From eea37d7d84681e9e79350bdb8bc44eb5a1bd37ab Mon Sep 17 00:00:00 2001 From: Aleksandr Shevchuk Date: Fri, 13 Nov 2026 14:12:08 +0200 Subject: [PATCH] fix(author): the build page route hands over the source file, only the tool writes the .h5p In the build page route the source goes over as a file too, where the chat can give one: 2 of ChatGPT's 3 links broke as it wrote them out, and its .source.json built every time. The skill's opening says only the build tool writes the .h5p: ChatGPT zipped one by hand, with no library in it and its content in a params key. An install that hangs until the command times out counts as one that failed, as ChatGPT's npx did. Closes #194. --- design/author.md | 30 ++++++++++++++++++++++++++++++ skills/h5p-author/SKILL.md | 17 +++++++++++------ 2 files changed, 41 insertions(+), 6 deletions(-) diff --git a/design/author.md b/design/author.md index 6763102..27c01e9 100644 --- a/design/author.md +++ b/design/author.md @@ -299,6 +299,14 @@ to 3,000. Twenty-four things the code does not say by itself: block and no link under the old text and the new (12 replies, half of them asked for a link to click), so the rule costs that position nothing, and what it changes in ChatGPT is not measured. No rule reaches a link copied wrong between the command's output and the reply. + An install that hangs is one that fails (2026-11-13): ChatGPT, asked why it had built nothing, + said its `npx` had timed out, and step 3's list named only errors. Haiku in a terminal whose + registry took each connection and never answered went on to the two files under the old text + and the new, 2 of 2 runs each, and built, so the words are for a model that reads the list to + the letter. An uploaded plugin is no way round the registry: a ChatGPT plugin that carried the + one-file tool and the whole pack, 15.6 MB, uploaded, and its code's `find /` found no file of + it, so the zips the organisation's site offers to install (missing-elements.github.io#40) + carry the skill's text and files only. - **A bundle per content type, where the pack cannot be installed** (2026-11-09, #166). The page leaves the last steps to the user, but ChatGPT's sandbox runs Node and fetches a file its browsing tool has opened: given the libraries as files, a chat builds and fixes its source @@ -651,6 +659,28 @@ to 3,000. Twenty-four things the code does not say by itself: page; with the change, 5 of 5 again. It is for a model that reads step 5's list to the letter. In Claude Code's place it changed nothing: 2 of 2 Question Sets handed over the exact link alone, and the picture run no address and the preview command. + + In that route the source goes over as a file too, where the chat can give one (2026-11-13). + ChatGPT with the skill as a plugin ran the link command and wrote its output out itself: 2 of + its 3 links broke, one with 43 characters of its own in place of 37 near its start, one at a + length base64 never has, while the `.source.json` it gave built at once on the page, which + since missing-elements.github.io#39 says a damaged link is damaged and offers to open that + file. Haiku in a sandbox told it had no network and could give files handed the file over + under the old text already, in 5 of 6 runs, as under the new; every link it gave was exact + and the reply's one web address. +- **Only the build tool writes the `.h5p`** (2026-11-13). ChatGPT, asked to prove it could make + the file where it could not install the tool, zipped an `h5p.json` and a `content.json` it had + written: no library in it, and the content wrapped in a `params` key. The verifier fails it + for its missing libraries, and given the pack's it plays and draws "No question has been + added". Gemini, given the skill as an uploaded skill, said it held no steps to put a package + together. So the skill's opening says that only the tool writes one. With that sentence in a + test plugin, ChatGPT answered that it had written no `.h5p` and made none up: one run each + way. Haiku made none by hand under either text, 0 of 6 runs whose user asked for the file + itself, so the weak model shows no gain. It shows where the sentence leads: told its sandbox + had no network, 3 of 6 Haiku runs with it ran `npx` anyway, against 0 of 6 without, and built, + since this computer's npm answered. With npm cut off, 5 of 6 handed over the exact link and + the source file; the sixth, whose user wanted "not a link and not JSON", ended with the `npx` + command for the user, as one run of the old text had. - **The skill names no product** (2026-11-12, the owner's call). Its routes were told apart by the apps they were measured in; they now say what each needs: a shell that reaches the npm registry, Node and a download where npm cannot install, or nothing that runs or fetches. What a diff --git a/skills/h5p-author/SKILL.md b/skills/h5p-author/SKILL.md index dfff72d..f5d6ff6 100644 --- a/skills/h5p-author/SKILL.md +++ b/skills/h5p-author/SKILL.md @@ -10,7 +10,8 @@ You write a short source: the content type and only what its defaults cannot kno `@missing-elements/h5p-author` fills in the rest from the libraries, copies them, and checks every field. Needs Node 22 and a shell; nothing to install. Where `npx` cannot install, it builds from two downloaded files, or a page in the user's browser builds it (step 3), so never end with -commands for the user to run. +commands for the user to run. Only it writes the `.h5p`: never put one together yourself from +`h5p.json` and `content.json`, since one made by hand carries no libraries and nothing checks it. Keep [LICENSE](./LICENSE) with the skill. With this text alone and none of its files beside it, open https://missing-elements.github.io/h5p/skill/ @@ -127,8 +128,9 @@ npx @missing-elements/h5p-author@latest build source.json course.h5p ``` **If it cannot install here, build from files instead.** No network for npm (`EAI_AGAIN`, -`ENOTFOUND`, a registry's 403, 404 or 503): do not retry, try another way to install it, or end -with commands for the user to run once npm works. Where Node runs and you can fetch a file (where +`ENOTFOUND`, a registry's 403, 404 or 503, or an install that hangs until the command times out): +do not retry, try another way to install it, or end with commands for the user to run once npm +works. Where Node runs and you can fetch a file (where the sandbox downloads only what a browsing tool has opened, open each address with that tool first, then download it), fetch the build tool and the bundle of the source's own `type`, the libraries a build of that type reads, @@ -166,7 +168,9 @@ python3 -c "import base64,json,zlib;s=open('source.json','rb').read();f=[];json. **A link is only what one of these commands printed here, handed over whole: no command run, no link.** Never write a `#source=` link yourself, from memory or after an example, even when asked for one: its text is compressed, so it cannot be typed, and one wrong character leaves the page -nothing to build. +nothing to build. Where you can give the user a file, give them the source too, beside the link, +under the activity's name with `.source.json` (`course.source.json`): the page opens it, and a +link copied wrong into your reply builds nothing. Where nothing is built here and they print no link, with neither, or with no tool that runs anything at all (a chat's code tool can be unavailable for hours), give no link: the page sees @@ -203,8 +207,9 @@ removing what fails. Without a browser, say the package is **unverified**. ## 5. Review and hand over Check answers and feedback against the material. Where nothing was built here, step 3's build -page route is the whole hand-over: the link it printed, or the whole source and the page's -address. Otherwise let the user play it in their browser: +page route is the whole hand-over: the link it printed, with the source as a file where you can +give one, or the whole source and the page's address. Otherwise let the user play it in their +browser: ```bash npx @missing-elements/h5p-verify@latest course.h5p --preview