SkillHub v0.2.21
SkillHub adds two-stage Suite Bundle publishing, expands CLI authentication and agent targeting, and lays a LEGACY-gated foundation for unified enterprise identity.
🌟 Highlights
- Publish and update Suite Bundles from one archive with side-effect-free preview, explicit confirmation, recovery, labels, and member diff visibility.
- Sign in to the SkillHub CLI through OAuth Device Flow and install Skills directly for Pi agents.
- Route public OAuth through a LEGACY/SHADOW/ACTIVE unified identity core foundation while preserving legacy behavior by default.
🚨 Breaking Changes
⚠️ No intentional breaking API or installation change is included. Operators should still back up PostgreSQL before upgrading because Flyway V54-V65 are applied automatically. OAuth's default post-login fallback now lands on / instead of /dashboard; deployments depending on the previous implicit fallback should set an explicit return target. Complete Suite Bundle confirmation requires SKILLHUB_SUITE_BUNDLE_CONFIRMATION_ENABLED=true and SKILLHUB_SUITE_REVIEW_WRITES_ENABLED=true.
✨ Features
- Add two-stage Suite Bundle publishing from ZIP/folder uploads, including create/update manifests, side-effect-free preview, explicit confirmation, member publication/review coordination, operation recovery, Suite labels, reverse discovery, and Web import flows by @XiaoSeS in #850.
- Add OAuth Device Flow login to the SkillHub CLI with browser launch, headless
--no-open, token validation before persistence, and non-secret output by @Danny5487401 in #857. - Add Pi as a first-class CLI agent target for project and user skill directories by @dongmucat in #869.
- Open non-session Skill lifecycle routes to appropriately scoped API tokens, including archive/unarchive/delete-version/yank coverage by @thiagonogueira in #865.
- Let Skill owners and Namespace admins yank published versions through Web/API lifecycle endpoints with
skill:yanktoken scope by @thiagonogueira in #866. - Introduce the unified identity core R1-A with organization/external-identity foundations, LEGACY/SHADOW/ACTIVE rollout modes, public OAuth routing through the core, and safer login return handling by @XiaoSeS in #874.
🐛 Bug Fixes
- Preserve
runtime.shlifecycle command options forup,down,ps,logs, andpull, including Aliyun source, pinned refs, version, custom home, public URL, mirror registry, image overrides, and scanner disabling by @XiaoSeS in #870. - Align the language switcher fallback with i18n resolved language and English defaults by @XiaoSeS in #872.
- Improve Suite Markdown code block contrast and add tooltips for truncated Suite member identifiers by @XiaoSeS in #873.
- Serialize concurrent version-yank paths on the same PostgreSQL row lock to prevent duplicate audit/events and incorrect latest-version side effects by @XiaoSeS in #875.
⚡ Performance
- No dedicated performance-only changes.
📚 Documentation
- Correct publishing docs to state that Skill metadata comes from
SKILL.mdYAML frontmatter, notpackage.json, and add complete packaging examples by @FenjuFu in #852. - Publish the 2026 W38 open-source weekly report by @XiaoSeS in #882.
- Document Suite Bundle import in Chinese and English as part of #850.
- Document CLI OAuth Device Flow and Pi agent targeting as part of #857 and #869.
🔧 Chore
- Add release/script regression coverage for runtime lifecycle output, release config validation wiring, workflow security checks, and generated weekly site updates.
📖 Documentation
- Docs site: https://iflytek.github.io/skillhub/
👥 New Contributors
{{Keep as-is}}
Full Changelog: v0.2.20...v0.2.21