fix(plugin): 名前指定インストールの @ref 拒否と status の空 path ガード

- installer.py: `devbase plugin install myplugin@v1` の名前指定インストール分岐で
  source.ref を _install_from_repo() に渡し既定ブランチを黙ってインストールしていた
  問題を修正。未登録/登録済みリポジトリと同様に @ref を PluginError で拒否する (major)
- status.py: plugin.path が空文字列の場合に環境ルートの projects/ を誤参照する
  可能性を防ぐため事前ガードを追加し 0 件扱いとする (minor / 堅牢性)
- 回帰テスト追加: test_install_ref_rejected_for_name_only /
  test_project_count_zero_when_path_empty

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: takemi-ohama

lib/devbase/commands/status.py

@@ -105,6 +105,11 @@ def _get_plugin_info(registry: PluginRegistry) -> list[dict]:
         # plugin.path は devbase_root からの相対パス。
         # repos/ ベース (repos/<repo>/<subdir>) と --link ベース
         # (plugins/<name>) の両方を同じロジックで解決する。
+        # path が空の場合 (旧/破損エントリ) は devbase_root/projects を
+        # 誤参照してしまうため、先にガードして 0 件扱いとする。
+        if not plugin.path:
+            results.append({"name": plugin.name, "project_count": 0})
+            continue
         plugin_projects_dir = registry.devbase_root / plugin.path / "projects"
         if plugin_projects_dir.is_dir():
             project_count = sum(

lib/devbase/plugin/installer.py

@@ -123,12 +123,24 @@ def install_plugin(
     plugins_dir = registry.get_plugins_dir()
 
     if not source.repo and source.plugin_name:
+        # Reject @ref on name-only installs too — the permanent clone tracks
+        # the default branch and does not support pinned refs.  Without this
+        # guard, `devbase plugin install myplugin@v1` would silently drop the
+        # ref in _install_from_repo() and install the default branch instead.
+        # This matches the validation for unregistered/registered repos below.
+        if source.ref:
+            raise PluginError(
+                f"Cannot use @{source.ref} with plugin '{source.plugin_name}'.\n"
+                "Permanent clones track the default branch and do not support pinned refs.\n"
+                f"Install without @ref:\n"
+                f"  devbase plugin install {source.plugin_name}"
+            )
         result = registry.find_plugin_in_repos(source.plugin_name)
         if result:
             repo, avail_plugin = result
             repo_source = PluginSource(
                 repo=repo.url, plugin_name=source.plugin_name,
-                ref=source.ref, linked=False,
+                ref=None, linked=False,
             )
             _install_from_repo(
                 registry, repo_source, install_all=False,

tests/plugin/test_repos_core.py

@@ -443,6 +443,27 @@ def test_install_ref_rejected_for_registered_repo(self, registry, devbase_root):
         with pytest.raises(PluginError, match="Cannot use @v2.0"):
             install_plugin(registry, "testorg/testrepo:myplugin@v2.0")
 
+    def test_install_ref_rejected_for_name_only(self, registry, devbase_root):
+        """@ref on a name-only install is rejected too.
+
+        Without the guard, `devbase plugin install myplugin@v1` would parse
+        to (repo='', plugin_name='myplugin', ref='v1'), enter the
+        find_plugin_in_repos branch and silently drop the ref in
+        _install_from_repo(), installing the default branch instead.
+        """
+        url = "https://github.com/testorg/testrepo.git"
+        _make_repo_dir(devbase_root, "testorg/testrepo", [
+            {"name": "myplugin", "path": "myplugin", "projects": ["myproj"]},
+        ])
+        _register_repo(registry, "testorg/testrepo", url, [
+            {"name": "myplugin", "path": "myplugin"},
+        ])
+
+        with pytest.raises(PluginError, match="Cannot use @v1"):
+            install_plugin(registry, "myplugin@v1")
+        # registry must not have installed the plugin from the default branch
+        assert registry.get("myplugin") is None
+
     def test_install_legacy_repo_without_local_path(self, registry, devbase_root):
         """Legacy repos (no local_path) are auto-migrated to persistent clone."""
         url = "https://github.com/testorg/testrepo.git"

tests/plugin/test_status_project_count.py

@@ -85,3 +85,21 @@ def test_project_count_zero_when_no_projects_dir(registry, devbase_root):
 
     info = _get_plugin_info(registry)
     assert info == [{"name": "noproj", "project_count": 0}]
+
+
+def test_project_count_zero_when_path_empty(registry, devbase_root):
+    """path が空 (旧/破損エントリ) のとき環境ルートの projects を誤参照しない。"""
+    # 環境ルートに projects/ が存在し、中身があっても 0 と数えること。
+    _make_projects(devbase_root, ["root-proj-a", "root-proj-b"])
+
+    registry.add(InstalledPlugin(
+        name="brokenpath",
+        version="0.1.0",
+        source="",
+        installed_at=registry.now_iso(),
+        path="",
+        linked=False,
+    ))
+
+    info = _get_plugin_info(registry)
+    assert info == [{"name": "brokenpath", "project_count": 0}]