@xiashe/skill 0.1.26 → 0.1.27

package/README.md

@@ -44,9 +44,9 @@ node packages/xiashe-skill-cli/bin/xiashe-skill.mjs snippet . --target js
 node packages/xiashe-skill-cli/bin/xiashe-skill.mjs track . --event skill_invoked --hub red --dry-run --json
 ```
 
-Use the `claimUrl` returned with a dashboard dynamic code exactly as issued. `publish` runs the same preflight automatically before it consumes a code: it verifies the exact registry origin, protocol version, and environment id exposed by that deployment. A dynamic code without an explicit `--claim-url` is rejected before the code is consumed, so development, CN, and global codes cannot accidentally be sent to the production registry. For an existing Skill update, use the single public `--registry-origin https://<registry-host>` option. The CLI derives its routes, compares that origin and the registry environment id with the local private manifest, and stops before writing or uploading when they differ. Do not copy individual internal endpoint overrides into an update task.
+Use the `claimUrl` returned with a dashboard dynamic code exactly as issued. `publish` validates that destination before it consumes a code, so a code cannot accidentally be sent to a different service. For an existing Skill update, run the normal publish command from the original project folder. The CLI reads and validates its saved local connection before it writes or uploads anything. Do not copy internal endpoint options into a user-facing update task.
 
-When an existing project was originally linked through XiaShe, `@agentpie/skill publish` may adopt its `.xiashe/xiashe.skill.json` only for an update without a dynamic code or explicit public token. The legacy manifest must identify itself as XiaShe and contain its saved registry origin and environment. The CLI verifies both, then writes a separate `.agentpie/agentpie.skill.json`; the XiaShe manifest is retained. A missing value or mismatch stops before a manifest write or package upload, so development, CN, and global Skill identities stay isolated.
+When an existing project was originally linked through XiaShe, `@agentpie/skill publish` can reuse that local connection only for an update without a dynamic code or public token. It validates the recorded connection first, then creates a separate AgentPie local connection while retaining the XiaShe original. If it cannot verify the link, it stops before changing files or uploading a package. This keeps distinct services isolated without asking users to understand internal deployment details.
 
 ## Reliable publish and recovery
 

package/bin/xiashe-skill.mjs

@@ -68,7 +68,7 @@ function isTransportError(error) {
 }
 
 const LOCAL_ENV_DEFAULTS = loadLocalEnvDefaults();
-const VERSION = process.env.XIASHE_SKILL_CLI_VERSION || '0.1.25';
+const VERSION = process.env.XIASHE_SKILL_CLI_VERSION || '0.1.27';
 const COMMAND_NAME = process.env.XIASHE_SKILL_CLI_NAME || 'xiashe-skill';
 const PRODUCT_NAME = process.env.XIASHE_SKILL_PRODUCT_NAME || (COMMAND_NAME === 'agentpie-skill' ? 'AgentPie' : 'XiaShe');
 const REGISTRY_PROVIDER = process.env.XIASHE_SKILL_REGISTRY_PROVIDER || (COMMAND_NAME === 'agentpie-skill' ? 'agentpie' : 'xiashe');
@@ -341,7 +341,7 @@ Usage:
 Options:
   --public-token <token>      Public write token issued by ${PRODUCT_NAME} registry.
   --code <dynamic-code>       One-time ${PRODUCT_NAME} dashboard code used to claim registry identity.
-  --registry-origin <url>     Existing Skill update origin. Derives all registry routes and verifies the saved environment.
+  --registry-origin <url>     Advanced recovery option for an existing Skill. Normal updates do not need it.
   --claim-url <url>           Code claim endpoint. Defaults to XIASHE_SKILL_CLAIM_URL or ${DEFAULT_CLAIM_URL}
   --registry-doctor-url <url> Registry preflight endpoint. Defaults to the claim URL origin.
   --skill-id <id>             Public ${PRODUCT_NAME} Skill registry id.
@@ -543,7 +543,7 @@ function latestVersionEndpoint(inspectedOrRegistry = {}) {
   // Existing Skills must keep checking the registry that originally issued
   // their manifest. Falling back to a CLI default here would make a dev
   // package discover Global/CN updates after a machine-level config change.
-  const registryOrigin = normalizeBaseUrl(registry.registryOrigin) || DEFAULT_BASE_URL;
+  const registryOrigin = resolveStoredRegistryOrigin(registry) || DEFAULT_BASE_URL;
   const params = new URLSearchParams();
   if (publicSkillId) {
     params.set('publicSkillId', publicSkillId);
@@ -990,13 +990,13 @@ async function resolveExistingSkillRoot(root, flags = {}) {
   }
   if (candidates.length > 1) {
     throw new Error(
-      'CREATOR_SKILL_MANIFEST_AMBIGUOUS: more than one matching local Skill connection was found. ' +
-      'The CLI did not update or create any Skill. Run the command from the intended Skill folder.'
+      'CREATOR_SKILL_SOURCE_AMBIGUOUS: more than one Skill project matches this update. ' +
+      'No Skill was changed. Run this task from the intended Skill project folder.'
     );
   }
   throw new Error(
-    'CREATOR_SKILL_MANIFEST_NOT_FOUND: no matching local Skill connection was found in this project. ' +
-    'The CLI did not update or create any Skill. Run the command from the original Skill folder.'
+    'CREATOR_SKILL_SOURCE_NOT_FOUND: this task does not include the original Skill project. ' +
+    'No Skill was created or changed. Add that project folder and retry.'
   );
 }
 
@@ -1123,11 +1123,14 @@ function claimUrlForCode(flags = {}) {
 }
 
 function claimUrlForExistingManifest(flags = {}, registry = {}) {
-  return (
-    explicitClaimUrl(flags) ||
-    claimUrlFromRegistryOrigin(registry.registryOrigin) ||
-    DEFAULT_CLAIM_URL
-  );
+  const claimUrl = explicitClaimUrl(flags) || claimUrlFromRegistryOrigin(resolveStoredRegistryOrigin(registry));
+  if (!claimUrl) {
+    throw new Error(
+      'CREATOR_SKILL_CONNECTION_UNVERIFIABLE: this local Skill connection cannot be verified safely. ' +
+      'No Skill was created or changed. Add the original Skill project folder and retry.'
+    );
+  }
+  return claimUrl;
 }
 
 function normalizeRegistryOrigin(value) {
@@ -1154,6 +1157,55 @@ function registryOriginFromFlags(flags = {}) {
   return normalizeRegistryOrigin(flags['registry-origin']);
 }
 
+const STORED_REGISTRY_ENDPOINT_PATHS = new Set([
+  '/registry/skill/claim',
+  '/registry/skill-events',
+  '/registry/agent-ack',
+  '/registry/skill/latest',
+  '/registry/skill/package-upload-url',
+  '/registry/skill/package-status'
+]);
+
+function registryOriginFromStoredEndpoint(value) {
+  const raw = normalizeText(value, 2_000);
+  if (!raw) return '';
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return '';
+  }
+  if (url.username || url.password || url.hash) return '';
+  const pathname = url.pathname.replace(/\/+$/, '') || '/';
+  if (!STORED_REGISTRY_ENDPOINT_PATHS.has(pathname)) return '';
+  try {
+    return normalizeRegistryOrigin(url.origin);
+  } catch {
+    return '';
+  }
+}
+
+function resolveStoredRegistryOrigin(registry = {}) {
+  const directOrigin = normalizeBaseUrl(registry.registryOrigin);
+  if (directOrigin) {
+    try {
+      return normalizeRegistryOrigin(directOrigin);
+    } catch {
+      return '';
+    }
+  }
+  for (const endpoint of [
+    registry.claimUrl,
+    registry.registryUrl,
+    registry.agentAckUrl,
+    registry.latestVersionEndpoint
+  ]) {
+    const origin = registryOriginFromStoredEndpoint(endpoint);
+    if (origin) return origin;
+  }
+  return '';
+}
+
 function applyRegistryOriginFlags(flags = {}) {
   const registryOrigin = registryOriginFromFlags(flags);
   if (!registryOrigin) return flags;
@@ -1572,15 +1624,15 @@ async function uploadXiashePackageArtifact(root, flags, manifestResult) {
   // to the production registry, then verify that origin before any write.
   const claimUrl = claimUrlForExistingManifest(flags, registry);
   const registryPreflight = await preflightRegistryClaim(claimUrl, flags);
-  const expectedRegistryOrigin = normalizeBaseUrl(registry.registryOrigin);
+  const expectedRegistryOrigin = resolveStoredRegistryOrigin(registry);
   const expectedEnvironmentId = normalizeText(registry.environmentId, 160);
   if (
     (expectedRegistryOrigin && expectedRegistryOrigin !== registryPreflight.registryOrigin) ||
     (expectedEnvironmentId && expectedEnvironmentId !== registryPreflight.environmentId)
   ) {
     throw new Error(
-      'CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: the local manifest belongs to a different registry environment. ' +
-      'Do not upload or claim a new code; switch to the original environment or start a new dashboard task.'
+      'CREATOR_SKILL_CONNECTION_MISMATCH: this project is linked to a different Skill service. ' +
+      'No package was uploaded.'
     );
   }
   const uploadTicket =
@@ -1712,22 +1764,25 @@ async function inspectSkill(root, flags = {}) {
 async function writeManifest(root, flags) {
   const inspected = await inspectSkill(root, flags);
   const code = normalizeText(flags.code, 80);
-  const existingRegistry = inspected.registry || {};
-  const savedRegistryOrigin = normalizeBaseUrl(existingRegistry.registryOrigin);
+  const rawExistingRegistry = inspected.registry || {};
+  const savedRegistryOrigin = resolveStoredRegistryOrigin(rawExistingRegistry);
+  const existingRegistry = savedRegistryOrigin && rawExistingRegistry.registryOrigin !== savedRegistryOrigin
+    ? { ...rawExistingRegistry, registryOrigin: savedRegistryOrigin }
+    : rawExistingRegistry;
   const savedEnvironmentId = normalizeText(existingRegistry.environmentId, 160);
   const requestedRegistryOrigin = registryOriginFromFlags(flags);
   const suppliedPublicToken = normalizeText(flags['public-token'], 512);
   const isLegacyXiaSheMigration = inspected.manifestSource === 'legacy_xiashe';
   if (
     isLegacyXiaSheMigration &&
-    (existingRegistry.provider !== 'xiashe' || !savedRegistryOrigin || !savedEnvironmentId)
+    (existingRegistry.provider !== 'xiashe' || !savedRegistryOrigin)
   ) {
     throw new Error(
-      'CREATOR_SKILL_LEGACY_MANIFEST_UNVERIFIABLE: this XiaShe local connection does not contain a verifiable registry origin and environment. ' +
-      'No AgentPie manifest was written. Update from the original XiaShe connection or attach the Skill explicitly.'
+      'CREATOR_SKILL_LEGACY_CONNECTION_UNVERIFIABLE: this older XiaShe Skill connection cannot be verified safely. ' +
+      'No AgentPie Skill was created or changed. Use the original Skill project folder and refresh its connection before updating.'
     );
   }
-  if (!code && suppliedPublicToken && !explicitClaimUrl(flags) && !claimUrlFromRegistryOrigin(existingRegistry.registryOrigin)) {
+  if (!code && suppliedPublicToken && !explicitClaimUrl(flags) && !savedRegistryOrigin) {
     throw new Error(
       'CREATOR_SKILL_CLAIM_URL_REQUIRED: a new manifest created from --public-token must include --claim-url. ' +
       'Existing manifests resume through their saved registry origin.'
@@ -1735,19 +1790,20 @@ async function writeManifest(root, flags) {
   }
   if (!code && !savedRegistryOrigin && !requestedRegistryOrigin) {
     throw new Error(
-      'CREATOR_SKILL_REGISTRY_ORIGIN_REQUIRED: existing Skill updates must include --registry-origin so the CLI can verify the original environment before writing or uploading.'
+      'CREATOR_SKILL_CONNECTION_UNVERIFIABLE: this local Skill connection cannot be verified safely. ' +
+      'No Skill was created or changed. Add the original Skill project folder and retry.'
     );
   }
   if (!code && savedRegistryOrigin && requestedRegistryOrigin && savedRegistryOrigin !== requestedRegistryOrigin) {
-    throw new Error('CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: the supplied registry origin differs from the original Skill manifest. No files were changed.');
+    throw new Error('CREATOR_SKILL_CONNECTION_MISMATCH: this project is linked to a different Skill service. No files were changed.');
   }
   const claimUrl = code ? claimUrlForCode(flags) : claimUrlForExistingManifest(flags, existingRegistry);
   const registryPreflight = await preflightRegistryClaim(claimUrl, flags);
   if (!code && savedRegistryOrigin && savedRegistryOrigin !== registryPreflight.registryOrigin) {
-    throw new Error('CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: the saved Skill manifest belongs to a different registry origin. No files were changed.');
+    throw new Error('CREATOR_SKILL_CONNECTION_MISMATCH: this project is linked to a different Skill service. No files were changed.');
   }
   if (!code && savedEnvironmentId && savedEnvironmentId !== registryPreflight.environmentId) {
-    throw new Error('CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: the saved Skill manifest belongs to a different registry environment. No files were changed.');
+    throw new Error('CREATOR_SKILL_CONNECTION_MISMATCH: this project is linked to a different Skill service. No files were changed.');
   }
   const claim = code
     ? await postJson(
@@ -1778,12 +1834,15 @@ async function writeManifest(root, flags) {
     const claimEnvironment = normalizeText(claim.registry?.environmentId, 160);
     const claimOrigin = normalizeBaseUrl(claim.registry?.registryOrigin);
     if (claimEnvironment !== registryPreflight.environmentId || claimOrigin !== registryPreflight.registryOrigin) {
-      throw new Error('CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: the claimed Skill identity was returned by a different registry environment. No package upload was attempted.');
+      throw new Error('CREATOR_SKILL_CONNECTION_MISMATCH: the returned Skill identity does not match this local connection. No package upload was attempted.');
     }
   }
   const publicToken = normalizeText(flags['public-token'] || claim?.publicToken || existingRegistry.publicToken, 512);
   if (!publicToken) {
-    throw new Error('Missing --code or --public-token.');
+    throw new Error(
+      'CREATOR_SKILL_CONNECTION_UNVERIFIABLE: this local Skill connection cannot be verified safely. ' +
+      'No Skill was created or changed. Add the original Skill project folder and retry.'
+    );
   }
   const now = new Date().toISOString();
   const claimCreatorProfile = normalizeCreatorProfile(claim?.creatorProfile);
@@ -3508,7 +3567,7 @@ async function setupAgentWorkflow(root, flags) {
         ? 'An existing local Skill connection was found automatically; no new registry entry was created.'
         : null,
       manifestResult.adoptedLegacyXiaSheManifest
-        ? 'A compatible XiaShe local connection was reused after the registry origin and environment check; a separate AgentPie manifest was created.'
+        ? 'A compatible XiaShe local connection was reused safely; a separate AgentPie local connection was created.'
         : null,
       firstPartyPackageArtifact?.skipped
         ? `${PRODUCT_NAME} complete package upload was skipped (${firstPartyPackageArtifact.reason}).`
@@ -3573,10 +3632,8 @@ async function main() {
         flags
       );
       print(flags.json ? result : [
-        `${PRODUCT_NAME} registry preflight passed.`,
-        `Environment: ${result.environmentId}`,
-        `Registry: ${result.registryOrigin}`,
-        `Protocol: ${result.protocolVersion}`
+        `${PRODUCT_NAME} preflight passed.`,
+        'Connection verified.'
       ].join('\n'), flags.json);
       return;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/skill",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "type": "module",
   "bin": {
     "xiashe-skill": "bin/xiashe-skill.mjs"