Commit graph

958 commits

Author SHA1 Message Date
dongmucat
32f34fbf4c fix(ci): remove unsupported Python CodeQL scan
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-17 14:04:27 +08:00
dongmucat
a85298f7ae
Merge pull request #508 from iflytek/fix/security-review-hardening
fix(security): harden review findings
2026-06-17 11:08:38 +08:00
dongmucat
a23cbd84eb
Merge pull request #530 from iflytek/fix/issue-51-profile-review-notifications
fix: admin notifications for profile review requests
2026-06-17 11:08:10 +08:00
dongmucat
52251fcd0e chore(docs): remove handwritten notification OpenAPI (#524)
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-17 10:25:34 +08:00
dongmucat
e50140272b fix(security): close review hardening gaps
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 17:48:15 +08:00
dongmucat
a73dba5f80
Merge pull request #533 from iflytek/fix/publish-notification-owner
fix(notification): avoid publish notice for promotion reviewers
2026-06-16 15:16:08 +08:00
dongmucat
05e1968563
Merge pull request #526 from iflytek/feature/add-agentguard-skill
feat(bootstrap): add agentguard builtin skill
2026-06-16 14:27:30 +08:00
dongmucat
7d0402e937 fix(security): address review blockers
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 14:19:39 +08:00
dongmucat
73767a9022 fix(notification): avoid publish notice for promotion reviewers
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 12:19:27 +08:00
dongmucat
8527409742 fix(notification): keep SSE live push streams open (#524)
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 11:57:49 +08:00
dongmucat
a865960cf3 fix(notification): ISSUE-51 add profile review notifications
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 10:33:02 +08:00
dongmucat
6d6577faa2 fix(bootstrap): confirm builtin publish warnings
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 10:23:02 +08:00
dongmucat
abdad25df3 feat(bootstrap): add agentguard builtin skill
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-15 15:32:35 +08:00
dongmucat
40d7de8462 fix(security): harden review findings
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-12 14:40:30 +08:00
dongmucat
4776550391
Merge pull request #498 from iflytek/feature/cloud-url-builtin-skills
feat(bootstrap): sync built-in skills from cloud manifest
2026-06-11 17:27:26 +08:00
dongmucat
4f52680961
Merge pull request #507 from iflytek/codex/fix-skill-md-case
fix(publish): accept case-insensitive SKILL.md uploads
2026-06-11 16:51:33 +08:00
XiaoSeS
a88b09e51b fix(publish): accept case-insensitive SKILL.md uploads 2026-06-11 16:34:13 +08:00
dongmucat
8045e52f5e feat(bootstrap): add skillhub hello builtin skill
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-11 11:20:27 +08:00
dongmucat
d58c934d64
Merge pull request #482 from iflytek/feature/namespace-search-download
feat(skill): add namespace search and bundle download
2026-06-10 20:10:32 +08:00
dongmucat
920e6889e7 fix(web): remove namespace download residuals
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 19:48:32 +08:00
dongmucat
0298823d06 fix(skill): remove namespace bundle backend residues
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 19:48:27 +08:00
dongmucat
201e636858 test(web): add namespace search-only regression
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 19:48:16 +08:00
dongmucat
04348f5022 chore: sync schema.d.ts — remove namespace bundle download paths and operations
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 19:48:06 +08:00
dongmucat
738e8f8cee fix(web): stabilize frontend validation
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 18:00:10 +08:00
dongmucat
f93ab170e5 Merge remote-tracking branch 'origin/main' into feature/cloud-url-builtin-skills
Signed-off-by: dongmucat <1127093059@qq.com>

# Conflicts:
#	server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/service/SkillPublishService.java
2026-06-10 16:53:48 +08:00
dongmucat
f35f91616a fix(publish): preserve latest version reference cleanup order
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 16:51:35 +08:00
dongmucat
6779c1eecd
feat(web): preview relative markdown package links (#502)
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 16:31:22 +08:00
dongmucat
1b09ab88a2 fix(bootstrap): enforce strict builtin skill skips
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 14:19:41 +08:00
dongmucat
dd3e511a91 fix(bootstrap): support skill directory archives
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 10:31:40 +08:00
dongmucat
43d66a59e1 Merge remote-tracking branch 'origin/main' into HEAD
Signed-off-by: dongmucat <1127093059@qq.com>

# Conflicts:
#	server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/skill/service/SkillDownloadServiceTest.java
2026-06-09 14:29:03 +08:00
dongmucat
ed13a41ed8 fix(skill): align anonymous download helper with main
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-09 14:25:17 +08:00
dongmucat
973c37613e fix(bootstrap): harden builtin skill sync
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-09 14:19:25 +08:00
dongmucat
b5edfb850e fix(web): clarify namespace bundle download limits
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-09 10:02:26 +08:00
dongmucat
973c336c82 fix(auth): protect builtin system account boundaries
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-08 18:01:20 +08:00
Xudong Sun
7e23508a32
chore(logging): include idempotency cleanup threshold 2026-06-08 17:31:07 +08:00
dongmucat
5cc934a294 fix(bootstrap): harden builtin skill startup sync
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-08 15:20:10 +08:00
dongmucat
4c4a888b01 fix(bootstrap): harden built-in skill startup sync
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-08 14:01:19 +08:00
dongmucat
6e094f4199 fix(skill): cap namespace bundle downloads
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-08 10:46:30 +08:00
dongmucat
6dc62ddfb8
feat(web): add install method tabs (#496)
* feat(web): add install method tabs

Signed-off-by: dongmucat <1127093059@qq.com>

* test(web): stabilize real service e2e checks

Signed-off-by: dongmucat <1127093059@qq.com>

* style(web): simplify install tab indicator

Signed-off-by: dongmucat <1127093059@qq.com>

---------

Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-05 17:27:34 +08:00
XiaoSeS
531d59caf2
feat(my-skills): add keyword search, namespace filter and clickable pagination (#493)
* feat(my-skills): add keyword search, namespace filter and clickable pagination

Add comprehensive filtering and search capabilities to the My Skills page:

- Keyword search: search by skill name, slug, or description
- Namespace filter: filter skills by namespace
- Clickable pagination: page number buttons with smart ellipsis
- State preservation: sync search state to URL, restore when returning from detail page
- Debounced search: 300ms debounce to avoid excessive queries
- Fix: hide stale rejected preview badge when newer version is published

Backend changes:
- MySkillAppService: add keyword and namespace filtering logic
- SkillLifecycleProjectionService: only show preview versions newer than published
- MeController: add keyword and namespace query parameters
- 6 new test cases covering search and filter scenarios

Frontend changes:
- my-skills.tsx: search input, namespace dropdown, URL state sync
- pagination.tsx: clickable page numbers with ellipsis
- use-user-queries.ts: prevent flicker on query transitions
- skill-detail.tsx: remove invalid rejected badge display
- router.tsx: URL parameter validation
- i18n: add search-related translation keys

Synced from SAAS commits:
- 939fa749 (feat: search and filters)
- dc14df6c (fix: search flicker)
- 0168ea81 (fix: rejected badge)
- c9eefa93 (fix: stale preview)

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(tests): address test failures in PR #493

Backend test fixes:
- Remove unnecessary Mockito stubbing for filtered-out skills
- Add missing findBySkillIdAndStatus stub for published version lookup
- Update MeController test mocks to match new method signature (keyword, namespace params)

Frontend fixes:
- Fix TypeScript error: useMyNamespaces returns ManagedNamespace[] not PagedResponse
- Add type annotation for namespace map callback parameter

E2E test fix:
- Update URL regex to allow query parameters (returnTo from search page)

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(tests): resolve test failures in PR #493

Backend:
- Remove unnecessary mock stubbings for skillId 2 and 3 in MySkillAppServiceTest.listMySkills_combinesKeywordNamespaceAndStatusFilters
- The test filters results to only return skill with id=1, so mocks for id 2 and 3 were never called, causing UnnecessaryStubbingException

Frontend:
- Add missing mocks for useLocation, useSearch, useMyNamespaces, and useDebounce in my-skills.test.ts
- MySkillsPage component uses these hooks but the test setup didn't provide mocks, causing 'No QueryClient set' and 'No export' errors

All 4 frontend tests now pass locally.

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-06-05 17:24:51 +08:00
dongmucat
0f752e2305 docs(bootstrap): add built-in skill cloud setup guide
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-05 17:16:25 +08:00
dongmucat
9bb6b31db7 feat(bootstrap): sync built-in skills from cloud manifest
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-05 16:27:02 +08:00
XiaoSeS
31b25fb6c5
fix(domain): clear skill.latest_version_id before deleting skill_version (#495)
The PG FK constraint fk_skill_latest_version blocks deleting a
SkillVersion whenever Skill.latest_version_id still references it.
Two services had the wrong order:

- SkillPublishService.deleteReplaceableVersionArtifacts: triggered
  when re-uploading the same version (UPLOADED -> overwritten).
  Reproduced by AstronClaw client retrying personal-skills upload.

- SkillGovernanceService.deleteVersion: triggered when admin deletes
  a draft version that happens to be skill.latest_version_id.

Fix: clear skill.latest_version_id and flush BEFORE deleting the
SkillVersion row, so PG sees no live reference at delete time.

Synced from SAAS commit 4626f0c117d9c0544c4dc1115c3aac7468f0d277
2026-06-05 16:21:33 +08:00
XiaoSeS
2bb7dedaf4
feat(cli,domain): support non-global namespace skill download (#497)
* feat(cli,domain): support non-global namespace skill download

Parse namespace from skill name using -- separator (e.g.,
astroclaw--api-gateway) so users don't need --namespace flag.
Allow anonymous download for any PUBLIC skill regardless of namespace.

CLI changes:
- Add cli/src/shared/skill-name-parser.ts utility
- Update install and remove commands to parse skill name argument
- 10 unit tests covering edge cases

Domain changes:
- SkillDownloadService.isAnonymousDownloadAllowed: drop namespace
  type check, only require PUBLIC visibility
- Update test to expect success for team-namespace public skill

Synced from SAAS commit 26c67e31b1221249cf9b73321d1b726d8ba6e6df

* fix(cli): use bun:test instead of vitest in skill-name-parser test
2026-06-05 16:20:34 +08:00
dongmucat
04caf21e76
fix(audit): resolve 8-hour timezone offset in audit log timestamps (#472)
## Problem
Audit log timestamps displayed 8 hours later than actual time when JVM
default timezone != UTC. Root cause: `audit_log.created_at` was
`TIMESTAMP without time zone`, and `rs.getTimestamp()` interprets bare
values using JVM timezone.

## Solution
### Backend
- **V42 migration**: Upgrade `audit_log.created_at` from `TIMESTAMP` to
  `TIMESTAMPTZ`, anchor historical data as UTC via `USING created_at AT
  TIME ZONE 'UTC'` (same pattern as V18/V19/V23/V25/V36)
- **Read path**: `AdminAuditLogAppService.readInstant()` uses
  `rs.getObject(col, OffsetDateTime.class).toInstant()`, result
  independent of JVM timezone
- **Write path (filter params)**: `startTime`/`endTime` binding changed
  from `Timestamp.from()` to `OffsetDateTime.ofInstant(instant,
  ZoneOffset.UTC)` via `toUtcOffsetDateTime()` helper, symmetric with
  read path

### Migration Safety
- `SET LOCAL lock_timeout = '30s'` (transaction-scoped, won't leak to pool)
- `DO $$ ... IF data_type = 'timestamp without time zone' THEN ... ELSE
  ... END $$` idempotent guard with dual-branch `RAISE NOTICE`
- Safe retry: re-running won't double-apply `AT TIME ZONE 'UTC'`

### Test Coverage (10 tests, 477 total suite)
- `rowMapper_readsCreatedAtAsInstant` — UTC offset regression
- `rowMapper_normalisesNonUtcOffsetToInstant` — Non-UTC offset (+08:00)
- `rowMapper_returnsNullTimestampWhenColumnIsNull` — Null path
- `rowMapper_isIndependentOfJvmDefaultTimezone` — JVM TZ=Asia/Shanghai
  drift prevention with `verify(rs, never()).getTimestamp()`
- `@ParameterizedTest buildWhereClause_bindsTimeRangeAsOffsetDateTime` —
  3 cases (both/startOnly/endOnly) for filter param binding
- `@BeforeEach setUp()` — Mock isolation to prevent cross-test stub
  accumulation

## Quality Gates
- [x] `make test-backend-app` passes (477 tests, 0 failures)
- [x] No Controller changes, `make generate-api` not needed
- [x] No frontend changes, typecheck/lint/e2e not needed

## Deployment
V42 must run before new code (guaranteed by Spring Boot startup sequence
→ Flyway executes before app accepts traffic). Rolling deployment:
- New pod + migrated column: correct
- Old pod + migrated column: old code reads TIMESTAMPTZ correctly (pgjdbc
  returns absolute instant)

## Related Docs
- `docs/15-backend-time-governance-plan.md` §3.1: V42 progress registered
- `docs/16-backend-time-inventory.md` §3.1: V42 listed
- Same migration pattern: V18/V19/V23/V25/V36
2026-06-05 15:28:12 +08:00
dongmucat
1ec93db0d6
Revert "feat(bootstrap): initialize built-in skills (#481)" (#487)
This reverts commit 90fc97e740.
2026-06-05 11:25:02 +08:00
dongmucat
90fc97e740
feat(bootstrap): initialize built-in skills (#481)
* feat(bootstrap): initialize built-in skills

Signed-off-by: dongmucat <1127093059@qq.com>

* docs(builtin-skills): remove implementation plan

Signed-off-by: dongmucat <1127093059@qq.com>

---------

Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-05 10:27:37 +08:00
dongmucat
6bb89b1c89 fix(skill): address namespace bundle review findings
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-04 17:12:44 +08:00
dongmucat
204f52dd30 test(web): add namespace search download e2e coverage
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-04 15:49:40 +08:00
dongmucat
85c025a1b9 feat(skill): add namespace search and bundle download
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-04 15:23:09 +08:00