14 Commits

Author	SHA1	Message	Date
Jakub Zych	792139b5ed	chore: sweep Kimi mentions from comments and notes	2026-10-06 20:19:17 +02:00
Jakub Zych	6cfa0c55d2	refactor: drop 12 runtimes, keep Claude, Codex, OpenCode, Cursor, ZCode, Antigravity ... Removes kilo, kimi, kimi-code, copilot, windsurf, augment, trae, qwen, hermes, cline, codebuddy and pi end to end: capability descriptors, installer branches and converters (bin/install.js 14.9k -> 11.2k lines), TypeScript converters, hook surfaces and runtime homes, review lanes qwen/kimi-code, the two pi migrations, Kimi payload normalization in the hook guards, dead hostBehaviors vocabulary, launcher home probes, fixtures, runtime-specific tests and the prose that presented them as supported. Installer output for the six kept runtimes is byte-identical to before the prune. The Kimi tool-vocabulary tests in workflow-guard, read-guard and read-injection-scanner are left in place pending a decision.	2026-10-06 20:02:40 +02:00
Jakub Zych	a9a7a328e6	refactor: hard-fork GSD -> MSD (Make Software Done) ... Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD across contents and paths, upstream package/repo coordinates -> @golem15/msd-core and golem15com/msd-core. Deep links into upstream history, sibling upstream packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is. Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line, package/plugin identity, regenerated lockfile, install-tree fixtures, derived registries and benchmark baseline; migration checksum baseline re-locked (MSD keeps its own install state, so no install had applied the old sums); sort-order and regex-escaped expectations in tests adjusted.	2026-10-06 01:47:40 +02:00
sim	ff5c5782ee	test(#4512): migrate process-seam batch to named timeout constants ... Batch 1 of the ad hoc timeout literal migration (epic #4445). Replaces every bare numeric timeout/timeoutMs object-literal property in tests/process-seam.test.cjs, tests/helpers-process-isolation.test.cjs, tests/run-with-timeout.test.cjs, and tests/helpers.cjs with a named constant, per eslint-rules/no-adhoc-timeout-literal.cjs. Removes the 4 files from the rule's allowlist. Adds SEAM_DEFAULT_TIMEOUT_MS to tests/helpers/timeouts.cjs (shared across 2 batch files, mirroring process-seam.cjs's own un-exported default). File-local constants elsewhere for values not shared across files or not a bench-derived class norm. No src/bin file touched, no numeric value changed anywhere. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-08 19:38:41 -04:00
Behruz Nassre Esfahani	a44d513566	fix(#3712): confine in-process installs to a sandboxed HOME (#3725) ... * fix(#3712): confine in-process installs to a sandboxed HOME A runtime kind may declare a global `home` override resolved from os.homedir() rather than from the caller's configDir — codex's skills kind (`home: ".agents"`, ADR-1239 / #2088) is the only live case. Sandboxing configDir/targetDir does not contain it, and assertDestWithinConfigHome cannot see the class: that gate confines a destSubpath to whatever root it is handed, and here the root IS the escaped home. So an in-process caller that forgot to sandbox HOME wrote to, and pruned gsd-* entries from, the developer's REAL ~/.agents/skills. tests/agent-descriptor-parity.install.test.cjs's K1 loop did exactly that: it iterates every agents-kind runtime (codex included) with a sandboxed targetDir and an un-sandboxed HOME. Reproduced against a canary home on next @ adb46cdd8 — 71 gsd-* skill dirs deleted, a foreign `cloudflare` skill surviving, suite still exit 0. It is silent because the runtime's own config home is untouched, so the manifest keeps reporting a healthy install. FIVE writers resolve a kind `home` and then destroy under it. Three are reachable today — installRuntimeArtifacts, uninstallRuntimeArtifacts (install-engine.cts) and applySurface (surface.cts). Two are descriptor-dependent and guarded against a future descriptor change rather than a present escape: installOpencodeFamilySkills (behind the combined-family early return) and installAgentsKindStandalone. Those two are scoped to the single kind each destroys — passing the whole layout made codex's unrelated skills override trip a writer that never touches it. - src/test-home-guard.cts: refuse when a run under a test runner cannot be shown to have sandboxed HOME. NODE_TEST_CONTEXT (set by `node --test`) gates it, so installs outside a Node test context are untouched; GSD_TEST_MODE is unusable, as several candidate files including the offender never set it. Homes are compared by FILESYSTEM IDENTITY (st_dev + st_ino), not by pathname: path.resolve() resolves neither symlinks nor case, and realpath returns a canonical pathname that two routes to one directory can still disagree on (bind mounts). Verified on macOS/APFS — HOME=/users/<name> made the strings differ while naming the same directory, and the lexical form ALLOWED a write into the physical real home. FAILS CLOSED: a pair is "different" only when both identify, or one is definitively absent (ENOENT/ENOTDIR) while the other identifies; every other errno is "cannot tell" and refuses. Only when neither home identifies is a marker consulted, and it carries the sandbox PATH and must equal the home in effect — a boolean checked first let an ambient or stale value disarm the guard. - helpers: promote sandboxHome() out of its two byte-identical private copies, which is also what makes them record the sandbox; the three withFakeHome() helpers record it too. The marker NAME is duplicated as a bare string rather than required from the compiled guard, keeping helpers.cjs's documented no-built-lib-at-import-time contract; a test pins the two together. - agent-descriptor-parity: sandbox HOME across the K1 loop. - helpers-process-isolation: #3156's canary asserts on <home>/.gsd only, and its `--cursor --local` spawn cannot reach `.agents` at all, so an assertion added there would pass with all confinement removed. Add a discriminating row — a `--codex --global` spawn against a seeded ambient home — which also asserts the runtime still declares the override. Its check is a sampled inventory (dir names + each SKILL.md), not a tree compare. - install-write-confinement: predicate rows through the deps seam, covering the symlinked HOME, ambient and stale markers, and each sameDirectory branch (both-identify, one-absent, neither-identifiable), plus wiring rows that drive the REAL entrypoints so deleting a guard call site is red. Verified: guard fires end-to-end against a real un-sandboxed HOME (exit 1, zero deletions); the case-variant fail-open reproduced on APFS before the fix and refuses after; K1 file 29/29 green with skills intact; mutation-tested — each of the three reachable call sites, lexical-only comparison, and treating an unknown errno as "absent" each take exactly one row red, with every mutation echoed back; the process-isolation row negative-controlled by reverting installerEnv to its pre-#3156 leak (16/0 -> 13/3); a full npm test leaves ~/.agents/skills at 71. Stated residual: the two descriptor-dependent writers have no wiring test, because no runtime declares a `home` override on those kinds and neither can be exercised without inventing a descriptor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(#3712): add changeset Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(#3712): let a sandbox nested inside the real home through the guard All six Windows shards of #3725 failed on legitimately sandboxed destinations. On Windows os.tmpdir() is %LOCALAPPDATA%\Temp — inside the user's home — so every sandbox a test creates is a descendant of the real home, and "does this land inside the real home?" answers yes for the safe case and the dangerous one alike. POSIX conceals this: /tmp and /var/folders both sit outside $HOME. Add the missing conjunct: a destination inside the real home is allowed only when it also sits beneath a HOME that was sandboxed away from the passwd home. Both halves are required — dropping the first re-admits a plain un-sandboxed install, and dropping the second decays into the "is HOME sandboxed?" check the module rejects, which a layout resolved before the sandbox walks straight through. Each is mutation-proven by a row that goes red without it. Also covers the two fail-closed branches of the new exemption, which survived mutation to `true` with the suite green, and avoids `<user>` in a docblock — the prompt-injection scanner reads it as a delimiter tag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#3712): close three writer/rollback gaps found reviewing the whole PR Cross-AI review of the full PR (not just the round's delta) surfaced three ways the guard could still be defeated: - The nested-sandbox exemption trusted the SPELLING of a destination. With HOME sandboxed to a directory inside the real home — legitimate on Windows — an aliased `.agents` (symlink, junction, subordinate bind mount) beneath it redirected an allowed path into the real home. Decide containment on the path the write RESOLVES to: walk up to the nearest existing ancestor, canonicalize, re-append the tail. - `migrateLegacyDevPreferencesToSkill` is a SIXTH writer that resolves a skills-kind `home` override. It creates rather than prunes, which is why it was missed, and `_runLegacyInstallMigrations` runs it before `installRuntimeArtifacts`' own assertion. Guarded, scoped to that kind. - Worst of the three: `bin/install.js` snapshots the resolved skills root before installing, and its outer catch rolls back by deleting and recreating every snapshotted `gsd-*` directory there. The guard's own throw landed in that catch, so refusing an un-sandboxed codex install provoked exactly the mutation the guard exists to prevent. Refusals are now marked and rethrown without rollback — nothing was written, so there is no partial install to undo. Every other error still rolls back. Also carries the sandbox marker into `installSpawnEnv`, so spawned installers are not refused on passwd-less CI images, and corrects three claims that no longer hold: "every writer" (six, and named), the unconditional "fails CLOSED" (the passwd-less marker branch is a deliberate weakening, and TOCTOU is out of scope), and the assertion that Windows os.tmpdir() is always %LOCALAPPDATA%\Temp (Node honors TEMP/TMP). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(#3712): name the guard's two limits instead of overclaiming Round-2 review found the prose had drifted ahead of the code. Corrected, with no behavior change: - The module still said FIVE writers; there are six, and the sixth is now named along with why it was missed (it creates rather than prunes) and why it carries its own assertion (it runs before the main one). - The canonicalization docblock listed subordinate bind mounts among the aliases it closes. It does not close them: a bind mount is not a link, so realpath keeps the mount-point spelling. `sameDirectory` already recorded that limit; the new helper now inherits it explicitly rather than contradicting it. Closing it needs mount-table introspection. - "FAILS CLOSED" was unqualified while the passwd-less marker branch is a deliberate weakening — with no passwd entry, nothing can contradict a marker naming the real home. - "Refuses BEFORE any write" was too broad: legacy install migrations run ahead of the layout-driven ones, which is exactly why the two rollbackInstallerMigrations() calls still execute before the rethrow. Only the codex skills-root rollback is skipped, and that is the only _codexPreConfigRollback() call site — applySurface is never called from bin/install.js and uninstall cannot reach it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#3712): sandbox HOME in the opencode-family home-override parity rows The last two Windows failures, and the same platform asymmetry in a different disguise. This row drives a skills-kind `home` override on purpose — precisely what the guard polices — but relied on the override temp dir happening to sit outside the real home. It does on POSIX (/tmp, /var/folders); on Windows os.tmpdir() is under %USERPROFILE%, so the guard correctly refused and only Windows went red. Declare the sandbox instead of depending on the platform: HOME becomes the override itself, which is the home the call writes under. This is the fix the guard's own message prescribes, applied to the test rather than to the guard. Both failing Windows shards fail on exactly these two rows and nothing else; every other shard is green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#3712): make sameDirectory answer NO when it cannot tell Review Major 1. sameDirectory()'s only caller is the passwd-less marker branch, which reads a `true` as permission to PROCEED: if (marker && sameDirectory(marker, osMod.homedir())) return; The fallthrough returned `true` whenever neither side identified — two absent paths, or two stats failing EACCES/EPERM/EIO on a locked-down host — on the reasoning that "cannot tell" should make the caller refuse. That reasoning was inverted with respect to this caller: it turned the passwd-less escape hatch into an unconditional bypass for any marker value at all, on precisely the hosts the fallback exists to serve. Only two things now answer yes: one resolved pathname, or two readable identities that match. Restoring the old fallthrough takes the new row red. Also from review: - Major 2 asked whether st_dev/st_ino discriminate directories on Windows, where Node derives them from BY_HANDLE_FILE_INFORMATION. The whole guard rests on that primitive, so assert it rather than argue it: a row comparing two distinct temp directories, and one directory reached by two spellings. It runs on every platform in the matrix, so Windows answers the question itself. - Minor 1: the refusal now names the real home it compared against, not just the destination it refused. That is the one fact needed to tell a true positive from a false one, and its absence is what made the Windows case a CI-log dig rather than a glance. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#3712): refuse a HOME that merely spells the real home more widely Review round: one Blocker, four Minors, a Nit. N2 (the one with teeth) — a destination's ancestor chain is linear, so "inside the real home AND inside the effective HOME" admits two arrangements, not one. The intended `effectiveHome ⊂ realHome` is the Windows temp shape; `realHome ⊂ effectiveHome` — HOME at /Users, /home, C:\Users — is not a sandbox at all, it is the real home reached by a wider spelling, and it was exempting a stale destination pointing straight at ~/.agents. Third conjunct added; the docblock no longer claims two conditions suffice. Removing the conjunct reds the new row and nothing else. N4 — the migration guard resolved its OWN layout, and without capabilityRegistry, so a registry-dependent descriptor could make it vouch for a path the migration does not write: a guard reporting safe while the unsafe write proceeds. It now guards the destination already resolved by _resolveDevPreferencesSkillTarget, keyed on `installRoot !== targetDir` — which is exactly the condition under which a `home` override was declared, read off that same result. N1 — CONTEXT.md gains the Test Home Guard Module glossary entry that contributor-standards.md requires of a new Module. Not CI-enforced, so green CI was never evidence it was met. N3 — the docs/INVENTORY.md row was misfiled between install-fs-adapter and install-model-override-resolver; the table is alphabetical and the manifest already had it right. Moved, and its text now names six writers and the third conjunct. N5 — applySurface's signature docblock was two parameters stale; this PR added the second of them. N6 — the duplicated rollbackInstallerMigrations() adjacent to the new rethrow: two identical consecutive calls, not two phases. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#3712): guard the sixth writer, and close two false-ALLOW paths Review round 3 (NEW-1, NEW-2) plus three defects Codex found in the whole-PR pass, each reproduced before it was fixed. NEW-1 — migrateLegacyDevPreferencesToSkill called the guard with no `deps`, so it bound real os/process.env and could not be wiring-tested the way the other three reachable writers were. It now takes the same optional `deps: { os?, env? }` tail parameter. The wiring block gains the missing fourth row, and a fifth pinning the ALLOW half; the test file's header docblock said "FIVE writers ... the three reachable today", contradicting the six/four statement this PR already put in src/test-home-guard.cts, CONTEXT.md, docs/INVENTORY.md and the changeset. Both directions of the guard's condition now fail a row when broken — previously neither did. NEW-2 — derivesFromSandboxedHome's docblock claimed "THREE conditions are required, and no two of them suffice". False for {2,3}: isInside is reflexive, so whenever conjunct 1 fires conjunct 2 already returns false on its own. Reworded as a fast path, which is what it is. Codex 1 (false ALLOW) — on a host with no readable passwd entry the marker branch returned as soon as the marker matched the effective HOME. That attests a caller sandboxed HOME and says nothing about where an already-resolved destination points, so a layout captured before sandboxHome() — still naming the real ~/.agents — was waved straight through: the same stale-layout shape the primary branch refuses by design. The marker must now identify AND contain every destination. Codex 2 (false ALLOW) — `installRoot !== targetDir` was the stand-in for "the skills kind declared a home override". The two are not equivalent: the inequality is false when the override resolves onto targetDir itself, which is exactly a configDir of $HOME/.agents. The guard was skipped and SKILL.md written into the real home under a test runner. _resolveDevPreferencesSkillTarget now reports hasHomeOverride off the same resolution instead of inferring it from two paths. Codex 3 (prose) — the shared refusal message claimed every guarded writer prunes; the migrate writer only creates. The changeset headline claimed in-process installer calls can no longer reach the real home, which is wider than the guard: writeNonClaudeDefaults still writes ~/.gsd/defaults.json through os.homedir(). INVENTORY's and CONTEXT's fail-closed sentences omitted sameDirectory's pathname-equality shortcut. All four narrowed to what the code does. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#3712): let the sandbox marker follow an overridden HOME Found by Codex in the whole-PR pass. installSpawnEnv spreads `overrides` last so an explicit HOME wins — deliberate, and its docblock tells callers needing per-spawn isolation to pass their own { HOME, USERPROFILE }. But the #3712 marker was set before that spread, so such a caller got HOME=<theirs> and marker=<helper default>. On a host with no readable passwd entry the guard compares the two and refuses a legitimately sandboxed spawn — tests/install.test.cjs:7143 and install-shared.cjs's own runInstaller both take that path. The marker is now derived from the final HOME unless the caller supplied one explicitly. The contract test asserted HOME after an override but not the marker, which is why it stayed green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(#3712): name the shipped guard condition, not the deleted one Review round 4 of #3725. Two artifacts this PR adds still described `target.installRoot !== targetDir` in the PRESENT tense as the live guard condition on `migrateLegacyDevPreferencesToSkill`. The shipped condition is `runtime && target.hasHomeOverride` (src/install-engine.cts:510). This is not ordinary doc drift. The named condition is the exact false-ALLOW the previous round closed: a `home` override resolving onto `targetDir` — a configDir of `$HOME/.agents`, which is where codex's override points — makes the inequality FALSE while the override is declared, so the guard was skipped. A maintainer reading CONTEXT.md:290 as authoritative would believe the guard still skips that case. - tests/install-write-confinement.test.cjs — the ALLOW-half row's comment. Its "teeth" rationale is unchanged and still correct as written. - CONTEXT.md:290 — the Test Home Guard Module glossary entry, a documented PR gate. Now states the condition and names the inequality only as what it is NOT, with the reason. The three surviving mentions of the inequality are all past-tense or negated (src/install-engine.cts:448, :508 and the sibling test comment at :3698) and are correct as they stand. Verified: `npm run lint:ci` exit 0; full `npm test` 31327 tests / 31312 pass / 0 fail / 14 skipped, run with TMPDIR unset. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(#3712): canonicalization fails closed, matching identify's errno split Codex full-PR review of #3725, run against the round-4 head. `resolveThroughLinks` caught EVERY realpathSync error and fell back to `path.resolve(dest)` — the lexical spelling. That inverts the function's own purpose. An aliased `<sandbox>/.agents` that cannot be canonicalized keeps its sandbox spelling, satisfies the nested-sandbox exemption at :227, and the write is ALLOWED into the real home — the exact escape this walk exists to close. The module documents that it fails CLOSED with ONE named exception (the marker branch); this was a second, unnamed one. Split by errno, and deliberately by the SAME split `identify` already draws rather than a second policy in one module — both answer "does this path exist as named?", so they must not disagree: ENOENT / ENOTDIR -> walk up. The ordinary case: a fresh install resolves a destination nothing has created yet, so realpath fails on the leaf and on every not-yet-created ancestor. Refusing here rejects every install. anything else (EACCES, EPERM, ELOOP, EIO) -> refuse. The component exists but cannot be resolved, so the guard cannot tell where the write lands. Three rows in the predicate block, beside the other aliasing rows: - a symlink CYCLE in the destination path (ELOOP) -> REFUSE - a destination that does not exist yet (ENOENT) -> ALLOW - a component behind a regular file (ENOTDIR) -> ALLOW Teeth checked against the artifact the test loads, not the source: reverting the condition to the swallow-everything shape in the compiled test-home-guard.cjs turns row 1 — and only row 1 — red. The ENOTDIR row caught a stale build during development, which is the point of asserting on the compiled file. CONTEXT.md and the resolveThroughLinks docblock both record the new behaviour, so this does not repeat the prose-vs-code drift the round-4 finding was about. The changeset's existing scope sentence now bounds "six writers" to the `installRuntimeArtifacts` call tree and names `cmdGenerateDevPreferences` — which resolves the same codex `home` override through `getGlobalSkillsBase` and writes SKILL.md beneath it unguarded. It has no in-process caller today (its only direct require-and-call is a spawnSync with HOME sandboxed), so it is latent rather than live, and whether it belongs in this PR is raised with the maintainer rather than decided here. Verified: `npm run lint:ci` exit 0; full `npm test` 31330 tests / 31315 pass / 0 fail / 14 skipped, TMPDIR unset. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-23 18:27:02 -04:00
0xdhx	6ac4d2e6ab	fix(#3156): bound the cold-require probe the rebase turned into a violation ... Post-rebase validity finding, not a new defect. The base range added local/no-unbounded-spawn (#3143, 2afe17bb) and then DELETED its allowlist (#3148, 9faacc0c), so the cold-require probe this PR added in 4bc6b0a2 -- legal when written -- is now an error. Bounded at 30s: a cold require is sub-second, so that is ~30x headroom and still fails loudly rather than hanging a lane. Also routes this round's own teardown through cleanup() instead of raw fs.rmSync, per local/no-raw-rmsync-in-tests, which carries the Windows-EBUSY retry budget. eslint clean on the file.	2026-08-08 05:58:35 -05:00
0xdhx	af39f13be2	test(#3156): pin the ambient-HOME leak the scrub set cannot reach ... Two halves, and the second is the one that matters. The contract half asserts installSpawnEnv() and installerEnv() both replace the ambient HOME, keep USERPROFILE tracking it (os.homedir() reads that one on Windows), and still let an explicit override win. The behavioural half drives the REAL installer against a REAL ambient HOME: it points process.env.HOME at a canary, runs `install.js --cursor --local`, and asserts the canary gains no .gsd. No assertion about the scrub set can stand in for this, because writeNonClaudeDefaults() resolves through os.homedir(), which reads no GSD variable -- a set-membership test would pass with the bug fully live. Negative-controlled against the pre-fix tree rather than assumed: reverting installerEnv() to `{ ...process.env, ...overrides }` fails BOTH halves, the behavioural one reporting the actual artifact ("the installer wrote GSD's user store into the ambient HOME: defaults.json").	2026-08-08 05:57:28 -05:00
0xdhx	4bc6b0a2a3	fix(#2665): defer the built-lib require so an unbuilt tree fails one test, not all ... tests/helpers.cjs required gsd-core/bin/lib at module scope to derive the config-location scrub set. That lib is BUILT, so on an unbuilt tree the require threw inside `require('./helpers.cjs')` -- before a single test() had registered -- turning one missing `npm run build:lib` into a whole-suite crash with no message naming the remedy. This is the file ~370 test files import, so the blast radius is the suite. `npm test` builds via its pretest hook; the shape that reaches this is a direct `node --test` invocation, which is exactly what a contributor reaches for when running one file. The require is now memoized behind builtLib(), and the two derived exports (TEST_ENV_BASE, CONFIG_LOCATION_ENV_KEYS) are enumerable lazy getters, so destructuring and Object.keys() behave as before. Reading either is what forces the build; a test file that needs neither now imports cleanly. When the build IS missing, the error names `npm run build:lib` instead of surfacing a bare MODULE_NOT_FOUND. Verified by a cold-child probe rather than by inspection -- this process has already loaded everything, so an in-process assertion would pass vacuously. The probe checks require.cache before and after touching TEST_ENV_BASE, and fails when the require is moved back to module scope. Addresses review finding: Major 7.	2026-08-08 05:50:49 -05:00
0xdhx	c95b817cb6	fix(#2665): scrub GSD_ALLOW_SYMLINKED_DEST — a write-escape permission ... Found by the pre-publication claim audit of this round's response comment, which refuted the sentence "none of the unscrubbed env reads names a write destination" on the grounds that naming a path is not the same property as influencing where writes land. GSD_ALLOW_SYMLINKED_DEST is boolean and names no path, so every rung of the derivation is structurally incapable of reaching it: not a registry configHome, not descriptor-shaped, not one of GSD's own location vars. It is still a #2665 leak vector. install-engine.cts reads it env-first (:214) and threads it as allowOptInFollow into the symlink-escape guard at four call sites, each gating a write (:361/:367, :416/:424, :785/:790, :927/:932). That guard is what stops a write leaving the install root, so an ambient =1 disarms it for the whole suite — the #2665 hazard arriving through a permission rather than a path. Added as its own named family (WRITE_ESCAPE_PERMISSION_ENV_KEYS) rather than folded into a location rung, for the same reason GSD_HOME got its own family in round 3: the list should not misdescribe what its members are. Blanking is fail-safe in the only direction that matters — '' is neither '1' nor 'true', so a blanked value makes the guard stricter, never looser. That asymmetry is what licenses scrubbing it wholesale rather than reasoning about each call site. The guard test names the variable literally rather than iterating the family constant: a test that asserts over the constant shrinks its own expectation when the family is emptied, which is the enumeration-relative failure that let the kimi-code descriptor go unwatched earlier in this same round. #2393's opt-in suite is unaffected (99/100, 0 fail): it sets process.env directly in-process and never routes through scrubConfigLocationEnv, and an explicit env argument still wins over TEST_ENV_BASE in childEnv.	2026-08-08 05:50:49 -05:00
0xdhx	652b99b71b	test(#2665): reversion guards for all three round-4 fixes ... None of the round-4 fixes had a test that fails on reversion: re-shipping the test-instrumentation chain passes #2858 (everything ships, so every require resolves), dropping the strict env from test.yml demotes the guard to report-only with nothing red, and the skillsHome derivation tests are enumeration-relative over declarations that are all empty today. One guard each, every one negative-controlled against its reverted fix (fails pre-fix, passes post-fix): - packaging-shipped-scripts-require-only-shipped.test.cjs asserts the four chain files are absent from the npm pack file list (reuses the tarball set the #2858 gate already resolves — no second npm pack). - live-config-guard.test.cjs asserts all three test jobs wire GSD_STRICT_LIVE_CONFIG_GUARD, matching the WHOLE expression anchored — a prefix match accepted both a Windows-silently-strict tail and a malformed one. - helpers-process-isolation.test.cjs cold-requires helpers.cjs in a child with sentinel skillsHome env vars injected into both enumerations, so the walk itself is under test rather than today's empty declarations.	2026-08-08 05:50:49 -05:00
0xdhx	7b8c36f904	fix(#2665): walk skillsHome.env on both descriptor rungs of the scrub derivation ... Review round 4, Minor 3. A configHome descriptor can nest a second, independently-resolved descriptor (skillsHome -> resolveSkillsBaseFromDescriptor) carrying its own env array, and the derivation walked configHome.env alone — the identical walk-one-field gap-shape rounds 2-3 closed for the registry and the non-registry set. Inert today (only kilo declares skillsHome, with env: []), closed before it is live rather than after. The guard's root enumeration deliberately does NOT gain the skills base: getGlobalSkillsBase returns a skills directory (codex: ~/.agents/skills), not a config root, and the snapshot applies the config-root layout beneath every root — adding it false-positives on <skillsBase>/gsd-core while missing a real <skillsBase>/gsd-help write (found by this round's pre-push adversarial review). Watching skills bases needs its own layout, like resolveExtraWatchTargets; a comment in resolveLiveConfigRoots records the non-action. New derivation test asserts both skillsHome rungs land in TEST_ENV_BASE, with an anti-vacuity check that at least one runtime actually declares the field.	2026-08-08 05:50:49 -05:00
0xdhx	fec42e9a7d	test(#2665): cover the widened derivation, and mark what these tests cannot prove ... Two tests for round 3's change (round 2 Blockers 1 and 2): KIMI_SHARE_DIR must arrive via NON_REGISTRY_CONFIG_HOME_DESCRIPTORS rather than a literal, and every GSD_LOCATION_ENV_KEYS entry must be blanked. Both assert a floor on their source first, so a renamed export fails loudly instead of passing vacuously. Negative-controlled against the registry-only derivation: both fail there, and only those two. And the Nit, which is the more useful half. This block asserts that TEST_ENV_BASE is not narrower than the enumerations it derives from. It cannot prove those enumerations are complete — a var no enumeration carries is invisible to every test here, and they stay green. That is exactly how round 2 found GSD_HOME and KIMI_SHARE_DIR while this block was fully green: one belonged to no enumeration at all, the other sat inside a function body where nothing could enumerate it. So the scope boundary is now written down at the top of the block, naming where the completeness question is actually answered — a source census re-derived each round, and live-config-guard.cjs observing real writes at runtime — so that a green run here is not misread as "the set is exhaustive." Deliberately NOT added: an assertion per reviewer-named variable. That is the hand-maintained list wearing a test's clothes, and it fails the same way.	2026-08-08 05:50:36 -05:00
0xdhx	a4efa4deda	test(#2665): cover the derivation and the in-process scrub ... The single regression test exercised CLAUDE_CONFIG_DIR only, so deleting GSD_RUNTIME or CODEX_HOME from any literal broke nothing -- a mutation of 24 of the 27 added key-value pairs survived. Four tests here: every configHome env var the registry declares is scrubbed; every scrubbed key is blanked rather than merely present; the four non-registry vars are named explicitly so deleting one is a failure rather than a silent narrowing; and scrubConfigLocationEnv round-trips both a set and an unset var (restoring an originally-unset var as '' would itself be a leak). Both derivation tests assert a floor on the registry first, so a renamed registry shape fails loudly instead of making the assertions vacuously true. Negative-controlled against the hand-written 3-key list this PR shipped: the parity test fails there and names all 19 missing vars. Addresses review findings: Major 6, Minor 8.	2026-08-08 05:50:17 -05:00
Tom Boucher	656bff8b73	test: add process-state isolation helper for reliability (#331)	2026-05-26 11:23:35 -04:00