Skip to content

v2.8.7 - the apply check refuses a relative name starting with a drive letter

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Oct 21:23
· 34 commits to main since this release
v2.8.7
This tag was signed with the committer’s verified signature.
HetCreep HetCreep
SSH Key Fingerprint: 0osv9sipbbl2qmrI00rRA3kcEKs4ZuS+FBihPD/c8DU
Verified
Learn about vigilant mode.
74caabd
This commit was signed with the committer’s verified signature.
HetCreep HetCreep
SSH Key Fingerprint: 0osv9sipbbl2qmrI00rRA3kcEKs4ZuS+FBihPD/c8DU
Verified
Learn about vigilant mode.

The apply check refuses a relative name starting with a drive letter.

Security

  • The final-consent apply check refuses a relative target that starts with a drive prefix. On Windows a path such as z:foo/x.txt is not absolute, so the checker judged it joined to the project root, while a writer that resolves it (path.win32.resolve(root, 'z:foo/x.txt')) lands on another drive (z:\foo\x.txt). skills/coalboard/scripts/apply-target.mjs now refuses, on every platform, a relative target whose text starts with one letter and a colon (z:foo/x.txt, c:d/x, either letter case), with the existing reason name (REFUSE <target> name -); the digest and the report name it as not applicable, so "apply all" never covers it. A colon later in a name (a.txt::$DATA, ab:c/x), a drive-like segment that is not at the start (sub/z:foo/x, ./z:foo/x) and an absolute target are not affected, because a drive prefix counts only at the very start of a path. The name rule of 2.8.6 also refuses a dot or a space right before a stream colon (a.txt.::$DATA). — test: scripts/lib/apply-target.test.mjs

Fixed

  • The GATE 3 step in SKILL.md no longer promises a real path for every refused target. It said a refused target is named in the digest and the report "with its real path"; the checker prints - for a name or an unresolvable refusal, so the sentence now says "with its real path (where the checker gives one)" and its parenthetical now reads "(one of four reasons: a link, outside the project, unresolvable, or name, a trailing dot or space or a drive prefix)". — test: scripts/lib/conductor-links.test.mjs

Changed

  • Test-only hardening; not shipped in the plugin. scripts/front-door-links.test.mjs is re-copied by blob (c051b28f) from the .github canon at b9832a0; every spawn in scripts/verify.test.mjs now has a finite timeout and kill signal and every git child there runs with sandbox variables; the XDG leg of scripts/lib/derive-roots.test.mjs gives its child a minimal environment instead of the whole one. — test: scripts/verify.test.mjs, scripts/lib/derive-roots.test.mjs
Assets 2
Loading