bigpowers 2.79.1 → 2.80.0

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.79.1",
+  "version": "2.80.0",
   "description": "80 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [2.80.0](https://github.com/danielvm-git/bigpowers/compare/v2.79.1...v2.80.0) (2026-07-23)
+
+
+### Features
+
+* **e54s01:** freeze skill catalog baseline snapshot ([0df0fff](https://github.com/danielvm-git/bigpowers/commit/0df0fff86fc48794a2343ae4b2c421835bc5c58c))
+
 ## [2.79.1](https://github.com/danielvm-git/bigpowers/compare/v2.79.0...v2.79.1) (2026-07-23)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.79.1",
+  "version": "2.80.0",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/snapshot-catalog-baseline.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# story: e54s01
+# snapshot-catalog-baseline.sh — freeze the live skill catalog into a dated,
+# immutable YAML baseline for e56's reclassification diff.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/lib/skill-common.sh"
+source "$SCRIPT_DIR/lib/python-env.sh"
+
+resolve_repo_root
+cd "$REPO_ROOT"
+
+DRY_RUN=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run) DRY_RUN=true; shift ;;
+    -h|--help) echo "Usage: bash scripts/snapshot-catalog-baseline.sh [--dry-run]"; exit 0 ;;
+    *) echo "Unknown flag: $1" >&2; exit 2 ;;
+  esac
+done
+
+DATE_STR="$(date +%Y-%m-%d)"
+COMMIT_HASH="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
+OUT_FILE="$REPO_ROOT/specs/tech-architecture/CATALOG-BASELINE-${DATE_STR}.yaml"
+
+# unquote_source_desc — strip a source frontmatter's own surrounding quotes
+# and unescape its inner \" , or re-quoting double-escapes the description.
+unquote_source_desc() {
+  local desc="$1"
+  if [[ "$desc" == \"*\" ]]; then
+    desc="${desc#\"}"
+    desc="${desc%\"}"
+    desc="${desc//\\\"/\"}"
+  fi
+  echo "$desc"
+}
+
+# emit_skill_row — print one skill's YAML row to stdout; appends any missing-
+# field warning line for that skill to $WARN_FILE (a plain file, since this
+# function runs inside a command-substitution subshell and can't mutate the
+# caller's shell variables).
+emit_skill_row() {
+  local skill_md="$1" name phase model effort desc desc_escaped
+  name="$(basename "$(dirname "$skill_md")")"
+  parse_frontmatter_okf "$skill_md" || true
+
+  phase="$(awk '/^---/{f++} f==1 && /^phase:/{print; exit}' "$skill_md" | sed 's/^phase:[[:space:]]*//')"
+  model="${_PF_MODEL:-}"
+  effort="${_PF_EFFORT:-}"
+  desc="${_PF_DESCRIPTION:-}"
+
+  [[ -z "$phase" ]] && phase="null"
+  [[ -z "$model" ]] && { model="null"; echo "  - \"${name}: missing model field\"" >> "$WARN_FILE"; }
+  [[ -z "$effort" ]] && { effort="null"; echo "  - \"${name}: missing effort field\"" >> "$WARN_FILE"; }
+  [[ -z "$desc" ]] && desc="null"
+
+  desc="$(unquote_source_desc "$desc")"
+  desc_escaped="${desc//\"/\\\"}"
+
+  echo "  - name: \"${name}\"\n    path: \"skills/${name}/SKILL.md\"\n    phase: ${phase}\n    effort: ${effort}\n    model: ${model}\n    description: \"${desc_escaped}\"\n"
+}
+
+WARN_FILE="$(mktemp)"
+trap 'rm -f "$WARN_FILE"' EXIT
+
+ROWS=""
+COUNT=0
+
+for skill_md in "$SKILLS_ROOT"/*/SKILL.md; do
+  [[ -f "$skill_md" ]] || continue
+  ROWS="${ROWS}$(emit_skill_row "$skill_md")"
+  COUNT=$((COUNT + 1))
+done
+
+WARNINGS="$(cat "$WARN_FILE")"
+WARN_COUNT="$(grep -c '^  -' "$WARN_FILE" || true)"
+
+if $DRY_RUN; then
+  echo "${COUNT} skills scanned"
+  echo "${WARN_COUNT} warnings"
+  [[ -n "$WARNINGS" ]] && echo -e "warnings:\n${WARNINGS}"
+  exit 0
+fi
+
+mkdir -p "$REPO_ROOT/specs/tech-architecture"
+
+{
+  echo "# CATALOG-BASELINE-${DATE_STR}.yaml"
+  echo "# frozen for e54-e59 migration; do not hand-edit"
+  echo "snapshot_date: \"${DATE_STR}\""
+  echo "commit_hash: \"${COMMIT_HASH}\""
+  echo "total_skill_count: ${COUNT}"
+  echo "warnings:"
+  if [[ -n "$WARNINGS" ]]; then
+    echo -e "$WARNINGS"
+  else
+    echo "  []"
+  fi
+  echo "skills:"
+  echo -e "$ROWS"
+} > "$OUT_FILE"
+
+echo "Wrote ${OUT_FILE} (${COUNT} skills, ${WARN_COUNT} warnings)"

package/scripts/test-tombstone-mechanism.sh

@@ -102,6 +102,48 @@ else
   tt_fail "expired tombstone was not flagged"
 fi
 
+# --- Scenario: rejects path-traversal / invalid skill names (threat model CWE-22) ---
+# tombstone-skill.sh exits non-zero on rejection, and this script runs under
+# `set -o pipefail` — capture output via `|| true` first so the pipe's exit
+# status doesn't mask the grep check below.
+output=$(bash scripts/tombstone-skill.sh "../../etc/passwd" "target" 2>&1 || true)
+if echo "$output" | grep -qi "not a valid skill name"; then
+  tt_pass "tombstone-skill.sh rejects a path-traversal old-name"
+else
+  tt_fail "tombstone-skill.sh did not reject a path-traversal old-name"
+fi
+
+output=$(bash scripts/tombstone-skill.sh "$FIXTURE_OLD" "../../etc/passwd" 2>&1 || true)
+if echo "$output" | grep -qi "not a valid skill name"; then
+  tt_pass "tombstone-skill.sh rejects a path-traversal new-name"
+else
+  tt_fail "tombstone-skill.sh did not reject a path-traversal new-name"
+fi
+
+# --- Scenario: validate-tombstones.sh rejects an invalid name read back from the ledger ---
+python3 -c "
+import yaml
+d = yaml.safe_load(open('$TOMBSTONES_FILE')) or {'tombstones': []}
+d.setdefault('tombstones', []).append({
+    'old_name': '../../etc/passwd',
+    'new_name_or_merge_target': 'target',
+    'created_at_version': '0.0.0',
+})
+yaml.dump(d, open('$TOMBSTONES_FILE', 'w'), default_flow_style=False)
+"
+output=$(bash scripts/validate-tombstones.sh 2>&1 | strip_ansi || true)
+if echo "$output" | grep -qi "FAIL.*not a valid skill name"; then
+  tt_pass "validate-tombstones.sh rejects a path-traversal name read from the ledger"
+else
+  tt_fail "validate-tombstones.sh did not reject a path-traversal name read from the ledger"
+fi
+python3 -c "
+import yaml
+d = yaml.safe_load(open('$TOMBSTONES_FILE')) or {'tombstones': []}
+d['tombstones'] = [t for t in d.get('tombstones', []) if t.get('old_name') != '../../etc/passwd']
+yaml.dump(d, open('$TOMBSTONES_FILE', 'w'), default_flow_style=False)
+"
+
 echo "---"
 if [[ "$FAILURES" -eq 0 ]]; then
   echo -e "${GREEN}test-tombstone-mechanism: ALL PASS${NC}"