Adom Wiki
Public Made by Adomby adom
How the Adom Wiki (wiki.adom.inc) works and how to drive it with the adom-wiki CLI: the two storage layers (git page repo vs package registry), hosting source by pushing files (not a tarball), making
Private-package existence leaked via dependency rendering on public pages (fixed; design note)
Record of a resolved issue, kept as a design note for future visibility work.
What leaked. A public package's Overview enriched manifest dependency refs straight from the pages table with no viewer check. Example: public adom/brand declared an optional dep on private adom/fonts, and logged-out visitors saw the ref rendered with a SKILL type badge, confirming the private package's existence and leaking its type/brief. First instance of this leak class we have hit.
The subtle part (the oracle). The first fix rendered inaccessible refs as 'unresolved'. Still leaky: the manifest is public content (Files tab + install tarball), so anyone could diff it against the rendered page, and a hidden-or-degraded row would mean 'exists but private'. Selective hiding of private refs is an existence oracle. The only oracle-free rendering is UNIFORM: outsiders get no row/node for ANY ref they cannot resolve, so private and nonexistent are indistinguishable on the page and on the diff.
What shipped (all on prod).
- Overview dep cards, Dependencies tab list, and the graph JSON drop every unresolved-to-viewer ref for outsiders; emptied sections hide entirely.
- Insiders (org members / author / admin) keep unresolved rows so typo'd refs stay debuggable; private targets resolve for them anyway.
- Publish emits a PRIVATE_DEP_REF warning when a PUBLIC manifest names a private package: the name still ships in the public manifest and tarball, so if the name itself is sensitive the only complete fix is not declaring it (or inverting the dependency so the private package depends on the public one). The hint rides only the publish response, never public reads.
Residual truth (by design, cannot be fixed registry-side). A ref declared in a public manifest is published content; the registry cannot redact strings from tarballs people download. Wiki surfaces are sealed; the manifest is the author's explicit choice, now surfaced at publish time.
Rule for future surfaces. Any page/API that resolves a cross-page ref (deps, dependents, breadcrumbs, search enrichment) must gate the ENRICHMENT by viewer, and if it renders unresolved refs, it must render all of them identically or none, never selectively.
Regression coverage: test/security/dep-enrichment-leak.test.mjs (14 asserts: anon/insider x overview/tab/graph). Commits: ca0267b, 7875fa2, bf50296.