skillrepo 4.9.1 → 4.9.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillrepo",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "description": "Pull-based CLI for agent skills — init, sync, search, add, remove your library from any IDE",
   "type": "module",
   "bin": {

package/src/test/lib/http.test.mjs

@@ -551,6 +551,66 @@ describe("getLibrary", () => {
     }
   });
 
+  // ── Wire identity (#2358 — skillset epic no-file contract) ──────────
+  //
+  // The skillset epic's D2 contract: a repo with no skillset declaration
+  // must produce request/receipt payloads byte-identical to the
+  // pre-skillset CLI, forever. These tests capture today's wire shape so
+  // any future change to it — a new query param, a pin/skillset header —
+  // fails here first and has to be made deliberately.
+
+  it("wire identity: a plain sync sends the exact pre-skillset request shape (#2358)", async () => {
+    let captured;
+    const srv = await startServer((req, res) => {
+      captured = { url: req.url, method: req.method, headers: { ...req.headers } };
+      jsonRes(res, 200, { skills: [], removals: [], syncedAt: "x" });
+    });
+    try {
+      await getLibrary(srv.url, VALID_KEY);
+
+      // Exact path — no query string at all on a plain sync.
+      assert.equal(captured.url, "/api/v1/library");
+      assert.equal(captured.method, "GET");
+      // Auth rides the Authorization header, and no pin/skillset-shaped
+      // vocabulary appears in any header name or value.
+      assert.match(captured.headers.authorization, /^Bearer /);
+      const headerBlob = JSON.stringify(captured.headers);
+      assert.doesNotMatch(headerBlob, /skillset|approved|pin/i);
+    } finally {
+      await srv.close();
+    }
+  });
+
+  it("wire identity: a pin-suffixed ETag round-trips verbatim as an opaque string (#2358)", async () => {
+    // Servers emit `"{ts}-{count}-{removals}-p{ts}-{n}"` for accounts
+    // with pin history. The CLI must treat every ETag as opaque: store
+    // it exactly, send it back exactly. A client that parsed the legacy
+    // three-segment shape would corrupt the conditional-GET cycle for
+    // pinned accounts.
+    const SUFFIXED = '"1754680000000-12-3-p1754690000000-2"';
+    let conditional;
+    const srv = await startServer((req, res) => {
+      if (req.headers["if-none-match"]) {
+        conditional = req.headers["if-none-match"];
+        res.statusCode = 304;
+        res.end();
+        return;
+      }
+      jsonRes(res, 200, { skills: [], removals: [], syncedAt: "x" }, { ETag: SUFFIXED });
+    });
+    try {
+      const first = await getLibrary(srv.url, VALID_KEY);
+      assert.equal(first.etag, SUFFIXED);
+
+      const second = await getLibrary(srv.url, VALID_KEY, { ifNoneMatch: first.etag });
+      assert.equal(conditional, SUFFIXED);
+      assert.equal(second.notModified, true);
+      assert.equal(second.etag, SUFFIXED);
+    } finally {
+      await srv.close();
+    }
+  });
+
   it("throws authError on 401", async () => {
     const srv = await startServer((req, res) => jsonRes(res, 401, { error: "nope" }));
     try {