Repository navigation
fix(manifest): resolve composed repository origins through their own Manifest's repositories - #365
Merged
Merged
Conversation
aroff
enabled auto-merge (squash)
September 23, 2026 18:53
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…Manifest's repositories A composed Manifest could declare a `repository` origin, but only the consuming project's `[tool.fastskill.repositories]` were ever loaded. The origin then failed with "Repository 'team' is not configured". Worse, if the consumer happened to define a repository with the same name, it silently installed the skill from the consumer's catalog instead of the one the shared Manifest meant. `SkillProjectToml::composed_repositories` now walks the same composition as `to_skill_entries`, through one shared visitor. It collects every Manifest's repositories, and anchors a composed Manifest's relative local path to that Manifest. One name with identical definitions is merged. One name with different definitions is an error that names both Manifests, never a silent pick. Install, update, add and serve resolve through the composed set. The `repo` commands keep loading only the project's own repositories, because `repo add/update/remove` save the whole list back and must not copy a composed Manifest's repositories into the project. A composed Manifest's skills_directory, eval and server settings stay ignored on purpose; the Manifest docs now say so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aroff
force-pushed
the
fix/composed-manifest-repositories
branch
from
September 23, 2026 19:14
56753ed to
3e2c5d0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A composed Manifest (
[tool.fastskill.manifests]) contributed its dependencies but not its[[tool.fastskill.repositories]]. A shared dependency such as{ origin = { type = "repository", repo = "team", … } }then either:Repository 'team' is not configuredwhen the consuming project did not declareteam, orteamcatalog when it happened to declare one with the same name but a different definition (the wrong-catalog case).Change
SkillProjectToml::composed_repositories(project_dir)walks the same composition graph as dependencies and returns the project's own repositories plus every composed Manifest's, with a composed localpathanchored to the Manifest that declares it.Repository 'team' is defined differently by <a> and <b>; give one of them another name. Identical definitions merge.skill add/install origin resolution (load_resolution_repositories), the edge-service injection,serve's manifest handler and all/registry/*browse routes.fastskill repo add/update/remove/liststill read and write only the project's own repositories (load_repositories_from_project), so a composed catalog is never copied into the project's toml.skills_directory,[tool.fastskill.eval]and[tool.fastskill.server]stay ignored on purpose; documented inwebdocs/skill-management/manifest-system.mdx.Tests
manifest_composition_cli_test.rs: the wrong-catalog / not-configured case and the conflicting-name case (both fail onmain), identical definitions merging, andrepo addnever copying composed repositories.http_registry_sources_tests.rs: the/registry/*routes had never run against real repositories. They now run over a wiremock zip-url marketplace, unreadable Git and zip-url marketplaces, a local catalog, an HTTP registry, composed repositories and a conflicting composition.http_handler_route_tests.rs:serve_index_fileerror paths (missing index root, a path through a file, a directory, a symlink out of the index).registry.rsso the whole-file coverage gate passes: oneproject_sources_managerhelper replaces four copies of the same error mapping, and the index file response is built withIntoResponseinstead of a fallible builder../scripts/run-tests.shpasses locally (fmt, file-size cap, clippy, build, nextest, modified-file coverage).🤖 Generated with Claude Code