@salesforce/afv-skills 1.44.0 → 1.46.0

package/skills/dx-code-analyzer-configure/scripts/validate-config.sh

@@ -37,10 +37,11 @@ fi
 # Basic YAML syntax check (if python3 available)
 if command -v python3 &> /dev/null; then
     echo "Checking YAML syntax..."
-    if python3 -c "
+    if python3 - "$CONFIG_FILE" 2>&1 <<'PYEOF'; then
 import yaml, sys
+config_file = sys.argv[1]
 try:
-    with open('${CONFIG_FILE}', 'r') as f:
+    with open(config_file, 'r') as f:
         config = yaml.safe_load(f)
     if config is None:
         print('WARNING: Config file is empty or contains only comments')
@@ -50,10 +51,10 @@ try:
         sys.exit(1)
     print('YAML syntax: OK')
 except yaml.YAMLError as e:
-    print(f'ERROR: Invalid YAML syntax')
+    print('ERROR: Invalid YAML syntax')
     print(f'  {e}')
     sys.exit(1)
-" 2>&1; then
+PYEOF
         echo ""
     else
         echo ""
@@ -69,16 +70,19 @@ echo "Checking known fields..."
 VALID_TOP_LEVEL="config_root log_folder log_level rules engines ignores suppressions"
 
 if command -v python3 &> /dev/null; then
-    python3 -c "
+    python3 - "$CONFIG_FILE" "$VALID_TOP_LEVEL" 2>&1 <<'PYEOF'
 import yaml, sys
 
-with open('${CONFIG_FILE}', 'r') as f:
+config_file = sys.argv[1]
+valid_top_level = sys.argv[2]
+
+with open(config_file, 'r') as f:
     config = yaml.safe_load(f)
 
 if config is None:
     sys.exit(0)
 
-valid_fields = set('${VALID_TOP_LEVEL}'.split())
+valid_fields = set(valid_top_level.split())
 unknown = set(config.keys()) - valid_fields
 if unknown:
     print(f'WARNING: Unknown top-level fields: {sorted(unknown)}')
@@ -100,12 +104,12 @@ if 'engines' in config and config['engines']:
 # Check ignores section
 if 'ignores' in config and config['ignores']:
     if 'files' not in config['ignores']:
-        print('WARNING: ignores section should contain a \"files\" list')
+        print('WARNING: ignores section should contain a "files" list')
     elif not isinstance(config['ignores']['files'], list):
         print('ERROR: ignores.files must be a list of glob patterns')
         sys.exit(1)
     else:
-        print(f'Ignore patterns: {len(config[\"ignores\"][\"files\"])} patterns configured')
+        print(f'Ignore patterns: {len(config["ignores"]["files"])} patterns configured')
 
 # Check rules section
 if 'rules' in config and config['rules']:
@@ -120,7 +124,7 @@ if 'rules' in config and config['rules']:
                             print(f'WARNING: rules.{engine}.{rule_name}.severity = {sev} (expected 1-5 or Critical/High/Moderate/Low/Info)')
 
 print('')
-" 2>&1
+PYEOF
 fi
 
 # Run sf code-analyzer config validation (if sf CLI available)

package/skills/dx-code-analyzer-run/scripts/apply-fixes.js

@@ -15,14 +15,55 @@ const filePath = process.argv[2];
 const data = JSON.parse(fs.readFileSync(filePath, "utf8"));
 const runDir = data.runDir || "";
 
-// Group fixes by file
+// Fix targets are confined to the current working directory (the project being
+// fixed). loc.file and runDir come from the results JSON and are untrusted;
+// resolving each target against cwd and rejecting anything that escapes it
+// stops a crafted results file from writing arbitrary paths (e.g. /etc/passwd
+// or ../../outside-project).
+const baseDir = fs.realpathSync(process.cwd());
+
+function isOutside(base, target) {
+  const rel = path.relative(base, target);
+  return rel === "" || rel.startsWith("..") || path.isAbsolute(rel);
+}
+
+function safeResolve(candidate) {
+  if (typeof candidate !== "string" || !candidate) return null;
+  let rel = candidate;
+  // Engine output often uses absolute paths under the scan runDir; normalize
+  // those to project-relative before confinement.
+  if (runDir && rel.startsWith(runDir)) rel = rel.substring(runDir.length + 1);
+  const resolved = path.resolve(baseDir, rel);
+  // Lexical guard: rejects absolute paths and `..` traversal.
+  if (isOutside(baseDir, resolved)) return null;
+  // Symlink-aware guard: path.resolve/relative do not follow symlinks, so a
+  // symlinked path component (e.g. `link/victim` where `link` -> outside the
+  // tree) would pass the lexical check and let writeFileSync escape. Fix
+  // targets are read before being written, so the file exists — resolve its
+  // real path and re-check. Writing to the realpath also avoids following a
+  // symlink at write time. A missing target (realpathSync throws) is skipped.
+  let real;
+  try {
+    real = fs.realpathSync(resolved);
+  } catch {
+    return null;
+  }
+  if (isOutside(baseDir, real)) return null;
+  return real;
+}
+
+// Group fixes by confined, absolute file path
 const fileFixesMap = new Map();
+let fixesSkippedUnsafe = 0;
 data.violations.forEach(v => {
   if (v.fixes && v.fixes.length > 0) {
     v.fixes.forEach(fix => {
       const loc = fix.location;
-      let filePath = loc.file;
-      if (runDir && filePath.startsWith(runDir)) filePath = filePath.substring(runDir.length + 1);
+      const filePath = safeResolve(loc.file);
+      if (!filePath) {
+        fixesSkippedUnsafe++;
+        return;
+      }
 
       if (!fileFixesMap.has(filePath)) fileFixesMap.set(filePath, []);
       fileFixesMap.get(filePath).push({
@@ -83,4 +124,4 @@ fileFixesMap.forEach((fixes, filePath) => {
   }
 });
 
-console.log(JSON.stringify({ success: true, filesModified, fixesApplied, fixesSkipped, totalFixableFiles: fileFixesMap.size }));
+console.log(JSON.stringify({ success: true, filesModified, fixesApplied, fixesSkipped, fixesSkippedUnsafe, totalFixableFiles: fileFixesMap.size }));

package/skills/dx-code-analyzer-run/scripts/describe-rule.js

@@ -15,7 +15,32 @@
 //       resource:    https://...
 //       description: Some description text
 
-const { execSync } = require("child_process");
+const { execFileSync } = require("child_process");
+
+/**
+ * Run `sf code-analyzer rules ...` safely.
+ *
+ * Arguments are passed as an argv array (NOT a shell string), so a rule name
+ * or --engine value can never be interpreted as shell syntax. Returns the
+ * command's stdout as text; never throws (a non-zero exit still yields the
+ * output the caller wants to parse).
+ */
+function runCodeAnalyzerRules(extraArgs) {
+  try {
+    return execFileSync("sf", ["code-analyzer", "rules", ...extraArgs], {
+      encoding: "utf8",
+      timeout: 60000,
+      maxBuffer: 2 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch (err) {
+    // Preserve the original `2>&1` behavior: a non-zero exit that emitted
+    // partial stdout plus a diagnostic on stderr must surface BOTH streams, in
+    // order, so a genuine failure isn't misparsed as "rule not found".
+    const combined = String(err.stdout || "") + String(err.stderr || "");
+    return combined || (err.output && err.output.filter(Boolean).join("")) || "";
+  }
+}
 
 function printUsage() {
   console.error(`Usage: node describe-rule.js <rule-name> [--engine <engine>]
@@ -52,25 +77,21 @@ for (let i = 1; i < args.length; i++) {
 // Build the rule selector for the lookup
 const selector = engine ? `${engine}:${ruleName}` : ruleName;
 
-// Run `sf code-analyzer rules` with --view detail to get full rule info
-let rawOutput;
-try {
-  const cmd = `sf code-analyzer rules --rule-selector "${selector}" --view detail 2>&1`;
-  rawOutput = execSync(cmd, {
-    encoding: "utf8",
-    timeout: 60000,
-    maxBuffer: 2 * 1024 * 1024,
-  });
-} catch (err) {
-  // execSync throws on non-zero exit, but we still want the output
-  rawOutput = err.stdout || err.stderr || (err.output && err.output.join("")) || "";
-  if (!rawOutput) {
-    console.log(JSON.stringify({
-      status: "error",
-      message: `Failed to run sf code-analyzer rules: ${err.message}`,
-    }));
-    process.exit(0);
-  }
+// Run `sf code-analyzer rules` with --view detail to get full rule info.
+// `selector` is passed as a single argv element, so it cannot inject shell
+// commands even if it contains metacharacters.
+const rawOutput = runCodeAnalyzerRules([
+  "--rule-selector",
+  selector,
+  "--view",
+  "detail",
+]);
+if (!rawOutput) {
+  console.log(JSON.stringify({
+    status: "error",
+    message: `Failed to run sf code-analyzer rules for selector "${selector}"`,
+  }));
+  process.exit(0);
 }
 
 // Parse the detail view output
@@ -224,12 +245,16 @@ function parseDetailOutput(output) {
 function tryGrepFallback(ruleName, engine) {
   try {
     const sel = engine || "Recommended";
-    const cmd = `sf code-analyzer rules --rule-selector "${sel}" 2>&1 | grep -i "${ruleName}"`;
-    const grepOutput = execSync(cmd, {
-      encoding: "utf8",
-      timeout: 60000,
-      maxBuffer: 2 * 1024 * 1024,
-    });
+    const output = runCodeAnalyzerRules(["--rule-selector", sel]);
+
+    // Case-insensitive substring filter done in JS. Previously this shelled out
+    // to `... | grep -i "${ruleName}"`, interpolating the untrusted rule name
+    // into a shell command; matching here removes that injection sink.
+    const needle = ruleName.toLowerCase();
+    const grepOutput = output
+      .split("\n")
+      .filter((line) => line.toLowerCase().includes(needle))
+      .join("\n");
 
     if (!grepOutput.trim()) return null;
 
@@ -273,12 +298,7 @@ function tryGrepFallback(ruleName, engine) {
 function tryFuzzyFallback(ruleName, engine) {
   try {
     const sel = engine || "Recommended";
-    const cmd = `sf code-analyzer rules --rule-selector "${sel}" 2>&1`;
-    const output = execSync(cmd, {
-      encoding: "utf8",
-      timeout: 60000,
-      maxBuffer: 2 * 1024 * 1024,
-    });
+    const output = runCodeAnalyzerRules(["--rule-selector", sel]);
 
     // Extract rule names from table output
     // Lines with rule data have: index  name  engine  severity  tags

package/skills/platform-apex-logs-debug/SKILL.md

@@ -2,11 +2,8 @@
 name: platform-apex-logs-debug
 description: "Salesforce debug log analysis and troubleshooting with 100-point scoring. TRIGGER when: user analyzes debug logs, hits governor limits, reads stack traces, or touches .log files from Salesforce orgs. DO NOT TRIGGER when: running Apex tests (use platform-apex-test-run), generating or fixing Apex code (use platform-apex-generate), or Agentforce session tracing (use agentforce-observe)."
 metadata:
-  cliTools:
-    - tool: ["jq"]
-      semver: ">=1.6.0"
-    - tool: ["sf"]
-      semver: ">=2.0.0"
+  version: "1.1"
+  domains: ["Platform"]
   relatedSkills:
     - "agentforce-observe"
     - "platform-apex-generate"
@@ -14,8 +11,11 @@ metadata:
     - "platform-data-manage"
     - "platform-metadata-deploy"
     - "platform-soql-query"
-  version: "1.1"
-  domains: ["Platform"]
+  cliTools:
+    - tool: ["sf"]
+      semver: ">=2.0.0"
+    - tool: ["jq"]
+      semver: ">=1.6.0"
 ---
 
 # platform-apex-logs-debug: Salesforce Debug Log Analysis & Troubleshooting

package/skills/platform-custom-application-generate/SKILL.md

@@ -2,11 +2,11 @@
 name: platform-custom-application-generate
 description: "Use this skill when users need to create or configure tab-based Salesforce Custom Applications with navigation, branding, and action overrides. Trigger when users mention custom apps, application metadata, app navigation, or organizing tabs into applications. Use when users want to create app containers for tabs and pages. Do NOT use when the goal is hosting a React UI bundle in the App Launcher — use experience-ui-bundle-custom-app-generate for that case."
 metadata:
-  relatedSkills:
-    - "experience-ui-bundle-custom-app-generate"
   version: "1.0"
   domains: ["Platform"]
   minApiVersion: "60.0"
+  relatedSkills:
+    - "experience-ui-bundle-custom-app-generate"
 ---
 
 ## When to Use This Skill
@@ -48,8 +48,8 @@ Custom applications (Lightning Apps) that group tabs and functionality to provid
 - **description**: Brief description of the application's purpose
 - **tabs**: Array of tab names to include
 - **utilityBar**: API name of the Utility Bar configuration
-- **brand**: ⚠️ HIGHLY RECOMMENDED - Branding configuration object (headerColor, shouldOverrideOrgTheme, footerColor)
-- **actionOverrides**: ⚠️ REQUIRED when custom record pages exist - Action override configuration (actionName, content, formFactor, type, pageOrSobjectType)
+- **brand**: HIGHLY RECOMMENDED - Branding configuration object (headerColor, shouldOverrideOrgTheme, footerColor)
+- **actionOverrides**: REQUIRED when custom record pages exist - Action override configuration (actionName, content, formFactor, type, pageOrSobjectType)
 - **profileActionOverrides**: Profile-specific action overrides (actionName, content, formFactor, pageOrSobjectType, type, profile)
 - **isNavAutoTempTabsDisabled**: Navigation behavior setting (default: false)
 - **isNavPersonalizationDisabled**: Personalization setting (default: false)

package/skills/platform-custom-object-generate/SKILL.md

@@ -25,7 +25,7 @@ This document defines the mandatory constraints for generating CustomObject meta
 
 **File extension:** `.object-meta.xml`
 
-> **🔔 Description freshness — applies to EVERY object change, fields AND validation rules:** Whenever you add, update, or delete a field **or a validation rule** on an object, the `<description>` may now be stale. Before finishing, refresh it per **Section 3.B** (propose, confirm with the user, write). A validation-rule change counts exactly like a field change — the change is **not** done until the description has been reconciled. This is easy to forget on validation-rule edits/deletes — don't.
+> **Description freshness — applies to EVERY object change, fields AND validation rules:** Whenever you add, update, or delete a field **or a validation rule** on an object, the `<description>` may now be stale. Before finishing, refresh it per **Section 3.B** (propose, confirm with the user, write). A validation-rule change counts exactly like a field change — the change is **not** done until the description has been reconciled. This is easy to forget on validation-rule edits/deletes — don't.
 
 ---
 
@@ -57,7 +57,7 @@ The following constraints must be true for the XML body to deploy successfully.
 - IF object has Master-Detail field → use `ControlledByParent`
 - IF a Master-Detail field is being added to an existing child object → that existing object's `<sharingModel>` must also be updated to `ControlledByParent`
 
-**❌ INCORRECT** — Will cause error: `Cannot set sharingModel to ReadWrite on a CustomObject with a MasterDetail relationship field`
+**INCORRECT** — Will cause error: `Cannot set sharingModel to ReadWrite on a CustomObject with a MasterDetail relationship field`
 ```xml
 <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
   <label>Order Line Item</label>
@@ -67,7 +67,7 @@ The following constraints must be true for the XML body to deploy successfully.
 </CustomObject>
 ```
 
-**✅ CORRECT:**
+**CORRECT:**
 ```xml
 <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
   <label>Order Line Item</label>
@@ -191,7 +191,7 @@ Do not create more than **2 Master-Detail relationships** for a single object. I
 
 Do NOT include the `<fullName>` tag at the root of the `.object-meta.xml` file. The API name is derived from the filename.
 
-**❌ INCORRECT:**
+**INCORRECT:**
 ```xml
 <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
   <fullName>Vehicle__c</fullName>  <!-- WRONG: Remove this -->
@@ -199,7 +199,7 @@ Do NOT include the `<fullName>` tag at the root of the `.object-meta.xml` file.
 </CustomObject>
 ```
 
-**✅ CORRECT:**
+**CORRECT:**
 ```xml
 <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
   <label>Vehicle</label>
@@ -218,7 +218,7 @@ Validation rule names follow different conventions than custom fields.
 - Cannot contain two consecutive underscores
 - **Must NOT end with `__c`** (unlike custom fields)
 
-**❌ INCORRECT:**
+**INCORRECT:**
 ```xml
 <validationRules>
   <fullName>Require_Start_Date__c</fullName>  <!-- WRONG: Has __c suffix -->
@@ -229,7 +229,7 @@ Validation rule names follow different conventions than custom fields.
 ```
 **Error:** `The validation name can only contain alphanumeric characters, must begin with a letter, cannot end with an underscore...`
 
-**✅ CORRECT:**
+**CORRECT:**
 ```xml
 <validationRules>
   <fullName>Require_Start_Date</fullName>  <!-- CORRECT: No __c suffix -->

package/skills/platform-custom-tab-generate/SKILL.md

@@ -81,7 +81,7 @@ Also forbidden:
     <motif>Custom98: Truck</motif>
 </CustomTab>
 ```
-- **❌ WRONG** — do NOT add `<sobjectName>`, `<name>`, `<fullName>`, or `<label>`:
+- **WRONG** — do NOT add `<sobjectName>`, `<name>`, `<fullName>`, or `<label>`:
 ```xml
 <CustomTab xmlns="http://soap.sforce.com/2006/04/metadata">
     <sobjectName>Space_Station__c</sobjectName>  <!-- DEPLOYMENT ERROR -->

package/skills/platform-flexipage-generate/SKILL.md

@@ -11,6 +11,10 @@ metadata:
       semver: ">=3.10.0"
     - tool: ["sf"]
       semver: ">=2.126.4"
+  mcpTools:
+    metadata-experts:
+      tools: ["execute_metadata_action"]
+      semver: ">=1.0.0"
 ---
 
 ## When to Use This Skill

package/skills/platform-list-view-generate/SKILL.md

@@ -4,6 +4,7 @@ description: "Use this skill when users need to create, generate, or validate Sa
 metadata:
   version: "1.0"
   domains: ["Platform"]
+  minApiVersion: "51.0"
 ---
 
 ## When to Use This Skill

package/skills/platform-soql-query/SKILL.md

@@ -2,6 +2,14 @@
 name: platform-soql-query
 description: "SOQL query generation, optimization, and analysis with 100-point scoring. Use this skill when the user needs SOQL/SOSL authoring or optimization: natural-language-to-query generation, relationship queries, aggregates, query-plan analysis, and performance or safety improvements for Salesforce queries. TRIGGER when: user writes, optimizes, or debugs SOQL/SOSL queries, touches .soql files, or asks about relationship queries, aggregates, or query performance. DO NOT TRIGGER when: bulk data operations (use platform-data-manage), Apex DML logic (use platform-apex-generate), or report/dashboard queries."
 metadata:
+  version: "1.1"
+  domains: ["Platform"]
+  relatedSkills:
+    - "experience-lwc-generate"
+    - "platform-apex-generate"
+    - "platform-apex-logs-debug"
+    - "platform-apex-test-run"
+    - "platform-data-manage"
   cliTools:
     - tool: ["jq"]
       semver: ">=1.6.0"
@@ -9,14 +17,6 @@ metadata:
       semver: ">=3.10.0"
     - tool: ["sf"]
       semver: ">=2.0.0"
-  relatedSkills:
-    - "experience-lwc-generate"
-    - "platform-apex-generate"
-    - "platform-apex-logs-debug"
-    - "platform-apex-test-run"
-    - "platform-data-manage"
-  version: "1.1"
-  domains: ["Platform"]
 ---
 
 # platform-soql-query: Salesforce SOQL Query Expert

package/skills/platform-value-set-generate/SKILL.md

@@ -2,11 +2,11 @@
 name: platform-value-set-generate
 description: "Use this skill when users need to create, generate, or validate a Salesforce global value set or customize a standard value set. Trigger when users mention a global value set, GlobalValueSet, standard value set, StandardValueSet, a reusable picklist, a picklist value set shared across fields, or customizing standard picklists like Industry, Lead Source, or Opportunity Stage. Also use when users hit deployment errors adding values to a standard picklist, referencing a value set from a custom field, or working with .globalValueSet-meta.xml or .standardValueSet-meta.xml files. DO NOT TRIGGER for an inline one-off picklist on a single field with no reuse, or for general custom field metadata work that does not involve a GlobalValueSet or StandardValueSet — use platform-custom-field-generate instead."
 metadata:
-  relatedSkills:
-    - "platform-custom-field-generate"
   version: "1.0"
   domains: ["Platform"]
   minApiVersion: "60.0"
+  relatedSkills:
+    - "platform-custom-field-generate"
   cliTools:
     - tool: ["sf"]
       semver: ">=2.0.0"