happyskills 0.18.0 → 0.18.1

package/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-03-29
+
+### Fixed
+- Fix `pull` and `diff` recording stale commit SHA from CloudFront-cached clone responses — now clones at the specific head commit from the compare endpoint, ensuring the lock file matches the remote after pull
+
 ## [0.18.0] - 2026-03-29
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "0.18.0",
+	"version": "0.18.1",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",

package/src/commands/diff.js

@@ -136,15 +136,18 @@ const run = (args) => catch_errors('Diff failed', async () => {
 	}
 
 	if (mode === 'remote') {
-		// Base vs remote — use classify_changes with base as the "local" side
-		const [remote_err, remote_clone] = await repos_api.clone(owner, repo, null)
+		// Base vs remote — get head commit via compare, clone at that commit
+		const [cmp_err, cmp_data] = await repos_api.compare(owner, repo, lock_entry.base_commit)
+		if (cmp_err) throw e('Compare failed', cmp_err)
+
+		const [remote_err, remote_clone] = await repos_api.clone(owner, repo, null, { commit: cmp_data.head_commit })
 		if (remote_err) throw e('Failed to fetch remote files', remote_err)
 		const remote_files = (remote_clone.files || []).map(f => ({ path: f.path, sha: f.sha }))
 
 		const classified = classify_changes(base_files, base_files, remote_files)
 
 		if (args.flags.json) {
-			const report = build_report(skill_name, lock_entry.version, null, classified)
+			const report = build_report(skill_name, lock_entry.version, cmp_data.head_version, classified)
 			print_json({ data: { mode, report } })
 		} else {
 			print_file_table(classified)
@@ -152,16 +155,19 @@ const run = (args) => catch_errors('Diff failed', async () => {
 		return
 	}
 
-	// Full three-way diff
+	// Full three-way diff — get head commit via compare
+	const [cmp_err, cmp_data] = await repos_api.compare(owner, repo, lock_entry.base_commit)
+	if (cmp_err) throw e('Compare failed', cmp_err)
+
 	const [local_err, local_files] = await build_local_entries(skill_dir)
 	if (local_err) throw e('Failed to read local files', local_err)
 
-	const [remote_err, remote_clone] = await repos_api.clone(owner, repo, null)
+	const [remote_err, remote_clone] = await repos_api.clone(owner, repo, null, { commit: cmp_data.head_commit })
 	if (remote_err) throw e('Failed to fetch remote files', remote_err)
 	const remote_files = (remote_clone.files || []).map(f => ({ path: f.path, sha: f.sha }))
 
 	const classified = classify_changes(base_files, local_files, remote_files)
-	const report = build_report(skill_name, lock_entry.version, null, classified)
+	const report = build_report(skill_name, lock_entry.version, cmp_data.head_version, classified)
 
 	if (args.flags.json) {
 		print_json({ data: { mode, report } })

package/src/commands/pull.js

@@ -142,7 +142,8 @@ const run = (args) => catch_errors('Pull failed', async () => {
 	// 5. No local mods → fast-forward
 	if (!det.local_modified || strategy === 'force') {
 		spinner.update('Fast-forwarding...')
-		const [clone_err, clone_data] = await repos_api.clone(owner, repo, null)
+		// Clone at the specific head commit from compare (bypasses CDN cache)
+		const [clone_err, clone_data] = await repos_api.clone(owner, repo, null, { commit: cmp_data.head_commit })
 		if (clone_err) { spinner.fail('Clone failed'); throw clone_err[0] }
 
 		// Remove existing files and write fresh
@@ -159,12 +160,12 @@ const run = (args) => catch_errors('Pull failed', async () => {
 		const [wf_err] = await write_files_from_clone(clone_data, skill_dir)
 		if (wf_err) { spinner.fail('Failed to write files'); throw wf_err[0] }
 
-		// Update lock
+		// Update lock — use head_commit from compare (authoritative, not cached)
 		const [hash_err, new_integrity] = await hash_directory(skill_dir)
 		const updated_entry = {
 			...lock_entry,
-			commit: clone_data.commit,
-			base_commit: clone_data.commit,
+			commit: cmp_data.head_commit,
+			base_commit: cmp_data.head_commit,
 			integrity: new_integrity || lock_entry.integrity,
 			base_integrity: new_integrity || lock_entry.base_integrity,
 			version: cmp_data.head_version || lock_entry.version,
@@ -196,8 +197,8 @@ const run = (args) => catch_errors('Pull failed', async () => {
 	const [local_err, local_files] = await build_local_entries(skill_dir)
 	if (local_err) { spinner.fail('Failed to read local files'); throw local_err[0] }
 
-	// Get remote files (clone latest)
-	const [remote_err, remote_clone] = await repos_api.clone(owner, repo, null)
+	// Get remote files (clone at head commit — bypasses CDN cache)
+	const [remote_err, remote_clone] = await repos_api.clone(owner, repo, null, { commit: cmp_data.head_commit })
 	if (remote_err) { spinner.fail('Failed to fetch remote files'); throw remote_err[0] }
 	const remote_files = (remote_clone.files || []).map(f => ({ path: f.path, sha: f.sha }))
 
@@ -262,12 +263,12 @@ const run = (args) => catch_errors('Pull failed', async () => {
 	}
 	// strategy === 'ours' → keep local files as-is (no action needed)
 
-	// Update lock
+	// Update lock — use head_commit from compare (authoritative, not cached)
 	const [hash_err, new_integrity] = await hash_directory(skill_dir)
 	const updated_entry = {
 		...lock_entry,
-		commit: remote_clone.commit,
-		base_commit: remote_clone.commit,
+		commit: cmp_data.head_commit,
+		base_commit: cmp_data.head_commit,
 		integrity: new_integrity || lock_entry.integrity,
 		base_integrity: new_integrity || lock_entry.base_integrity,
 		version: cmp_data.head_version || lock_entry.version,