From 38b2ffe53d99754b9393f7c832beed8ff007d2f9 Mon Sep 17 00:00:00 2001 From: Alex Verkhovsky Date: Tue, 21 Apr 2026 23:55:32 -0700 Subject: [PATCH] fix(quick-dev): scope render/ whitelist to bmad-quick-dev The previous INSTALL_ONLY_PATHS entry 'render/' was a blanket prefix that let every {project-root}/_bmad/render/... reference in any skill slip past validation. Narrow to 'render/bmad-quick-dev/' so only this skill's render buffer is whitelisted. Future skills adopting the stdout-dispatch renderer pattern add their own entries explicitly. Part of plan-quick-dev-python-config-hardening.md (F6). Co-Authored-By: Claude Opus 4.7 (1M context) --- tools/validate-file-refs.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/validate-file-refs.js b/tools/validate-file-refs.js index 14835de81..31d5db83c 100644 --- a/tools/validate-file-refs.js +++ b/tools/validate-file-refs.js @@ -80,7 +80,7 @@ function escapeTableCell(str) { } // Path prefixes/patterns that only exist in installed structure, not in source -const INSTALL_ONLY_PATHS = ['_config/', 'custom/', 'render/']; +const INSTALL_ONLY_PATHS = ['_config/', 'custom/', 'render/bmad-quick-dev/']; // Files that are generated at install time and don't exist in the source tree const INSTALL_GENERATED_FILES = ['config.yaml', 'config.user.yaml'];