scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-10-05 02:41:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
1268 commits 254 branches 28 tags 38 MiB
Commit graph

1268 commits

This branch
This branch
All branches
Author SHA1 Message Date
XiaoSeS
2b831f31a9
fix(cli): enforce fingerprint-safe install and sync (#804) 
* fix(cli): validate downloaded skill fingerprint

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): guard namespace sync version drift

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): preserve sync safety guards under force

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): fail blocked sync checks

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 18:58:17 +08:00
XiaoSeS
45d341f144
feat(review): add skill comments and user feedback (#793) 
* feat(review): add skill review domain model

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* feat(review): expose skill reviews in API and UI

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): preserve moderation under concurrent edits

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): scope concurrent write conflicts

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): restore web build compatibility

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): keep author cleanup available

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): preserve author cleanup access

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): require review score contract

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): strengthen failure and concurrency coverage

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): tighten persistence assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): disambiguate repository ports

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): enable request validation

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): align validation and postgres coverage

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(namespace): verify invalid batch has no side effects

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): align accessibility and plural assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(i18n): require complete plural references

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): wrap editor actions on mobile

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): wrap long mobile labels

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): disable edits for archived skills

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): enforce archived mutation guard

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 11:15:52 +08:00
XiaoSeS
15dad68740
test(promotion): cover global download after approval (#792) 
* test(promotion): cover global download after approval

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(promotion): align smoke setup with current API

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(promotion): make download smoke repeatable

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(promotion): wait for member review readiness

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(promotion): verify denied approval state

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 11:15:10 +08:00
XiaoSeS
6ab8faa6b9
feat(cli): add source-safe skill upgrades (#796) 
* feat(cli): add source-safe skill upgrades

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): harden skill upgrade lifecycle

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): make multi-target upgrades failure-safe

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): cover upgrade selection and fallback boundaries

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): use a dead pid for stale lock recovery

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): prove upgrade safety invariants

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): prove manual ownership remains untouched

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): bind ownership sentinels to each fixture

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): keep upgrade assertions registry-scoped

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): close upgrade commit races

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): keep rollback backup path narrowed

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): reject upgrade targets removed after planning

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): serialize remove with target upgrades

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): prove shared target lock cleanup

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): make stale target lock recovery ownership-safe

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): use proven cross-process target locks

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): synchronize target lock contenders

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): bound target lock worker cleanup

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): satisfy target lock worker lint

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): serialize inventory and alias target mutations

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): cover lock root safety boundaries

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): keep target lock identity stable

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): report partial upgrade failures

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): preserve committed upgrade results

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): surface install lifecycle warnings

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): prove lifecycle warning outputs

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): assert structured upgrade failures

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): keep portable install paths

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(cli): unify aliased target identity

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): accept canonical relative paths

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): verify portable target identity

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(cli): synchronize stale lock contenders

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 10:50:09 +08:00
XiaoSeS
08723fd01a
Merge pull request #791 from iflytek/codex/validate/issues620-621-20260901 
feat(review): add progress history and light-dark themes
 2026-09-01 18:05:52 +08:00
XiaoSeS
ea1ebb99d7 test(web): stabilize theme and review browser flows 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
2e11705ebd fix(theme): harden responsive switch semantics 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
0d48945fd2 fix(theme): polish dark header and toggle 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
fa13dd54ee test(review): validate progress query on postgres 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
83599f9317 fix(review): prevent progress offset overflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
39861bc6d8 test(review): strengthen exact-sha coverage 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
918ef9d265 test(review): filter known CSP browser warning 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
a568d22526 fix(review): restrict version history to reviewers 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
3e77365a5d fix(review): complete progress history workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
b8b0fba3d4 fix(theme): polish dark notification states 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
7995c00683 feat(review): add author review progress and attempt history 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
ebac94a043 feat(theme): add browser-local light and dark mode 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
ac42c2346c
Merge pull request #786 from iflytek/fix/issue-613-oauth-concurrency-20260831 
fix(auth): converge concurrent identity binding
 2026-08-31 18:49:41 +08:00
XiaoSeS
bdb42b1be9
Merge pull request #787 from iflytek/fix/issue-615-audit-atomicity-20260831 
fix(governance): make mutations and audit atomic
 2026-08-31 18:48:30 +08:00
XiaoSeS
a73997c672
Merge pull request #784 from iflytek/fix/concurrent-publish-coordinate-race 
fix(publish): return deterministic conflict on concurrent coordinate race
 2026-08-31 18:47:19 +08:00
XiaoSeS
3a29f6d750 fix(auth): converge concurrent identity binding 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
b22b92fcbc fix(governance): make mutations and audit atomic 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
182f7bacef fix(publish): flush concurrent coordinate writes 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
13510609a0
Merge pull request #783 from iflytek/fix/auth-stale-session-public-routes 
fix(auth): allow public routes after session expiry
 2026-08-31 15:25:01 +08:00
XiaoSeS
d1cd3d2afe
Merge pull request #782 from FenjuFu/fix/audit-detail-json 
fix(audit): render audit detail JSON with Jackson instead of string concatenation
 2026-08-31 15:24:06 +08:00
XiaoSeS
8361ea3fcd
Merge pull request #774 from FenjuFu/fix/promotion-pagination 
fix(promotion): paginate review queues
 2026-08-31 15:22:21 +08:00
XiaoSeS
49ef09d989
Merge pull request #773 from FenjuFu/fix/publish-case-insensitive-whitelist 
fix(publish): match allowed filenames case-insensitively
 2026-08-31 15:19:52 +08:00
FenjuFu
d224c5a8ba fix(publish): return deterministic conflict on concurrent coordinate race 
Concurrent publishes for the same (namespace_id, slug, owner_id) or
(skill_id, version) coordinate both pass the check-then-create reads and
race on the database unique constraints. The losing request surfaced an
unhandled DataIntegrityViolationException as HTTP 500.

Translate the constraint violation at both insert points into a
deterministic DomainBadRequestException (error.skill.publish.concurrentConflict),
matching the existing idiom in LabelDefinitionService/ReviewService/
PromotionService. No same-transaction re-read is attempted, so the losing
publish rolls back cleanly and returns a retryable conflict instead of a 500.

Add the i18n key (en/zh) and two unit tests covering the skill-insert and
version-insert races.

Closes #617

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-31 14:27:45 +08:00
XiaoSeS
346acbcfa3 fix(auth): preserve protected invalid-session handling 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
fe8a0cb21f fix(promotion): clamp emptied queue pages 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
9f3b10d27a test(publish): cover case-insensitive whitelist variants 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
98a0e1d2f9 fix(auth): allow public routes after session expiry 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
FenjuFu
215ab11b09 fix(audit): render audit detail JSON with Jackson instead of concatenation 
audit_log.detail_json is a JSONB column, so the value has to be valid
JSON or the insert fails. It was built by string concatenation at every
call site, with three inconsistent levels of escaping: none at all in
ClawHubCompatAppService, DeviceAuthWebController, LabelAdminAppService
and SkillLabelAppService; quotes only in ReviewPortalAppService,
SkillLifecycleAppService, NamespaceGovernanceService and
SkillGovernanceService; quotes and backslashes in
PromotionPortalAppService.escapeJson.

None of the three escapes control characters, which JSON forbids raw
inside a string. A reviewer pressing Enter in a review comment therefore
produced a payload PostgreSQL rejects, and because the audit write
happens after the domain mutation, the review was already approved when
the request returned 500.

Add AuditDetail, which renders the payload through Jackson, and route
all 29 construction sites through it. 17 of those interpolate a string
value and are the actual defect surface; the numeric and constant ones
are converted too so there is one way to build audit detail and no
hand-rolled example left to copy.

SkillHardDeleteService.toAuditPayload already did this correctly with a
LinkedHashMap and an ObjectMapper; AuditDetail is that shape extracted.
The service itself is left alone rather than changing its constructor
signature for no behavior gain.

Output is byte-identical for values that were already escaped correctly,
so the existing exact-string assertions in AdminSearchControllerTest and
PromotionPortalAppServiceTest are unchanged. null still means "no
detail": the builder returns null rather than {} when no field is set.

Addresses the JSON half of #615. The transaction half -- the domain
mutation and the audit write not sharing one transaction -- is a
separate design decision about whether an audit failure should roll back
a review, and is not bundled here.

Signed-off-by: FenjuFu <fufenjupku@gmail.com>
 2026-08-30 18:39:48 +08:00
XiaoSeS
b896c698cd
Merge pull request #780 from iflytek/fix/cli-fingerprint-order 
fix(cli): stabilize namespace sync fingerprints
 2026-08-29 16:43:12 +08:00
XiaoSeS
9443731dc4 fix(cli): stabilize namespace sync fingerprints 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 16:39:27 +08:00
XiaoSeS
20d3dc24ac
Merge pull request #779 from iflytek/fix/server-storage-uid-compat 
fix(deploy): preserve storage volume ownership
 2026-08-29 16:14:52 +08:00
XiaoSeS
aa4ea17c4a fix(deploy): preserve storage volume ownership 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:58:55 +08:00
XiaoSeS
1335c4e3ff
Merge pull request #778 from iflytek/feature/revert-public-release-skill 
docs(release): remove public release workflow
 2026-08-29 15:50:28 +08:00
XiaoSeS
fcc9dfd616 docs(release): remove public release workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:47:25 +08:00
XiaoSeS
d3adc95ce0
Merge pull request #777 from iflytek/docs/release-domain-validation-gate 
docs(release): add verified publishing workflow
 2026-08-29 15:45:02 +08:00
XiaoSeS
1136e9ef5d
Merge pull request #776 from iflytek/feature/fix-subpath-redirect-scheme 
fix(web): preserve HTTPS in sub-path redirects
 2026-08-29 15:43:31 +08:00
XiaoSeS
33483ec20f docs(release): add verified publishing workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:39:23 +08:00
XiaoSeS
e9e570133d fix(web): preserve HTTPS in sub-path redirects 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:29:42 +08:00
XiaoSeS
337d3d973d
Merge pull request #775 from iflytek/fix/cli-namespace-sync-server-route 
fix(cli): add namespace sync manifest endpoint
 2026-08-29 15:16:27 +08:00
XiaoSeS
60fed4d94f fix(auth): support bearer tokens behind sub-path proxies 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:05:09 +08:00
XiaoSeS
2babc0935b fix(cli): add namespace sync manifest endpoint 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 14:06:34 +08:00
FenjuFu
817426c50f fix(promotion): paginate review queues 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-28 23:29:58 +08:00
FenjuFu
e9ac6c162a fix(publish): match allowed filenames case-insensitively 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-28 17:57:01 +08:00
XiaoSeS
c11a51c75f
docs(weekly): publish 2026 W35 report
Some checks failed
Deploy Docs / build (push) Has been cancelled
Details
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details
Security / CodeQL (python) (push) Has been cancelled
Details
Deploy Docs / Deploy (push) Has been cancelled
Details 
Merge reviewed W35 weekly report mirror.
 2026-08-28 17:22:18 +08:00
XiaoSeS
56ed2dcadd docs(weekly): mirror 2026-W35 report 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-28 17:18:57 +08:00