Add platformRoles parameter to skill lifecycle methods:
- hideSkill, archiveSkill, unhideSkill, unarchiveSkill, deleteVersion
- Support SUPER_ADMIN and SKILL_ADMIN role bypass
- Add hideSkillAsAdmin and unhideSkillAsAdmin for admin controllers
- Fix userId null checks in rating and star controllers
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Fix SkillStarController to use @RequestAttribute instead of @AuthenticationPrincipal
- Fix SkillRatingController to use @RequestAttribute instead of @AuthenticationPrincipal
- Fix SkillGovernanceService NPE when userNamespaceRoles is null
- Update ApiTokenAuthenticationFilter to properly populate userNsRoles
- Enhance error messages for 403 vs 401 status codes
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Add 'me namespaces' subcommand to list accessible namespaces
- Remove standalone 'namespaces' command from CLI
- Rename 'My Skills' help section to 'My Profile'
- Move namespaces listing under My Profile section
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Add unified permission model for skill lifecycle operations:
- Skill owners can hide/unhide/archive their own skills
- Namespace admins/owners can manage skills in their namespace
- Platform admins retain full access via admin endpoints
Changes:
- SkillGovernanceService: add permission checks to hideSkill/unhideSkill
- SkillLifecycleAppService: add hideSkill/unhideSkill methods
- GovernanceWorkflowAppService: add facade methods for hide/unhide
- SkillLifecycleController: add POST /{namespace}/{slug}/hide and /unhide endpoints
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Merge list and check into unified list command with status filtering
- Add skill-status.ts core module for shared discovery logic
- Unify interaction flow: scope -> agent -> status -> display
- Replace -g/-p/-a flags with --scope option
- Simplify check as alias for list --status managed,missing
- Fix uninstall to properly handle 'All' scope selection
- Display orphaned skills with [orphaned] marker in uninstall
- Update help text and examples
BREAKING CHANGE: Removed -g/--global, -p/--project, -a/--all flags from list command.
Use --scope global|project|all instead.
- Add interactive namespace selection to inspect command (like install)
- Add version selection when multiple versions exist (--version to skip)
- Skip version selection when --details is specified (shows all versions)
- Add error handling for 403/404 errors with helpful messages
- Add 'for installation' and 'for details' hints to explore command
- Reorganize help: separate 'Discover & Info' and 'Social & Reviews' sections
- Remove --rating option and rating sort (API doesn't support it)
- Add --stars shorthand for star-based sorting
- Fix interactive-search.ts to use stars sort instead of rating
- Add ratingAvg field to SkillDetail and display in explore output
- Delete deprecated versions.ts command (functionality merged into inspect)
- Replace dim() function calls with chalk.dim() to return strings
- Use array join approach for clean output formatting
- Fix undefined output in environment variable instructions
- Simplify config command: remove <key> parameter, hardcode registry
- config set <value> now directly sets registry URL
- config get shows resolved value with source information
- Add --source option to config get for env/file/resolved
- Add version normalization (strip 'v' prefix) in install
- Skip version selection when --skill-version or --tag specified
- Enhance inspect with --details option for version history
- Reorganize help: Configuration at top, Discover & Info merged
- Move SkillVersionItem types to schema/routes.ts
- Fix error handling to return after setting exit code
- Remove versions command registration (file retained for compatibility)
- Add --details option to inspect for version history and tags
- Normalize version input (strip 'v' prefix) in install command
- Skip version selection when --skill-version or --tag is specified
- Reorganize help: merge Discover & Info sections
- Move SkillVersionItem/VersionsResponse types to schema/routes.ts
- Remove versions command registration from CLI (file retained for now)
- Fix error handling to return after setting exit code
- Update tests to reflect command changes
- Remove hardcoded default from Commander --registry option that
overrode config file settings in ALL commands
- Login command now uses loadConfigFromProgram() like other commands
instead of hardcoded http://localhost:8080
- Improved login error messages with registry URL context
process.exit() forcefully kills the process, preventing libuv from
cleanly closing HTTP connections (undici). On Windows this triggers
an assertion failure: UV_HANDLE_CLOSING.
Using process.exitCode = 1 lets Node.js exit gracefully after the
event loop drains, eliminating the assertion error while still
returning exit code 1.
ApiError previously displayed raw JSON like:
API error 403: {"code":403,"msg":"Access denied..."}
Now extracts the msg field from the API response body and displays:
Access denied to skill: find-skills
Run `skillhub login` to authenticate.
Changes:
- Add extractHumanMessage() to pull msg/message/error from response
- ApiError.message now shows human text instead of raw JSON
- 401/403 responses append login hint
- whoami: remove redundant 'Not authenticated:' prefix
Remove scripts/notify-feishu.sh and scripts/release-cli.sh from git tracking
as they are local utility files. Added to .gitignore to prevent future
accidental commits.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Revert the vite.config.ts changes from e93adaa that changed the dev
server port from 3000 to 8181 and added local dev features (env loading,
serve-skill-md plugin, proxy headers). These were local development
configs that broke CI by changing the port away from 3000 which the
Makefile health check expects.
list.ts:
- Remove locked universal section, all agents are now equal
- Users manually select which agents to list from
- No default selections, cleaner UX
check.ts:
- Add agent filtering via --agent flag or interactive selection
- Add status filtering via --status flag or interactive selection
- Default to showing only OK + Missing (not Orphaned)
- Interactive prompts for scope, agents, and statuses
- Show agent names and scope prefix in output
- Smart defaults reduce noise from orphaned skills
- list.ts: use isUniversalForScope for dynamic grouping based on scope
- list.ts: group output by skill name to avoid duplicate path listings
- uninstall.ts: use isUniversalForScope for dynamic grouping
- uninstall.ts: add printUninstallResults for consistent formatted output
- .npmignore: exclude development files from npm package
- package.json: bump version to 1.1.1
- update.ts: sort skill selection list alphabetically
- check.ts: sort results by status then name, sort agent names in locations
- install.ts: sort agent names in buildAgentSummary, sort --list output
- sync.ts: sort discovered skills by name before display
Ensures consistent alphabetical ordering across all CLI commands for
better user experience and predictability.
Group agents that share the same install path into a single line.
When more than 5 agents share a path, show first 5 names + count.
Sort agent names alphabetically within each group.
Extract buildInstallResultLines utility function to DRY up
duplicate output logic in installFromRegistry and installFromGit.
- Sort universal and non-universal agent lists by name in selectAgentsInteractive
- Exclude agents with showInUniversalList===false from locked section
- Replace spinner.stop() with spinner.succeed() before interactive prompts
to prevent 'Fetching' text from appearing as the step title
- Also fix spinner.stop -> spinner.succeed for 'Installation complete'
- Move scope selection before agent selection in both installFromRegistry
and installFromGit flows
- Use isUniversalForScope in selectAgentsInteractive so that the Universal
locked section correctly reflects the actual scope:
- Project: agents with skillsDir='.agents/skills' (Cline, Codex, Cursor, etc.)
- Global: agents with globalSkillsDir='.agents/skills' (Cline, Warp only)
- Clean up unused getUniversalAgents/getNonUniversalAgents imports
- Add isUniversalForScope(agent, isGlobal) and getAgentTargetDir(agent, isGlobal) to agent-detector.ts
- An agent is 'universal' when its target install dir equals the canonical .agents/skills directory
- This fixes incorrect symlink skipping for agents like Codex/Cursor whose globalSkillsDir
differs from .agents/skills (e.g. .codex/skills, .cursor/skills)
- Update installer.ts to use dynamic check via optional AgentInfo parameter
- Update install.ts to use getAgentTargetDir and pass agent info to installSkill
- Update uninstall.ts to use isUniversalForScope for correct path resolution
- Clean up unused isUniversalAgent import in list.ts
- Stop spinner before runInteractiveSearch to prevent terminal UI conflict
(same issue as version selection p.select)
- Make spinner messages more specific: include skill name, version, path
instead of generic "Fetching"/"Downloading"/"Extracting"
The ora spinner was still running during p.select() interactive prompt,
causing the spinner to continuously overwrite the terminal and block
the version selection UI. The user would see "Fetching..." stuck until
pressing Enter.
Stop spinner before p.select() and restart after selection completes.
* feat(ci): add AI-powered release notes generation
- Add GitHub Models integration for automated release notes
- Support bilingual (EN) release notes with highlights extraction
- Fallback to conventional commit grouping when LLM unavailable
- Trigger on tag push or manual workflow dispatch
- Zero configuration: uses GitHub Models (gpt-4o-mini) by default
* chore: pin action versions and update gitignore
- Pin checkout and setup-deno to commit hashes matching project convention
- Add .playwright-mcp/ and .mcp.json to gitignore
* fix(search): keep private skills out of portal discovery
- remove super admin expanded visibility from portal search
- exclude all private skills from portal search results
- keep namespace-only skills visible only to namespace members
- reserve private skill access for my-skills and future admin surfaces
* test(search): update test to reflect portal visibility policy
- rename test from platformWideAccessShouldBypass... to platformWideAccessShouldNotBypass...
- verify that platformWideAccess flag does not grant extra visibility in portal search
- verify PRIVATE skills are excluded from search SQL
- aligns test with new requirement: portal search uses standard visibility rules
* test(search): update app service test for portal visibility policy
- rename test from search_shouldGrantPlatformWideAccessToSuperAdmin to search_shouldNotGrantPlatformWideAccessToSuperAdminInPortal
- verify super admin does not get platformWideAccess in portal search
- aligns with requirement: portal uses standard visibility, admin features reserved for dedicated interface
