Malformed plugin-hint tags are now dropped instead of parsed.
A parser now recognizes lines of the form <claude-code-hint type="plugin" value="name@marketplace" v=1/> in bash/command output, strips them from what's shown, and, on the main thread, submits the referenced plugin as a pending install hint. Seen hints are deduplicated in new session state (seenHintPluginIds, capped at 64) and logged via tengu_plugin_hint_seen with a hashed plugin id; the stripping itself always runs, and only the telemetry/tracking side is skipped in restricted environments.
Embedded <claude-code-hint> payloads of type 'plugin' are validated against a name@marketplace pattern: malformed ones are dropped with a warning, and overly long hint lines are also dropped rather than parsed.
Fixed plugin install hints from CLIs run in background Bash commands: they are now detected, and the raw <claude-code-hint> tag no longer…