feat: implement pack field and collision guard for plugin-sourced skills - #4577
Merged
Conversation
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
bernstein-the-conductor
Bot
requested a review
from chernistry
as a code owner
August 25, 2026 20:59
chernistry
enabled auto-merge
August 25, 2026 21:00
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Aug 25, 2026
jm27
pushed a commit
to jm27/bernstein
that referenced
this pull request
Aug 26, 2026
…urdrink-ltd#4602) ## Problem `SSOAuthMiddleware.dispatch` gates its unauthenticated pass-through on `auth_disabled_via_opt_out()` alone — a live read of `BERNSTEIN_AUTH_DISABLED`. The constructor still resolves the factory argument (`auth.enabled: false` in configuration arrives as `auth_disabled=True`) into `self._auth_disabled`, but nothing reads that attribute any more. The regression shipped inside sipyourdrink-ltd#4577, which is about skill collision guards; the middleware line was unrelated to that change. Net effect: a deployment that disables auth by configuration logs the loud "auth is DISABLED" warning at startup and then returns 401 on every protected route anyway. The documented opt-out surface (`docs/security/manager-auth.md`) no longer matched behaviour. ## Fix Dispatch honours both signals: ```python if self._auth_disabled or auth_disabled_via_opt_out(): ``` The live environment read is kept on purpose — a variable exported after the middleware stack is built still counts, which is the one property the sipyourdrink-ltd#4577 change added. ## Tests - `test_config_resolved_opt_out_survives_without_the_env_var` — `auth_disabled=True` from the factory bypasses the gate with no env var set; fails before this fix. - `test_env_opt_out_set_after_construction_still_counts` — pins the live-read property so honouring the flag cannot regress the env path. Both run in the existing `test_auth_middleware_defaults.py` suite (33 passed).
This was referenced Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4515
Problem
Problem. The skills lock row records provenance as a bare
source = "plugin"string (src/bernstein/core/skills/lifecycle.py:146). Two different plugin packs that both ship a skill namedalphaare therefore indistinguishable in the lock: the cross-source collision guard added for #4503 refuses a plugin replacing abernstein-skills.tomlinstall, but a second pack silently replaces the first pack's copy — same silent-clobber failure, one provenance class deeper.Change
feat: implement pack field and collision guard for plugin-sourced skills (
013e22d)src/bernstein/core/skills/lifecycle.py(+29/-14)tests/unit/skills/test_plugin_cross_source_collision.py(+26/-7)Also in this branch:
4356d30)1efe6f2)91e14fc)Housekeeping, not what this pull request is about:
20fd808)b19827f)f140f13)3e5727e)bbdf091)Verification
Provenance
sha256:7a62a66330022284cda37544a6a8d77804bcffc7f053a6ebb5ad38cad2112c5b59eda1003e3bec49ae99ed7b960e55a5565409aec77436e9451934a4727a339fbernstein review-receipt verify --pr <this PR> --issue <issue.md> --diff <pr.diff>Generated from Bernstein session
1787691389.bernstein-session-id: 1787691389
Made by bernstein v3.18.0 - unattended run
run-20260825T204053p3974698Z, no operator in the loop.