1164 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
XiaoSeS	7ea323a258	docs(web): record vendored font licenses ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-25 10:49:17 +08:00
FenjuFu	f06e52cd0f	fix(web): self-host Inter and JetBrains Mono fonts ... web/index.html loaded Inter + JetBrains Mono from fonts.googleapis.com at runtime. On networks where Google Fonts is slow or unreachable (e.g. CN), that stylesheet blocks first paint for tens of seconds (#716). Vendor the same woff2 (from the @fontsource distribution) under web/public/fonts and declare them in fonts.css with latin/latin-ext unicode-range splits and font-display: swap, then point index.html at the local stylesheet and drop the fonts.googleapis.com / fonts.gstatic.com hosts from the page CSP. Only Inter and JetBrains Mono were ever fetched from the CDN, so families and weights are unchanged; no external font requests remain. Closes #716 Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>	2026-08-25 01:31:29 +08:00
FenjuFu	954dfce7a4	fix(publish): accept Windows zip directory entries (#742) ... * fix(publish): accept Windows zip directory entries Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com> * chore: restore repository line endings Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com> --------- Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>	2026-08-24 19:58:18 +08:00
FenjuFu	d5c6411ce6	fix(i18n): disable host locale fallback (#741) ... Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>	2026-08-24 19:54:05 +08:00
FenjuFu	f846da230c	feat: add initial RISC-V image support (#725) ... * feat: add initial RISC-V image support Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com> * chore(ci): tighten riscv64 image guardrails Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com> Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-24 16:37:34 +08:00
XiaoSeS	1b7a6d5544	chore(deps): resolve dependabot npm alerts ... Resolve open npm Dependabot alerts for the web app and docs site by refreshing dependency overrides and lockfiles. Also sets the staging web forwarded-proto default so `make staging` can render the shared Nginx template when using the bare nginx image. Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-24 16:08:07 +08:00
XiaoSeS	9fa6c52a4d	docs(troubleshooting): broaden postgres volume permission guidance (#745) ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-24 14:25:28 +08:00
FenjuFu	183729613c	docs(faq): add CLI namespace-not-found and PostgreSQL permission entries (#743) ... Add two entries collected from community support, to both the zh docs and the en i18n mirror: - FAQ: installing a skill via CLI reporting `namespace not found` — set the registry / log in with an API token, and use the correct namespace slug (`@team/skill` -> `team--skill`); the web UI Install button provides a ready-made command. - Troubleshooting: PostgreSQL container failing to start with `operation not permitted` on bind mounts — fix data volume ownership (`chown 999:999`), check SELinux, or use the `runtime.sh` script. Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>	2026-08-24 13:39:49 +08:00
XiaoSeS	e8cab7389f	Merge pull request #739 from iflytek/docs/weekly-w34-official ... docs(weekly): publish 2026 W34 report	2026-08-21 18:46:19 +08:00
XiaoSeS	67d39f04f6	docs(weekly): mirror reviewed W34 report ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-21 18:42:52 +08:00
XiaoSeS	15ce199e1a	fix(publish): emit event on confirm publish (#738) ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-21 17:52:25 +08:00
FenjuFu	fa04d2fa23	fix(auth): close API token policy gaps against the authorization list (#729) ... RouteSecurityPolicyRegistry keeps two policy lists — AUTHORIZATION_POLICIES for session/cookie access and API_TOKEN_POLICIES for Bearer tokens — with nothing keeping them in step. Routes the authorization list opens but the token list never registers fall through to the catch-all and answer API token cannot access endpoint: <path>. Register the routes reported in #713 (/api/v1/labels, the star and rating writes) plus the same-class gaps for /api/v1/auth/methods and paths below /api/v1/download, and add a guard test that walks the authorization list and fails when a route is neither token-reachable nor declared session-only. DELETE /api/v1/skills/{id}/star also matched the SUPER_ADMIN rule for DELETE /api/v1/skills/*/*, so un-starring was refused for ordinary accounts on the session path too. Star and rating writes now have their own authorization entries ahead of that rule. Closes #713 Signed-off-by: FenjuFu <fufenjupku@gmail.com>	2026-08-21 16:08:50 +08:00
FenjuFu	51457bfa2c	fix(security): 扫描任务改为事务提交后发布 (Closes #612) (#733) ... * fix(security): publish scan task after transaction commit SecurityScanService.triggerScan is @Transactional but published the Redis Stream scan task inline, before the transaction committed. The stream consumer could receive the task before the skill_version / security_audit rows were visible, fail with "SkillVersion not found" / "SecurityAudit not found", exhaust its immediate retries while the publishing transaction was still open, and leave the committed version stuck in SCANNING. Defer the publish to an afterCommit transaction synchronization so the consumer only ever sees the task once the rows are committed and visible; on rollback the task is never published. Falls back to an inline publish when called outside a transaction. Closes #612 Signed-off-by: FenjuFu <fufenjupku@gmail.com> * test(security): cover scan task after-commit publishing Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * refactor(security): hide scan publish transaction callback Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: FenjuFu <fufenjupku@gmail.com> Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-21 14:18:40 +08:00
FenjuFu	bbdc0f7a0c	fix(dev): use bash for backend launchers (#721) ... Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>	2026-08-21 09:35:52 +08:00
XiaoSeS	c3ecafb206	Merge pull request #736 from iflytek/docs/weekly-w33-official ... docs(weekly): mirror reviewed W33 report	2026-08-20 17:22:32 +08:00
XiaoSeS	f77e32ada5	docs(weekly): mirror reviewed W33 report ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-20 17:19:01 +08:00
XiaoSeS	d2403bb591	feat(namespace): add admin namespace management ... Closes #580	2026-08-12 12:39:24 +08:00
XiaoSeS	81be20a6b5	fix(namespace): let super admin view namespaces (#705) ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-11 16:04:28 +08:00
XiaoSeS	76d95b615e	docs(compliance): document runtime integration contract (#704) ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-11 13:43:42 +08:00
XiaoSeS	2fe7514a4e	feat(review): show compliance declaration diffs (#703)	2026-08-11 10:44:11 +08:00
XiaoSeS	0690e3f256	Merge pull request #698 from iflytek/fix/runtime-aliyun-stop-url ... fix(deploy): correct Aliyun runtime stop URL	2026-08-10 16:13:10 +08:00
XiaoSeS	c56e21e4bb	Merge pull request #699 from iflytek/feat/compliance-search-detail-projection ... feat(search): surface compliance mappings in discovery	2026-08-10 15:00:39 +08:00
XiaoSeS	1dfe3756a9	feat(search): refine compliance discovery interactions ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-10 10:42:19 +08:00
XiaoSeS	4efeed18c8	fix(deploy): preserve Aliyun source mode in stop command ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 18:20:06 +08:00
XiaoSeS	8de293b38f	fix(deploy): correct Aliyun runtime stop URL ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 16:45:12 +08:00
XiaoSeS	00f55c2db3	feat(search): surface compliance mappings in discovery ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 16:37:07 +08:00
XiaoSeS	460304eed8	Merge pull request #697 from iflytek/feat/compliance-metadata-snapshot ... feat(metadata): add compliance snapshot mappings	2026-08-07 16:06:44 +08:00
XiaoSeS	da5c3cba3b	feat(search): index compliance snapshot mappings ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 15:46:06 +08:00
XiaoSeS	a7b25b072b	feat(metadata): expose compliance snapshots in version views ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 15:46:06 +08:00
XiaoSeS	725bbe165b	feat(metadata): add x-astron compliance snapshot ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 15:46:06 +08:00
XiaoSeS	6e133c006e	Merge pull request #694 from iflytek/docs/weekly-w32-official ... docs(weekly): mirror reviewed W32 report	2026-08-07 10:37:36 +08:00
XiaoSeS	77e0ff3749	docs(weekly): mirror reviewed W32 report ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 10:34:32 +08:00
XiaoSeS	da8a888469	Merge pull request #576 from Phil-OSophy-42/feat/configurable-base-path ... feat(web): support deployment under a configurable base path	2026-08-06 20:10:46 +08:00
XiaoSeS	c272811213	docs(deploy): document manual sub-path env setup ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 19:08:57 +08:00
XiaoSeS	9668f3cd5a	fix(deploy): avoid changing runtime helper for PR 576 ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 19:06:55 +08:00
XiaoSeS	5e3f4e72e7	fix(deploy): keep PR 576 backport focused ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 19:05:36 +08:00
XiaoSeS	d0b7a7c5d4	fix(deploy): backport sub-path runtime fixes to PR 576 ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 18:59:37 +08:00
XiaoSeS	f0164fe8ba	Merge pull request #693 from iflytek/docs/weekly-w32-star-clarity ... docs(weekly): publish 2026 W32 report	2026-08-06 18:06:45 +08:00
XiaoSeS	53cb3b4757	docs(weekly): publish 2026 W32 report ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 18:03:14 +08:00
philsun	34f244e7a4	feat(web): support configurable base-path deployment ... Signed-off-by: philsun <xinyi.sun@daocloud.io>	2026-08-05 12:50:26 +08:00
XiaoSeS	b97487b02c	Merge pull request #687 from iflytek/agent/her-hack-astron-custom-issue-template ... docs: add customized HER Hack-Astron issue template	2026-08-05 10:32:14 +08:00
FenjuFu	8011f2558b	docs: add customized HER Hack-Astron issue template ... Signed-off-by: FenjuFu <fufenjupku@gmail.com>	2026-08-04 20:16:21 +08:00
XiaoSeS	fc457a0651	test(smoke): decouple admin checks from bootstrap credentials (#686) ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-04 19:20:34 +08:00
XiaoSeS	51ff9b99d2	Merge pull request #684 from iflytek/fix/search-rebuild-observability-597 ... fix(search): observe label search rebuild failures	2026-08-04 17:42:17 +08:00
XiaoSeS	27113ce60c	fix(api): map Spring MVC client errors to 4xx (#685) ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-04 17:16:09 +08:00
FenjuFu	7b3b4c9337	docs: add Related Projects section linking astron-agent and astron-rpa (#682) ... Add a compact Related Projects module to README and README_zh pointing to the sibling iFlytek Astron open-source projects (astron-agent, astron-rpa), so visitors can discover the wider ecosystem. Signed-off-by: FenjuFu <fufenjupku@gmail.com>	2026-08-04 14:33:14 +08:00
FenjuFu	dbc00d6993	docs: position SkillHub vs anthropics/skills and add integration note (#676) ... Add a section to README and README_zh clarifying that SkillHub is a registry and governance platform, complementary to open skill collections like anthropics/skills. Includes a comparison table, a publish-into-SkillHub snippet using the shared SKILL.md format, and a licensing caveat for the source-available document skills. Signed-off-by: FenjuFu <fufenjupku@gmail.com>	2026-08-04 14:32:32 +08:00
Michael	a063090a52	fix(web): stop React 19 portal removeChild/insertBefore crashes (#624) ... * fix(web): replace custom Dialog with Radix to stop portal races Hand-rolled createPortal siblings on document.body raced with Radix Select/DropdownMenu/Sonner under React 19 (insertBefore/removeChild). Use @radix-ui/react-dialog like select/dropdown adapters and bail out overview ResizeObserver setState when values are unchanged. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): stop portal removeChild races on search and shell Move Radix portals to #skillhub-portals, drop language-switcher body portal (match UserMenu), remove Select/Dropdown exit animations, and keep previous search results while typing to avoid skeleton unmount churn. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): systemic overlay teardown for React 19 removeChild Render Select/Dropdown in-tree (no Portal), translate=no on overlays, dismiss overlays on pathname change, defer navigate after close, host Toaster in #skillhub-portals, and add recoverable RouteError UI. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): harden overlay dismiss after code review Clip decorative layer only, dismiss Dialog via overlay pointer events, log RouteError once in useEffect, and defer skill-detail leave navigations. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): batch starred highlight and defer Sonner toasts Avoid N× per-card star fetches on /search and flushSync toast races during React 19 list re-renders (removeChild / insertBefore). Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): block Chrome Translate DOM races on skill overview Keep html/#root notranslate, sync lang with i18n, and harden overview expand so memoized markdown + quiet ResizeObserver avoid insertBefore crashes. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> --------- Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>	2026-08-04 13:59:37 +08:00
XiaoSeS	b6cd414588	fix(search): observe label search rebuild failures ... Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-04 11:17:38 +08:00
XiaoSeS	55e5c1e10e	feat(observability): add generic request correlation and tracing foundation (#664) ... * feat(observability): establish request correlation boundary Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * feat(observability): add selectable tracing modes Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * feat(observability): propagate async trace context Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * docs(observability): document tracing deployment modes Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): tighten tracing integration boundaries Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): harden operational log privacy Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * feat(observability): propagate message trace context Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): document message propagation semantics Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * test(auth): isolate security context between tests Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): skip otlp exporter without endpoint Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-04 10:26:42 +08:00