release-skill 0.6.3 → 0.7.0

package/src/core/proposal-inbox.mjs

@@ -48,6 +48,11 @@ import {
   POST_PUBLISH_VERIFY_FAILED,
 } from './errors.mjs';
 import { preflightPresetWorkspace, assertPresetWorkspaceExecution } from './presets.mjs';
+import {
+  checkGitRemoteUrl,
+  describeGitRemoteUrlFailure,
+  redactUrlCredentialsIfPresent,
+} from './git-url-policy.mjs';
 
 const execFileAsync = promisify(execFileCb);
 
@@ -60,7 +65,6 @@ const GIT_TIMEOUT_MS = 120_000;
 const TRANSFER_TIMEOUT_MS = 300_000;
 const TMP_PREFIX = 'release-skill-proposal-';
 
-const SAFE_REMOTE_URL_RE = /^(?:https?|file):\/\/.+\.git$/;
 const SAFE_BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 const SHA_RE = /^[a-f0-9]{40}$/;
 
@@ -105,11 +109,12 @@ function hasControlChars(value) {
 }
 
 function assertSafeRemoteUrl(remoteUrl) {
-  if (typeof remoteUrl !== 'string' || !SAFE_REMOTE_URL_RE.test(remoteUrl) || hasControlChars(remoteUrl)) {
+  const verdict = checkGitRemoteUrl(remoteUrl);
+  if (!verdict.ok) {
     throw new ReleaseError(
       GATE_FAILED,
-      'proposal-inbox remoteUrl must be an http(s)/file URL ending in .git',
-      { remoteUrl },
+      `proposal-inbox remoteUrl ${describeGitRemoteUrlFailure(verdict.reason)}`,
+      { reason: verdict.reason },
     );
   }
 }
@@ -240,7 +245,8 @@ export function buildProposalDocument(context) {
  * @returns {string}
  */
 export function buildManualSyncPrompt({ remoteUrl, proposalPath, branch }) {
-  return `manual sync required: review proposal ${proposalPath} in downstream repository ${remoteUrl} (branch ${branch}); suggested action: open a pull request or apply the proposal through the downstream governance workflow`;
+  const safeRemoteUrl = redactUrlCredentialsIfPresent(remoteUrl);
+  return `manual sync required: review proposal ${proposalPath} in downstream repository ${safeRemoteUrl} (branch ${branch}); suggested action: open a pull request or apply the proposal through the downstream governance workflow`;
 }
 
 // ---------------------------------------------------------------------------
@@ -275,7 +281,7 @@ export async function crossCheckPushedCommit(exec, remoteUrl, branch, pushedComm
     throw new ReleaseError(
       POST_PUBLISH_VERIFY_FAILED,
       `post-push cross-check failed: remote branch ${branch} is at ${observed ?? '<missing>'}, which disagrees with the pushed commit ${pushedCommit}`,
-      { remoteUrl, branch, pushedCommit, observed },
+      { remoteUrl: redactUrlCredentialsIfPresent(remoteUrl), branch, pushedCommit, observed },
     );
   }
   return observed;
@@ -333,12 +339,13 @@ export async function deliverProposalGitPush(params) {
       });
     } catch (error) {
       const classification = classifyNetFailure(stderrText(error));
+      const safeRemoteUrl = redactUrlCredentialsIfPresent(remoteUrl);
       throw new ReleaseError(
         classification === 'auth' ? REMOTE_CONFLICT : REMOTE_UNAVAILABLE,
         classification === 'auth'
-          ? `proposal-inbox remote refused authentication for ${remoteUrl}; the host keychain credential is reused and never prompted, read, or retried`
-          : `cannot reach proposal-inbox remote ${remoteUrl} — start VPN / check network; delivery fails closed and never retries with credentials`,
-        { remoteUrl, stderrTail: stderrTail(error) },
+          ? `proposal-inbox remote refused authentication for ${safeRemoteUrl}; the host keychain credential is reused and never prompted, read, or retried`
+          : `cannot reach proposal-inbox remote ${safeRemoteUrl} — start VPN / check network; delivery fails closed and never retries with credentials`,
+        { remoteUrl: safeRemoteUrl, stderrTail: stderrTail(error) },
       );
     }
 
@@ -375,8 +382,8 @@ export async function deliverProposalGitPush(params) {
       }
       throw new ReleaseError(
         REMOTE_CONFLICT,
-        `proposal ${proposalPath} already exists in ${remoteUrl} with different content; overwriting a downstream proposal requires a human decision`,
-        { remoteUrl, proposalPath },
+        `proposal ${proposalPath} already exists in ${redactUrlCredentialsIfPresent(remoteUrl)} with different content; overwriting a downstream proposal requires a human decision`,
+        { remoteUrl: redactUrlCredentialsIfPresent(remoteUrl), proposalPath },
       );
     }
 
@@ -401,12 +408,13 @@ export async function deliverProposalGitPush(params) {
       });
     } catch (error) {
       const classification = classifyNetFailure(stderrText(error));
+      const safeRemoteUrl = redactUrlCredentialsIfPresent(remoteUrl);
       throw new ReleaseError(
         classification === 'auth' ? REMOTE_CONFLICT : REMOTE_UNAVAILABLE,
         classification === 'auth'
-          ? `proposal-inbox push refused authentication for ${remoteUrl}; the host keychain credential is reused and never prompted, read, or retried`
-          : `proposal-inbox push to ${remoteUrl} failed — start VPN / check network; delivery fails closed and never retries with credentials`,
-        { remoteUrl, branch, stderrTail: stderrTail(error) },
+          ? `proposal-inbox push refused authentication for ${safeRemoteUrl}; the host keychain credential is reused and never prompted, read, or retried`
+          : `proposal-inbox push to ${safeRemoteUrl} failed — start VPN / check network; delivery fails closed and never retries with credentials`,
+        { remoteUrl: safeRemoteUrl, branch, stderrTail: stderrTail(error) },
       );
     }
 
@@ -581,29 +589,37 @@ export async function deliverProposalLocalFile(params) {
  * deliver it into the local checkout (never pushed). Shared by the
  * distribute saga and the postVerify run.
  *
+ * F-04: `releaseWorkspaceRoot` is the real project root — the ONLY
+ * resolution basis for `config.target.workspace` and the release-workspace
+ * write exclusion. The detached execution worktree is never passed here.
+ *
  * @param {object} params
  * @param {object} params.hook - Declared hook entry (config.target bound).
  * @param {object} params.contextProjection - The §2.3 context projection.
  * @param {object} params.commitIdentity - Frozen commitIdentity.
- * @param {string} params.root - Release workspace root (workspace resolution).
+ * @param {string} params.releaseWorkspaceRoot - Release workspace root
+ *   (workspace resolution + release-workspace write exclusion).
  * @param {Function} [params.exec] - Injectable git exec (tests).
  * @returns {Promise<{ status: string, observation: object, proposalPath: string, manualSyncPrompt: string }>}
  */
 export async function executeProposalInboxLocalFileHook(params) {
-  const { hook, contextProjection, commitIdentity, root, exec } = params ?? {};
+  const { hook, contextProjection, commitIdentity, releaseWorkspaceRoot, exec } = params ?? {};
   const target = hook?.config?.target;
   if (!target || typeof target.workspace !== 'string' || typeof target.branch !== 'string') {
     throw new ReleaseError(GATE_FAILED, 'proposal-inbox local-file requires config.target.workspace and config.target.branch');
   }
-  if (typeof root !== 'string' || root.length === 0) {
-    throw new ReleaseError(GATE_FAILED, 'proposal-inbox local-file requires the release workspace root');
+  if (typeof releaseWorkspaceRoot !== 'string' || releaseWorkspaceRoot.length === 0) {
+    throw new ReleaseError(
+      GATE_FAILED,
+      'proposal-inbox local-file requires the release workspace root (releaseWorkspaceRoot); the detached execution worktree is never the release workspace',
+    );
   }
 
   // §2.6 workspace execution checks: preflight realpath, TOCTOU re-check,
   // release-workspace/runtime-directory exclusion — all before any write.
-  const preflight = await preflightPresetWorkspace(target.workspace, { root });
+  const preflight = await preflightPresetWorkspace(target.workspace, { releaseWorkspaceRoot });
   const execution = await assertPresetWorkspaceExecution(target.workspace, {
-    root,
+    releaseWorkspaceRoot,
     preflightRealpath: preflight.realpath,
   });
 

package/src/core/redact.mjs

@@ -23,16 +23,26 @@
  *   sha256 digests, stable field names, and fragment-anchored JSON pointers
  *   (#/required) are likewise preserved verbatim. Any other two-or-more
  *   segment '/'-led token stays redacted as the fail-closed default.
+ * - URL userinfo (F-05): strings additionally pass through the Git URL
+ *   policy boundary (core/git-url-policy.mjs), which strips embedded
+ *   username/password from any credential-bearing URL span and delegates the
+ *   actual redaction to the Foundation redactor. Credential-free URLs and
+ *   all non-URL text pass through unchanged, so error prose keeps its
+ *   diagnostic value.
  * - Arrays and plain objects: recursed; every string value is redacted.
  * - Everything else (numbers, booleans, null, undefined, and non-plain
  *   objects such as Buffers/Dates/Maps) is returned untouched.
  *
- * Pure and zero-dependency: no imports from src/artifacts/* (no cycles, no
- * cross-layer coupling); node built-ins only (none required).
+ * Pure; no imports from src/artifacts/* (no cycles, no cross-layer
+ * coupling). The only local dependency is the release-domain Git URL policy
+ * boundary, which itself only consumes the exact released Foundation
+ * package (no top-level await anywhere in this module graph).
  *
  * @module core/redact
  */
 
+import { redactEmbeddedUrlCredentials } from './git-url-policy.mjs';
+
 /** Stable placeholder substituted for every redacted absolute path. */
 export const REDACTED_PATH_PLACEHOLDER = '<redacted-path>';
 
@@ -160,7 +170,7 @@ function isUncPath(token) {
  * @returns {string}
  */
 function redactString(input) {
-  return input.replace(PATH_TOKEN_RE, (raw) => {
+  const pathRedacted = input.replace(PATH_TOKEN_RE, (raw) => {
     const match = TRAILING_PUNCT_RE.exec(raw);
     const core = match[1];
     const tail = match[2];
@@ -169,6 +179,9 @@ function redactString(input) {
     }
     return raw;
   });
+  // F-05: strip embedded URL credentials (delegates to the Foundation
+  // redactor through the Git URL policy boundary).
+  return redactEmbeddedUrlCredentials(pathRedacted);
 }
 
 /**

package/src/producers/build-adapters.mjs

@@ -394,8 +394,16 @@ function renderSkillForPlatform(content, platformName) {
 /**
  * Collect binary file paths from a source directory recursively.
  * Returns array of relative paths.
+ *
+ * `excludedTopDirs` names top-level directories that are skipped entirely.
+ * It only exists for subtrees that are already excluded from the shipped
+ * output (see the native/safe-write build/ exclusion below): their contents
+ * are never read and never shipped, so descending into them would only let
+ * transient, regeneratable artifacts (node-gyp creates a
+ * build/node_gyp_bins/python3 symlink while a rebuild is running) fail the
+ * collection without protecting any shipped byte.
  */
-async function collectBinaryFiles(baseDir, physicalRoot, relPrefix = '') {
+async function collectBinaryFiles(baseDir, physicalRoot, relPrefix = '', excludedTopDirs) {
   const results = [];
   const physicalDir = await assertTrustedDirectory(
     baseDir,
@@ -409,6 +417,7 @@ async function collectBinaryFiles(baseDir, physicalRoot, relPrefix = '') {
       throw new Error(`SECURITY: symlink in resource tree: ${relPath}`);
     }
     if (entry.isDirectory()) {
+      if (relPrefix === '' && excludedTopDirs?.has(entry.name)) continue;
       results.push(...await collectBinaryFiles(join(physicalDir, entry.name), physicalRoot, relPath));
     } else if (entry.isFile()) {
       results.push({ relPath, sourcePath: join(physicalDir, entry.name) });
@@ -495,23 +504,24 @@ async function generateAdapterFiles(platform, skills, templateJson, root, market
   // Copy bin/ entry point and bundle (text files). The self-contained
   // bundle ships runtime sidecars next to it (JSON resources read via
   // new URL(<rel>, import.meta.url) by inlined Foundation modules, e.g.
-  // error-codes.json); enumerate the directory so every sidecar is
-  // replicated deterministically. The source CLI (release-skill-cli.mjs)
-  // is never shipped into adapters. The wrapper and the bundle are
-  // required entries: a missing one fails closed before any write.
-  const binFiles = (await readdir(join(root, 'bin')))
-    .filter((name) => name !== 'release-skill-cli.mjs')
-    .sort();
+  // error-codes.json; since F-06/T6 the inlined Engineering Kit also
+  // carries license-text sidecars under bin/license-texts/); enumerate
+  // the directory recursively so every sidecar is replicated
+  // deterministically. The source CLI (release-skill-cli.mjs) is never
+  // shipped into adapters. The wrapper and the bundle are required
+  // entries: a missing one fails closed before any write.
+  const binFileEntries = await collectBinaryFiles(join(root, 'bin'), root);
+  const binRelPaths = binFileEntries.map(({ relPath }) => relPath);
   for (const required of ['release-skill.mjs', 'release-skill.bundle.mjs']) {
-    if (!binFiles.includes(required)) {
+    if (!binRelPaths.includes(required)) {
       throw new Error(`SECURITY: required bundle entry is missing: bin/${required}`);
     }
   }
-  for (const name of binFiles) {
-    const srcPath = join(root, 'bin', name);
-    const content = await readTrustedFile(srcPath, root, `bin/${name}`);
+  for (const { relPath: rel, sourcePath } of binFileEntries) {
+    if (rel === 'release-skill-cli.mjs') continue;
+    const content = await readTrustedFile(sourcePath, root, `bin/${rel}`);
     files.push({
-      relPath: join('bin', name),
+      relPath: join('bin', rel),
       content,
       isBinary: false,
     });
@@ -537,8 +547,12 @@ async function generateAdapterFiles(platform, skills, templateJson, root, market
   // Copy native/safe-write/ directory (prebuilds.json, prebuilds/, src/).
   // Exclude build/ — it contains platform-specific build artifacts that are
   // regenerated by node-gyp and should not be in the published adapter.
+  // Collection never descends into build/: it is output-excluded anyway, and
+  // a concurrent node-gyp rebuild transiently places symlinked helper bins
+  // there (node_gyp_bins/python3) that must not fail the derived-artifact
+  // gates.
   const nativeBase = join(root, 'native', 'safe-write');
-  const nativeFiles = await collectBinaryFiles(nativeBase, root);
+  const nativeFiles = await collectBinaryFiles(nativeBase, root, '', new Set(['build']));
   if (!nativeFiles.some(({ relPath }) => relPath === 'prebuilds.json')) {
     throw new Error('SECURITY: required native resource is missing: native/safe-write/prebuilds.json');
   }