YeonGyu-Kim 98659783c0 fix(security): confine file resolution to project roots ...

Block traversal, out-of-root absolute path, and symlink escapes for @file references, file:// URIs, and config skill file loading while logging rejected attempts.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

2026-04-02 14:55:35 +09:00

..

merger

fix(security): confine file resolution to project roots

2026-04-02 14:55:35 +09:00

agents-skills-global.test.ts

fix(skill-loader): discover skills from .agents/skills/ directory

2026-02-14 14:58:09 +09:00

AGENTS.md

docs(agents): refresh generated AGENTS guides

2026-03-06 17:59:05 +09:00

allowed-tools-parser.ts

refactor(opencode-skill-loader): split loader and merger into focused modules

2026-02-08 16:21:19 +09:00

async-loader.test.ts

test: cover remaining nested async skill paths

2026-03-29 01:16:10 -07:00

async-loader.ts

fix: preserve nested async skill names in discovery

2026-03-29 00:35:59 -07:00

blocking.test.ts

refactor: major codebase cleanup - BDD comments, file splitting, bug fixes (#1350)

2026-02-01 16:47:50 +09:00

blocking.ts

Fix model fallback across main/background/sync agents

2026-02-20 17:45:53 +02:00

config-source-discovery.test.ts

fix(tests): drop duplicate tilde config regression

2026-03-26 13:08:53 +09:00

config-source-discovery.ts

fix(skills): remove duplicate homedir import

2026-03-26 13:06:32 +09:00

discover-worker.ts

Fix model fallback across main/background/sync agents

2026-02-20 17:45:53 +02:00

git-master-template-injection.test.ts

fix(tmux): escape serverUrl in pane shell commands

2026-03-17 15:16:54 +09:00

git-master-template-injection.ts

fix(tmux): escape serverUrl in pane shell commands

2026-03-17 15:16:54 +09:00

index.ts

feat(skills): load config sources in runtime discovery

2026-02-13 11:08:46 +09:00

loaded-skill-from-path.ts

merge: integrate origin/dev (5th merge) — resolve @path skill references in split file structure

2026-02-09 12:08:15 +09:00

loaded-skill-template-extractor.ts

fix: resolve 25 pre-publish blockers

2026-03-28 15:24:18 +09:00

loader.test.ts

fix(skills): discover ancestor project skill directories

2026-03-26 11:22:00 +09:00

loader.ts

fix(commands): load .agents skills into command config

2026-03-26 12:15:47 +09:00

merger.test.ts

feat(skills): load config sources in runtime discovery

2026-02-13 11:08:46 +09:00

merger.ts

feat(skills): load config sources in runtime discovery

2026-02-13 11:08:46 +09:00

project-skill-discovery.test.ts

fix(skills): discover ancestor project skill directories

2026-03-26 13:02:36 +09:00

project-skill-tool-references.test.ts

test(skill-loader): avoid node:fs mock leakage in project skill references

2026-03-16 11:37:56 +09:00

skill-content.test.ts

test(git-master): add tests for git_env_prefix injection

2026-03-06 11:35:59 +09:00

skill-content.ts

refactor(opencode-skill-loader): split loader and merger into focused modules

2026-02-08 16:21:19 +09:00

skill-deduplication.ts

refactor(opencode-skill-loader): split loader and merger into focused modules

2026-02-08 16:21:19 +09:00

skill-definition-record.ts

refactor(opencode-skill-loader): split loader and merger into focused modules

2026-02-08 16:21:19 +09:00

skill-directory-loader.ts

refactor(opencode-skill-loader): split loader and merger into focused modules

2026-02-08 16:21:19 +09:00

skill-discovery.ts

fix(skills): use directory param instead of process.cwd() for project skill discovery

2026-02-13 10:49:15 +08:00

skill-mcp-config.ts

refactor(opencode-skill-loader): split loader and merger into focused modules

2026-02-08 16:21:19 +09:00

skill-resolution-options.ts

fix(skills): use directory param instead of process.cwd() for project skill discovery

2026-02-13 10:49:15 +08:00

skill-template-resolver.ts

refactor(opencode-skill-loader): split loader and merger into focused modules

2026-02-08 16:21:19 +09:00

types.ts

fix(skill): support YAML array format for allowed-tools field (#1163)

2026-01-28 16:26:34 +09:00