Function FetchBlob

internal/skills/discovery/discovery.go:918–944

FetchBlob retrieves the content of a blob by SHA. The blob is base64-encoded inside the JSON response and decoded here, so it is returned as iostreams.Untrusted and callers must choose sanitized display or raw round-tripping.

(client *api.Client, host, owner, repo, sha string)

// iostreams.Untrusted and callers must choose sanitized display or raw
// round-tripping.
func FetchBlob(client *api.Client, host, owner, repo, sha string) (iostreams.Untrusted, error) {
	apiPath, err := safeurl.JoinPath("repos", owner, repo, "git", "blobs", sha)
	if err != nil {
		return iostreams.Untrusted{}, err
	}
	var resp struct {
		SHA      string `json:"sha"`
		Content  string `json:"content"`
		Encoding string `json:"encoding"`
	}
	if err := client.REST(host, "GET", apiPath.String(), nil, &resp); err != nil {
		return iostreams.Untrusted{}, fmt.Errorf("could not fetch blob: %w", err)
	}

	if resp.Encoding != "base64" {
		return iostreams.Untrusted{}, fmt.Errorf("unexpected blob encoding: %s", resp.Encoding)
	}

	// GitHub API returns base64 with embedded newlines; use the StdEncoding
	// decoder via a reader to handle them transparently.
	decoded, err := io.ReadAll(base64.NewDecoder(base64.StdEncoding, strings.NewReader(resp.Content)))
	if err != nil {
		return iostreams.Untrusted{}, fmt.Errorf("could not decode blob content: %w", err)
	}

	return iostreams.NewUntrustedBytes(decoded), nil
}

// DiscoverLocalSkills finds non-hidden-dir skills in a local directory using
// the same conventions as remote discovery. Hidden-dir skills are excluded; use