super-skill-cli 0.10.0__tar.gz → 0.11.1__tar.gz

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "super-skill: personal Agent-Skill package manager (versioned registry, rollback, mining).",
-    "version": "0.10.0"
+    "version": "0.11.1"
   },
   "plugins": [
     {
       "name": "super-skill",
       "source": "./",
       "description": "Git-backed versioned registry for your Claude Code skills: seed import, explain/provenance, one-command rollback, integrity doctor, and opportunity mining. Wraps the `super-skill` CLI (pip/uv installable as super-skill-cli).",
-      "version": "0.10.0",
+      "version": "0.11.1",
       "category": "development"
     }
   ]

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "super-skill",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Personal Agent-Skill package manager: a git-backed, versioned registry for your Claude Code skills with seed import, provenance/explain, one-command rollback, integrity doctor, and opportunity mining from captured sessions.",
   "author": {
     "name": "sdsrss",

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/CHANGELOG.md

@@ -3,6 +3,96 @@
 All notable changes to this project are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/); this project uses semantic versioning.
 
+## [0.11.1] - 2026-07-12
+
+Follow-up patch from a code review of 0.11.0. Fixes a **Critical ReDoS regression
+the 0.11.0 redaction hardening introduced** plus four gaps. Backward-compatible;
+upgrade recommended over 0.11.0 (`pip install -U super-skill-cli`).
+
+### Security
+- **Fix ReDoS in the redaction `assigned_secret` rule** (regression in 0.11.0) —
+  the broadened rule used unbounded `[A-Za-z0-9_]*` runs, so underscore-heavy
+  input (snake_case blobs, env dumps) backtracked catastrophically: a ~6 KB
+  payload took ~21 s. Since redaction runs on every captured event, a normal
+  hook payload could hang `super-skill capture` (worse than the crash 0.11.0 was
+  hardening). Runs are now bounded (`{0,64}`); the same payload processes in
+  ~18 ms and secrets still redact.
+- **`sk-proj-`/`sk-svcacct-` OpenAI keys are now fully redacted** — the body may
+  contain `_`/`-`, and the previous rule stopped at the first such char, leaking
+  the tail.
+- **A secret in a keyword-named frontmatter field is now caught** — the gate and
+  eval-lite serialized frontmatter with JSON, which quoted the key (`"token":`)
+  and broke the `keyword: value` secret pattern; they now use YAML, preserving
+  adjacency.
+- **The gate folds uppercase homoglyphs** — the confusables map was lowercase
+  only, so `СURL … | bash` (uppercase Cyrillic) slipped through; normalization
+  now casefolds first.
+
+### Fixed
+- **`capture` survives deeply-nested JSON** — `json.loads` raises `RecursionError`
+  (a `RuntimeError`, not `JSONDecodeError`) on very deep input; the parse guard
+  now exits 0 on any error (NFR-3).
+- The WAL append loops on short writes so a very large line can't be truncated.
+
+## [0.11.0] - 2026-07-12
+
+Security & reliability hardening from a full production-readiness audit. All fixes
+are backward-compatible; defaults unchanged. **Recommended upgrade** if you wire
+live capture via `hooks-config` — the capture/redaction path had secret-leak and
+crash-safety gaps that this release closes.
+
+**Migration**: none required. An existing `mine_state.json` from 0.10.0 is auto-
+handled (the watermark format changed to a session-id set; an old file reads as
+"nothing mined" and self-heals on the next `mine`). **Revert path**: pin the prior
+release with `pip install super-skill-cli==0.10.0`.
+
+### Security
+- **Redaction no longer leaks underscore-delimited env-var secrets** — `DB_PASSWORD=…`,
+  `AWS_SECRET_ACCESS_KEY=…`, `SECRET_KEY=…` etc. were written verbatim to the WAL
+  because the keyword rule anchored on `\b` (an underscore is a word char). The
+  same `redact_text` feeds the eval-lite secret gate, so this closed a leak in
+  both paths at once.
+- **Redaction now matches current key formats** — OpenAI `sk-proj-`/`sk-svcacct-`,
+  Stripe `sk_live_`/`sk_test_`, GitHub fine-grained PATs `github_pat_`, and GCP
+  `AIza…` keys were previously unmatched.
+- **The instruction-layer gate + eval-lite scan the full frontmatter**, not just
+  `description` + body — an injection or secret in any other frontmatter field
+  (e.g. `instructions:`, `metadata:`) previously shipped to the host unscanned.
+- **The gate normalizes cheap obfuscation** (NFKC + zero-width strip + common
+  Cyrillic/Greek homoglyph fold) so `с​url … | bash` and homoglyph variants no
+  longer slip a shell pipe past the ASCII rules.
+- **The capture WAL and mine watermark are gitignored** — `events/` and
+  `mine_state.json` are no longer swept into the registry's audit history by
+  `git add -A`, keeping (redacted-but-private) session content out of the repo.
+- **Redaction depth is capped** so a pathologically nested payload can't
+  `RecursionError`; the over-deep subtree is dropped rather than leaked.
+
+### Fixed
+- **`capture` never fails the host session (NFR-3)** — non-object JSON on stdin
+  and any WAL write error are now swallowed with exit 0; previously a list/scalar
+  payload raised and exited 1.
+- **The WAL tolerates a torn/partial line** — a hook killed mid-append no longer
+  bricks every reader (`status`/`mine`/`count`); the bad line is skipped.
+- **Concurrent captures no longer corrupt the WAL** — each event is one atomic
+  `O_APPEND` write instead of a buffered write that could interleave across
+  processes.
+- **Registry/candidate/watermark writes are atomic** (temp + `os.replace`), and a
+  corrupt `meta.json`/`candidate.json` surfaces as a typed error instead of a raw
+  traceback that crashed `status`/`list`/`doctor`.
+- **`approve` is crash-idempotent** — a crash between the registry commit and
+  marking the candidate approved no longer double-promotes on re-run.
+- **`seed` skips a skill whose frontmatter `name` ≠ its directory name**, so two
+  host dirs sharing a name can no longer collapse into one version chain.
+- **The `mine` reminder survives WAL TTL pruning** — the watermark tracks mined
+  session ids, so new sessions still count as "unmined" after old ones roll off.
+- **`init` rebuilds a missing/stale `.gitignore`** even when `.git` already exists.
+
+### Changed
+- Docs `02`/`03`/`04` bumped to v1.4 with WS-vs-target implementation notes
+  (registry-as-source distribution, WS entity/eval-lite subsets) for doc↔code
+  consistency. Test suite grew 127 → 159; `gate.py` and `redact.py` at 100%
+  line coverage.
+
 ## [0.10.0] - 2026-07-12
 
 ### Added

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: super-skill-cli
-Version: 0.10.0
+Version: 0.11.1
 Summary: Personal Agent-Skill package manager: versioned registry, seed import, explain, rollback (M0+WS scope).
 Project-URL: Homepage, https://github.com/sdsrss/super-skill
 Project-URL: Repository, https://github.com/sdsrss/super-skill

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "super-skill-cli"
-version = "0.10.0"
+version = "0.11.1"
 description = "Personal Agent-Skill package manager: versioned registry, seed import, explain, rollback (M0+WS scope)."
 readme = "README.md"
 requires-python = ">=3.12"

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/super_skill/candidate.py

@@ -10,11 +10,12 @@ candidate -> gate (human approve) -> promote, never bypassed.
 
 from __future__ import annotations
 
+import os
 import re
 from datetime import datetime
 from pathlib import Path
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
 
 from . import config
 from .evallite import EvalError, eval_lite
@@ -95,7 +96,10 @@ class CandidateStore:
         meta = self._cdir(cand_id) / "candidate.json"
         if not meta.exists():
             return None
-        return Candidate.model_validate_json(meta.read_text(encoding="utf-8"))
+        try:
+            return Candidate.model_validate_json(meta.read_text(encoding="utf-8"))
+        except ValidationError as e:
+            raise CandidateError(f"{cand_id}: corrupt candidate.json ({e})") from e
 
     def list(self) -> list[Candidate]:
         if not self.dir.exists():
@@ -116,9 +120,11 @@ class CandidateStore:
     def save(self, cand: Candidate) -> None:
         cdir = self._cdir(cand.candidate_id)
         cdir.mkdir(parents=True, exist_ok=True)
-        (cdir / "candidate.json").write_text(
-            cand.model_dump_json(indent=2), encoding="utf-8"
-        )
+        # Atomic write so a crash can't leave a truncated candidate.json (M12).
+        p = cdir / "candidate.json"
+        tmp = p.with_suffix(".json.tmp")
+        tmp.write_text(cand.model_dump_json(indent=2), encoding="utf-8")
+        os.replace(tmp, p)
 
 
 def draft_from_families(

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/super_skill/capture.py

@@ -7,10 +7,13 @@ events are TTL-bounded (FR-CAP-6); structured products live elsewhere.
 
 from __future__ import annotations
 
+import os
 import uuid
 from collections.abc import Iterator
 from pathlib import Path
 
+from pydantic import ValidationError
+
 from . import config
 from .redact import redact_payload, redact_text
 from .schemas import CaptureEvent, EventType
@@ -53,8 +56,17 @@ class EventLog:
         day = event.timestamp.strftime("%Y-%m-%d")
         out = self.events_dir / day / "events.jsonl"
         out.parent.mkdir(parents=True, exist_ok=True)
-        with out.open("a", encoding="utf-8") as f:
-            f.write(event.model_dump_json() + "\n")
+        # One atomic append per event: a single O_APPEND os.write, not a buffered
+        # writer that can split a large line into multiple write() calls and let
+        # two concurrent captures interleave into a corrupt line (H4).
+        data = (event.model_dump_json() + "\n").encode("utf-8")
+        fd = os.open(out, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o644)
+        try:
+            # Loop on short writes so a very large line isn't silently truncated.
+            while data:
+                data = data[os.write(fd, data):]
+        finally:
+            os.close(fd)
         return event
 
     def iter_events(self) -> Iterator[CaptureEvent]:
@@ -66,11 +78,20 @@ class EventLog:
                 continue
             for line in wal.read_text(encoding="utf-8").splitlines():
                 line = line.strip()
-                if line:
+                if not line:
+                    continue
+                try:
                     yield CaptureEvent.model_validate_json(line)
+                except ValidationError:
+                    # A killed hook can leave a torn final line; one bad record
+                    # must not brick every reader (status/mine/count). Skip it.
+                    continue
 
     def count(self) -> int:
         return sum(1 for _ in self.iter_events())
 
+    def session_ids(self) -> set[str]:
+        return {ev.session_id for ev in self.iter_events()}
+
     def distinct_sessions(self) -> int:
-        return len({ev.session_id for ev in self.iter_events()})
+        return len(self.session_ids())

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/super_skill/cli.py

@@ -97,37 +97,47 @@ def capture(
     try:
         raw = sys.stdin.read()
         data = json.loads(raw) if raw.strip() else {}
-    except (json.JSONDecodeError, OSError):
+    except Exception:
+        # NFR-3: never fail the session. Covers JSONDecodeError, OSError, and
+        # RecursionError (deeply-nested JSON — a RuntimeError, not JSONDecodeError).
         raise typer.Exit(0) from None
-    name = event_type or str(data.get("hook_event_name", ""))
+    # NFR-3: the hook must NEVER fail the host session. Everything past here —
+    # non-dict JSON (data.get would raise), an unknown event type, or any WAL
+    # write error — is swallowed and exits 0. Capture-never-fails beats
+    # capture-complete.
     try:
-        etype = EventType(name)
-    except ValueError:
+        if not isinstance(data, dict):
+            raise typer.Exit(0)
+        name = event_type or str(data.get("hook_event_name", ""))
+        etype = EventType(name)  # ValueError on unknown type
+        session_id = str(data.get("session_id", "unknown"))
+        project_id = data.get("cwd")
+        EventLog().append(
+            etype, session_id, data, project_id=str(project_id) if project_id else None
+        )
+    except typer.Exit:
+        raise
+    except Exception:
         raise typer.Exit(0) from None
-    session_id = str(data.get("session_id", "unknown"))
-    project_id = data.get("cwd")
-    EventLog().append(
-        etype, session_id, data, project_id=str(project_id) if project_id else None
-    )
 
 
 @app.command()
 def mine(min_sessions: int = typer.Option(3, "--min-sessions")) -> None:
     """Surface recurring task families from captured events (FR-GEN-1 signal)."""
     log = EventLog()
+    session_ids = log.session_ids()
     families = mine_families(log.iter_events(), min_sessions=min_sessions)
-    distinct = log.distinct_sessions()
     if not families:
         typer.echo(
             f"no families recurring across >={min_sessions} sessions yet "
-            f"({distinct} distinct sessions captured)"
+            f"({len(session_ids)} distinct sessions captured)"
         )
     else:
         typer.echo(f"{'sessions':>8}  {'events':>6}  family")
         for fam in families:
             typer.echo(f"{fam.session_count:>8}  {fam.event_count:>6}  {fam.label}")
     # Mining acknowledges the accumulated sessions: reset the reminder watermark.
-    minestate.record_mined(log.root, distinct)
+    minestate.record_mined(log.root, session_ids)
 
 
 @app.command()
@@ -149,7 +159,7 @@ def status() -> None:
     log = EventLog(reg.root)
     typer.echo(f"events     : {log.count()}")
     typer.echo(f"candidates : {len(cands)} ({breakdown})")
-    unmined = minestate.unmined(reg.root, log.distinct_sessions())
+    unmined = minestate.unmined(reg.root, log.session_ids())
     if unmined >= minestate.reminder_threshold():
         typer.echo(f"reminder   : {unmined} distinct sessions unmined "
                    f"— run `super-skill mine`")
@@ -322,7 +332,7 @@ def candidate_draft(min_sessions: int = typer.Option(3, "--min-sessions")) -> No
     store = CandidateStore(config.state_root())
     created = draft_from_families(store, families)
     # Drafting acts on the mining, so it too clears the status reminder.
-    minestate.record_mined(log.root, log.distinct_sessions())
+    minestate.record_mined(log.root, log.session_ids())
     if not created:
         typer.echo("no new candidates (nothing mined, or all already drafted)")
         return

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/super_skill/evallite.py

@@ -17,6 +17,8 @@ from __future__ import annotations
 import re
 from dataclasses import dataclass, field
 
+import yaml
+
 from .redact import redact_text
 from .skillmd import SkillMdError, parse
 
@@ -72,8 +74,14 @@ def eval_lite(raw: str) -> EvalReport:
     except SkillMdError as e:
         return EvalReport(checks=[EvalCheck("schema", False, str(e))])
 
-    # 2. zero credential / PII leak in the instruction text (凭据与 PII 泄漏 = 0)
-    text = f"{parsed.frontmatter.description}\n{parsed.body}"
+    # 2. zero credential / PII leak in the instruction text (凭据与 PII 泄漏 = 0).
+    # Scan the FULL frontmatter (extra="allow" ships every field to the host, M6),
+    # not just description + body. YAML (not JSON) keeps ``keyword: value``
+    # adjacency so a secret in a keyword-named field is caught (v0.11.1 #4).
+    fm = yaml.safe_dump(
+        parsed.frontmatter.model_dump(), default_flow_style=False, allow_unicode=True
+    )
+    text = f"{fm}\n{parsed.body}"
     _, counts = redact_text(text)
     leaks = {k: c for k, c in counts.items() if k != "home_path"}
     checks.append(

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/super_skill/gate.py

@@ -17,10 +17,33 @@ land at M1 — v1 candidates carry no scripts, so there is nothing to cross-chec
 from __future__ import annotations
 
 import re
+import unicodedata
 from dataclasses import dataclass
 
+import yaml
+
 from .skillmd import parse
 
+# Cheap-obfuscation defenses (M7): strip zero-width/format chars and fold the
+# common Cyrillic/Greek homoglyphs so ``с​url`` (ZWSP) and ``сurl`` (Cyrillic es)
+# can't slip a shell pipe past the ASCII regexes. Base64-encoded payloads remain
+# out of scope until the M1 LLM-judge layer.
+_ZERO_WIDTH = dict.fromkeys(map(ord, "​‌‍⁠"), None)
+_CONFUSABLES = str.maketrans({
+    "а": "a", "с": "c", "ԁ": "d", "е": "e", "ɡ": "g", "һ": "h", "і": "i",
+    "ј": "j", "ո": "n", "о": "o", "р": "p", "ѕ": "s", "т": "t", "υ": "u",
+    "ν": "v", "х": "x", "у": "y", "α": "a", "ε": "e", "ο": "o", "ρ": "p", "κ": "k",
+})
+
+
+def _normalize(text: str) -> str:
+    """Fold cheap obfuscations before pattern-matching. casefold() runs before the
+    confusables map so UPPERCASE homoglyphs (e.g. Cyrillic ``С``) fold too."""
+    text = unicodedata.normalize("NFKC", text)
+    text = text.translate(_ZERO_WIDTH)
+    text = text.casefold()
+    return text.translate(_CONFUSABLES)
+
 # (category, pattern). Case-insensitive. Ordered most-severe first.
 _RULES: list[tuple[str, re.Pattern[str]]] = [
     (
@@ -84,6 +107,7 @@ class InstructionGateError(RuntimeError):
 
 def scan_text(text: str, location: str) -> list[Finding]:
     findings: list[Finding] = []
+    text = _normalize(text)
     for category, pat in _RULES:
         for m in pat.finditer(text):
             snippet = " ".join(m.group(0).split())[:80]
@@ -92,11 +116,22 @@ def scan_text(text: str, location: str) -> list[Finding]:
 
 
 def scan_skill_md(raw: str) -> list[Finding]:
-    """Scan a SKILL.md's description + body for external-action imperatives.
+    """Scan a SKILL.md's frontmatter + body for external-action imperatives.
 
     description is scanned separately: §2.4bis forbids imperative / second-person
-    external-action language there (it would both win routing and inject)."""
+    external-action language there (it would both win routing and inject). Every
+    OTHER frontmatter field is scanned too (M6): ``extra="allow"`` means fields
+    like ``instructions:`` / ``metadata:`` ship verbatim to the host, so they
+    need the same scrutiny — scanning only description + body left them a bypass."""
     parsed = parse(raw)
-    return scan_text(parsed.frontmatter.description, "description") + scan_text(
-        parsed.body, "body"
-    )
+    findings = scan_text(parsed.frontmatter.description, "description")
+    fm = parsed.frontmatter.model_dump()
+    # name is NAME_RE-constrained (safe); description already scanned above.
+    extra = {k: v for k, v in fm.items() if k not in ("name", "description") and v is not None}
+    if extra:
+        # YAML (not JSON) keeps ``keyword: value`` adjacency — JSON quotes the key
+        # (``"token":``), which breaks the credential/secret patterns that expect
+        # the keyword immediately before ``:`` (v0.11.1 #4).
+        dumped = yaml.safe_dump(extra, default_flow_style=False, allow_unicode=True)
+        findings += scan_text(dumped, "frontmatter")
+    return findings + scan_text(parsed.body, "body")

super_skill_cli-0.11.1/super_skill/minestate.py

@@ -0,0 +1,69 @@
+"""Mine watermark (D#67): remember WHICH distinct sessions had been mined last,
+so ``status``/``mine`` can nudge once enough new sessions accumulate — "you
+solved X across N unmined sessions, run mine".
+
+It stores the SET of mined session ids, not a count (M13): the WAL is TTL-bounded,
+so an absolute count went silently wrong once old sessions rolled off — new
+sessions could no longer exceed the stale high-water count. A set is robust:
+unmined = current session ids not in the mined set.
+
+Deliberately tiny: one JSON file in the state root, overwritten (never appended)
+each mine. Missing/corrupt reads as the empty set so a fresh or hand-broken state
+degrades to "everything is unmined" rather than crashing a read-only status.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+from collections.abc import Iterable
+from pathlib import Path
+
+_FILE = "mine_state.json"
+_DEFAULT_THRESHOLD = 3
+
+
+def reminder_threshold() -> int:
+    """Distinct unmined sessions before status nudges (env-overridable)."""
+    raw = os.environ.get("SUPER_SKILL_MINE_REMINDER")
+    if raw is None:
+        return _DEFAULT_THRESHOLD
+    try:
+        return int(raw)
+    except ValueError:
+        return _DEFAULT_THRESHOLD
+
+
+def _path(root: Path) -> Path:
+    return root / _FILE
+
+
+def mined_sessions(root: Path) -> set[str]:
+    """Set of session ids mined last (empty set if absent/corrupt)."""
+    p = _path(root)
+    if not p.exists():
+        return set()
+    try:
+        data = json.loads(p.read_text(encoding="utf-8"))
+        return set(data["mined_session_ids"])
+    except (ValueError, KeyError, TypeError):
+        return set()
+
+
+def record_mined(root: Path, session_ids: Iterable[str]) -> None:
+    """Persist the set of session ids seen at this mine as the new watermark."""
+    root.mkdir(parents=True, exist_ok=True)
+    p = _path(root)
+    # Atomic write so a crash can't leave a truncated watermark (M12); a corrupt
+    # read already degrades to empty, but atomicity keeps the good value intact.
+    fd, tmp = tempfile.mkstemp(dir=root, suffix=".tmp")
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        json.dump({"mined_session_ids": sorted(set(session_ids))}, f)
+    os.replace(tmp, p)
+
+
+def unmined(root: Path, current_sessions: Iterable[str]) -> int:
+    """How many currently-captured sessions have not been mined yet. Robust to
+    WAL TTL pruning: pruned-and-mined sessions simply don't appear in current."""
+    return len(set(current_sessions) - mined_sessions(root))

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/super_skill/redact.py

@@ -24,14 +24,28 @@ _PATTERNS: list[tuple[str, re.Pattern[str], int]] = [
         re.DOTALL,
     ), 0),
     ("anthropic_key", re.compile(r"sk-ant-[A-Za-z0-9_-]{16,}"), 0),
-    ("openai_key", re.compile(r"sk-[A-Za-z0-9]{20,}"), 0),
+    # OpenAI legacy (sk-…) + prefixed project/service keys (sk-proj-…, sk-svcacct-…).
+    # The 20+ alnum CORE keeps prose (short hyphenated words) from matching; the
+    # trailing _/- -joined segments capture project-key bodies fully (no tail leak).
+    ("openai_key", re.compile(r"sk-(?:[a-z]+-)?[A-Za-z0-9]{20,}(?:[_-][A-Za-z0-9]+)*"), 0),
+    ("stripe_key", re.compile(r"sk_(?:live|test)_[A-Za-z0-9]{16,}"), 0),
+    ("github_pat", re.compile(r"github_pat_[A-Za-z0-9_]{20,}"), 0),
     ("github_token", re.compile(r"gh[pousr]_[A-Za-z0-9]{20,}"), 0),
     ("aws_key", re.compile(r"AKIA[0-9A-Z]{16}"), 0),
+    ("gcp_key", re.compile(r"AIza[0-9A-Za-z_-]{35}"), 0),
     ("slack_token", re.compile(r"xox[baprs]-[A-Za-z0-9-]{10,}"), 0),
     ("bearer_token", re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*"), 0),
+    # Match a full identifier token that CONTAINS a sensitive word, up to the
+    # assignment. A ``\b`` left-anchor missed ``DB_PASSWORD`` (``_`` is a word
+    # char) and a bare keyword missed ``SECRET_KEY`` (the ``_KEY`` suffix broke
+    # ``[:=]`` adjacency) — H1. The lookbehind + surrounding identifier runs admit
+    # the keyword anywhere inside an env-var-shaped name. The runs are BOUNDED
+    # ({0,64}, not *) — an unbounded run over an underscore-heavy blob backtracks
+    # catastrophically (ReDoS on the capture hot path); env-var names are short.
     ("assigned_secret", re.compile(
-        r"(?i)\b(?:api[_-]?key|secret|token|password|passwd|pwd|access[_-]?key)\b"
-        r"\s*[:=]\s*['\"]?([^\s'\"]{6,})",
+        r"(?i)(?<![A-Za-z0-9])[A-Za-z0-9_]{0,64}"
+        r"(?:api[_-]?key|access[_-]?key|secret|password|passwd|pwd|token)"
+        r"[A-Za-z0-9_]{0,64}\s*[:=]\s*['\"]?([^\s'\"]{6,})",
     ), 1),
     ("email", re.compile(r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b"), 0),
 ]
@@ -66,10 +80,23 @@ def redact_text(text: str) -> tuple[str, dict[str, int]]:
     return text, counts
 
 
-def redact_payload(obj: Any, _path: str = "") -> tuple[Any, list[RedactionMark]]:
+# Recursion cap: a pathologically nested payload must not RecursionError (which
+# would blow past capture's guard). Well under CPython's ~1000-frame limit.
+_MAX_DEPTH = 60
+
+
+def redact_payload(
+    obj: Any, _path: str = "", _depth: int = 0
+) -> tuple[Any, list[RedactionMark]]:
     """Recursively redact all string leaves in a JSON-like structure, collecting
     marks that record kind + dotted field path (never the value)."""
     marks: list[RedactionMark] = []
+    if _depth > _MAX_DEPTH:
+        # Drop (do not stringify — str() of a deep subtree would itself recurse)
+        # the over-deep subtree; safer to lose it than to leak or crash (L18).
+        return "[REDACTED:max_depth]", [
+            RedactionMark(kind="max_depth", location=_path or "(root)", count=1)
+        ]
     if isinstance(obj, str):
         red, counts = redact_text(obj)
         marks.extend(
@@ -81,14 +108,14 @@ def redact_payload(obj: Any, _path: str = "") -> tuple[Any, list[RedactionMark]]
         out_d: dict[str, Any] = {}
         for k, v in obj.items():
             child = f"{_path}.{k}" if _path else str(k)
-            out_d[k], sub = redact_payload(v, child)
+            out_d[k], sub = redact_payload(v, child, _depth + 1)
             marks.extend(sub)
         return out_d, marks
     if isinstance(obj, list):
         out_l: list[Any] = []
         for i, v in enumerate(obj):
             child = f"{_path}[{i}]"
-            rv, sub = redact_payload(v, child)
+            rv, sub = redact_payload(v, child, _depth + 1)
             out_l.append(rv)
             marks.extend(sub)
         return out_l, marks

{super_skill_cli-0.10.0 → super_skill_cli-0.11.1}/super_skill/registry.py

@@ -9,10 +9,11 @@ without changing the entity shapes (docs/03 §3 M1, docs/02 §7.7).
 
 from __future__ import annotations
 
+import os
 import subprocess
 from pathlib import Path
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
 
 from . import config
 from .schemas import (
@@ -29,6 +30,11 @@ from .skillmd import content_hash, parse
 
 _GIT_ID = ["-c", "user.name=super-skill", "-c", "user.email=super-skill@localhost"]
 
+# Untracked by the registry git backend: pre-promotion scratch (candidates/,
+# locks/), the capture WAL + mine watermark (events/, mine_state.json — private
+# session content that must not enter audit history, M9), and atomic-write temps.
+_GITIGNORE = "locks/\ncandidates/\nevents/\nmine_state.json\n*.tmp\n"
+
 
 class SkillRecord(BaseModel):
     """Per-skill aggregate persisted as meta.json."""
@@ -63,17 +69,16 @@ class Registry:
     # ---- lifecycle ---------------------------------------------------------
     def init(self) -> None:
         self.skills_root.mkdir(parents=True, exist_ok=True)
-        # candidates/ holds pre-promotion draft scratch — kept out of tracked
-        # history so only approve (the Publisher path) writes registry state.
-        gitignore = "locks/\ncandidates/\n"
-        gi = self.root / ".gitignore"
         if not (self.root / ".git").exists():
             self._git("init", "-q")
-            gi.write_text(gitignore, encoding="utf-8")
-            self._commit("chore: initialize super-skill registry")
-        elif gi.exists() and "candidates/" not in gi.read_text(encoding="utf-8"):
-            gi.write_text(gitignore, encoding="utf-8")
-            self._commit("chore: ignore candidates/ scratch dir")
+        gi = self.root / ".gitignore"
+        # Rewrite whenever missing or stale — unconditionally, not gated on ``.git``
+        # existing (a crash between ``git init`` and the first write, or a manual
+        # ``git init``, used to leave it un-created and candidates/ tracked, M10).
+        if not gi.exists() or gi.read_text(encoding="utf-8") != _GITIGNORE:
+            gi.write_text(_GITIGNORE, encoding="utf-8")
+        # Idempotent: no-op when nothing is staged (already-initialized re-run).
+        self._commit("chore: initialize super-skill registry (.gitignore)")
 
     def _git(self, *args: str) -> str:
         proc = subprocess.run(
@@ -113,7 +118,13 @@ class Registry:
         p = self._meta_path(skill_id)
         if not p.exists():
             return None
-        return SkillRecord.model_validate_json(p.read_text(encoding="utf-8"))
+        try:
+            return SkillRecord.model_validate_json(p.read_text(encoding="utf-8"))
+        except ValidationError as e:
+            # A truncated/corrupt meta.json (crash mid-write, hand-edit) must
+            # surface as RegistryError so status/list/doctor report it cleanly
+            # rather than dying on a raw pydantic traceback (M12).
+            raise RegistryError(f"{skill_id}: corrupt meta.json ({e})") from e
 
     def list_skills(self) -> list[SkillRecord]:
         if not self.skills_root.exists():
@@ -145,6 +156,14 @@ class Registry:
         """Register a new immutable version; optionally make it the active pointer."""
         parsed = parse(raw)
         rec = self.get(skill_id) or SkillRecord(skill=Skill(skill_id=skill_id, scope=scope))
+        # Idempotent promotion (M8): re-adding content identical to the current
+        # active version is a no-op. Guards the approve crash window (candidate
+        # left 'pending' after commit) from double-promoting on re-run.
+        new_hash = content_hash(raw)
+        if make_active and rec.skill.active_version:
+            cur = rec.versions.get(rec.skill.active_version)
+            if cur is not None and cur.artifact_hash == new_hash:
+                return cur
         version = rec.next_version()
         parents = [rec.skill.active_version] if rec.skill.active_version else []
         sv = SkillVersion(
@@ -205,7 +224,11 @@ class Registry:
     def _write(self, rec: SkillRecord) -> None:
         p = self._meta_path(rec.skill.skill_id)
         p.parent.mkdir(parents=True, exist_ok=True)
-        p.write_text(rec.model_dump_json(indent=2), encoding="utf-8")
+        # Atomic write: a crash mid-write must never leave a truncated meta.json
+        # (M12). Write to a sibling temp file, then os.replace (atomic rename).
+        tmp = p.with_suffix(".json.tmp")
+        tmp.write_text(rec.model_dump_json(indent=2), encoding="utf-8")
+        os.replace(tmp, p)
 
     # ---- distribution ------------------------------------------------------
     def materialize(self, skill_id: str, host_dir: Path) -> Path: