skillrepo 4.8.1 → 4.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillrepo",
-  "version": "4.8.1",
+  "version": "4.8.2",
   "description": "Pull-based CLI for agent skills — init, sync, search, add, remove your library from any IDE",
   "type": "module",
   "bin": {

package/src/commands/add.mjs

@@ -27,7 +27,8 @@
  *   - 404 not-found → clean error, exit 5
  *   - 409 self-ownership → clean error, exit 5 ("you can't add your
  *     own skill to your own library")
- *   - 403 plan-limit → validationError (via http.mjs) with billing hint
+ *   - 403 plan-limit → validationError (via http.mjs); the server
+ *     message carries the per-cap remedy (no CLI-side hint, #2239)
  *   - 403 scope → scopeError (via http.mjs) with write-key hint
  *
  * Flags: --global / --agent / --json / --key / --url

package/src/lib/http.mjs

@@ -339,7 +339,7 @@ async function mapErrorResponse(res, url) {
     //      `src/app/api/v1/library/route.ts:226-235`. The route comment
     //      EXPLICITLY documents that the CLI must distinguish this from
     //      scope errors. We map it to `validationError` (exit 5) with a
-    //      hint pointing at billing — it is not a key-permission issue
+    //      no CLI-side hint — it is not a key-permission issue
     //      so neither authError nor scopeError is the right fit, and
     //      adding a dedicated planLimitError to the exit code matrix is
     //      out of scope for v3.0.0.
@@ -350,9 +350,13 @@ async function mapErrorResponse(res, url) {
     //   3. Generic 403 — suspended account, blocked user, etc. Maps to
     //      authError with a "contact support" hint.
     if (typeof code === "string" && code === "plan_limit") {
-      return validationError(message, {
-        hint: "Upgrade your plan at /app/settings/billing or remove an existing skill from your library.",
-      });
+      // No CLI-side hint: the server's plan_limit message now states the
+      // limit AND the correct remedy for the specific cap that fired
+      // (skills "Delete one to add another.", library "Remove one to add
+      // another.", cap-0 "A personal library isn't included in your
+      // plan."). A generic hint here either duplicates it or — for the
+      // cap-0 tier — contradicts it (#2239 round-2 review).
+      return validationError(message);
     }
     if (typeof code === "string" && code.toLowerCase().includes("scope")) {
       return scopeError(message, {
@@ -1233,7 +1237,7 @@ async function setSkillVisibility(serverUrl, apiKey, owner, name, target, option
   // CANNOT fall through to `mapErrorResponse` (which re-reads the
   // body and would get an empty object — a `plan_limit` 403 would
   // mis-classify as authError exit 2 instead of validationError
-  // exit 5 with billing hint). Pre-parse once, then dispatch every
+  // exit 5, message self-contained). Pre-parse once, then dispatch every
   // code path inline mirroring `mapErrorResponse`'s shape so the
   // CliError types stay consistent across endpoints.
   if (res.status === 403 || res.status === 422) {
@@ -1253,13 +1257,13 @@ async function setSkillVisibility(serverUrl, apiKey, owner, name, target, option
       }
       // Mirror `mapErrorResponse`'s 403 taxonomy so a 403 here behaves
       // identically to a 403 on any other endpoint:
-      //   - `plan_limit` → validationError (exit 5) with billing hint
+      //   - `plan_limit` → validationError (exit 5), server message only
       //   - any `*scope*` code → scopeError (exit 4)
       //   - everything else → authError (exit 2, "suspended" hint)
       if (code === "plan_limit") {
-        throw validationError(message, {
-          hint: "Upgrade your plan at /app/settings/billing or remove an existing skill from your library.",
-        });
+        // Same as mapErrorResponse: the server message is the complete,
+        // cap-specific remedy — no CLI hint (#2239 round-2 review).
+        throw validationError(message);
       }
       if (code && code.toLowerCase().includes("scope")) {
         throw scopeError(message, {

package/src/test/commands/add.test.mjs

@@ -235,7 +235,7 @@ describe("runAdd — error paths", () => {
     );
   });
 
-  it("403 plan-limit maps to validationError with billing hint", async () => {
+  it("403 plan-limit maps to validationError (server message self-contained, no hint)", async () => {
     server.setAddResponse("alice", "limit-test", {
       status: 403,
       body: {

package/src/test/commands/publish.test.mjs

@@ -192,11 +192,11 @@ describe("runPublish — error paths", () => {
     });
   });
 
-  it("403 plan_limit → CliError EXIT_VALIDATION (NOT authError), billing hint surfaces", async () => {
+  it("403 plan_limit → CliError EXIT_VALIDATION (NOT authError), no CLI-side hint", async () => {
     // Real-world regression scenario: an account over its skill
     // quota tries to publish. Server returns 403 with code
     // `plan_limit`. The CLI MUST classify this as exit 5
-    // validation with the billing hint, NOT exit 2 authError
+    // validation with the self-contained server message, NOT exit 2 authError
     // ("contact support") — a pre-review version of the code
     // consumed the 403 body and let mapErrorResponse re-parse, but
     // the body was empty by then so plan_limit fell through to
@@ -211,7 +211,7 @@ describe("runPublish — error paths", () => {
     await assert.rejects(runPublish(baseArgv(), { stdout }), (err) => {
       assert.ok(err instanceof CliError);
       assert.equal(err.exitCode, EXIT_VALIDATION);
-      assert.match(err.hint ?? "", /Upgrade your plan|billing/);
+      assert.equal(err.hint, undefined); // server plan_limit message is self-contained (#2239)
       return true;
     });
   });
@@ -514,10 +514,10 @@ describe("runUnpublish — error paths", () => {
     );
   });
 
-  it("403 plan_limit → CliError EXIT_VALIDATION (NOT authError), billing hint surfaces", async () => {
+  it("403 plan_limit → CliError EXIT_VALIDATION (NOT authError), no CLI-side hint", async () => {
     // Same shared `setSkillVisibility` 403 dispatch as publish: a
     // plan_limit 403 must classify as exit 5 validation with the
-    // billing hint, never exit 2 authError. Mirrors the publish-side
+    // self-contained server message, never exit 2 authError. Mirrors the publish-side
     // regression guard for the unpublish verb.
     server.setUnpublishResponse("alice", "my-skill", {
       status: 403,
@@ -529,7 +529,7 @@ describe("runUnpublish — error paths", () => {
     await assert.rejects(runUnpublish(baseArgv(), { stdout }), (err) => {
       assert.ok(err instanceof CliError);
       assert.equal(err.exitCode, EXIT_VALIDATION);
-      assert.match(err.hint ?? "", /Upgrade your plan|billing/);
+      assert.equal(err.hint, undefined); // server plan_limit message is self-contained (#2239)
       return true;
     });
   });

package/src/test/commands/push.test.mjs

@@ -401,7 +401,7 @@ describe("runPush — server error mapping", () => {
 
   it("maps server 403 plan_limit to EXIT_VALIDATION (NOT auth)", async () => {
     // mapErrorResponse explicitly disambiguates plan_limit from the
-    // generic-403 authError path so the user sees a billing hint, not
+    // generic-403 authError path so the user sees the plan-limit message, not
     // a "contact support" hint. Mirrors the http.test.mjs assertion.
     file("SKILL.md", VALID_SKILL_MD);
     server.setPushResponse({

package/src/test/e2e/cli-commands.test.mjs

@@ -363,7 +363,7 @@ describe("CLI E2E — read commands", () => {
     assert.match(r.stderr, /write-scoped key|scope/);
   });
 
-  it("add with 403 plan_limit exits 5 with billing hint", async () => {
+  it("add with 403 plan_limit exits 5 (validation, server message shown)", async () => {
     server.setAddResponseForAny({
       status: 403,
       body: { error: "Your free plan allows up to 5 library skills.", code: "plan_limit" },

package/src/test/lib/http.test.mjs

@@ -1278,7 +1278,7 @@ describe("pushSkill", () => {
   it("maps 403 plan_limit through mapErrorResponse to validationError", async () => {
     const srv = await makePushServer((req, res) => {
       jsonRes(res, 403, {
-        error: "Plan limit reached",
+        error: "Your developer plan allows up to 40 skills. Delete one to add another.",
         code: "plan_limit",
       });
     });
@@ -2119,9 +2119,9 @@ describe("publishLibrarySkill", () => {
     }
   });
 
-  it("throws validationError on 403 plan_limit (billing hint, not auth)", async () => {
+  it("throws validationError on 403 plan_limit (validation exit, not auth)", async () => {
     const srv = await startServer((req, res) =>
-      jsonRes(res, 403, { error: "Plan limit reached", code: "plan_limit" }),
+      jsonRes(res, 403, { error: "Your developer plan allows up to 40 skills. Delete one to add another.", code: "plan_limit" }),
     );
     try {
       await assert.rejects(