Repository navigation
Keep declared component paths within the packaged plugin #424
Description
🤖 Generated by the Agentic Engineer
Problem
The real package gate accepts skills: ["../../outside"]. Package validity must not depend on files outside the installable plugin or follow a symlink that escapes its root.
Observed on fresh main during hands-on validation on 2026-10-03. The package cases exercise the production gate against a complete isolated fixture; the catalogue cases exercise its shared parser and native CLI argument contract.
Intended outcome
Reject absolute paths, parent traversal and symlink escapes before dereferencing component resources; accept contained regular resources and test both path kinds.
Success proxy: a regression fails against current main, then passes with the root-cause repair; healthy packages and normal installation remain usable. No external adoption is claimed.
Size: S. Part of #38.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Effort
Projects
- Status
Activity
chore: agent-claim #424 nonce=983735c49836780df23a59a51f4ab11d
devantler commentedon Oct 3, 2026
Delivered in #426 at merged commit 465a84f. The merged tree matches the reviewed final source. The actual merged package passes its production gate; introducing a conflicting repeated declaration into that otherwise healthy package is rejected.
The 39 package boundary cases, 313 existing manifest cases and 25 MCP boundary cases pass, and required CI was green at the final reviewed commit. All review findings were fixed or refuted with evidence before merge.