Skip to content

v3.23.5 - project writes refuse parent-folder links; gold-standard stamps

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 15:44
· 18 commits to main since this release
v3.23.5
This tag was signed with the committer’s verified signature.
HetCreep HetCreep
SSH Key Fingerprint: 0osv9sipbbl2qmrI00rRA3kcEKs4ZuS+FBihPD/c8DU
Verified
Learn about vigilant mode.
0696ee0
This commit was signed with the committer’s verified signature.
HetCreep HetCreep
SSH Key Fingerprint: 0osv9sipbbl2qmrI00rRA3kcEKs4ZuS+FBihPD/c8DU
Verified
Learn about vigilant mode.

Project writes refuse parent-folder links; gold-standard stamps

A project write (the config, the installer's files) now refuses a link at any folder between the project root and the file. plugin/ moved only for the gold-standard method reference, so this is a PATCH release.

Security

  • A project write refuses a link at any folder between the project root and the file, wherever it points. Before: a write through an in-project link (an in-project .claude junction or symlink) was made while the hooks refused to read the same file (the 3.23.3 read pin); a link that led outside the project was already refused. Now writeRepoFile and the pre-checks every caller runs (configure.mjs, install.mjs: rules files, git hooks, the skills folder, the manifest, uninstall) refuse a link at any component, an in-project target included, and make missing folders one at a time, checking each. A user whose own .claude, .github or .agents is an in-project link (a dotfile manager's) is refused where they install, the same rule the reads already apply; configure.mjs --global (no project root) is unchanged. Not covered: the check-then-make race. The walk and the later write are separate steps, so a local process that swaps a folder for a link between the last check and the write can still land the file outside the project. — test: scripts/lib/write-folder-pin.test.mjs

Changed

  • Internal — the canon re-copy round (UMB3-038), by blob id, from the org canon overlay: scripts/lib/wave-run.mjs b60827c6, scripts/lib/wave-run.test.mjs bccbaa58, scripts/lib/release-prune.mjs 7f33a695, scripts/lib/release-prune.test.mjs 96a4cceb, scripts/lib/asset-upload-mode.mjs 0022e6fa, scripts/lib/asset-upload-mode.test.mjs 573349d2, scripts/verify-release-shape.mjs 270e43d1, scripts/verify-release-shape.test.mjs 7c2b35c4 and scripts/release-notes.test.mjs f9dde432; the github/codeql-action pin in codeql.yml and scorecard.yml moved to 24c54180a607b1449ed407dd24f251e4e9147c8d (v4); scorecard.yml's paths-ignore gains NOTICE; claude-ai-zips.yml takes the canon's package-manager-cache: false on setup-node. These ship nothing in plugin/.
  • NOTICE follows the canon wording (BB-185): name, copyright line, the series URL and the licence; the room's own Origin line and attribution sentence are gone.
  • gold-standard stamps only the content it re-checked. A FILL or RE-VALIDATE that checks some sections of a file writes a new stamp on the line above each section it checked and leaves the file-level stamp's date and exemplars as they were (a section with no stamp of its own keeps that date); re-dating the file-level stamp over sections nobody re-read over-claimed their freshness. The rule is in skills/gold-standard/references/method.md and its plugin/ copy, and the RE-VALIDATE step in SKILL.md says the same. A prose rule, so no test.
Assets 12
Loading