From 18b55582d742c7855246ef5d7acaf53dcfa5a0fa Mon Sep 17 00:00:00 2001 From: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Date: Mon, 26 Oct 2026 11:31:05 +0800 Subject: [PATCH 1/2] chore(release): prepare CLI 0.2.0 and DSH 0.4.0 Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --- cli/CHANGELOG.md | 44 +++++++++++++++---- cli/package.json | 2 +- cli/src/generated/pkg-info.ts | 2 +- .../add-dsh-native-plugin/release-guide.md | 19 ++++++-- .../add-dsh-native-plugin/release-notes.md | 16 +++++++ plugins/dsh/README.en.md | 22 +++++++--- plugins/dsh/README.md | 22 +++++++--- plugins/dsh/package.json | 2 +- 8 files changed, 100 insertions(+), 29 deletions(-) diff --git a/cli/CHANGELOG.md b/cli/CHANGELOG.md index 998bb731b..e4843c5f5 100644 --- a/cli/CHANGELOG.md +++ b/cli/CHANGELOG.md @@ -2,18 +2,44 @@ All notable CLI behavior changes are documented in this file. -## Unreleased +## 0.2.0 (release candidate) + +### Added + +- Add Skill Suite installation, checking, upgrade planning/execution and removal with exact + member versions, shared ownership and local-change protection. Suite commands require a + Registry implementing the Suite API; this release does not add that API to an existing server. +- Add OAuth Device Flow to `skillhub login` when no API token is supplied, including browser + launch, `--no-open`, bounded polling and non-secret JSON progress. +- Add `pi`, `dsh` and `zcode` agent profiles and their user/project directory detection. +- Preserve authored `.skillhub/examples.json` with the skill package through publication, + installation, synchronization and upgrades. Invalid example declarations remain ordinary + files; only installer-owned `.skillhub/metadata.json` is excluded from directory publication. + +### Changed + +- Store installed versions per location in inventory schema v2. User and project copies can + have different versions; updates and removals preserve unselected locations and Suite owners. +- Reading v1 inventory does not migrate it. Before the first successful v2 write, preserve a + byte-verified `inventory.v1..backup.json` alongside the inventory. +- Upgrade all CLI clients sharing the inventory to `0.2.0` before using DSH plugin `0.4.0`. + Old CLI/new inventory mixed writes are unsupported. Inventory backup alone is not a rollback + of skill files, metadata or operation journals changed after migration. +- Provide the shared native installation core used by the DSH plugin, with precise target, + confirmation, transaction recovery and local-change protection. + +### Fixed + +- Retain Registry URL prefixes when following application-relative download URLs, including + install and namespace synchronization. +- Preserve numeric-looking version strings and reject repeated or conflicting version options. +- Preserve authored `.skillhub` files in fingerprints and packages instead of excluding the + whole directory; normalize ZIP directory separators consistently. + +## Notes retained from 0.1.12 and earlier ### Added -- Add the `zcode` agent profile, displayed as ZCode, with automatic detection of project-level - and user-level `.zcode/skills` directories. -- Add the `dsh` agent profile, displayed as DeepSeek Harness, with automatic detection of - project-level and user-level `.dsh/skills` directories. -- Add OAuth Device Flow to `skillhub login` when no API token is supplied, including best-effort - browser launch, a `--no-open` headless mode, bounded polling, and non-secret JSON progress output. -- Add the `pi` agent profile, displayed as Pi, with `--agent pi`, project-level - `/.pi/skills/`, and user-level `~/.pi/agent/skills/` support. - Add the user-level `astudio` agent profile, displayed as AStudio, with automatic detection of `~/.acode/skills` on Linux, macOS, and Windows. - Add repeatable `sync pull --skill ` selection for non-interactive and JSON workflows, with diff --git a/cli/package.json b/cli/package.json index 668e4d6ba..990587273 100644 --- a/cli/package.json +++ b/cli/package.json @@ -1,6 +1,6 @@ { "name": "@astron-team/skillhub", - "version": "0.1.12", + "version": "0.2.0", "description": "Manage and install skills for AI coding agents", "keywords": [ "skillhub", diff --git a/cli/src/generated/pkg-info.ts b/cli/src/generated/pkg-info.ts index 6b3b5a6b4..4391833da 100644 --- a/cli/src/generated/pkg-info.ts +++ b/cli/src/generated/pkg-info.ts @@ -1,3 +1,3 @@ // Generated by scripts/generate-pkg-info.ts - do not edit by hand. export const PKG_NAME = "@astron-team/skillhub" -export const PKG_VERSION = "0.1.12" +export const PKG_VERSION = "0.2.0" diff --git a/openspec/changes/add-dsh-native-plugin/release-guide.md b/openspec/changes/add-dsh-native-plugin/release-guide.md index 4b7752833..eb1680777 100644 --- a/openspec/changes/add-dsh-native-plugin/release-guide.md +++ b/openspec/changes/add-dsh-native-plugin/release-guide.md @@ -10,6 +10,19 @@ 插件运行在 DSH 主机，不部署进 SkillHub 网站，也不要求网站嵌入插件 UI。插件内部 Remote 接口随插件版本交付；Registry API 随服务端交付。两者分别管理版本和发布节奏。 +### 1.1 本轮 npm 发布与升级顺序 + +本轮只交付 CLI `0.2.0` 和 DSH 插件 `0.4.0`，不发布服务端镜像、不部署 SaaS。插件内置安装核心，不要求另装 CLI；但同一用户使用 CLI 共同管理技能时，两者必须使用兼容库存格式。 + +1. 完成候选 tarball 的干净安装与旧库存升级验证。保留旧版公开包及未迁移的隔离数据，用真实旧包建立升级基线；不能只用新代码构造旧 JSON 就声称完成旧版升级。 +2. 先发布 `@astron-team/skillhub@0.2.0`，检查公开包版本、命令输出、库存 v1 只读行为、首次写入的 v2 迁移与备份、用户/项目版本隔离。 +3. 再发布 `@astron-team/skillhub-dsh@0.4.0`，核对公开包与已测候选完整性，在支持的 DSH Profile 中干净安装或升级，确认既有技能保留、管理与使用入口正常。 +4. 已同时使用 CLI 的用户先升级这些 CLI，再升级插件，并停止旧 CLI 的后台写入。只有插件的用户无需额外安装 CLI。旧 CLI 与 v2 库存混写不受支持。 + +读取库存 v1 不会写盘迁移；首次写入 v2 前在库存同目录生成并核对 `inventory.v1..backup.json`。备份只覆盖旧库存，不覆盖之后改变的技能目录、安装元数据或事务日志。位置版本已经分化后，不能仅替换库存或降级包；回退需停止所有写入并核对对应文件与记录，不能把库存备份称为完整回滚点。 + +`.skillhub/examples.json` 是作者随包提供的版本内容，安装后路径不变，参与指纹与生命周期；它不是全局配置或安装器生成的副本。升级验证应包含带案例与无案例的技能，并确认无效声明按普通文件保留。 + ## 2. 验证流程 ```mermaid @@ -73,7 +86,7 @@ npm pack --ignore-scripts --pack-destination /absolute/path/to/candidate-output ### 2.3 隔离环境验证 -本次 `0.3.1` 候选分别验证 DSH `0.2.0-rc.2` 与 `0.2.1-rc.2`，Node `>=24.2.0 <25`。Host、app-boot、核心模块及注入 Client 模块须为同一精确发行版。新 RC 仅使用 `4.0.5 / 1.0.6 / 1.0.10 / 1.1.7`；旧 RC 的 Cordis、Loader、Include、Timer 须为已验证的完整组合：`4.0.4 / 1.0.5 / 1.0.9 / 1.1.6` 或 `4.0.5 / 1.0.6 / 1.0.10 / 1.1.7`，不得交叉混装；以实际 Host 解析结果为准。已发布 `0.1.0` 尚不包含后一组合支持及历史回执修复，`0.1.1` 起包含这些修复，`0.2.0` 延续此兼容基线；发布前使用本次 tarball 验证。在独立测试账户或容器中准备 Web Profile、工作区和测试技能，连接测试 Registry。仅隔离 Profile/DSH home 不足以隔离共享 inventory。 +本次 `0.4.0` 候选分别验证 DSH `0.2.0-rc.2` 与 `0.2.1-rc.2`，Node `>=24.2.0 <25`。Host、app-boot、核心模块及注入 Client 模块须为同一精确发行版。新 RC 仅使用 `4.0.5 / 1.0.6 / 1.0.10 / 1.1.7`；旧 RC 的 Cordis、Loader、Include、Timer 须为已验证的完整组合：`4.0.4 / 1.0.5 / 1.0.9 / 1.1.6` 或 `4.0.5 / 1.0.6 / 1.0.10 / 1.1.7`，不得交叉混装；以实际 Host 解析结果为准。已发布 `0.1.0` 尚不包含后一组合支持及历史回执修复，`0.1.1` 起包含这些修复，`0.2.0` 延续此兼容基线；发布前使用本次 tarball 验证。在独立测试账户或容器中准备 Web Profile、工作区和测试技能，连接测试 Registry。仅隔离 Profile/DSH home 不足以隔离共享 inventory。 首次创建测试 Web Profile，然后安装本地候选包： @@ -158,7 +171,7 @@ SaaS 使用其现有流水线部署；公共接口契约、测试数据规则与 ### 4.1 独立发布流程 -插件使用独立版本，tag 前缀固定为 `dsh-v`（本次为 `dsh-v0.3.1`），不复用 CLI 的 `cli-v*` 发布流程。专用工作流为 `.github/workflows/release-dsh-plugin.yml`；发布前仍须确认 npm 包名、兼容基线及候选包验收，本次候选为 `0.3.1`，manifest 已显式设为 `private: false`；缺省 Registry 为 `https://skill.xfyun.cn`，显式空串/空白仍断开，已有自定义来源保留。发布前分别验证缺省、断开和自定义配置，以及正式域名的固定版本安装、状态识别和本地管理。正式发布仍以最终提交、候选验收和审批结果为准。 +插件使用独立版本，tag 前缀固定为 `dsh-v`（本次为 `dsh-v0.4.0`），不复用 CLI 的 `cli-v*` 发布流程。专用工作流为 `.github/workflows/release-dsh-plugin.yml`；发布前仍须确认 npm 包名、兼容基线及候选包验收，本次候选为 `0.4.0`，manifest 已显式设为 `private: false`；缺省 Registry 为 `https://skill.xfyun.cn`，显式空串/空白仍断开，已有自定义来源保留。发布前分别验证缺省、断开和自定义配置，以及正式域名的固定版本安装、状态识别和本地管理。正式发布仍以最终提交、候选验收和审批结果为准。 发布流程依次完成：校验版本 → 测试与构建 → 生成并检查 tarball → 隔离 DSH 候选验收 → 发布审批 → 发布 npm → 校验已发布包。当前工作流自动执行版本校验、测试与构建、包检查、上传及完整性校验；隔离 DSH 的 UI、真实模型和平台验收按本次确认范围另行执行，未验项目须单独注明；CI 矩阵成功不等同于这些验收通过。工作流使用仓库的 `NPM_TOKEN` 发布凭证，源码及 npm 包不包含凭证；配置了环境保护规则时还须完成对应审批。 @@ -181,7 +194,7 @@ SaaS 使用其现有流水线部署；公共接口契约、测试数据规则与 ### 4.3 发布说明 -`0.3.1` 的变更说明见 [release-notes.md](release-notes.md)。正式版本发布前按最终候选及验收结果更新，不沿用开发版本的支持声明。 +`0.4.0` 的变更说明见 [release-notes.md](release-notes.md)。正式版本发布前按最终候选及验收结果更新，不沿用开发版本的支持声明。 每个版本包含： diff --git a/openspec/changes/add-dsh-native-plugin/release-notes.md b/openspec/changes/add-dsh-native-plugin/release-notes.md index c8680d27c..fd8deb40f 100644 --- a/openspec/changes/add-dsh-native-plugin/release-notes.md +++ b/openspec/changes/add-dsh-native-plugin/release-notes.md @@ -2,8 +2,24 @@ ## 版本与交付状态 +当前准备版本为 `0.4.0`，尚未发布；上一公开版本为以下 `0.3.1`。 + `@astron-team/skillhub-dsh@0.3.1` 已发布，独立标签为 `dsh-v0.3.1`。[发布准备 PR #995](https://github.com/iflytek/skillhub/pull/995) 已合并，[专用发布工作流](https://github.com/iflytek/skillhub/actions/runs/39556075587) 成功；[公开 npm 包](https://www.npmjs.com/package/@astron-team/skillhub-dsh/v/0.3.1) 与工作流产物逐字节一致，`latest` 指向 `0.3.1`。两版 Linux 的严格安装、原生探针及浏览器操作复验通过，测试工件与公开包字节一致，结果见 [验证摘要](verification.md)。历史已发布版本保持不变。 +## 0.4.0 候选：技能使用与对话管理 + +`@astron-team/skillhub-dsh@0.4.0` 为待发布候选，独立标签为 `dsh-v0.4.0`；配套共享库存的 CLI 候选为 `@astron-team/skillhub@0.2.0`。以下为已合并实现，不表示 npm 已发布或公开包已验收。 + +- **使用技能与案例**：[PR #1007](https://github.com/iflytek/skillhub/pull/1007) 支持作者随包提供 `.skillhub/examples.json`，按语言选择案例；技能中心进入同工作区新对话，对话卡保留当前会话，在原生输入框上方选择案例并填入草稿，保留原文字、引用和附件，不自动发送。案例与技能版本共同安装和校验，无效声明按普通文件保留。 +- **对话管理**：[PR #1018](https://github.com/iflytek/skillhub/pull/1018) 支持当前来源的已安装查询、最新或指定较新版本检查、升级、卸载及原操作查询；多份安装明确选择位置，写入必须由真人确认。历史引用、本地修改、共享归属和同名覆盖继续阻止不安全动作。 +- **按位置维护版本**：同一技能的用户和项目副本可保持不同版本，更新或卸载不影响未选位置。库存 v1 只读不迁移，首次写入 v2 前保存字节核对备份；同机共享库存的 CLI 必须先升级到 `0.2.0`，旧 CLI 混写不受支持。回退不能只恢复旧库存而忽略已更新的文件和操作记录。 +- **紧凑交互与状态同步**：多技能两列卡片、组内位置选择、精简结果与独立错误行；通过官方运行时上下文提供当前安装快照，避免按钮操作后模型只引用旧历史。宿主禁用该上下文时仍须工具重查，快照不是写入授权。 +- **兼容与来源**：保留 `0.3.1` 的两版 DSH RC、Node 和 Cordis 约束，默认 Registry 仍为 `https://skill.xfyun.cn`。不新增登录、服务端文件操作或 SaaS 部署。 + +功能分支完成 CLI/插件自动检查、双 RC Host/浏览器及指定模型真实对话验收；最终版本候选、发布工作流和公开 npm 包检查分别记录，不用历史结果代替公开包验证。优先发布配套 CLI，确认公开安装可用后再发布插件；具体顺序与回退限制见 [发布指南](release-guide.md)。 + +完整变更：[DSH 0.3.1 → 0.4.0](https://github.com/iflytek/skillhub/compare/dsh-v0.3.1...dsh-v0.4.0)（新标签发布后可用）。 + ## 0.3.1 DSH 双 RC 兼容 - **精确发行版**：支持一致的 DSH `0.2.0-rc.2` 或 `0.2.1-rc.2` 依赖图；Host、app-boot、核心模块及注入 Client 模块必须同版，未知或混装继续拒绝新写入。 diff --git a/plugins/dsh/README.en.md b/plugins/dsh/README.en.md index f90273f2f..955e92011 100644 --- a/plugins/dsh/README.en.md +++ b/plugins/dsh/README.en.md @@ -8,13 +8,13 @@ Version `0.2.0` adds source-aware installation status to catalog cards and conve Version `0.2.1` defaults to `https://skill.xfyun.cn` when `registryUrl` is omitted. An explicit empty or whitespace-only value still disconnects; existing custom addresses are preserved. CLI defaults and credentials are not inherited. -Version `0.3.1` fixes compatibility with both enumerated DSH RCs, uses the independent `dsh-v0.3.1` release tag and retains the marketplace interactions and version management from `0.3.0`. Until npm publication and public-package verification finish, validate this version using its built tarball. +Version `0.4.0` is a release candidate using the independent `dsh-v0.4.0` tag. It adds versioned examples and native composer handoff, conversational installation management, and per-location installed versions while retaining the dual-RC compatibility of `0.3.1`. Until npm publication and public-package verification finish, validate this version using its built tarball. -## Use an installed skill (in development) +## Use an installed skill Choose “使用此技能” on an installed card, matching installed-version detail or completed installation result. Catalog entries open a new conversation in the same workspace; conversation entries keep their current session. After installation verification, examples appear above the native composer. Confirm an example or choose a custom task to insert an editable invocation. The original conversation is preserved, and in-conversation use retains its existing text, references and attachments. Complete the task and send it yourself; this action does not submit messages, call a model or install files. -An active session is required. Shadowed skills, modified files, disabled user invocation or changed context are reported without modifying the draft. Historical receipts are not proof of current installation. This feature is under development and is not part of published `0.3.1`. +An active session is required. Shadowed skills, modified files, disabled user invocation or changed context are reported without modifying the draft. Historical receipts are not proof of current installation. This feature is included in the `0.4.0` candidate, not in published `0.3.1`. ## Requirements and validation scope @@ -27,7 +27,7 @@ An active session is required. Shadowed skills, modified files, disabled user in | Build package manager | Bun `1.3.13`, using frozen lockfiles | | UI | Chinese, DSH light/dark themes and narrow layouts | | Verified environments | Both Linux DSH Hosts: strict installation, native probes and browser user/project install, upgrade, removal and cancellation; Windows browser UI and interactions against a real Host | -| Pending validation | New-RC native Windows/macOS filesystem operations; real desktop clients; real model calls with this compatibility fix | +| Validation boundary | Feature candidates have real-model and cross-platform CI evidence; the final `0.4.0` candidate and public package need separate acceptance. These results do not substitute for desktop clients, native Windows/macOS manual interactions or SaaS acceptance | Windows browser acceptance does not establish complete native Windows Host filesystem support. CI results do not replace desktop, model, or target-instance acceptance. See the repository's [compatibility design](../../openspec/changes/add-dsh-native-plugin/compatibility-design.md) and [acceptance criteria](../../openspec/changes/add-dsh-native-plugin/acceptance.md). @@ -69,15 +69,23 @@ Published `0.1.0` still requires the original Cordis `4.0.4` baseline and does n ## Install from npm -After `0.3.1` is published on npm, use these commands to install it. Check DSH, Node and a complete Cordis combination listed above, stop the target Web Profile Host, then install the exact version. Before publication, use the local candidate instructions below: +After `0.4.0` is published on npm, use these commands to install it. Check DSH, Node and a complete Cordis combination listed above, stop the target Web Profile Host, then install the exact version. Before publication, use the local candidate instructions below: ```sh -dsh plugin --profile skillhub-test add @astron-team/skillhub-dsh@0.3.1 --ignore-scripts +dsh plugin --profile skillhub-test add @astron-team/skillhub-dsh@0.4.0 --ignore-scripts dsh --profile skillhub-test --host 127.0.0.1 --port 0 --no-open ``` Replace `skillhub-test` with the intended Web Profile; initial creation is documented below. When `registryUrl` is omitted, the plugin uses `https://skill.xfyun.cn`. To use a self-hosted instance, change, test and save the source in plugin settings. Explicitly saving an empty address disconnects. Before publication, use a local candidate; failure to fetch an unpublished npm version does not indicate a plugin loading error. +## Upgrade from an older version + +`0.4.0` uses inventory schema v2 with per-location versions. The installation core remains bundled, so a separate CLI is unnecessary. If the same user also manages these skills through SkillHub CLI, upgrade every such CLI to `0.2.0` before upgrading the plugin and stop scheduled/background writes from old clients. After publication, run `npm install -g @astron-team/skillhub@0.2.0`, verify `skillhub version`, then install the exact plugin version above. + +Reading v1 inventory does not migrate it. Before the first v2 write, a byte-verified `inventory.v1..backup.json` is retained beside the inventory. User and project copies may retain different versions. Old CLI/v2 inventory mixed writes are unsupported. Once locations have changed independently, restoring the old inventory or downgrading the plugin alone is not a rollback: skill files, installation metadata and operation records must also be reconciled. + +Authors provide examples at the fixed `.skillhub/examples.json` path inside each skill package. The file keeps its location after installation and follows the skill's version and fingerprint; no separate global example copy is created. Skills without examples use a custom task; invalid declarations remain ordinary files without exposing invalid examples. + ## Install a local candidate These commands target the specified DSH Web release. Use the same Profile and DSH home for installation, startup and maintenance. `skillhub-test` is an example Profile. Skill-write testing requires a dedicated test account/container, workspace and test skills: a separate Profile or `DSH_HOME` alone does not isolate the shared inventory. @@ -181,7 +189,7 @@ The plugin uses independent `dsh-v` tags. `check-dsh-plugin.yml` runs n See the [release guide](../../openspec/changes/add-dsh-native-plugin/release-guide.md) and [release notes](../../openspec/changes/add-dsh-native-plugin/release-notes.md). OpenSpec and integration links refer to the source repository; those documents are not included in the tarball. -### Open-source interaction update (unreleased) +### Marketplace interaction and installation management Market cards open details and offer separate installation-management actions. Multiple installed scopes require a selected target. After an explicit install request, an omitted scope defaults to current user; project scope must be explicitly selected. Market install actions open the same dialog without detail-page navigation. Current user is preselected, with project scope in advanced options; the dialog never submits automatically. A later explicit user scope may start a new call. Details omit complete leading frontmatter and reuse public reads for 60 seconds without bypassing write validation. The versions tab requests `downloadableOnly=true`, requiring the updated open-source backend; SaaS synchronization and acceptance remain separate. diff --git a/plugins/dsh/README.md b/plugins/dsh/README.md index 5f4b708ad..6b024d80b 100644 --- a/plugins/dsh/README.md +++ b/plugins/dsh/README.md @@ -8,13 +8,13 @@ SkillHub 的 DSH 原生插件。在 DSH 侧栏打开 **技能中心**，匿名 `0.2.1` 缺省连接 `https://skill.xfyun.cn`；显式空串或仅空白仍表示断开，已有自定义地址保留。插件不继承 CLI 的默认地址或凭证。 -`0.3.1` 为 DSH 双 RC 兼容修复版本，使用独立发布标签 `dsh-v0.3.1`，保留 `0.3.0` 的市场交互与版本管理能力。npm 发布及公开包验收完成前，使用本版本构建的 tarball 验证。 +`0.4.0` 为待发布候选，独立标签为 `dsh-v0.4.0`，新增技能案例与原生输入框衔接、对话管理已安装技能及按安装位置独立维护版本。保留 `0.3.1` 的双 RC 兼容范围。npm 发布及公开包验收完成前，使用本版本构建的 tarball 验证。 -## 使用已安装技能（开发中） +## 使用已安装技能 在已安装卡片、已安装版本详情或安装成功结果点击“使用此技能”。技能中心入口在同一工作区新建对话，对话内入口保留当前会话。核验所选安装后，案例显示在原生输入框上方；确认案例或自定义任务后，带入可编辑的技能调用。原会话草稿不会被覆盖，对话内操作保留已有文字、引用和附件。补充任务和材料后自行发送；点击使用不会自动发送、调用模型或安装文件。 -需要当前活动会话。被项目同名技能覆盖、本地文件变更、禁止用户调用或会话/来源变化时会提示原因；历史回执不能代替当前安装状态。此功能正在开发，尚不属于已发布的 `0.3.1` 包。 +需要当前活动会话。被项目同名技能覆盖、本地文件变更、禁止用户调用或会话/来源变化时会提示原因；历史回执不能代替当前安装状态。此功能包含在 `0.4.0` 候选中，不属于已发布的 `0.3.1` 包。 ## 环境与验证范围 @@ -27,7 +27,7 @@ SkillHub 的 DSH 原生插件。在 DSH 侧栏打开 **技能中心**，匿名 | 开发包管理器 | Bun `1.3.13`，按锁文件安装 | | 当前 UI | 中文；支持 DSH 深浅主题和窄屏 | | 已验证环境 | Linux 两版 DSH Host 严格安装、原生探针及浏览器用户/项目安装、升级、卸载与取消；Windows 浏览器访问真实 Host 的界面和交互 | -| 待验证范围 | 新 RC 的 Windows/macOS 原生文件操作；真实桌面客户端；本次兼容修复的真实模型调用 | +| 验证边界 | 功能候选已进行真实模型对话及跨平台 CI；最终 `0.4.0` 候选与公开包须独立验收。真实桌面客户端、原生 Windows/macOS 人工交互和 SaaS 验收不由这些结果替代 | Windows 浏览器验证不等于 Windows 原生 Host 的全部文件操作已经验证。CI 的平台矩阵也不替代真实桌面、模型及目标实例验收。完整支持边界见仓库内的 [兼容设计](../../openspec/changes/add-dsh-native-plugin/compatibility-design.md) 和 [验收标准](../../openspec/changes/add-dsh-native-plugin/acceptance.md)。 @@ -69,15 +69,23 @@ npm pack --ignore-scripts --pack-destination /absolute/path/to/candidate-output ## 从 npm 安装 -`0.3.1` 在 npm 发布完成后，使用以下命令安装。先确认 DSH、Node 和上表完整 Cordis 组合满足要求，停止目标 Web Profile 的 Host，然后安装精确版本。发布完成前使用下一节的本地候选包： +`0.4.0` 在 npm 发布完成后，使用以下命令安装。先确认 DSH、Node 和上表完整 Cordis 组合满足要求，停止目标 Web Profile 的 Host，然后安装精确版本。发布完成前使用下一节的本地候选包： ```sh -dsh plugin --profile skillhub-test add @astron-team/skillhub-dsh@0.3.1 --ignore-scripts +dsh plugin --profile skillhub-test add @astron-team/skillhub-dsh@0.4.0 --ignore-scripts dsh --profile skillhub-test --host 127.0.0.1 --port 0 --no-open ``` `skillhub-test` 替换为实际 Web Profile；首次创建方法见下一节。未配置 `registryUrl` 时默认使用 `https://skill.xfyun.cn`。如需自建实例，在插件设置中修改来源并测试、保存；显式保存空地址可断开。发布前请使用本地候选包验收，不要将未发布版本的 npm 安装失败当成插件加载失败。 +## 从旧版本升级 + +`0.4.0` 使用按安装位置记录版本的库存 v2。插件仍内置安装核心，无需为了使用插件单独安装 CLI；如果同一用户还使用 SkillHub CLI 管理这些技能，先将这些 CLI 升级到 `0.2.0`，再升级插件，并停止旧版 CLI 的定时或后台写入。发布完成后使用 `npm install -g @astron-team/skillhub@0.2.0`，确认 `skillhub version`，再执行上面的精确插件版本安装命令。 + +读取旧库存不迁移；首次写入 v2 前，在库存同目录保存经字节核对的 `inventory.v1..backup.json`。同一技能的用户与项目副本可保留不同版本。旧 CLI 与 v2 库存混写不受支持；已分位置更新后，不能只恢复旧库存文件或降级插件来回退，必须同时核对实际技能文件、安装元数据和操作记录。 + +案例由作者随技能包提供固定文件 `.skillhub/examples.json`，安装后保持相同位置，跟随技能版本和指纹，不创建另一个全局案例副本。无案例时使用自定义任务；无效声明按普通文件保留，不提供错误的案例入口。 + ## 安装本地候选包 以下命令针对上述 DSH Web 发行版。`skillhub-test` 是示例 Profile 名称，请始终使用同一 Profile 和 DSH home 安装、启动和维护。首次测试应使用独立测试账户或容器、工作区和测试技能；仅创建 Profile 或更改 `DSH_HOME` 不能隔离共享技能 inventory。 @@ -181,7 +189,7 @@ dsh plugin --profile skillhub-test remove @astron-team/skillhub-dsh 具体部署、发布后检查与回退清单见 [发布指南](../../openspec/changes/add-dsh-native-plugin/release-guide.md)，变化见 [发布说明](../../openspec/changes/add-dsh-native-plugin/release-notes.md)。上述 OpenSpec 与测试链接面向源码仓库，不包含在 npm tarball 中。 -### 开源交互更新（待发布） +### 市场交互与安装管理 市场卡片支持点击进入详情及独立安装、卸载、检查更新/升级操作；多范围记录先选择管理目标。用户明确要求安装后，未指定范围默认当前用户；明确指定当前项目时安装到项目。市场卡片的安装按钮也直接打开确认弹窗；默认预选当前用户，项目级位于高级选项，但不自动提交。用户后续明确范围也可发起新调用。详情隐藏完整首部元数据，保留安全 Markdown；公开读取缓存 60 秒，写入仍重新核验。版本 Tab 请求 `downloadableOnly=true`，需要本次开源后端契约；SaaS 尚需单独同步和验收。 diff --git a/plugins/dsh/package.json b/plugins/dsh/package.json index 60da1ead7..60c67e003 100644 --- a/plugins/dsh/package.json +++ b/plugins/dsh/package.json @@ -1,6 +1,6 @@ { "name": "@astron-team/skillhub-dsh", - "version": "0.3.1", + "version": "0.4.0", "private": false, "type": "module", "license": "Apache-2.0", From c4e654cf67bfeee52e968ee0fe4bc12944ffc960 Mon Sep 17 00:00:00 2001 From: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Date: Mon, 26 Oct 2026 11:34:42 +0800 Subject: [PATCH 2/2] docs(release): keep package version guidance publication-neutral Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --- cli/CHANGELOG.md | 2 +- plugins/dsh/README.en.md | 15 ++++++++------- plugins/dsh/README.md | 15 ++++++++------- 3 files changed, 17 insertions(+), 15 deletions(-) diff --git a/cli/CHANGELOG.md b/cli/CHANGELOG.md index e4843c5f5..5622c3832 100644 --- a/cli/CHANGELOG.md +++ b/cli/CHANGELOG.md @@ -2,7 +2,7 @@ All notable CLI behavior changes are documented in this file. -## 0.2.0 (release candidate) +## 0.2.0 ### Added diff --git a/plugins/dsh/README.en.md b/plugins/dsh/README.en.md index 955e92011..7a5eb05ef 100644 --- a/plugins/dsh/README.en.md +++ b/plugins/dsh/README.en.md @@ -8,13 +8,13 @@ Version `0.2.0` adds source-aware installation status to catalog cards and conve Version `0.2.1` defaults to `https://skill.xfyun.cn` when `registryUrl` is omitted. An explicit empty or whitespace-only value still disconnects; existing custom addresses are preserved. CLI defaults and credentials are not inherited. -Version `0.4.0` is a release candidate using the independent `dsh-v0.4.0` tag. It adds versioned examples and native composer handoff, conversational installation management, and per-location installed versions while retaining the dual-RC compatibility of `0.3.1`. Until npm publication and public-package verification finish, validate this version using its built tarball. +Version `0.4.0` uses the independent `dsh-v0.4.0` tag. It adds versioned examples and native composer handoff, conversational installation management, and per-location installed versions while retaining the dual-RC compatibility of `0.3.1`. Check npm for public availability; locally built tarballs can be verified independently as described below. ## Use an installed skill Choose “使用此技能” on an installed card, matching installed-version detail or completed installation result. Catalog entries open a new conversation in the same workspace; conversation entries keep their current session. After installation verification, examples appear above the native composer. Confirm an example or choose a custom task to insert an editable invocation. The original conversation is preserved, and in-conversation use retains its existing text, references and attachments. Complete the task and send it yourself; this action does not submit messages, call a model or install files. -An active session is required. Shadowed skills, modified files, disabled user invocation or changed context are reported without modifying the draft. Historical receipts are not proof of current installation. This feature is included in the `0.4.0` candidate, not in published `0.3.1`. +An active session is required. Shadowed skills, modified files, disabled user invocation or changed context are reported without modifying the draft. Historical receipts are not proof of current installation. This feature is available from `0.4.0`. ## Requirements and validation scope @@ -27,7 +27,7 @@ An active session is required. Shadowed skills, modified files, disabled user in | Build package manager | Bun `1.3.13`, using frozen lockfiles | | UI | Chinese, DSH light/dark themes and narrow layouts | | Verified environments | Both Linux DSH Hosts: strict installation, native probes and browser user/project install, upgrade, removal and cancellation; Windows browser UI and interactions against a real Host | -| Validation boundary | Feature candidates have real-model and cross-platform CI evidence; the final `0.4.0` candidate and public package need separate acceptance. These results do not substitute for desktop clients, native Windows/macOS manual interactions or SaaS acceptance | +| Validation boundary | The feature implementation has real-model and cross-platform CI evidence; built artifacts and public packages have separate acceptance records. These results do not substitute for desktop clients, native Windows/macOS manual interactions or SaaS acceptance | Windows browser acceptance does not establish complete native Windows Host filesystem support. CI results do not replace desktop, model, or target-instance acceptance. See the repository's [compatibility design](../../openspec/changes/add-dsh-native-plugin/compatibility-design.md) and [acceptance criteria](../../openspec/changes/add-dsh-native-plugin/acceptance.md). @@ -69,18 +69,19 @@ Published `0.1.0` still requires the original Cordis `4.0.4` baseline and does n ## Install from npm -After `0.4.0` is published on npm, use these commands to install it. Check DSH, Node and a complete Cordis combination listed above, stop the target Web Profile Host, then install the exact version. Before publication, use the local candidate instructions below: +Query the exact npm version first and install only after confirming availability. Check DSH, Node and a complete Cordis combination listed above, stop the target Web Profile Host, then install the plugin. A verified local tarball can also be installed using the next section: ```sh +npm view @astron-team/skillhub-dsh@0.4.0 version dsh plugin --profile skillhub-test add @astron-team/skillhub-dsh@0.4.0 --ignore-scripts dsh --profile skillhub-test --host 127.0.0.1 --port 0 --no-open ``` -Replace `skillhub-test` with the intended Web Profile; initial creation is documented below. When `registryUrl` is omitted, the plugin uses `https://skill.xfyun.cn`. To use a self-hosted instance, change, test and save the source in plugin settings. Explicitly saving an empty address disconnects. Before publication, use a local candidate; failure to fetch an unpublished npm version does not indicate a plugin loading error. +Replace `skillhub-test` with the intended Web Profile; initial creation is documented below. When `registryUrl` is omitted, the plugin uses `https://skill.xfyun.cn`. To use a self-hosted instance, change, test and save the source in plugin settings. Explicitly saving an empty address disconnects. Diagnose npm query/download failures separately from plugin loading errors. ## Upgrade from an older version -`0.4.0` uses inventory schema v2 with per-location versions. The installation core remains bundled, so a separate CLI is unnecessary. If the same user also manages these skills through SkillHub CLI, upgrade every such CLI to `0.2.0` before upgrading the plugin and stop scheduled/background writes from old clients. After publication, run `npm install -g @astron-team/skillhub@0.2.0`, verify `skillhub version`, then install the exact plugin version above. +`0.4.0` uses inventory schema v2 with per-location versions. The installation core remains bundled, so a separate CLI is unnecessary. If the same user also manages these skills through SkillHub CLI, upgrade every such CLI to `0.2.0` before upgrading the plugin and stop scheduled/background writes from old clients. Confirm availability with `npm view @astron-team/skillhub@0.2.0 version`, then run `npm install -g @astron-team/skillhub@0.2.0`, verify `skillhub version`, then install the exact plugin version above. Reading v1 inventory does not migrate it. Before the first v2 write, a byte-verified `inventory.v1..backup.json` is retained beside the inventory. User and project copies may retain different versions. Old CLI/v2 inventory mixed writes are unsupported. Once locations have changed independently, restoring the old inventory or downgrading the plugin alone is not a rollback: skill files, installation metadata and operation records must also be reconciled. @@ -183,7 +184,7 @@ dsh plugin --profile skillhub-test remove @astron-team/skillhub-dsh ## Server synchronization and independent release -The plugin Host calls anonymous Registry HTTP APIs; local file transactions stay on the Host. SaaS does not need a new API that controls user filesystems. Define and verify contracts in open source first, then synchronize missing routes, fields, anonymous policy and tests to SaaS. Public npm `0.2.0` has verified catalog, search, documentation, version selection and fixed-version project installation against `https://skill.xfyun.cn`, including files/fingerprint, inventory and DSH discovery. This candidate and its public package require separate acceptance. Non-SemVer versions with no reliable ordering, including date-based versions, remain blocked from automatic upgrades; no executable upgrade action is offered. Verified first-time fixed-version installation remains available. Real model execution of SaaS skills is unverified. See the [Registry contract](../../openspec/changes/add-dsh-native-plugin/registry-api-contract.md). +The plugin Host calls anonymous Registry HTTP APIs; local file transactions stay on the Host. SaaS does not need a new API that controls user filesystems. Define and verify contracts in open source first, then synchronize missing routes, fields, anonymous policy and tests to SaaS. Public npm `0.2.0` has verified catalog, search, documentation, version selection and fixed-version project installation against `https://skill.xfyun.cn`, including files/fingerprint, inventory and DSH discovery. Each version’s built artifacts and public package require separate acceptance. Non-SemVer versions with no reliable ordering, including date-based versions, remain blocked from automatic upgrades; no executable upgrade action is offered. Verified first-time fixed-version installation remains available. Real model execution of SaaS skills is unverified. See the [Registry contract](../../openspec/changes/add-dsh-native-plugin/registry-api-contract.md). The plugin uses independent `dsh-v` tags. `check-dsh-plugin.yml` runs normal clean-install checks on Linux/macOS/Windows × Node 24.2.0/current Node 24, plus an isolated retained-Cordis baseline regression. `release-dsh-plugin.yml` is manual and defaults to candidate-only operation. Publishing requires an approved version, publishable manifest, candidate acceptance and explicit release authorization; configured environment protection rules must also be satisfied. Version updates are explicit commits; npm publication uses the dedicated workflow after release authorization. diff --git a/plugins/dsh/README.md b/plugins/dsh/README.md index 6b024d80b..cd5d2aae4 100644 --- a/plugins/dsh/README.md +++ b/plugins/dsh/README.md @@ -8,13 +8,13 @@ SkillHub 的 DSH 原生插件。在 DSH 侧栏打开 **技能中心**，匿名 `0.2.1` 缺省连接 `https://skill.xfyun.cn`；显式空串或仅空白仍表示断开，已有自定义地址保留。插件不继承 CLI 的默认地址或凭证。 -`0.4.0` 为待发布候选，独立标签为 `dsh-v0.4.0`，新增技能案例与原生输入框衔接、对话管理已安装技能及按安装位置独立维护版本。保留 `0.3.1` 的双 RC 兼容范围。npm 发布及公开包验收完成前，使用本版本构建的 tarball 验证。 +`0.4.0` 使用独立标签 `dsh-v0.4.0`，提供技能案例与原生输入框衔接、对话管理已安装技能及按安装位置独立维护版本。保留 `0.3.1` 的双 RC 兼容范围。公开可用状态以 npm 为准；本地构建的 tarball 可按下文独立验证。 ## 使用已安装技能 在已安装卡片、已安装版本详情或安装成功结果点击“使用此技能”。技能中心入口在同一工作区新建对话，对话内入口保留当前会话。核验所选安装后，案例显示在原生输入框上方；确认案例或自定义任务后，带入可编辑的技能调用。原会话草稿不会被覆盖，对话内操作保留已有文字、引用和附件。补充任务和材料后自行发送；点击使用不会自动发送、调用模型或安装文件。 -需要当前活动会话。被项目同名技能覆盖、本地文件变更、禁止用户调用或会话/来源变化时会提示原因；历史回执不能代替当前安装状态。此功能包含在 `0.4.0` 候选中，不属于已发布的 `0.3.1` 包。 +需要当前活动会话。被项目同名技能覆盖、本地文件变更、禁止用户调用或会话/来源变化时会提示原因；历史回执不能代替当前安装状态。此功能自 `0.4.0` 起提供。 ## 环境与验证范围 @@ -27,7 +27,7 @@ SkillHub 的 DSH 原生插件。在 DSH 侧栏打开 **技能中心**，匿名 | 开发包管理器 | Bun `1.3.13`，按锁文件安装 | | 当前 UI | 中文；支持 DSH 深浅主题和窄屏 | | 已验证环境 | Linux 两版 DSH Host 严格安装、原生探针及浏览器用户/项目安装、升级、卸载与取消；Windows 浏览器访问真实 Host 的界面和交互 | -| 验证边界 | 功能候选已进行真实模型对话及跨平台 CI；最终 `0.4.0` 候选与公开包须独立验收。真实桌面客户端、原生 Windows/macOS 人工交互和 SaaS 验收不由这些结果替代 | +| 验证边界 | 功能实现已进行真实模型对话及跨平台 CI；构建产物与公开包的验收分别记录。真实桌面客户端、原生 Windows/macOS 人工交互和 SaaS 验收不由这些结果替代 | Windows 浏览器验证不等于 Windows 原生 Host 的全部文件操作已经验证。CI 的平台矩阵也不替代真实桌面、模型及目标实例验收。完整支持边界见仓库内的 [兼容设计](../../openspec/changes/add-dsh-native-plugin/compatibility-design.md) 和 [验收标准](../../openspec/changes/add-dsh-native-plugin/acceptance.md)。 @@ -69,18 +69,19 @@ npm pack --ignore-scripts --pack-destination /absolute/path/to/candidate-output ## 从 npm 安装 -`0.4.0` 在 npm 发布完成后，使用以下命令安装。先确认 DSH、Node 和上表完整 Cordis 组合满足要求，停止目标 Web Profile 的 Host，然后安装精确版本。发布完成前使用下一节的本地候选包： +先查询 npm 上的精确版本，确认可用后安装。核对 DSH、Node 和上表完整 Cordis 组合，停止目标 Web Profile 的 Host，再执行插件安装；也可按下一节安装已验证的本地 tarball： ```sh +npm view @astron-team/skillhub-dsh@0.4.0 version dsh plugin --profile skillhub-test add @astron-team/skillhub-dsh@0.4.0 --ignore-scripts dsh --profile skillhub-test --host 127.0.0.1 --port 0 --no-open ``` -`skillhub-test` 替换为实际 Web Profile；首次创建方法见下一节。未配置 `registryUrl` 时默认使用 `https://skill.xfyun.cn`。如需自建实例，在插件设置中修改来源并测试、保存；显式保存空地址可断开。发布前请使用本地候选包验收，不要将未发布版本的 npm 安装失败当成插件加载失败。 +`skillhub-test` 替换为实际 Web Profile；首次创建方法见下一节。未配置 `registryUrl` 时默认使用 `https://skill.xfyun.cn`。如需自建实例，在插件设置中修改来源并测试、保存；显式保存空地址可断开。npm 查询或下载失败与插件加载失败应分别诊断。 ## 从旧版本升级 -`0.4.0` 使用按安装位置记录版本的库存 v2。插件仍内置安装核心，无需为了使用插件单独安装 CLI；如果同一用户还使用 SkillHub CLI 管理这些技能，先将这些 CLI 升级到 `0.2.0`，再升级插件，并停止旧版 CLI 的定时或后台写入。发布完成后使用 `npm install -g @astron-team/skillhub@0.2.0`，确认 `skillhub version`，再执行上面的精确插件版本安装命令。 +`0.4.0` 使用按安装位置记录版本的库存 v2。插件仍内置安装核心，无需为了使用插件单独安装 CLI；如果同一用户还使用 SkillHub CLI 管理这些技能，先将这些 CLI 升级到 `0.2.0`，再升级插件，并停止旧版 CLI 的定时或后台写入。先用 `npm view @astron-team/skillhub@0.2.0 version` 确认可用，再使用 `npm install -g @astron-team/skillhub@0.2.0`，确认 `skillhub version`，再执行上面的精确插件版本安装命令。 读取旧库存不迁移；首次写入 v2 前，在库存同目录保存经字节核对的 `inventory.v1..backup.json`。同一技能的用户与项目副本可保留不同版本。旧 CLI 与 v2 库存混写不受支持；已分位置更新后，不能只恢复旧库存文件或降级插件来回退，必须同时核对实际技能文件、安装元数据和操作记录。 @@ -183,7 +184,7 @@ dsh plugin --profile skillhub-test remove @astron-team/skillhub-dsh ## 服务端同步与发布 -插件 Host 调用匿名 Registry HTTP API；本地安装事务在 Host 内完成，不需要 SaaS 新增操作用户文件系统的安装接口。开源先定义和验证契约，再将缺失的路径、字段、匿名策略和测试同步到 SaaS。公开 npm `0.2.0` 已对 `https://skill.xfyun.cn` 完成目录、搜索、文档、版本选择和固定版本项目安装及文件/指纹、库存、DSH 发现核验；本版候选和公开包须独立验收。日期格式等无法可靠排序的非 SemVer 版本继续阻断自动升级，不显示可执行升级入口；这不影响已验证的固定版本首次安装。SaaS 技能的真实模型执行尚未验收。详细要求见 [Registry 契约](../../openspec/changes/add-dsh-native-plugin/registry-api-contract.md)。 +插件 Host 调用匿名 Registry HTTP API；本地安装事务在 Host 内完成，不需要 SaaS 新增操作用户文件系统的安装接口。开源先定义和验证契约，再将缺失的路径、字段、匿名策略和测试同步到 SaaS。公开 npm `0.2.0` 已对 `https://skill.xfyun.cn` 完成目录、搜索、文档、版本选择和固定版本项目安装及文件/指纹、库存、DSH 发现核验；各版本的构建产物与公开包分别验收。日期格式等无法可靠排序的非 SemVer 版本继续阻断自动升级，不显示可执行升级入口；这不影响已验证的固定版本首次安装。SaaS 技能的真实模型执行尚未验收。详细要求见 [Registry 契约](../../openspec/changes/add-dsh-native-plugin/registry-api-contract.md)。 插件独立使用 `dsh-v` tag，不复用 CLI 或服务镜像发布。`check-dsh-plugin.yml` 配置 Linux/macOS/Windows × Node 24.2.0/当前 Node 24 的普通干净安装检查，并额外保留旧 Cordis 组合的隔离 Host 回归；`release-dsh-plugin.yml` 手动触发，默认只产出候选包。发布需正式版本、可发布 manifest、候选验收及明确发布授权；配置了环境保护规则时还须完成相应审批。版本更新需显式提交，npm 发布需明确授权后运行专用工作流。