iterate-skill-installer 2.12.0 → 3.0.1

package/lib/installer.js

@@ -189,11 +189,13 @@ function parseChecksums(text) {
     const parts = trimmed.split(/\s+/);
     if (parts.length >= 2) {
       // Normalize the filename the same way scripts/install.py does
-      // (_parse_checksum): strip the GNU tar binary-mode marker ('*') and the
+      // (_parse_checksum): strip all leading GNU tar binary-mode markers a la
+      // Python's name.lstrip("*") (ONE '*', or several in a malformed entry —
+      // strip them all so the two parsers can never disagree), then strip the
       // './' prefix, then match on the basename so entries with a subpath or
       // versioned component (e.g. "dist/iterate-skill.tar.gz" or
       // "./iterate-skill.tar.gz") still resolve to the expected asset.
-      const normalized = parts[1].replace(/^\*/, '').replace(/^\.\//, '');
+      const normalized = parts[1].replace(/^\*+/, '').replace(/^\.\//, '');
       const basename = normalized.split('/').pop();
       map.set(basename, parts[0]);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iterate-skill-installer",
-  "version": "2.12.0",
+  "version": "3.0.1",
   "description": "One-command installer for iterate-skill across AI coding assistants",
   "main": "lib/installer.js",
   "bin": {

package/test/mode.test.js

@@ -107,6 +107,11 @@ async function run() {
   const starredSubpath = parseChecksums('abc123  *./release/iterate-skill-1.2.3.tar.gz\n');
   assert.strictEqual(starredSubpath.get('iterate-skill-1.2.3.tar.gz'), 'abc123', '*./ and versioned subpath should match by basename');
 
+  // Multiple leading '*' markers must be stripped like Python's lstrip("*")
+  // (a malformed entry must never leave a leading '*' in the basename).
+  const multiStar = parseChecksums('abc123  **iterate-skill.tar.gz\n');
+  assert.strictEqual(multiStar.get('iterate-skill.tar.gz'), 'abc123', 'all leading * markers should strip (lstrip matching)');
+
   console.log('mode.test.js: all parseChecksums tests passed');
 
   // parseArgs: --no-cli must toggle skill-only mode, and default to off.