From 8ece5068d7a5ea8ac9bf62e7a719c741adb64801 Mon Sep 17 00:00:00 2001 From: Gustavo Caetano Date: Fri, 23 Oct 2026 13:28:00 -0300 Subject: [PATCH 1/3] fix: bind optional archive metadata to the reviewed version --- src/lib/plugins/artifacts.ts | 10 ++++++++++ src/lib/plugins/package.server.ts | 4 ++-- tests/business-platform.test.ts | 14 ++++++++++++++ 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/src/lib/plugins/artifacts.ts b/src/lib/plugins/artifacts.ts index 800874dc..0d655b6f 100644 --- a/src/lib/plugins/artifacts.ts +++ b/src/lib/plugins/artifacts.ts @@ -48,3 +48,13 @@ export function verifyArtifact(files: unknown, digest: string): Record( + manifest: T, + version: string, +): T & { version: string } { + if (manifest.version !== undefined && manifest.version !== version) + throw new Error("Archive manifest version does not match its reviewed registry version"); + return { ...manifest, version }; +} diff --git a/src/lib/plugins/package.server.ts b/src/lib/plugins/package.server.ts index 5a58438f..c9e4660a 100644 --- a/src/lib/plugins/package.server.ts +++ b/src/lib/plugins/package.server.ts @@ -1,4 +1,4 @@ -import { verifyArtifact } from "./artifacts"; +import { verifyArtifact, bindManifestVersion } from "./artifacts"; /** * Builds an Agent Plugins v1 portable package for a published catalog item. * Server-only: reads the live registry and reuses the SKILL.md serializer. @@ -71,7 +71,7 @@ export async function loadPluginPackage( return { slug: pkg.slug, pluginName: report.manifest.name, - manifest: report.manifest, + manifest: bindManifestVersion(report.manifest, ver.version), mcp: files.has("mcp.json") ? (JSON.parse(files.get("mcp.json")!) as McpConfig) : buildMcpConfig(), diff --git a/tests/business-platform.test.ts b/tests/business-platform.test.ts index 28bf3644..cf72714d 100644 --- a/tests/business-platform.test.ts +++ b/tests/business-platform.test.ts @@ -215,3 +215,17 @@ test("business relevance beats unrelated popularity while preserving the trust f false, ); }); + +import { bindManifestVersion } from "../src/lib/plugins/artifacts.ts"; +test("optional source manifest version uses the reviewed registry version without rewriting source", () => { + const source = { name: "portable-skill" }; + assert.deepEqual(bindManifestVersion(source, "0.1.0"), { + name: "portable-skill", + version: "0.1.0", + }); + assert.deepEqual(source, { name: "portable-skill" }); + assert.throws( + () => bindManifestVersion({ version: "2.0.0" }, "0.1.0"), + /reviewed registry version/, + ); +}); From 6999ad693b02b9fb6ec190bcb17cf7692ff0fafa Mon Sep 17 00:00:00 2001 From: Gustavo Caetano Date: Fri, 23 Oct 2026 13:28:01 -0300 Subject: [PATCH 2/3] chore: bump platform version 0.6.0 to 0.6.1 --- CHANGELOG.md | 6 ++++++ package.json | 2 +- plugin.json | 2 +- src/lib/version.ts | 9 ++++++++- 4 files changed, 16 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 494238c5..21d050e4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,12 @@ Component artifacts are versioned and released independently via git tags: - **`super-agent` CLI** — `cli-v*` tags publish cross-platform binaries. - **`@superagentskill/sdk`** — versioned in `packages/sdk-ts/package.json`. +## [0.6.1] — 2026-10-23 — *Genesis* (alpha) — Maintenance release + +### Changed + +- bind optional archive metadata to the reviewed version + ## [0.6.0] — 2026-10-23 — *Genesis* (alpha) — Feature update ### Changed diff --git a/package.json b/package.json index 8d6b5700..dfcfca00 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "tanstack_start_ts", - "version": "0.6.0", + "version": "0.6.1", "private": true, "sideEffects": false, "type": "module", diff --git a/plugin.json b/plugin.json index fb861d12..4d880570 100644 --- a/plugin.json +++ b/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", "name": "superagentskill", - "version": "0.6.0", + "version": "0.6.1", "description": "Agent skills and candidate workflows from Super Agent Skill. Published registry packages expose available trust and execution evidence; candidate workflows include offline fixtures.", "author": { "name": "Super Agent Skill", diff --git a/src/lib/version.ts b/src/lib/version.ts index 16e72ada..efdd466e 100644 --- a/src/lib/version.ts +++ b/src/lib/version.ts @@ -12,7 +12,7 @@ * We are still pre-1.0: rapid evolution, no stability guarantees. */ -export const PLATFORM_VERSION = "0.6.0" as const; +export const PLATFORM_VERSION = "0.6.1" as const; export const PLATFORM_CODENAME = "Genesis" as const; export const PLATFORM_STAGE: "alpha" | "beta" | "ga" = "alpha"; export const PLATFORM_BUILD_DATE = "2026-10-23" as const; @@ -30,6 +30,13 @@ export type ChangelogEntry = { * Every deployed change appends a new entry (or amends the top one before shipping). */ export const CHANGELOG: ChangelogEntry[] = [ + { + version: "0.6.1", + date: "2026-10-23", + kind: "patch", + title: "Maintenance release", + highlights: ["bind optional archive metadata to the reviewed version"], + }, { version: "0.6.0", date: "2026-10-23", From 2550891d2432bb38b552980433bdebbc65ab6cbd Mon Sep 17 00:00:00 2001 From: Gustavo Caetano Date: Fri, 23 Oct 2026 13:28:31 -0300 Subject: [PATCH 3/3] fix: retain version locks when the original manifest omits metadata --- src/lib/plugins/package.server.ts | 6 +----- tests/business-platform.test.ts | 1 + 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/src/lib/plugins/package.server.ts b/src/lib/plugins/package.server.ts index c9e4660a..129b348a 100644 --- a/src/lib/plugins/package.server.ts +++ b/src/lib/plugins/package.server.ts @@ -62,11 +62,7 @@ export async function loadPluginPackage( const files = new Map(Object.entries(verifyArtifact(artifact.files, artifact.sha256))); const { runPluginConformance } = await import("./conformance"); const report = runPluginConformance(files); - if ( - !report.conformant || - !report.manifest || - (report.manifest.version ?? "0.1.0") !== ver.version - ) + if (!report.conformant || !report.manifest) throw new Error("Stored package failed conformance"); return { slug: pkg.slug, diff --git a/tests/business-platform.test.ts b/tests/business-platform.test.ts index cf72714d..b6374027 100644 --- a/tests/business-platform.test.ts +++ b/tests/business-platform.test.ts @@ -223,6 +223,7 @@ test("optional source manifest version uses the reviewed registry version withou name: "portable-skill", version: "0.1.0", }); + assert.equal(bindManifestVersion(source, "1.2.3").version, "1.2.3"); assert.deepEqual(source, { name: "portable-skill" }); assert.throws( () => bindManifestVersion({ version: "2.0.0" }, "0.1.0"),