skillhub

mirror of https://github.com/iflytek/skillhub.git synced 2026-08-27 11:14:59 +00:00

Author	SHA1	Message	Date
XiaoSeS	15ce199e1a	fix(publish): emit event on confirm publish (#738 ) Some checks are pending Security / Dependency Review (push) Waiting to run Details Security / CodeQL (java-kotlin) (push) Waiting to run Details Security / CodeQL (javascript-typescript) (push) Waiting to run Details Security / CodeQL (python) (push) Waiting to run Details Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-21 17:52:25 +08:00
FenjuFu	fa04d2fa23	fix(auth): close API token policy gaps against the authorization list (#729 ) RouteSecurityPolicyRegistry keeps two policy lists — AUTHORIZATION_POLICIES for session/cookie access and API_TOKEN_POLICIES for Bearer tokens — with nothing keeping them in step. Routes the authorization list opens but the token list never registers fall through to the catch-all and answer API token cannot access endpoint: <path>. Register the routes reported in #713 (/api/v1/labels, the star and rating writes) plus the same-class gaps for /api/v1/auth/methods and paths below /api/v1/download, and add a guard test that walks the authorization list and fails when a route is neither token-reachable nor declared session-only. DELETE /api/v1/skills/{id}/star also matched the SUPER_ADMIN rule for DELETE /api/v1/skills//, so un-starring was refused for ordinary accounts on the session path too. Star and rating writes now have their own authorization entries ahead of that rule. Closes #713 Signed-off-by: FenjuFu <fufenjupku@gmail.com>	2026-08-21 16:08:50 +08:00
FenjuFu	51457bfa2c	fix(security): 扫描任务改为事务提交后发布 (Closes #612 ) (#733 ) * fix(security): publish scan task after transaction commit SecurityScanService.triggerScan is @Transactional but published the Redis Stream scan task inline, before the transaction committed. The stream consumer could receive the task before the skill_version / security_audit rows were visible, fail with "SkillVersion not found" / "SecurityAudit not found", exhaust its immediate retries while the publishing transaction was still open, and leave the committed version stuck in SCANNING. Defer the publish to an afterCommit transaction synchronization so the consumer only ever sees the task once the rows are committed and visible; on rollback the task is never published. Falls back to an inline publish when called outside a transaction. Closes #612 Signed-off-by: FenjuFu <fufenjupku@gmail.com> * test(security): cover scan task after-commit publishing Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * refactor(security): hide scan publish transaction callback Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: FenjuFu <fufenjupku@gmail.com> Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-21 14:18:40 +08:00
FenjuFu	bbdc0f7a0c	fix(dev): use bash for backend launchers (#721 ) Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>	2026-08-21 09:35:52 +08:00
XiaoSeS	c3ecafb206	Merge pull request #736 from iflytek/docs/weekly-w33-official Some checks failed Security / Dependency Review (push) Waiting to run Details Security / CodeQL (java-kotlin) (push) Waiting to run Details Security / CodeQL (javascript-typescript) (push) Waiting to run Details Security / CodeQL (python) (push) Waiting to run Details Deploy Docs / build (push) Has been cancelled Details Deploy Docs / Deploy (push) Has been cancelled Details docs(weekly): mirror reviewed W33 report	2026-08-20 17:22:32 +08:00
XiaoSeS	f77e32ada5	docs(weekly): mirror reviewed W33 report Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-20 17:19:01 +08:00
XiaoSeS	d2403bb591	feat(namespace): add admin namespace management Some checks failed Security / Dependency Review (push) Has been cancelled Details Security / CodeQL (java-kotlin) (push) Has been cancelled Details Security / CodeQL (javascript-typescript) (push) Has been cancelled Details Security / CodeQL (python) (push) Has been cancelled Details Closes #580	2026-08-12 12:39:24 +08:00
XiaoSeS	81be20a6b5	fix(namespace): let super admin view namespaces (#705 ) Some checks failed Security / Dependency Review (push) Waiting to run Details Security / CodeQL (java-kotlin) (push) Waiting to run Details Security / CodeQL (javascript-typescript) (push) Waiting to run Details Security / CodeQL (python) (push) Waiting to run Details Deploy Docs / build (push) Has been cancelled Details Deploy Docs / Deploy (push) Has been cancelled Details Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-11 16:04:28 +08:00
XiaoSeS	76d95b615e	docs(compliance): document runtime integration contract (#704 ) Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-11 13:43:42 +08:00
XiaoSeS	2fe7514a4e	feat(review): show compliance declaration diffs (#703 )	2026-08-11 10:44:11 +08:00
XiaoSeS	0690e3f256	Merge pull request #698 from iflytek/fix/runtime-aliyun-stop-url Some checks are pending Security / Dependency Review (push) Waiting to run Details Security / CodeQL (java-kotlin) (push) Waiting to run Details Security / CodeQL (javascript-typescript) (push) Waiting to run Details Security / CodeQL (python) (push) Waiting to run Details fix(deploy): correct Aliyun runtime stop URL	2026-08-10 16:13:10 +08:00
XiaoSeS	c56e21e4bb	Merge pull request #699 from iflytek/feat/compliance-search-detail-projection feat(search): surface compliance mappings in discovery	2026-08-10 15:00:39 +08:00
XiaoSeS	1dfe3756a9	feat(search): refine compliance discovery interactions Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-10 10:42:19 +08:00
XiaoSeS	4efeed18c8	fix(deploy): preserve Aliyun source mode in stop command Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 18:20:06 +08:00
XiaoSeS	8de293b38f	fix(deploy): correct Aliyun runtime stop URL Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 16:45:12 +08:00
XiaoSeS	00f55c2db3	feat(search): surface compliance mappings in discovery Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 16:37:07 +08:00
XiaoSeS	460304eed8	Merge pull request #697 from iflytek/feat/compliance-metadata-snapshot Some checks failed Security / CodeQL (python) (push) Has been cancelled Details Security / Dependency Review (push) Has been cancelled Details Security / CodeQL (java-kotlin) (push) Has been cancelled Details Security / CodeQL (javascript-typescript) (push) Has been cancelled Details feat(metadata): add compliance snapshot mappings	2026-08-07 16:06:44 +08:00
XiaoSeS	da5c3cba3b	feat(search): index compliance snapshot mappings Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 15:46:06 +08:00
XiaoSeS	a7b25b072b	feat(metadata): expose compliance snapshots in version views Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 15:46:06 +08:00
XiaoSeS	725bbe165b	feat(metadata): add x-astron compliance snapshot Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 15:46:06 +08:00
XiaoSeS	6e133c006e	Merge pull request #694 from iflytek/docs/weekly-w32-official Some checks failed Security / Dependency Review (push) Waiting to run Details Security / CodeQL (java-kotlin) (push) Waiting to run Details Security / CodeQL (javascript-typescript) (push) Waiting to run Details Security / CodeQL (python) (push) Waiting to run Details Deploy Docs / build (push) Has been cancelled Details Deploy Docs / Deploy (push) Has been cancelled Details docs(weekly): mirror reviewed W32 report	2026-08-07 10:37:36 +08:00
XiaoSeS	77e0ff3749	docs(weekly): mirror reviewed W32 report Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-07 10:34:32 +08:00
XiaoSeS	da8a888469	Merge pull request #576 from Phil-OSophy-42/feat/configurable-base-path feat(web): support deployment under a configurable base path	2026-08-06 20:10:46 +08:00
XiaoSeS	c272811213	docs(deploy): document manual sub-path env setup Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 19:08:57 +08:00
XiaoSeS	9668f3cd5a	fix(deploy): avoid changing runtime helper for PR 576 Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 19:06:55 +08:00
XiaoSeS	5e3f4e72e7	fix(deploy): keep PR 576 backport focused Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 19:05:36 +08:00
XiaoSeS	d0b7a7c5d4	fix(deploy): backport sub-path runtime fixes to PR 576 Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 18:59:37 +08:00
XiaoSeS	f0164fe8ba	Merge pull request #693 from iflytek/docs/weekly-w32-star-clarity docs(weekly): publish 2026 W32 report	2026-08-06 18:06:45 +08:00
XiaoSeS	53cb3b4757	docs(weekly): publish 2026 W32 report Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-06 18:03:14 +08:00
philsun	34f244e7a4	feat(web): support configurable base-path deployment Signed-off-by: philsun <xinyi.sun@daocloud.io>	2026-08-05 12:50:26 +08:00
XiaoSeS	b97487b02c	Merge pull request #687 from iflytek/agent/her-hack-astron-custom-issue-template Some checks failed Security / Dependency Review (push) Has been cancelled Details Security / CodeQL (java-kotlin) (push) Has been cancelled Details Security / CodeQL (javascript-typescript) (push) Has been cancelled Details Security / CodeQL (python) (push) Has been cancelled Details docs: add customized HER Hack-Astron issue template	2026-08-05 10:32:14 +08:00
FenjuFu	8011f2558b	docs: add customized HER Hack-Astron issue template Signed-off-by: FenjuFu <fufenjupku@gmail.com>	2026-08-04 20:16:21 +08:00
XiaoSeS	fc457a0651	test(smoke): decouple admin checks from bootstrap credentials (#686 ) Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-04 19:20:34 +08:00
XiaoSeS	51ff9b99d2	Merge pull request #684 from iflytek/fix/search-rebuild-observability-597 fix(search): observe label search rebuild failures	2026-08-04 17:42:17 +08:00
XiaoSeS	27113ce60c	fix(api): map Spring MVC client errors to 4xx (#685 ) Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-04 17:16:09 +08:00
FenjuFu	7b3b4c9337	docs: add Related Projects section linking astron-agent and astron-rpa (#682 ) Some checks are pending Security / Dependency Review (push) Waiting to run Details Security / CodeQL (java-kotlin) (push) Waiting to run Details Security / CodeQL (javascript-typescript) (push) Waiting to run Details Security / CodeQL (python) (push) Waiting to run Details Add a compact Related Projects module to README and README_zh pointing to the sibling iFlytek Astron open-source projects (astron-agent, astron-rpa), so visitors can discover the wider ecosystem. Signed-off-by: FenjuFu <fufenjupku@gmail.com>	2026-08-04 14:33:14 +08:00
FenjuFu	dbc00d6993	docs: position SkillHub vs anthropics/skills and add integration note (#676 ) Add a section to README and README_zh clarifying that SkillHub is a registry and governance platform, complementary to open skill collections like anthropics/skills. Includes a comparison table, a publish-into-SkillHub snippet using the shared SKILL.md format, and a licensing caveat for the source-available document skills. Signed-off-by: FenjuFu <fufenjupku@gmail.com>	2026-08-04 14:32:32 +08:00
Michael	a063090a52	fix(web): stop React 19 portal removeChild/insertBefore crashes (#624 ) * fix(web): replace custom Dialog with Radix to stop portal races Hand-rolled createPortal siblings on document.body raced with Radix Select/DropdownMenu/Sonner under React 19 (insertBefore/removeChild). Use @radix-ui/react-dialog like select/dropdown adapters and bail out overview ResizeObserver setState when values are unchanged. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): stop portal removeChild races on search and shell Move Radix portals to #skillhub-portals, drop language-switcher body portal (match UserMenu), remove Select/Dropdown exit animations, and keep previous search results while typing to avoid skeleton unmount churn. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): systemic overlay teardown for React 19 removeChild Render Select/Dropdown in-tree (no Portal), translate=no on overlays, dismiss overlays on pathname change, defer navigate after close, host Toaster in #skillhub-portals, and add recoverable RouteError UI. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): harden overlay dismiss after code review Clip decorative layer only, dismiss Dialog via overlay pointer events, log RouteError once in useEffect, and defer skill-detail leave navigations. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): batch starred highlight and defer Sonner toasts Avoid N× per-card star fetches on /search and flushSync toast races during React 19 list re-renders (removeChild / insertBefore). Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> * fix(web): block Chrome Translate DOM races on skill overview Keep html/#root notranslate, sync lang with i18n, and harden overview expand so memoized markdown + quiet ResizeObserver avoid insertBefore crashes. Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com> --------- Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>	2026-08-04 13:59:37 +08:00
XiaoSeS	b6cd414588	fix(search): observe label search rebuild failures Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-04 11:17:38 +08:00
XiaoSeS	55e5c1e10e	feat(observability): add generic request correlation and tracing foundation (#664 ) * feat(observability): establish request correlation boundary Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * feat(observability): add selectable tracing modes Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * feat(observability): propagate async trace context Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * docs(observability): document tracing deployment modes Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): tighten tracing integration boundaries Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): harden operational log privacy Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * feat(observability): propagate message trace context Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): document message propagation semantics Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * test(auth): isolate security context between tests Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): skip otlp exporter without endpoint Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-08-04 10:26:42 +08:00
XiaoSeS	6fcb539769	Merge pull request #674 from iflytek/fix/clawhub-download-cjk-slug-location fix(compat): percent-encode ClawHub download redirect Location	2026-08-04 09:31:06 +08:00
XiaoSeS	5be758846e	Merge pull request #625 from michael-xiii/feat/web-label-search-navigation feat(web): link skill labels to search and wrap filter chips	2026-08-04 09:29:53 +08:00
XiaoSeS	358e819077	Merge pull request #619 from iflytek/fix/web-typecheck-ambient-types [#618] Fix web ambient type isolation	2026-08-04 09:28:22 +08:00
FenjuFu	34dc4fa29c	fix(compat): percent-encode ClawHub download redirect Location Downloading a skill whose slug is non-ASCII (e.g. a Chinese name) through the ClawHub CLI compatibility route failed: the 302 Location header was built by string-concatenating the raw slug, and Tomcat encodes header values as ISO-8859-1, so a character outside 0-255 makes it drop the Location header entirely and the download breaks. The skillhub CLI path was unaffected because it doesn't go through this redirect. Build the Location with UriComponentsBuilder.pathSegment(...).encode(), so each segment is percent-encoded while the '/' separators stay literal. "需求" becomes %E9%9C%80%E6%B1%82 and the header is ISO-8859-1-writable. Fixes #658 Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>	2026-08-02 02:18:36 +08:00
XiaoSeS	fac1110d15	Merge pull request #636 from iflytek/codex/builtin-skills-release Some checks failed Deploy Docs / build (push) Has been cancelled Details Security / Dependency Review (push) Has been cancelled Details Security / CodeQL (java-kotlin) (push) Has been cancelled Details Security / CodeQL (javascript-typescript) (push) Has been cancelled Details Security / CodeQL (python) (push) Has been cancelled Details Deploy Docs / Deploy (push) Has been cancelled Details feat(bootstrap): verify built-in skill artifacts	2026-07-31 21:33:26 +08:00
XiaoSeS	3c151d1065	Merge pull request #635 from iflytek/codex/builtin-skills-content feat(builtin-skills): add reviewed starter collection	2026-07-31 21:32:04 +08:00
XiaoSeS	31d037de02	test(bootstrap): cover builtin skill upgrade conflicts Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-07-31 19:08:32 +08:00
XiaoSeS	5f7c48b7a4	feat(bootstrap): publish starter skills in runtime manifest Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-07-31 18:27:25 +08:00
XiaoSeS	b20ad397ad	Merge codex/builtin-skills-content into codex/builtin-skills-release Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>	2026-07-31 18:27:25 +08:00
XiaoSeS	1305f21646	Merge pull request #667 from iflytek/fix/weekly-thursday-close fix(docs): align weekly reports to Thursday close	2026-07-31 17:18:10 +08:00

1 2 3 4 5 ...

1154 commits