René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Revert content hash identity — use git ref instead","articleBody":"## Summary\n\nThe content hash identity system (PR #382) adds unnecessary complexity. Git repos already provide identity via `url + ref` (SHA/tag/branch). Computing content hashes of all skill files on every sync adds CPU overhead and code complexity for no practical benefit that `git rev-parse` doesn't already provide.\n\n## Problem\n\n- **Content hash = overkill for git-based plugins.** `git rev-parse HEAD` gives you the remote content SHA cheaply. Content hashes recompute on every sync.\n- **npm uses hashes for integrity, not identity.** npm's `package-lock.json` stores SHA-512 hashes to verify downloads weren't corrupted — it still identifies packages by name + version. allagents doesn't have the same supply chain attack surface (local git repos).\n- **gh CLI** uses a single binary with vendored deps — no runtime dependency resolution at all. Version = identity.\n- **Added complexity without practical benefit.** The `computeContentHash` function iterates all skill files and hashes them. This is wasted work when `git pull` + `git rev-parse HEAD` already tells you if content changed.\n\n## Proposal\n\nRevert the content hash system. The lock file should track:\n\n```typescript\ninterface PluginLockEntry {\n  url: string;        // plugin source\n  ref: string;        // git SHA/tag/branch (identity)\n  lastSynced: number; // timestamp\n}\n```\n\n- `ref` (from `git rev-parse HEAD` after fetch) uniquely identifies content\n- `lastSynced` tells you when it was last fetched\n- No content hash computation needed\n\n## Scope\n\n- Remove `computeContentHash` from `sync.ts`\n- Remove `contentHash` from `LockFileEntry` interface\n- Simplify `updateLockEntry` to set `ref` + `lastSynced` only\n- Remove any hash comparison logic in `needsSync`\n- Update tests accordingly\n\n## Why\n\nThe content hash adds:\n- CPU overhead (hashing all skill files on every sync)\n- Code complexity (hash computation, comparison, migration)\n- No practical benefit over `git ref` identity\n\nVersion pinning (fixed git ref) + `git pull` is sufficient. This is what npm ultimately does (lock file = exact version, not hash-for-identity), and what git does natively (commit SHA = content identity).\n","author":{"url":"https://github.com/christso","@type":"Person","name":"christso"},"datePublished":"2026-05-12T21:35:46.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/388/allagents/issues/388"}