scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-10-15 04:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
1298 commits 266 branches 29 tags 44 MiB
Commit graph

404 commits

Author SHA1 Message Date
XiaoSeS
1b7e679d45 fix(security): include csrf token in scan retry 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:46:13 +08:00
XiaoSeS
697bb952a4 fix(security): harden scan retry lifecycle 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:45:44 +08:00
XiaoSeS
0fb00f01b6 chore(api): refresh security scan retry schema 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:45:16 +08:00
XiaoSeS
680a5d1b94 feat(security): retry failed scans 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:45:16 +08:00
XiaoSeS
e02c22e678 fix(i18n): align scanner failure reason keys 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:32:37 +08:00
XiaoSeS
8b09c23dc4 fix(scanner): make terminal failures recoverable 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:32:37 +08:00
XiaoSeS
d6afc43364
Merge pull request #807 from iflytek/codex/refactor/issue-622-notification-polling 
refactor(notification): replace SSE with HTTP polling
 2026-09-03 13:48:57 +08:00
XiaoSeS
47f3d33c65
Merge pull request #806 from iflytek/codex/docs/issue-795-clawhub-compat 
docs(compat): clarify supported ClawHub workflows
 2026-09-03 13:48:33 +08:00
XiaoSeS
4d71a16ddd fix(notification): complete polling migration 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 11:38:02 +08:00
XiaoSeS
efa3c1ae65 refactor(notification): replace SSE with HTTP polling 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 11:38:02 +08:00
XiaoSeS
20d20c16d0 docs(compat): separate ClawHub and SkillHub authentication 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 10:44:15 +08:00
XiaoSeS
923c1df4e1 docs(compat): remove unsupported publish guidance 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 10:40:35 +08:00
XiaoSeS
5045901c9e fix(web): retain dashboard pagination on detail return 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 10:27:51 +08:00
XiaoSeS
b62a487037 fix(web): preserve dashboard return path from skill details 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 09:42:00 +08:00
XiaoSeS
fc7c59534a
fix(platform): harden sessions, scanner recovery, and CLI guidance (#801) 
* fix(auth): recover from unreadable sessions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(scanner): defer unavailable scan tasks safely

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): prefer the SkillHub CLI install command

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(auth): decode session cookies during recovery

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(runtime): address scanner and session review findings

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(scanner): defer all server-side outages

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* docs(scanner): clarify deferred failure semantics

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(scanner): cover recovery boundaries

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(scanner): register startup hook on router

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(e2e): align install defaults and reuse auth session

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 20:15:42 +08:00
XiaoSeS
45d341f144
feat(review): add skill comments and user feedback (#793) 
* feat(review): add skill review domain model

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* feat(review): expose skill reviews in API and UI

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): preserve moderation under concurrent edits

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): scope concurrent write conflicts

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): restore web build compatibility

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): keep author cleanup available

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): preserve author cleanup access

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): require review score contract

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): strengthen failure and concurrency coverage

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): tighten persistence assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): disambiguate repository ports

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): enable request validation

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): align validation and postgres coverage

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(namespace): verify invalid batch has no side effects

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): align accessibility and plural assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(i18n): require complete plural references

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): wrap editor actions on mobile

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): wrap long mobile labels

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): disable edits for archived skills

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): enforce archived mutation guard

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 11:15:52 +08:00
XiaoSeS
2e11705ebd fix(theme): harden responsive switch semantics 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
0d48945fd2 fix(theme): polish dark header and toggle 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
39861bc6d8 test(review): strengthen exact-sha coverage 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
3e77365a5d fix(review): complete progress history workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
b8b0fba3d4 fix(theme): polish dark notification states 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
7995c00683 feat(review): add author review progress and attempt history 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
ebac94a043 feat(theme): add browser-local light and dark mode 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
8361ea3fcd
Merge pull request #774 from FenjuFu/fix/promotion-pagination 
fix(promotion): paginate review queues
 2026-08-31 15:22:21 +08:00
XiaoSeS
fe8a0cb21f fix(promotion): clamp emptied queue pages 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
2babc0935b fix(cli): add namespace sync manifest endpoint 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 14:06:34 +08:00
FenjuFu
817426c50f fix(promotion): paginate review queues 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-28 23:29:58 +08:00
XiaoSeS
c825d896a4
Merge pull request #762 from FenjuFu/fix/code-scanning-alerts-2026-08 
fix(security): resolve CodeQL findings
 2026-08-28 10:22:04 +08:00
wurongjie
f43c047a6b feat(skill-card): show author and update time in skill card 
Add ownerId and ownerDisplayName fields to SkillSummaryResponse,
and render author and last update time at the bottom of each skill card.

在技能卡片底部新增作者和最近更新时间显示，搜索结果接口新增
ownerId 和 ownerDisplayName 字段。

Log: 技能卡片新增作者和更新时间
Influence: 搜索结果页技能卡片底部显示作者和更新时间信息，接口新增 ownerId/ownerDisplayName 字段。
Signed-off-by: wurongjie <wurongjie@uniontech.com>
 2026-08-27 17:21:15 +08:00
FenjuFu
36967794d1 fix(security): resolve CodeQL findings 
Use a bounded safe YAML constructor, remove the polynomial placeholder regex, keep public label access GET-only with CSRF protection, validate CLI callbacks as loopback URL objects, and use cryptographic UUIDs for E2E identities.

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-27 15:16:54 +08:00
XiaoSeS
7e37935da8
fix(i18n): keep Russian locale keys in sync 
Merge validated locale parity fix.
 2026-08-27 14:51:22 +08:00
Michael
16306dd4f4
feat(i18n): add Russian locale for web UI and server messages (#700) 
Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>
 2026-08-26 19:43:07 +08:00
FenjuFu
3b5d4381a9
feat(publish): allow uploading a skill folder directly 
Fix E2E ZIP picker selector after adding folder upload input.
 2026-08-26 17:37:21 +08:00
XiaoSeS
243e9b68f4 fix(auth): prevent login page redirect loop 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-26 15:46:20 +08:00
wrj97
d7e8c51775
fix(dashboard): remove encoding from slug params (#747) 
The router handles parameter encoding automatically. Explicitly encoding
the slug results in double-encoded characters in the URL.

Signed-off-by: wurongjie <wurongjie@uniontech.com>
 2026-08-26 10:23:43 +08:00
XiaoSeS
7599dd0ca9
fix(web): keep select poppers in collision bounds (#755) 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-25 20:07:58 +08:00
FenjuFu
907d8eff90
fix(web): keep select menus within viewport (#754) 
Cap shared Radix select content to the available viewport height and enable vertical scrolling so long option lists remain usable near page and dialog edges. Add a shared component regression test for the viewport and overflow classes.\n\nCloses #714

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-25 16:56:58 +08:00
FenjuFu
91d0ae1504
feat(api): return skill labels from the skill listing endpoints on request (#730) 
* feat(api): return skill labels from the skill listing endpoints on request

Skill labels were reachable only one skill at a time, through
/api/{v1,web}/skills/{namespace}/{slug}/labels, so a client rendering a list had
to issue a follow-up request per row.

Add includeLabels=true to GET /api/v1/skills and GET /api/web/skills. The labels
array is populated only when the parameter is set and left out of the payload
otherwise, so existing responses are byte-identical.

Labels for the whole page are resolved by SkillLabelProjectionService in three
queries — assignments, definitions, translations — rather than three per skill.

Closes #710

Signed-off-by: FenjuFu <fufenjupku@gmail.com>

* fix(api): use include parameter for skill labels

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(api): reject unsupported include before search

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: FenjuFu <fufenjupku@gmail.com>
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-25 13:49:24 +08:00
XiaoSeS
d2403bb591
feat(namespace): add admin namespace management
Some checks failed
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details
Security / CodeQL (python) (push) Has been cancelled
Details 
Closes #580
 2026-08-12 12:39:24 +08:00
XiaoSeS
2fe7514a4e
feat(review): show compliance declaration diffs (#703) 2026-08-11 10:44:11 +08:00
XiaoSeS
1dfe3756a9 feat(search): refine compliance discovery interactions 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-10 10:42:19 +08:00
XiaoSeS
00f55c2db3 feat(search): surface compliance mappings in discovery 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-07 16:37:07 +08:00
XiaoSeS
a7b25b072b feat(metadata): expose compliance snapshots in version views 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-07 15:46:06 +08:00
philsun
34f244e7a4 feat(web): support configurable base-path deployment 
Signed-off-by: philsun <xinyi.sun@daocloud.io>
 2026-08-05 12:50:26 +08:00
Michael
a063090a52
fix(web): stop React 19 portal removeChild/insertBefore crashes (#624) 
* fix(web): replace custom Dialog with Radix to stop portal races

Hand-rolled createPortal siblings on document.body raced with Radix
Select/DropdownMenu/Sonner under React 19 (insertBefore/removeChild).
Use @radix-ui/react-dialog like select/dropdown adapters and bail out
overview ResizeObserver setState when values are unchanged.

Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>

* fix(web): stop portal removeChild races on search and shell

Move Radix portals to #skillhub-portals, drop language-switcher body
portal (match UserMenu), remove Select/Dropdown exit animations, and keep
previous search results while typing to avoid skeleton unmount churn.

Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>

* fix(web): systemic overlay teardown for React 19 removeChild

Render Select/Dropdown in-tree (no Portal), translate=no on overlays,
dismiss overlays on pathname change, defer navigate after close, host
Toaster in #skillhub-portals, and add recoverable RouteError UI.

Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>

* fix(web): harden overlay dismiss after code review

Clip decorative layer only, dismiss Dialog via overlay pointer events,
log RouteError once in useEffect, and defer skill-detail leave navigations.

Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>

* fix(web): batch starred highlight and defer Sonner toasts

Avoid N× per-card star fetches on /search and flushSync toast races
during React 19 list re-renders (removeChild / insertBefore).

Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>

* fix(web): block Chrome Translate DOM races on skill overview

Keep html/#root notranslate, sync lang with i18n, and harden overview
expand so memoized markdown + quiet ResizeObserver avoid insertBefore crashes.

Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>

---------

Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>
 2026-08-04 13:59:37 +08:00
Mikhail Neradkov
90ae071e44 feat(web): link skill labels to search and wrap filter chips 
Make skill-detail label chips navigate to /search?label=… and allow
the search filter row to wrap when many labels are present.

Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>
 2026-07-29 22:48:58 +03:00
1664940968@qq.com
1d679c526a
fix(auth): recover login page from stale lazy-loaded chunks after logout (#560) 
* fix(auth): recover from stale login chunks after logout

* fix(auth): prevent repeated stale chunk reloads

Signed-off-by: ylhu16 <ylhu16@iflytek.com>

---------

Signed-off-by: ylhu16 <ylhu16@iflytek.com>
Co-authored-by: ylhu16 <ylhu16@iflytek.com>
 2026-07-28 16:36:47 +08:00
dongmucat
0134da73b5 fix(frontend): support nested preview links 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-24 16:51:42 +08:00
dongmucat
8413ee3950
Merge pull request #554 from iflytek/fix/auth-password-settings
Some checks failed
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details 
fix(auth): restore password settings access
 2026-06-24 10:50:26 +08:00
dongmucat
e501be9cf8 feat(promotion): improve promotion review dashboard 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-24 09:28:43 +08:00