mustflow 2.112.14 → 2.113.0

package/dist/cli/commands/skill.js

@@ -16,6 +16,7 @@ const SKILL_OPTIONS = [
     { name: '--dry-run', kind: 'boolean' },
     { name: '--name', kind: 'string' },
     { name: '--ref', kind: 'string' },
+    { name: '--trust-scripts', kind: 'boolean' },
 ];
 export function getSkillHelp(lang = 'en') {
     return renderHelp({
@@ -32,6 +33,7 @@ export function getSkillHelp(lang = 'en') {
             { label: '--install', description: 'Install an external skill after previewing the same source' },
             { label: '--name <slug>', description: 'Override the installed external skill directory name' },
             { label: '--ref <ref>', description: 'Override the GitHub ref used for import' },
+            { label: '--trust-scripts', description: 'Create command-contract intents for imported scripts; requires --install to write them' },
             { label: '--json', description: t(lang, 'cli.option.json') },
             { label: '-h, --help', description: t(lang, 'cli.option.help') },
         ],
@@ -73,6 +75,7 @@ function parseSkillArgs(args) {
         dryRun: hasParsedCliOption(parsed, '--dry-run'),
         name: getParsedCliStringOption(parsed, '--name'),
         ref: getParsedCliStringOption(parsed, '--ref'),
+        trustScripts: hasParsedCliOption(parsed, '--trust-scripts'),
         error: parsed.error,
     };
 }
@@ -138,6 +141,15 @@ function renderSkillImportReport(report) {
             lines.push(`- ${file.relative_path} (${file.kind}, ${file.bytes} bytes, ${file.sha256})`);
         }
     }
+    if (report.script_trust) {
+        lines.push('', 'Script trust', `- requested: ${String(report.script_trust.requested)}`, `- status: ${report.script_trust.status}`, `- command authority: ${String(report.script_trust.grants_command_authority)}`);
+        if (report.script_trust.fragment_path) {
+            lines.push(`- command fragment: ${report.script_trust.fragment_path}`);
+        }
+        for (const intent of report.script_trust.intents) {
+            lines.push(`- intent: ${intent.intent}`);
+        }
+    }
     if (report.warnings.length > 0) {
         lines.push('', 'Warnings', ...report.warnings.map((warning) => `- ${warning}`));
     }
@@ -183,6 +195,7 @@ export async function runSkill(args, reporter, lang = 'en') {
             mode,
             name: parsed.name,
             ref: parsed.ref,
+            trustScripts: parsed.trustScripts,
         });
         if (parsed.json) {
             reporter.stdout(JSON.stringify(report, null, 2));

package/dist/cli/lib/external-skill-import.js

@@ -1,9 +1,12 @@
 import { existsSync, renameSync, rmSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
-import { ensureFileTargetInsideWithoutSymlinks, writeJsonFileInsideWithoutSymlinks, writeUtf8FileInsideWithoutSymlinks, } from '../../core/safe-filesystem.js';
+import { readCommandContract, readCommandContractIncludePaths, } from '../../core/config-loading.js';
+import { ensureFileTargetInsideWithoutSymlinks, readUtf8FileInsideWithoutSymlinks, writeJsonFileInsideWithoutSymlinks, writeUtf8FileInsideWithoutSymlinks, } from '../../core/safe-filesystem.js';
 const EXTERNAL_SKILL_ROOT = '.mustflow/external-skills';
 const PROVENANCE_FILE = 'mustflow-skill-source.json';
+const COMMANDS_CONFIG_PATH = '.mustflow/config/commands.toml';
+const COMMAND_FRAGMENT_DIRECTORY = '.mustflow/config/commands';
 const DEFAULT_GITHUB_REF = 'HEAD';
 const MAX_IMPORTED_FILES = 40;
 const MAX_TOTAL_BYTES = 512 * 1024;
@@ -130,6 +133,9 @@ function sanitizeSkillName(value) {
         .replace(/^-+|-+$/gu, '')
         .replace(/-{2,}/gu, '-');
 }
+function commandSafeSegment(value) {
+    return sanitizeSkillName(value).replace(/-/gu, '_');
+}
 function readFrontmatterScalar(content, key) {
     if (!content.startsWith('---')) {
         return null;
@@ -359,7 +365,172 @@ function createTarget(skillName) {
         provenance_path: `${skillDir}/${PROVENANCE_FILE}`,
     };
 }
-function writeImportedSkillFiles(projectRoot, target, source, files, fileReport, warnings) {
+function scriptNameForIntent(relativePath) {
+    const basename = path.posix.basename(relativePath);
+    const withoutExtension = basename.replace(/\.[^.]+$/u, '');
+    const sanitized = commandSafeSegment(withoutExtension);
+    if (!sanitized) {
+        throw new Error(`External script path cannot be converted to a safe intent name: ${relativePath}`);
+    }
+    return sanitized;
+}
+function trustedScriptArgv(skillName, scriptPath) {
+    const extension = path.posix.extname(scriptPath).toLowerCase();
+    const projectScriptPath = `${EXTERNAL_SKILL_ROOT}/${skillName}/${scriptPath}`;
+    if (['.js', '.mjs', '.cjs'].includes(extension)) {
+        return ['node', projectScriptPath];
+    }
+    if (['.ts', '.mts', '.cts'].includes(extension)) {
+        return ['bun', projectScriptPath];
+    }
+    if (extension === '.ps1') {
+        return ['pwsh', '-NoProfile', '-File', projectScriptPath];
+    }
+    if (extension === '.sh') {
+        return ['sh', projectScriptPath];
+    }
+    throw new Error(`External script import cannot create a trusted command intent for unsupported script type: ${scriptPath}`);
+}
+function createTrustedScriptIntent(skillName, scriptPath) {
+    return {
+        intent: `external_skill_${commandSafeSegment(skillName)}_${scriptNameForIntent(scriptPath)}`,
+        script_path: scriptPath,
+        argv: trustedScriptArgv(skillName, scriptPath),
+        run_policy: 'agent_allowed',
+        network: true,
+        destructive: true,
+        approval_required: ['network_access', 'destructive_command'],
+    };
+}
+function createScriptTrust(projectRoot, target, files, trustScripts, mode) {
+    const scripts = files.filter((file) => file.kind === 'script');
+    if (!trustScripts) {
+        return {
+            requested: false,
+            status: 'not_requested',
+            grants_command_authority: false,
+            command_contract_path: null,
+            include_entry: null,
+            fragment_path: null,
+            intents: [],
+        };
+    }
+    if (scripts.length === 0) {
+        return {
+            requested: true,
+            status: 'no_scripts',
+            grants_command_authority: false,
+            command_contract_path: null,
+            include_entry: null,
+            fragment_path: null,
+            intents: [],
+        };
+    }
+    const fragmentName = `external-skills-${target.skill_name}.toml`;
+    const includeEntry = `commands/${fragmentName}`;
+    const fragmentPath = `${COMMAND_FRAGMENT_DIRECTORY}/${fragmentName}`;
+    const intents = scripts.map((script) => createTrustedScriptIntent(target.skill_name, script.relative_path));
+    const duplicateIntent = findDuplicate(intents.map((intent) => intent.intent));
+    if (duplicateIntent) {
+        throw new Error(`External skill trusted script intents contain a duplicate name: ${duplicateIntent}`);
+    }
+    validateTrustedScriptCommandPlan(projectRoot, includeEntry, fragmentPath, intents);
+    return {
+        requested: true,
+        status: mode === 'install' ? 'trusted' : 'planned',
+        grants_command_authority: mode === 'install',
+        command_contract_path: COMMANDS_CONFIG_PATH,
+        include_entry: includeEntry,
+        fragment_path: fragmentPath,
+        intents,
+    };
+}
+function findDuplicate(values) {
+    const seen = new Set();
+    for (const value of values) {
+        if (seen.has(value)) {
+            return value;
+        }
+        seen.add(value);
+    }
+    return null;
+}
+function validateTrustedScriptCommandPlan(projectRoot, includeEntry, fragmentPath, intents) {
+    const existingIncludes = new Set(readCommandContractIncludePaths(projectRoot).map((entry) => entry.replace(/^\.mustflow\/config\//u, '')));
+    if (existingIncludes.has(includeEntry)) {
+        throw new Error(`External skill trusted script command include already exists: ${includeEntry}`);
+    }
+    if (existsSync(path.join(projectRoot, ...fragmentPath.split('/')))) {
+        throw new Error(`External skill trusted script command fragment already exists: ${fragmentPath}`);
+    }
+    const contract = readCommandContract(projectRoot);
+    for (const intent of intents) {
+        if (Object.prototype.hasOwnProperty.call(contract.intents, intent.intent)) {
+            throw new Error(`External skill trusted script intent already exists in command contract: ${intent.intent}`);
+        }
+    }
+}
+function renderTomlString(value) {
+    return JSON.stringify(value);
+}
+function renderTomlStringArray(values) {
+    return `[${values.map(renderTomlString).join(', ')}]`;
+}
+function renderTrustedScriptCommandFragment(target, source, scriptTrust) {
+    const lines = [
+        `# Generated by mf skill import --trust-scripts for external skill ${JSON.stringify(target.skill_name)}.`,
+        `# Source: ${source.source_url}`,
+        '# These intents execute imported external script files. They are agent-runnable only through mf run,',
+        '# and remain gated by network_access and destructive_command approvals.',
+        '',
+    ];
+    for (const intent of scriptTrust.intents) {
+        lines.push(`[intents.${intent.intent}]`, 'status = "configured"', 'lifecycle = "oneshot"', 'run_policy = "agent_allowed"', `description = ${renderTomlString(`Run trusted external skill script ${intent.script_path} from ${target.skill_name}.`)}`, `argv = ${renderTomlStringArray(intent.argv)}`, 'cwd = "."', 'timeout_seconds = 300', 'stdin = "closed"', 'success_exit_codes = [0]', 'writes = []', 'network = true', 'destructive = true', 'env_policy = "minimal"', '');
+    }
+    return lines.join('\n');
+}
+function updateCommandIncludeText(content, includeEntry) {
+    const normalizedContent = content.replace(/\r\n?/gu, '\n');
+    const lines = normalizedContent.split('\n');
+    const includeLineIndex = lines.findIndex((line) => /^\s*\[include\]\s*$/u.test(line));
+    const includeLine = `  ${renderTomlString(includeEntry)},`;
+    if (includeLineIndex < 0) {
+        const separator = normalizedContent.endsWith('\n') ? '' : '\n';
+        return `${normalizedContent}${separator}\n[include]\nfiles = [\n${includeLine}\n]\n`;
+    }
+    const nextSectionIndex = lines.findIndex((line, index) => index > includeLineIndex && /^\s*\[[^\]]+\]\s*$/u.test(line));
+    const sectionEnd = nextSectionIndex < 0 ? lines.length : nextSectionIndex;
+    const filesLineIndex = lines.findIndex((line, index) => index > includeLineIndex &&
+        index < sectionEnd &&
+        /^\s*files\s*=\s*\[/u.test(line));
+    if (filesLineIndex < 0) {
+        lines.splice(includeLineIndex + 1, 0, 'files = [', includeLine, ']');
+        return lines.join('\n');
+    }
+    if (lines[filesLineIndex].includes(']')) {
+        const existingValues = [...lines[filesLineIndex].matchAll(/"([^"]+)"/gu)].map((match) => match[1]);
+        const values = [...new Set([...existingValues, includeEntry])].sort((left, right) => left.localeCompare(right));
+        lines.splice(filesLineIndex, 1, 'files = [', ...values.map((entry) => `  ${renderTomlString(entry)},`), ']');
+        return lines.join('\n');
+    }
+    const closingLineIndex = lines.findIndex((line, index) => index > filesLineIndex && index < sectionEnd && /^\s*\]\s*$/u.test(line));
+    if (closingLineIndex < 0) {
+        throw new Error(`[include].files in ${COMMANDS_CONFIG_PATH} must be a TOML array`);
+    }
+    lines.splice(closingLineIndex, 0, includeLine);
+    return lines.join('\n');
+}
+function writeTrustedScriptCommandContract(projectRoot, target, source, scriptTrust) {
+    if (scriptTrust.status !== 'trusted' || !scriptTrust.fragment_path || !scriptTrust.include_entry) {
+        return;
+    }
+    const fragmentContent = renderTrustedScriptCommandFragment(target, source, scriptTrust);
+    writeUtf8FileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, ...scriptTrust.fragment_path.split('/')), fragmentContent);
+    const commandsPath = path.join(projectRoot, ...COMMANDS_CONFIG_PATH.split('/'));
+    const commandsContent = readUtf8FileInsideWithoutSymlinks(projectRoot, commandsPath, { maxBytes: 256 * 1024 });
+    writeUtf8FileInsideWithoutSymlinks(projectRoot, commandsPath, updateCommandIncludeText(commandsContent, scriptTrust.include_entry));
+}
+function writeImportedSkillFiles(projectRoot, target, source, files, fileReport, warnings, scriptTrust) {
     const targetPath = path.join(projectRoot, ...target.skill_dir.split('/'));
     const skillPath = path.join(targetPath, 'SKILL.md');
     if (existsSync(targetPath)) {
@@ -384,6 +555,7 @@ function writeImportedSkillFiles(projectRoot, target, source, files, fileReport,
             kind: 'external_skill_source',
             source,
             files: fileReport,
+            script_trust: scriptTrust,
             warnings,
         });
         renameSync(tempPath, targetPath);
@@ -424,14 +596,31 @@ export async function createExternalSkillImportReport(projectRoot, inputUrl, opt
         const source = externalSkillSourceFromParsed(inputUrl, parsed);
         const files = normalizeImportedSkillFiles(sourceFiles);
         const reports = fileReports(files);
+        const scriptTrust = createScriptTrust(projectRoot, target, reports, options.trustScripts === true, mode);
         const warnings = [
-            ...(reports.some((file) => file.kind === 'script')
+            ...(reports.some((file) => file.kind === 'script') && scriptTrust.status !== 'trusted'
                 ? ['Imported scripts are inert reference files; mustflow does not grant command authority for external scripts.']
                 : []),
+            ...(scriptTrust.status === 'trusted'
+                ? ['Imported scripts were trusted by request; mustflow created command-contract intents gated by network and destructive approvals.']
+                : []),
+            ...(scriptTrust.status === 'planned'
+                ? ['Imported scripts would be trusted by request during install; dry-run only reports the command-contract plan.']
+                : []),
             'External skills are untrusted until the agent reads and evaluates the selected SKILL.md.',
         ];
         if (mode === 'install') {
-            writeImportedSkillFiles(projectRoot, target, source, files, reports, warnings);
+            try {
+                writeImportedSkillFiles(projectRoot, target, source, files, reports, warnings, scriptTrust);
+                writeTrustedScriptCommandContract(projectRoot, target, source, scriptTrust);
+            }
+            catch (error) {
+                rmSync(path.join(projectRoot, ...target.skill_dir.split('/')), { recursive: true, force: true });
+                if (scriptTrust.fragment_path) {
+                    rmSync(path.join(projectRoot, ...scriptTrust.fragment_path.split('/')), { force: true });
+                }
+                throw error;
+            }
         }
         return {
             schema_version: '1',
@@ -444,6 +633,7 @@ export async function createExternalSkillImportReport(projectRoot, inputUrl, opt
             source,
             target,
             files: reports,
+            script_trust: scriptTrust,
             warnings,
             issues: [],
             wrote_files: mode === 'install',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.112.14",
+  "version": "2.113.0",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/skill-import-report.schema.json

@@ -43,6 +43,7 @@
       "type": "array",
       "items": { "$ref": "#/$defs/file" }
     },
+    "script_trust": { "$ref": "#/$defs/scriptTrust" },
     "warnings": {
       "type": "array",
       "items": { "type": "string" }
@@ -92,6 +93,80 @@
         "bytes": { "type": "integer", "minimum": 0 },
         "sha256": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
       }
+    },
+    "scriptTrust": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "requested",
+        "status",
+        "grants_command_authority",
+        "command_contract_path",
+        "include_entry",
+        "fragment_path",
+        "intents"
+      ],
+      "properties": {
+        "requested": { "type": "boolean" },
+        "status": { "type": "string", "enum": ["not_requested", "no_scripts", "planned", "trusted"] },
+        "grants_command_authority": { "type": "boolean" },
+        "command_contract_path": {
+          "oneOf": [
+            { "const": ".mustflow/config/commands.toml" },
+            { "type": "null" }
+          ]
+        },
+        "include_entry": {
+          "oneOf": [
+            { "type": "string", "pattern": "^commands/external-skills-[a-z0-9]+(?:-[a-z0-9]+)*\\.toml$" },
+            { "type": "null" }
+          ]
+        },
+        "fragment_path": {
+          "oneOf": [
+            { "type": "string", "pattern": "^\\.mustflow/config/commands/external-skills-[a-z0-9]+(?:-[a-z0-9]+)*\\.toml$" },
+            { "type": "null" }
+          ]
+        },
+        "intents": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/trustedScriptIntent" }
+        }
+      }
+    },
+    "trustedScriptIntent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "intent",
+        "script_path",
+        "argv",
+        "run_policy",
+        "network",
+        "destructive",
+        "approval_required"
+      ],
+      "properties": {
+        "intent": { "type": "string", "pattern": "^external_skill_[A-Za-z0-9_-]+$" },
+        "script_path": { "type": "string", "pattern": "^scripts/.+$" },
+        "argv": {
+          "type": "array",
+          "minItems": 2,
+          "items": { "type": "string" }
+        },
+        "run_policy": { "const": "agent_allowed" },
+        "network": { "const": true },
+        "destructive": { "const": true },
+        "approval_required": {
+          "type": "array",
+          "prefixItems": [
+            { "const": "network_access" },
+            { "const": "destructive_command" }
+          ],
+          "minItems": 2,
+          "maxItems": 2
+        }
+      }
     }
   }
 }

package/templates/default/i18n.toml

@@ -1164,7 +1164,7 @@ translations = {}
 [documents."skill.security-privacy-review"]
 source = "locales/en/.mustflow/skills/security-privacy-review/SKILL.md"
 source_locale = "en"
-revision = 24
+revision = 25
 translations = {}
 
 [documents."skill.security-regression-tests"]

package/templates/default/locales/en/.mustflow/skills/security-privacy-review/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.security-privacy-review
 locale: en
 canonical: true
-revision: 24
+revision: 25
 lifecycle: mustflow-owned
 authority: procedure
 name: security-privacy-review
@@ -200,6 +200,9 @@ Catch security, privacy, and disclosure risks introduced by ordinary code, docum
 35. For pinned action references, distinguish tag objects from the commit that implements the tag. Verify pinned SHAs against the action repository so scanner tooling does not report an imposter or non-member commit.
 36. For dependency scanner alerts, separate production dependency manifests from fixtures, examples, generated test repositories, and intentionally vulnerable samples. Narrow the scan scope before treating fixture-only alerts as product vulnerabilities.
     - For lockfile CVEs, inspect the manifest and lockfile together. Identify the direct parent that keeps the vulnerable transitive package in the graph, update the narrowest direct dependency or override needed to reach the fixed range, and confirm the vulnerable package version no longer appears in the resolved graph before claiming the alert is fixed.
+    - For object merge, defaulting, or configuration merge advisories, trace whether parsed request bodies, database records, uploaded JSON, repository config, or provider payloads can become the first or highest-priority merge input. Treat `__proto__`, `constructor`, and `prototype` keys, inherited polluted values, and default-overwrite behavior as prototype-pollution sinks; prove the patched dependency is resolved or add a regression payload that cannot override trusted defaults.
+    - For ORM or SQL-builder advisories around identifiers, aliases, dynamic sorting, report columns, CTE names, or `.as()`-style APIs, remember that value parameter binding does not protect identifier positions. Runtime input must map through an allowlist of known columns or aliases, and dialect quote delimiters inside identifiers must be escaped by the library before the identifier is wrapped.
+    - For serializer or deserializer advisories, treat sparse arrays, giant indexes, deep objects, cyclic references, and attacker-controlled serialized payloads as allocation and CPU sinks. Bound serialized size, array length or highest index, nesting depth, and parse source trust before claiming a parser-only upgrade removes the availability risk.
     - For advisories involving development tools such as Vite, Vitest UI, browser-mode test servers, Storybook, docs preview, asset servers, or framework dev servers, do not dismiss the issue merely because the package is a devDependency. Check whether scripts, docs, Docker, Codespaces, CI previews, tunnels, or config bind the server to a non-localhost host, widen file-serving roots, disable deny lists, or expose privileged read, write, rerun, snapshot, attachment, or execute APIs.
 37. For deployment settings, check debug mode, sample admin accounts, default credentials, public admin panels, open metrics endpoints, public storage, root container users, HTTPS enforcement, and exposed GraphQL or development consoles.
 38. For runtime and framework security updates, check that supported versions are documented, end-of-life versions are rejected, dependency locks exist where appropriate, security patches can be tested and deployed quickly, and rollback or redeploy can happen without manual dashboard memory. Do not treat a fashionable or high-performance runtime as safe unless the patch path is operationally credible.

package/templates/default/manifest.toml

@@ -1,6 +1,6 @@
 id = "default"
 name = "default"
-version = "2.112.14"
+version = "2.113.0"
 description = "Minimal workflow for LLM agents to read, edit, and verify their work in a repository."
 common_root = "common"
 locales_root = "locales"