fix(registry): restore Skill pages broken by behavior rules (#436)

Nitro rewrites the text `import.meta.env` inside skilld-protocol's
bundled rules to `globalThis._importMeta_.env`. The rules then fail
their own lowercase check, detectBehaviors throws, and every Skill
page answers 503. Patch the literal so the bundler cannot reach it,
and make a rules failure return no behaviors instead of a 503.

Author: harlan-zw

layers/registry/server/utils/skill-behaviors.ts

@@ -12,12 +12,16 @@ export type SkillPageBehavior = Omit<Behavior, 'locations'> & {
  * The page holds SKILL.md and the file names the sync stored, never supporting
  * file content, so only those inputs reach the shared rules. `skilld run`
  * applies the same rules to every file.
+ *
+ * The panel is optional, so a rules failure returns no behaviors and reports
+ * itself. On 2026-10-05 the bundled rules failed their own parse, and the
+ * throw took every Skill page down with a 503.
  */
 export function skillPageBehaviors(input: {
   raw: string | null
   assetPaths: readonly string[]
   source: { owner: string, repo: string, branch: string | null, skillPath: string | null }
-}): SkillPageBehavior[] {
+}, detect: typeof detectBehaviors = detectBehaviors): SkillPageBehavior[] {
   const files = [
     ...(input.raw === null ? [] : [{ path: 'SKILL.md', text: input.raw }]),
     ...input.assetPaths.map(path => ({ path })),
@@ -34,7 +38,19 @@ export function skillPageBehaviors(input: {
     })
     return file && location.line !== null ? `${file}#L${location.line}` : file
   }
-  return detectBehaviors(files).map(behavior => ({
+  let detected: Behavior[]
+  try {
+    detected = detect(files)
+  }
+  catch (error) {
+    emitOperationalEvent(createWideEvent({
+      operation: 'skill-behaviors',
+      outcome: 'failed',
+      reason: error instanceof Error ? error.message : String(error),
+    }))
+    return []
+  }
+  return detected.map(behavior => ({
     ...behavior,
     locations: behavior.locations.map(location => ({ ...location, url: url(location) })),
   }))

patches/skilld-protocol@2.5.0.patch

@@ -0,0 +1,14 @@
+diff --git a/dist/behaviors.mjs b/dist/behaviors.mjs
+index 901192e4a9fc582bfeb23b17aae8beb79861ef57..f5cabec0a991721d7ca8af58bfa83ec352dec05f 100644
+--- a/dist/behaviors.mjs
++++ b/dist/behaviors.mjs
+@@ -418,7 +418,8 @@ var skill_behaviors_default = {
+ 			"commands": [["printenv"]],
+ 			"substrings": [
+ 				"process.env",
+-				"import.meta.env",
++				// Split so a bundler that rewrites `import.meta` cannot reach the pattern.
++				"import." + "meta.env",
+ 				"deno.env",
+ 				"bun.env",
+ 				"os.environ",

pnpm-lock.yaml

@@ -178,6 +178,7 @@ pipelines:
 patchedDependencies:
   hookable@5.5.3: patches/hookable@5.5.3.patch
   hookable@6.1.1: patches/hookable@6.1.1.patch
+  skilld-protocol@2.5.0: patches/skilld-protocol@2.5.0.patch
 catalog:
   '@antfu/eslint-config': ^9.3.0
   '@cloudflare/sandbox': 1.0.0

pnpm-workspace.yaml

@@ -34,4 +34,13 @@ describe('skillPageBehaviors', () => {
 
     expect(scripts?.locations[0]?.url).toBeNull()
   })
+
+  // 2026-10-05: the bundled rules failed their own parse, and every Skill page answered 503.
+  it('returns no behaviors, and keeps the page up, when the rules fail', () => {
+    const failing = () => {
+      throw new Error('patterns are lowercase')
+    }
+
+    expect(skillPageBehaviors({ raw: '---\nname: setup\n---\n', assetPaths: ['run.py'], source }, failing)).toEqual([])
+  })
 })