Repository navigation
fix(skillhub): accept hub archives that set the data-descriptor flag - #371
Merged
Merged
Conversation
Installing some skills from the Skill Hub failed with "ADM-ZIP: No descriptor present". The hub re-packs every upload with adm-zip to inject _meta.json; adm-zip's writer keeps each entry's original general-purpose flags but never emits a data descriptor, so an upload whose zipper set bit 3 (macOS Archive Utility, Windows Explorer, streaming zippers) comes back with the flag set, real sizes/crc in both headers, and no descriptor. adm-zip 0.5.16 refused exactly that shape; 0.6.1 validates such entries against the central directory's crc instead (upstream issues #533/#548/#554), which is what every other unzip tool does. Bump adm-zip to 0.6.1 and add a regression test that rewrites a normal archive into the hub's shape. 0.6.1 also caps inflation at each entry's declared size and rejects duplicate entry names, both of which tighten the guards archive.ts already relies on. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the "The Skill Hub could not deliver this skill. (ADM-ZIP: No descriptor present)" error a user hit installing
outlook-localfrom the desktop Skill Hub.Root cause
The hub re-packs every uploaded skill with adm-zip to inject
_meta.json(src/lib/zipMeta.tsin the hub). adm-zip's writer copies each original entry's general-purpose flags but never writes a data descriptor. When the upload was produced by a zipper that sets bit 3 ("sizes and crc follow the data" — macOS Archive Utility, Windows Explorer, most streaming zippers), the archive the hub serves has bit 3 set on those entries, the real sizes and crc in both the local and central headers, and no descriptor record after the data.adm-zip 0.5.16, which
@codev/skillhubpinned, treated "next local header where the descriptor should be" as fatal and threwNo descriptor presentfromgetData(). The error surfaced indetectAndStripRoot(and would again inextractZip), after the download and the listing had both succeeded — which is why the skill could be browsed but never installed. Every client shares this path: the desktop app, the TUI, andcodev skill pull.outlook-localhas 8 such entries. Of the 24 most-downloaded skills and all 6 stacks on the live hub it is the only one affected today, but any future upload from those zippers hits it.Fix
adm-zipto 0.6.1 (published 2026-09-11). Itscrc32OKvalidates a bit-3 entry against the central directory's crc instead of hunting for the descriptor (upstream issues #533, #548, #554). No public API changes between 0.5.16 and 0.6.1; the two additions are a per-entry inflate cap at the declared size and rejection of duplicate entry names, both of which tighten guardsarchive.tsalready relies on (comment updated).inspectZip,detectAndStripRoot, andextractZipall succeed, and that a wrong crc is still refused.No upstream files touched, so no
DIVERGENCES.mdrow.Verification
packages/codev-skillhub: 249 pass (3 new),bun typecheckclean;packages/serverbun typecheckclean.packages/opencodeHttpApi exerciser--include skillhub: 7/7 pass.installSkill("outlook-local")through the package's own install path against the live hub now writesSKILL.md,_meta.json,.netmind-preinstalled.json, and the six scripts. Before the bump the same call threw the reported error.Hub-side follow-up (not in this PR)
The hub should clear bit 3 when it re-serializes an upload in
zipMeta.ts(or bump its own adm-zip past 0.6.0 and re-pack), so older CoDev builds that still ship 0.5.16 can install these skills too.🤖 Generated with Claude Code