fix(workspace): a project with no git does not publish from /

Ralph's one open item on the re-review, traced independently by CodeRabbit
and Codex. `Project.fromDirectory` sets the worktree to the sentinel `/`
for a project with no git; `workdir(api)` returned it unchanged, so the
TUI's containment boundary was `/` and any discovered skill on the machine
passed. The TUI now falls back to the session directory, as the CLI
already did — and `assertProjectSkill` refuses a filesystem root as a
boundary outright, so the next caller that forgets cannot reopen this.

Also, cubic's optional one: parent traversal is tested exactly (`..` or
`../…`), so a directory literally named `..foo` under the root is inside.

Verified: 668 pass across the workspace, plugin, fork-guard and skill
suites, typecheck clean. Mutation-checked: accepting a root of `/`, and
refusing `..foo`, each fail a test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

Author: sahrizvi

packages/opencode/src/altimate/workspace/skill-publish.ts

@@ -789,8 +789,15 @@ function updateConflict(err: ConflictError, skillName: string): Error {
   return err
 }
 
-/** The skill's real directory, once it has passed. */
-function assertProjectSkill(projectRoot: string, skillDirectory: string): string {
+/** The skill's real directory, once it has passed. Exported for its test:
+ * the boundary rule has to hold for every caller, and a root of `/` — the
+ * sentinel a project with no git carries — is not a boundary at all. */
+export function assertProjectSkill(projectRoot: string, skillDirectory: string): string {
+  // A filesystem root would contain everything. Both callers substitute the
+  // session directory for the `/` sentinel; this refuses it in case one
+  // forgets, since the failure mode is publishing anything on the machine.
+  if (path.resolve(projectRoot) === path.parse(path.resolve(projectRoot)).root)
+    throw new NotProjectSkillError(skillDirectory)
   const lexical = path.resolve(skillDirectory)
   let real: string
   try {
@@ -817,7 +824,10 @@ function assertProjectSkill(projectRoot: string, skillDirectory: string): string
     root = path.resolve(projectRoot)
   }
   const rel = path.relative(root, real)
-  if (rel.startsWith("..") || path.isAbsolute(rel)) throw new NotProjectSkillError(skillDirectory)
+  // Parent traversal exactly, not any name that begins with two dots: a
+  // skill directory literally named `..foo` is inside the project.
+  if (rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel))
+    throw new NotProjectSkillError(skillDirectory)
   return real
 }
 

packages/opencode/src/plugin/tui/altimate/skill-ops.tsx

@@ -573,8 +573,10 @@ function openActionPicker(api: TuiPluginApi, info: SkillInfo | undefined, skillN
   // `workdir` resolves to, and the two differ in a worktree subdirectory.
   const projectDirectory = api.state.path.directory || workdir(api)
   // The boundary a skill must lie within: the worktree, since discovery
-  // walks up to it. `workdir` already resolves that.
-  const projectRoot = workdir(api)
+  // walks up to it — EXCEPT for a project with no git, where the worktree
+  // is the sentinel `/` and `workdir` returns it unchanged. A root of `/`
+  // would accept any skill on the machine. Same fallback as the CLI.
+  const projectRoot = api.state.path.worktree === "/" ? projectDirectory : workdir(api)
   const managed = !isBuiltin && isManagedSkill(projectDirectory, path.dirname(info!.location))
 
   const actions: TuiDialogSelectOption<string>[] = (

packages/opencode/test/altimate/workspace/skill-publish.test.ts

@@ -49,6 +49,7 @@ const {
   NotLinkedError,
   SkillNameConflictError,
   SymlinkError,
+  assertProjectSkill,
   collectBundle,
   describePublish,
   explainPublishError,
@@ -677,6 +678,29 @@ describe("what counts as a project skill", () => {
     expect(report.action).toBe("created")
   })
 
+  test("a root of `/` is no boundary: the session directory must be the fallback", () => {
+    // A project with no git carries the sentinel worktree `/`. Passed through
+    // as the boundary, it contains every skill on the machine — a parent
+    // directory's `.opencode/skills/x`, an absolute `skills.paths` entry.
+    // Ralph traced it on the TUI, where `workdir` returned `/` unchanged;
+    // the shared path refuses it too, for the next caller that forgets.
+    const elsewhere = mkdtempSync(path.join(SANDBOX, "elsewhere-"))
+    writeFileSync(path.join(elsewhere, "SKILL.md"), "---\nname: x\n---\n")
+    expect(() => assertProjectSkill("/", elsewhere)).toThrow(NotProjectSkillError)
+    // The same skill against the session directory: outside it, refused;
+    // inside it, allowed.
+    expect(() => assertProjectSkill(project, elsewhere)).toThrow(NotProjectSkillError)
+    expect(assertProjectSkill(project, skillDir)).toBe(realpathSync(skillDir))
+  })
+
+  test("a directory named with two leading dots is still inside the project", () => {
+    // Directly under the root, so `path.relative` is `..foo` itself — the
+    // one spelling a `startsWith("..")` check mistakes for traversal.
+    const odd = path.join(project, "..foo")
+    mkdirSync(odd, { recursive: true })
+    expect(assertProjectSkill(project, odd)).toBe(realpathSync(odd))
+  })
+
   test("a skill outside the project is refused", async () => {
     // A personal skill under the home directory is the user's, not this
     // project's, and publishing would share it with the whole workspace.