Commit:

7f51b2b2cda1fe76b2e54f2c9b9d4903c9684981 (tags/v0.1)

Tagger:

Isaac Meerleo <isaac@itm.works>

Date:

Tue Jul 14 12:52:16 2026 UTC

Message:

ui: unveil ~/.fugu/skills before the startup skills read skills_load() ran in main() before any unveil, with the whole filesystem visible and symlinks followed -- so a symlink planted at ~/.fugu/skills/<name>/SKILL.md was an arbitrary-file read primitive: its first bytes were slurped into a model-visible skill body. Call the (previously dead) skills_unveil() first so the load is pinned to ~/.fugu/skills; unveil checks the resolved target, so an out-of-tree symlink is refused (EACCES) and the skill is silently skipped. In-tree skills are unaffected. The skills dir then joins the front-end's locked unveil set, read-only -- the user's own dir, no runtime code reads it. Behaviour change: skills symlinked OUT of ~/.fugu/skills no longer load (deliberate; that is the read primitive). regress/skills gains test_skills_unveil_confinement: a forked child (the unveil is process-wide and irreversible) plants /real plus /evil whose SKILL.md symlinks to a file outside the skills dir, then asserts skills_unveil + skills_load loads /real but never follows /evil. Verified it fails without the unveil (revert experiment). Found by an adversarial confinement audit of the curses UI worker after its runtime pledge was widened for the conversation drawer.

fugu 0.1