RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge 8489f33bd8 into 2be6c06ba8

This commit is contained in:
sneakygriff 2026-08-15 23:48:23 +03:00 committed by GitHub
parent 2be6c06ba8 8489f33bd8
commit 8667e35165
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
test/hermetic-wiring.test.ts
View File

@ -125,10 +125,21 @@ describe('hermetic wiring tripwire', () => {
expect(configDir.startsWith(runRoot + path.sep)).toBe(true); expect(configDir.startsWith(runRoot + path.sep)).toBe(true);
expect(configDir.startsWith(operatorClaude)).toBe(false); expect(configDir.startsWith(operatorClaude)).toBe(false);
const skillsDir = path.join(configDir, 'skills'); const skillsDir = path.join(configDir, 'skills');
const repoRootReal = fs.realpathSync(ROOT) + path.sep;
for (const entry of fs.readdirSync(skillsDir)) { for (const entry of fs.readdirSync(skillsDir)) {
const target = fs.readlinkSync(path.join(skillsDir, entry, 'SKILL.md')); const target = fs.readlinkSync(path.join(skillsDir, entry, 'SKILL.md'));
expect(target.startsWith(operatorClaude), `${entry}: symlink escapes to ${target}`).toBe(false); const resolved = fs.realpathSync(target);
expect(fs.realpathSync(target).startsWith(fs.realpathSync(ROOT) + path.sep), `${entry}: symlink outside repo: ${target}`).toBe(true); // Targets inside the live repo checkout are the blessed edge — exempt
// them BEFORE the operator-~/.claude ban. On the default global-git
// install the repo itself lives at ~/.claude/skills/gstack, so every
// CORRECT symlink carries the operatorClaude prefix and an unexempted
// ban can never pass (regression 2026-08-15: pristine v1.64.1.0 fails
// this test in any worktree under ~/.claude/skills/ and passes
// elsewhere — realpath both sides so a symlinked HOME can't dodge it).
if (!resolved.startsWith(repoRootReal)) {
expect(resolved.startsWith(operatorClaude), `${entry}: symlink escapes to ${target}`).toBe(false);
}
expect(resolved.startsWith(repoRootReal), `${entry}: symlink outside repo: ${target}`).toBe(true);
} }
}); });
}); });