Repository navigation
Harden package validator and list graphify_rank_files - #3
0xkaushik-ai wants to merge 1 commit into
Conversation
- Reject symlinks in plugin packages (could point outside the plugin) - Reject hooks for the graphify package, matching the README's no-local-code claim - Don't crash on a non-string metadata.pluginRoot - Resolve repo root from the script location, not cwd - Accept frontmatter that closes at end of file; treat quoted empty values as empty - Add graphify_rank_files to the README tools table
![graphify-labs-staging[bot]](https://avatars.githubusercontent.com/in/4517131?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.
Not checked: tests were not run; no formal proof of the changed code.
Graphify review — findings
Tightens graphify package validation to reject hooks and any symlinks discovered during tree walks, deduplicates error strings, and switches repoRoot to a stable import.meta.url resolution that survives cwd changes. parseFrontmatter now strips matching quotes from values and uses a regex for the closing delimiter so malformed frontmatter fails cleanly instead of returning partial data. The symlink ban leaves the package root itself unchecked, so a symlinked root still passes.
Worth a look
- Symlinked package root bypasses symlink ban —
scripts/validate-template.mjs:110· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 27 functions depend on the 27 functions this change touches.
Health — grade A; 1 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):
main()— 1 callers, 10 callees (medium)
Verification — 27 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 27 function(s) in the blast radius were not formally verified this run
1 participant
Small fixes to
scripts/validate-template.mjs, each reproduced before fixing:/etc/passwdpassed); they're now rejected.hooks/dir orhooksfield passed, despite the README saying the package runs no local code; now rejected.metadata.pluginRootcrashed with a TypeError; now a normal validation error.description: ""counts as empty.Also adds
graphify_rank_filesto the README tools table (it was referenced but not listed).node scripts/validate-template.mjspasses on the current package.