@bhargavvc/sdd-cc 1.30.1 → 1.42.3

package/scripts/lint-skill-deps.cjs

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+/**
+ * lint-skill-deps.cjs
+ *
+ * Two checks:
+ *
+ * a) Frontmatter to body consistency:
+ *    For each commands/sdd/*.md, parse requires: and walk the body for
+ *    references to other SDD skills (pattern: /sdd:<stem> or sdd:<stem>).
+ *    Fail if a skill body references a skill not listed in requires:.
+ *
+ * b) Profile closure satisfaction:
+ *    Load PROFILES from install-profiles.cjs. For each non-full profile,
+ *    compute closure(profile.base) using the manifest. If any skill in
+ *    the closure references a skill NOT in the closure, fail.
+ *
+ * Usage:
+ *   node scripts/lint-skill-deps.cjs               # scans commands/sdd/
+ *   node scripts/lint-skill-deps.cjs --dir <path>  # scan a custom dir (testing)
+ *
+ * Exits 0 if all pass; exits 1 if any violation.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const PROFILES_MODULE = path.join(__dirname, '..', 'sdd', 'bin', 'lib', 'install-profiles.cjs');
+const { PROFILES, loadSkillsManifest, resolveProfile } = require(PROFILES_MODULE);
+
+// ---------------------------------------------------------------------------
+// Argument parsing
+// ---------------------------------------------------------------------------
+
+let commandsDir = path.join(__dirname, '..', 'commands', 'sdd');
+const args = process.argv.slice(2);
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === '--dir' && args[i + 1]) {
+    commandsDir = args[i + 1];
+    i++;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Reference extraction from skill body
+// ---------------------------------------------------------------------------
+
+function extractBodyReferences(body) {
+  const refs = new Set();
+  const re = /(?:\/?)sdd:([a-z0-9_-]+)/g;
+  let m;
+  while ((m = re.exec(body)) !== null) {
+    refs.add(m[1]);
+  }
+  return refs;
+}
+
+function extractBody(content) {
+  const fmEnd = content.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n/m);
+  if (!fmEnd) return content;
+  return content.slice(fmEnd[0].length);
+}
+
+// ---------------------------------------------------------------------------
+// Check a: frontmatter to body consistency
+// ---------------------------------------------------------------------------
+
+function checkFrontmatterBodyConsistency(manifest, allStems) {
+  const violations = [];
+
+  for (const [stem, declared] of manifest) {
+    if (stem.startsWith('_calls_agents_')) continue;
+    const filePath = path.join(commandsDir, stem + '.md');
+    let content;
+    try {
+      content = fs.readFileSync(filePath, 'utf8');
+    } catch {
+      continue;
+    }
+    const body = extractBody(content);
+    const referenced = extractBodyReferences(body);
+    const declaredSet = new Set(declared);
+    for (const ref of referenced) {
+      if (ref === stem) continue;
+      if (!allStems.has(ref)) {
+        violations.push({
+          stem,
+          filePath,
+          undeclared: ref,
+          message: 'body references unknown skill sdd:' + ref,
+        });
+        continue;
+      }
+      if (!declaredSet.has(ref)) {
+        violations.push({
+          stem,
+          filePath,
+          undeclared: ref,
+          message: 'body references sdd:' + ref + ' but requires: does not list it',
+        });
+      }
+    }
+  }
+
+  return violations;
+}
+
+// ---------------------------------------------------------------------------
+// Check b: profile closure satisfaction
+// ---------------------------------------------------------------------------
+
+function checkProfileClosure(manifest) {
+  const violations = [];
+
+  for (const profileName of Object.keys(PROFILES)) {
+    const base = PROFILES[profileName];
+    if (base === '*') continue;
+    const resolved = resolveProfile({ modes: [profileName], manifest });
+    if (resolved.skills === '*') continue;
+
+    const closure = resolved.skills;
+    for (const stem of closure) {
+      const deps = manifest.get(stem) || [];
+      for (const dep of deps) {
+        if (!closure.has(dep)) {
+          violations.push({
+            profile: profileName,
+            stem,
+            missingDep: dep,
+            message: 'profile "' + profileName + '" includes "' + stem + '" which requires "' + dep + '", but "' + dep + '" is not in the closure',
+          });
+        }
+      }
+    }
+  }
+
+  return violations;
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+const manifest = loadSkillsManifest(commandsDir);
+const allStems = new Set(
+  [...manifest.keys()].filter((k) => !k.startsWith('_calls_agents_'))
+);
+
+const consistencyViolations = checkFrontmatterBodyConsistency(manifest, allStems);
+const closureViolations = checkProfileClosure(manifest);
+
+const totalViolations = consistencyViolations.length + closureViolations.length;
+
+if (totalViolations === 0) {
+  const checked = manifest.size;
+  process.stdout.write('ok lint-skill-deps: ' + checked + ' skill(s) checked, 0 violations\n');
+  process.exit(0);
+}
+
+process.stderr.write('\nERROR lint-skill-deps: ' + totalViolations + ' violation(s) found\n\n');
+
+if (consistencyViolations.length > 0) {
+  process.stderr.write('Frontmatter to body consistency violations (' + consistencyViolations.length + '):\n\n');
+  for (const v of consistencyViolations) {
+    process.stderr.write('  ' + v.filePath + '\n');
+    process.stderr.write('    ' + v.message + '\n\n');
+  }
+  process.stderr.write('Fix: add missing deps to requires: in the skill frontmatter.\n\n');
+}
+
+if (closureViolations.length > 0) {
+  process.stderr.write('Profile closure violations (' + closureViolations.length + '):\n\n');
+  for (const v of closureViolations) {
+    process.stderr.write('  ' + v.message + '\n');
+  }
+  process.stderr.write('\nFix: add the missing skills to the profile base set in install-profiles.cjs.\n\n');
+}
+
+process.exit(1);

package/scripts/pr-template-policy.cjs

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+
+const TRUSTED_AUTHOR_ASSOCIATIONS = new Set([
+  'CONTRIBUTOR',
+  'COLLABORATOR',
+  'MEMBER',
+  'OWNER',
+]);
+
+const DEFAULT_TEMPLATE_MARKERS = [
+  'Wrong template',
+  'Every PR must use a typed template',
+  'Select the template that matches your PR',
+];
+
+const TEMPLATES = [
+  {
+    name: 'fix',
+    heading: 'Fix PR',
+    requiredHeadings: [
+      'Fix PR',
+      'Linked Issue',
+      'What was broken',
+      'What this fix does',
+      'Testing',
+      'Checklist',
+    ],
+  },
+  {
+    name: 'enhancement',
+    heading: 'Enhancement PR',
+    requiredHeadings: [
+      'Enhancement PR',
+      'Linked Issue',
+      'What this enhancement improves',
+      'Before / After',
+      'How it was implemented',
+      'Testing',
+      'Scope confirmation',
+      'Checklist',
+    ],
+  },
+  {
+    name: 'feature',
+    heading: 'Feature PR',
+    requiredHeadings: [
+      'Feature PR',
+      'Linked Issue',
+      'Feature summary',
+      'What changed',
+      'Implementation notes',
+      'Spec compliance',
+      'Testing',
+      'Scope confirmation',
+      'Checklist',
+    ],
+  },
+];
+
+function stripMarkdownDecoration(value) {
+  return value
+    .replace(/^\s*#+\s*/, '')
+    .replace(/\s*#+\s*$/, '')
+    .replace(/\*\*/g, '')
+    .trim()
+    .toLowerCase();
+}
+
+function extractHeadings(body) {
+  const headings = new Set();
+  for (const line of String(body || '').split(/\r?\n/)) {
+    if (/^\s*#{1,6}\s+\S/.test(line)) {
+      headings.add(stripMarkdownDecoration(line));
+    }
+  }
+  return headings;
+}
+
+function includesDefaultTemplate(body) {
+  const text = String(body || '').toLowerCase();
+  return DEFAULT_TEMPLATE_MARKERS.some((marker) => text.includes(marker.toLowerCase()));
+}
+
+function matchingTemplate(body) {
+  const headings = extractHeadings(body);
+  for (const template of TEMPLATES) {
+    if (!headings.has(stripMarkdownDecoration(template.heading))) continue;
+    const missingHeadings = template.requiredHeadings.filter((heading) => {
+      return !headings.has(stripMarkdownDecoration(heading));
+    });
+    return {
+      template: template.name,
+      missingHeadings,
+    };
+  }
+  return {
+    template: null,
+    missingHeadings: [],
+  };
+}
+
+function evaluatePrTemplate(body, authorAssociation) {
+  const association = String(authorAssociation || '').toUpperCase();
+  const trusted = TRUSTED_AUTHOR_ASSOCIATIONS.has(association);
+  const normalizedBody = String(body || '').trim();
+
+  let valid = true;
+  let reason = 'PR body uses a typed pull request template.';
+  let template = null;
+  let missingHeadings = [];
+
+  if (!normalizedBody) {
+    valid = false;
+    reason = 'PR body is empty; a typed pull request template is required.';
+  } else {
+    const match = matchingTemplate(normalizedBody);
+    template = match.template;
+    missingHeadings = match.missingHeadings;
+    if (template && missingHeadings.length === 0) {
+      valid = true;
+    } else if (template && missingHeadings.length > 0) {
+      valid = false;
+      reason = `PR body appears to use the ${template} template but is missing required headings.`;
+    } else if (includesDefaultTemplate(normalizedBody)) {
+      valid = false;
+      reason = 'PR body still contains the default wrong-template guidance.';
+    } else {
+      valid = false;
+      reason = 'PR body does not match the fix, enhancement, or feature template.';
+    }
+  }
+
+  let action = 'pass';
+  if (!valid) {
+    action = trusted ? 'warn' : 'close';
+  }
+
+  return {
+    valid,
+    action,
+    trusted,
+    authorAssociation: association || 'UNKNOWN',
+    template,
+    reason,
+    missingHeadings,
+  };
+}
+
+function main() {
+  const result = evaluatePrTemplate(process.env.PR_BODY || '', process.env.AUTHOR_ASSOCIATION || '');
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (process.env.GITHUB_OUTPUT) {
+    const fs = require('fs');
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `result=${JSON.stringify(result)}\n`);
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `action=${result.action}\n`);
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `valid=${result.valid ? 'true' : 'false'}\n`);
+  }
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  evaluatePrTemplate,
+  extractHeadings,
+  includesDefaultTemplate,
+  matchingTemplate,
+};

package/scripts/prompt-injection-scan.sh

@@ -72,8 +72,11 @@ ALLOWLIST=(
   'tests/security-scan.test.cjs'
   'tests/security.test.cjs'
   'tests/prompt-injection-scan.test.cjs'
+  'tests/verify.test.cjs'
   'sdd/bin/lib/security.cjs'
   'hooks/sdd-prompt-guard.js'
+  'hooks/sdd-read-injection-scanner.js'
+  'tests/read-injection-scanner.test.cjs'
   'SECURITY.md'
 )