wyvrnpm 2.4.1 → 2.9.0

package/src/commands/init.js

@@ -3,8 +3,35 @@
 const fs = require('fs');
 const path = require('path');
 const { defaultManifest, writeManifest } = require('../manifest');
+const { LOCAL_OVERLAY_FILENAME } = require('../conf');
 const log = require('../logger');
 
+// The wyvrn.local.json overlay must never be committed — it is by design
+// per-developer state. init writes a gitignore entry; existing projects
+// get a one-line nudge from install (see install.js) when the file is
+// present but not ignored.
+const GITIGNORE_MARKER_LINE = '# wyvrnpm — per-developer conf overlay (never commit)';
+
+function ensureGitignoreEntry(rootDir) {
+  const gitignorePath = path.join(rootDir, '.gitignore');
+  const desiredLines  = [GITIGNORE_MARKER_LINE, LOCAL_OVERLAY_FILENAME];
+
+  let existing = '';
+  if (fs.existsSync(gitignorePath)) {
+    existing = fs.readFileSync(gitignorePath, 'utf8');
+    const hasEntry = existing.split(/\r?\n/).some((l) => l.trim() === LOCAL_OVERLAY_FILENAME);
+    if (hasEntry) return { action: 'already-present', path: gitignorePath };
+  }
+
+  const needsLeadingNewline = existing.length > 0 && !existing.endsWith('\n');
+  const block = (needsLeadingNewline ? '\n' : '') + desiredLines.join('\n') + '\n';
+  fs.writeFileSync(gitignorePath, existing + block, 'utf8');
+  return {
+    action: existing.length > 0 ? 'appended' : 'created',
+    path:   gitignorePath,
+  };
+}
+
 /**
  * Initialises a new wyvrn.json manifest in the project root.
  * If a manifest already exists the command exits early without overwriting it.
@@ -28,7 +55,16 @@ async function init(argv) {
 
   writeManifest(manifestPath, manifest);
 
+  const gitignore = ensureGitignoreEntry(rootDir);
+  if (gitignore.action === 'created') {
+    log.info(`Created .gitignore at ${gitignore.path} with ${LOCAL_OVERLAY_FILENAME} exclusion`);
+  } else if (gitignore.action === 'appended') {
+    log.info(`Added ${LOCAL_OVERLAY_FILENAME} to ${gitignore.path}`);
+  }
+
   log.success(`Created manifest at ${manifestPath}`);
 }
 
 module.exports = init;
+module.exports.ensureGitignoreEntry  = ensureGitignoreEntry;
+module.exports.GITIGNORE_MARKER_LINE = GITIGNORE_MARKER_LINE;

package/src/commands/install-skill.js

@@ -5,6 +5,7 @@ const os   = require('os');
 const path = require('path');
 const AdmZip = require('adm-zip');
 
+const { assertAllSafeZipEntryNames } = require('../zip-safe');
 const log = require('../logger');
 
 // ---------------------------------------------------------------------------
@@ -72,6 +73,13 @@ function installForClaude({ force, dryRun }) {
   rmrf(destZip);
 
   const zip = new AdmZip(zipPath);
+  // Zip Slip defense-in-depth (EVALUATION.md S2). The shipped .skill zip
+  // is trusted-by-provenance, but validating consistently keeps the
+  // attack surface flat across all extraction call sites.
+  assertAllSafeZipEntryNames(
+    zip.getEntries().map((e) => e.entryName),
+    `${SKILL_NAME}.skill`,
+  );
   zip.extractAllTo(skillsDir, /* overwrite */ true);
   fs.copyFileSync(zipPath, destZip);