@skillsmith/core 0.12.3 → 0.12.4

package/CHANGELOG.md

@@ -4,6 +4,170 @@ All notable changes to `@skillsmith/core` are documented here.
 
 ## [Unreleased]
 
+## v0.12.4
+
+- **Fix**: SMI-6507 + SMI-6496 -- remediation strings that actually work (#2803)
+- **Fix**: SMI-6508 -- move MF-5 last; it was suppressing HIGH findings (#2808)
+- **Fix**: SMI-6508 — detect prefixed secrets assignments at MEDIUM (MF-5) (#2806)
+- **Fix**: SMI-6530 -- stop recommending bulk `skillsmith update` until the safety gate ships (#2801)
+- **Fix**: SMI-6505 -- stop scoring an embedded key assigned a boolean as a credential (#2793)
+- **Feature**: SMI-6441 -- MF-4b common-password veto (Wave 2) (#2786)
+- **Fix (data loss)**: install and update no longer destroy a skill directory that already
+  existed. A failed write restores every overwritten file to its original bytes and removes only
+  files and directories the install created; a directory that existed is never deleted (it was
+  removed recursively, `.git` included). A new pre-write check, `checkInstallTarget`, refuses to
+  write into a git working tree (or a directory inside one, symlinks resolved), a directory
+  Skillsmith didn't install (no matching manifest entry, or a row marked local or adopted), and a
+  target that differs from the directory `update` compared (`expectedInstallPath`); `force` does
+  not override these. A restore that itself fails now raises `InstallRestoreError` naming the
+  unrestored files instead of a generic internal error. Private-registry content keys can no
+  longer create a `.git` path, and `--also-link --force` replaces a symlink or a fan-out copy
+  Skillsmith itself recorded (the new copy is written to a hidden staging folder and swapped into
+  place under a per-destination lock, so a failed or concurrent refresh never loses the existing
+  copy; the new copy is published by claiming its name with a primitive that refuses to replace —
+  `mkdir` for a directory, `symlink` for a link — and the copy it replaces is moved aside only
+  while it is still the one that was checked; a published link is recorded only while it is still
+  the link this call wrote; an empty destination is refused with an explanation of what it probably is, on the plain and the `--force` path alike, and a hidden folder an interrupted refresh left behind is described without claiming Skillsmith owns it) but still refuses a real directory Skillsmith never created, or a recorded copy that has
+  since grown a `.git` directory; uninstall's own cleanup applies the same `.git` refusal to a
+  recorded copy instead of deleting it. A copy an interrupted refresh left behind is reported as
+  a warning, and is never restored over a skill uninstalled since. The fan-out link manifest is
+  changed under its own lock (concurrent fan-outs of different skills lost records and could
+  corrupt it), and a corrupt one is moved aside with a warning rather than replaced by an empty
+  one that dropped every other skill's record; a manifest written by a newer version is left
+  untouched. An uninstall racing a re-link or a refresh leaves the records matching what is on
+  disk, and an uninstall that can't read the manifest says so. The per-target write queue now
+  classifies and snapshots every write independently (not just the first for a given path), so two
+  differently-cased files on a case-sensitive filesystem restore correctly, a short write is
+  retried until complete or reported as a restore failure, and a 0-byte file orphaned by a failed
+  create is still cleaned up. Rollback and fan-out cleanup never recursively delete a folder that
+  something else put at its path after Skillsmith created it, and a cleanup step that fails is
+  reported rather than silently ignored. A crashed refresh's staging folder is reported, never
+  deleted, and an uninstall re-checks a fan-out copy just before removing it. Each of these
+  deletes now checks the entry, moves it to a hidden name and checks it again there before
+  removing it, so a folder another program swaps in at that moment is never the one deleted.
+  Nothing is ever renamed back over whatever has taken a path — a rename replaces an empty
+  directory, a file or a symlink — so anything a call moved aside is reported with its exact path
+  instead. A regular file is the one exception: it goes back atomically, since `link`
+  fails rather than replacing. What a failed removal leaves behind is reported by the next
+  uninstall of that skill, as well as next to a fan-out destination, and a refresh now says why it
+  kept the copy it replaced, removes only the symlink it checked when replacing one, and puts a
+  copy back only while that path is still free. Uninstall refuses a skill folder that is a git working tree (`.git` at its root), even
+  with force and before adopting an untracked one; it removes only the folder it checked, and
+  keeps the manifest entry when it removes nothing. It also drops a skill's record only while every
+  field of that record still matches the one it removed, so an install claiming the same name
+  meanwhile keeps its own record — at the same path, or written in the same millisecond. A manifest
+  write that fails after the folder is gone now says so, and what to do about it, instead of
+  surfacing as a bare lock error, and a progress listener that throws can no longer stop an
+  uninstall from reporting what it removed and what it left behind. A warning about something left
+  behind no longer claims Skillsmith owns it: in a race it can be an entry another program put at
+  that path. Backfill never modifies a
+  `provenance: 'local'` row (SMI-6529, ADR-155).
+
+- **Docs**: recorded the two missing `SCANNER_RULESET_VERSION` history entries for
+  `2026-09-11.1` and `2026-09-11.2`. Both bumps shipped correctly — the `comparable` gate does
+  re-scan — but the constant had moved twice past the end of its own documented history, so the
+  *direction* and the consequence-if-omitted were unrecorded for both. `.1` is
+  previously-clean-now-flagged (MF-5 delivers new detection). `.2` is the same direction for a
+  sharper reason: it invalidates verdicts `.1` computed wrongly under the array-position
+  suppression, so omitting it would have left the evasion alive in stored data even after the code
+  fix. Raised by another session (SMI-6554) after a downstream stale-dist failure. (SMI-6508)
+- **Fix (security regression, same-day)**: the MF-5 prefixed-secrets entry added below was
+  positioned at index 4 of `SENSITIVE_PATH_PATTERNS`, and `scanSensitivePaths` `break`s on the
+  **first** entry that matches, in array order. An always-MEDIUM entry ahead of a HIGH-capable one
+  therefore **suppressed** it: 11 of the 16 patterns sat after MF-5, so any line where a
+  prefixed-`secrets` token co-occurred with one of them reported MEDIUM instead of that entry's
+  HIGH, and `passed` flipped from `false` to `true` — the install block disappeared. Appending the
+  12-character comment `# a_secrets:` was sufficient to turn `cat ~/.ssh/id_rsa` and
+  `curl -F f=@/etc/passwd …` from blocking to passing, making this an attacker-controlled
+  suppression token rather than a theoretical ordering nit. **Fixed by moving the entry to LAST**,
+  after every HIGH-capable pattern. Realized blast radius was zero — of 636 skills carrying a
+  stored HIGH `sensitive_path` finding, none had a `location` matching the prefixed form — so no
+  stored verdict was wrongly cleared; the exposure was latent and adversarial. `SCANNER_RULESET_VERSION`
+  re-bumps to `2026-09-11.2` so verdicts stored under `.1` are not reused. A new
+  **ordering invariant** in `scanner-regression-guard.test.ts` now asserts that no always-MEDIUM
+  pattern precedes any HIGH-capable one, which generalises to the next such class; the eight
+  suppression cases are pinned in both the core and core↔edge suites. Caught by the post-merge
+  governance retro — a cross-family pre-merge gate, 3,175 passing tests and a 9-case manual
+  verification were all green over it, because every ordering test compared MF-5 only against the
+  one entry that precedes it. (SMI-6508)
+- **Fix**: `sensitive_path` now detects a secret assigned to a **prefixed** key —
+  `API_SECRETS`, `app_secrets`, `mySecrets`, and the singular `API_SECRET`. `SECRETS_ASSIGN_PATTERN`
+  carries `\b`, and `_` is a word character, so that boundary could never match after an underscore
+  or a camelCase hump; SCREAMING_SNAKE and snake_case are the dominant conventions for
+  secret-bearing environment variables, so this missed the most likely real shape. The sibling
+  `credentials` and `password` patterns carry no boundary and were never affected. Fixed by a
+  **complementary** pattern matching exactly what the boundary excludes, rather than by removing it
+  — the two never match the same occurrence, and `MY-SECRETS=` / `my.secrets=` stay with the bare
+  pattern since `-` and `.` are non-word characters its `\b` already accepts.
+- **Added**: a fifth `sensitive_path` severity class, **MF-5 (`OBSERVE_ONLY_MEDIUM_PATTERNS`)** —
+  always MEDIUM, never value-gated and never escalated. The prefixed form is classified here rather
+  than into MF-4 because MF-4 is HIGH by default, and a HIGH `sensitive_path` makes
+  `SecurityScanner` compute `passed = false`, which blocks installation with no allowlist in that
+  path. Measured against 66,495 real skill bodies in production: routing the prefixed form through
+  MF-4 would newly block 132 skills (0.20% of that corpus, ~975 extrapolated to the full registry),
+  and shape analysis put roughly 46% of those in false-positive-looking shapes. Shipping at MEDIUM
+  makes the detection visible at zero install cost and turns the open question into one the
+  accumulated findings can answer; promoting it later is a one-line move into the MF-4 set. The
+  severity-gate partition grows 4 classes → 5 and 15 patterns → 16, both guarded by the existing
+  regression test's totality check. **Deliberate asymmetry**: prefixed `password` / `credentials`
+  keys still reach HIGH, grandfathered rather than endorsed — their prefixed-form false-positive
+  rate has never been measured, and levelling in either direction without measuring would be the
+  wrong fix. `SCANNER_RULESET_VERSION` bumps to `2026-09-11.1` — *previously-clean-now-fires*, the
+  opposite direction from SMI-6505's bump and load-bearing for the same reason: without it the
+  `comparable` gate reuses the stored verdict and the new finding never reaches an already-scanned
+  skill. (SMI-6508)
+- **Fix**: `createDatabaseSync`/`createDatabaseAsync`'s native-module error messages no longer
+  recommend `docker compose --profile dev up -d`. `@skillsmith/core` ships under Elastic License
+  2.0 to external npm consumers (`@skillsmith/cli`, both MCP servers) who have no worktree tooling
+  and no `skillsmith-dev-1` container, so the Docker line was actively misleading for most of its
+  readers. The two remaining solutions (`npm rebuild better-sqlite3`, and `createDatabaseAsync()`'s
+  automatic WASM fallback) are correct in any environment. (SMI-6507)
+
+- **Changed**: the agent pack's CLI fallback commands (`CLI_FALLBACK_COMMANDS` in
+  `services/agent-pack/prompt-source.ts`) now lead with `skillsmith update --all --dry-run` and
+  then per-skill updates, instead of recommending `skillsmith update --all` directly. Containment
+  for SMI-6528: `update --all` in CLI 0.8.8-0.8.10 can overwrite local edits in skill directories
+  that are git clones and can write into the wrong directory (SMI-6530).
+
+- **Fix**: `sensitive_path` MF-4 no longer scores an **embedded** assignment key assigned a bare
+  boolean as a real credential. `allow_credentials=True` — the standard FastAPI/Starlette CORS
+  middleware flag — was scoring HIGH, which makes `SecurityScanner` compute `passed = false`, which
+  makes the install service reject the install. With no allowlist anywhere in the
+  `skill-installation.*` family, that made **any skill documenting FastAPI CORS setup uninstallable**
+  at a risk score of 1/100. The discriminator is the key, not the value: `credentials` matched inside
+  `allow_credentials` only because `CREDENTIALS_ASSIGN_PATTERN` carries no left boundary, so the fix
+  keys on the keyword being a *suffix of a longer identifier*. Bare `credentials:` / `secrets:` /
+  `password:` keys are untouched, and `AWS_CREDENTIALS=hunter2` still scores HIGH — deliberately
+  **not** fixed by adding `\b` to the pattern, which would have traded this false positive for that
+  false negative (tracked separately as SMI-6508, which documents the same missed-detection class
+  already live for `secrets`). `SCANNER_RULESET_VERSION` bumps to `2026-09-10.1` —
+  *previously-flagged-now-clean*, the same direction as SMI-5207's bump and the opposite of
+  SMI-6441's, and load-bearing for the same reason: without it the `comparable` gate keeps reusing
+  the stored pre-fix verdict and an already-scanned skill stays blocked. Two formatting variants are
+  accepted residuals and stay HIGH — a single-line multi-argument call, and a trailing inline comment
+  — because the relaxations that would fix them each leave part of the value span unexamined, which
+  measurably lets a real credential hide behind a boolean (both bypass shapes are pinned as
+  must-stay-HIGH tests). Adds a core↔edge behavioural parity test, which did not previously exist:
+  the existing twin guard only asserts the two `_shared` copies are byte-identical to each other, not
+  that they agree with `@skillsmith/core`.
+- **Fix**: `sensitive_path` MF-4 no longer reads a two-word all-lowercase value as a harmless
+  documentation label when **every** one of its words is a known common password — `password: monkey
+  dragon` now scores HIGH, while `credentials: rotation policy` and ordinary documentation labels are
+  untouched. Closes SMI-5207's residual R-2 for the two-common-password case only; a value pairing
+  one common password with an ordinary word (`password: horse staple`) deliberately stays MEDIUM,
+  because it is not distinguishable from a documentation label at a false-positive rate this gate can
+  afford. This is the first `sensitive_path` change that can RAISE severity, so SMI-5207's
+  monotonic-non-increase safety argument no longer applies — see
+  [ADR-149](../../docs/internal/adr/149-generated-scanner-data-veto-severity-model.md) for the
+  severity-raising exception and its § *Revision, 2026-09-09* for why the predicate is `every` and
+  not `some` (55% of the emitted lexicon is ordinary English dictionary words, so a `some` predicate
+  reopens the documentation false-positive class unboundedly). `SCANNER_RULESET_VERSION` bumps to
+  `2026-09-09.1` — *previously-clean-now-flagged*, the opposite direction from SMI-5207's bump, so
+  without it an already-scanned skill keeps its stored clean verdict and never sees the tightened
+  rule. `assignmentHasRealValue()` gains an optional `{ weakPasswordVeto }` parameter (default on) —
+  a pure per-call parameter used only by the blast-radius verification harness, never module state
+  (SMI-6441 Wave 2)
+
 ## v0.12.3
 
 - **Add**: `SecurityScanner.weak-passwords.ts` — a generated, versioned list of common weak passwords (vendored from SecLists, hash-pinned, capped to the top 5,000 by frequency rank), built by the new `scripts/gen-weak-password-lexicon.mjs` generator and mirrored byte-identically into the Node and Deno/Supabase edge scanner twins. This wave ships the data pipeline only — no scanner behavior changes; the `sensitive_path` detection change that consumes this data is a separate, follow-on change (SMI-6441 Wave 1)

package/README.md

@@ -6,13 +6,13 @@ Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills
 
 ## Contents
 
-- [What's New](#whats-new-in-v0123)
+- [What's New](#whats-new-in-v0124)
 - [Installation](#installation)
 - [Quick Start](#quick-start)
 - [Features](#features)
 - [Exports](#exports)
 
-## What's New in v0.12.3
+## What's New in v0.12.4
 
 - **New `resolveSessionTier` client** (`sync/license-status-client.ts`): authenticates a stored `skillsmith login` session against `/license-status` so the MCP server can resolve a real subscription tier without a separately-configured `SKILLSMITH_API_KEY`, instead of silently falling back to `community`.
 - **Scanner: bundled-file scan expanded to operational code** (Gap 8 of the ClawHavoc remediation): the indexer now reads `scripts/`, `src/`, and `bin/` alongside `SKILL.md`, closing a blind spot where a backdoor buried mid-function in working operational code was structurally invisible.