- Add integration tests for doctor, install, list, publish, remove, whoami commands
- Expand fake-registry with resolve/delete state capture for real assertions
- Fix update command: use correct package name @astron-team/skillhub from constants
- Refactor runUpdateCommand to accept string[] instead of fragile string splitting
- Add dependency injection to updateCommand for testable unit tests without global mocks
- Replace package.json import with codegen (scripts/generate-pkg-info.ts) to avoid
leaking devDependencies into the build artifact
- Fix startNetworkFailureServer TOCTOU race by keeping listener alive
- Add TODO markers for known help command bugs (--json not forwarded, unknown topic crash)
- Extend update integration test timeout for real npm registry checks
Ensures npm publish uses the correct registry (registry.npmjs.org) even when
global npm config points to a mirror registry (e.g., registry.npmmirror.com).
- Add publish script with env validation, git checks, and build/test/pack preflights
- Add comprehensive test suite for publish workflow (302 lines)
- Update cli/package.json with @astron-team scope and full npm metadata
- Add README.md with user-focused documentation and registry info
- Add .env.example template for publish configuration
- Add Apache 2.0 LICENSE
- Add Makefile targets for build/test/lint/typecheck/publish workflows
- All publish targets include .env.local validation
- Update installation instructions across all documentation to use @astron-team/skillhub
The issue was that new URL().pathname returns Unix-style paths on Windows
(e.g., /D:/a/skillhub/...) which Bun.spawn() cannot resolve correctly.
Using fileURLToPath() converts the URL to a proper platform-specific path.
Changes:
- cli/test/helpers/run-cli.ts: use fileURLToPath for cwd
- cli/test/integration/version-command.test.ts: same fix for build spawn
Bun.which('bun') on Windows CI returns a non-existent path
(C:\Users\runneradmin\.bun\bin\bun.exe), causing all integration
tests to fail. Add existsSync() check to fallback to process.execPath
when the resolved path doesn't exist.
Also fix version-command.test.ts to use process.execPath instead of
hardcoded 'bun' string for cross-platform compatibility.
Fixes 19 failing integration tests on Windows platform.
- Use Bun.which() with process.execPath fallback in run-cli helper to
resolve bun executable on Windows (fixes 22 integration tests)
- Normalize paths in credentials-store test for Windows backslash compat
- Use shell: true on Windows in updater spawn for proper exe resolution
Replace 'any' type annotation with proper type guard in inventory-store.ts
and add optional chaining in test to satisfy TypeScript strict checks.
All three platforms (Ubuntu, macOS, Windows) CI checks now pass.
Add 36 test cases covering:
- Path traversal and symlink attack prevention in archive extraction
- SkillHubClient error handling (401/403/404/network) for all endpoints
- Inventory store concurrent writes and stale lock recovery
- Config store read/write round-trip
- Platform utilities (package-manager, updater, paths)
- Output formatting (printResult, humanize)
Tests use cross-platform commands (node) instead of shell builtins
for CI compatibility across macOS/Linux/Windows.
Protect doctor metadata scanning from symlinked agent, skill, and .skillhub directories, and make inventory mutations use locked atomic writes with stale lock recovery.
Document the full CLI workflow so users can understand configuration precedence, install targets, local state files, troubleshooting, and local verification steps.
Enable API token authentication for CLI endpoints by adding /api/cli/
to the filter's path whitelist. Previously, CLI endpoints were not
processed by the token authentication filter, causing all Bearer token
requests to fail with 401.
Root cause: two issues caused CI failure:
1. publishSkill hit 429 rate limit from other tests in the suite
2. glob pattern '?' was ambiguous for matching literal '?' in URLs
Fix: remove publishSkill dependency, use regex route matching, and
return fully mocked API responses with fake skill data. This tests
the frontend pagination UI behavior without needing real published
skills.
The namespace detail page hardcoded a limit of 20 skills with no
pagination controls, so namespaces with more than 20 skills appeared
truncated. Add page state, wire it into the search query, and render
the shared Pagination component when total exceeds PAGE_SIZE. Also
reset page to 0 when the namespace param changes.
Closes#350
Add an "Update" button to each skill card on the My Skills dashboard
page. Clicking it navigates to the Publish page with the skill's
namespace and visibility pre-selected, reducing manual steps when
re-publishing a skill package.
- Add visibility field to SkillSummaryResponse so the list API exposes
each skill's current visibility setting
- Add publish-prefill module to normalize and validate URL search params
- Wire TanStack Router validateSearch on the publish route
- Add E2E tests covering the prefill flow and invalid-param fallback
* feat(ci): add AI-powered release notes generation
- Add GitHub Models integration for automated release notes
- Support bilingual (EN) release notes with highlights extraction
- Fallback to conventional commit grouping when LLM unavailable
- Trigger on tag push or manual workflow dispatch
- Zero configuration: uses GitHub Models (gpt-4o-mini) by default
* chore: pin action versions and update gitignore
- Pin checkout and setup-deno to commit hashes matching project convention
- Add .playwright-mcp/ and .mcp.json to gitignore
* fix(search): keep private skills out of portal discovery
- remove super admin expanded visibility from portal search
- exclude all private skills from portal search results
- keep namespace-only skills visible only to namespace members
- reserve private skill access for my-skills and future admin surfaces
* test(search): update test to reflect portal visibility policy
- rename test from platformWideAccessShouldBypass... to platformWideAccessShouldNotBypass...
- verify that platformWideAccess flag does not grant extra visibility in portal search
- verify PRIVATE skills are excluded from search SQL
- aligns test with new requirement: portal search uses standard visibility rules
* test(search): update app service test for portal visibility policy
- rename test from search_shouldGrantPlatformWideAccessToSuperAdmin to search_shouldNotGrantPlatformWideAccessToSuperAdminInPortal
- verify super admin does not get platformWideAccess in portal search
- aligns with requirement: portal uses standard visibility, admin features reserved for dedicated interface
- start postgres before bringing up application services
- sync the database role password from .env.release
- verify TCP auth with the synced password before startup
