@skillsmith/core 0.11.6 → 0.12.0

package/CHANGELOG.md

@@ -4,6 +4,214 @@ All notable changes to `@skillsmith/core` are documented here.
 
 ## [Unreleased]
 
+## v0.12.0
+
+- **Cadence**: Mechanical cadence alignment (no changes since v0.11.7).
+- **Feature**: new `resolveSessionTier` client (`sync/license-status-client.ts`, SMI-6098) —
+  authenticates the stored device-login session against `/license-status` (proactively refreshing
+  via the existing `resolveAccessToken` helper) so the MCP server can resolve a real subscription
+  tier for a `skillsmith login` session with no separately-configured `SKILLSMITH_API_KEY`.
+  Throws `SessionTierAuthError` (no session / refresh failed) or `SessionTierTransientError`
+  (network error, HTTP 429/5xx, unexpected response) so callers never conflate "couldn't check"
+  with a definitive `community` result.
+- **Fix**: `analyzeMarkdownContext`'s indented-code-block heuristic (4+ spaces or a tab = a
+  markdown documentation example) was being applied unconditionally to every scanned file,
+  including the new Gap 8 extended siblings — real, non-markdown source files. Since virtually all
+  indented Python/Ruby/Perl/etc. control-flow bodies match this pattern, it silently downgraded
+  `sensitive_path` findings from `high` to `medium` and blocked `escalateCodeExecution`'s
+  co-signal escalation path in those files, discovered via a genuine multi-signal backdoor fixture
+  (a `~/.ssh` read next to a `curl|bash`) that failed to escalate to `critical` purely because its
+  containing function body was indented. `analyzeMarkdownContext`/`scanSkillContent` (both edge
+  twins) and core's `SecurityScanner.scan()` now take an `isMarkdown` parameter (default `true`,
+  byte-identical behavior for every existing caller) that the indexer's extended-sibling scan path
+  and `bundled-sibling-scan.ts`'s executable-code candidates now pass `false` for.
+- **Feature**: scoped bundled-file scan expansion to operational code (SMI-6033 Wave 2, Gap 8) —
+  the final wave of the ClawHavoc scanner-gap remediation initiative. The indexer previously only
+  ever read `SKILL.md` plus 7 fixed sibling filenames, never `scripts/`, `src/`, or `bin/`, so a
+  backdoor buried mid-function in otherwise-working operational code was structurally invisible to
+  the scanner. New `fetchRepoTreeEntries` (run-scoped memoized, budgeted via
+  `MAX_TREE_FETCHES_PER_RUN`/`SKILLSMITH_MAX_TREE_FETCHES_PER_RUN`, default 300) fetches the
+  repo's git tree once per repo per run; `enumerateExtendedSiblingTargets` deterministically ranks
+  and caps (`MAX_EXTENDED_SIBLING_FILES = 20`) executable-code candidates (`.sh .py .js .mjs .cjs
+  .ts .rb .php .ps1 .pl`) by SKILL.md-reference, entry-point naming, path depth, then lexicographic
+  order. Two new `skills` columns (`scan_coverage_incomplete`/`scan_coverage_note`) record — never
+  silently — when the extended selection couldn't cover everything (count cap, size cap, a
+  transient sibling-fetch failure, a Trees API fetch failure, a truncated tree response, or a
+  spent per-run fetch budget); a clean 404 does not count. Surfaced in `get_skill`, `search`, and
+  `skill_recommend` output as a plain informational caveat (never a rejection signal). Local
+  `skill_rescan`/`skill_validate` gets the same ranked, capped selection via
+  `bundled-sibling-scan.ts`'s `collectExecutableCodeFiles` (replacing the narrower `.sh`-only
+  `collectShFiles`), closing that module's own documented Phase-3 follow-up — this narrows its
+  existing local scan-file cap from 50 to 20 to match the registry-side cap, an intentional
+  behavior change, not a pure addition.
+- **Fix**: adversarial review of the above (2026-08-16) found that applying the existing
+  sibling-rejection rule (any `code_execution`/`obfuscated_directive` finding on a non-doc sibling
+  standalone-quarantines) unchanged to the new extended surface would have quarantined ordinary
+  installer scripts — a `scripts/install.sh` using the industry-standard `curl | bash` idiom
+  (rustup, Homebrew, nvm, bun) scores the SAME `code_execution:medium` finding as an actual
+  backdoor, and the plan's own policy is explicit that a bare `curl | bash` must never
+  standalone-quarantine. `mergeSiblingScans`/`isExecutionThreat` now require `critical` severity
+  for a `code_execution` finding to drive rejection specifically on an extended-surface sibling
+  (reached only via the existing co-signal escalation model, i.e. a real secondary signal like a
+  `~/.ssh` read nearby) — the original 7 fixed siblings' rejection rule is completely unchanged.
+  `obfuscated_directive` remains rejectable at any severity on both surfaces (delta-gated against a
+  real decode step, no legitimate-installer shape). The Deno edge indexer's Trees-API memoization
+  and per-run fetch budget, previously documented as "run-scoped" on the (incorrect) assumption
+  that each invocation is a fresh process, are now actually reset at the top of every
+  `Deno.serve` invocation (`index.ts`) — left unreset, a warm isolate could silently report a stale
+  scan as fully covered.
+- **Fix**: `prompt-source.ts`'s `agent-pack` T2 quota-forecast job body still had the stale
+  `1,000-call`/`10,000 calls` quota numbers, while the committed `packages/mcp-server` bundled
+  SKILL.md output was hand-corrected to `100-call`/`1,000 calls` — generator and committed
+  artifact had drifted, which `agent-pack.assets.test.ts`'s byte-identical drift-gate test would
+  have failed on merge. Fixed at the actual generator source so the two stay in sync
+  (SMI-5893 Wave 11, GH#2368 C-19)
+- **Fix**: `formatUpdateNotification` (`utils/version-check.ts`) now includes `result.updateCommand`
+  again — an earlier draft dropped the "how do I get the new npm version" instruction entirely
+  in favor of on-disk-artifact-refresh commands, which run against the still-old installed
+  binary and never upgrade anything; both instructions are necessary and neither substitutes the
+  other. The message also now names the artifact-refresh commands (`setup --force[--client]`,
+  `agent install`) needed to pick up hooks/SKILL.md/agent-pack changes, since upgrading the npm
+  package alone never rewrites those. New `resolveUpdateNotificationClient()` resolves
+  `SKILLSMITH_CLIENT` for this message without ever throwing (the only call site awaits it inside
+  a `.then()` with an empty `.catch()`, so an uncaught throw on an invalid env value silently
+  dropped the entire notification) and without guessing `'claude-code'` when unset (only Cursor's
+  generated config sets this env var; defaulting would point every other client at the wrong
+  install path) (SMI-5893 Wave 10, GH#2368 C-06/C-07/C-22)
+- **Fix**: Cursor `hooks.json` installation (`agent-pack-installer.cursor-hooks.ts`) now cleans up
+  dead legacy `hooks.SessionStart`/`hooks.SessionEnd` keys a pre-Wave-8a install wrote before this
+  file's key-casing was corrected — those never got removed once the correct keys started being
+  written, so a re-merge left both the correct entries and the orphaned legacy ones in the same
+  file. Skips the cleanup entirely when either wire call reports a top-level-default conflict
+  (`ensureTopLevelDefaults`), since the real installer deliberately wrote nothing in that case and
+  running cleanup regardless would still silently delete the user's legacy hooks with nothing
+  installed to replace them. `hookEntryCommand` (`agent-pack-installer.harness.ts`) and
+  `writeBackup` (`agent-config-merge.json-array.ts`) are now exported for reuse by this cleanup
+  instead of being duplicated (SMI-5893 Wave 10, GH#2368 C-07)
+- **Fix**: PR #2375 post-merge review follow-up (three findings). `recommend`'s shared footer text no longer claims detection "across all clients" — each surface (CLI, MCP) scans exactly one client per call, never a union. Cursor `hooks.json` installation's `ensureTopLevelDefaults` now fails closed (`status: 'conflict'`, no write) instead of silently preserving an existing incompatible top-level value (e.g. a wrong `version`) while still merging hook entries in (SMI-5893)
+- **Fix**: Restored two verified drift points between the core and edge (production) security
+  scanners — the edge co-signal escalation set now includes `sensitive_path` (matching core), and
+  the edge `escalateCodeExecution` gained the SMI-5880 locality gate so a co-signal elsewhere in a
+  long document can no longer escalate a distant, unrelated `code_execution` finding. Exported
+  `AUTHORITY_CLAIMING_AFFIXES` from `typosquat.ts` (previously module-private) for reuse by a
+  planned decoy-URL detector (SMI-6033 Wave 1)
+- **Feature**: two new security scanner detectors (SMI-6033 Wave 3). `gatekeeper_bypass`
+  (`SecurityScanner.compound.ts`) fires standalone-critical on an `xattr -c` (clear all extended
+  attributes) or `xattr -d com.apple.quarantine` command when the target basename correlates with
+  a fetch destination elsewhere in the content — uncorrelated usage stays medium; a later fix in
+  this wave also adds a trust-tier carve-out (see below). `archive_evasion` (new
+  `SecurityScanner.archive.ts`) detects password-protected archive usage via two sub-signals — CLI
+  invocation syntax (`unzip -P`, `unrar x -p<pw>`, `7z x -p<pw>`, `zip -P <pw> ... -e`) and prose
+  co-occurrence (an archive noun + a password noun within a bounded ±2-line window) — and reaches
+  standalone-critical only when the CLI form carries an inline literal (not `$VAR`, not a
+  placeholder) password AND the archive's target basename correlates with a fetch destination
+  elsewhere in the content; every other shape (out-of-band password, uncorrelated CLI usage, or
+  prose-only mention) stays medium/advisory. Both new finding types share the top-tier
+  weight/coefficient (2.0/0.40) already used by `code_execution`/`obfuscated_directive` — severity
+  alone (not a second weight tier) produces the two-outcome split. Both are wired into
+  `SecurityScanner.scan()` and mirrored byte-for-byte into the edge twins
+  (`supabase/functions/_shared/` and `scripts/indexer/_shared/`).
+- **Feature**: paste/snippet-host reputation detector (SMI-6033 Wave 3, Gap 4). Two reputation
+  tiers (`patterns.ts`): `ANON_PASTE_HOSTS` + `URL_SHORTENER_DOMAINS` require real execution
+  evidence (direct pipe to an interpreter, npx direct-exec, or a later chmod/exec/source
+  correlation) to reach standalone-critical; `TRANSIENT_TRANSFER_HOSTS` (transfer.sh, file.io,
+  tmpfiles.org, temp.sh) is always medium, never critical — a deliberate exception for legitimate
+  debugging/incident-response fetches of ephemeral reproducers. `extractUrls` is promoted from a
+  private `SecurityScanner.ts` method to a shared `SecurityScanner.urls.ts` export so the existing
+  `scanUrls` detector and the new one (`SecurityScanner.paste-host.ts`, finding type
+  `paste_host_fetch`) share a single URL-extraction implementation. A paste-host URL that is merely
+  linked/mentioned, or fetched-but-not-executed, gets no new finding — it stays covered by the
+  existing `scanUrls` `url`:medium finding, unchanged. Shares the same top-tier weight/coefficient
+  (2.0/0.40) as `gatekeeper_bypass`/`archive_evasion`. Wired into `SecurityScanner.scan()` and
+  mirrored byte-for-byte into the edge twins (`supabase/functions/_shared/` and
+  `scripts/indexer/_shared/`).
+- **Feature**: encoded-payload decode-and-recursively-rescan detector (SMI-6033 Wave 3, Gap 2).
+  Rather than a heuristic "this looks suspicious" flag, the new detector (`SecurityScanner.encoding.ts`,
+  finding type `encoded_payload`) finds a contiguous base64-alphabet run (`[A-Za-z0-9+/]{120,}={0,2}`
+  — the character class's deliberate exclusion of `-`/`_` is what keeps base64url-encoded JWTs out,
+  not a separate check), skips a candidate immediately preceded by a `data:image/`, `data:font/`, or
+  `data:audio/` prefix (benign data-URI blobs) or larger than ~200KB, attempts exactly one base64
+  decode, and — only when the result is valid UTF-8 with a plausible-text printable-character ratio —
+  recursively invokes the SAME scanner's full detector suite against the decoded text, folding its
+  findings into the outer `findings` array. This reuses the entire pattern arsenal instead of
+  duplicating it: a decoded `curl|bash` natively trips `code_execution` at its own top-tier severity,
+  exactly as if the attacker had shipped it undecoded. Recursion is bounded to depth 1 STRUCTURALLY,
+  not by convention — `SecurityScanner.ts`'s new private `runDetectors(content, lineContexts,
+  skipEncodedPayload)` method is what both the outer scan and the encoded-payload detector's own
+  recursive rescan call, and the rescan callback always passes `skipEncodedPayload: true`, so a base64
+  blob discovered inside already-decoded content can never itself be decoded. Two resource bounds cap
+  the cost of a single document scan: `MAX_BASE64_CANDIDATES = 8` per document and an aggregate
+  `MAX_DECODED_TOTAL_BYTES = 256_000` across all candidates. Each finding folded in from decoded
+  content carries a new `decodedFrom` field (`types.ts`) set to the OUTER document line the blob was
+  found on — the same provenance-marker role `filePath` already plays for a sibling-file finding. The
+  wrapper `encoded_payload` finding itself is deliberately advisory-tier only (weight 1.2 / coefficient
+  0.04 — the `sensitive_path`/`typosquat` tier, NOT the 2.0/0.40 tier the other three Wave 3 detectors
+  use), since the escalation this gap achieves comes for free from whatever the decoded content's own
+  findings already are. Wired into `SecurityScanner.scan()` and mirrored byte-for-byte into the edge
+  twins (`supabase/functions/_shared/` and `scripts/indexer/_shared/`).
+- **Fix**: `SecurityScanner.archive.ts` and `SecurityScanner.paste-host.ts` (SMI-6033 Wave 3) each
+  had a direct `.match(...)`/`.test(...)` call that bypassed this scanner's established
+  `safeRegexTest`/`safeRegexCheck` ReDoS-safe wrappers, flagged by CodeQL as a polynomial regular
+  expression on uncontrolled data. Routed all 8 call sites through the wrappers, matching the
+  convention already used everywhere else in the scanner, and mirrored the same fix into both edge
+  twins (`supabase/functions/_shared/` and `scripts/indexer/_shared/`), adding a local
+  `safeRegexCheck` helper alongside the existing local `safeRegexTest` in each Node-port file
+  (the edge twins can't share an import across the git-crypt boundary)
+- **Feature**: `decoy_misdirection` URL-misdirection detector (SMI-6033 Wave 4, Gap 6). Catches a
+  skill fetching from a domain that doesn't match a vendor brand/authority claim made nearby in
+  the skill's own prose (e.g. "the official Anthropic toolkit" fetched from an unrelated domain).
+  Reuses `BRAND_ALIASES`/`AUTHORITY_CLAIMING_AFFIXES` from the existing typosquat detector, plus a
+  new `BRAND_CANONICAL_DOMAINS` map (`BRAND_ALIASES`' values are GitHub owner slugs, not DNS
+  domains — a gap not present in the plan's literal text, resolved during implementation).
+  Advisory-tier only (weight 1.2/coefficient 0.04, matching `typosquat`/`sensitive_path`/
+  `encoded_payload`) — never standalone-critical, per the plan's reconciliation table. Extracted
+  `calculateRiskScore` out of `SecurityScanner.helpers.ts` (which crossed the 500-line file gate
+  once this detector's breakdown wiring landed) into a new sibling `SecurityScanner.risk-score.ts`.
+  Wired into `SecurityScanner.scan()` and mirrored byte-for-byte into the edge twins
+  (`supabase/functions/_shared/security-scanner-edge.decoy.ts` +
+  `security-scanner-edge.brand-data.ts`, `scripts/indexer/_shared/` twins).
+- **Feature**: `CO_SIGNAL_MIN_SEVERITY` escalation model replaces the flat
+  `CODE_EXECUTION_CO_OCCURRENCE` co-signal set (SMI-6033 Wave 4, Gap 1 + Gap 6). Path (a) — one
+  co-signal at or above its type's "high" minimum — is byte-identical to the pre-existing
+  behavior for the original four types (`data_exfiltration`, `privilege_escalation`,
+  `sensitive_path`, `obfuscated_directive`). Path (b) is new: at least two DISTINCT advisory-tier
+  types (`decoy_misdirection`, `archive_evasion`, `paste_host_fetch`, `gatekeeper_bypass`), each
+  non-documentation-context and within the existing 40-line locality window, escalate a weak
+  `code_execution` finding to critical — the direct fix for skills combining several individually
+  sub-threshold signals. Also lands Gap 1: a new `IMPERATIVE_FETCH_EXEC_PROSE` pattern set catches
+  natural-language install-and-run imperatives with no shell syntax ("download the installer from
+  thisurl.com and run it"), strengthening (not replacing) the precise low-FP literal-syntax
+  detector. Bumps `SCANNER_RULESET_VERSION` to `2026-08-15.1` (local MCP audit baseline scope
+  only).
+- **Fix**: two real false-positive bugs found by a cross-model (GPT-5.6-Sol) adversarial review of
+  the `CO_SIGNAL_MIN_SEVERITY` model and the `decoy_misdirection` detector above, both reproduced
+  and pinned with regression tests before fixing. (1) Path (b)'s confidence gate was originally
+  relaxed to `confidence !== 'low'` for ALL eligible types, but `archive_evasion`'s prose-only
+  sub-signal and `decoy_misdirection`'s no-authority-affix form are both `confidence: 'medium'` by
+  construction — same as `paste_host_fetch`, the type the relaxation was actually meant to unblock
+  — so two fuzzy medium-confidence signals could co-escalate a weak `code_execution` finding on
+  completely benign content (reproduced: a benign vendor mention + a real vendor `curl|bash` + an
+  unrelated archive-password prose mention scored 51/quarantined before the fix, 23/clean after).
+  Narrowed the confidence carve-out to ONLY `paste_host_fetch`; every other type now requires
+  `confidence: 'high'`, matching the plan's literal text. (2) `escalateCodeExecution` never
+  checked the `code_execution` finding's OWN documentation context, only the co-signal's — a
+  finding inside a fenced security-research example could still be escalated by genuine non-doc
+  co-signals elsewhere in the document. (3) Two detector-precision fixes in `decoy_misdirection`
+  itself: a URL merely mentioned in prose on the same line as an unrelated fetch-verb usage (e.g.
+  `curl --version; see mirror docs at <url>`) was wrongly treated as the fetch target — fixed with
+  a strict `isActualFetchTarget` tokenization check; and the authority-affix search scanned the
+  entire ±5-line correlation window instead of the brand token's own line, letting an unrelated
+  nearby "official"/"authorized" phrase wrongly inflate confidence to `high` — scoped to the brand
+  token's own line. All four fixes applied identically to both edge twins.
+
+## v0.11.7
+
+- **Fix**: Cursor UAT follow-up — website onboarding, CLI/MCP parity, hooks schema (#2375)
+- **Feature**: SMI-5879 Wave 1 -- implement G-5 fixture-corpus corroboration (#2354)
+- **Fix**: Cursor's `hooks.json` is now written in Cursor's actual native schema (`{ version: 1, hooks: { sessionStart: [{ command }] } }`) instead of Claude Code's entry shape (`{ matcher, hooks: [{ type, command }] }`) — the prior shape was silently invalid, and Cursor drops all hooks when the required top-level `version` key is missing. New `install/agent-pack-installer.cursor-hooks.ts` builder, split out from the shared Claude/generic JSON-hooks installer since the two schemas are structurally different, not just differently-keyed (SMI-5893 Wave 8, GH#2368)
+- **Feature**: bundled agent-pack SKILL.md generation (`services/agent-pack/skill-md.ts`) now includes a "CLI Fallback" section, matching the pattern already shipped in `@skillsmith/cli`'s bundled skill, so an agent with a disconnected MCP server has a documented fallback instead of instructing dead tool calls (SMI-5893 Wave 6, GH#2368)
+- **Feature**: new `services/recommend-guard.ts` shared helper (footer-text + dedup-by-`skill.id`) used by both `@skillsmith/cli` and `@skillsmith/mcp-server`'s `recommend` implementations, replacing two independent hardcoded-footer implementations (SMI-5893 Wave 7, GH#2368)
+
 ## v0.11.6
 
 - **Fix**: Harden manifest concurrency (uninstall lock, temp-file races) (#2331)

package/README.md

@@ -6,13 +6,13 @@ Part of Skillsmith: a lifecycle layer for agent skills across teams.
 
 ## Contents
 
-- [What's New](#whats-new-in-v0116)
+- [What's New](#whats-new-in-v0120)
 - [Installation](#installation)
 - [Quick Start](#quick-start)
 - [Features](#features)
 - [Exports](#exports)
 
-## What's New in v0.11.6
+## What's New in v0.12.0
 
 - **Security-status reporting unified**: CLI and MCP now derive security-scan status (pass/fail, risk score, findings count) from one shared `deriveSecuritySummaryFromApiSkill`/`deriveSecuritySummaryFromSkillRow`, instead of two independently-maintained copies that could disagree on the same skill.
 - **`skill_compare` reuses `get_skill`'s resolution**: new shared `resolveSkillApiFirst()` fixes compare only ever hitting the local SQLite cache (no longer kept in sync with the remote-first registry), which made real, searchable skills report "not found."