PR uses as source of truth. (scripts/lib/plugin-sdk-deprecated-public-subpaths.json:1, 912fdfbedd5a)
• Existing SDK entry helpers use that inventory: Current helper code already derives deprecated public plugin SDK entrypoints from the same JSON inventory, supporting the PR's source-of-truth direction. (scripts/lib/plugin-sdk-entries.mjs:28, 912fdfbedd5a)

Likely related people:

• Val Alexander: Commit 119a01c introduced the current deprecated API guard, curated deprecated SDK inventory, and related SDK entry helpers touched by this PR. (role: recent area contributor; confidence: high; commits: 119a01c82998; files: scripts/check-deprecated-api-usage.mjs, scripts/lib/plugin-sdk-deprecated-public-subpaths.json, scripts/lib/plugin-sdk-entries.mjs)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

• Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
• The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
• Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
• The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
• Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.