bigpowers 2.86.0 → 2.86.2

package/skills/security-review/fixtures/CWE-639-idor-negative.go

@@ -0,0 +1,48 @@
+// story: e80s05
+// Negative fixture: correctly scoped tenant query (must NOT be flagged).
+//
+// The org comes from the authenticated context, never from the request, and it
+// is part of the WHERE clause. A caller from another organization gets zero
+// rows rather than someone else's site.
+//
+// Note the retrofit trap this deliberately avoids: bigbase's BUG-2026-07-24T184443
+// added `org_id INTEGER NOT NULL DEFAULT 0`, which passed tests on new rows and
+// hid 8 of 9 production sites whose legacy rows defaulted to org 0. Scope on a
+// real, backfilled org_id — never a placeholder default.
+package fixtures
+
+import (
+	"database/sql"
+	"net/http"
+)
+
+func orgIDFromContext(r *http.Request) (string, bool) {
+	v, ok := r.Context().Value(ctxOrgID).(string)
+	return v, ok && v != ""
+}
+
+type ctxKey string
+
+const ctxOrgID ctxKey = "org_id"
+
+func handleGetSiteNegative(w http.ResponseWriter, r *http.Request, db *sql.DB) {
+	orgID, ok := orgIDFromContext(r)
+	if !ok {
+		http.Error(w, "forbidden", http.StatusForbidden)
+		return
+	}
+	siteID := r.URL.Query().Get("site_id")
+
+	// SAFE: the tenant predicate is not optional and does not come from input.
+	row := db.QueryRow(
+		`SELECT id, name, domain FROM sites WHERE id = ? AND org_id = ?`,
+		siteID, orgID,
+	)
+
+	var id, name, domain string
+	if err := row.Scan(&id, &name, &domain); err != nil {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+	_, _ = w.Write([]byte(name + " " + domain))
+}

package/skills/security-review/fixtures/CWE-639-idor-positive.go

@@ -0,0 +1,29 @@
+// story: e80s05
+// Positive fixture: IDOR / missing tenant scoping (must be flagged).
+//
+// Modelled on the bigbase family (BUG-129/130/133/135/136/140/143): the
+// handler authenticates the caller, then trusts an ID from the request and
+// queries by that ID alone. Authentication is proven; authorization is not.
+// Nothing in the type system or a diff-scoped review makes this look wrong —
+// the bug is a predicate that was never written.
+package fixtures
+
+import (
+	"database/sql"
+	"net/http"
+)
+
+func handleGetSitePositive(w http.ResponseWriter, r *http.Request, db *sql.DB) {
+	siteID := r.URL.Query().Get("site_id")
+
+	// VULNERABLE: scoped by primary key only. Any authenticated caller from any
+	// organization can read any site by guessing or enumerating site_id.
+	row := db.QueryRow(`SELECT id, name, domain FROM sites WHERE id = ?`, siteID)
+
+	var id, name, domain string
+	if err := row.Scan(&id, &name, &domain); err != nil {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+	_, _ = w.Write([]byte(name + " " + domain))
+}

package/skills/smoke-test/SKILL.md

@@ -81,4 +81,4 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`

package/skills/trace-requirement/SKILL.md

@@ -33,7 +33,7 @@ Look for `// story: X.Y` or `# story: X.Y` comments in source files and tests:
 grep -rn "story: " . --include="*.ts" --include="*.js" --include="*.py" --include="*.sh" | grep -v node_modules
 ```
 
-→ verify: `grep -rn "story: " . --include="*.ts" --include="*.sh" | wc -l`
+→ verify: `[ "$(grep -rl "story: " . --include="*.ts" --include="*.sh" --include="*.py" 2>/dev/null | wc -l | tr -d " ")" -gt 0 ]`
 
 ### 3. Build the matrix
 

package/skills-lock.json

@@ -88,7 +88,7 @@
     },
     "diagnose-root": {
       "description": "Run 4-phase root cause analysis — reproduce, isolate, hypothesize, verify. Use when a bug is confirmed but root cause is unclear, after investigate-bug, or when user mentions root cause analysis.",
-      "sha256": "fe1be0325dca7c89",
+      "sha256": "29ae28bdaf599530",
       "path": "skills/diagnose-rootSKILL.md"
     },
     "diagnose-stall": {
@@ -203,7 +203,7 @@
     },
     "migrate-spec": {
       "description": "Detect GSD, spec-kit, or BMAD spec artifacts and transform them into bigpowers YAML layout (state.yaml, release-plan.yaml, epics/, requirements/, plans/, ADRs). Use when migrating foreign spec docs.",
-      "sha256": "a9d4bfb518421b13",
+      "sha256": "7eff81666ba5b9c0",
       "path": "skills/migrate-specSKILL.md"
     },
     "model-domain": {
@@ -238,7 +238,7 @@
     },
     "plan-work": {
       "description": "\"PLANNING SPINE STEP 3 of 3 — Plan the work: write detailed implementation tasks into the active epic capsule (specs/epics/eNN-slug/). Produces countable-story-format .md specs and runnable -tasks.yaml files. Use after slice-tasks (step 2). Not a substitute for scope-work (step 1) or slice-tasks (step 2).\"",
-      "sha256": "2cccc734ae9781ab",
+      "sha256": "e5d751ca5e928e2d",
       "path": "skills/plan-workSKILL.md"
     },
     "publish-package": {
@@ -303,7 +303,7 @@
     },
     "security-review": {
       "description": ">",
-      "sha256": "0265010d9bd22e27",
+      "sha256": "3d046f443689fc1e",
       "path": "skills/security-reviewSKILL.md"
     },
     "seed-conventions": {
@@ -333,7 +333,7 @@
     },
     "smoke-test": {
       "description": "\"Post-deploy health-check against a live URL. Validates HTTP status, response content, and critical endpoints. Runnable standalone OR as the final step of the deploy skill.\"",
-      "sha256": "f75e9e57d4003209",
+      "sha256": "050170d66ada581e",
       "path": "skills/smoke-testSKILL.md"
     },
     "spike-prototype": {
@@ -358,7 +358,7 @@
     },
     "trace-requirement": {
       "description": "Link story IDs from specs/release-plan.yaml + epic capsule directories to the implementing code and tests. Produces specs/TRACEABILITY_LATEST.md. Use when you want to verify coverage of a release plan, audit which stories are implemented, or find \"dark\" stories with no code.",
-      "sha256": "1e77081b27b86cf3",
+      "sha256": "f825b8f5849b963c",
       "path": "skills/trace-requirementSKILL.md"
     },
     "using-bigpowers": {