* test(#2322): fail-first tests for third-party capability skill materialization Red phase: tests (1) and (6) fail — resolveSurface reports the third-party stem surfaced (#2045) but no SKILL.md is ever written to disk. The other four are controls that must keep holding: first-party-wins collision, profile-tier filter, nested-router layout unperturbed, and absent/malformed capability must not throw. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SLufH5sDuqA1AiEGu45cuA * fix(#2322): materialize installed third-party capability skills A capability could report installed:true, surfaced:true, active:true and still never exist as an invocable command. #2045 fixed the registry layer — resolveSurface unions registry.capabilityClusters into the resolved skill set — but the materialization layer never got the matching fix. stageSkillsForRuntimeAsSkills only ever read gsd-core's own bundled commands/gsd/*.md and silently skipped any stem it couldn't find there, so a third-party skill living at <GSD_HOME>/.gsd/capabilities/<id>/skills/<stem>/ was never copied. Registry said surfaced; disk had nothing. Installed capability skills are now staged alongside the first-party ones, copied verbatim (they are authored complete for their target runtime and need no converter). First-party stems always win a collision, the profile filter still applies, and an absent or malformed capability degrades rather than throwing. Security: capability.json's skills[] entries are validated only as non-empty non-reserved strings (capability-validator.cjs:503-514) — no path shape is enforced upstream — so stems are sanitized (rejecting separators, '..', absolute paths, NUL) with an independent isPathConfined check on both the read and write paths. A '../../evil' stem writes nothing outside the capability's own dir. Also fixes a defect this surfaced in pruneSkillDirs: a materialized capability skill dir has no first-party manifest entry, so every apply logged "preserving (user-owned or unknown)" for a live GSD-managed dir. The retained check now precedes the manifest gate; no deletion outcome changes, and genuinely unknown gsd-* dirs still warn and are preserved. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SLufH5sDuqA1AiEGu45cuA * fix(#2322): address security review — bind skills to declaring capability, fix full profile An independent security review BLOCKED the first pass. Both blockers were mine. BLOCKER 1 (security): readInstalledCapabilitySkill scanned every capability dir and returned the first sorted match, never checking that a capability DECLARES the stem — ownership was inferred from attacker-controlled filesystem layout. Since install copies the whole bundle and the validator only checks DECLARED entries, a capability declaring `skills: []` could ship an undeclared skills/deploy/SKILL.md and win the `deploy` stem on sort order, supplying the agent-invocable instructions the user believed came from the registered capability. Stems are now bound to their owning capId via registry.capabilityClusters, and only that capability's dir is read. BLOCKER 2: the fill-in pass was gated `skills !== '*'` on the premise that applySurface materializes `full` into a concrete Set. True for applySurface — false for the installer, which is the default path: resolveProfile returns the '*' sentinel and bin/install.js passes it straight to staging. So #2322 survived on the default `full` profile, i.e. the fix didn't fix the reported bug. The registry is now plumbed to staging, and '*' stages all capability-cluster stems. Wiring this surfaced a second gap: the ADR-1239 imperative adapter (the primary install path) never threaded its registry either, which would have silently defeated the fix on the real default install. HIGH: staged capability skills were never prunable — pruneSkillDirs gates on the first-party manifest, so uninstalling a capability left its instructions live in the agent's context forever. Staged skills now carry a marker making them GSD-owned and prunable; genuinely unknown gsd-* dirs still warn and are preserved. MEDIUM: the "staged verbatim" claim was false — applySurface rewrites bodies over the whole stage dir. The tests asserted byte-equality and passed only because their fixtures contained no rewrite triggers. Claim dropped; tests now assert the rewrite against triggering content. LOW: isPathConfined is lexical, not realpath (symlink-defeatable, currently unreachable because install rejects symlinks) — comment corrected. The validator does not enforce non-empty, so isSafeCapabilitySkillStem is the sole defense, not a second layer — comment corrected and it now has traversal/NUL/absolute/empty test coverage (previously mutating it to `return true` left every test green). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SLufH5sDuqA1AiEGu45cuA * test(#2322): pin that the imperative adapter forwards a capability registry The delegation-args test deep-equalled the exact argv to installRuntimeArtifacts, so threading the composed capability registry through the ADR-1239 imperative adapter (required for #2322 — without it the default `full` install path never materializes third-party capability skills) failed it. The contract legitimately gained a parameter, so this is a stale-test correction, not a regression. Rather than deep-equalling the whole composed registry (brittle — it embeds the full agent/profile map), the test pins the leading args exactly and asserts only that a registry-shaped value is forwarded. That still fails if the adapter stops threading it, which is the regression the test exists to catch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SLufH5sDuqA1AiEGu45cuA * docs(#2322): backfill PR number 2340 into changeset Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SLufH5sDuqA1AiEGu45cuA --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
@@ -81,7 +81,21 @@ test('imperative adapter.install/uninstall delegate in-process to install-engine
|
||||
installEngine.uninstallRuntimeArtifacts = function (...a) { uninstallArgs = a; return undefined; };
|
||||
adapter.install({ configDir: '/tmp/imp/' + r, scope: 'global', resolvedProfile: { p: 1 } });
|
||||
adapter.uninstall({ configDir: '/tmp/imp/' + r, scope: 'local' });
|
||||
assert.deepStrictEqual(installArgs, [r, '/tmp/imp/' + r, 'global', { p: 1 }, undefined], `${r}: install delegation args`);
|
||||
// The trailing arg is the composed capability registry (#2322): the adapter
|
||||
// must forward one, or third-party capability skills never materialize on
|
||||
// the default `full` install path. Its contents are the loader's business —
|
||||
// pin only that a registry-shaped value is threaded through, not its bulk.
|
||||
const [, , , , manifest, registry] = installArgs;
|
||||
assert.deepStrictEqual(
|
||||
installArgs.slice(0, 5),
|
||||
[r, '/tmp/imp/' + r, 'global', { p: 1 }, undefined],
|
||||
`${r}: install delegation args`,
|
||||
);
|
||||
assert.strictEqual(manifest, undefined, `${r}: manifest arg unchanged`);
|
||||
assert.ok(
|
||||
registry && typeof registry === 'object' && 'capabilityClusters' in registry,
|
||||
`${r}: install must forward a composed capability registry (#2322), got: ${typeof registry}`,
|
||||
);
|
||||
assert.deepStrictEqual(uninstallArgs, [r, '/tmp/imp/' + r, 'local'], `${r}: uninstall delegation args`);
|
||||
}
|
||||
} finally {
|
||||
|
||||
@@ -1084,3 +1084,89 @@ describe('capability consent store (#1459)', () => {
|
||||
assert.match(`${r.error}\n${r.output}`, /trust/i);
|
||||
});
|
||||
});
|
||||
|
||||
// ─── issue #2322: capability set --runtime materializes installed skills ──────
|
||||
|
||||
describe('issue-2322: capability set --runtime materializes an installed third-party capability skill end-to-end', () => {
|
||||
/**
|
||||
* A conformant local capability source that declares one owned skill
|
||||
* (`skills: [stem]`) and ships that skill's already-authored SKILL.md
|
||||
* verbatim under `skills/<stem>/SKILL.md` — mirroring the real on-disk
|
||||
* shape `capability install` copies into `~/.gsd/capabilities/<id>/`.
|
||||
*/
|
||||
function writeCapSourceWithSkill(id, stem, skillContent, { tier = 'standard' } = {}) {
|
||||
const src = tmpDir(`cap-cli-src-${id}-`);
|
||||
const cap = {
|
||||
id,
|
||||
role: 'feature',
|
||||
version: '1.0.0',
|
||||
title: id,
|
||||
description: 'test capability with a skill',
|
||||
tier,
|
||||
requires: [],
|
||||
runtimeCompat: { supported: ['*'], unsupported: [] },
|
||||
skills: [stem],
|
||||
agents: [],
|
||||
hooks: [],
|
||||
config: {},
|
||||
steps: [],
|
||||
contributions: [],
|
||||
gates: [],
|
||||
};
|
||||
fs.writeFileSync(path.join(src, 'capability.json'), JSON.stringify(cap, null, 2));
|
||||
const skillDir = path.join(src, 'skills', stem);
|
||||
fs.mkdirSync(skillDir, { recursive: true });
|
||||
fs.writeFileSync(path.join(skillDir, 'SKILL.md'), skillContent, 'utf8');
|
||||
return src;
|
||||
}
|
||||
|
||||
test('reproduces #2322: capability state reports surfaced:true but the skill is not written to <config-dir>/skills/', () => {
|
||||
const home = tmpDir('cap-cli-home-');
|
||||
const cwd = makeCwd();
|
||||
// #2322 MEDIUM-4: a fixture with NO rewrite-triggering content would pass
|
||||
// the byte-for-byte assertion below vacuously (it never proves the
|
||||
// runtime body rewrite pass — which DOES run over third-party skills too —
|
||||
// actually ran). Embed a `~/.claude/` reference so the later assertion
|
||||
// exercises that pass instead of asserting its absence.
|
||||
const AUTHORED = '---\nname: my-thing\ndescription: third-party test skill\n---\n\n# My Thing\nSee @~/.claude/workflows/example.md for details.\n';
|
||||
const src = writeCapSourceWithSkill('my-thing', 'my-thing', AUTHORED);
|
||||
|
||||
// Step 2 of the issue repro: capability install ./capabilities/my-thing --yes
|
||||
const install = runGsdTools(['capability', 'install', src, '--scope', 'global', '--raw'], cwd, scopeEnv(home));
|
||||
assert.equal(install.success, true, `install failed: ${install.error || install.output}`);
|
||||
assert.equal(parse(install.output).status, 'installed');
|
||||
assert.ok(fs.existsSync(path.join(capDir(home, 'my-thing'), 'skills', 'my-thing', 'SKILL.md')), 'sanity: install copies the skill verbatim into the capabilities root');
|
||||
|
||||
// Step 3 of the issue repro: capability set my-thing --runtime claude --scope global
|
||||
const rcd = tmpDir('cap-cli-rcd-');
|
||||
const setResult = runGsdTools(
|
||||
['capability', 'set', 'my-thing', '--runtime', 'claude', '--scope', 'global', '--config-dir', rcd, '--raw'],
|
||||
cwd,
|
||||
scopeEnv(home),
|
||||
);
|
||||
assert.equal(setResult.success, true, `capability set failed: ${setResult.error || setResult.output}`);
|
||||
const setOut = parse(setResult.output);
|
||||
assert.deepEqual(setOut.errors, [], `capability set reported errors: ${JSON.stringify(setOut.errors)}`);
|
||||
|
||||
// Step 4 of the issue repro: capability state --raw -> installed:true, surfaced:true
|
||||
const myThing = setOut.capabilities.find((c) => c.id === 'my-thing');
|
||||
assert.ok(myThing, 'my-thing present in the returned capability state');
|
||||
assert.equal(myThing.installed, true, 'installed:true (matches issue step 4)');
|
||||
assert.equal(myThing.surfaced, true, 'surfaced:true (matches issue step 4 — #2045 registry union already works)');
|
||||
|
||||
// Step 5 of the issue repro: ls ~/.claude/skills/gsd-my-thing/ -> No such file or directory (THE BUG)
|
||||
const stagedPath = path.join(rcd, 'skills', 'gsd-my-thing', 'SKILL.md');
|
||||
assert.ok(
|
||||
fs.existsSync(stagedPath),
|
||||
`gsd-my-thing/SKILL.md must exist under ${rcd}/skills/ — capability state reports surfaced:true but nothing was materialized to disk (#2322)`,
|
||||
);
|
||||
const staged = fs.readFileSync(stagedPath, 'utf8');
|
||||
assert.notEqual(
|
||||
staged,
|
||||
AUTHORED,
|
||||
'#2322 MEDIUM-4: a third-party skill is NOT immune from the runtime-targeted body rewrite pass that runs over the whole stage dir (rewriteStagedSkillBodies) — a byte-for-byte-equal assertion here would be vacuous',
|
||||
);
|
||||
assert.ok(!staged.includes('~/.claude/'), 'the ~/.claude/ literal must have been rewritten to the resolved path prefix');
|
||||
assert.ok(staged.includes('workflows/example.md'), 'the rewrite must preserve the referenced path suffix, not corrupt the body');
|
||||
});
|
||||
});
|
||||
|
||||
@@ -32,6 +32,11 @@ const {
|
||||
writeActiveProfile,
|
||||
PROFILES,
|
||||
STAGED_DIRS,
|
||||
// #2322 security-hardening seams
|
||||
isSafeCapabilitySkillStem,
|
||||
readInstalledCapabilitySkill,
|
||||
capabilityClusterStems,
|
||||
CAPABILITY_SKILL_MARKER,
|
||||
} = require('../gsd-core/bin/lib/install-profiles.cjs');
|
||||
const { createTempDir, cleanup } = require('./helpers.cjs');
|
||||
|
||||
@@ -936,6 +941,534 @@ describe('bug-3659: applySurface prunes ~/.claude/skills/gsd-*/ on cluster disab
|
||||
}
|
||||
|
||||
|
||||
// ────────────────────────────────────────────────────────────────────────
|
||||
// #2322: applySurface never materializes installed third-party capability
|
||||
// skills (~/.gsd/capabilities/<id>/skills/<stem>/SKILL.md) — the registry
|
||||
// (#2045) reports surfaced:true but stageSkillsForRuntimeAsSkills only ever
|
||||
// iterates findInstallSourceRoot(configDir) (gsd-core's own bundled
|
||||
// commands/gsd), so a stem that lives only under the capabilities root is
|
||||
// silently dropped: no error, no file on disk, /gsd-<stem> not invocable.
|
||||
// ────────────────────────────────────────────────────────────────────────
|
||||
{
|
||||
const { describe: __issueDescribe, test: __issueTest } = require('node:test');
|
||||
const surfaceMod = require('../gsd-core/bin/lib/surface.cjs');
|
||||
const { writeSurface: __writeSurface, applySurface: __applySurface } = surfaceMod;
|
||||
const { resolveRuntimeArtifactLayout: __resolveRuntimeArtifactLayout } = require('../gsd-core/bin/lib/runtime-artifact-layout.cjs');
|
||||
|
||||
/** Install a fake already-installed third-party capability skill under a sandboxed GSD_HOME. */
|
||||
function __installCapSkill(gsdHome, capId, stem, content) {
|
||||
const skillDir = path.join(gsdHome, '.gsd', 'capabilities', capId, 'skills', stem);
|
||||
fs.mkdirSync(skillDir, { recursive: true });
|
||||
fs.writeFileSync(path.join(skillDir, 'SKILL.md'), content, 'utf8');
|
||||
}
|
||||
|
||||
/** A minimal capability-registry shape carrying one capId -> [stems] cluster. */
|
||||
function __registryFor(capId, stems, tier = 'standard') {
|
||||
return {
|
||||
capabilityClusters: { [capId]: stems },
|
||||
profileMembership: { [capId]: { tier, profiles: tier === 'core' ? ['core', 'standard', 'full'] : ['standard', 'full'] } },
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Recursively snapshot every FILE under dir into a Map<relPath, content>.
|
||||
* NOTE: converters embed the absolute configDir in some skill bodies (e.g.
|
||||
* `@`-workflow-file references), so two DIFFERENT tmp configDirs never
|
||||
* produce byte-identical output even with identical inputs. Every
|
||||
* before/after comparison below therefore re-applies to the SAME configDir
|
||||
* (snapshot -> mutate -> re-snapshot) rather than comparing two distinct
|
||||
* directories.
|
||||
*/
|
||||
function __snapshotDir(dir) {
|
||||
const snap = new Map();
|
||||
const walk = (rel) => {
|
||||
const abs = path.join(dir, rel);
|
||||
for (const entry of fs.readdirSync(abs, { withFileTypes: true })) {
|
||||
const relChild = path.join(rel, entry.name);
|
||||
if (entry.isDirectory()) walk(relChild);
|
||||
else if (entry.isFile()) snap.set(relChild, fs.readFileSync(path.join(dir, relChild), 'utf8'));
|
||||
}
|
||||
};
|
||||
walk('.');
|
||||
return snap;
|
||||
}
|
||||
|
||||
/** Assert every entry captured in `before` (a __snapshotDir Map) still exists, byte-identical, under dir. */
|
||||
function __assertSnapshotSubsetPreserved(before, dir, label) {
|
||||
for (const [relChild, beforeContent] of before) {
|
||||
const candidatePath = path.join(dir, relChild);
|
||||
assert.ok(fs.existsSync(candidatePath), `${label}: ${relChild} must still exist`);
|
||||
assert.strictEqual(fs.readFileSync(candidatePath, 'utf8'), beforeContent, `${label}: ${relChild} must be byte-identical`);
|
||||
}
|
||||
}
|
||||
|
||||
__issueDescribe('issue-2322: applySurface materializes installed third-party capability skills', () => {
|
||||
__issueTest('(1) primary: installed capability skill materializes at <prefix><stem>/SKILL.md and IS subject to the same runtime body rewrites as first-party content', () => {
|
||||
const gsdHome = createTempDir('gsd-2322-home-');
|
||||
const configDir = createTempDir('gsd-2322-cfg-');
|
||||
const savedHome = process.env.GSD_HOME;
|
||||
try {
|
||||
// #2322 MEDIUM-4: a fixture with NO rewrite-triggering content passes
|
||||
// vacuously (fs.readFileSync === AUTHORED is trivially true whether or
|
||||
// not the rewrite pass ever ran over this directory). This fixture
|
||||
// deliberately embeds a `~/.claude/` reference so the assertion below
|
||||
// actually exercises rewriteStagedSkillBodies (surface.cts) — it is
|
||||
// NOT immune from that pass just because no per-file `converter` runs
|
||||
// at stage time (see readInstalledCapabilitySkill's doc comment).
|
||||
const AUTHORED = '---\nname: my-thing\ndescription: third-party test skill\n---\n\n# My Thing\nSee @~/.claude/workflows/example.md for details.\n';
|
||||
__installCapSkill(gsdHome, 'my-thing', 'my-thing', AUTHORED);
|
||||
process.env.GSD_HOME = gsdHome;
|
||||
|
||||
const registry = __registryFor('my-thing', ['my-thing']);
|
||||
const manifest = loadSkillsManifest(REAL_COMMANDS_DIR);
|
||||
const layout = __resolveRuntimeArtifactLayout('claude', configDir, 'global', registry);
|
||||
const resolved = __applySurface(configDir, layout, manifest, undefined, registry);
|
||||
|
||||
assert.ok(resolved.skills.has('my-thing'), 'sanity: registry union (#2045) already includes my-thing in resolved.skills');
|
||||
|
||||
const stagedPath = path.join(configDir, 'skills', 'gsd-my-thing', 'SKILL.md');
|
||||
assert.ok(
|
||||
fs.existsSync(stagedPath),
|
||||
'gsd-my-thing/SKILL.md must exist on disk after applySurface — registry says surfaced:true but nothing was materialized (#2322)',
|
||||
);
|
||||
const staged = fs.readFileSync(stagedPath, 'utf8');
|
||||
assert.notStrictEqual(
|
||||
staged,
|
||||
AUTHORED,
|
||||
'MEDIUM-4: a third-party skill is NOT immune from the runtime body rewrite pass applySurface runs over the whole stage dir — a byte-for-byte-equal assertion here would be vacuous',
|
||||
);
|
||||
assert.ok(!staged.includes('~/.claude/'), 'the ~/.claude/ literal must have been rewritten to the resolved path prefix');
|
||||
assert.ok(staged.includes('workflows/example.md'), 'the rewrite must preserve the referenced path suffix, not corrupt the body');
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.GSD_HOME; else process.env.GSD_HOME = savedHome;
|
||||
cleanup(gsdHome);
|
||||
cleanup(configDir);
|
||||
}
|
||||
});
|
||||
|
||||
__issueTest('(2) collision: a first-party stem always wins over a same-named third-party capability skill', () => {
|
||||
const gsdHome = createTempDir('gsd-2322-home-');
|
||||
const configDir = createTempDir('gsd-2322-cfg-');
|
||||
const savedHome = process.env.GSD_HOME;
|
||||
try {
|
||||
const EVIL = '---\nname: phase\n---\n\n# EVIL PHASE — must never win over the first-party gsd-phase skill\n';
|
||||
__installCapSkill(gsdHome, 'evil-cap', 'phase', EVIL);
|
||||
process.env.GSD_HOME = gsdHome;
|
||||
|
||||
const manifest = loadSkillsManifest(REAL_COMMANDS_DIR);
|
||||
|
||||
// Baseline: apply against the SAME configDir with no colliding capability
|
||||
// registered — this is the reference first-party conversion of
|
||||
// commands/gsd/phase.md. (Two DIFFERENT configDirs would embed different
|
||||
// absolute @-workflow-file paths in the body and could never compare
|
||||
// byte-identical, so the collision run below re-applies to this same dir.)
|
||||
const baselineLayout = __resolveRuntimeArtifactLayout('claude', configDir, 'global');
|
||||
__applySurface(configDir, baselineLayout, manifest, undefined, undefined);
|
||||
const phasePath = path.join(configDir, 'skills', 'gsd-phase', 'SKILL.md');
|
||||
assert.ok(fs.existsSync(phasePath), 'sanity: first-party gsd-phase stages without a colliding capability');
|
||||
const baselinePhaseContent = fs.readFileSync(phasePath, 'utf8');
|
||||
|
||||
// Collision run: re-apply to the SAME configDir once a third-party
|
||||
// capability also declares the 'phase' stem — the layout is rebuilt
|
||||
// WITH the colliding registry so the third-party fill-in pass actually
|
||||
// runs (and is then correctly suppressed by "first-party always wins"),
|
||||
// rather than never attempting it at all.
|
||||
const collideRegistry = __registryFor('evil-cap', ['phase']);
|
||||
const collideLayout = __resolveRuntimeArtifactLayout('claude', configDir, 'global', collideRegistry);
|
||||
__applySurface(configDir, collideLayout, manifest, undefined, collideRegistry);
|
||||
assert.ok(fs.existsSync(phasePath), 'gsd-phase must still exist when a third-party capability collides on the same stem');
|
||||
const collidePhaseContent = fs.readFileSync(phasePath, 'utf8');
|
||||
|
||||
assert.notStrictEqual(collidePhaseContent, EVIL, 'the third-party EVIL PHASE content must never win the collision');
|
||||
assert.strictEqual(
|
||||
collidePhaseContent,
|
||||
baselinePhaseContent,
|
||||
'on a stem collision the first-party converted content must be staged, identical to the no-collision baseline',
|
||||
);
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.GSD_HOME; else process.env.GSD_HOME = savedHome;
|
||||
cleanup(gsdHome);
|
||||
cleanup(configDir);
|
||||
}
|
||||
});
|
||||
|
||||
__issueTest('(3) profile filter: a third-party skill outside the resolved profile is not staged; sibling first-party skills are unaffected', () => {
|
||||
const gsdHome = createTempDir('gsd-2322-home-');
|
||||
const configDir = createTempDir('gsd-2322-cfg-');
|
||||
const savedHome = process.env.GSD_HOME;
|
||||
try {
|
||||
__installCapSkill(gsdHome, 'my-thing', 'my-thing', '# my-thing\n');
|
||||
process.env.GSD_HOME = gsdHome;
|
||||
|
||||
// 'my-thing' is tier:'standard' -> profiles ['standard','full']; the
|
||||
// 'core' base profile does NOT include it.
|
||||
__writeSurface(configDir, { baseProfile: 'core', disabledClusters: [], explicitAdds: [], explicitRemoves: [] });
|
||||
|
||||
const registry = __registryFor('my-thing', ['my-thing'], 'standard');
|
||||
const manifest = loadSkillsManifest(REAL_COMMANDS_DIR);
|
||||
const layout = __resolveRuntimeArtifactLayout('claude', configDir, 'global', registry);
|
||||
const resolved = __applySurface(configDir, layout, manifest, undefined, registry);
|
||||
|
||||
assert.ok(!resolved.skills.has('my-thing'), 'sanity: core profile excludes a standard-tier capability skill');
|
||||
assert.ok(
|
||||
!fs.existsSync(path.join(configDir, 'skills', 'gsd-my-thing', 'SKILL.md')),
|
||||
'a capability skill outside the resolved profile must NOT be staged',
|
||||
);
|
||||
// 'phase' is a core-profile member — must be unaffected by the presence
|
||||
// of the (filtered-out) third-party capability skill.
|
||||
assert.ok(
|
||||
fs.existsSync(path.join(configDir, 'skills', 'gsd-phase', 'SKILL.md')),
|
||||
'a first-party core-profile skill must still stage normally alongside a filtered-out capability skill',
|
||||
);
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.GSD_HOME; else process.env.GSD_HOME = savedHome;
|
||||
cleanup(gsdHome);
|
||||
cleanup(configDir);
|
||||
}
|
||||
});
|
||||
|
||||
__issueTest('(4) control: a nested-router (doNest) runtime layout is unperturbed by an installed capability skill', () => {
|
||||
const gsdHome = createTempDir('gsd-2322-home-');
|
||||
const configDir = createTempDir('gsd-2322-cfg-');
|
||||
const savedHome = process.env.GSD_HOME;
|
||||
try {
|
||||
__installCapSkill(gsdHome, 'my-thing', 'my-thing', '# my-thing\n');
|
||||
process.env.GSD_HOME = gsdHome;
|
||||
|
||||
const manifest = loadSkillsManifest(REAL_COMMANDS_DIR);
|
||||
// 'cline' is a nested (doNest) runtime layout (unlike Claude's flat layout).
|
||||
const baselineLayout = __resolveRuntimeArtifactLayout('cline', configDir, 'global');
|
||||
|
||||
// Baseline: no capability registered — snapshot the resulting nested layout.
|
||||
__applySurface(configDir, baselineLayout, manifest, undefined, undefined);
|
||||
const skillsDir = path.join(configDir, 'skills');
|
||||
const router = fs.readdirSync(skillsDir).find((d) => d.startsWith('gsd-ns-'));
|
||||
assert.ok(router, 'sanity: the baseline nested layout has at least one gsd-ns-* router');
|
||||
const baselineSnapshot = __snapshotDir(skillsDir);
|
||||
|
||||
// Re-apply to the SAME configDir once a capability skill is also
|
||||
// installed and present in the registry — rebuild the layout WITH the
|
||||
// registry so the fill-in pass actually runs.
|
||||
const registry = __registryFor('my-thing', ['my-thing']);
|
||||
const registryLayout = __resolveRuntimeArtifactLayout('cline', configDir, 'global', registry);
|
||||
__applySurface(configDir, registryLayout, manifest, undefined, registry);
|
||||
|
||||
assert.ok(
|
||||
fs.existsSync(path.join(skillsDir, router)),
|
||||
'the namespace router bundle must still be present when a capability skill is also installed',
|
||||
);
|
||||
// Every first-party file staged in the baseline (no capability) run
|
||||
// must remain byte-identical after the capability is added — its
|
||||
// presence must never perturb first-party nesting or content.
|
||||
__assertSnapshotSubsetPreserved(baselineSnapshot, skillsDir, 'nested first-party layout');
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.GSD_HOME; else process.env.GSD_HOME = savedHome;
|
||||
cleanup(gsdHome);
|
||||
cleanup(configDir);
|
||||
}
|
||||
});
|
||||
|
||||
__issueTest('(5) absent/malformed: a registry-referenced capability skill missing on disk must not throw and must not affect first-party output', () => {
|
||||
const gsdHome = createTempDir('gsd-2322-home-');
|
||||
const configDirGhost = createTempDir('gsd-2322-cfg-ghost-');
|
||||
const configDirPartial = createTempDir('gsd-2322-cfg-partial-');
|
||||
const savedHome = process.env.GSD_HOME;
|
||||
try {
|
||||
// Partial case: the capability dir exists but the declared stem's
|
||||
// skills/<stem>/SKILL.md is missing (e.g. a corrupt/partial install).
|
||||
fs.mkdirSync(path.join(gsdHome, '.gsd', 'capabilities', 'partial-cap', 'skills'), { recursive: true });
|
||||
process.env.GSD_HOME = gsdHome;
|
||||
|
||||
const manifest = loadSkillsManifest(REAL_COMMANDS_DIR);
|
||||
|
||||
// Ghost case: capId in the registry has NO install directory at all.
|
||||
const ghostRegistry = __registryFor('ghost-cap', ['ghost-stem']);
|
||||
const ghostLayout = __resolveRuntimeArtifactLayout('claude', configDirGhost, 'global', ghostRegistry);
|
||||
assert.doesNotThrow(() => {
|
||||
__applySurface(configDirGhost, ghostLayout, manifest, undefined, ghostRegistry);
|
||||
}, 'applySurface must not throw when a registry-referenced capability has no install directory on disk');
|
||||
assert.ok(
|
||||
fs.existsSync(path.join(configDirGhost, 'skills', 'gsd-help', 'SKILL.md')),
|
||||
'first-party skills must still materialize when a referenced capability is entirely absent on disk',
|
||||
);
|
||||
|
||||
// Partial case.
|
||||
const partialRegistry = __registryFor('partial-cap', ['missing-stem']);
|
||||
const partialLayout = __resolveRuntimeArtifactLayout('claude', configDirPartial, 'global', partialRegistry);
|
||||
assert.doesNotThrow(() => {
|
||||
__applySurface(configDirPartial, partialLayout, manifest, undefined, partialRegistry);
|
||||
}, 'applySurface must not throw when a capability install dir exists but the declared stem is missing under skills/');
|
||||
assert.ok(
|
||||
fs.existsSync(path.join(configDirPartial, 'skills', 'gsd-help', 'SKILL.md')),
|
||||
'first-party skills must still materialize when a referenced capability skill is partially/malformed-installed',
|
||||
);
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.GSD_HOME; else process.env.GSD_HOME = savedHome;
|
||||
cleanup(gsdHome);
|
||||
cleanup(configDirGhost);
|
||||
cleanup(configDirPartial);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// ── BLOCKER 1: cross-capability skill-stem hijack ──────────────────────────
|
||||
__issueDescribe('issue-2322 BLOCKER 1: capability skill stem hijack via an undeclared/unregistered directory', () => {
|
||||
__issueTest('an UNDECLARED skills/<stem>/ directory shipped by one capability must never supply another capability\'s declared+registered stem', () => {
|
||||
const gsdHome = createTempDir('gsd-2322-home-');
|
||||
const configDir = createTempDir('gsd-2322-cfg-');
|
||||
const savedHome = process.env.GSD_HOME;
|
||||
try {
|
||||
const EVIL = '---\nname: deploy\n---\n\n# EVIL deploy — planted by aaa-utils, which never declared this skill\n';
|
||||
const LEGIT = '---\nname: deploy\n---\n\n# legit deploy — authored and declared by zzz-deploy\n';
|
||||
// aaa-utils sorts BEFORE zzz-deploy lexically (the OLD scan-and-first-
|
||||
// sorted-match implementation would have picked aaa-utils) AND ships an
|
||||
// UNDECLARED skills/deploy/ directory it never listed in its
|
||||
// capability.json `skills[]`.
|
||||
__installCapSkill(gsdHome, 'aaa-utils', 'deploy', EVIL);
|
||||
// zzz-deploy is the SOLE capability that DECLARES + is REGISTERED as
|
||||
// owning 'deploy'.
|
||||
__installCapSkill(gsdHome, 'zzz-deploy', 'deploy', LEGIT);
|
||||
process.env.GSD_HOME = gsdHome;
|
||||
|
||||
// aaa-utils's capabilityClusters entry is EMPTY — mirrors
|
||||
// gen-capability-registry.cjs deriveCapabilityClusters, which only
|
||||
// includes a capability that owns a NON-EMPTY declared skills[] array
|
||||
// (i.e. "skills": [] in capability.json never appears here at all).
|
||||
const registry = {
|
||||
capabilityClusters: { 'aaa-utils': [], 'zzz-deploy': ['deploy'] },
|
||||
profileMembership: { 'zzz-deploy': { tier: 'standard', profiles: ['standard', 'full'] } },
|
||||
};
|
||||
|
||||
// (a) direct unit-level probe of the ownership-binding function.
|
||||
const found = readInstalledCapabilitySkill('deploy', registry);
|
||||
assert.ok(found, 'sanity: the declared+registered owner must be resolvable');
|
||||
assert.strictEqual(found.capId, 'zzz-deploy', 'ownership must resolve to the DECLARING+REGISTERED capability, never the alphabetically-first directory on disk');
|
||||
assert.strictEqual(found.content, LEGIT, 'the returned content must be the declaring capability\'s own SKILL.md');
|
||||
assert.notStrictEqual(found.content, EVIL, 'the undeclared sibling directory\'s content must never be returned');
|
||||
|
||||
// (b) end-to-end through the real staging path (applySurface).
|
||||
const manifest = loadSkillsManifest(REAL_COMMANDS_DIR);
|
||||
const layout = __resolveRuntimeArtifactLayout('claude', configDir, 'global', registry);
|
||||
const resolved = __applySurface(configDir, layout, manifest, undefined, registry);
|
||||
assert.ok(resolved.skills.has('deploy'), 'sanity: the registered capability skill is unioned into the resolved surface');
|
||||
|
||||
const stagedPath = path.join(configDir, 'skills', 'gsd-deploy', 'SKILL.md');
|
||||
assert.ok(fs.existsSync(stagedPath), 'the legitimate declaring capability\'s skill must be staged');
|
||||
const stagedContent = fs.readFileSync(stagedPath, 'utf8');
|
||||
assert.ok(!stagedContent.includes('EVIL'), 'the undeclared aaa-utils directory must never win the stem — hijack blocked end-to-end');
|
||||
assert.ok(stagedContent.includes('legit deploy'), 'the declaring capability\'s own content must be what lands on disk');
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.GSD_HOME; else process.env.GSD_HOME = savedHome;
|
||||
cleanup(gsdHome);
|
||||
cleanup(configDir);
|
||||
}
|
||||
});
|
||||
|
||||
__issueTest('two capabilities can never both claim the same stem — capabilityClusters is unambiguous by construction (no ownership tie to break)', () => {
|
||||
// capabilityClusters can only ever bind a stem to ONE capId (the
|
||||
// capability-loader registry composer rejects a candidate whose declared
|
||||
// skill collides with an already-registered owner before it is ever
|
||||
// composed) — so _owningCapabilityId's "first Object.keys() match wins"
|
||||
// internal iteration order can never actually matter in practice. This
|
||||
// documents that invariant at the readInstalledCapabilitySkill boundary.
|
||||
const registry = { capabilityClusters: { alpha: ['shared'], beta: ['shared'] } };
|
||||
// Even in this (registry-invariant-violating, hand-crafted) input, the
|
||||
// lookup must be deterministic and must not throw.
|
||||
assert.doesNotThrow(() => readInstalledCapabilitySkill('shared', registry));
|
||||
});
|
||||
});
|
||||
|
||||
// ── BLOCKER 2: the '*' (full-profile) sentinel must still stage capability skills ──
|
||||
__issueDescribe('issue-2322 BLOCKER 2: mode=full (the "*" sentinel) must still stage registered third-party capability skills', () => {
|
||||
__issueTest('resolveProfile({modes:["full"]})\'s "*" sentinel, passed straight to stageSkillsForRuntimeAsSkills, still materializes a registered capability skill', () => {
|
||||
const gsdHome = createTempDir('gsd-2322-home-');
|
||||
const configDir = createTempDir('gsd-2322-cfg-');
|
||||
const savedHome = process.env.GSD_HOME;
|
||||
let unitStaged;
|
||||
let e2eStaged;
|
||||
try {
|
||||
const AUTHORED = '# my-thing (full profile)\n';
|
||||
__installCapSkill(gsdHome, 'my-thing', 'my-thing', AUTHORED);
|
||||
process.env.GSD_HOME = gsdHome;
|
||||
|
||||
const registry = __registryFor('my-thing', ['my-thing']);
|
||||
// The REAL sentinel resolveProfile({modes:['full']}) produces — mirrors
|
||||
// bin/install.js's `_resolvedProfile` for the DEFAULT (`--profile full`)
|
||||
// install, and does NOT go through applySurface/resolveSurface (which
|
||||
// would materialize '*' into a concrete Set before staging ever sees it).
|
||||
const resolvedFull = resolveProfile({ modes: ['full'] });
|
||||
assert.strictEqual(resolvedFull.skills, '*', 'sanity: full mode resolves to the "*" sentinel');
|
||||
|
||||
// (a) direct unit-level probe of the staging function.
|
||||
unitStaged = stageSkillsForRuntimeAsSkills(REAL_COMMANDS_DIR, resolvedFull, (content) => content, 'gsd-', false, registry);
|
||||
const unitStagedPath = path.join(unitStaged, 'gsd-my-thing', 'SKILL.md');
|
||||
assert.ok(
|
||||
fs.existsSync(unitStagedPath),
|
||||
'#2322 BLOCKER 2: the "*" sentinel must still stage a registered capability skill (unit level) — mode=standard already did this, mode=full must too',
|
||||
);
|
||||
assert.strictEqual(fs.readFileSync(unitStagedPath, 'utf8'), AUTHORED);
|
||||
|
||||
// (b) end-to-end through resolveRuntimeArtifactLayout's skills-kind
|
||||
// stage() closure — the EXACT call shape bin/install.js's installer
|
||||
// path uses (kind.stage(resolvedProfile), with NO applySurface
|
||||
// involved, so the '*' sentinel really does reach staging here).
|
||||
const layout = __resolveRuntimeArtifactLayout('claude', configDir, 'global', registry);
|
||||
const skillsKindEntry = layout.kinds.find((k) => k.kind === 'skills');
|
||||
e2eStaged = skillsKindEntry.stage(resolvedFull);
|
||||
const e2eStagedPath = path.join(e2eStaged, 'gsd-my-thing', 'SKILL.md');
|
||||
assert.ok(
|
||||
fs.existsSync(e2eStagedPath),
|
||||
'BLOCKER 2 (issue repro): mode=full must stage a registered capability skill exactly like mode=standard already does',
|
||||
);
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.GSD_HOME; else process.env.GSD_HOME = savedHome;
|
||||
cleanup(gsdHome);
|
||||
cleanup(configDir);
|
||||
if (unitStaged) cleanup(unitStaged);
|
||||
if (e2eStaged) cleanup(e2eStaged);
|
||||
}
|
||||
});
|
||||
|
||||
__issueTest('no registry threaded through at all -> the "*" sentinel stages NOTHING third-party (fail closed, never a fallback scan)', () => {
|
||||
const gsdHome = createTempDir('gsd-2322-home-');
|
||||
const savedHome = process.env.GSD_HOME;
|
||||
let staged;
|
||||
try {
|
||||
__installCapSkill(gsdHome, 'my-thing', 'my-thing', '# my-thing\n');
|
||||
process.env.GSD_HOME = gsdHome;
|
||||
const resolvedFull = resolveProfile({ modes: ['full'] });
|
||||
staged = stageSkillsForRuntimeAsSkills(REAL_COMMANDS_DIR, resolvedFull, (c) => c, 'gsd-', false /* no registry arg */);
|
||||
assert.ok(
|
||||
!fs.existsSync(path.join(staged, 'gsd-my-thing')),
|
||||
'an absent registry must never fall back to scanning the capabilities root — fail closed',
|
||||
);
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.GSD_HOME; else process.env.GSD_HOME = savedHome;
|
||||
cleanup(gsdHome);
|
||||
if (staged) cleanup(staged);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// ── HIGH 3: staged capability skills must be prunable once orphaned ────────
|
||||
__issueDescribe('issue-2322 HIGH-3: an orphaned (uninstalled/unsurfaced) capability skill is pruned; a genuinely unknown gsd-* dir is still preserved', () => {
|
||||
__issueTest('uninstalling the capability + re-applying removes its staged skill; an unrelated hand-made gsd-* dir survives with a warning', () => {
|
||||
const gsdHome = createTempDir('gsd-2322-home-');
|
||||
const configDir = createTempDir('gsd-2322-cfg-');
|
||||
const savedHome = process.env.GSD_HOME;
|
||||
try {
|
||||
__installCapSkill(gsdHome, 'my-thing', 'my-thing', '# my-thing\n');
|
||||
process.env.GSD_HOME = gsdHome;
|
||||
|
||||
const registry = __registryFor('my-thing', ['my-thing']);
|
||||
const manifest = loadSkillsManifest(REAL_COMMANDS_DIR);
|
||||
const layoutWithCap = __resolveRuntimeArtifactLayout('claude', configDir, 'global', registry);
|
||||
|
||||
// Step 1: install + apply -> the capability skill is staged and marked.
|
||||
__applySurface(configDir, layoutWithCap, manifest, undefined, registry);
|
||||
const stagedDirPath = path.join(configDir, 'skills', 'gsd-my-thing');
|
||||
assert.ok(fs.existsSync(path.join(stagedDirPath, 'SKILL.md')), 'sanity: the capability skill is staged');
|
||||
assert.ok(
|
||||
fs.existsSync(path.join(stagedDirPath, CAPABILITY_SKILL_MARKER)),
|
||||
'sanity: the staged capability skill dir carries the persisted ownership marker',
|
||||
);
|
||||
|
||||
// Step 2: an unrelated, genuinely user-created gsd-* dir must survive
|
||||
// the whole scenario untouched, with a warning — the data-loss guard.
|
||||
const userDir = path.join(configDir, 'skills', 'gsd-my-own-notes');
|
||||
fs.mkdirSync(userDir, { recursive: true });
|
||||
fs.writeFileSync(path.join(userDir, 'SKILL.md'), '# my own notes\n');
|
||||
|
||||
// Step 3: uninstall the capability (remove its on-disk bundle) and drop
|
||||
// it from every registry view entirely — simulating `capability remove`.
|
||||
cleanup(path.join(gsdHome, '.gsd', 'capabilities', 'my-thing'));
|
||||
const registryAfterUninstall = { capabilityClusters: {}, profileMembership: {} };
|
||||
const layoutAfterUninstall = __resolveRuntimeArtifactLayout('claude', configDir, 'global', registryAfterUninstall);
|
||||
|
||||
// Step 4: re-apply to the SAME configDir with the capability now
|
||||
// entirely absent from the registry.
|
||||
const stderrChunks = [];
|
||||
const origWrite = process.stderr.write.bind(process.stderr);
|
||||
process.stderr.write = (chunk, ...rest) => { stderrChunks.push(String(chunk)); return origWrite(chunk, ...rest); };
|
||||
try {
|
||||
__applySurface(configDir, layoutAfterUninstall, manifest, undefined, registryAfterUninstall);
|
||||
} finally {
|
||||
process.stderr.write = origWrite;
|
||||
}
|
||||
|
||||
assert.ok(
|
||||
!fs.existsSync(stagedDirPath),
|
||||
'HIGH-3: an uninstalled/unsurfaced capability\'s previously-staged skill must be PRUNED, not preserved forever',
|
||||
);
|
||||
assert.ok(
|
||||
fs.existsSync(userDir),
|
||||
'a genuinely unknown/hand-made gsd-* dir must still be preserved (data-loss protection unchanged)',
|
||||
);
|
||||
assert.ok(
|
||||
stderrChunks.some((c) => c.includes('gsd-my-own-notes')),
|
||||
'the genuinely unknown dir must still emit the preserve warning',
|
||||
);
|
||||
assert.ok(
|
||||
!stderrChunks.some((c) => c.includes('gsd-my-thing')),
|
||||
'the orphaned capability skill must be pruned via its positively-identified marker, not routed through the "unknown" warning path',
|
||||
);
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.GSD_HOME; else process.env.GSD_HOME = savedHome;
|
||||
cleanup(gsdHome);
|
||||
cleanup(configDir);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// ── LOW 7: isSafeCapabilitySkillStem — the security control had ZERO direct coverage ──
|
||||
__issueDescribe('issue-2322 LOW-7: isSafeCapabilitySkillStem direct security-control coverage', () => {
|
||||
const unsafe = [
|
||||
['../../evil', 'parent-directory traversal (unix separators)'],
|
||||
['..\\..\\evil', 'parent-directory traversal (windows separators)'],
|
||||
['/etc/passwd', 'absolute unix path'],
|
||||
['C:\\x', 'absolute-looking windows path (rejected via the backslash check, platform-independent)'],
|
||||
['foo/../../bar', 'embedded traversal segment'],
|
||||
['foo\0bar', 'embedded NUL byte'],
|
||||
['.', 'current-directory sentinel'],
|
||||
['..', 'parent-directory sentinel'],
|
||||
['', 'empty string'],
|
||||
];
|
||||
for (const [stem, label] of unsafe) {
|
||||
__issueTest(`rejects: ${label}`, () => {
|
||||
assert.strictEqual(isSafeCapabilitySkillStem(stem), false, `"${JSON.stringify(stem)}" (${label}) must be rejected`);
|
||||
});
|
||||
}
|
||||
|
||||
__issueTest('accepts an ordinary single-segment stem (limit-1 / control case)', () => {
|
||||
assert.strictEqual(isSafeCapabilitySkillStem('my-thing'), true);
|
||||
});
|
||||
|
||||
__issueTest('boundary: a very long single-segment stem (no separators) has no length cap — accepted, and a lookup against it degrades gracefully (never throws)', () => {
|
||||
const longStem = 'a'.repeat(5000);
|
||||
assert.strictEqual(isSafeCapabilitySkillStem(longStem), true, 'no length cap is documented on this function — it is a shape check, not a length check');
|
||||
const registry = { capabilityClusters: { 'some-cap': [longStem] } };
|
||||
assert.doesNotThrow(() => readInstalledCapabilitySkill(longStem, registry), 'an overlong (but shape-valid) stem must degrade to null on a filesystem-level failure (e.g. ENAMETOOLONG), never throw');
|
||||
assert.strictEqual(readInstalledCapabilitySkill(longStem, registry), null);
|
||||
});
|
||||
|
||||
__issueTest('capabilityClusterStems ignores prototype-pollution-shaped keys and non-array values', () => {
|
||||
// Computed keys (['__proto__'], ['constructor']) create genuine OWN
|
||||
// enumerable properties named "__proto__"/"constructor" — unlike the
|
||||
// bare object-literal `__proto__:` form (which sets the object's actual
|
||||
// [[Prototype]] instead and would never appear in Object.keys() at all,
|
||||
// making the BANNED-list guard untestable this way).
|
||||
const clusters = Object.create(null);
|
||||
clusters['__proto__'] = ['evil'];
|
||||
clusters['constructor'] = ['evil'];
|
||||
clusters['good'] = ['a', 'b'];
|
||||
clusters['bad'] = 'not-an-array';
|
||||
const stems = capabilityClusterStems({ capabilityClusters: clusters });
|
||||
assert.deepStrictEqual([...stems].sort(), ['a', 'b']);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
// ────────────────────────────────────────────────────────────────────────
|
||||
// Folded from tests/bug-924-claude-flat-skill-layout.test.cjs — consolidation epic #1969 (B3 #1972)
|
||||
// ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
Reference in New Issue
Block a user