golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

refactor: hard-fork GSD -> MSD (Make Software Done)

Browse Source 
Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD
across contents and paths, upstream package/repo coordinates -> @golem15/msd-core
and golem15com/msd-core. Deep links into upstream history, sibling upstream
packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is.

Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line,
package/plugin identity, regenerated lockfile, install-tree fixtures, derived
registries and benchmark baseline; migration checksum baseline re-locked
(MSD keeps its own install state, so no install had applied the old sums);
sort-order and regex-escaped expectations in tests adjusted.
This commit is contained in:
Jakub Zych
2026-10-06 01:47:40 +02:00
parent fe069b2a56
commit a9a7a328e6
2763 changed files with 78465 additions and 78434 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
tests/external-descriptor-confinement.test.cjs
View File

@@ -11,12 +11,12 @@ const path = require('node:path');
const {
isPathConfined,
assertDescriptorConfined,
} = require('../gsd-core/bin/lib/external-descriptor-trust.cjs');
} = require('../msd-core/bin/lib/external-descriptor-trust.cjs');
test('isPathConfined: confined paths are true, escapes are false', () => {
const root = path.join('/home', 'me', '.gsd');
const root = path.join('/home', 'me', '.msd');
assert.ok(isPathConfined('skills', root), 'simple subdir is confined');
assert.ok(isPathConfined('skills/gsd-plan.md', root), 'nested subdir is confined');
assert.ok(isPathConfined('skills/msd-plan.md', root), 'nested subdir is confined');
assert.ok(isPathConfined('.', root), 'root itself is confined');
assert.ok(!isPathConfined('../etc/passwd', root), 'parent escape is NOT confined');
assert.ok(!isPathConfined('../../etc', root), 'multi-level escape is NOT confined');
@@ -27,7 +27,7 @@ test('isPathConfined: confined paths are true, escapes are false', () => {
test('isPathConfined: win32 injection — confined and escape cases', () => {
const win32 = path.win32;
const root = 'C:\\Users\\me\\.gsd';
const root = 'C:\\Users\\me\\.msd';
assert.ok(
isPathConfined('sub\\file.md', root, { pathImpl: win32 }),
'win32 target under root is confined',
@@ -56,19 +56,19 @@ test('isPathConfined: win32 injection — confined and escape cases', () => {
test('isPathConfined: win32 prefix-boundary — sibling with root as a string prefix is refused', () => {
const win32 = path.win32;
const root = 'C:\\Users\\me\\.gsd';
const root = 'C:\\Users\\me\\.msd';
assert.ok(
!isPathConfined('..\\.gsdEVIL', root, { pathImpl: win32 }),
'C:\\Users\\me\\.gsdEVIL must be refused despite sharing the "C:\\Users\\me\\.gsd" string prefix',
!isPathConfined('..\\.msdEVIL', root, { pathImpl: win32 }),
'C:\\Users\\me\\.msdEVIL must be refused despite sharing the "C:\\Users\\me\\.msd" string prefix',
);
});
test('isPathConfined: posix prefix-boundary — sibling with root as a string prefix is refused', () => {
const posix = path.posix;
const root = '/home/me/.gsd';
const root = '/home/me/.msd';
assert.ok(
!isPathConfined('../.gsdEVIL', root, { pathImpl: posix }),
'/home/me/.gsdEVIL must be refused despite sharing the "/home/me/.gsd" string prefix',
!isPathConfined('../.msdEVIL', root, { pathImpl: posix }),
'/home/me/.msdEVIL must be refused despite sharing the "/home/me/.msd" string prefix',
);
});
@@ -89,7 +89,7 @@ test('assertDescriptorConfined: a global destSubpath escape is rejected fail-clo
runtime: { artifactLayout: { global: [{ destSubpath: '../../../etc/passwd' }] } },
};
assert.throws(
() => assertDescriptorConfined(desc, '/home/me/.gsd'),
() => assertDescriptorConfined(desc, '/home/me/.msd'),
/malicious-host.*unconfined global destSubpath.*fail-closed/,
'an escaping global destSubpath must be rejected with a fail-closed error naming the descriptor',
);
@@ -101,7 +101,7 @@ test('assertDescriptorConfined: a local destSubpath escape is rejected fail-clos
runtime: { artifactLayout: { local: [{ destSubpath: '../../.ssh/authorized_keys' }] } },
};
assert.throws(
() => assertDescriptorConfined(desc, '/home/me/.gsd'),
() => assertDescriptorConfined(desc, '/home/me/.msd'),
/sneaky-host.*unconfined local destSubpath/,
'an escaping local destSubpath must be rejected',
);
@@ -112,14 +112,14 @@ test('assertDescriptorConfined: an absolute destSubpath outside configHome is re
id: 'abs-host',
runtime: { artifactLayout: { global: [{ destSubpath: '/etc/cron.d/evil' }] } },
};
assert.throws(() => assertDescriptorConfined(desc, '/home/me/.gsd'), /unconfined global destSubpath/);
assert.throws(() => assertDescriptorConfined(desc, '/home/me/.msd'), /unconfined global destSubpath/);
});
test('assertDescriptorConfined: a descriptor with no artifact layout passes (nothing to confine)', () => {
assert.doesNotThrow(() => assertDescriptorConfined({ id: 'bare', runtime: {} }, '/home/me/.gsd'));
assert.doesNotThrow(() => assertDescriptorConfined({ id: 'noruntime' }, '/home/me/.gsd'));
assert.doesNotThrow(() => assertDescriptorConfined({}, '/home/me/.gsd'));
assert.doesNotThrow(() => assertDescriptorConfined(null, '/home/me/.gsd'));
assert.doesNotThrow(() => assertDescriptorConfined({ id: 'bare', runtime: {} }, '/home/me/.msd'));
assert.doesNotThrow(() => assertDescriptorConfined({ id: 'noruntime' }, '/home/me/.msd'));
assert.doesNotThrow(() => assertDescriptorConfined({}, '/home/me/.msd'));
assert.doesNotThrow(() => assertDescriptorConfined(null, '/home/me/.msd'));
});
test('assertDescriptorConfined: non-string / empty destSubpath entries are skipped (not flagged)', () => {