fix: resolve critical issues in install.sh, settings.json, and worker-protocol

- install.sh: replace unreachable $? check with `if !` pattern (set -e
  exits before the check runs on Windows mklink failure)
- settings.json: remove fragile Bash deny patterns that can't match across
  path separators; broaden .env denies to recursive **/.env with Read/Write/Edit
- worker-protocol: align QA instruction with qa-checklist — qa_check goes in
  frontmatter envelope, not as a prose line
This commit is contained in:
Bryan Ramos 2026-04-02 07:48:47 -04:00
parent 341f500396
commit b741354dd8
3 changed files with 9 additions and 11 deletions

View file

@ -62,8 +62,7 @@ create_symlink() {
local win_dst local win_dst
win_src="$(cygpath -w "$src")" win_src="$(cygpath -w "$src")"
win_dst="$(cygpath -w "$dst")" win_dst="$(cygpath -w "$dst")"
cmd //c "mklink /D \"$win_dst\" \"$win_src\"" > /dev/null 2>&1 if ! cmd //c "mklink /D \"$win_dst\" \"$win_src\"" > /dev/null 2>&1; then
if [ $? -ne 0 ]; then
echo "ERROR: mklink failed for $name." echo "ERROR: mklink failed for $name."
echo "On Windows, enable Developer Mode (Settings > Update & Security > For Developers)" echo "On Windows, enable Developer Mode (Settings > Update & Security > For Developers)"
echo "or run this script as Administrator." echo "or run this script as Administrator."
@ -104,8 +103,7 @@ create_file_symlink() {
local win_dst local win_dst
win_src="$(cygpath -w "$src")" win_src="$(cygpath -w "$src")"
win_dst="$(cygpath -w "$dst")" win_dst="$(cygpath -w "$dst")"
cmd //c "mklink \"$win_dst\" \"$win_src\"" > /dev/null 2>&1 if ! cmd //c "mklink \"$win_dst\" \"$win_src\"" > /dev/null 2>&1; then
if [ $? -ne 0 ]; then
echo "ERROR: mklink failed for $name." echo "ERROR: mklink failed for $name."
echo "On Windows, enable Developer Mode (Settings > Update & Security > For Developers)" echo "On Windows, enable Developer Mode (Settings > Update & Security > For Developers)"
echo "or run this script as Administrator." echo "or run this script as Administrator."

View file

@ -19,18 +19,18 @@
"Read(~/.ssh/**)", "Read(~/.ssh/**)",
"Read(~/.aws/**)", "Read(~/.aws/**)",
"Read(~/.gnupg/**)", "Read(~/.gnupg/**)",
"Read(./.env)", "Read(**/.env)",
"Read(./.env.*)", "Read(**/.env.*)",
"Write(~/.ssh/**)", "Write(~/.ssh/**)",
"Write(~/.aws/**)", "Write(~/.aws/**)",
"Write(~/.gnupg/**)", "Write(~/.gnupg/**)",
"Write(**/.env)",
"Write(**/.env.*)",
"Edit(~/.ssh/**)", "Edit(~/.ssh/**)",
"Edit(~/.aws/**)", "Edit(~/.aws/**)",
"Edit(~/.gnupg/**)", "Edit(~/.gnupg/**)",
"Bash(*.ssh/*)", "Edit(**/.env)",
"Bash(*.aws/*)", "Edit(**/.env.*)"
"Bash(*.gnupg/*)",
"Bash(*.env*)"
], ],
"ask": [ "ask": [
"Bash(rm *)", "Bash(rm *)",

View file

@ -41,7 +41,7 @@ Produce the assigned deliverable. Accurately. Completely. Nothing more.
## Self-QA ## Self-QA
Before returning your output, run the `qa-checklist` skill against your work. Fix any issues you find — don't just note them. Your Self-Assessment must include the `QA self-check: pass/fail` line. If you can't pass your own QA, flag what remains and why. Before returning your output, run the `qa-checklist` skill against your work. Fix any issues you find — don't just note them. Set `qa_check: pass` or `qa_check: fail` in your frontmatter envelope. If you can't pass your own QA, flag what remains and why in your Self-Assessment.
## Cost sensitivity ## Cost sensitivity