dsh-skill-hub 0.3.24 → 0.3.26

package/lib/index.js

@@ -937,6 +937,17 @@ var SkillHubStore = class {
 	* Upsert one skill into a source record. When the repo has no record yet a
 	* new one is created (root + commit snapshot from the caller).
 	*/
+	/**
+	* Record one imported skill in its repo-level source row.
+	*
+	* A repo owns exactly one source row, hence one pinned ref, so a later import
+	* must re-pin it: keeping the first import's `ref` / `commitSha` makes
+	* `sources/check` compare against a stale sha and `sources/sync` re-download
+	* the old ref over content that was imported from a tag — the "pinning a tag
+	* means nothing" failure of issue #15, reached through the bookkeeping
+	* instead of the download. An absent `ref` means the import ran on the
+	* default branch, which clears the pin rather than silently keeping it.
+	*/
 	async addSourceSkill(repo, root, commitSha, ref, skillName) {
 		await this.ensureLoaded();
 		const existing = this.sourcesByRepo.get(repo);
@@ -949,10 +960,14 @@ var SkillHubStore = class {
 		});
 		else {
 			const skills = existing.skills.includes(skillName) ? existing.skills : [...existing.skills, skillName].sort((a, b) => a.localeCompare(b));
-			this.sourcesByRepo.set(repo, {
+			const next = {
 				...existing,
 				skills
-			});
+			};
+			if (ref !== void 0 && ref !== "") next.ref = ref;
+			else delete next.ref;
+			if (commitSha !== "") next.commitSha = commitSha;
+			this.sourcesByRepo.set(repo, next);
 		}
 		await this.persist();
 	}

package/lib/types/client/api.d.ts

@@ -7,6 +7,28 @@ import { type CatalogResponse, type ConfigResponse, type CreateRequest, type Cre
 export declare class SkillHubApiError extends Error {
     constructor(message: string);
 }
+/**
+ * Resolve one route path against the page's base.
+ *
+ * Every route in this family is registered on the server as a root-absolute
+ * path (`/api/skill-hub/...`), which is right there but wrong in a browser
+ * behind a reverse proxy that owns a path prefix: the page loads from
+ * `https://host/app/dsh/` while a root-absolute URL drops the prefix entirely,
+ * so the gateway answers 404 HTML and `readJson` reports "invalid JSON
+ * response" (issue #18). Resolving against `document.baseURI` is the host's own
+ * convention — `dsh-client-connection` opens its browser carrier with
+ * `new URL(path.slice(1), document.baseURI)` — so a root deployment resolves to
+ * exactly the same absolute path while a prefixed one keeps its prefix, and the
+ * gateway strips it before forwarding: the server still receives
+ * `/api/skill-hub/*`.
+ *
+ * `SKILL_HUB_API_ROOT` must stay absolute (the same constant registers the
+ * routes on the server), which is why the prefix is applied here at the single
+ * outbound boundary rather than in the constants.
+ * @param path - one route path, root-absolute unless it is already a full URL.
+ * @returns the URL to fetch.
+ */
+export declare function resolveApiUrl(path: string): string;
 /** The browser half's only data entry point. */
 export declare class SkillHubApi {
     /** One GET round trip (query already encoded by the caller). */

package/lib/types/store/store.d.ts

@@ -83,6 +83,17 @@ export declare class SkillHubStore {
      * Upsert one skill into a source record. When the repo has no record yet a
      * new one is created (root + commit snapshot from the caller).
      */
+    /**
+     * Record one imported skill in its repo-level source row.
+     *
+     * A repo owns exactly one source row, hence one pinned ref, so a later import
+     * must re-pin it: keeping the first import's `ref` / `commitSha` makes
+     * `sources/check` compare against a stale sha and `sources/sync` re-download
+     * the old ref over content that was imported from a tag — the "pinning a tag
+     * means nothing" failure of issue #15, reached through the bookkeeping
+     * instead of the download. An absent `ref` means the import ran on the
+     * default branch, which clears the pin rather than silently keeping it.
+     */
     addSourceSkill(repo: string, root: string, commitSha: string, ref: string | undefined, skillName: string): Promise<void>;
     /** Replace a source's skill list (used after sync/confirm-delete). */
     setSourceSkills(repo: string, skills: readonly string[]): Promise<SourceRecord | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.24",
+  "version": "0.3.26",
   "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {

package/src/client/api.test.ts

@@ -0,0 +1,51 @@
+/**
+ * Root-absolute route paths must resolve against the page's base, not the site
+ * root: behind a reverse proxy that owns a path prefix (`https://host/app/dsh/`)
+ * a root-absolute URL loses the prefix and the gateway answers 404 HTML — the
+ * `HTTP 404: invalid JSON response` banner in issue #18.
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { SkillHubApi, resolveApiUrl } from './api.ts'
+
+describe('resolveApiUrl (issue #18)', () => {
+  afterEach(() => { vi.unstubAllGlobals() })
+
+  it('resolves to the site root for a plain deployment', () => {
+    vi.stubGlobal('document', { baseURI: 'http://127.0.0.1:3080/' })
+    expect(resolveApiUrl('/api/skill-hub/catalog')).toBe('http://127.0.0.1:3080/api/skill-hub/catalog')
+  })
+
+  it('keeps a reverse proxy path prefix', () => {
+    vi.stubGlobal('document', { baseURI: 'https://host.example.com/app/dsh/' })
+    expect(resolveApiUrl('/api/skill-hub/catalog')).toBe('https://host.example.com/app/dsh/api/skill-hub/catalog')
+  })
+
+  it('passes full URLs through and tolerates a missing document (SSR/tests)', () => {
+    expect(resolveApiUrl('https://cdn.example.com/x.json')).toBe('https://cdn.example.com/x.json')
+    expect(resolveApiUrl('/api/skill-hub/catalog')).toBe('/api/skill-hub/catalog')
+  })
+})
+
+describe('SkillHubApi outbound boundary (issue #18)', () => {
+  afterEach(() => { vi.unstubAllGlobals() })
+
+  it('sends every request through the resolved URL, prefix included', async () => {
+    vi.stubGlobal('document', { baseURI: 'https://host.example.com/app/dsh/' })
+    const seen: string[] = []
+    vi.stubGlobal('fetch', async (url: string) => {
+      seen.push(String(url))
+      return new Response(JSON.stringify({ ok: true, skills: [], disabled: [], diagnostics: [] }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      })
+    })
+
+    const api = new SkillHubApi()
+    await api.catalog()
+
+    // One outbound path for the whole family: the prefix is applied once, here.
+    expect(seen).toHaveLength(1)
+    expect(seen[0]).toBe('https://host.example.com/app/dsh/api/skill-hub/catalog')
+  })
+})

package/src/client/api.ts

@@ -83,6 +83,37 @@ async function readJson<T>(response: Response): Promise<T> {
   return body as T
 }
 
+/**
+ * Resolve one route path against the page's base.
+ *
+ * Every route in this family is registered on the server as a root-absolute
+ * path (`/api/skill-hub/...`), which is right there but wrong in a browser
+ * behind a reverse proxy that owns a path prefix: the page loads from
+ * `https://host/app/dsh/` while a root-absolute URL drops the prefix entirely,
+ * so the gateway answers 404 HTML and `readJson` reports "invalid JSON
+ * response" (issue #18). Resolving against `document.baseURI` is the host's own
+ * convention — `dsh-client-connection` opens its browser carrier with
+ * `new URL(path.slice(1), document.baseURI)` — so a root deployment resolves to
+ * exactly the same absolute path while a prefixed one keeps its prefix, and the
+ * gateway strips it before forwarding: the server still receives
+ * `/api/skill-hub/*`.
+ *
+ * `SKILL_HUB_API_ROOT` must stay absolute (the same constant registers the
+ * routes on the server), which is why the prefix is applied here at the single
+ * outbound boundary rather than in the constants.
+ * @param path - one route path, root-absolute unless it is already a full URL.
+ * @returns the URL to fetch.
+ */
+export function resolveApiUrl(path: string): string {
+  if (!path.startsWith('/')) return path
+  if (typeof document === 'undefined') return path
+  try {
+    return new URL(path.slice(1), document.baseURI).href
+  } catch {
+    return path
+  }
+}
+
 /**
  * Fetch with a hard timeout: a hung connection (proxy, stalled keep-alive,
  * host wedged) must never leave the panel stuck on "loading" forever — it
@@ -92,7 +123,7 @@ async function fetchWithTimeout(input: RequestInfo | URL, init?: RequestInit, ms
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), ms)
   try {
-    return await fetch(input, { ...init, signal: controller.signal })
+    return await fetch(typeof input === 'string' ? resolveApiUrl(input) : input, { ...init, signal: controller.signal })
   } finally {
     clearTimeout(timer)
   }

package/src/store/store.ts

@@ -282,6 +282,17 @@ export class SkillHubStore {
    * Upsert one skill into a source record. When the repo has no record yet a
    * new one is created (root + commit snapshot from the caller).
    */
+  /**
+   * Record one imported skill in its repo-level source row.
+   *
+   * A repo owns exactly one source row, hence one pinned ref, so a later import
+   * must re-pin it: keeping the first import's `ref` / `commitSha` makes
+   * `sources/check` compare against a stale sha and `sources/sync` re-download
+   * the old ref over content that was imported from a tag — the "pinning a tag
+   * means nothing" failure of issue #15, reached through the bookkeeping
+   * instead of the download. An absent `ref` means the import ran on the
+   * default branch, which clears the pin rather than silently keeping it.
+   */
   async addSourceSkill(repo: string, root: string, commitSha: string, ref: string | undefined, skillName: string): Promise<void> {
     await this.ensureLoaded()
     const existing = this.sourcesByRepo.get(repo)
@@ -295,7 +306,11 @@ export class SkillHubStore {
       })
     } else {
       const skills = existing.skills.includes(skillName) ? existing.skills : [...existing.skills, skillName].sort((a, b) => a.localeCompare(b))
-      this.sourcesByRepo.set(repo, { ...existing, skills })
+      const next: SourceRecord = { ...existing, skills }
+      if (ref !== undefined && ref !== '') next.ref = ref
+      else delete next.ref
+      if (commitSha !== '') next.commitSha = commitSha
+      this.sourcesByRepo.set(repo, next)
     }
     await this.persist()
   }

package/src/store.test.ts

@@ -125,6 +125,31 @@ describe('SkillHubStore', () => {
     expect(again[0].manifest).toEqual({ 'skills/docx/SKILL.md': 120 })
   })
 
+  // issue #15 follow-up: one repo owns one source row, hence one pinned ref, so
+  // a later import must re-pin it. Keeping the first import's ref/sha made
+  // `check` compare a stale sha and `sync` re-download the old ref over
+  // tag-pinned content — the same "pinning a tag means nothing" failure.
+  it('re-pins the source to the ref and sha of the latest import', async () => {
+    await store.addSourceSkill('a/b', 'skills', 'sha-main', 'main', 'one')
+    expect(await store.getSource('a/b')).toMatchObject({ ref: 'main', commitSha: 'sha-main' })
+
+    await store.addSourceSkill('a/b', 'skills', 'sha-tag', 'v1.2.0', 'two')
+    expect(await store.getSource('a/b')).toMatchObject({ ref: 'v1.2.0', commitSha: 'sha-tag', skills: ['one', 'two'] })
+
+    // An import from the default branch clears the pin instead of keeping it.
+    await store.addSourceSkill('a/b', 'skills', 'sha-default', undefined, 'three')
+    const unpinned = await store.getSource('a/b')
+    expect(unpinned?.ref).toBeUndefined()
+    expect(unpinned?.commitSha).toBe('sha-default')
+    expect(unpinned?.skills).toEqual(['one', 'three', 'two'])
+
+    // The cleared pin survives the sidecar round trip.
+    const reloaded = new SkillHubStore(file)
+    const persisted = await reloaded.getSource('a/b')
+    expect(persisted?.ref).toBeUndefined()
+    expect(persisted?.commitSha).toBe('sha-default')
+  })
+
   it('drops only the given skill directory from the baseline', async () => {
     await store.addSourceSkill('a/b', 'skills', 'sha-1', undefined, 'docx')
     await store.addSourceSkill('a/b', 'skills', 'sha-1', undefined, 'pdf')