fix(sdk): reconcile managed identity and skill bindings - #114
Merged
Merged
Conversation
…rift detection - Pass the resource declaration to readComparableResource so adapters can use declared display names and metadata for identity. - Qoder adapter now identifies agents/environments by the protected agents.project/agents.resource metadata instead of only by name. - Treat empty agent descriptions as omitted to avoid phantom drift. - Update drift-detection and slim-state tests for managed identity behavior.
…tion - Pass declarations to comparable reads for accurate matching - Match on protected metadata to ensure correct identity detection - Update versions of sdk, cli, playground, and server packages to patch 0.7.2/0.0.12 - Reflect fix in changelogs across multiple packages
Raise Tiptap, Hono, and js-yaml to patched releases so the dependency audit can pass.
Regenerate the dependency lockfile without local registry URLs so public verification can consume it.
Retain the existing compatible dependency graph while publishing canonical npm tarball URLs.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
Provider reconciliation must converge remote state to the declaration. Omitting an empty skill list leaves stale remote bindings on merge-style agent updates, while identity-based matching prevents managed resources from being misidentified during drift detection.
Type
Surface area
Checklist
bun run verify:fullpassesBehavior / risk
Agent update payloads now include
skills: []when no skills are declared, explicitly replacing stale provider-side bindings. The same mapper is used for create requests, so skill-less creates also send an empty array. Provider mapper tests cover the payload shape. Qoder managed-resource matching now uses declared identity during drift detection.Validation
bun run verify:scopedbun run verify:full(lint, typecheck, architecture, tests, and WebUI build passed; dependency audit was rerun against the public npm registry because the configured enterprise mirror returned 404 for its advisory endpoint)bun scripts/verify.ts pushbun audit: no vulnerabilities found