@klhapp/skillmux 1.7.1 → 1.9.0

package/src/vault.ts

@@ -1,8 +1,12 @@
-import { existsSync, readdirSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
 
 export const SKILL_ID_PATTERN = /^[a-z0-9][a-z0-9-]{1,127}$/;
 
+/** Provenance sidecar filename (see provenance.ts). Kept here, not re-imported from
+ *  provenance.ts, so listSupportingFiles can exclude it without a circular import. */
+export const SKILLMUX_ORIGIN_FILENAME = ".skillmux-origin";
+
 export interface VaultSkill {
   skill_id: string;
   title: string;
@@ -45,8 +49,26 @@ export function decodeUtf8Strict(bytes: Uint8Array): string {
   return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
 }
 
+/** SKILL.md itself is read directly (not via listSupportingFiles, which excludes
+ *  it by name) — so its own symlink-ness must be checked here. Without this, a
+ *  symlinked SKILL.md reachable via a shared git-backed vault or a hand-edit would
+ *  have its target's content indexed and delivered to agents as the skill body.
+ *
+ *  The skill directory itself must be checked too, separately from SKILL.md's own
+ *  leaf check: `lstat` only refuses to follow the *final* path component, so a
+ *  symlinked skill directory containing a real (non-symlink) SKILL.md file at its
+ *  target silently passes the leaf check while still resolving straight through
+ *  to arbitrary host content. */
 export async function readSkill(vaultPath: string, skillId: string): Promise<VaultSkill> {
-  const bytes = await Bun.file(join(vaultPath, skillId, "SKILL.md")).bytes();
+  const skillDir = join(vaultPath, skillId);
+  if (lstatSync(skillDir).isSymbolicLink()) {
+    throw new Error(`refusing to read ${skillId}: the skill directory is a symlink`);
+  }
+  const path = join(skillDir, "SKILL.md");
+  if (lstatSync(path).isSymbolicLink()) {
+    throw new Error(`refusing to read ${skillId}/SKILL.md: it is a symlink`);
+  }
+  const bytes = await Bun.file(path).bytes();
   return parseSkillMd(skillId, decodeUtf8Strict(bytes));
 }
 
@@ -124,17 +146,35 @@ export function findShadowedSkills(vaultPath: string, localVaultPaths: string[])
   return shadowed.sort((a, b) => a.skill_id.localeCompare(b.skill_id));
 }
 
-/** Relative paths of everything under the skill dir except SKILL.md itself, sorted. */
+/** Relative paths of everything under the skill dir except SKILL.md and the
+ *  provenance sidecar, sorted. Symlinks are excluded rather than followed —
+ *  install/sync already refuse a skill containing one, but a symlink can still
+ *  reach the vault directly (a shared git-backed vault pulled in, or a hand-edit),
+ *  and this function otherwise feeds skill content straight into content
+ *  scanning (scan.ts) and drift hashing (provenance.ts). `skillId` must be a
+ *  single path segment — not the stricter SKILL_ID_PATTERN, since scanPath's
+ *  ad-hoc single-directory mode legitimately passes an arbitrary, not-yet-
+ *  normalized directory name — so `..`/`.`/a path separator is rejected to
+ *  keep the walk inside `vaultPath` without breaking that mode. */
 export function listSupportingFiles(vaultPath: string, skillId: string): string[] {
+  if (skillId === "" || skillId === "." || skillId === ".." || skillId.includes("/") || skillId.includes("\\")) {
+    return [];
+  }
   const root = join(vaultPath, skillId);
+  // A symlinked skill directory must not be walked into: readdirSync follows a
+  // symlinked path argument (unlike the entry.isSymbolicLink() check below, which
+  // only applies to entries *found by* the walk), so without this a symlinked
+  // `root` would return the target directory's file listing straight through.
+  if (!existsSync(root) || lstatSync(root).isSymbolicLink()) return [];
   const files: string[] = [];
   const walk = (dir: string) => {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isSymbolicLink()) continue;
       const abs = join(dir, entry.name);
       if (entry.isDirectory()) walk(abs);
       else if (statSync(abs).isFile()) {
         const rel = relative(root, abs);
-        if (rel !== "SKILL.md") files.push(rel);
+        if (rel !== "SKILL.md" && rel !== SKILLMUX_ORIGIN_FILENAME) files.push(rel);
       }
     }
   };