Add 36 test cases covering:
- Path traversal and symlink attack prevention in archive extraction
- SkillHubClient error handling (401/403/404/network) for all endpoints
- Inventory store concurrent writes and stale lock recovery
- Config store read/write round-trip
- Platform utilities (package-manager, updater, paths)
- Output formatting (printResult, humanize)
Tests use cross-platform commands (node) instead of shell builtins
for CI compatibility across macOS/Linux/Windows.
Protect doctor metadata scanning from symlinked agent, skill, and .skillhub directories, and make inventory mutations use locked atomic writes with stale lock recovery.
Document the full CLI workflow so users can understand configuration precedence, install targets, local state files, troubleshooting, and local verification steps.
Enable API token authentication for CLI endpoints by adding /api/cli/
to the filter's path whitelist. Previously, CLI endpoints were not
processed by the token authentication filter, causing all Bearer token
requests to fail with 401.
- Add visual separator between StarButton and SubscribeButton
- Use optimistic updates in useToggleSubscription for instant feedback
- Remove isLoading guard that caused button to unmount during refetch
When access-key / secret-key are left blank, fall back to the AWS
DefaultCredentialsProvider chain so that deployments on EC2, ECS,
and EKS can authenticate via instance profile, task role, or IRSA
without static credentials.
- Extract buildCredentialsProvider() in S3StorageService
- Add sts dependency for Web Identity Token (EKS) support
- Add unit tests for credential provider selection
- Update storage-spi docs (zh + en) and env example
Include subscriptionCount in SkillDetailDTO and SkillDetailResponse
so the frontend SubscribeButton receives the updated count after
subscribe/unsubscribe mutations.
Revert emailVerified check in EmailDomainAccessPolicy to preserve
backward compatibility with GitHub/GitLab OAuth users. Instead, null
unverified emails in CustomOidcUserService.toOAuthClaims() so
EmailDomainAccessPolicy naturally denies them via null email.
Add SLF4J logging to CustomOidcUserService for OIDC authentication
flow tracing and failure diagnostics.
Add registration ID collision warning to deployment docs.
Published skills start in PENDING_REVIEW status with canInteract=false,
so the SubscribeButton is not rendered. Use admin user to approve the
review first, following the same pattern as search-seed and review-seed.
Use .first() for h1 heading locator since skill detail page
renders two h1 elements (page title + README heading).
Add page-ready wait in second test before locating Subscribe button.
- Add null/blank validation for OIDC sub claim in CustomOidcUserService
- Throw OAuth2AuthenticationException when sub is missing or blank
- Complete .env.release.example with all required OIDC environment variables
- Add test cases for sub validation and providerLogin fallback scenarios
- All 5 tests passing
