The top-level esbuild.target also applied to dev/test transforms, which
broke vitest suites that use top-level await (Chromium 83 / ES2020 does
not support it). Only build.target and optimizeDeps.esbuildOptions.target
need the legacy target; remove the global esbuild.target override.
Publish page dropdowns (namespace/visibility) failed to open on older
Chromium because Vite 6 defaults build target to chrome87 and some
bundled deps call runtime APIs absent in Chrome 83 (replaceAll, .at,
hasOwn). Lower esbuild/vite target to chrome83, add browserslist, drop
??= in bootstrap, and inject runtime polyfills before main loads.
Addresses review feedback on #413: for a single-package project,
pnpm-workspace.yaml is unnecessary and its 'packages: [.]' declaration
turns the web/ directory into a pnpm workspace root, which is a
semantic side effect we don't want.
Move onlyBuiltDependencies under the 'pnpm' field in package.json
(pnpm 10 still reads it there) and drop the workspace file from the
Dockerfile COPY list. Verified locally with docker buildx: pnpm 10.33
runs esbuild postinstall and the build succeeds.
Corepack was resolving pnpm to latest (11.0.9) on each CI run, and
pnpm 11 refuses unapproved postinstall scripts in --frozen-lockfile
mode. That caused ERR_PNPM_IGNORED_BUILDS: esbuild@0.25.12 and failed
the web image build in publish-images.
Changes:
- web/package.json: pin packageManager to pnpm@10.33.0
- web/pnpm-workspace.yaml: approve esbuild via onlyBuiltDependencies
(pnpm 10 syntax; matches the pinned major)
- web/Dockerfile: copy pnpm-workspace.yaml before pnpm install so the
approval list is visible inside the build stage
Introduce a dedicated `/space/$namespace/$slug/compare` page that compares
two published skill versions GitHub-style: left file list + right unified
diff. Backend exposes `GET /versions/compare` returning structured diff
(computed via java-diff-utils) with per-file hunks, binary placeholder,
and truncation flags. Frontend uses two version selectors scoped to
PUBLISHED versions, a file search box, active-file highlighting, and
whitespace-preserving unified view. E2E covers the publish + rerelease
+ approve round trip; controller/domain tests cover happy path and
same-version rejection.
Adds skillhub.storage.s3.disable-chunked-encoding (env:
SKILLHUB_STORAGE_S3_DISABLE_CHUNKED_ENCODING, default false) so
operators can turn off aws-chunked encoding when the S3 backend is
Aliyun OSS, which rejects it with 'InvalidArgument: aws-chunked
encoding is not supported'.
Closes#365
* feat(publish): increase max file count from 100 to 500
Configurable via SKILLHUB_PUBLISH_MAX_FILE_COUNT env var.
* feat(publish): support SKILL.md in subdirectory with warning for ignored files
When SKILL.md is found in a single subdirectory (e.g. my-skill/SKILL.md),
promote that directory's contents to root and discard files outside it.
Discarded files are reported as warnings through the existing confirm flow.
* feat(publish): pass extraction warnings through confirm flow
When files are ignored during SKILL.md subdirectory promotion,
warnings are surfaced to the user via the existing precheck confirm dialog.
* fix(security): add invalidSessionStrategy to return 401 on expired session
Handles the case where Spring Security detects an invalid session cookie,
returning a clean 401 JSON response instead of triggering cascading exceptions.
Closes#360 (part 1/2)
* fix(security): handle session invalidation IllegalStateException as 401
Catches IllegalStateException with "Session was invalidated" message and
returns 401 instead of letting it fall through to the generic 500 handler.
Non-session IllegalStateExceptions are re-thrown to the catch-all handler.
Closes#360 (part 2/2)
* feat(publish): filter macOS metadata and add integration tests
Skip __MACOSX/, .DS_Store, and ._ resource fork entries during zip
extraction. Add integration tests for nested SKILL.md warning flow,
session invalidation 401 response, and macOS metadata filtering.
* test(publish): add real-world macOS zip and edge case integration tests
Covers: macOS zip with nested SKILL.md + __MACOSX + .DS_Store + stray files,
simple macOS single-folder case, and missing SKILL.md fallback behavior.
- Add visual separator between StarButton and SubscribeButton
- Use optimistic updates in useToggleSubscription for instant feedback
- Remove isLoading guard that caused button to unmount during refetch
When access-key / secret-key are left blank, fall back to the AWS
DefaultCredentialsProvider chain so that deployments on EC2, ECS,
and EKS can authenticate via instance profile, task role, or IRSA
without static credentials.
- Extract buildCredentialsProvider() in S3StorageService
- Add sts dependency for Web Identity Token (EKS) support
- Add unit tests for credential provider selection
- Update storage-spi docs (zh + en) and env example
Include subscriptionCount in SkillDetailDTO and SkillDetailResponse
so the frontend SubscribeButton receives the updated count after
subscribe/unsubscribe mutations.
Revert emailVerified check in EmailDomainAccessPolicy to preserve
backward compatibility with GitHub/GitLab OAuth users. Instead, null
unverified emails in CustomOidcUserService.toOAuthClaims() so
EmailDomainAccessPolicy naturally denies them via null email.
Add SLF4J logging to CustomOidcUserService for OIDC authentication
flow tracing and failure diagnostics.
Add registration ID collision warning to deployment docs.
Published skills start in PENDING_REVIEW status with canInteract=false,
so the SubscribeButton is not rendered. Use admin user to approve the
review first, following the same pattern as search-seed and review-seed.
Use .first() for h1 heading locator since skill detail page
renders two h1 elements (page title + README heading).
Add page-ready wait in second test before locating Subscribe button.
- Add null/blank validation for OIDC sub claim in CustomOidcUserService
- Throw OAuth2AuthenticationException when sub is missing or blank
- Complete .env.release.example with all required OIDC environment variables
- Add test cases for sub validation and providerLogin fallback scenarios
- All 5 tests passing
