Tibsfox
0a18fc3464
fix(config): global skill symlink guard, tests, and empty-name handling ( #1992 )
...
Review feedback from @trek-e — three blocking issues and one style fix:
1. **Symlink escape guard** — Added validatePath() call on the resolved
global skill path with allowAbsolute: true. This routes the path
through the existing symlink-resolution and containment logic in
security.cjs, preventing a skill directory symlinked to an arbitrary
location from being injected. The name regex alone prevented
traversal in the literal name but not in the underlying directory.
2. **5 new tests** covering the global: code path:
- global:valid-skill resolves and appears in output
- global:invalid!name rejected by regex, skipped without crash
- global:missing-skill (directory absent) skipped gracefully
- Mix of global: and project-relative paths both resolve
- global: with empty name produces clear warning and skips
3. **Explicit empty-name guard** — Added before the regex check so
"global:" produces "empty skill name" instead of the confusing
'Invalid global skill name ""'.
4. **Style fix** — Hoisted require('os') and globalSkillsBase
calculation out of the loop, alongside the existing validatePath
import at the top of buildAgentSkillsBlock.
All 16 agent-skills tests pass.
2026-04-11 03:39:29 -07:00
..
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-11 03:39:29 -07:00
2026-04-10 10:49:00 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-10 12:30:46 -04:00
2026-04-07 17:27:20 -04:00
2026-04-05 23:07:52 -04:00
2026-04-04 14:29:03 -04:00
2026-04-10 13:55:13 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 07:58:27 -04:00
2026-04-04 07:24:31 -04:00
2026-04-05 23:11:18 -04:00
2026-04-07 08:13:52 -04:00
2026-04-05 17:49:20 -04:00
2026-04-05 17:32:18 -04:00
2026-04-05 18:05:32 -04:00
2026-04-05 18:20:11 -04:00
2026-04-05 23:11:16 -04:00
2026-04-07 17:36:47 -04:00
2026-04-07 17:26:29 -04:00
2026-04-07 17:19:10 -04:00
2026-04-07 17:28:23 -04:00
2026-04-10 10:48:00 -04:00
2026-04-10 10:50:17 -04:00
2026-04-10 11:19:32 -04:00
2026-04-10 11:25:55 -04:00
2026-04-10 11:15:59 -04:00
2026-04-10 12:07:13 -04:00
2026-04-10 21:37:08 -04:00
2026-04-07 08:13:58 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-06 15:14:02 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 15:12:58 -04:00
2026-04-10 13:58:16 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 19:43:45 -04:00
2026-04-10 10:46:21 -04:00
2026-04-10 10:49:58 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 17:02:20 -04:00
2026-04-10 10:56:09 -04:00
2026-04-04 14:29:03 -04:00
2026-04-10 10:49:00 -04:00
2026-04-07 17:25:11 -04:00
2026-04-10 15:00:38 -04:00
2026-04-04 14:29:03 -04:00
2026-04-10 11:47:22 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 09:15:41 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-01 08:47:31 -06:00
2026-04-04 14:29:03 -04:00
2026-04-05 10:23:41 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 18:33:27 -04:00
2026-04-05 18:33:17 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 15:50:01 -04:00
2026-04-06 15:19:46 -04:00
2026-04-10 21:30:13 -04:00
2026-04-10 15:56:19 -04:00
2026-04-05 11:30:38 -04:00
2026-04-04 14:37:54 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:15:30 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 18:33:24 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 23:07:59 -04:00
2026-04-05 18:33:15 -04:00
2026-04-10 12:30:24 -04:00
2026-04-10 11:47:22 -04:00
2026-04-05 19:09:14 -04:00
2026-04-07 17:39:29 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-07 17:26:31 -04:00
2026-04-04 14:29:03 -04:00
2026-04-06 08:54:18 -04:00
2026-04-04 15:52:13 -04:00
2026-04-05 17:03:17 -04:00
2026-04-10 21:55:44 -04:00
2026-04-05 18:05:32 -04:00
2026-04-07 08:13:46 -04:00
2026-04-05 17:05:06 -04:00
2026-04-04 14:29:03 -04:00
2026-04-03 12:47:24 +03:00
2026-04-05 09:15:19 -04:00
2026-04-06 15:13:23 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-10 12:04:33 -04:00
2026-04-04 14:29:03 -04:00
2026-04-10 12:41:59 -04:00
2026-04-03 13:32:05 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 12:41:17 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 20:03:47 -04:00
2026-04-05 10:23:41 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 10:23:41 -04:00
2026-04-10 21:55:44 -04:00
2026-04-10 21:55:44 -04:00
2026-04-04 14:29:03 -04:00
2026-04-10 10:50:35 -04:00
2026-04-10 12:29:25 -04:00
2026-04-06 15:20:06 -04:00
2026-04-10 10:44:15 -04:00
2026-04-04 07:14:24 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 17:04:33 -04:00
2026-04-01 16:53:20 -04:00
2026-04-04 14:29:03 -04:00
2026-03-24 13:33:58 -04:00
2026-04-05 20:22:52 -04:00
2026-04-04 07:10:21 -04:00
2026-04-04 14:29:03 -04:00
2026-04-10 13:55:27 -04:00
2026-04-10 10:46:21 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 17:49:20 -04:00
2026-04-05 17:04:08 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-05 17:00:30 -04:00
2026-04-04 14:29:03 -04:00
2026-04-10 11:03:10 -04:00
2026-04-02 18:55:17 -03:00
2026-04-10 12:29:09 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-04 14:29:03 -04:00
2026-04-06 08:40:37 -04:00
2026-04-05 22:54:12 -04:00
2026-04-05 12:30:24 -04:00
2026-04-05 10:23:41 -04:00
2026-04-02 21:36:36 -05:00
2026-04-04 14:29:03 -04:00
2026-04-05 11:11:38 -04:00
2026-04-10 12:30:08 -04:00
2026-04-04 14:29:03 -04:00