Follow-up to #100: fix CodeQL finding, externalize the bridge marker

src/chock/scaffold/data/bridge_marker.txt

@@ -0,0 +1,3 @@
+This directory is a Chock bridge copy of the same-named skill in .agents/skills/.
+Do not edit it here -- edit the canonical copy; this one is regenerated on every
+`chock sync`. Safe to delete for the same reason: sync recreates it.

src/chock/scaffold/init.py

@@ -22,7 +22,7 @@
 from chock.scaffold.agents_md import update_agents_md
 from chock.scaffold.recompile import BookkeepingError, recompile
 from chock.scaffold.templates import (
-    _GITATTRIBUTES_TEMPLATE,
+    GITATTRIBUTES_TEMPLATE,
     _dependency_allowlist_template,
     _preserve_or_write,
     packaged_template,
@@ -167,7 +167,7 @@ def cmd_init(argv: list[str] | None = None) -> int:
     _write_agents_md(repo_root, args.force)
     if _preserve_or_write(repo_root / "docs" / "README.md", packaged_template("docs/README.md"), args.force):
         preserved.append("docs/README.md")
-    if _preserve_or_write(repo_root / ".gitattributes", _GITATTRIBUTES_TEMPLATE, args.force):
+    if _preserve_or_write(repo_root / ".gitattributes", GITATTRIBUTES_TEMPLATE, args.force):
         preserved.append(".gitattributes")
     preserved += write_vendored_guardrails(repo_root, args.force)
     _write_config(repo_root, agents, args.agent_agnostic)

src/chock/scaffold/skills_bridge.py

@@ -8,16 +8,15 @@
 import sys
 from pathlib import Path
 
+from chock.resources import package_data_dir
+
 AGENT_BRIDGES: dict[str, str] = {
     "claude": ".claude/skills",
 }
 
 _BRIDGE_MARKER = ".chock-bridge"
-_BRIDGE_MARKER_BODY = (
-    "This directory is a Chock bridge copy of the same-named skill in .agents/skills/.\n"
-    "Do not edit it here -- edit the canonical copy; this one is regenerated on every\n"
-    "`chock sync`. Safe to delete for the same reason: sync recreates it.\n"
-)
+_SCAFFOLD_DATA_DIR = package_data_dir("chock.scaffold", "data")
+_BRIDGE_MARKER_BODY = _SCAFFOLD_DATA_DIR.joinpath("bridge_marker.txt").read_text(encoding="utf-8")
 
 
 def _is_correct_symlink(link: Path, target: Path) -> bool:

src/chock/scaffold/templates.py

@@ -21,7 +21,7 @@ def _dependency_allowlist_template() -> str:
 
 
 _SCAFFOLD_DATA_DIR = package_data_dir("chock.scaffold", "data")
-_GITATTRIBUTES_TEMPLATE = _SCAFFOLD_DATA_DIR.joinpath("gitattributes.txt").read_text(encoding="utf-8")
+GITATTRIBUTES_TEMPLATE = _SCAFFOLD_DATA_DIR.joinpath("gitattributes.txt").read_text(encoding="utf-8")
 POLICIES_GUARDRAIL = _SCAFFOLD_DATA_DIR.joinpath("policies_guardrail.md").read_text(encoding="utf-8")
 SKILLS_GUARDRAIL = _SCAFFOLD_DATA_DIR.joinpath("skills_guardrail.md").read_text(encoding="utf-8")
 

tests/test_template_tokens.py

@@ -88,14 +88,15 @@ def test_runtime_bundle_dispatch_template_token() -> None:
 
 def test_static_templates_carry_no_orphan_tokens() -> None:
     """Templates with no placeholders at all must stay that way."""
-    from chock.scaffold import agents_md, install_ci, templates
+    from chock.scaffold import agents_md, install_ci, skills_bridge, templates
 
     for text in (
         install_ci.WORKFLOW_TEMPLATE,
-        templates._GITATTRIBUTES_TEMPLATE,
+        templates.GITATTRIBUTES_TEMPLATE,
         templates.POLICIES_GUARDRAIL,
         templates.SKILLS_GUARDRAIL,
         agents_md.POINTER_BLOCK,
+        skills_bridge._BRIDGE_MARKER_BODY,
         runtime_bundle._IMPORTS,
         runtime_bundle._SESSION_START_BRANCH,
         runtime_bundle._SESSION_START_ORCHESTRATION,