From c750781be454068e7d9856dbf762b51c950934af Mon Sep 17 00:00:00 2001 From: YeonGyu-Kim Date: Sun, 12 Apr 2026 02:28:46 +0900 Subject: [PATCH] fix(shared): avoid false-positive skill path resolution on npm scoped packages (#2857) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The @scope/path regex incorrectly matched npm scoped package references like 'require(\"@scope/pkg\")' or '--package=@scope/pkg'. Added context filtering to exclude matches preceded by npm/import indicators. 🤖 Generated with OhMyOpenCode assistance https://github.com/code-yeongyu/oh-my-opencode --- src/shared/skill-path-resolver.test.ts | 12 ++++++++++++ src/shared/skill-path-resolver.ts | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/src/shared/skill-path-resolver.test.ts b/src/shared/skill-path-resolver.test.ts index a9815b7fd..7bc08d340 100644 --- a/src/shared/skill-path-resolver.test.ts +++ b/src/shared/skill-path-resolver.test.ts @@ -149,4 +149,16 @@ describe("resolveSkillPathReferences", () => { //#then expect(result).toBe("Inspect @data/../../../secret/") }) + + it("does not resolve npx --package=@scope/pkg as skill path", () => { + //#given + const content = "npx --package=@scope/pkg" + const basePath = "/skills/frontend" + + //#when + const result = resolveSkillPathReferences(content, basePath) + + //#then + expect(result).toBe("npx --package=@scope/pkg") + }) }) diff --git a/src/shared/skill-path-resolver.ts b/src/shared/skill-path-resolver.ts index 6d088171d..008ac0e8f 100644 --- a/src/shared/skill-path-resolver.ts +++ b/src/shared/skill-path-resolver.ts @@ -9,7 +9,7 @@ function looksLikeFilePath(path: string): boolean { export function resolveSkillPathReferences(content: string, basePath: string): string { const normalizedBase = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath return content.replace( - /(? { if (!looksLikeFilePath(relativePath)) return match const resolvedPath = resolve(normalizedBase, relativePath)