Markus 01e0455f25 fix(workflows): reject symlinked overlay directories in layer sources ...

Address PR #3557 review comments r3594064534 and r3594064563:

- ProjectOverlaySource.collect now rejects symlinked per-workflow overlay
  directories (.specify/workflows/overlays/<id>) before iterating
- InstalledOverlaySource.collect now rejects symlinked installed overlay
  directories (.specify/workflows/<id>/overlays) before iterating
- workflow_overlay_list catches ValueError from resolver and exits with
  code 1 instead of crashing on unhandled exceptions
- Added .specify/workflows/overlays to _reject_unsafe_workflow_storage
  chokepoint for defense-in-depth

These guards prevent symlinked overlay directories from redirecting
auto-loaded overlay YAML to attacker-controlled content outside the
project, which could inject executable shell steps into trusted workflows.

Refs: PR #3557 review comments r3594064534, r3594064563

Assisted-by: opencode-go/qwen3.7-max (autonomous)

2026-07-16 14:47:38 +02:00

..

contract

fix: resolve GitHub release asset API URL for private repo bundle downloads (#3136)

2026-07-01 16:30:20 -05:00

extensions

fix(agent-context): discover nested plan.md in scoped layouts (#3024) (#3301)

2026-07-10 14:21:43 -05:00

hooks

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430)

2026-07-10 11:47:36 -05:00

integration

fix(bundler): bundle update uninstalls components dropped by new version (#3353)

2026-07-07 14:59:27 -05:00

integrations

fix(catalogs): raise catalog error, not raw ValueError, on a malformed URL (#3435)

2026-07-10 13:39:01 -05:00

unit

fix(bundler): raise BundlerError, not raw ValueError, on a malformed catalog URL (#3433)

2026-07-10 11:57:53 -05:00

workflows

fix(workflows): reject symlinked overlay directories in layer sources

2026-07-16 14:47:38 +02:00

__init__.py

Add modular extension system (#1551)

2026-02-10 14:27:20 -06:00

auth_helpers.py

feat: Config-driven opt-in authentication registry with multi-platform support (#2393)

2026-05-07 12:51:20 -05:00

bundler_helpers.py

feat: add specify bundle command (#3070)

2026-06-19 17:07:20 -05:00

conftest.py

feat(cli): honor SPECIFY_INIT_DIR in the specify CLI project resolver (#3186)

2026-07-01 15:55:18 -05:00

http_helpers.py

feat(cli): implement specify self upgrade (#2475)

2026-06-03 12:04:54 -05:00

self_upgrade_helpers.py

feat(cli): implement specify self upgrade (#2475)

2026-06-03 12:04:54 -05:00

test_agent_config_consistency.py

chore: retire Roo Code integration — extension shut down (#3167) (#3212)

2026-06-30 10:24:04 -05:00

test_authentication.py

fix(auth): return no matches, not raw ValueError, for a malformed URL (#3437)

2026-07-10 13:45:44 -05:00

test_branch_numbering.py

feat: make git extension opt-in and remove --no-git at v0.10.0 (#2873)

2026-06-09 06:13:07 -05:00

test_check_prerequisites_paths_only.py

fix: fall back to feature dir basename for empty CURRENT_BRANCH (#3026) (#3229)

2026-07-01 13:50:53 -05:00

test_check_prerequisites_python_parity.py

feat(scripts): add Python check-prerequisites PoC (#3302)

2026-07-06 17:54:31 -05:00

test_check_tool.py

feat: add support for rovodev (#2539)

2026-06-04 11:34:05 -05:00

test_cli_version.py

feat: add version feature reporting (#2548)

2026-05-14 12:52:14 -05:00

test_command_template_py_scripts.py

test: pin interpreter probe so py-template render test passes on Windows (#3428)

2026-07-09 12:21:50 -05:00

test_commands_package.py

feat(cli): add py script type & Python interpreter resolution (#3278) (#3285)

2026-07-01 16:34:46 -05:00

test_console_imports.py

chore(tests): fix ruff lint violations in tests/ (#2827)

2026-06-03 16:02:26 -05:00

test_extension_registration.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430)

2026-07-10 11:47:36 -05:00

test_extension_skills.py

fix extension-local script path rewriting (#3364)

2026-07-07 10:51:50 -05:00

test_extension_update_hardening.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430)

2026-07-10 11:47:36 -05:00

test_extensions.py

fix(toml): escape control characters so generated command files parse (#3341)

2026-07-08 07:42:34 -05:00

test_github_http.py

fix(github-http): return None on malformed GHES port instead of raising (#3379)

2026-07-07 15:14:25 -05:00

test_github_workflows.py

ci: pin actions to commit SHAs and add shellcheck (#3126)

2026-06-24 15:08:16 -05:00

test_init_dir_cli.py

feat(cli): honor SPECIFY_INIT_DIR in the specify CLI project resolver (#3186)

2026-07-01 15:55:18 -05:00

test_init_dir.py

feat(scripts): add SPECIFY_INIT_DIR to target a member project from the repo root (#2892)

2026-06-19 12:05:42 -05:00

test_live_transient_windows.py

fix: disable Rich Live transient mode on Windows to prevent PS 5.1 hang (#2938)

2026-06-17 06:48:42 -05:00

test_merge.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430)

2026-07-10 11:47:36 -05:00

test_post_process.py

feat(integrations): generalize post-processing to all format types (#3311)

2026-07-07 11:35:43 -05:00

test_presets.py

fix(cli): exit cleanly on malformed IPv6 URLs in extension/preset/workflow add (#3369)

2026-07-07 15:20:13 -05:00

test_ps1_encoding.py

fix: PS 5.1 compat — replace non-ASCII chars in shipped PowerShell scripts (#2709)

2026-05-26 13:18:34 -05:00

test_registrar_path_traversal.py

Harden command registration path handling (#3088)

2026-06-22 10:25:29 -05:00

test_self_upgrade_detection.py

feat(cli): implement specify self upgrade (#2475)

2026-06-03 12:04:54 -05:00

test_self_upgrade_execution.py

feat(cli): implement specify self upgrade (#2475)

2026-06-03 12:04:54 -05:00

test_self_upgrade_guidance.py

feat(cli): implement specify self upgrade (#2475)

2026-06-03 12:04:54 -05:00

test_self_upgrade_verification.py

feat(cli): implement specify self upgrade (#2475)

2026-06-03 12:04:54 -05:00

test_setup_plan_feature_json.py

fix(scripts): fall through to grep/sed when python3 is a broken stub in feature.json parser (#3312)

2026-07-08 07:45:01 -05:00

test_setup_plan_no_overwrite.py

fix(scripts): route 'Plan template not found' per --json in setup-plan.ps1 (parity with bash) (#3241)

2026-06-29 16:37:40 -05:00

test_setup_tasks.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430)

2026-07-10 11:47:36 -05:00

test_shared_infra_integrity.py

feat(extensions): verify catalog archive sha256 before install (#3080)

2026-06-24 14:52:24 -05:00

test_timestamp_branches.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430)

2026-07-10 11:47:36 -05:00

test_upgrade.py

feat(cli): implement specify self upgrade (#2475)

2026-06-03 12:04:54 -05:00

test_utils_assets_imports.py

feat: make git extension opt-in and remove --no-git at v0.10.0 (#2873)

2026-06-09 06:13:07 -05:00

test_utils.py

harden: reject shell=True in run_command (#3132)

2026-06-24 13:05:21 -05:00

test_version_imports.py

chore(tests): fix ruff lint violations in tests/ (#2827)

2026-06-03 16:02:26 -05:00

test_workflow_run_without_project.py

fix(workflows): route run/resume errors to stderr under --json (#3352)

2026-07-07 14:52:36 -05:00

test_workflows.py

fix(workflows): report validation errors instead of crashing on non-string workflow.yml scalars (#3421)

2026-07-10 09:51:19 -05:00