Skip to content

chore: draft routing updates#369

Closed
notque wants to merge 2 commits intomainfrom
fix/revert-private-skill-leak
Closed

chore: draft routing updates#369
notque wants to merge 2 commits intomainfrom
fix/revert-private-skill-leak

Conversation

@notque
Copy link
Copy Markdown
Owner

@notque notque commented Apr 11, 2026

Superseded.

notque added 2 commits April 11, 2026 10:17
…14 uncategorized skills (#368)

* Fix Codex skill mirror install paths

* Fix install doctor path checks for Codex support

* Document /do for Claude and $do for Codex

* Fix install-doctor test lint

* fix(routing): add WrestleJoy/voice skills to routing-tables.md and fix 14 uncategorized skills

9 WrestleJoy and voice skills were in INDEX.json but completely absent from
routing-tables.md, making them invisible to any process that consults the
routing reference. Additionally, 14 skills had no category field in their
SKILL.md routing sections.

Changes:
- Add WrestleJoy Skills section to routing-tables.md (6 skills)
- Add voice-andy-nemmity, voice-amy-nemmity, voice-andy-disagreement to
  Voice Skills section in routing-tables.md
- Add category: field to routing: section in 7 SKILL.md files
  (e2e-testing, fish-shell-config, go-patterns, nano-banana-builder,
  testing-anti-patterns, video-editing, workflow)
- Private skill categories (7 WrestleJoy/voice SKILL.md files) updated
  locally via symlink targets; regenerate-skill-index picks these up
- Regenerate INDEX.json: 0 uncategorized skills (was 14)

Detected by Phase 1 routing-table drift check in toolkit-evolution cycle
2026-04-11. Validated 0 missing skills in routing-tables.md post-fix.
PR #368 (merge commit 54966e1) leaked 9 private skills into two tracked
files via the generate-skill-index.py script following symlinks from
skills/ into gitignored private directories.

Part 1: surgical revert of leaked content
- Remove 9 private skill entries from skills/INDEX.json
  (voice-andy-nemmity, voice-amy-nemmity, voice-andy-disagreement,
  wrestlejoy-aew-images, wrestlejoy-external-research,
  wrestlejoy-mmr-research, wrestlejoy-news-pipeline,
  wrestlejoy-research-transform, gemini-wrestlejoy-comparison)
- Remove 3 voice rows (lines 228-230) and WrestleJoy Skills section
  (7 rows + section header) from skills/do/references/routing-tables.md
- Regenerate skills/INDEX.json via fixed generator (public-only mode)
  to restore correct metadata for joy-check and toolkit-evolution entries
  that were also corrupted by the leaked-index regeneration

Part 2: root-cause fix in scripts/generate-skill-index.py
- Add is_private_path() guard: resolves realpath and checks for private
  directory components (private-skills, private-agents, private-hooks,
  private-voices) before including any SKILL.md in the index
- Default mode is now public-only (private symlinks silently skipped)
- Add --include-private flag for local private-skill index generation
- Add --output flag defaulting to skills/INDEX.json
- Add --skills-dir flag for testability and override support
- Add 14 tests in scripts/tests/test_generate_skill_index.py covering
  all four required scenarios (all pass)

Part 3: local override mechanism
- Add skills/INDEX.local.json to .gitignore with generation instructions
- Update scripts/routing-manifest.py to prefer INDEX.local.json when
  present, falling back to the committed public INDEX.json
- This gives local workflows access to private skills without committing

Part 4: fix the nightly cron runner
- Update scripts/toolkit-evolution-cron.sh prompt with explicit guard:
  run generate-skill-index.py without --include-private, never add
  private skill rows to routing-tables.md
- Root cause: toolkit-evolution DIAGNOSE phase detected skills in
  INDEX.json absent from routing-tables.md (correct), then BUILD phase
  regenerated INDEX.json via the unguarded script (incorrect), picking
  up private symlinks and committing the result via PR #368

The 7 legitimate category: field additions to SKILL.md files in #368
(e2e-testing, fish-shell-config, go-patterns, nano-banana-builder,
testing-anti-patterns, video-editing, workflow) are preserved.
@notque notque changed the title fix(security): revert private skill leak from PR #368 + fix root cause chore: draft routing updates Apr 11, 2026
@notque notque closed this Apr 11, 2026
@notque notque deleted the fix/revert-private-skill-leak branch April 11, 2026 16:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant