@xiashe/skill 0.1.21 → 0.1.23
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -1
- package/bin/xiashe-skill.mjs +657 -121
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -31,7 +31,8 @@ The user-facing product flow should point creators at the official publish Markd
|
|
|
31
31
|
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs --help
|
|
32
32
|
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs inspect .
|
|
33
33
|
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs doctor .
|
|
34
|
-
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs
|
|
34
|
+
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs preflight --claim-url https://<registry-host>/registry/skill/claim --json
|
|
35
|
+
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs publish . --code XS-XXXX-XXXX --claim-url https://<registry-host>/registry/skill/claim --to xiashe,red
|
|
35
36
|
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs setup . --code XS-XXXX-XXXX --hub all
|
|
36
37
|
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs setup . --code XS-XXXX-XXXX --hub red
|
|
37
38
|
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs verify . --hub red --dry-run --json
|
|
@@ -42,3 +43,17 @@ node packages/xiashe-skill-cli/bin/xiashe-skill.mjs prompt . --hub red --source-
|
|
|
42
43
|
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs snippet . --target js
|
|
43
44
|
node packages/xiashe-skill-cli/bin/xiashe-skill.mjs track . --event skill_invoked --hub red --dry-run --json
|
|
44
45
|
```
|
|
46
|
+
|
|
47
|
+
Use the `claimUrl` returned with a dashboard dynamic code exactly as issued. `publish` runs the same preflight automatically before it consumes a code: it verifies the exact registry origin, protocol version, and environment id exposed by that deployment. A dynamic code without an explicit `--claim-url` is rejected before the code is consumed, so development, CN, and global codes cannot accidentally be sent to the production registry. For a resumed upload, the CLI uses the registry origin stored in the local private manifest and preflights it again.
|
|
48
|
+
|
|
49
|
+
## Reliable publish and recovery
|
|
50
|
+
|
|
51
|
+
The publish path keeps three different values separate:
|
|
52
|
+
|
|
53
|
+
- **Source fingerprint** — a stable SHA-256 of reviewed Skill source files. It is the idempotency key for the publish job.
|
|
54
|
+
- **Artifact checksum** — SHA-256 of the generated `.tgz` bytes. The backend compares it only with storage's checksum for those exact bytes.
|
|
55
|
+
- **Storage checksum** — the checksum reported after upload. It must match the artifact checksum; it is never compared with the source fingerprint.
|
|
56
|
+
|
|
57
|
+
If the network breaks after the server receives a dynamic-code claim, rerun the exact same `publish` command before that code expires. The registry accepts only the same code and source fingerprint, returns the original local manifest credentials, and reuses the same package job. It never creates a second Skill or a second upload job. Do not generate a new dashboard code merely because a local HTTP response was interrupted.
|
|
58
|
+
|
|
59
|
+
If an upload has already started, rerun the same command. The CLI queries the existing package job first and either reports success, waits for processing, or resumes the failed upload with the same public token and source fingerprint.
|