You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The apply check refuses a relative name starting with a drive letter.
Security
The final-consent apply check refuses a relative target that starts with a drive prefix. On Windows a path such as z:foo/x.txt is not absolute, so the checker judged it joined to the project root, while a writer that resolves it (path.win32.resolve(root, 'z:foo/x.txt')) lands on another drive (z:\foo\x.txt). skills/coalboard/scripts/apply-target.mjs now refuses, on every platform, a relative target whose text starts with one letter and a colon (z:foo/x.txt, c:d/x, either letter case), with the existing reason name (REFUSE <target> name -); the digest and the report name it as not applicable, so "apply all" never covers it. A colon later in a name (a.txt::$DATA, ab:c/x), a drive-like segment that is not at the start (sub/z:foo/x, ./z:foo/x) and an absolute target are not affected, because a drive prefix counts only at the very start of a path. The name rule of 2.8.6 also refuses a dot or a space right before a stream colon (a.txt.::$DATA). — test: scripts/lib/apply-target.test.mjs
Fixed
The GATE 3 step in SKILL.md no longer promises a real path for every refused target. It said a refused target is named in the digest and the report "with its real path"; the checker prints - for a name or an unresolvable refusal, so the sentence now says "with its real path (where the checker gives one)" and its parenthetical now reads "(one of four reasons: a link, outside the project, unresolvable, or name, a trailing dot or space or a drive prefix)". — test: scripts/lib/conductor-links.test.mjs
Changed
Test-only hardening; not shipped in the plugin.scripts/front-door-links.test.mjs is re-copied by blob (c051b28f) from the .github canon at b9832a0; every spawn in scripts/verify.test.mjs now has a finite timeout and kill signal and every git child there runs with sandbox variables; the XDG leg of scripts/lib/derive-roots.test.mjs gives its child a minimal environment instead of the whole one. — test: scripts/verify.test.mjs, scripts/lib/derive-roots.test.mjs
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
TheColliery
Uh oh!
There was an error while loading. Please reload this page.
The apply check refuses a relative name starting with a drive letter.
Security
z:foo/x.txtis not absolute, so the checker judged it joined to the project root, while a writer that resolves it (path.win32.resolve(root, 'z:foo/x.txt')) lands on another drive (z:\foo\x.txt).skills/coalboard/scripts/apply-target.mjsnow refuses, on every platform, a relative target whose text starts with one letter and a colon (z:foo/x.txt,c:d/x, either letter case), with the existing reasonname(REFUSE <target> name -); the digest and the report name it as not applicable, so "apply all" never covers it. A colon later in a name (a.txt::$DATA,ab:c/x), a drive-like segment that is not at the start (sub/z:foo/x,./z:foo/x) and an absolute target are not affected, because a drive prefix counts only at the very start of a path. Thenamerule of 2.8.6 also refuses a dot or a space right before a stream colon (a.txt.::$DATA). — test:scripts/lib/apply-target.test.mjsFixed
SKILL.mdno longer promises a real path for every refused target. It said a refused target is named in the digest and the report "with its real path"; the checker prints-for anameor anunresolvablerefusal, so the sentence now says "with its real path (where the checker gives one)" and its parenthetical now reads "(one of four reasons: a link, outside the project, unresolvable, orname, a trailing dot or space or a drive prefix)". — test:scripts/lib/conductor-links.test.mjsChanged
scripts/front-door-links.test.mjsis re-copied by blob (c051b28f) from the.githubcanon atb9832a0; every spawn inscripts/verify.test.mjsnow has a finite timeout and kill signal and every git child there runs with sandbox variables; the XDG leg ofscripts/lib/derive-roots.test.mjsgives its child a minimal environment instead of the whole one. — test:scripts/verify.test.mjs,scripts/lib/derive-roots.test.mjsRelease page · CoalBoard
All reactions