coding-agent-skills 0.2.8

package/tests/fixtures/project-adapter-upgrades/unsupported-future-core/before/.coding-agent/adapters/fixture-upgrade-adapter/adapter.json

@@ -0,0 +1,70 @@
+{
+  "adapterId": "fixture-upgrade-adapter",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-upgrade-project",
+    "detection": {
+      "rootMarkers": [
+        {
+          "kind": "file",
+          "path": "package.json"
+        }
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": [
+        "0.2.2"
+      ],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": [
+      "README.md",
+      "src"
+    ],
+    "ignoredPaths": [
+      "dist"
+    ],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": [
+      "repository root",
+      "application entry point"
+    ],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": [
+      "npm"
+    ]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/project-adapter-upgrades/unsupported-future-core/before/.coding-agent/skills.json

@@ -0,0 +1,27 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-upgrade-project",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.2",
+    "versionPin": "0.2.2"
+  },
+  "compatibleSkillIds": [
+    "repo-map"
+  ],
+  "adapters": [
+    {
+      "id": "fixture-upgrade-adapter",
+      "version": "1.0.0",
+      "skillIds": [
+        "repo-map"
+      ]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/project-adapter-upgrades/unsupported-old-core/after/.coding-agent/adapters/fixture-upgrade-adapter/adapter.json

@@ -0,0 +1,70 @@
+{
+  "adapterId": "fixture-upgrade-adapter",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-upgrade-project",
+    "detection": {
+      "rootMarkers": [
+        {
+          "kind": "file",
+          "path": "package.json"
+        }
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": [
+        "0.2.3"
+      ],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": [
+      "README.md",
+      "src"
+    ],
+    "ignoredPaths": [
+      "dist"
+    ],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": [
+      "repository root",
+      "application entry point"
+    ],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": [
+      "npm"
+    ]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/project-adapter-upgrades/unsupported-old-core/after/.coding-agent/skills.json

@@ -0,0 +1,27 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-upgrade-project",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": "0.2.3"
+  },
+  "compatibleSkillIds": [
+    "repo-map"
+  ],
+  "adapters": [
+    {
+      "id": "fixture-upgrade-adapter",
+      "version": "1.0.0",
+      "skillIds": [
+        "repo-map"
+      ]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/project-adapter-upgrades/unsupported-old-core/before/.coding-agent/adapters/fixture-upgrade-adapter/adapter.json

@@ -0,0 +1,70 @@
+{
+  "adapterId": "fixture-upgrade-adapter",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-upgrade-project",
+    "detection": {
+      "rootMarkers": [
+        {
+          "kind": "file",
+          "path": "package.json"
+        }
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": [
+        "0.1.2"
+      ],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": [
+      "README.md",
+      "src"
+    ],
+    "ignoredPaths": [
+      "dist"
+    ],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": [
+      "repository root",
+      "application entry point"
+    ],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": [
+      "npm"
+    ]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/project-adapter-upgrades/unsupported-old-core/before/.coding-agent/skills.json

@@ -0,0 +1,27 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-upgrade-project",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.1.2",
+    "versionPin": "0.1.2"
+  },
+  "compatibleSkillIds": [
+    "repo-map"
+  ],
+  "adapters": [
+    {
+      "id": "fixture-upgrade-adapter",
+      "version": "1.0.0",
+      "skillIds": [
+        "repo-map"
+      ]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/project-adapter-upgrades/valid-upgrade/after/.coding-agent/adapters/fixture-upgrade-adapter/adapter.json

@@ -0,0 +1,70 @@
+{
+  "adapterId": "fixture-upgrade-adapter",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-upgrade-project",
+    "detection": {
+      "rootMarkers": [
+        {
+          "kind": "file",
+          "path": "package.json"
+        }
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": [
+        "0.2.3"
+      ],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": [
+      "README.md",
+      "src"
+    ],
+    "ignoredPaths": [
+      "dist"
+    ],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": [
+      "repository root",
+      "application entry point"
+    ],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": [
+      "npm"
+    ]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/project-adapter-upgrades/valid-upgrade/after/.coding-agent/skills.json

@@ -0,0 +1,27 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-upgrade-project",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": "0.2.3"
+  },
+  "compatibleSkillIds": [
+    "repo-map"
+  ],
+  "adapters": [
+    {
+      "id": "fixture-upgrade-adapter",
+      "version": "1.0.0",
+      "skillIds": [
+        "repo-map"
+      ]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/project-adapter-upgrades/valid-upgrade/before/.coding-agent/adapters/fixture-upgrade-adapter/adapter.json

@@ -0,0 +1,70 @@
+{
+  "adapterId": "fixture-upgrade-adapter",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-upgrade-project",
+    "detection": {
+      "rootMarkers": [
+        {
+          "kind": "file",
+          "path": "package.json"
+        }
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": [
+        "0.2.2"
+      ],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": [
+      "README.md",
+      "src"
+    ],
+    "ignoredPaths": [
+      "dist"
+    ],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": [
+      "repository root",
+      "application entry point"
+    ],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": [
+      "npm"
+    ]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/project-adapter-upgrades/valid-upgrade/before/.coding-agent/skills.json

@@ -0,0 +1,27 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-upgrade-project",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.2",
+    "versionPin": "0.2.2"
+  },
+  "compatibleSkillIds": [
+    "repo-map"
+  ],
+  "adapters": [
+    {
+      "id": "fixture-upgrade-adapter",
+      "version": "1.0.0",
+      "skillIds": [
+        "repo-map"
+      ]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/project-adapters.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/sample-repo/.env.example

@@ -0,0 +1 @@
+EXAMPLE_API_TOKEN=replace-with-local-test-value

package/tests/fixtures/sample-repo/README.md

@@ -0,0 +1,4 @@
+# Sample Repository
+
+This synthetic repository exists only for dependency-free pilot-pack tests.
+It contains no credentials, private paths, network calls, or generated output.

package/tests/fixtures/sample-repo/docs/architecture.md

@@ -0,0 +1,3 @@
+# Architecture
+
+The fixture has one dependency-free module and one built-in Node.js test.

package/tests/fixtures/sample-repo/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "coding-agent-skills-sample-repo",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "typecheck": "node --check src/index.js",
+    "test": "node --test",
+    "build": "node --check src/index.js"
+  }
+}

package/tests/fixtures/sample-repo/src/index.js

@@ -0,0 +1,3 @@
+export function greeting(name) {
+  return `Hello, ${name}.`;
+}

package/tests/fixtures/sample-repo/test/index.test.js

@@ -0,0 +1,8 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { greeting } from "../src/index.js";
+
+test("greeting includes the supplied name", () => {
+  assert.equal(greeting("pilot"), "Hello, pilot.");
+});

package/tests/fixtures/triggers/cases.json

@@ -0,0 +1,101 @@
+{
+  "version": "1.0.0",
+  "cases": [
+    {
+      "id": "repo-map-unfamiliar",
+      "prompt": "Map this unfamiliar repository and identify its entry points before I change anything.",
+      "expectedSkill": "repo-map",
+      "notSkills": ["build-verify", "runtime-truth"]
+    },
+    {
+      "id": "repo-map-ambiguous-root",
+      "prompt": "Determine which nested directory is the canonical repository root and summarize its structure.",
+      "expectedSkill": "repo-map",
+      "notSkills": ["git-preflight"]
+    },
+    {
+      "id": "repo-map-stale-context",
+      "prompt": "The inherited repository context is stale; relocate the canonical repo and map the current packages.",
+      "expectedSkill": "repo-map",
+      "notSkills": ["llm-drift-control"]
+    },
+    {
+      "id": "build-after-implementation",
+      "prompt": "The implementation is finished. Run the existing typecheck, tests, and build.",
+      "expectedSkill": "build-verify",
+      "notSkills": ["repo-map", "git-preflight"]
+    },
+    {
+      "id": "build-before-handoff",
+      "prompt": "Before handoff, validate the changed code with the project-native test and build scripts.",
+      "expectedSkill": "build-verify",
+      "notSkills": ["runtime-truth"]
+    },
+    {
+      "id": "git-before-commit",
+      "prompt": "Before I commit, inspect the branch, staged files, untracked files, and whitespace state.",
+      "expectedSkill": "git-preflight",
+      "notSkills": ["build-verify"]
+    },
+    {
+      "id": "git-before-push",
+      "prompt": "Check whether the Git working tree is understood and ready for push or handoff.",
+      "expectedSkill": "git-preflight",
+      "notSkills": ["repo-map"]
+    },
+    {
+      "id": "runtime-live-claim",
+      "prompt": "The API is claimed to be live. Verify the process, listener, and health endpoint.",
+      "expectedSkill": "runtime-truth",
+      "notSkills": ["build-verify"]
+    },
+    {
+      "id": "runtime-running-state",
+      "prompt": "Is the local worker actually running and listening on the expected port?",
+      "expectedSkill": "runtime-truth",
+      "notSkills": ["git-preflight"]
+    },
+    {
+      "id": "drift-doc-code-disagreement",
+      "prompt": "The README says the feature exists, but the code and tests disagree. Reconcile the claim.",
+      "expectedSkill": "llm-drift-control",
+      "notSkills": ["repo-map"]
+    },
+    {
+      "id": "drift-runtime-disagreement",
+      "prompt": "The handoff says phase 8 is complete, while runtime evidence contradicts it. Classify the claim.",
+      "expectedSkill": "llm-drift-control",
+      "notSkills": ["runtime-truth"]
+    },
+    {
+      "id": "negative-deploy",
+      "prompt": "Deploy this application to production.",
+      "expectedSkill": null,
+      "notSkills": ["repo-map", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
+    },
+    {
+      "id": "negative-install",
+      "prompt": "Install all missing dependencies and update the lockfile.",
+      "expectedSkill": null,
+      "notSkills": ["build-verify"]
+    },
+    {
+      "id": "negative-publish",
+      "prompt": "Commit these files and publish the branch.",
+      "expectedSkill": null,
+      "notSkills": ["git-preflight"]
+    },
+    {
+      "id": "negative-restart",
+      "prompt": "Restart the unhealthy service and enable it at boot.",
+      "expectedSkill": null,
+      "notSkills": ["runtime-truth"]
+    },
+    {
+      "id": "negative-rewrite",
+      "prompt": "Rewrite the documentation so it agrees with the project claim.",
+      "expectedSkill": null,
+      "notSkills": ["llm-drift-control"]
+    }
+  ]
+}

package/tests/policy/README.md

@@ -0,0 +1,16 @@
+# Command Policy Tests
+
+`tests/fixtures/policy/commands.json` validates safe single commands, safe composition, multiline commands, and rejection of:
+
+- Shell chains containing any restricted segment.
+- Validation scripts whose definitions contain installs, fixes, deploys, or migrations.
+- Git mutation hidden behind aliases or shell wrappers.
+- Runtime lifecycle operations.
+- Unbounded traversal.
+- Secret-file reads and authenticated APIs.
+
+Validate representative skill manifests and policies against the schemas in `schemas/`.
+
+`tests/fixtures/policy/properties.json` generates cross-products of safe prefixes, separators, and restricted suffixes, then checks wrappers, heredocs, arguments, provider-specific `npx`, curl approvals, bounded reads, and package-script bodies.
+
+The analyzer is deliberately bounded. It rejects obvious bypasses and unknown execution rather than claiming full POSIX shell parsing.

package/tests/privacy/README.md

@@ -0,0 +1,14 @@
+# Privacy And Restricted-Evidence Tests
+
+`tests/fixtures/privacy/cases.json` stores synthetic sensitive shapes as ordered parts so the repository does not retain complete token-like or private-key values.
+
+Verify that:
+
+- Secret-bearing files are not read without named approval.
+- Evidence summaries do not reproduce sensitive values.
+- Restricted commands do not appear as reusable examples.
+- Private values are replaced with safe descriptions or placeholders.
+- An intentionally local credential is not treated as an incident without exposure evidence.
+- A credential shown to be printed, generated, committed, pushed, or externally exposed produces a rotation warning without printing the value.
+
+The executable harness reconstructs values only in memory, confirms expected detection types, redacts them, and verifies no sensitive-looking value remains.