fix(sleep): confine per-skill adoption to the staged skills roots

[Yifan Yang (Yif-Yang)]

Follow-up to #212 (merged as faf4700).

The gap

_safe_live_path is the only filter on a per-skill live target at adopt time. It proves the path is absolute, traversal-free, ~-free, control-char-free and *.md — but it accepts any such path on the machine. skill_proposal_rows adds basename == "SKILL.md" and basename(parent) == skill_name, which is a shape check, not a location check.

_path_is_within already exists in staging.py and _contained_skill_file in skill_resolver.py does containment correctly — but neither ever reaches the live write target. staging.py does not import skill_resolver.

So a manifest.json whose live_skill_path / live_realpath / live_sha256 are edited self-consistently passes every existing check and redirects the adopt write onto an arbitrary file. I reproduced both cases against the merged code:

• overwrite an existing file outside any skills root — succeeds
• create a new file in an existing directory outside any skills root — succeeds

(Creating a whole new directory tree is already refused: live parent directory for 'alpha' does not exist. The blast radius is "any existing directory", not "anywhere".)

This is not remote-triggerable — it needs local write access to the staging manifest — but the manifest is explicitly treated as untrusted everywhere else in this file (schema versioning, fail-closed parsing, hash pinning, symlink rejection). Containment was the one property left unenforced.

The fix

1. write_staging records the resolved skills roots in the manifest as skill_roots. The cycle passes skill_search_roots(cfg). Low-level callers that don't know the roots get them derived from the just-resolved <root>/<name>/SKILL.md paths — at stage time, from paths we resolved ourselves, never from the manifest that will later be trusted.
2. staged_skill_roots reads them back with validation. A manifest without recorded roots fails closed with an explicit "discard and restage" message, so nights staged by the previous version cannot silently adopt unconfined.
3. _adopt_live_target_ok re-checks each live target against those roots — placed after the existing realpath(live) == live identity check, so a symlinked ancestor cannot fake containment. Ordering matters here and the comment says so.

Validation

• 1348 passed, 10 skipped, 269 subtests — full suite on this branch (1344 on main before it; +4 new).
• New TestAdoptionIsConfinedToTheStagedRoots covers both reproduced exploits (asserting the victim file is byte-identical / never created), the missing-roots fail-closed path, and that ordinary in-root adoption still succeeds.
• Negative control: disabling just the new guard makes exactly the two exploit tests fail and the other two pass — confirming they exercise the new check rather than being incidentally caught by a pre-existing one.
• ruff check clean on all three changed files.

Thanks Bogdan (Dan) Baciu (@bogdanbaciu21) — the surrounding symlink/TOCTOU/WAL hardening in #212 is genuinely strong work; this closes the one remaining property.

🤖 Generated with Claude Code