Skip to content

fix!: catch AuthenticationError in pull/resolve fallback for public bundles#21

Merged
justinmerrell merged 1 commit intomainfrom
fix/public-bundle-auth-fallback
Apr 3, 2026
Merged

fix!: catch AuthenticationError in pull/resolve fallback for public bundles#21
justinmerrell merged 1 commit intomainfrom
fix/public-bundle-auth-fallback

Conversation

@justinmerrell
Copy link
Copy Markdown
Contributor

Summary

  • Adds AuthenticationError (HTTP 401) to the catch clauses in pullContent(), pull(), and resolve() so unauthenticated requests to namespace-scoped endpoints fall back to public hub endpoints
  • Adds pullFromHub() and resolveFromHub() private helpers that pull public bundles entirely via the hub :pull endpoint when namespace :resolve also requires auth
  • Verified end-to-end by pulling musher-examples/demo-starter:1.0.0 from hub.musher.dev without MUSHER_API_KEY

Closes #20

Test plan

  • Unit tests: 4 new tests covering 401/403 fallback in pullContent, pull, and resolve
  • Full suite: all 145 tests pass (pnpm check)
  • Integration: pull("musher-examples/demo-starter:1.0.0") succeeds without API key, returns 3 files (2 skills, 1 agent spec)

🤖 Generated with Claude Code

…blic bundles

When pulling a public bundle without MUSHER_API_KEY, the namespace-scoped
:resolve and :pull endpoints return 401. The SDK now catches
AuthenticationError (in addition to ForbiddenError) and falls back to the
public hub endpoints, matching the CLI behavior.

Closes #20

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@justinmerrell justinmerrell merged commit d7f3552 into main Apr 3, 2026
7 checks passed
@justinmerrell justinmerrell deleted the fix/public-bundle-auth-fallback branch April 3, 2026 00:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

pullContent() doesn't catch AuthenticationError, breaking public bundle access without API key

1 participant