@promptci/core 0.2.2 → 0.4.0

package/dist/skill-supply-chain.js

@@ -119,6 +119,7 @@ import { realPathWithinRoot } from './path-containment.js';
 import { scanFencedLines } from './markdown-fences.js';
 import { extractFileRefs } from './skills-detector.js';
 import { codepointLabel, visibleText } from './evidence.js';
+import { treeFor } from './repo-tree.js';
 /** First entry of every finding's `tags`. */
 export const SKILL_SUPPLY_CHAIN_TAG = 'skill-supply-chain';
 /** Total bytes of skill content read per scan; the rest is reported, not read. */
@@ -2531,7 +2532,7 @@ function checkManifest(doc, hit, add) {
  * Bundled reference docs are not checked: they are where skills keep worked
  * examples of scripts the *reader* would write, which never exist.
  */
-function checkMissingScripts(repoRoot, skillDir, doc, alreadyReported, add) {
+function checkMissingScripts(tree, skillDir, doc, alreadyReported, add) {
     const pluginRoot = /^(.*?)\/?skills\/[^/]+$/.exec(skillDir)?.[1];
     const resolveCandidates = (raw) => {
         let ref = raw;
@@ -2578,7 +2579,7 @@ function checkMissingScripts(repoRoot, skillDir, doc, alreadyReported, add) {
         if (fsChecks >= MAX_FS_CHECKS_PER_DOC)
             return undefined;
         fsChecks++;
-        const result = isFileWithinRoot(repoRoot, p);
+        const result = isFileWithinRoot(tree, p);
         exists.set(p, result);
         return result;
     };
@@ -2751,7 +2752,7 @@ function loadDocs(repoRoot, relPath, isSkillMd, priority, budget) {
 }
 // ── Detector ──────────────────────────────────────────────────────────────────
 /** Scan one document (dropped by the caller right after). Returns package `bin` targets to scan next. */
-function scanDoc(repoRoot, skillDir, doc, isSkillMd, alreadyReported, collector, unscanned) {
+function scanDoc(tree, skillDir, doc, isSkillMd, alreadyReported, collector, unscanned) {
     const add = (rule, line, excerptText, severity, confidence) => {
         if (!collector.accepts(rule, doc.path, severity, confidence)) {
             collector.count(rule, doc.path);
@@ -2779,7 +2780,7 @@ function scanDoc(repoRoot, skillDir, doc, isSkillMd, alreadyReported, collector,
         const rel = name.replace(/^\.\//, '');
         if (!rel || rel.startsWith('/') || /^[a-z]:/i.test(rel))
             return false;
-        return [`${path.posix.dirname(doc.path)}/${rel}`, `${skillDir}/${rel}`, rel].some((p) => isFileWithinRoot(repoRoot, p));
+        return [`${path.posix.dirname(doc.path)}/${rel}`, `${skillDir}/${rel}`, rel].some((p) => isFileWithinRoot(tree, p));
     };
     const consumed = checkExec(doc, logical, commands, add, manifestExists);
     checkUnpinned(doc, commands, consumed, add);
@@ -2787,7 +2788,7 @@ function scanDoc(repoRoot, skillDir, doc, isSkillMd, alreadyReported, collector,
         checkProse(doc, add);
         checkHiddenMarkup(doc, add);
         if (isSkillMd && !doc.tail)
-            checkMissingScripts(repoRoot, skillDir, doc, alreadyReported, add);
+            checkMissingScripts(tree, skillDir, doc, alreadyReported, add);
     }
     else {
         checkScript(doc, consumed, add);
@@ -2807,19 +2808,24 @@ const DEPENDENCY_REF_RE = {
     worktrees: /(?:^|[\s'"`(=:])(?:\.\/)?worktrees\//m,
     '.worktrees': /(?:^|[\s'"`(=:])(?:\.\/)?\.worktrees\//m,
 };
-/** Non-sample hook files under a skill's `.git/hooks`. */
-function hasGitHooks(repoRoot, gitDir) {
-    const abs = resolveWithinRoot(repoRoot, `${gitDir}/hooks`);
-    if (!abs)
-        return false;
-    try {
-        return fs.readdirSync(abs).some((f) => !f.endsWith('.sample'));
-    }
-    catch {
+/**
+ * Non-sample hook files under a skill's `.git/hooks`.
+ *
+ * pcic-e6xa: listed through the scan's tree. The path is a fixed name under a
+ * discovered skill directory, but a `.git` committed as a link out of the
+ * repository used to decide whether this `warning` fires, and in the hosted
+ * product the scan root is a server temp directory.
+ */
+function hasGitHooks(tree, gitDir) {
+    const entries = tree.entries(`${gitDir}/hooks`);
+    if (typeof entries === 'string')
         return false;
-    }
+    for (const name of entries.keys())
+        if (!name.endsWith('.sample'))
+            return true;
+    return false;
 }
-function skipReason(skip, referenced, repoRoot) {
+function skipReason(skip, referenced, tree) {
     switch (skip.kind) {
         case 'dependency-dir': {
             const name = path.posix.basename(skip.path);
@@ -2828,7 +2834,7 @@ function skipReason(skip, referenced, repoRoot) {
             if (referenced.has(name)) {
                 return { path: skip.path, reason: `dependency/VCS directory the skill runs or references by path — not walked${read}`, severity: 'high' };
             }
-            if (name === '.git' && hasGitHooks(repoRoot, skip.path)) {
+            if (name === '.git' && hasGitHooks(tree, skip.path)) {
                 return { path: skip.path, reason: 'git directory with hooks — hooks run on git operations and were not scanned', severity: 'warning' };
             }
             return { path: skip.path, reason: `dependency/VCS directory — not walked${read}`, severity: 'info' };
@@ -2840,6 +2846,10 @@ function skipReason(skip, referenced, repoRoot) {
     }
 }
 export function detectSkillSupplyChain(context, limits = {}) {
+    // pcic-e6xa: every existence check this scan makes goes through the scan's
+    // tree, so a skill cannot point it outside the repository through a committed
+    // link; pcic-csf: a caller's file inventory answers first.
+    const tree = treeFor(context);
     // `allSkills`/`skillFiles` are optional for hand-built contexts from older releases.
     const ai = context.aiConfig ?? {};
     const allSkills = ai.allSkills ?? ai.skills ?? [];
@@ -2913,7 +2923,7 @@ export function detectSkillSupplyChain(context, limits = {}) {
             state.headContent = loaded.docs[0]?.content;
         for (const doc of loaded.docs) {
             noteReferences(state, doc);
-            extra.push(...scanDoc(context.repoRoot, state.dir, doc, isSkillMd, state.alreadyReported, state.collector, state.unscanned));
+            extra.push(...scanDoc(tree, state.dir, doc, isSkillMd, state.alreadyReported, state.collector, state.unscanned));
         }
         // A dependency package's `bin` targets are what `npx`/install runs: scan them as scripts.
         for (const target of extra)
@@ -2940,7 +2950,7 @@ export function detectSkillSupplyChain(context, limits = {}) {
             continue; // unreadable SKILL.md
         for (const skip of ai.skillBundleSkips ?? []) {
             if (owner(skip.path) === states.indexOf(state))
-                state.unscanned.push(skipReason(skip, state.referenced, context.repoRoot));
+                state.unscanned.push(skipReason(skip, state.referenced, tree));
         }
         // Name what could not be scanned — never drop it silently.
         for (const u of state.unscanned) {