Skip to content

fix(skills): Correct the HTTP 403 advice now that server-side FDv2 is available to every account #141

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tracisiebel merged 1 commit into from
Oct 16, 2026
Merged

fix(skills): Correct the HTTP 403 advice now that server-side FDv2 is available to every account #141

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/client/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -446,7 +446,7 @@ try {

**The connection carries only skills.** Every request declares the skill payload, so flag and segment objects do not arrive on it. Any other object kind is skipped, not rejected, and counted in `diagnostics.objectsIgnored`; a nonzero count means the payload has a kind this version does not recognise, not that something failed.

> **Beta caveats, worth knowing before you deploy.** Payload signing does not exist on this channel yet, so delivery is TLS-only and the content hash establishes self-consistency, not origin authenticity. The FDv2 protocol is opt-in per account: without it the endpoints return HTTP 403, which the store reports as a fatal error explaining what to do. `ld-relay` does not speak the FDv2 endpoints, so relay-only deployments cannot receive skills.
> **Beta caveats, worth knowing before you deploy.** Payload signing does not exist on this channel yet, so delivery is TLS-only and the content hash establishes self-consistency, not origin authenticity. The SDK-facing FDv2 endpoints are available to every account. An account without Agent Skills access receives no skill content rather than an error status. An HTTP 403 is reported as a fatal error explaining what to check. `ld-relay` does not speak the FDv2 endpoints, so relay-only deployments cannot receive skills.

**If every skill comes back empty, check `diagnostics.hashlessObjects`.** Objects without a `contentHash` are withheld, so a nonzero count means skills are being withheld, not that the environment has none. The count is cumulative, not the current size of the withheld set. The store logs an error per hashless object, plus a summary when its contents become wholly hashless or the withheld set changes (not repeated for an unchanged re-delivery). There is no fallback that skips verification.

Expand Down
4 changes: 2 additions & 2 deletions packages/client/src/__tests__/skills-fdv2.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2304,8 +2304,8 @@ describe('failure handling', () => {
store.start();
expect(await waitUntil(() => store.failed !== null)).toBe(true);
expect(store.failed).toContain('403');
expect(store.failed).toContain('opt-in');
expect(consoleErrors()).toContain('opt-in');
expect(store.failed).toContain('proxy');
expect(consoleErrors()).toContain('proxy');
});

it('stops on 401', async () => {
Expand Down
5 changes: 3 additions & 2 deletions packages/client/src/skills-fdv2.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -978,8 +978,9 @@ const REQUEST_ADVICE =
'the base URI and that the endpoint speaks FDv2.';

const FORBIDDEN_ADVICE =
'The FDv2 protocol is opt-in per LaunchDarkly account and is served as HTTP 403 while it is off. Skill ' +
'delivery needs it enabled; contact LaunchDarkly support to enable it for your account.';
'The SDK-facing FDv2 endpoints are available to every LaunchDarkly account, so check that the SDK key is the ' +
"environment's server-side SDK key and that no proxy in between is refusing the request. If neither explains " +
'it, contact LaunchDarkly support.';

/**
* `Retry-After` in milliseconds, or `null` when absent or unusable (blank, the
Expand Down
Loading