CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-09 14:38:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(test): exempt the live repo tree from hermetic-wiring's operator-~/.claude ban

Browse Source 
The skill-seeding tripwire asserted every seeded symlink target must NOT
start with ~/.claude — but on the default global-git install the repo
itself lives at ~/.claude/skills/gstack, so every CORRECT symlink (which
must resolve into the live repo tree, as the very next assertion requires)
carried the banned prefix. The test could never pass on a default install:
pristine v1.64.1.0 (c118e240) fails it in any worktree under
~/.claude/skills/ and passes elsewhere (verified 2026-08-15).

Exempt targets that realpath into the resolved repo ROOT before applying
the operatorClaude ban — realpath both sides so a symlinked HOME can't
dodge the tripwire. Genuine escapes (a target under ~/.claude but outside
the repo) still fail with the escape message.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Stefan Andrei
2026-08-16 08:33:21 -07:00
committed by Garry Tan
co-authored by Claude Fable 5
parent 7ab271318b
commit cb8c79ac77
1 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/hermetic-wiring.test.ts
+13 -2
View File
@@ -125,10 +125,21 @@ describe('hermetic wiring tripwire', () => {
expect(configDir.startsWith(runRoot + path.sep)).toBe(true);
expect(configDir.startsWith(operatorClaude)).toBe(false);
const skillsDir = path.join(configDir, 'skills');
const repoRootReal = fs.realpathSync(ROOT) + path.sep;
for (const entry of fs.readdirSync(skillsDir)) {
const target = fs.readlinkSync(path.join(skillsDir, entry, 'SKILL.md'));
expect(target.startsWith(operatorClaude), `${entry}: symlink escapes to ${target}`).toBe(false);
expect(fs.realpathSync(target).startsWith(fs.realpathSync(ROOT) + path.sep), `${entry}: symlink outside repo: ${target}`).toBe(true);
const resolved = fs.realpathSync(target);
// Targets inside the live repo checkout are the blessed edge — exempt
// them BEFORE the operator-~/.claude ban. On the default global-git
// install the repo itself lives at ~/.claude/skills/gstack, so every
// CORRECT symlink carries the operatorClaude prefix and an unexempted
// ban can never pass (regression 2026-08-15: pristine v1.64.1.0 fails
// this test in any worktree under ~/.claude/skills/ and passes
// elsewhere — realpath both sides so a symlinked HOME can't dodge it).
if (!resolved.startsWith(repoRootReal)) {
expect(resolved.startsWith(operatorClaude), `${entry}: symlink escapes to ${target}`).toBe(false);
}
expect(resolved.startsWith(repoRootReal), `${entry}: symlink outside repo: ${target}`).toBe(true);
}
});
});