Commit graph

1221 commits

Author SHA1 Message Date
XiaoSeS
2babc0935b fix(cli): add namespace sync manifest endpoint
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-29 14:06:34 +08:00
XiaoSeS
c11a51c75f
docs(weekly): publish 2026 W35 report
Some checks failed
Deploy Docs / build (push) Has been cancelled
Security / Dependency Review (push) Has been cancelled
Security / CodeQL (java-kotlin) (push) Has been cancelled
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Security / CodeQL (python) (push) Has been cancelled
Deploy Docs / Deploy (push) Has been cancelled
Merge reviewed W35 weekly report mirror.
2026-08-28 17:22:18 +08:00
XiaoSeS
56ed2dcadd docs(weekly): mirror 2026-W35 report
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-28 17:18:57 +08:00
XiaoSeS
f993ad6533
Merge pull request #712 from Vast-Stars/feat/personal-namespace-provisioning
feat(namespace): auto-provision a personal namespace on registration
2026-08-28 17:04:21 +08:00
XiaoSeS
37e3c63236
Merge pull request #688 from iflytek/fix/auth-email-assurance-guard-main
fix(auth): enforce trusted OAuth identity attributes
2026-08-28 17:04:15 +08:00
XiaoSeS
eeb63613f2 fix(namespace): enable personal provisioning by default 2026-08-28 16:42:26 +08:00
XiaoSeS
ee0f0763db refactor(namespace): keep personal provisioning configuration-only 2026-08-28 15:55:29 +08:00
XiaoSeS
7beb1be356 fix(namespace): skip system accounts during provisioning 2026-08-28 15:27:39 +08:00
XiaoSeS
04bb414b37 fix(namespace): use stable random personal namespace slugs 2026-08-28 15:19:56 +08:00
XiaoSeS
dc31bb97f4 Revert "feat(namespace): backfill personal namespaces for existing accounts"
This reverts commit 2d50437e4f.
2026-08-28 15:19:56 +08:00
XiaoSeS
fbf6887e9d Revert "fix(namespace): stop the backfill from querying with a null keyword"
This reverts commit 639e081ca7.
2026-08-28 15:19:56 +08:00
XiaoSeS
e80fb986f7 Revert "fix(web): stop the settings form from reverting the saved value"
This reverts commit 4fe6948f87.
2026-08-28 15:19:56 +08:00
XiaoSeS
eba2762b5b Revert "feat(namespace): let operators choose which namespaces new accounts join"
This reverts commit a9e7f43e5a.
2026-08-28 15:19:56 +08:00
XiaoSeS
0221c17113 Revert "feat(web): pick default namespaces from a list instead of typing slugs"
This reverts commit 7247defd5d.
2026-08-28 15:19:56 +08:00
XiaoSeS
c91c2ca408 fix(auth): make GitHub email assurance resilient 2026-08-28 15:08:07 +08:00
XiaoSeS
71fbc8357a
Merge pull request #724 from 15258725278/release/cli-v0.1.10
feat(cli): add namespace workspace sync
2026-08-28 10:22:24 +08:00
XiaoSeS
c32bced109
Merge pull request #748 from myml/fix/security-csp-policy
fix(security): harden CSP policy and hide nginx server tokens
2026-08-28 10:22:14 +08:00
XiaoSeS
c825d896a4
Merge pull request #762 from FenjuFu/fix/code-scanning-alerts-2026-08
fix(security): resolve CodeQL findings
2026-08-28 10:22:04 +08:00
XiaoSeS
2e78f79e83
Merge pull request #765 from iflytek/fix/pr735-subscription-authorization-20260827
Some checks are pending
Security / Dependency Review (push) Waiting to run
Security / CodeQL (java-kotlin) (push) Waiting to run
Security / CodeQL (javascript-typescript) (push) Waiting to run
Security / CodeQL (python) (push) Waiting to run
fix(subscription): enforce current visibility for subscribers
2026-08-27 17:48:08 +08:00
XiaoSeS
7476c9e0d2
fix(skill-card): resolve author display names in summaries
Maintainer follow-up for #751; batch-loads owner display names and preserves summary constructor compatibility.
2026-08-27 17:45:34 +08:00
XiaoSeS
1544ae4775 fix(skill-card): add owner summary compatibility overload
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-27 17:30:15 +08:00
XiaoSeS
ec9689dbc8 fix(skill-card): preserve owner fields when adding labels
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-27 17:28:09 +08:00
XiaoSeS
41a389432d fix(skill-card): keep legacy summary constructor compatible
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-27 17:26:30 +08:00
XiaoSeS
b0c4a154fd fix(skill-card): resolve author display names in summaries
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-27 17:21:15 +08:00
wurongjie
f43c047a6b feat(skill-card): show author and update time in skill card
Add ownerId and ownerDisplayName fields to SkillSummaryResponse,
and render author and last update time at the bottom of each skill card.

在技能卡片底部新增作者和最近更新时间显示,搜索结果接口新增
ownerId 和 ownerDisplayName 字段。

Log: 技能卡片新增作者和更新时间
Influence: 搜索结果页技能卡片底部显示作者和更新时间信息,接口新增 ownerId/ownerDisplayName 字段。
Signed-off-by: wurongjie <wurongjie@uniontech.com>
2026-08-27 17:21:15 +08:00
XiaoSeS
a3d1b4c9c5 test(subscription): remove unrelated confirm-publish assertions
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-27 16:56:01 +08:00
XiaoSeS
126f01d75e fix(subscription): retain yank visibility context
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-27 16:50:37 +08:00
XiaoSeS
1331667496 fix(subscription): reuse visibility policy and localize denial
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-27 16:45:55 +08:00
千乘妍 (Xiaoyaner)
bacfd58aa0 fix: emit confirm-publish events with permission-aware subscriber fanout
Signed-off-by: 千乘妍 (Xiaoyaner) <258399167+xiaoyaner0201@users.noreply.github.com>
2026-08-27 16:43:32 +08:00
FenjuFu
36967794d1 fix(security): resolve CodeQL findings
Use a bounded safe YAML constructor, remove the polynomial placeholder regex, keep public label access GET-only with CSRF protection, validate CLI callbacks as loopback URL objects, and use cryptographic UUIDs for E2E identities.

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
2026-08-27 15:16:54 +08:00
FenjuFu
26f49e6819
docs(governance): add DPGA policy evidence
Validated documentation, links, markdown checks, and CI.
2026-08-27 15:07:42 +08:00
FenjuFu
7fc1df5043
feat(ratelimit): make thresholds runtime-configurable
Validated locally and in CI, including runtime configuration documentation.
2026-08-27 15:07:31 +08:00
XiaoSeS
7e37935da8
fix(i18n): keep Russian locale keys in sync
Merge validated locale parity fix.
2026-08-27 14:51:22 +08:00
qwn3213
412514b299
fix(web) 添加oidc的logo文件,配置oidc登录后图裂无logo太丑了 (#734)
* fix(web) 添加oidc的logo文件,配置oidc登录后图裂无logo太丑了

Signed-off-by: qwn3213 <qwn3213@gmail.com>

* fix(web) rename loge.svg to logo.svg

Signed-off-by: qwn3213 <qwn3213@gmail.com>

---------

Signed-off-by: qwn3213 <qwn3213@gmail.com>
2026-08-26 19:45:08 +08:00
FenjuFu
0587c55f8b
docs(examples): add Python client and usage examples (#702)
Add examples/python: a dependency-light (requests-only) SkillHubClient plus
runnable examples covering search, resolve, download and publish against the
REST API, and link them from the README Documentation sections. Serves the
large Python-leaning audience and doubles as a reference SDK seed (see #701).

Signed-off-by: FenjuFu <fufenjupku@gmail.com>
2026-08-26 19:43:13 +08:00
Michael
16306dd4f4
feat(i18n): add Russian locale for web UI and server messages (#700)
Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>
2026-08-26 19:43:07 +08:00
bbdu3
95e630c096
fix(scan): prevent scan tasks from being lost after transaction commit
Some checks are pending
Security / Dependency Review (push) Waiting to run
Security / CodeQL (java-kotlin) (push) Waiting to run
Security / CodeQL (javascript-typescript) (push) Waiting to run
Security / CodeQL (python) (push) Waiting to run
Preserve scan delivery on lock contention through the retry path and add reclaim regression coverage.
2026-08-26 17:46:16 +08:00
FenjuFu
3b5d4381a9
feat(publish): allow uploading a skill folder directly
Fix E2E ZIP picker selector after adding folder upload input.
2026-08-26 17:37:21 +08:00
XiaoSeS
4344ec6b22
Merge pull request #759 from iflytek/fix/auth-login-redirect-loop
fix(auth): prevent login page redirect loop
2026-08-26 15:57:30 +08:00
XiaoSeS
243e9b68f4 fix(auth): prevent login page redirect loop
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-26 15:46:20 +08:00
XiaoSeS
3522bad295
Merge pull request #623 from gale-popai/fix/oauth-return-to
fix(auth): keep the OAuth return target through the provider callback
2026-08-26 15:29:48 +08:00
wrj97
d7e8c51775
fix(dashboard): remove encoding from slug params (#747)
The router handles parameter encoding automatically. Explicitly encoding
the slug results in double-encoded characters in the URL.

Signed-off-by: wurongjie <wurongjie@uniontech.com>
2026-08-26 10:23:43 +08:00
ShinyHero666
470e79d6d2
fix(smoke): support separate actuator target (#689)
Signed-off-by: ShinyHero666 <160204855+ShinyHero666@users.noreply.github.com>
2026-08-26 10:23:31 +08:00
XiaoSeS
7599dd0ca9
fix(web): keep select poppers in collision bounds (#755)
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-25 20:07:58 +08:00
wrj97
5a95278528
fix(compat): prioritize PUBLIC/GLOBAL skills in legacy slug lookup (#750)
Some checks are pending
Security / Dependency Review (push) Waiting to run
Security / CodeQL (java-kotlin) (push) Waiting to run
Security / CodeQL (javascript-typescript) (push) Waiting to run
Security / CodeQL (python) (push) Waiting to run
* fix(compat): prioritize PUBLIC/GLOBAL skills in legacy slug lookup

When multiple skills share the same slug across namespaces,
findByLegacySlug now prefers PUBLIC visibility and GLOBAL
namespace over NAMESPACE_ONLY/PRIVATE ones, so plain slug
lookups resolve to the most accessible skill. Namespaces are
batch-fetched via findByIdIn to avoid N+1 database queries.

Signed-off-by: wurongjie <wurongjie@uniontech.com>

* fix(compat): prefer published legacy slug candidates

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: wurongjie <wurongjie@uniontech.com>
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-25 16:58:17 +08:00
FenjuFu
907d8eff90
fix(web): keep select menus within viewport (#754)
Cap shared Radix select content to the available viewport height and enable vertical scrolling so long option lists remain usable near page and dialog edges. Add a shared component regression test for the viewport and overflow classes.\n\nCloses #714

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
2026-08-25 16:56:58 +08:00
FenjuFu
91d0ae1504
feat(api): return skill labels from the skill listing endpoints on request (#730)
* feat(api): return skill labels from the skill listing endpoints on request

Skill labels were reachable only one skill at a time, through
/api/{v1,web}/skills/{namespace}/{slug}/labels, so a client rendering a list had
to issue a follow-up request per row.

Add includeLabels=true to GET /api/v1/skills and GET /api/web/skills. The labels
array is populated only when the parameter is set and left out of the payload
otherwise, so existing responses are byte-identical.

Labels for the whole page are resolved by SkillLabelProjectionService in three
queries — assignments, definitions, translations — rather than three per skill.

Closes #710

Signed-off-by: FenjuFu <fufenjupku@gmail.com>

* fix(api): use include parameter for skill labels

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(api): reject unsupported include before search

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: FenjuFu <fufenjupku@gmail.com>
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-25 13:49:24 +08:00
FenjuFu
1c3e9be9e9
fix(web): self-host Inter and JetBrains Mono fonts (#753)
* fix(web): self-host Inter and JetBrains Mono fonts

web/index.html loaded Inter + JetBrains Mono from fonts.googleapis.com at
runtime. On networks where Google Fonts is slow or unreachable (e.g. CN),
that stylesheet blocks first paint for tens of seconds (#716).

Vendor the same woff2 (from the @fontsource distribution) under
web/public/fonts and declare them in fonts.css with latin/latin-ext
unicode-range splits and font-display: swap, then point index.html at the
local stylesheet and drop the fonts.googleapis.com / fonts.gstatic.com hosts
from the page CSP. Only Inter and JetBrains Mono were ever fetched from the
CDN, so families and weights are unchanged; no external font requests remain.

Closes #716

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>

* docs(web): record vendored font licenses

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-08-25 13:49:08 +08:00
FenjuFu
954dfce7a4
fix(publish): accept Windows zip directory entries (#742)
* fix(publish): accept Windows zip directory entries

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>

* chore: restore repository line endings

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>

---------

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
2026-08-24 19:58:18 +08:00
FenjuFu
d5c6411ce6
fix(i18n): disable host locale fallback (#741)
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
2026-08-24 19:54:05 +08:00