dsh-skill-hub 0.3.25 → 0.3.26

package/CONTRIBUTING.md

@@ -39,7 +39,7 @@ src/client/locales/     dictionaries by view (common/skills/market/sources/detai
 ```bash
 npm install
 npm run typecheck   # tsc --noEmit
-npm test            # vitest (294 tests across 16 suites)
+npm test            # vitest (295 tests across 16 suites)
 npm run build       # tsc declarations + tsdown bundles (lib/index.js + lib/client.js)
 ```
 

package/README.md

@@ -108,7 +108,7 @@ Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemP
 
 ```bash
 npm run typecheck  # tsc --noEmit
-npm test           # 294 tests, 16 suites
+npm test           # 295 tests, 16 suites
 npm run build      # tsc + tsdown → lib/index.js + lib/client.js
 ```
 

package/README.zh.md

@@ -108,7 +108,7 @@ GitHub 仓库 ──扫描/导入──▶ ~/.dsh/skills
 
 ```bash
 npm run typecheck  # tsc --noEmit
-npm test           # 294 tests, 16 suites
+npm test           # 295 tests, 16 suites
 npm run build      # tsc + tsdown → lib/index.js + lib/client.js
 ```
 

package/lib/index.js

@@ -937,6 +937,17 @@ var SkillHubStore = class {
 	* Upsert one skill into a source record. When the repo has no record yet a
 	* new one is created (root + commit snapshot from the caller).
 	*/
+	/**
+	* Record one imported skill in its repo-level source row.
+	*
+	* A repo owns exactly one source row, hence one pinned ref, so a later import
+	* must re-pin it: keeping the first import's `ref` / `commitSha` makes
+	* `sources/check` compare against a stale sha and `sources/sync` re-download
+	* the old ref over content that was imported from a tag — the "pinning a tag
+	* means nothing" failure of issue #15, reached through the bookkeeping
+	* instead of the download. An absent `ref` means the import ran on the
+	* default branch, which clears the pin rather than silently keeping it.
+	*/
 	async addSourceSkill(repo, root, commitSha, ref, skillName) {
 		await this.ensureLoaded();
 		const existing = this.sourcesByRepo.get(repo);
@@ -949,10 +960,14 @@ var SkillHubStore = class {
 		});
 		else {
 			const skills = existing.skills.includes(skillName) ? existing.skills : [...existing.skills, skillName].sort((a, b) => a.localeCompare(b));
-			this.sourcesByRepo.set(repo, {
+			const next = {
 				...existing,
 				skills
-			});
+			};
+			if (ref !== void 0 && ref !== "") next.ref = ref;
+			else delete next.ref;
+			if (commitSha !== "") next.commitSha = commitSha;
+			this.sourcesByRepo.set(repo, next);
 		}
 		await this.persist();
 	}

package/lib/types/store/store.d.ts

@@ -83,6 +83,17 @@ export declare class SkillHubStore {
      * Upsert one skill into a source record. When the repo has no record yet a
      * new one is created (root + commit snapshot from the caller).
      */
+    /**
+     * Record one imported skill in its repo-level source row.
+     *
+     * A repo owns exactly one source row, hence one pinned ref, so a later import
+     * must re-pin it: keeping the first import's `ref` / `commitSha` makes
+     * `sources/check` compare against a stale sha and `sources/sync` re-download
+     * the old ref over content that was imported from a tag — the "pinning a tag
+     * means nothing" failure of issue #15, reached through the bookkeeping
+     * instead of the download. An absent `ref` means the import ran on the
+     * default branch, which clears the pin rather than silently keeping it.
+     */
     addSourceSkill(repo: string, root: string, commitSha: string, ref: string | undefined, skillName: string): Promise<void>;
     /** Replace a source's skill list (used after sync/confirm-delete). */
     setSourceSkills(repo: string, skills: readonly string[]): Promise<SourceRecord | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.25",
+  "version": "0.3.26",
   "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {

package/src/store/store.ts

@@ -282,6 +282,17 @@ export class SkillHubStore {
    * Upsert one skill into a source record. When the repo has no record yet a
    * new one is created (root + commit snapshot from the caller).
    */
+  /**
+   * Record one imported skill in its repo-level source row.
+   *
+   * A repo owns exactly one source row, hence one pinned ref, so a later import
+   * must re-pin it: keeping the first import's `ref` / `commitSha` makes
+   * `sources/check` compare against a stale sha and `sources/sync` re-download
+   * the old ref over content that was imported from a tag — the "pinning a tag
+   * means nothing" failure of issue #15, reached through the bookkeeping
+   * instead of the download. An absent `ref` means the import ran on the
+   * default branch, which clears the pin rather than silently keeping it.
+   */
   async addSourceSkill(repo: string, root: string, commitSha: string, ref: string | undefined, skillName: string): Promise<void> {
     await this.ensureLoaded()
     const existing = this.sourcesByRepo.get(repo)
@@ -295,7 +306,11 @@ export class SkillHubStore {
       })
     } else {
       const skills = existing.skills.includes(skillName) ? existing.skills : [...existing.skills, skillName].sort((a, b) => a.localeCompare(b))
-      this.sourcesByRepo.set(repo, { ...existing, skills })
+      const next: SourceRecord = { ...existing, skills }
+      if (ref !== undefined && ref !== '') next.ref = ref
+      else delete next.ref
+      if (commitSha !== '') next.commitSha = commitSha
+      this.sourcesByRepo.set(repo, next)
     }
     await this.persist()
   }

package/src/store.test.ts

@@ -125,6 +125,31 @@ describe('SkillHubStore', () => {
     expect(again[0].manifest).toEqual({ 'skills/docx/SKILL.md': 120 })
   })
 
+  // issue #15 follow-up: one repo owns one source row, hence one pinned ref, so
+  // a later import must re-pin it. Keeping the first import's ref/sha made
+  // `check` compare a stale sha and `sync` re-download the old ref over
+  // tag-pinned content — the same "pinning a tag means nothing" failure.
+  it('re-pins the source to the ref and sha of the latest import', async () => {
+    await store.addSourceSkill('a/b', 'skills', 'sha-main', 'main', 'one')
+    expect(await store.getSource('a/b')).toMatchObject({ ref: 'main', commitSha: 'sha-main' })
+
+    await store.addSourceSkill('a/b', 'skills', 'sha-tag', 'v1.2.0', 'two')
+    expect(await store.getSource('a/b')).toMatchObject({ ref: 'v1.2.0', commitSha: 'sha-tag', skills: ['one', 'two'] })
+
+    // An import from the default branch clears the pin instead of keeping it.
+    await store.addSourceSkill('a/b', 'skills', 'sha-default', undefined, 'three')
+    const unpinned = await store.getSource('a/b')
+    expect(unpinned?.ref).toBeUndefined()
+    expect(unpinned?.commitSha).toBe('sha-default')
+    expect(unpinned?.skills).toEqual(['one', 'three', 'two'])
+
+    // The cleared pin survives the sidecar round trip.
+    const reloaded = new SkillHubStore(file)
+    const persisted = await reloaded.getSource('a/b')
+    expect(persisted?.ref).toBeUndefined()
+    expect(persisted?.commitSha).toBe('sha-default')
+  })
+
   it('drops only the given skill directory from the baseline', async () => {
     await store.addSourceSkill('a/b', 'skills', 'sha-1', undefined, 'docx')
     await store.addSourceSkill('a/b', 'skills', 'sha-1', undefined, 'pdf')