agent-skills-standard 2.6.4 → 2.6.6

package/README.md

@@ -5,7 +5,7 @@
 
 **Sync 242 AI coding standards to any project in one command.** Works with Cursor, Claude Code, GitHub Copilot, Gemini, Windsurf, Trae, Kiro, and Roo.
 
-**Current release:** `v2.6.4` — skill validator accepts package directories under `scripts/`; SkillSpector security scanning, pull request evaluation gates, and verified release tags.
+**Current release:** `v2.6.5` — `ags sync` manifest-check fix for repo-root LICENSE/NOTICE; skill validator accepts package directories under `scripts/`; SkillSpector security scanning, pull request evaluation gates, and verified release tags.
 
 ```bash
 npx agent-skills-standard@latest init   # detect your stack

package/dist/index.js

@@ -50,7 +50,7 @@ let crypto = require("crypto");
 crypto = __toESM(crypto);
 var package_default = {
 	name: "agent-skills-standard",
-	version: "2.6.4",
+	version: "2.6.6",
 	description: "A CLI to manage and sync AI agent skills standard for Cursor, Claude, Copilot, Windsurf, and more.",
 	main: "dist/index.js",
 	bin: {
@@ -94,7 +94,7 @@ var package_default = {
 	dependencies: {
 		"commander": "^15.0.0",
 		"cross-fetch": "^4.1.0",
-		"dotenv": "^18.0.3",
+		"dotenv": "^18.0.5",
 		"fs-extra": "^11.4.1",
 		"inquirer": "^14.2.2",
 		"js-yaml": "^5.4.2",
@@ -102,9 +102,9 @@ var package_default = {
 		"zod": "^4.6.5"
 	},
 	devDependencies: {
-		"@vitest/coverage-v8": "^5.0.1",
-		"vite": "^8.3.0",
-		"vitest": "^5.0.1"
+		"@vitest/coverage-v8": "^5.0.3",
+		"vite": "^8.3.2",
+		"vitest": "^5.0.3"
 	}
 };
 //#endregion
@@ -2698,7 +2698,7 @@ var McpConfigService = class {
 	buildEntry(version) {
 		return {
 			command: "npx",
-			args: ["-y", `${PACKAGE}@${version || "0.6.0"}`]
+			args: ["-y", `${PACKAGE}@${version || "0.6.1"}`]
 		};
 	}
 	/** For testing: allows overriding the home directory. */
@@ -4409,9 +4409,46 @@ async function removeEmptyParents(rootDir, dir) {
 	}
 }
 //#endregion
+//#region src/services/install/safePath.ts
+/**
+* Asserts that a target file path resides inside rootDir and that NO intermediate
+* directory or terminal file under rootDir is a symbolic link.
+*
+* Requirements:
+* - rootDir may itself be a symlink (or inside one); components under rootDir must NOT be.
+* - Both existing files and dangling symlinks must be detected via lstat.
+* - Fails closed if lexical containment is breached or if any component under rootDir is a symlink.
+*
+* @param rootDir The trusted root directory
+* @param targetPath The destination file/directory path to check
+*/
+async function assertNoSymlinksUnderRoot(rootDir, targetPath) {
+	const resolvedRoot = path.default.resolve(rootDir);
+	const resolvedTarget = path.default.resolve(targetPath);
+	const relative = path.default.relative(resolvedRoot, resolvedTarget);
+	if (relative === ".." || relative.startsWith(`..${path.default.sep}`) || path.default.isAbsolute(relative)) throw new Error(`Path traversal or outside target detected: "${targetPath}" is outside "${rootDir}"`);
+	const segments = relative.split(path.default.sep).filter(Boolean);
+	let current = resolvedRoot;
+	for (const segment of segments) {
+		current = path.default.join(current, segment);
+		try {
+			if ((await fs_extra.default.lstat(current)).isSymbolicLink()) throw new Error(`Symlink path component not permitted: "${current}" is a symbolic link under "${rootDir}"`);
+		} catch (err) {
+			if (err instanceof Error && err.message.includes("Symlink path component")) throw err;
+			if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") break;
+			throw err;
+		}
+	}
+}
+//#endregion
 //#region src/services/install/OwnershipWriter.ts
 var PassthroughWriter = class {
+	rootDir;
+	constructor(rootDir) {
+		this.rootDir = rootDir;
+	}
 	async write(absPath, content) {
+		await assertNoSymlinksUnderRoot(this.rootDir, absPath);
 		await fs_extra.default.outputFile(absPath, content);
 	}
 };
@@ -4434,6 +4471,7 @@ var OwnershipWriter = class {
 		this.opts = opts;
 	}
 	async write(absPath, content, meta) {
+		await assertNoSymlinksUnderRoot(this.opts.rootDir, absPath);
 		const rel = toPosixRel(this.opts.rootDir, absPath);
 		this.touched.add(rel);
 		const incoming = sha256(content);
@@ -4489,6 +4527,7 @@ var OwnershipWriter = class {
 				continue;
 			}
 			const abs = path.default.join(this.opts.rootDir, rel);
+			await assertNoSymlinksUnderRoot(this.opts.rootDir, abs);
 			if (!await fs_extra.default.pathExists(abs)) continue;
 			if (sha256(await fs_extra.default.readFile(abs)) !== prev.sha256) {
 				this.plan.keptOrphans.push(rel);
@@ -4537,7 +4576,7 @@ var AgentBridgeService = class {
 	* @param rootDir Project root directory
 	* @param agents List of agents to generate rules for
 	*/
-	async bridge(rootDir, agents, writer = new PassthroughWriter(), options = {}) {
+	async bridge(rootDir, agents, writer = new PassthroughWriter(rootDir), options = {}) {
 		const fileNameBase = "agent-skill-standard-rule";
 		const commonDescription = "Rule for Agent Skills Standard - Always consult AGENTS.md for consolidated project context and technical triggers.";
 		for (const agentId of agents) {
@@ -4575,7 +4614,9 @@ var AgentBridgeService = class {
 				"",
 				"### State 4: Execution & Audit Log (Output Generation)",
 				"",
-				"- **Action:** You may now begin answering the user or writing code.",
+				"- **Action:**",
+				"  - **Multi-task implementation plan (new or existing):** Do NOT edit files directly in the orchestrator session. Present the execution confirmation gate (Subagent-Driven vs. Inline) and use `subagent-driven-development`.",
+				"  - **Analysis, review, or single-file fix:** You may begin answering the user or implementing.",
 				"- **Constraint:** Your very first text output MUST be a \"Pre-Write Audit Log\" confirming which skills were loaded, or explicitly stating \"No project-specific skills applicable.\"",
 				"",
 				"## Self-Learning Protocol",
@@ -5198,17 +5239,22 @@ var SkillSyncService = class {
 	/**
 	* Writes collected skills to target agent paths.
 	*/
-	async writeSkills(skills, config, agents, writer = new PassthroughWriter()) {
+	async writeSkills(skills, config, agents, writer = new PassthroughWriter(process.cwd()), rootDir = process.cwd()) {
 		const overrides = config.custom_overrides || [];
+		for (const agentId of agents) {
+			const basePath = SUPPORTED_AGENTS.find((agent) => agent.id === agentId)?.path;
+			if (!basePath) continue;
+			for (const skill of skills) await this.writeSkillForAgent(agentId, skill, overrides, basePath, writer, config, true, rootDir);
+		}
 		for (const agentId of agents) {
 			const agentDef = SUPPORTED_AGENTS.find((agent) => agent.id === agentId);
 			if (!agentDef?.path) continue;
 			const basePath = agentDef.path;
-			for (const skill of skills) await this.writeSkillForAgent(agentId, skill, overrides, basePath, writer, config);
+			for (const skill of skills) await this.writeSkillForAgent(agentId, skill, overrides, basePath, writer, config, false, rootDir);
 			console.log(picocolors.default.gray(`  - Updated ${basePath}/ (${agentDef.name})`));
 		}
 	}
-	async writeSkillForAgent(agentId, skill, overrides, basePath, writer, config) {
+	async writeSkillForAgent(agentId, skill, overrides, basePath, writer, config, preflightOnly = false, rootDir = basePath) {
 		const isKiro = agentId === Agent.Kiro;
 		const skillPath = isKiro ? path.default.join(basePath, `${skill.category}-${skill.skill}`) : path.default.join(basePath, skill.category, skill.skill);
 		if (!this.isPathSafe(skillPath, basePath)) {
@@ -5216,7 +5262,7 @@ var SkillSyncService = class {
 			throw new Error(`Invalid skill path ${skill.category}/${skill.skill}`);
 		}
 		const source = `skill:${skill.category}/${skill.skill}@${config.skills?.[skill.category]?.ref ?? "main"}`;
-		const pending = [];
+		const pending = preflightOnly ? null : [];
 		for (const fileItem of skill.files) {
 			const targetFilePath = path.default.join(skillPath, fileItem.name);
 			if (!this.isPathSafe(targetFilePath, skillPath)) {
@@ -5227,12 +5273,15 @@ var SkillSyncService = class {
 				console.log(picocolors.default.yellow(`    ⚠️  Skipping overridden: ${this.normalizePath(targetFilePath)}`));
 				continue;
 			}
+			await assertNoSymlinksUnderRoot(rootDir, targetFilePath);
+			if (pending === null) continue;
 			const content = isKiro && fileItem.name === "SKILL.md" ? this.transformSkillForKiro(fileItem.content, skill.category) : fileItem.bytes ?? fileItem.content;
 			pending.push({
 				target: targetFilePath,
 				content
 			});
 		}
+		if (pending === null) return;
 		for (const { target, content } of pending) await writer.write(target, content, {
 			owner: "skill",
 			source,
@@ -5255,6 +5304,7 @@ var SkillSyncService = class {
 		const { ok: files, failed } = await this.githubService.downloadFilesConcurrentBytes(downloadTasks);
 		const verifier = verifiers[sourceCat] ?? verifiers[category];
 		if (verifier) for (const f of files) {
+			if (this.isRootAttributionFile(f.path)) continue;
 			const rejection = verifier.check(f.path, f.content);
 			if (rejection) failed.push({
 				path: f.path,
@@ -5649,7 +5699,7 @@ var WorkflowSyncService = class {
 	* - Copilot: prompt files
 	* - Cursor/Trae/Codex: skill folders with SKILL.md
 	*/
-	async writeWorkflows(workflows, config, agents, writer = new PassthroughWriter()) {
+	async writeWorkflows(workflows, config, agents, writer = new PassthroughWriter(process.cwd())) {
 		if (workflows.length === 0) return;
 		const overrides = config.custom_overrides || [];
 		const targetAgents = agents || [Agent.Antigravity];
@@ -5737,10 +5787,8 @@ function summarizeDeclaredPermissions(metadata) {
 }
 /**
 * For platforms with no way to express a declared risk_tier/permissions/
-* allowed-tools, prepend a visible warning rather than silently dropping
-* the declaration — a persona authored as restricted for one platform
-* should not read as unconstrained everywhere else without at least a
-* trace of what was intended.
+* allowed-tools, emit a visible warning after native frontmatter rather than
+* silently dropping the declaration.
 */
 function unenforceableWarningComment(metadata, agentName) {
 	const declared = summarizeDeclaredPermissions(metadata);
@@ -5780,39 +5828,39 @@ var SpecialistTransformer = class {
 			}
 			case "cursor-mdc": return {
 				name: `${fullName}.mdc`,
-				content: `${unenforceableWarningComment(metadata, "Cursor")}---\n${dumpFrontmatter({
+				content: `---\n${dumpFrontmatter({
 					description,
 					globs: ["**/*"]
-				})}\n---\n# Specialist: ${baseName}\n\n${body}`
+				})}\n---\n${unenforceableWarningComment(metadata, "Cursor")}\n# Specialist: ${baseName}\n\n${body}`
 			};
 			case "copilot-instructions": return {
 				name: `${fullName}.instructions.md`,
-				content: `${unenforceableWarningComment(metadata, "Copilot")}---\n${dumpFrontmatter({
+				content: `---\n${dumpFrontmatter({
 					description,
 					applyTo: "**/*"
-				})}\n---\n\n${body}`
+				})}\n---\n${unenforceableWarningComment(metadata, "Copilot")}\n${body}`
 			};
 			case "opencode-md": return {
 				name: `${baseName}.md`,
-				content: `${unenforceableWarningComment(metadata, "OpenCode")}---\n${dumpFrontmatter({
+				content: `---\n${dumpFrontmatter({
 					description,
 					mode: "subagent"
-				})}\n---\n\n${body}`
+				})}\n---\n${unenforceableWarningComment(metadata, "OpenCode")}\n${body}`
 			};
 			case "gemini-md": return {
 				name: `${baseName}.md`,
-				content: `${unenforceableWarningComment(metadata, "Gemini")}---\n${dumpFrontmatter({
+				content: `---\n${dumpFrontmatter({
 					name: baseName,
 					description,
 					kind: "local"
-				})}\n---\n\n${body}`
+				})}\n---\n${unenforceableWarningComment(metadata, "Gemini")}\n${body}`
 			};
 			case "kiro-md": return {
 				name: `${baseName}.md`,
-				content: `${unenforceableWarningComment(metadata, "Kiro")}---\n${dumpFrontmatter({
+				content: `---\n${dumpFrontmatter({
 					name: baseName,
 					description
-				})}\n---\n\n${body}`
+				})}\n---\n${unenforceableWarningComment(metadata, "Kiro")}\n${body}`
 			};
 			case "codex-toml": {
 				const sandboxMode = sandboxModeFor(metadata.risk_tier);
@@ -5874,7 +5922,7 @@ var SpecialistSyncService = class {
 		}
 		return specialists;
 	}
-	async syncCollectedSpecialists(rootDir, agents, specialists, writer = new PassthroughWriter()) {
+	async syncCollectedSpecialists(rootDir, agents, specialists, writer = new PassthroughWriter(rootDir)) {
 		if (specialists.length === 0) return 0;
 		for (const agentId of agents) {
 			const agentDef = SUPPORTED_AGENTS.find((a) => a.id === agentId);
@@ -5906,7 +5954,7 @@ var SpecialistSyncService = class {
 	* @param agents List of agents to sync for
 	* @param sourceDir Optional custom source directory for specialists
 	*/
-	async syncSpecialists(rootDir, agents, sourceDir, writer = new PassthroughWriter()) {
+	async syncSpecialists(rootDir, agents, sourceDir, writer = new PassthroughWriter(rootDir)) {
 		const specialistsDir = sourceDir || path.default.join(rootDir, "skills/specialists");
 		if (!await fs_extra.default.pathExists(specialistsDir)) return 0;
 		const specialistFolders = (await fs_extra.default.readdir(specialistsDir)).filter((f) => {
@@ -6085,8 +6133,10 @@ var BackupSession = class {
 		const normalized = rel.replace(/\\/g, "/");
 		if (this.added.has(normalized)) return;
 		const src = path.default.join(this.rootDir, normalized);
+		await assertNoSymlinksUnderRoot(this.rootDir, src);
 		if (!await fs_extra.default.pathExists(src)) return;
 		const dest = path.default.join(this.backupDir, "files", normalized);
+		await assertNoSymlinksUnderRoot(this.rootDir, dest);
 		await fs_extra.default.copy(src, dest, { overwrite: true });
 		this.added.add(normalized);
 	}
@@ -6097,7 +6147,9 @@ var BackupSession = class {
 			reason: this.reason,
 			files: Array.from(this.added)
 		};
-		await fs_extra.default.outputJson(path.default.join(this.backupDir, "manifest.json"), manifest, { spaces: 2 });
+		const manifestPath = path.default.join(this.backupDir, "manifest.json");
+		await assertNoSymlinksUnderRoot(this.rootDir, manifestPath);
+		await fs_extra.default.outputJson(manifestPath, manifest, { spaces: 2 });
 		const backupsDir = path.default.dirname(this.backupDir);
 		if (await fs_extra.default.pathExists(backupsDir)) {
 			const dirs = (await fs_extra.default.readdir(backupsDir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
@@ -6133,12 +6185,15 @@ var BackupService = class {
 	}
 	async begin(rootDir, reason) {
 		const agsDir = path.default.join(rootDir, ".ags");
+		await assertNoSymlinksUnderRoot(rootDir, agsDir);
 		await fs_extra.default.ensureDir(agsDir);
 		const gitignorePath = path.default.join(agsDir, ".gitignore");
+		await assertNoSymlinksUnderRoot(rootDir, gitignorePath);
 		const defaultGitignore = "backups/\npolicy-candidates.json\n";
 		if (!await fs_extra.default.pathExists(gitignorePath)) await fs_extra.default.writeFile(gitignorePath, defaultGitignore, "utf8");
 		else if (await fs_extra.default.readFile(gitignorePath, "utf8") === "*\n") await fs_extra.default.writeFile(gitignorePath, defaultGitignore, "utf8");
 		const backupsDir = path.default.join(agsDir, "backups");
+		await assertNoSymlinksUnderRoot(rootDir, backupsDir);
 		await fs_extra.default.ensureDir(backupsDir);
 		const date = this.now();
 		const baseId = this.formatId(date);
@@ -6149,6 +6204,7 @@ var BackupService = class {
 			counter++;
 		}
 		const backupDir = path.default.join(backupsDir, id);
+		await assertNoSymlinksUnderRoot(rootDir, backupDir);
 		await fs_extra.default.ensureDir(backupDir);
 		return new BackupSession(id, rootDir, backupDir, reason, date.toISOString(), this.keep);
 	}
@@ -6178,6 +6234,7 @@ var BackupService = class {
 			const src = path.default.join(backupDir, "files", rel);
 			if (await fs_extra.default.pathExists(src)) {
 				const dest = path.default.join(rootDir, rel);
+				await assertNoSymlinksUnderRoot(rootDir, dest);
 				await fs_extra.default.copy(src, dest, { overwrite: true });
 				restored.push(rel);
 			}
@@ -6322,7 +6379,7 @@ var SyncService = class {
 	specialistSyncService = new SpecialistSyncService();
 	gitService = new GitService();
 	lockfileService = new LockfileService();
-	writer = new PassthroughWriter();
+	writer = new PassthroughWriter(process.cwd());
 	ownership = null;
 	dryRun = false;
 	cachedRegistryMetadata = void 0;