feat(skills): add authenticated exact-version distribution - #88
Conversation
|
Warning Review limit reached
Next review available in: 22 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (16)
📝 WalkthroughWalkthroughThis change adds authenticated Skill manifest and package delivery across core services, MCP, API, storage, CLI, web UI, and CI. The CLI supports OAuth, Skill search, exact-version installation, integrity validation, receipts, and listing installed Skills. ChangesSkill distribution backend
CLI
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant CLI
participant MCP
participant API
participant Storage
User->>CLI: skill add namespace/slug@version
CLI->>MCP: resolve_skill(...)
MCP->>API: resolve Skill manifest
API->>Storage: validate package reference
Storage-->>API: verified package metadata
API-->>MCP: SkillManifestLink
MCP-->>CLI: manifest and package path
CLI->>MCP: download package with access token
MCP->>API: stream Skill package
API-->>CLI: package bytes
CLI-->>User: install receipt
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 16
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.java`:
- Around line 155-184: Update the skillPackage method so the opened content is
closed if any ResponseEntity header or builder operation fails before the
deferred StreamingResponseBody executes. Mirror the catch-close-rethrow pattern
already used by SkillDistributionService.open(), while preserving the existing
try-with-resources closure during successful streaming.
In `@apps/cli/package.json`:
- Around line 1-11: Update the package manifest for `@orgmemory/cli` to mark it
private, preventing accidental publication while preserving its existing name,
version, bin, and files configuration.
In `@apps/cli/README.md`:
- Around line 20-27: Update the CLI usage documentation near the installation
and OAuth flow description to document the --oauth-callback-port option,
including its default of 53682 and its use for selecting an alternate callback
port, and document the --json option with its supported output behavior.
In `@apps/cli/src/contracts.test.ts`:
- Around line 14-24: Extend the parseSkillReference rejection tests with
malformed-reference inputs that exercise the “Use an exact Skill reference”
branch: a reference without “@”, one with a trailing “@”, and one containing
extra slash segments. Assert each input is rejected with that branch’s message,
while preserving the existing invalid-coordinate/version cases.
In `@apps/cli/src/contracts.ts`:
- Line 65: Harden packagePath validation by resolving it against the trusted
server URL before checking it, rather than relying on the raw
startsWith("/skill-packages/") check. In the packagePath validation and
authenticated fetch flow, require the resolved URL to remain same-origin and its
normalized pathname to begin with /skill-packages/, rejecting traversal or
redirected paths such as /admin.
In `@apps/cli/src/index.ts`:
- Around line 92-96: Update the package download flow around fetch and
readBoundedPackage to enforce a finite timeout using an AbortController or the
existing timeout utility. Pass its signal to fetch, ensure the timeout is
cleared after completion, and preserve the existing bounded package-reading
behavior.
In `@apps/cli/src/install.test.ts`:
- Around line 79-105: Extend the installSkill test coverage to simulate a
failure during promote after the existing target has been renamed to its
recovery backup. Assert that the installation rejects, the original SKILL.md
content is restored, and the recovery backup is removed, matching the rollback
behavior covered by the existing receipt-failure test.
In `@apps/cli/src/install.ts`:
- Line 69: Update the promote/installSkill interaction so backup ownership is
propagated even when promote fails after renaming target to backup, including
failures that become AggregateError after restore fails. Ensure installSkill’s
finally cleanup uses that ownership state and does not delete backup when the
error requires recovery from it, while retaining cleanup for backups not owned
after failure.
- Around line 182-187: Update the archive extraction flow around unzipSync to
validate the manifest’s declared uncompressed file sizes and reject packages
whose total exceeds a defined safe memory ceiling before decompression. Prefer a
streaming extraction path that tracks cumulative output and aborts when the
budget is exceeded; preserve the existing unreadable-ZIP error handling for
extraction failures.
In `@apps/cli/src/mcp.ts`:
- Around line 60-71: Update the connection error handling around client.connect
in the relevant MCP connection method to close the local transport before
rethrowing non-authorization errors, and also clean it up when finishAuth fails.
Preserve the existing authorization retry flow, but ensure cleanup is attempted
without masking the original error.
In `@apps/cli/src/oauth.ts`:
- Around line 222-225: Update the server startup logic in start() so a listen
error, including EADDRINUSE, clears this.server before the promise rejects. Keep
the existing successful listen behavior unchanged, ensuring retries can create a
fresh server and close() does not operate on the failed instance.
- Around line 228-242: Update the OAuth callback server’s wait/close lifecycle
around wait() and close(): enforce a bounded timeout so wait() rejects when no
callback arrives, track the pending waiter so close() rejects it, and ensure
shutdown does not remain blocked by lingering keep-alive sockets. Preserve the
existing success path by resolving with the callback code when the redirect
arrives.
In `@apps/cli/tsconfig.json`:
- Around line 2-19: Add an explicit compilerOptions.lib entry in
apps/cli/tsconfig.json containing ES2024 and ESNext.Disposable so await using
and AsyncDisposable resolve from TypeScript’s standard libraries. The related
usage in apps/cli/src/index.ts requires no direct change.
In
`@core/src/main/java/com/orgmemory/core/assetregistry/AssetReleaseRepository.java`:
- Around line 19-21: Ensure the schema or migrations define a composite index or
unique constraint covering asset_id, organization_id, and version_label for the
AssetReleaseRepository.findByAssetIdAndOrganizationIdAndVersionLabel lookup,
adding the migration if absent.
In
`@core/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.java`:
- Around line 66-71: Update the catch block around
AssetRelease.validateVersionLabel in SkillDistributionService to preserve the
caught invalid exception as the cause when creating AssetNotFoundException. Keep
the existing handling for both IllegalArgumentException and NullPointerException
while ensuring all rethrow paths retain invalid’s stack trace.
In `@web/src/features/assets/components/asset-detail-page.tsx`:
- Around line 907-912: Update the install-command copy handler around the
navigator.clipboard call to check that the Clipboard API and writeText method
are available before invoking them, and show the existing “Could not copy
command” error toast when unavailable. Preserve the success toast and promise
rejection handling for supported browsers.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0de957ac-bac4-42b9-84da-0c907a2c8d89
⛔ Files ignored due to path filters (11)
apps/cli/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!**/pnpm-lock.yamlcontracts/openapi.jsonis excluded by!contracts/openapi.jsondocs/increments/active/2026-07-27-skill-registry-distribution/design.mdis excluded by!docs/**docs/increments/active/2026-07-27-skill-registry-distribution/plan.mdis excluded by!docs/**docs/increments/active/README.mdis excluded by!docs/**docs/increments/completed/2026-07-27-skill-registry-package-foundation/design.mdis excluded by!docs/**docs/increments/completed/2026-07-27-skill-registry-package-foundation/plan.mdis excluded by!docs/**docs/increments/completed/README.mdis excluded by!docs/**docs/runbooks/mcp-asset-delivery.mdis excluded by!docs/**docs/specs/domains/asset-registry.mdis excluded by!docs/**docs/tests/domains/asset-registry.mdis excluded by!docs/**
📒 Files selected for processing (33)
.github/workflows/ci.yml.gitignoreapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetDeliveryControllerSecurityTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.javaapps/cli/README.mdapps/cli/package.jsonapps/cli/src/contracts.test.tsapps/cli/src/contracts.tsapps/cli/src/index.tsapps/cli/src/install.test.tsapps/cli/src/install.tsapps/cli/src/mcp.tsapps/cli/src/oauth.tsapps/cli/tsconfig.build.jsonapps/cli/tsconfig.jsonapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryApiClient.javaapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryTools.javaapps/mcp/src/main/java/com/orgmemory/mcp/McpApiAuthorization.javaapps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.javaapps/mcp/src/main/java/com/orgmemory/mcp/SkillPackageController.javaapps/mcp/src/test/java/com/orgmemory/mcp/AssetDeliveryToolsTests.javaapps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.javaapps/mcp/src/test/java/com/orgmemory/mcp/SkillPackageControllerTests.javacore/src/main/java/com/orgmemory/core/assetregistry/AssetReleaseRepository.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageContent.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageStoragePort.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javaintegrations/object-storage-minio/src/main/java/com/orgmemory/integrations/storage/minio/MinioSkillPackageStorageAdapter.javaintegrations/object-storage-minio/src/test/java/com/orgmemory/integrations/storage/minio/MinioSkillPackageStorageAdapterTests.javaweb/src/features/assets/components/asset-detail-page.tsx
📜 Review details
🧰 Additional context used
📓 Path-based instructions (6)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Record current behavior in architecture/specification documentation only after it exists in code; keep intended behavior in vision, roadmap, or an active increment, and do not duplicate state.
Before using unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, Gradle, React, Vite, Tailwind, or TypeScript APIs, consult current official documentation via Context7 and the projectorgmemory-*verification skills.
Before retrieval, AI, MCP, permission, upload, graph, or export work, readdocs/guidelines/agent-safety.md.
Never commit.envfiles, provider keys, tokens, or customer data.
Run the relevant verification gates fromdocs/guidelines/testing-harness.md; use a terminating clean test as the context gate, and do not treatbootRunas verification.
Files:
apps/cli/tsconfig.jsonapps/cli/package.jsonapps/cli/src/contracts.test.tscore/src/main/java/com/orgmemory/core/assetregistry/AssetReleaseRepository.javaapps/cli/tsconfig.build.jsonapps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageContent.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.javaapps/mcp/src/test/java/com/orgmemory/mcp/AssetDeliveryToolsTests.javaintegrations/object-storage-minio/src/main/java/com/orgmemory/integrations/storage/minio/MinioSkillPackageStorageAdapter.javaapps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.javaintegrations/object-storage-minio/src/test/java/com/orgmemory/integrations/storage/minio/MinioSkillPackageStorageAdapterTests.javaapps/cli/README.mdapps/cli/src/contracts.tsapps/mcp/src/test/java/com/orgmemory/mcp/SkillPackageControllerTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetDeliveryControllerSecurityTests.javaapps/mcp/src/main/java/com/orgmemory/mcp/McpApiAuthorization.javaapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryApiClient.javaapps/cli/src/install.test.tsapps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javaapps/mcp/src/main/java/com/orgmemory/mcp/SkillPackageController.javaweb/src/features/assets/components/asset-detail-page.tsxapps/cli/src/index.tscore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageStoragePort.javaapps/cli/src/oauth.tsapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.javaapps/cli/src/mcp.tsapps/cli/src/install.tsapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryTools.java
**/*.{ts,tsx,js,jsx,css,scss,html}
📄 CodeRabbit inference engine (CLAUDE.md)
For frontend files, run Oxlint, TypeScript typecheck, the production build, and browser tests when the UI flow matters; do not run JetBrains IDE inspection on TypeScript, TSX, or web configuration.
Files:
apps/cli/src/contracts.test.tsapps/cli/src/contracts.tsapps/cli/src/install.test.tsweb/src/features/assets/components/asset-detail-page.tsxapps/cli/src/index.tsapps/cli/src/oauth.tsapps/cli/src/mcp.tsapps/cli/src/install.ts
**/*.{java,kt}
📄 CodeRabbit inference engine (CLAUDE.md)
JetBrains IDE inspection is a verification gate for the Java backend.
Files:
core/src/main/java/com/orgmemory/core/assetregistry/AssetReleaseRepository.javaapps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageContent.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.javaapps/mcp/src/test/java/com/orgmemory/mcp/AssetDeliveryToolsTests.javaintegrations/object-storage-minio/src/main/java/com/orgmemory/integrations/storage/minio/MinioSkillPackageStorageAdapter.javaapps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.javaintegrations/object-storage-minio/src/test/java/com/orgmemory/integrations/storage/minio/MinioSkillPackageStorageAdapterTests.javaapps/mcp/src/test/java/com/orgmemory/mcp/SkillPackageControllerTests.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/AssetDeliveryControllerSecurityTests.javaapps/mcp/src/main/java/com/orgmemory/mcp/McpApiAuthorization.javaapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryApiClient.javaapps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javaapps/mcp/src/main/java/com/orgmemory/mcp/SkillPackageController.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageStoragePort.javaapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.javaapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryTools.java
web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
web/src/features/assets/components/asset-detail-page.tsx
.github/**/*.{yml,yaml}
⚙️ CodeRabbit configuration file
.github/**/*.{yml,yaml}: Require least-privilege permissions, explicit release tags for actions,
bounded job timeouts, concurrency cancellation, frozen lockfiles, and no
secrets in pull-request workflows. GitHub Actions are intentionally not
pinned to commit SHAs; Dependabot owns their scheduled version updates.
Files:
.github/workflows/ci.yml
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.java
🧠 Learnings (3)
📚 Learning: 2026-07-26T05:46:47.443Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.
Applied to files:
apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.javaapps/mcp/src/main/java/com/orgmemory/mcp/McpApiAuthorization.javaapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryApiClient.javaapps/mcp/src/main/java/com/orgmemory/mcp/SkillPackageController.javaapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.javaapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryTools.java
📚 Learning: 2026-07-26T05:46:49.308Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpTransportConfiguration.java:34-43
Timestamp: 2026-07-26T05:46:49.308Z
Learning: In the MCP module, authentication should be captured at servlet-time in `McpTransportConfiguration` (via the servlet `contextExtractor`) and stored in `McpTransportContext` under `AUTHENTICATION_CONTEXT_KEY`. Any authorization code (e.g., `McpApiAuthorization`) must consume this stored `Authentication` from `McpTransportContext` rather than re-reading it from `SecurityContextHolder`. Preserve the existing validation behavior: treat missing authentication as `null`, and only proceed when the consumed authentication is non-null and `authentication.isAuthenticated()` is true.
Applied to files:
apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.javaapps/mcp/src/main/java/com/orgmemory/mcp/McpApiAuthorization.javaapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryApiClient.javaapps/mcp/src/main/java/com/orgmemory/mcp/SkillPackageController.javaapps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryTools.java
📚 Learning: 2026-07-24T22:52:57.466Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 40
File: .github/workflows/ci.yml:126-126
Timestamp: 2026-07-24T22:52:57.466Z
Learning: In this repository’s GitHub Actions workflows, the `uses:` field may intentionally reference GitHub Actions by explicit release tags (not immutable commit SHAs) per the project’s OrgMemory policy. Do not flag tag-based `uses:` references as “unpinned” if they are release-tag-based (e.g., `owner/repovX.Y.Z`) and follow the repo’s Dependabot-owned scheduled updates approach.
Applied to files:
.github/workflows/ci.yml
🪛 ast-grep (0.44.1)
apps/mcp/src/test/java/com/orgmemory/mcp/SkillPackageControllerTests.java
[warning] 30-30: Use a randomly-generated IV
Context: byte[] bytes = new byte[] {4, 5, 6};
Note: [CWE-329] Generation of Predictable IV with CBC Mode.
(random-iv)
apps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.java
[warning] 42-42: Use a randomly-generated IV
Context: byte[] bytes = new byte[] {1, 2, 3};
Note: [CWE-329] Generation of Predictable IV with CBC Mode.
(random-iv)
apps/cli/src/oauth.ts
[warning] 14-14: Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn } from "node:child_process"
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🪛 OpenGrep (1.25.0)
apps/cli/src/install.ts
[WARNING] 18-18: Sequelize.literal() with dynamic input can lead to SQL injection. Use parameterized queries or model methods instead.
(coderabbit.sql-injection.sequelize-literal)
🪛 PMD (7.26.0)
core/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.java
[Medium] 70-70: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'invalid' on all code paths
(PreserveStackTrace (Best Practices))
🪛 zizmor (1.26.1)
.github/workflows/ci.yml
[error] 196-196: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 201-201: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 206-206: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🔇 Additional comments (37)
.github/workflows/ci.yml (1)
28-28: LGTM!Also applies to: 57-57, 69-72, 185-223, 454-454, 470-470, 483-483
web/src/features/assets/components/asset-detail-page.tsx (3)
9-16: LGTM!Also applies to: 70-70, 308-314
774-889: 📐 Maintainability & Code QualityRun the required frontend verification gates.
This adds a manifest-fetch and install-command UI flow. Run Oxlint, TypeScript typecheck, production build, and relevant browser tests via
docs/guidelines/testing-harness.md; a clean terminating test is required. As per coding guidelines, “For frontend files, run Oxlint, TypeScript typecheck, the production build, and browser tests when the UI flow matters.”Source: Coding guidelines
921-926: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/AssetReleaseRepository.java (1)
19-21: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/SkillPackageContent.java (1)
1-27: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/SkillPackageStoragePort.java (1)
4-13: LGTM!Also applies to: 51-66
core/src/main/java/com/orgmemory/core/assetregistry/SkillDistributionService.java (3)
44-79: LGTM!
81-109: LGTM!
111-221: LGTM!core/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.java (1)
1-202: LGTM!integrations/object-storage-minio/src/main/java/com/orgmemory/integrations/storage/minio/MinioSkillPackageStorageAdapter.java (1)
54-66: LGTM!integrations/object-storage-minio/src/test/java/com/orgmemory/integrations/storage/minio/MinioSkillPackageStorageAdapterTests.java (1)
12-12: LGTM!Also applies to: 80-105
apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetDeliveryController.java (2)
12-23: LGTM!Also applies to: 33-33, 48-60
114-148: LGTM!apps/api/src/test/java/com/orgmemory/api/assetregistry/AssetDeliveryControllerSecurityTests.java (1)
9-9: LGTM!Also applies to: 59-75, 95-99, 109-112
apps/api/src/test/java/com/orgmemory/api/assetregistry/SkillDistributionControllerTests.java (1)
1-123: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/SkillInstallManifest.java (1)
1-39: LGTM!apps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryApiClient.java (1)
3-4: LGTM!Also applies to: 94-143, 326-352
apps/mcp/src/main/java/com/orgmemory/mcp/AssetDeliveryTools.java (1)
41-41: LGTM!Also applies to: 87-136, 220-223
apps/mcp/src/main/java/com/orgmemory/mcp/McpApiAuthorization.java (1)
35-43: LGTM!apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java (1)
50-53: LGTM!apps/mcp/src/main/java/com/orgmemory/mcp/SkillPackageController.java (1)
38-77: 📐 Maintainability & Code QualityRun the required Java inspection gate before merge.
Attach a successful JetBrains IDE inspection result for the changed Java backend files. As per coding guidelines, “JetBrains IDE inspection is a verification gate.”
Source: Coding guidelines
apps/mcp/src/test/java/com/orgmemory/mcp/AssetDeliveryToolsTests.java (1)
89-113: LGTM!apps/mcp/src/test/java/com/orgmemory/mcp/OrgMemoryMcpContextTests.java (1)
51-76: LGTM!apps/mcp/src/test/java/com/orgmemory/mcp/SkillPackageControllerTests.java (1)
23-83: LGTM!apps/cli/src/contracts.ts (1)
70-96: LGTM!apps/cli/src/install.ts (3)
115-132: LGTM!
134-170: LGTM!
263-318: LGTM!apps/cli/src/mcp.ts (1)
21-50: LGTM!Also applies to: 75-94
apps/cli/src/oauth.ts (2)
23-115: LGTM!
245-279: LGTM!apps/cli/src/index.ts (1)
21-65: LGTM!Also applies to: 111-141, 153-170
apps/cli/tsconfig.build.json (1)
1-12: LGTM!.gitignore (1)
23-23: LGTM!apps/cli/package.json (1)
26-30: 📐 Maintainability & Code QualityToolchain versions resolve.
1 participant
Outcome
Adds authenticated exact-version Skill distribution through an agent-native CLI and MCP discovery flow.
orgmemory skill add <namespace>/<slug>@<version>; they do not manually download or upload package archivesSecurity and integrity
Verification
./gradlew --no-daemon clean test— 93 tasks, successfulactionlintgit diff --checkBoundary
This PR does not add public marketplace publishing, ratings, MCP mutation, arbitrary remote URL installs, or npm publication of the CLI. The archive format is an internal immutable transport artifact, not an employee-facing installation workflow.
Summary by CodeRabbit
New Features
Documentation
Tests