Resolved conflicts by keeping both sides:
- web/src/api/client.ts: preserve paginated listMembers(slug, {page,size})
and add delete(slug) from main.
- web/src/shared/hooks/use-namespace-queries.ts: keep useUpdateNamespace
and useTransferNamespaceOwnership from this branch, plus useDeleteNamespace
from main.
Add namespace edit dialog, transfer ownership dialog, and member list pagination. Update API layer to support pagination (PagedResponse), add useUpdateNamespace and useTransferNamespaceOwnership hooks with pagination-aware optimistic updates. Integrate edit button in NamespaceHeader and transfer button on members page. Add i18n keys for all new features (en + zh).
Introduce a dedicated `/space/$namespace/$slug/compare` page that compares
two published skill versions GitHub-style: left file list + right unified
diff. Backend exposes `GET /versions/compare` returning structured diff
(computed via java-diff-utils) with per-file hunks, binary placeholder,
and truncation flags. Frontend uses two version selectors scoped to
PUBLISHED versions, a file search box, active-file highlighting, and
whitespace-preserving unified view. E2E covers the publish + rerelease
+ approve round trip; controller/domain tests cover happy path and
same-version rejection.
Add an "Update" button to each skill card on the My Skills dashboard
page. Clicking it navigates to the Publish page with the skill's
namespace and visibility pre-selected, reducing manual steps when
re-publishing a skill package.
- Add visibility field to SkillSummaryResponse so the list API exposes
each skill's current visibility setting
- Add publish-prefill module to normalize and validate URL search params
- Wire TanStack Router validateSearch on the publish route
- Add E2E tests covering the prefill flow and invalid-param fallback
- Remove duplicate useSubmitForReview/useConfirmPublish in hooks and client
- Restore resolveVersionStatusLabel (version-status-badge not in this branch)
- Fix missing Card closing tag in versions tab
- Backend: Add confirmWarnings parameter to rerelease DTO, domain service, and app service
- Frontend: Add warning dialog with retry logic when precheck warnings are detected
- i18n: Add rerelease warning dialog translations (en/zh)
Fixes the issue where rereleasing a published version with secret detection warnings
always fails with 400 error. Now follows the same confirm-and-retry pattern as initial publish.
* feat(skill): add UPLOADED status for PRIVATE skill lifecycle
## Summary
- Add UPLOADED status for PRIVATE skills after security scan passes
- PRIVATE skill owners can test before confirming publish or submitting for review
- Rerelease now follows visibility rules (PRIVATE→UPLOADED, PUBLIC→PENDING_REVIEW)
- Auto-withdraw changes status to UPLOADED (not DRAFT) to keep versions visible
## Changes
- SkillVersionStatus: Add UPLOADED enum value
- SkillPublishService: PRIVATE skills go to UPLOADED after scan
- SecurityScanService: Visibility-based status transition after scan
- SkillGovernanceService: Withdraw→UPLOADED, delete allows UPLOADED
- SkillQueryService: Include UPLOADED in version list filters
- SkillReviewSubmitService: New service for submit-review and confirm-publish
- SkillLifecycleController: Add submit-review and confirm-publish endpoints
- Frontend: Add buttons, dialogs, and hooks for new operations
## Workflow
- PRIVATE: Publish → SCANNING → UPLOADED → confirm-publish → PUBLISHED
- PUBLIC: Publish → SCANNING → PENDING_REVIEW → PUBLISHED
* feat(review): add backward compatibility for DRAFT status
Support both DRAFT (legacy) and UPLOADED (new flow) status in:
- SkillReviewSubmitService.submitForReview
- SkillReviewSubmitService.confirmPublish
- ReviewService.submitReview (both overloads)
This ensures existing data with DRAFT status continues to work
with the new visibility-based workflow introduced in OSS-02.
## Summary
- Add UPLOADED status for PRIVATE skills after security scan passes
- PRIVATE skill owners can test before confirming publish or submitting for review
- Rerelease now follows visibility rules (PRIVATE→UPLOADED, PUBLIC→PENDING_REVIEW)
- Auto-withdraw changes status to UPLOADED (not DRAFT) to keep versions visible
## Changes
- SkillVersionStatus: Add UPLOADED enum value
- SkillPublishService: PRIVATE skills go to UPLOADED after scan
- SecurityScanService: Visibility-based status transition after scan
- SkillGovernanceService: Withdraw→UPLOADED, delete allows UPLOADED
- SkillQueryService: Include UPLOADED in version list filters
- SkillReviewSubmitService: New service for submit-review and confirm-publish
- SkillLifecycleController: Add submit-review and confirm-publish endpoints
- Frontend: Add buttons, dialogs, and hooks for new operations
## Workflow
- PRIVATE: Publish → SCANNING → UPLOADED → confirm-publish → PUBLISHED
- PUBLIC: Publish → SCANNING → PENDING_REVIEW → PUBLISHED
* feat(publish): allow warning-confirmed pre-publish checks\n\nFixes #287
* fix(i18n): add missing register validation translation keys
The registration form uses i18n keys like register.usernameInvalid,
register.passwordTooShort etc. but they were never defined in the
locale files, causing E2E tests to fail because the raw key strings
were displayed instead of human-readable messages.
* feat: display username and email in namespace member management
MemberResponse DTO now includes displayName and email fields.
NamespacePortalQueryAppService batch-loads UserAccount data via
findByIdIn to avoid N+1 queries. Frontend member table shows
username (with userId as fallback subtitle) and email columns
instead of raw user IDs.
* test(namespace): add displayName/email assertions and new test coverage
- Controller: add displayName and email assertions to addMember and updateMemberRole tests
- QueryAppService: add listMembers tests for batch user enrichment and null degradation
- CommandAppService: add addMember/updateMemberRole tests for displayName/email population and graceful degradation
Addresses PR #236 review feedback comments:
- Issue 2: Controller tests now assert displayName and email from mocked UserAccount
- Issue 3: Service layer tests now cover batch query and null user degradation
* fix: increase nginx upload limit and filter Chrome DevTools logs
- Add client_max_body_size 100M to nginx config to allow large skill package uploads
- Silently handle Chrome DevTools .well-known requests to reduce log noise
Fixes#193
* feat(domain): add Unicode slug support with emoji validation
- Update SLUG_PATTERN to support Unicode letters (\p{L}), numbers (\p{N}), and symbols (\p{So})
- Add UPPERCASE_PATTERN to maintain lowercase-only validation
- Modify slugify() to preserve Unicode characters instead of replacing with hyphens
- Add 8 new test cases covering Chinese, Japanese, Korean, emoji, and mixed Unicode slugs
- Maintain backward compatibility with existing ASCII slug validation
- All 16 tests passing
Implements Phase 1 of unicode-slug-support-v1.0-prd.md
* feat(web): add URL encoding for Unicode slugs and improve monospace font support
- Encode skill slugs in all navigation URLs using encodeURIComponent
- Encode slugs in API client methods for proper HTTP request handling
- Update share button to generate properly encoded URLs
- Extend monospace font stack with system fonts for better Unicode support
- All frontend tests pass (506 tests)
Related to Unicode slug support PRD phase 2 and 3
* feat(web): regenerate API types for Unicode slug support
- Update OpenAPI schema types after backend slug validator changes
- Reflects new Unicode-aware slug pattern validation
* remove
- Replace hardcoded 'Network error' with i18n key 'apiError.networkError'
- Add dedicated handler for status 0 in handleApiError
- Add test case for network error scenario
Closes#160
* fix(skill): resolve duplicate result error when deleting skill with shared namespace+slug
V13 migration changed the unique constraint from (namespace_id, slug) to
(namespace_id, slug, owner_id), allowing multiple skills with the same
namespace+slug but different owners. The findByNamespaceSlugAndSlug query
returned Optional<Skill> which threw IncorrectResultSizeDataAccessException
when 2 rows matched.
Changed the query to return List<Skill> and added ownerId query param to
DELETE endpoints so the frontend can specify exactly which skill to delete.
* fix(review): keep failed scans reviewable and expose feedback
Implements 6 high-priority improvements from code review:
Backend:
- Make label business limits configurable via application.yml (max-definitions, max-per-skill)
Frontend:
- Split use-skill-queries.ts into domain-specific modules (label/namespace/user/skill)
- Enable @typescript/no-explicit-any as warning and clean up 10 any types
- Unify API error handling by removing unwrap() in favor of fetchJson()
Testing:
- Add label system scenarios to smoke test script
- Add 6 new tests for label management UI (validation, rendering)
All tests passing: 301 backend, 129 frontend
* feat(profile): add field policy config and GET response
Add per-field edit policy configuration (editable, requiresReview) to
application.yml and expose it in the GET /api/v1/user/profile response
via a new fieldPolicies map, enabling the frontend to dynamically render
fields based on backend-driven policies.
* feat(profile): implement mixed submission in PATCH
Split profile update changes by per-field policy: fields without
requiresReview apply immediately, fields with requiresReview enter
the pending queue. Return PARTIALLY_APPLIED status with appliedFields
and pendingFields maps when both paths trigger in a single request.
* feat(web): rewrite profile page with dynamic fields
Render profile fields dynamically from backend fieldPolicies, with
whole-page read/edit mode toggle. Handle APPLIED, PENDING_REVIEW, and
PARTIALLY_APPLIED responses. Add i18n keys for review hints and
partial-apply toasts in both en and zh.
* merge: resolve deepwiki.yml conflict with package-lock.json fix
* api schema
* fix(profile): align moderation defaults and tests
* ci(deepwiki): run crawler on release publish
* feat: add user profile update feature with moderation support
Add ability for users to update their display name with optional machine/human review.
Backend:
- Add profile_change_request table (V15 migration)
- Add UserProfileService with moderation workflow
- Add PATCH /api/v1/user/profile and GET /api/v1/user/profile endpoints
- Add ProfileModerationService interface with NoOp implementation
- Add ProfileModerationProperties for machine/human review toggles
- Update AuthController /me to refresh session when displayName changes
- Add i18n messages for profile validation and responses
Frontend:
- Add /settings/profile page with edit-on-click pattern
- Add profileApi.updateProfile() to client
- Update user menu: add "Profile Settings", make "Security Settings" local-only
- Add i18n translations (en/zh) for profile settings
Testing:
- Add UserProfileControllerTest with 8 test cases
- Add UserProfileServiceTest with 6 test cases
- Add AuthControllerTest case for session refresh on displayName change
* version sql
* merge main
* feat: add profile review admin workflow
* feat(web): add pagination to skill review list
- useReviewList now passes page/size to backend and returns paginated response
- reviews.tsx maintains per-tab page state with prev/next controls
- namespace-reviews.tsx adapted to new response shape
- Added i18n keys for pagination (en/zh)
* feat: add user profile update feature with moderation support
Add ability for users to update their display name with optional machine/human review.
Backend:
- Add profile_change_request table (V15 migration)
- Add UserProfileService with moderation workflow
- Add PATCH /api/v1/user/profile and GET /api/v1/user/profile endpoints
- Add ProfileModerationService interface with NoOp implementation
- Add ProfileModerationProperties for machine/human review toggles
- Update AuthController /me to refresh session when displayName changes
- Add i18n messages for profile validation and responses
Frontend:
- Add /settings/profile page with edit-on-click pattern
- Add profileApi.updateProfile() to client
- Update user menu: add "Profile Settings", make "Security Settings" local-only
- Add i18n translations (en/zh) for profile settings
Testing:
- Add UserProfileControllerTest with 8 test cases
- Add UserProfileServiceTest with 6 test cases
- Add AuthControllerTest case for session refresh on displayName change
* version sql
* merge main
