fix(skills): harden URL conversion

Author: xixu-me

skills/xget/SKILL.md

@@ -29,8 +29,8 @@ self-hosted option exists.
    - `XGET_BASE_URL` from the environment
    - if neither exists and the task is not just writing docs, ask the user for
      their self-hosted Xget domain and configure `XGET_BASE_URL`
-   - `https://xget.example.com` only for docs or templates when a real domain
-     is not available yet
+   - `https://xget.example.com` only for docs or templates when a real domain is
+     not available yet
    - `https://xget.xi-xu.me` only as an explicitly labeled fallback after the
      user declines or cannot provide a self-hosted domain
 2. Keep platform data fresh. Do not hardcode the full prefix list from memory.
@@ -51,7 +51,8 @@ node scripts/xget.mjs convert --base-url https://xget.example.com --url https://
 
 1. Identify the user's goal:
    - convert one or more upstream URLs
-   - generate config snippets for npm, pip, Go, NuGet, Cargo, Docker, or AI SDKs
+   - generate config snippets for npm, pip, Go, NuGet, Docker, or AI SDKs
+   - explain the current Cargo limitation for registry source replacement
    - explain which Xget prefix to use
    - propose or document a self-hosted deployment
 2. Refresh the live platform map with `scripts/xget.mjs` if the answer depends
@@ -62,6 +63,7 @@ node scripts/xget.mjs convert --base-url https://xget.example.com --url https://
 5. Before finishing, sanity-check that every example uses the right Xget path
    shape:
    - repo/content: `/{prefix}/...`
+   - crates.io HTTP URLs: `/crates/...` rather than `/crates/api/v1/crates/...`
    - inference APIs: `/ip/{provider}/...`
    - OCI registries: `/cr/{registry}/...`
 
@@ -94,7 +96,10 @@ node scripts/xget.mjs platforms --format table
   [references/REFERENCE.md](references/REFERENCE.md).
 - If an upstream URL does not match any known platform, do not invent a prefix.
   Report that no current Xget mapping was found.
-- When writing pip config for HTTPS domains, keep `trusted-host` aligned with
-  the actual host only if the user really needs it.
+- The default pip snippet should omit `trusted-host`; add it only when the
+  deployment really needs it and keep it aligned with the actual host.
+- The `cargo` preset is informational for now. Xget can rewrite direct
+  `crates.io` HTTP URLs under `/crates/...`, but this skill should not emit
+  Cargo source replacement config until Xget exposes a registry index endpoint.
 - When generating docs or templates without a real domain, prefer
   `https://xget.example.com` over the public demo.

skills/xget/references/REFERENCE.md

@@ -9,7 +9,9 @@ Use these defaults in order:
 3. `https://xget.example.com` only for templates and docs
 4. `https://xget.xi-xu.me` only as a clearly labeled public-demo fallback
 
-The Xget README explicitly labels `xget.xi-xu.me` as a pre-deployed instance with no reliability guarantee, while the self-hosting docs and DigitalOcean guide show recommended self-hosted domains such as `xget.example.com`.
+The Xget README explicitly labels `xget.xi-xu.me` as a pre-deployed instance
+with no reliability guarantee, while the self-hosting docs and DigitalOcean
+guide show recommended self-hosted domains such as `xget.example.com`.
 
 ## Live platform source
 
@@ -44,7 +46,11 @@ The script derives these path shapes from platform keys:
 - pip simple index: `https://{base}/pypi/simple/`
 - Go proxy: `https://{base}/golang`
 - NuGet v3 index: `https://{base}/nuget/v3/index.json`
-- Cargo registry: `https://{base}/crates/`
+- Direct crates.io HTTP URLs: `https://{base}/crates/...`
+
+Cargo registry source replacement is not currently emitted by this skill. Xget's
+`/crates/...` route rewrites direct crates.io HTTP API and download URLs, but it
+does not expose a Cargo registry index endpoint.
 
 ### Container registries
 
@@ -76,7 +82,7 @@ Representative presets:
 - `pip`
 - `go`
 - `nuget`
-- `cargo`
+- `cargo` (returns the current limitation instead of source replacement config)
 - `docker-ghcr`
 - `openai`
 - `anthropic`
@@ -98,7 +104,7 @@ services:
     image: ghcr.io/xixu-me/xget:latest
     container_name: xget
     ports:
-      - "127.0.0.1:8080:8080"
+      - '127.0.0.1:8080:8080'
     restart: unless-stopped
 ```
 
@@ -109,8 +115,14 @@ Representative reverse-proxy outcome:
 
 ## Troubleshooting heuristics
 
-- `404` on converted URLs often means the wrong prefix or an unmatched upstream platform.
-- pip issues often come from mixing the right `index-url` with the wrong host in `trusted-host`.
+- `404` on converted URLs often means the wrong prefix or an unmatched upstream
+  platform.
+- crates.io conversions should strip the upstream `/api/v1/crates` prefix before
+  adding `/crates/...`.
+- pip issues often come from adding `trusted-host` unnecessarily or pointing it
+  at the wrong host.
 - Docker examples must use `/cr/{registry}` prefixes, not plain `/{prefix}`.
-- AI SDK examples usually need the Xget base URL changed but keep the original API key behavior.
-- If the user asks for the “latest” supported platform, refresh the live platform map before answering.
+- AI SDK examples usually need the Xget base URL changed but keep the original
+  API key behavior.
+- If the user asks for the “latest” supported platform, refresh the live
+  platform map before answering.