@gajae-code/coding-agent 0.18.7 → 0.18.8

package/src/discovery/helpers.ts

@@ -479,6 +479,8 @@ export interface ScanSkillsFromDirOptions {
 	linkContainmentRoot?: string;
 	/** Filesystem authority for explicit-home reads. */
 	scope?: ReadScope;
+	/** User-owned permission to follow symlinks outside a user-scope scan root. */
+	allowExternalUserSkillSymlinks?: boolean;
 }
 
 // Stable ordering used for skill lists in prompts: name (case-insensitive), then name, then path.
@@ -498,6 +500,8 @@ export const SKILL_FRONTMATTER_SCAN_TOTAL_BYTES = 64 * 1024;
 
 export const SkillDiscoveryTestHooks: {
 	afterCandidateValidated?: (candidatePath: string) => void | Promise<void>;
+	afterSkillLinksCaptured?: (candidatePath: string) => void | Promise<void>;
+	afterSkillPathResolved?: (candidatePath: string) => void | Promise<void>;
 	afterAuthorityRootValidated?: (root: string) => void | Promise<void>;
 	afterAuthorityRootMissing?: (root: string) => void | Promise<void>;
 	afterContainedRootValidated?: (root: string) => void | Promise<void>;
@@ -517,6 +521,25 @@ interface ScanRootLinkIdentity {
 	target: DirectoryIdentity;
 }
 
+interface SkillFileIdentity {
+	dev: bigint;
+	ino: bigint;
+	realPath: string;
+}
+
+interface SkillLinkIdentity {
+	path: string;
+	dev: bigint;
+	ino: bigint;
+	linkText: string;
+	target: {
+		dev: bigint;
+		ino: bigint;
+		realPath: string;
+		kind: "directory" | "file";
+	};
+}
+
 async function captureScanRootLinkIdentity(root: string): Promise<ScanRootLinkIdentity | null> {
 	const observed = await fs.promises.lstat(root, { bigint: true });
 	if (!observed.isSymbolicLink()) return null;
@@ -577,6 +600,38 @@ async function directoryIdentityIsCurrent(
 	}
 }
 
+async function captureSkillLinkIdentity(linkPath: string): Promise<SkillLinkIdentity | null> {
+	const observed = await fs.promises.lstat(linkPath, { bigint: true });
+	if (!observed.isSymbolicLink()) return null;
+	const linkText = await fs.promises.readlink(linkPath);
+	const realPath = await fs.promises.realpath(linkPath);
+	const target = await fs.promises.stat(realPath, { bigint: true });
+	const kind = target.isDirectory() ? "directory" : target.isFile() ? "file" : undefined;
+	if (!kind) return null;
+	return {
+		path: linkPath,
+		dev: observed.dev,
+		ino: observed.ino,
+		linkText,
+		target: { dev: target.dev, ino: target.ino, realPath, kind },
+	};
+}
+
+async function skillLinkIdentityIsCurrent(expected: SkillLinkIdentity): Promise<boolean> {
+	try {
+		const observed = await fs.promises.lstat(expected.path, { bigint: true });
+		if (!observed.isSymbolicLink() || observed.dev !== expected.dev || observed.ino !== expected.ino) return false;
+		if ((await fs.promises.readlink(expected.path)) !== expected.linkText) return false;
+		const realPath = await fs.promises.realpath(expected.path);
+		if (normalizePathForComparison(realPath) !== normalizePathForComparison(expected.target.realPath)) return false;
+		const target = await fs.promises.stat(realPath, { bigint: true });
+		const kind = target.isDirectory() ? "directory" : target.isFile() ? "file" : undefined;
+		return kind === expected.target.kind && target.dev === expected.target.dev && target.ino === expected.target.ino;
+	} catch {
+		return false;
+	}
+}
+
 export async function scanSkillsFromDir(
 	_ctx: LoadContext,
 	options: ScanSkillsFromDirOptions,
@@ -693,7 +748,36 @@ export async function scanSkillsFromDir(
 		const relative = path.relative(realRoot, candidate);
 		return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
 	};
-	const openSkillFileSafely = async (skillPath: string): Promise<FileHandle> => {
+	const skillPathAndLinksAreCurrent = async (
+		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
+	): Promise<boolean> => {
+		try {
+			const [realPath, currentFile, currentLinks] = await Promise.all([
+				fs.promises.realpath(skillPath),
+				expectedFile ? fs.promises.stat(expectedFile.realPath, { bigint: true }) : Promise.resolve(undefined),
+				Promise.all(linkIdentities.map(skillLinkIdentityIsCurrent)),
+			]);
+			if (!expectedFile) return isWithinRoot(realPath) && currentLinks.every(Boolean);
+			if (!currentFile) return false;
+			return (
+				normalizePathForComparison(realPath) === normalizePathForComparison(expectedFile.realPath) &&
+				currentFile.isFile() &&
+				currentFile.nlink === 1n &&
+				currentFile.dev === expectedFile.dev &&
+				currentFile.ino === expectedFile.ino &&
+				currentLinks.every(Boolean)
+			);
+		} catch {
+			return false;
+		}
+	};
+	const openSkillFileSafely = async (
+		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
+	): Promise<FileHandle> => {
 		if (
 			!(await scanRootIsCurrent()) ||
 			(options.authorityRoot &&
@@ -707,14 +791,14 @@ export async function scanSkillsFromDir(
 			(process.platform === "win32" ? 0 : (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
 		const handle = await fs.promises.open(skillPath, flags);
 		try {
-			const [opened, observed, currentPath, currentScanRoot, currentAuthorityRoot] = await Promise.all([
+			const [opened, observed, currentScanRoot, currentAuthorityRoot, currentSkillPath] = await Promise.all([
 				handle.stat({ bigint: true }),
 				fs.promises.lstat(skillPath, { bigint: true }),
-				fs.promises.realpath(skillPath),
 				scanRootIsCurrent(),
 				options.authorityRoot && authorityIdentity
 					? directoryIdentityIsCurrent(options.authorityRoot, authorityIdentity)
 					: true,
+				skillPathAndLinksAreCurrent(skillPath, expectedFile, linkIdentities),
 			]);
 			if (
 				!opened.isFile() ||
@@ -723,9 +807,10 @@ export async function scanSkillsFromDir(
 				!observed.isFile() ||
 				opened.dev !== observed.dev ||
 				opened.ino !== observed.ino ||
-				!isWithinRoot(currentPath) ||
+				(expectedFile !== undefined && (opened.dev !== expectedFile.dev || opened.ino !== expectedFile.ino)) ||
 				!currentScanRoot ||
-				!currentAuthorityRoot
+				!currentAuthorityRoot ||
+				!currentSkillPath
 			) {
 				throw new Error(`Unsafe skill file: ${skillPath}`);
 			}
@@ -735,15 +820,20 @@ export async function scanSkillsFromDir(
 			throw error;
 		}
 	};
-	const readSkillContentSafely = async (skillPath: string): Promise<string> => {
-		const handle = await openSkillFileSafely(skillPath);
+	const readSkillContentSafely = async (
+		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
+	): Promise<string> => {
+		const handle = await openSkillFileSafely(skillPath, expectedFile, linkIdentities);
 		try {
 			const content = await handle.readFile({ encoding: "utf8" });
 			if (
 				!(await scanRootIsCurrent()) ||
 				(options.authorityRoot &&
 					authorityIdentity &&
-					!(await directoryIdentityIsCurrent(options.authorityRoot, authorityIdentity)))
+					!(await directoryIdentityIsCurrent(options.authorityRoot, authorityIdentity))) ||
+				!(await skillPathAndLinksAreCurrent(skillPath, expectedFile, linkIdentities))
 			) {
 				throw new Error(`Unsafe skill authority root for: ${skillPath}`);
 			}
@@ -754,8 +844,10 @@ export async function scanSkillsFromDir(
 	};
 	const readSkillFrontmatterSafely = async (
 		skillPath: string,
+		expectedFile: SkillFileIdentity | undefined,
+		linkIdentities: readonly SkillLinkIdentity[],
 	): Promise<{ frontmatter: SkillFrontmatter | null; size: number }> => {
-		const handle = await openSkillFileSafely(skillPath);
+		const handle = await openSkillFileSafely(skillPath, expectedFile, linkIdentities);
 		try {
 			const size = Number((await handle.stat({ bigint: true })).size);
 			const scanLimit = Math.min(size, SKILL_FRONTMATTER_SCAN_TOTAL_BYTES);
@@ -788,18 +880,55 @@ export async function scanSkillsFromDir(
 	};
 	const loadSkill = async (candidatePath: string) => {
 		try {
+			const linkIdentities = (
+				await Promise.all([
+					captureSkillLinkIdentity(path.dirname(candidatePath)),
+					captureSkillLinkIdentity(candidatePath),
+				])
+			).filter((identity): identity is SkillLinkIdentity => identity !== null);
+			await SkillDiscoveryTestHooks.afterSkillLinksCaptured?.(candidatePath);
 			const skillPath = await fs.promises.realpath(candidatePath);
-			if (!isWithinRoot(skillPath)) {
-				warnings.push(`Refusing skill path outside scan root: ${candidatePath}`);
+			await SkillDiscoveryTestHooks.afterSkillPathResolved?.(candidatePath);
+			const allowOutsideRoot = options.allowExternalUserSkillSymlinks && level === "user";
+			if (!isWithinRoot(skillPath) && !allowOutsideRoot) {
+				const remedy =
+					level === "user"
+						? `add ${path.dirname(path.dirname(skillPath))} to skills.customDirectories to load it, or enable skills.trustUserSkills`
+						: "keep project skill targets inside the skills scan root";
+				warnings.push(
+					`Refusing skill path outside scan root: ${candidatePath} (resolves to ${skillPath}; ${remedy})`,
+				);
 				return;
 			}
-			const stat = await fs.promises.stat(skillPath);
-			if (!stat.isFile() || stat.nlink !== 1) {
+			const stat = await fs.promises.stat(skillPath, { bigint: true });
+			if (!stat.isFile() || stat.nlink !== 1n) {
 				warnings.push(`Skill path is not a regular file: ${candidatePath}`);
 				return;
 			}
+			const pinExternalTarget = !isWithinRoot(skillPath) && allowOutsideRoot;
+			const fileLink = linkIdentities.find(identity => identity.path === candidatePath);
+			const parentLink = linkIdentities.find(identity => identity.path === path.dirname(candidatePath));
+			let capturedLinkTargetPath: string | undefined;
+			if (fileLink?.target.kind === "file") {
+				capturedLinkTargetPath = fileLink.target.realPath;
+			} else if (parentLink?.target.kind === "directory") {
+				capturedLinkTargetPath = path.join(parentLink.target.realPath, path.basename(candidatePath));
+			}
+			if (
+				pinExternalTarget &&
+				(!capturedLinkTargetPath ||
+					normalizePathForComparison(skillPath) !== normalizePathForComparison(capturedLinkTargetPath))
+			) {
+				warnings.push(`Refusing skill path not bound to its captured external link target: ${candidatePath}`);
+				return;
+			}
+			const fileIdentity = pinExternalTarget ? { dev: stat.dev, ino: stat.ino, realPath: skillPath } : undefined;
+			const pinnedLinkIdentities = pinExternalTarget ? linkIdentities : [];
 			await SkillDiscoveryTestHooks.afterCandidateValidated?.(candidatePath);
-			const { frontmatter, size } = await readSkillFrontmatterSafely(skillPath);
+			const { frontmatter, size } = await readSkillFrontmatterSafely(skillPath, fileIdentity, pinnedLinkIdentities);
+			if (!(await skillPathAndLinksAreCurrent(skillPath, fileIdentity, pinnedLinkIdentities))) {
+				throw new Error(`Unsafe skill link for: ${candidatePath}`);
+			}
 			if (!frontmatter) {
 				if (size > SKILL_FRONTMATTER_SCAN_TOTAL_BYTES) {
 					warnings.push(
@@ -823,8 +952,9 @@ export async function scanSkillsFromDir(
 			items.push({
 				name,
 				path: skillPath,
+				discoveryPath: candidatePath,
 				loadContent: async () => {
-					const content = await readSkillContentSafely(skillPath);
+					const content = await readSkillContentSafely(skillPath, fileIdentity, pinnedLinkIdentities);
 					return parseFrontmatter(content, { source: skillPath }).body;
 				},
 				frontmatter: frontmatter as SkillFrontmatter,
@@ -923,8 +1053,17 @@ export async function readContainedFile(
  * Expand environment variables in a string.
  * Supports ${VAR} and ${VAR:-default} syntax.
  */
-function expandEnvVars(value: string, extraEnv?: Record<string, string>): string {
+const SENSITIVE_ENV_NAME = /key|secret|token|pass|auth|credential|cookie|dsn|url$/i;
+
+export function isSensitiveEnvName(name: string): boolean {
+	return SENSITIVE_ENV_NAME.test(name);
+}
+
+function expandEnvVars(value: string, extraEnv?: Record<string, string>, skipSensitiveNames = false): string {
 	return value.replace(/\$\{([^}:]+)(?::-([^}]*))?\}/g, (_, varName: string, defaultValue?: string) => {
+		if (skipSensitiveNames && isSensitiveEnvName(varName)) {
+			return defaultValue !== undefined ? defaultValue : `\${${varName}}`;
+		}
 		const envValue = extraEnv?.[varName] ?? Bun.env[varName];
 		if (envValue !== undefined) return envValue;
 		if (defaultValue !== undefined) return defaultValue;
@@ -935,17 +1074,17 @@ function expandEnvVars(value: string, extraEnv?: Record<string, string>): string
 /**
  * Recursively expand environment variables in an object.
  */
-export function expandEnvVarsDeep<T>(obj: T, extraEnv?: Record<string, string>): T {
+export function expandEnvVarsDeep<T>(obj: T, extraEnv?: Record<string, string>, skipSensitiveNames = false): T {
 	if (typeof obj === "string") {
-		return expandEnvVars(obj, extraEnv) as T;
+		return expandEnvVars(obj, extraEnv, skipSensitiveNames) as T;
 	}
 	if (Array.isArray(obj)) {
-		return obj.map(item => expandEnvVarsDeep(item, extraEnv)) as T;
+		return obj.map(item => expandEnvVarsDeep(item, extraEnv, skipSensitiveNames)) as T;
 	}
 	if (obj !== null && typeof obj === "object") {
 		const result: Record<string, unknown> = {};
 		for (const [key, value] of Object.entries(obj)) {
-			result[key] = expandEnvVarsDeep(value, extraEnv);
+			result[key] = expandEnvVarsDeep(value, extraEnv, skipSensitiveNames);
 		}
 		return result as T;
 	}

package/src/discovery/mcp-json.ts

@@ -217,6 +217,12 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta, quiet = f
 				cwd: serverConfig.cwd,
 				url: serverConfig.url,
 				headers: serverConfig.headers,
+				publicNetwork:
+					serverConfig.type === "http" &&
+					"publicNetwork" in serverConfig &&
+					(serverConfig as { publicNetwork?: boolean }).publicNetwork === true
+						? true
+						: undefined,
 				auth: serverConfig.auth,
 				oauth: serverConfig.oauth,
 				transport: serverConfig.type,

package/src/discovery/ssh.ts

@@ -119,7 +119,7 @@ async function loadSshJsonFile(
 		warnings.push(`Failed to parse JSON in ${canonicalPath}`);
 		return { items, warnings };
 	}
-	const config = expandEnvVarsDeep(parsed);
+	const config = expandEnvVarsDeep(parsed, undefined, level === "project");
 	if (!config.hosts || typeof config.hosts !== "object") {
 		warnings.push(`Missing hosts in ${canonicalPath}`);
 		return { items, warnings };

package/src/discovery/substitute-plugin-root.ts

@@ -8,7 +8,9 @@ const GJC_VAR = "$" + "{GJC_PLUGIN_ROOT}";
 
 export function substitutePluginRoot<T>(value: T, rootPath: string): T {
 	if (typeof value === "string") {
-		return value.replaceAll(CLAUDE_VAR, rootPath).replaceAll(GJC_VAR, rootPath) as T;
+		// Function replacers: a string replacement would expand `$&`, `$$`, `` $` ``
+		// and `$'` inside the install path instead of inserting it verbatim.
+		return value.replaceAll(CLAUDE_VAR, () => rootPath).replaceAll(GJC_VAR, () => rootPath) as T;
 	}
 	if (Array.isArray(value)) {
 		return value.map(v => substitutePluginRoot(v, rootPath)) as T;

package/src/edit/file-read-cache.ts

@@ -27,7 +27,7 @@ import type { ToolSession } from "../tools";
 
 const MAX_PATHS_PER_SESSION = 30;
 /** Snapshot generations retained per path (newest first). */
-const MAX_GENERATIONS_PER_PATH = 4;
+const MAX_GENERATIONS_PER_PATH = 8;
 
 export interface FileReadSnapshot {
 	/** 1-indexed line number → exact line content as observed by `read`/`search`. */