skillrepo 4.8.2 → 4.8.4

package/README.md

@@ -92,7 +92,7 @@ and just write the config + gitignore.
 ```json
 {
   "action": "initialized",
-  "account": { "slug": "...", "id": "...", "tier": "free|pro|enterprise" },
+  "account": { "slug": "...", "id": "...", "tier": "publisher|developer|team" },
   "config": { "action": "created|updated|unchanged" },
   "vendors": ["claudeCode", "cursor", "..."],
   "mcp": {
@@ -279,8 +279,9 @@ from the server to your local library.
 
 Limits: total multipart body ≤ 4.5 MB, per-file path depth ≤ 5
 segments, executable/archive extensions blocked (full list in
-`src/lib/skills/constants.ts`). Anti-abuse rate limit: 5/min and
-30/hr on Publisher; 30/min and 500/hr on Team.
+`src/lib/skills/constants.ts`). Anti-abuse rate limit: 6/min and
+100/hr on Developer; 30/min and 500/hr on Team. (`push` needs a
+write-scoped access key, which starts on the Developer plan.)
 
 Flags:
 
@@ -318,8 +319,8 @@ the CLI exits `4 / scope` with `code: publish_not_permitted`. The same
 
 Publish-only preconditions that surface as exit `5 / validation`:
 
-- `namespace_unset` — the account's name still equals its
-  auto-generated slug; customize the namespace first.
+- `namespace_unset` — the account's handle is still the
+  auto-generated placeholder; choose an Author ID in Settings first.
 - `analysis_pending` — safety analysis hasn't completed (only fires
   where analysis is enabled).
 - `safety_grade_too_low` — the skill's safety grade is `F`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillrepo",
-  "version": "4.8.2",
+  "version": "4.8.4",
   "description": "Pull-based CLI for agent skills — init, sync, search, add, remove your library from any IDE",
   "type": "module",
   "bin": {

package/src/lib/http.mjs

@@ -370,6 +370,25 @@ async function mapErrorResponse(res, url) {
   if (res.status === 404) {
     return null; // Caller decides
   }
+  if (res.status === 422 && code === "handle_required") {
+    // #2310: the push would CREATE a skill while the account's Author ID
+    // is still an unchosen placeholder. Line 1 is the server's message
+    // ("Set your Author ID before adding skills."); the hint points at
+    // the Settings surface that unblocks it. Derive the base URL from
+    // the request URL's origin (same posture as the 401 auth hint above)
+    // so staging users get a staging link, with the prod host as the
+    // parse-failure fallback.
+    let settingsBase = "https://skillrepo.dev";
+    try {
+      settingsBase = new URL(url).origin;
+    } catch {
+      // URL parse failure shouldn't happen — `safeFetch` already
+      // validated. Fall back to the prod default.
+    }
+    return validationError(message, {
+      hint: `Set it in Settings → Account Profile: ${settingsBase}/app/settings`,
+    });
+  }
   if (res.status === 429) {
     // 429 hits mapErrorResponse in two cases: (1) a read-only
     // endpoint's retry budget was exhausted (safeFetch with

package/src/test/commands/publish.test.mjs

@@ -220,7 +220,7 @@ describe("runPublish — error paths", () => {
     server.setPublishResponse("alice", "my-skill", {
       status: 422,
       body: {
-        error: "Set up your account namespace before publishing.",
+        error: "Set your Author ID before publishing.",
         code: "namespace_unset",
       },
     });
@@ -229,7 +229,7 @@ describe("runPublish — error paths", () => {
       (err) =>
         err instanceof CliError &&
         err.exitCode === EXIT_VALIDATION &&
-        /account namespace/.test(err.message),
+        /Author ID/.test(err.message),
     );
   });
 

package/src/test/commands/push.test.mjs

@@ -453,6 +453,30 @@ describe("runPush — server error mapping", () => {
     );
   });
 
+  it("maps server 422 handle_required to EXIT_VALIDATION with the Settings hint (#2310, #2345)", async () => {
+    // The dedicated #2310 branch in mapErrorResponse: friendly message
+    // plus the Settings pointer. Previously pinned only at the
+    // http.test.mjs layer against hand-built JSON — this runs the whole
+    // runPush chain against the same wire shape the server emits
+    // (route.ts:724: `{ error, code: "handle_required" }`).
+    file("SKILL.md", VALID_SKILL_MD);
+    server.setPushResponse({
+      status: 422,
+      body: {
+        error: "Set your Author ID before adding skills.",
+        code: "handle_required",
+      },
+    });
+    await assert.rejects(
+      runPush(["--key", VALID_KEY, "--url", serverUrl, "skill"], { stdout }),
+      (err) =>
+        err instanceof CliError &&
+        err.exitCode === EXIT_VALIDATION &&
+        /author id/i.test(err.message) &&
+        /settings/i.test(err.hint ?? ""),
+    );
+  });
+
   it("maps server 413 payload_too_large to EXIT_VALIDATION (generic 4xx)", async () => {
     // 413 has NO explicit branch in mapErrorResponse (only 401/403/404/
     // 429/5xx are special-cased). It therefore falls through to the

package/src/test/lib/http.test.mjs

@@ -1296,6 +1296,93 @@ describe("pushSkill", () => {
     }
   });
 
+  it("maps 422 handle_required to validationError with a Settings hint on the server's own host (#2310)", async () => {
+    const SERVER_MESSAGE = "Set your Author ID before adding skills.";
+    const srv = await makePushServer((req, res) => {
+      jsonRes(res, 422, {
+        error: SERVER_MESSAGE,
+        code: "handle_required",
+      });
+    });
+    try {
+      await assert.rejects(
+        () =>
+          pushSkill(srv.url, VALID_KEY, {
+            files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+          }),
+        (err) =>
+          err instanceof CliError &&
+          err.exitCode === EXIT_VALIDATION &&
+          // Line 1: the server's message verbatim; line 2 (hint): the
+          // Settings path on the REQUEST host (staging users get a
+          // staging link), not hardcoded prod.
+          err.message === SERVER_MESSAGE &&
+          err.hint === `Set it in Settings → Account Profile: ${srv.url}/app/settings`,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("handle_required hint falls back to the prod host when the request URL is unparseable (#2310)", async () => {
+    // The `new URL(url)` origin-derivation inside the handle_required
+    // mapping can only throw if the URL that reached fetch was itself
+    // unparseable — impossible over a real socket (undici validates the
+    // URL before connecting), so stub fetch to hand back the 422
+    // directly. `normalizeUrl` passes any non-empty string through, so
+    // the raw serverUrl below reaches mapErrorResponse verbatim.
+    const SERVER_MESSAGE = "Set your Author ID before adding skills.";
+    const realFetch = globalThis.fetch;
+    globalThis.fetch = async () =>
+      new Response(
+        JSON.stringify({ error: SERVER_MESSAGE, code: "handle_required" }),
+        { status: 422, headers: { "Content-Type": "application/json" } },
+      );
+    try {
+      await assert.rejects(
+        () =>
+          pushSkill("not a url", VALID_KEY, {
+            files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+          }),
+        (err) =>
+          err instanceof CliError &&
+          err.exitCode === EXIT_VALIDATION &&
+          err.message === SERVER_MESSAGE &&
+          // Parse-failure fallback: the hint pins the prod host instead
+          // of the (unusable) request origin.
+          err.hint ===
+            "Set it in Settings → Account Profile: https://skillrepo.dev/app/settings",
+      );
+    } finally {
+      globalThis.fetch = realFetch;
+    }
+  });
+
+  it("does NOT special-case a 422 without the handle_required code (generic validation)", async () => {
+    // A 422 carrying a different code (e.g. idempotency_key_reused) must
+    // keep the pre-#2310 generic mapping: validationError, no Settings hint.
+    const srv = await makePushServer((req, res) => {
+      jsonRes(res, 422, {
+        error: "Idempotency-Key was reused with a different request body.",
+        code: "idempotency_key_reused",
+      });
+    });
+    try {
+      await assert.rejects(
+        () =>
+          pushSkill(srv.url, VALID_KEY, {
+            files: [{ relativePath: "SKILL.md", content: SKILL_MD }],
+          }),
+        (err) =>
+          err instanceof CliError &&
+          err.exitCode === EXIT_VALIDATION &&
+          err.hint === undefined,
+      );
+    } finally {
+      await srv.close();
+    }
+  });
+
   it("maps 413 payload_too_large through mapErrorResponse", async () => {
     const srv = await makePushServer((req, res) => {
       jsonRes(res, 413, {