* Fix: use argv exec and single-quote escaping for the four #476 shell-injection sites
JSON.stringify and raw double-quote interpolation were used as shell quoting,
but /bin/sh still expands $(...), backticks, and ${} inside double quotes.
- is-generated.mjs / live.mjs runScript: switch execSync string commands to
execFileSync argv form, which never invokes a shell. Closes the remote path
where a source file named `$(...)` executes during the live-mode walk.
- skills.mjs hook command + hook-lib.mjs ignore-value suggestion: values that
must stay shell strings now use POSIX single-quote escaping instead of
JSON/double quotes. The doctor's hook-token parser learns the single-quoted
absolute form so it keeps verifying user-level installs.
Adds regression tests for the single-quoted absolute hook form and the
single-quoted ignore-value suggestion. Verified end to end in a browser through
a real live-mode wrap walk against a hostile-named source file.
Prepared with AI assistance (Cursor) under maintainer instruction.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Test: lock in POSIX single-quoting for a $(...) absolute install path (#476)
Follow-up from security review: prove an install path embedding $(...) is
single-quoted in the written hook manifest, not double-quoted.
Prepared with AI assistance (Cursor) under maintainer instruction.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Fix: quote ignore-command args per platform so Windows cmd.exe keeps spaces (#533)
Greptile flagged that switching quoteCommandArg to POSIX single quotes fixed
$(...) injection on /bin/sh but regressed Windows cmd.exe, where single quotes
are literal, so a --file path containing spaces was split and the ignore scope
was stored malformed.
The suggested command runs on the same machine the hook fired on, so branch on
process.platform (the pattern skills.mjs already uses): single-quote on POSIX
for the #476 fix, and keep the original double-quote escaping on Windows so
that path's behavior is unchanged. Adds a regression test asserting both forms.
Prepared with AI assistance (Cursor) under maintainer instruction.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Test: prove the POSIX hook guard is inert under /bin/sh and Windows keeps double quotes (#533)
Greptile's probe could not reach the generated manifest, leaving the hook
command contract unverified. Convert that into committed proof:
- POSIX: install with a $(touch pwned) absolute path, then actually execute the
generated guard under /bin/sh from a clean cwd and assert no marker file
appears and the guard exits 0 (single-quoted substitution stays inert).
- Windows: drive copyProviderHooks as win32 in-process and assert the command
keeps the double-quoted absolute path (usable when the install path has
spaces; $(...) is inert on cmd.exe anyway).
Test-only; source quoting is unchanged.
Prepared with AI assistance (Cursor) under maintainer instruction.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Recognize both slash- and dollar-prefixed prescribed seed markers and exercise each variant in coverage tests.
AI assistance: Codex addressed Cursor and Copilot review feedback and reran validation under maintainer authorization.
Treat Components as optional only when DESIGN.md carries the prescribed seed marker, while retaining Colors and Typography checks.
AI assistance: Codex reproduced the issue, implemented the fix, and added regression coverage under maintainer authorization.
The deep staleness pass extracted a hook-script path with a greedy `\S*`
prefix that swallowed the `${CLAUDE_PROJECT_DIR}/` placeholder, then
existsSync'd the literal string. That string never exists, so every project
installed by `impeccable hooks on` got a `hook-script-missing` finding with
text claiming UI edits were going unscanned — the opposite of the truth.
Split extraction from resolution. hookScriptTokenFrom now pulls the path
token (quoted-first, so it handles the #399 guarded `[ ! -f "PATH" ] || node
"PATH"` form and absolute user-level installs) without absorbing shell
syntax. resolveHookScriptPath then applies a per-placeholder policy:
- ${CLAUDE_PROJECT_DIR} expands to the scanned root (the runtime mapping).
- ${CLAUDE_PLUGIN_ROOT} / ${PLUGIN_ROOT} / ${GROK_PLUGIN_ROOT}, $(...) command
substitution (GitHub's $(git rev-parse)), and any other $VAR are SKIPPED:
the doctor cannot know those locations and must never assert a negative it
cannot verify.
The check stays real: a placeholder that expands to a genuinely absent path
still flags. Adds TDD coverage for every command form.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
v4 changed PRODUCT.md's shape and retired the register axis, so an
upgraded project can carry answers nothing reads. Nothing measured that.
Two tiers, and the split is a performance contract:
- Boot (context.mjs, emitting CONTEXT_STALE) spends only what a boot
already spends: markdown already in memory, a bounded set of stats,
the small JSON files the boot reads anyway. No new directory walks.
One directive for the whole set, throttled to once a week per project
so a finding the user declined does not reappear tomorrow.
- doctor.mjs runs the deep pass on demand: git drift, ignore lists
validated against the live rule registry, hook script paths that stop
resolving, and the monorepo workspace sweep. --fix applies only the
migrations that carry no decision.
Findings are data, not prose, so the boot directive, the text report and
--json all render one set. Severity says what should happen: auto (fix on
the next write anyway), mention (state once), route (name the command
that owns the repair).
PRODUCT.md now carries a schema stamp so the checks stop reconstructing a
file's vintage from which sections it happens to have. Schema version,
not release version: a record written by 4.0.0 is not stale under 4.0.1.
DESIGN.md gets no stamp, because it follows the external design.md spec
that Stitch lints and every DESIGN.md signal is measurable without one.
The highest-value catch is a project that resolves to web while carrying
native build files, including a monorepo app inheriting a root record
that says web. That one costs output quality silently; nothing failed
before.
doctor follows the hooks/pin pattern rather than the Commands table, so
it stays out of the design menu and the count stays at 23.
Also corrects CLAUDE.md, which still documented the register axis,
reference/brand.md, reference/product.md, eleven deleted domain reference
files, and an extractRegister() whose only occurrence in the repo was
that sentence.
Prepared with AI assistance (Claude Code).
Co-Authored-By: Claude <noreply@anthropic.com>
Paul Bakaus
