skillhub

mirror of https://github.com/iflytek/skillhub.git synced 2026-09-07 08:26:00 +00:00

History

dongmucat 943294b558 fix(publish): address Codex review findings for dry-run Fix three blockers and one contract drift issue surfaced in code review: 1. API token policy: add skill:publish scope policy and authentication policy for /api/cli/v1/skills/*/publish/validate. Without these the AntPathMatcher pattern /publish would not cover /publish/validate, so Bearer-token requests would be rejected by the scope filter. 2. Warnings semantics: dry-run now treats warnings as making valid=false. The CLI publish flow uses confirmWarnings=false, so the real publish rejects any warnings; dry-run must mirror that to avoid false positives. 3. Visibility parameter: validate endpoint now accepts the same visibility multipart field as publish. The CLI forwards --visibility so invalid values are caught at dry-run time rather than at publish. 4. Schema drift: resolvedSlug and resolvedVersion are nullable in practice (returned as null when validation fails before resolution). Updated schema.d.ts to reflect string \| null instead of optional string. Tests added: - RouteSecurityPolicyRegistryTest: validate endpoint scope check - CliDryRunValidateTest: custom + invalid visibility cases - publish-dry-run.test.ts: --visibility forwarded to server	2026-05-18 14:50:14 +08:00
..
src	fix(publish): address Codex review findings for dry-run	2026-05-18 14:50:14 +08:00
pom.xml	feat(skill): add version compare page with unified diff	2026-05-07 09:45:26 +08:00

dongmucat 943294b558 fix(publish): address Codex review findings for dry-run

Fix three blockers and one contract drift issue surfaced in code review:

1. API token policy: add skill:publish scope policy and authentication
   policy for /api/cli/v1/skills/*/publish/validate. Without these the
   AntPathMatcher pattern /publish would not cover /publish/validate,
   so Bearer-token requests would be rejected by the scope filter.

2. Warnings semantics: dry-run now treats warnings as making valid=false.
   The CLI publish flow uses confirmWarnings=false, so the real publish
   rejects any warnings; dry-run must mirror that to avoid false positives.

3. Visibility parameter: validate endpoint now accepts the same
   visibility multipart field as publish. The CLI forwards --visibility
   so invalid values are caught at dry-run time rather than at publish.

4. Schema drift: resolvedSlug and resolvedVersion are nullable in
   practice (returned as null when validation fails before resolution).
   Updated schema.d.ts to reflect string | null instead of optional string.

Tests added:
- RouteSecurityPolicyRegistryTest: validate endpoint scope check
- CliDryRunValidateTest: custom + invalid visibility cases
- publish-dry-run.test.ts: --visibility forwarded to server

2026-05-18 14:50:14 +08:00

src

fix(publish): address Codex review findings for dry-run

2026-05-18 14:50:14 +08:00

pom.xml

feat(skill): add version compare page with unified diff

2026-05-07 09:45:26 +08:00