boost-skill-cli 1.0.188__tar.gz → 1.0.189__tar.gz

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.189}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.188
+Version: 1.0.189
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.189}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.188'
-__version_tuple__ = version_tuple = (1, 0, 188)
+__version__ = version = '1.0.189'
+__version_tuple__ = version_tuple = (1, 0, 189)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.189}/boost_cli/core/scopes.py

@@ -203,3 +203,27 @@ def contains(base, path) -> bool:
         return os.path.commonpath([str(base_r), str(path_r)]) == str(base_r)
     except (OSError, ValueError):
         return False
+
+
+def ensure_in_base(base, path):
+    """Raise if ``path`` would resolve outside ``base`` — the guard before any
+    project-scope WRITE, the mirror of :func:`contains` before every delete.
+
+    A project destination is built from directory names committed in the repo
+    (``.claude/skills`` and its per-agent siblings). A hostile repo can ship one
+    of those as a symlink pointing outside the tree — at ``~/.ssh``, say — and
+    the ``mkdir(parents=True)`` + ``os.replace`` that materializes a skill would
+    then run on the far side, escaping the project entirely. The squatter check
+    (refuse to overwrite a path boost did not create) does not stop this:
+    dropping a *new* name like ``authorized_keys`` collides with nothing, and
+    ``--force`` waives it regardless. ``contains`` resolves symlinks on both
+    ends, so re-deriving containment here — before the write, independent of
+    existence or force — is the boundary that actually holds. Returns ``path``
+    so a caller can wrap the target inline.
+    """
+    if not contains(base, path):
+        raise BoostError(
+            "refusing to install %s: it resolves outside this project" % path,
+            hint="a directory such as .claude/skills in this repo is a symlink "
+                 "pointing outside it — remove or replace it, then reinstall")
+    return Path(path)

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.189}/boost_cli/core/store.py

@@ -281,6 +281,15 @@ def _install_project_skill(entry: dict, force: bool = False,
                for agent, skills_dir in agents.enabled_agents().items()
                if not only_agents or agent in only_agents]
 
+    # Refuse to write through a symlink that leaves the repo. An agent dir like
+    # ``.claude/skills`` is committed, so a hostile clone can ship it as a
+    # symlink to ``~/.ssh`` and the copy below would land on the far side.
+    # Checked for every target up front — before existence, force, or any write
+    # — so a single escaping dir aborts the whole install rather than writing
+    # part of it outside the project first.
+    for _agent, dest in targets:
+        scopes.ensure_in_base(resolved_base, dest)
+
     # Refuse to clobber a directory boost did not put there. In user scope the
     # store is boost's alone, but here the destination is inside someone's repo
     # — a same-named hand-written skill is a real possibility, and overwriting
@@ -492,6 +501,11 @@ def _install_rule(entry: dict, force: bool = False,
         if only_agents and agent not in only_agents:
             continue
         mode, path = rules.rule_target(agent, skills_dir, name, base=resolved_base)
+        # Project scope writes into the repo, so a committed agent dir could be
+        # a symlink escaping it (see scopes.ensure_in_base). User scope writes
+        # into the user's own ~/.claude, which they control — nothing to guard.
+        if resolved_base is not None:
+            scopes.ensure_in_base(resolved_base, path)
         path.parent.mkdir(parents=True, exist_ok=True)
         if mode == rules.MODE_CLAUDE:
             current = path.read_text(encoding="utf-8") if path.exists() else ""
@@ -591,6 +605,11 @@ def _install_workflow(entry: dict, force: bool = False,
         if only_agents and agent not in only_agents:
             continue
         path = workflows.workflow_target(skills_dir, slot, name, base=resolved_base)
+        # Project scope writes into the repo; a committed agent dir could be a
+        # symlink escaping it (see scopes.ensure_in_base). User scope writes into
+        # the user's own ~/.claude, which they control — nothing to guard.
+        if resolved_base is not None:
+            scopes.ensure_in_base(resolved_base, path)
         path.parent.mkdir(parents=True, exist_ok=True)
         util.atomic_write_text(path, raw)
         materializations.append({"agent": agent, "slot": slot, "path": str(path)})

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.189}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.188
+Version: 1.0.189
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.189}/boost_skill_cli.egg-info/SOURCES.txt

@@ -184,6 +184,7 @@ docs/roadmap/items/performance-regression-gate-pytest-benchmark.md
 docs/roadmap/items/post-deploy-smoke-headless-load-check.md
 docs/roadmap/items/pre-release-python-canary-3-14t-free-threaded.md
 docs/roadmap/items/project-scope-across-every-command.md
+docs/roadmap/items/project-scope-symlink-escape-on-write.md
 docs/roadmap/items/promote-nav-footer-into-the-shared-style-system.md
 docs/roadmap/items/prompt-injection-scanning-of-skill-markdown.md
 docs/roadmap/items/property-based-tests-hypothesis-on-the-parsers.md

boost_skill_cli-1.0.189/docs/roadmap/items/project-scope-symlink-escape-on-write.md

@@ -0,0 +1,33 @@
+---
+id: project-scope-symlink-escape-on-write
+board: code
+section: trust
+status: shipped
+category: Security · Integrity
+complexity: S
+impact: High
+wow: 4
+note: hostile repo could write outside itself
+order: 6
+owner: loop/writeguard
+pr: 213
+title: Project scope — refuse to write through an escaping symlink
+---
+Workspace scope (<a href="https://github.com/jonnyeclectic/boost/pull/212">#212</a>)
+           guarded the delete side — <code>uninstall --local</code> re-derives every
+           recorded path and refuses one that resolves outside the repo — but not
+           the <em>write</em> side. A project install builds its destination from
+           agent-dir names committed in the repo
+           (<code>.claude/skills</code> and its per-agent siblings), and a hostile
+           clone can ship one of those as a <strong>symlink pointing outside the
+           tree</strong> — at <code>~/.ssh</code>, say. Cloning that repo and
+           running <code>boost install &lt;skill&gt; --local</code> then writes on the
+           far side: confirmed by reproduction, a skill directory landed in a
+           sibling of the repo instead of inside it. The squatter check does not
+           stop it (a brand-new leaf name like <code>authorized_keys</code>
+           collides with nothing, and <code>--force</code> waives it anyway).
+           <code>scopes.ensure_in_base</code> is the write-side mirror of the
+           delete guard: it re-derives containment through symlinks for every
+           target up front, so one escaping directory aborts the whole install
+           before anything is written. Covers all three project-scope kinds —
+           skill, rule and workflow.

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.189}/docs/roadmap.html

@@ -118,7 +118,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>109</b><span>Loop finds</span></div>
+      <div class="stat"><b>110</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -2082,6 +2082,35 @@ paths.</p>
         </div>
       </article>
 
+      <article class="cap rcard">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Integrity</span></div>
+        <h3>Project scope — refuse to write through an escaping symlink</h3>
+        <p>Workspace scope (<a href="https://github.com/jonnyeclectic/boost/pull/212">#212</a>)
+           guarded the delete side — <code>uninstall --local</code> re-derives every
+           recorded path and refuses one that resolves outside the repo — but not
+           the <em>write</em> side. A project install builds its destination from
+           agent-dir names committed in the repo
+           (<code>.claude/skills</code> and its per-agent siblings), and a hostile
+           clone can ship one of those as a <strong>symlink pointing outside the
+           tree</strong> — at <code>~/.ssh</code>, say. Cloning that repo and
+           running <code>boost install &lt;skill&gt; --local</code> then writes on the
+           far side: confirmed by reproduction, a skill directory landed in a
+           sibling of the repo instead of inside it. The squatter check does not
+           stop it (a brand-new leaf name like <code>authorized_keys</code>
+           collides with nothing, and <code>--force</code> waives it anyway).
+           <code>scopes.ensure_in_base</code> is the write-side mirror of the
+           delete guard: it re-derives containment through symlinks for every
+           target up front, so one escaping directory aborts the whole install
+           before anything is written. Covers all three project-scope kinds —
+           skill, rule and workflow.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">hostile repo could write outside itself</span>
+        </div>
+      </article>
+
       <article class="cap rcard">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Secrets</span></div>
         <h3>Secret &amp; PII scanning of installed skills</h3>

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.189}/tests/unit/test_scopes.py

@@ -284,3 +284,41 @@ def test_contains_fails_closed_when_resolution_errors(tmp_path, monkeypatch):
 
     monkeypatch.setattr(scopes, "Path", ExplodingPath)
     assert scopes.contains(tmp_path, tmp_path / "x") is False
+
+
+# ── ensure_in_base: the write guard ──────────────────────────────────────
+
+def test_ensure_in_base_returns_the_path_when_inside(tmp_path):
+    dest = tmp_path / ".claude" / "skills" / "x"
+    assert scopes.ensure_in_base(tmp_path, dest) == Path(dest)
+
+
+def test_ensure_in_base_raises_on_a_plain_escape(tmp_path):
+    (tmp_path / "repo").mkdir()
+    with pytest.raises(BoostError) as err:
+        scopes.ensure_in_base(tmp_path / "repo", tmp_path / "elsewhere" / "x")
+    assert "outside this project" in err.value.message
+
+
+def test_ensure_in_base_raises_when_a_symlinked_dir_escapes(tmp_path):
+    """The write-side attack contains() is reused for: an agent dir committed as
+    a symlink pointing outside the repo, targeting a NEW leaf that does not yet
+    exist — so nothing but the containment check can catch it."""
+    repo = tmp_path / "repo"
+    (repo / ".git").mkdir(parents=True)
+    (repo / ".claude").mkdir()
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    (repo / ".claude" / "skills").symlink_to(outside, target_is_directory=True)
+    # repo/.claude/skills/authorized_keys resolves to outside/authorized_keys.
+    dest = repo / ".claude" / "skills" / "authorized_keys"
+    with pytest.raises(BoostError):
+        scopes.ensure_in_base(repo, dest)
+
+
+def test_ensure_in_base_allows_a_real_nested_dir(tmp_path):
+    # A legitimate project dir, even several levels deep, must pass untouched.
+    repo = tmp_path / "repo"
+    (repo / ".claude" / "skills").mkdir(parents=True)
+    dest = repo / ".claude" / "skills" / "ok"
+    assert scopes.ensure_in_base(repo, dest) == Path(dest)

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.189}/tests/unit/test_store.py

@@ -860,6 +860,31 @@ class TestProjectSkills:
         store.install(entry, scope="project", base=str(repo), force=True)
         assert projectlock.get_skill(repo, "brainstorming")["installed_at"] == first
 
+    def test_symlinked_agent_dir_cannot_escape_the_repo(self, entry, tmp_path):
+        """A committed ``.claude/skills`` symlink pointing outside the repo must
+        not let the install write on the far side.
+
+        The attack: a hostile clone ships an agent dir as a symlink to, say,
+        ``~/.ssh``; ``_copy_skill`` would then ``mkdir``/``os.replace`` through
+        it and land outside the project. Guarded by ``scopes.ensure_in_base``
+        before any write. Uses a fresh skill name so the squatter check (which
+        only fires on an existing path) is not what does the blocking.
+        """
+        repo = self._repo(tmp_path)
+        outside = tmp_path / "outside"          # stands in for ~/.ssh
+        outside.mkdir()
+        (repo / ".claude").mkdir()
+        (repo / ".claude" / "skills").symlink_to(outside, target_is_directory=True)
+
+        with pytest.raises(BoostError) as err:
+            store.install(entry, scope="project", base=str(repo))
+        assert "outside this project" in err.value.message
+        # Nothing written through the symlink, and the all-or-nothing pre-check
+        # means the other agents' in-repo dirs stay untouched too.
+        assert list(outside.iterdir()) == []
+        assert not (repo / ".windsurf" / "skills" / "brainstorming").exists()
+        assert not (repo / ".cursor" / "skills" / "brainstorming").exists()
+
     def test_policy_blocks_a_project_install_too(self, entry, tmp_path):
         # Vendoring into a repo is not an escape hatch around policy.
         policy.save({"blocked_skills": ["brainstorming"]})