feat: office bundle ETag revalidation and --force-skills passthrough - #236
Merged
Conversation
Removing the manifest left no way to detect a republished bundle: an existing zip was reused as-is, so users who downloaded before a bundle refresh kept installing stale contents. Persist the server's ETag next to each download and revalidate: - finished file + stored ETag: If-None-Match probe; 304 keeps the local copy, an ETag mismatch re-downloads; server unreachable or erroring keeps the local copy; no ETag on record (manually copied file) trusts it as-is - resume: If-Range alongside Range, so a partial from an older publish restarts cleanly instead of splicing stale bytes Also pass --force-skills / -ForceSkills through to the setup scripts, the flag existing installs need to pick up refreshed skills. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
3 tasks
It appeared both in the passthrough list and in its own explanation, reading as a duplicate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two follow-ups to the manifest removal (#234), prompted by the bundle refresh that shipped the hardened xlsx skill:
1. ETag-based staleness detection. Dropping the manifest left no way to notice a republished bundle — an existing
codev-office-<os>.zipwas reused as-is, so users who downloaded before a refresh kept installing stale contents (including the just-fixed skill zips).downloadFilenow persists the server's ETag next to each file (<dest>.etag) and revalidates:If-None-Matchprobe: 304 keeps the local copy (one cheap round-trip, no re-download); an ETag change re-downloads; an unreachable/erroring server keeps the local copy (offline-safe); no ETag on record (manually copied file, pre-ETag download) trusts the file as-is — no behavior change for existing setups.If-RangealongsideRange, closing a real corruption hole: a.partialfrom an older publish previously had new-object bytes spliced onto it with nothing to catch it (the outer sha256 went away with the manifest); now the server answers 200 on mismatch and the existing start-over branch discards the stale bytes.The truth lives on the object itself (MinIO serves ETags on every object), so unlike a manifest there is no publish-side contract that can drift.
2.
--force-skillspassthrough. The setup scripts'--force-skills/-ForceSkillsflag is what existing installs need to pick up refreshed skills, butcodevhub skill officehad no way to forward it. Now:codevhub skill office --force-skills. Usage string andcodevhub helpupdated.Together these complete the update path for the installed base:
codevhub skill office --force-skillsrefetches the script, notices the republished bundle via ETag, re-downloads it, and replaces the installed skills with the refreshed ones.Test plan
pnpm fix/typecheckclean; office+download suites: 38 tests pass, including 4 new ETag cases (304 reuse with exactly one probe request, republish re-download, no-ETag trust with zero requests, If-Range restart across a republish) against a test server with MinIO-style conditional semanticspnpm build && node dist/index.js --versionsmoke-passes; full suite + build passed in the pre-commit hook🤖 Generated with Claude Code