Leave verifier refs out of a push for a skill you do not own - #60
Merged
Conversation
Only a skill's owner may change its verifier references, so a push for a skill shared with you has nothing to say about them. The registry carries the stored references forward whenever the field is absent, so omitting it is both correct and sufficient. The push payload sent them regardless. `_verifier_payload` returned a list rather than `None`, and the client only drops a key whose value is `None`, so a skill with no bindings still went out with an empty list attached. A registry that reads the field's presence as an attempt to set it refuses the whole save, which surfaced here as a read-only skip and made an ordinary edit look like a missing grant. Return `None` for a skill someone else owns so the key is left out. Bindings the registry reports back are still recorded in the index, so it keeps tracking references the caller cannot edit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
goodeye skills sync pushcould not update a skill shared with you, even ateditaccess. The push was reported as a read-only skip, which made it look like the grant was wrong.The payload was the problem. Only a skill's owner may change its verifier references, but the push sent them on every save regardless of who owned the skill.
_verifier_payloadreturned a list rather thanNone, and the client only drops a key whose value isNone, so even a skill with no bindings went out carrying"verifiers": []. A registry that treats the field's presence as an attempt to set it then refuses the entire save.The fix
Return
Nonefor a skill someone else owns, which leaves the key out of the payload. The registry carries the stored references forward whenever the field is absent, so nothing is lost by omitting it.Bindings the registry reports back are still recorded in the local index, so it keeps tracking references the caller cannot edit.
An index written by an older version has no recorded role and loads as
owner, so it keeps sending the field as before. That path is unaffected by this change and is handled on the registry side.Testing
edit-granted entry, that the save still addresses the skill by id, and that returned bindings are still recorded locally. Written red first.There is a companion change on the registry side so that already-installed versions keep working without waiting on a release.
🤖 Generated with Claude Code