coding-agent-skills 0.2.8

package/tests/fixtures/policy/commands.json

@@ -0,0 +1,164 @@
+{
+  "version": "1.0.0",
+  "cases": [
+    {
+      "id": "safe-pwd",
+      "command": "pwd",
+      "allowed": true
+    },
+    {
+      "id": "safe-git-status",
+      "command": "git status --short --branch",
+      "allowed": true
+    },
+    {
+      "id": "safe-chain",
+      "command": "pwd && git status --short --branch",
+      "allowed": true
+    },
+    {
+      "id": "safe-pipeline",
+      "command": "rg --files | head -n 20",
+      "allowed": true
+    },
+    {
+      "id": "unsafe-pipeline",
+      "command": "rg --files | git push origin main",
+      "allowed": false,
+      "reason": "Git mutation"
+    },
+    {
+      "id": "heredoc",
+      "command": "node <<'SCRIPT'\nconsole.log('fixture')\nSCRIPT",
+      "allowed": false,
+      "reason": "heredoc"
+    },
+    {
+      "id": "safe-multiline",
+      "command": "pwd\ngit status --short --branch",
+      "allowed": true
+    },
+    {
+      "id": "unsafe-multiline",
+      "command": "pwd\ngit push origin main",
+      "allowed": false,
+      "reason": "Git mutation"
+    },
+    {
+      "id": "safe-npm-script",
+      "command": "npm run typecheck",
+      "scripts": {
+        "typecheck": "node --check src/index.js"
+      },
+      "allowed": true
+    },
+    {
+      "id": "unsafe-npm-script-definition",
+      "command": "npm run validate",
+      "scripts": {
+        "validate": "npm install && node --check src/index.js"
+      },
+      "allowed": false,
+      "reason": "script definition"
+    },
+    {
+      "id": "unsafe-npm-fix",
+      "command": "npm run lint:fix",
+      "allowed": false,
+      "reason": "unsafe npm script"
+    },
+    {
+      "id": "npx-command",
+      "command": "npx tool-name check",
+      "allowed": false,
+      "reason": "npx"
+    },
+    {
+      "id": "safe-local-curl",
+      "command": "curl -sS http://127.0.0.1:3000/health",
+      "allowed": true
+    },
+    {
+      "id": "curl-authorization",
+      "command": "curl --user fake-user:fake-password https://example.invalid/admin",
+      "allowed": false,
+      "reason": "authenticated"
+    },
+    {
+      "id": "curl-data",
+      "command": "curl --data 'mode=change' https://example.invalid/api",
+      "allowed": false,
+      "reason": "mutating HTTP"
+    },
+    {
+      "id": "curl-url-credentials",
+      "command": "curl https://user:password@example.invalid/private",
+      "allowed": false,
+      "reason": "URL credentials"
+    },
+    {
+      "id": "git-push",
+      "command": "git push origin main",
+      "allowed": false,
+      "reason": "Git mutation"
+    },
+    {
+      "id": "git-unsafe-argument",
+      "command": "git config --global user.name Example",
+      "allowed": false,
+      "reason": "Git command"
+    },
+    {
+      "id": "mixed-chain",
+      "command": "git status --short && npm install",
+      "allowed": false,
+      "reason": "package installation"
+    },
+    {
+      "id": "shell-wrapper",
+      "command": "bash -c 'git push origin main'",
+      "allowed": false,
+      "reason": "shell wrapper"
+    },
+    {
+      "id": "file-redirection",
+      "command": "printf fixture > result.txt",
+      "allowed": false,
+      "reason": "redirection"
+    },
+    {
+      "id": "bounded-find",
+      "command": "find . -maxdepth 3 -type f",
+      "allowed": true
+    },
+    {
+      "id": "unbounded-find",
+      "command": "find /home -type f",
+      "allowed": false,
+      "reason": "unbounded"
+    },
+    {
+      "id": "service-status",
+      "command": "systemctl --user status example.service --no-pager",
+      "allowed": true
+    },
+    {
+      "id": "service-restart",
+      "command": "systemctl --user restart example.service",
+      "allowed": false,
+      "reason": "service mutation"
+    },
+    {
+      "id": "migration-apply",
+      "command": "npx supabase db push",
+      "allowed": false,
+      "reason": "npx supabase"
+    },
+    {
+      "id": "privileged-api",
+      "command": "gh api /user",
+      "allowed": false,
+      "reason": "privileged API"
+    }
+  ]
+}

package/tests/fixtures/policy/properties.json

@@ -0,0 +1,126 @@
+{
+  "version": "1.0.0",
+  "safeByPolicy": [
+    {
+      "policy": "repo-map",
+      "command": "find . -maxdepth 3 -type f",
+      "family": "bounded-file-inspection"
+    },
+    {
+      "policy": "repo-map",
+      "command": "sed -n 1,40p README.md",
+      "family": "bounded-file-inspection"
+    },
+    {
+      "policy": "git-preflight",
+      "command": "git status --short --branch",
+      "family": "git-read-only"
+    },
+    {
+      "policy": "build-verify",
+      "command": "npm pkg get scripts",
+      "family": "project-native-validation"
+    },
+    {
+      "policy": "build-verify",
+      "command": "npm run typecheck",
+      "family": "project-native-validation",
+      "scripts": {
+        "typecheck": "node --check src/index.js"
+      }
+    },
+    {
+      "policy": "runtime-truth",
+      "command": "curl -sS http://127.0.0.1:3000/health",
+      "family": "safe-health-check"
+    }
+  ],
+  "safePrefixes": [
+    "pwd",
+    "git status --short --branch",
+    "rg --files"
+  ],
+  "restrictedSuffixes": [
+    {
+      "command": "git push origin main",
+      "reason": "Git mutation"
+    },
+    {
+      "command": "npm install",
+      "reason": "package installation"
+    },
+    {
+      "command": "npx wrangler deploy",
+      "reason": "npx wrangler"
+    },
+    {
+      "command": "npx supabase db push",
+      "reason": "npx supabase"
+    },
+    {
+      "command": "cat .env",
+      "reason": "secret-file"
+    },
+    {
+      "command": "find /home -type f",
+      "reason": "unbounded"
+    },
+    {
+      "command": "systemctl --user restart sample.service",
+      "reason": "service mutation"
+    }
+  ],
+  "separators": [" && ", "; ", " | ", "\n"],
+  "wrappers": ["sh -c", "bash -c"],
+  "heredocs": [
+    "node <<'SCRIPT'\ngit push origin main\nSCRIPT",
+    "sh <<EOF\nnpm install\nEOF"
+  ],
+  "argumentCases": [
+    {
+      "command": "git status --short --branch",
+      "allowed": true
+    },
+    {
+      "command": "git config --global user.name Example",
+      "allowed": false,
+      "reason": "Git command"
+    },
+    {
+      "command": "sed -n 1,20p README.md",
+      "allowed": true
+    },
+    {
+      "command": "sed -n 1,20p /home/example/private.txt",
+      "allowed": false,
+      "reason": "outside declared scope"
+    },
+    {
+      "command": "curl --user fake:fake http://127.0.0.1:3000/health",
+      "allowed": false,
+      "reason": "authenticated"
+    },
+    {
+      "command": "curl --user fake:fake http://127.0.0.1:3000/health",
+      "approvals": ["authenticated-local-health"],
+      "allowed": true
+    }
+  ],
+  "scriptBodies": [
+    {
+      "command": "npm run validate",
+      "scripts": {
+        "validate": "node --check src/index.js"
+      },
+      "allowed": true
+    },
+    {
+      "command": "npm run validate",
+      "scripts": {
+        "validate": "node --check src/index.js && npm install"
+      },
+      "allowed": false,
+      "reason": "script definition"
+    }
+  ]
+}

package/tests/fixtures/privacy/cases.json

@@ -0,0 +1,47 @@
+{
+  "version": "1.0.0",
+  "synthetic": true,
+  "encoding": "ordered-parts",
+  "cases": [
+    {
+      "id": "fake-github-token",
+      "parts": ["gh", "p_", "FAKEONLY1234567890ABCDEF"],
+      "expectedTypes": ["github-token"]
+    },
+    {
+      "id": "fake-jwt",
+      "parts": ["eyJFAKE", "HEADER123456", ".", "eyJFAKE", "PAYLOAD12345", ".", "FAKESIGNATURE123456"],
+      "expectedTypes": ["jwt"]
+    },
+    {
+      "id": "fake-bearer",
+      "parts": ["Authorization: ", "Bearer ", "FAKEBEARER1234567890"],
+      "expectedTypes": ["authorization-header"]
+    },
+    {
+      "id": "fake-private-key",
+      "parts": ["-----BEGIN ", "PRIVATE KEY-----\n", "FAKEKEYMATERIAL\n", "-----END PRIVATE KEY-----"],
+      "expectedTypes": ["private-key"]
+    },
+    {
+      "id": "fake-env",
+      "parts": ["GITHUB_", "TOKEN=", "FAKEENVVALUE123456\n", "DATABASE_", "URL=postgres://fake:fake@example.invalid/db"],
+      "expectedTypes": ["env-secret", "url-credentials"]
+    },
+    {
+      "id": "fake-url-credentials",
+      "parts": ["https://", "fake-user:", "fake-password@", "example.invalid/private"],
+      "expectedTypes": ["url-credentials"]
+    },
+    {
+      "id": "fake-local-path",
+      "parts": ["/home/", "fake-user/", "private-project"],
+      "expectedTypes": ["local-home-path"]
+    },
+    {
+      "id": "fake-private-domain",
+      "parts": ["service.", "corp.", "example.invalid"],
+      "expectedTypes": ["private-domain"]
+    }
+  ]
+}

package/tests/fixtures/project-adapter-installation/invalid-adapter-location/.agents/adapters/basic/adapter.json

@@ -0,0 +1,53 @@
+{
+  "adapterId": "fixture-project-basic",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-exact-project",
+    "detection": {
+      "rootMarkers": [{"kind": "file", "path": "package.json"}],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": ["0.2.3"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["README.md", "src"],
+    "ignoredPaths": ["dist"],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["repository root", "application entry point"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/project-adapter-installation/invalid-adapter-location/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-exact-project",
+  "adapterRoot": ".agents/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": "0.2.3"
+  },
+  "compatibleSkillIds": ["repo-map"],
+  "adapters": [
+    {
+      "id": "fixture-project-basic",
+      "version": "1.0.0",
+      "skillIds": ["repo-map"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/project-adapter-installation/invalid-adapter-schema-version/.coding-agent/adapters/basic/adapter.json

@@ -0,0 +1,53 @@
+{
+  "adapterId": "fixture-project-basic",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-exact-project",
+    "detection": {
+      "rootMarkers": [{"kind": "file", "path": "package.json"}],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": ["0.2.3"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["README.md", "src"],
+    "ignoredPaths": ["dist"],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["repository root", "application entry point"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/project-adapter-installation/invalid-adapter-schema-version/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-exact-project",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "2.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": "0.2.3"
+  },
+  "compatibleSkillIds": ["repo-map"],
+  "adapters": [
+    {
+      "id": "fixture-project-basic",
+      "version": "1.0.0",
+      "skillIds": ["repo-map"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/project-adapter-installation/invalid-adapter-version-mismatch/.coding-agent/adapters/basic/adapter.json

@@ -0,0 +1,53 @@
+{
+  "adapterId": "fixture-project-basic",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-exact-project",
+    "detection": {
+      "rootMarkers": [{"kind": "file", "path": "package.json"}],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": ["0.2.3"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["README.md", "src"],
+    "ignoredPaths": ["dist"],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["repository root", "application entry point"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/project-adapter-installation/invalid-adapter-version-mismatch/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-exact-project",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": "0.2.3"
+  },
+  "compatibleSkillIds": ["repo-map"],
+  "adapters": [
+    {
+      "id": "fixture-project-basic",
+      "version": "2.0.0",
+      "skillIds": ["repo-map"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/project-adapter-installation/invalid-bad-semver/.coding-agent/adapters/basic/adapter.json

@@ -0,0 +1,53 @@
+{
+  "adapterId": "fixture-project-basic",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-exact-project",
+    "detection": {
+      "rootMarkers": [{"kind": "file", "path": "package.json"}],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": ["0.2.3"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["README.md", "src"],
+    "ignoredPaths": ["dist"],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["repository root", "application entry point"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/project-adapter-installation/invalid-bad-semver/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-exact-project",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "v0.2.2",
+    "versionPin": "^0.2.2"
+  },
+  "compatibleSkillIds": ["repo-map"],
+  "adapters": [
+    {
+      "id": "fixture-project-basic",
+      "version": "1.0.0",
+      "skillIds": ["repo-map"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}