reskill 1.20.2 → 1.20.3

package/dist/cli/index.js

@@ -3958,8 +3958,15 @@ class RegistryResolver {
         // 4. Download tarball
         const { tarball, integrity } = await client.downloadSkill(parsed.fullName, version);
         // 5. Verify integrity
-        const isValid = RegistryClient.verifyIntegrity(tarball, integrity);
-        if (!isValid) throw new Error(`Integrity verification failed for ${ref}`);
+        //
+        // The server contract (rush-v2 server-api.spec.md §3.2a/3.2b) explicitly
+        // returns an empty `x-integrity` header for local-mode publishes — i.e.
+        // skills uploaded as a multipart tarball via the Web UI store integrity
+        // as ''. Skip verification in that case rather than failing install.
+        if (integrity) {
+            const isValid = RegistryClient.verifyIntegrity(tarball, integrity);
+            if (!isValid) throw new Error(`Integrity verification failed for ${ref}`);
+        } else logger_logger.debug(`Server returned empty integrity for ${ref}; skipping verification (expected for local-mode publishes).`);
         return {
             parsed,
             shortName,

package/dist/core/registry-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-resolver.d.ts","sourceRoot":"","sources":["../../src/core/registry-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGL,KAAK,qBAAqB,EAE3B,MAAM,4BAA4B,CAAC;AAQpC,MAAM,WAAW,qBAAqB;IACpC,8BAA8B;IAC9B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAwC1C;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA+BxG;;;;;;OAMG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAWjE"}
+{"version":3,"file":"registry-resolver.d.ts","sourceRoot":"","sources":["../../src/core/registry-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAGL,KAAK,qBAAqB,EAE3B,MAAM,4BAA4B,CAAC;AAQpC,MAAM,WAAW,qBAAqB;IACpC,8BAA8B;IAC9B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAwC1C;;;;;;;;;;;;OAYG;IACG,OAAO,CACX,GAAG,EAAE,MAAM,EACX,mBAAmB,CAAC,EAAE,MAAM,EAC5B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,CAAC;IA0CjC;;;;;;OAMG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAWjE"}

package/dist/index.js

@@ -4343,8 +4343,15 @@ class RegistryResolver {
         // 4. Download tarball
         const { tarball, integrity } = await client.downloadSkill(parsed.fullName, version);
         // 5. Verify integrity
-        const isValid = RegistryClient.verifyIntegrity(tarball, integrity);
-        if (!isValid) throw new Error(`Integrity verification failed for ${ref}`);
+        //
+        // The server contract (rush-v2 server-api.spec.md §3.2a/3.2b) explicitly
+        // returns an empty `x-integrity` header for local-mode publishes — i.e.
+        // skills uploaded as a multipart tarball via the Web UI store integrity
+        // as ''. Skip verification in that case rather than failing install.
+        if (integrity) {
+            const isValid = RegistryClient.verifyIntegrity(tarball, integrity);
+            if (!isValid) throw new Error(`Integrity verification failed for ${ref}`);
+        } else logger_logger.debug(`Server returned empty integrity for ${ref}; skipping verification (expected for local-mode publishes).`);
         return {
             parsed,
             shortName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reskill",
-  "version": "1.20.2",
+  "version": "1.20.3",
   "description": "AI Skills Package Manager - Git-based skills management for AI agents",
   "type": "module",
   "main": "./dist/index.js",