- Replace redundant listFull() call with acceptedSkills to avoid extra DB round-trip
- Check slug conflicts against full acceptedSkills list instead of just same-source skills
- Call upsertAcceptedSkill after persisting to keep in-memory list current
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When "Scan project workspaces for skills" runs, now also iterates all
existing GitHub/sks_sh skills and re-fetches their source repos to
detect newly added skills. New skills are upserted automatically.
Skips sources that fail, logged as warnings.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When updateSkillAuth(null) is called, the underlying secret row was
left orphaned. Now deletes the secret via secretsSvc.remove() before
clearing sourceAuthSecretId from metadata.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Scope metadata update WHERE clause to companyId for defence-in-depth
- Add CompanySkillUpdateAuth inferred type export to match other schemas
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove duplicate `delete` method (identical to `remove`)
- Route delete-by-source through confirmation dialog with source
locator displayed and "Remove all from source" button
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Pre-check all skills for agent usage before deleting any in deleteBySource
to prevent partial/failed deletions
- Delete (rotate to empty) the skill-pat:<skillId> secret when a skill is
deleted to prevent orphaned PAT secrets
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add optional authToken to skill import for GitHub private repos
- Store PAT as encrypted company secret (skill-pat:{skillId})
- Thread auth token through ghFetch, fetchText, fetchJson, and all GitHub resolution functions
- Add PATCH /companies/:companyId/skills/:skillId/auth for managing PAT per skill
- Add DELETE /companies/:companyId/skills/by-source for bulk deleting skills from a repo
- Preserve sourceAuthSecretId across skill re-imports/updates
- UI: Add PAT input field in import form for GitHub URLs
- UI: Add SkillAuthSection with ShieldCheck icon for viewing/updating/removing PAT
- UI: Add trash icon next to source label for delete-by-source
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When updateSkillAuth(null) is called, the underlying secret row was
left orphaned. Now deletes the secret via secretsSvc.remove() before
clearing sourceAuthSecretId from metadata.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Install custom tooling in the production stage via direct binaries and apt
so it doesn't break the base stage build.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The fork added build-time tooling (kubectl, kubeseal, uv, nano, vim) that
is not needed inside the container build and was causing repeated build
failures due to URL/checksum drift. These tools belong in the runtime
environment, not the image build.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- kubectl: pin to v1.32.0 instead of dynamic stable.txt (which was
returning a version with no matching binary, causing 404)
- kubeseal: fix URL to use versioned tarball (v0.36.6) instead of
/latest which had no unversioned asset, causing 404
- also removed wget (no longer needed after removing keyring/apt)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- kubectl: pin to v1.32.0 instead of dynamic stable.txt (which was
returning a version with no matching binary, causing 404)
- kubeseal: fix URL to use versioned tarball (v0.36.6) instead of
/latest which had no unversioned asset, causing 404
- also removed wget (no longer needed after removing keyring/apt)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The GitHub CLI keyring approach requires a hardcoded SHA256 checksum
that drifts as the keyring file is updated upstream, causing build
failures. Replace with direct binary tarball download which is simpler
and has no checksum drift issue.
Also removed wget (only needed for keyring download).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The GitHub CLI keyring approach requires a hardcoded SHA256 checksum
that drifts as the keyring file is updated upstream, causing build
failures. Replace with direct binary tarball download which is simpler
and has no checksum drift issue.
Also removed wget (only needed for keyring download).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The hardcoded checksum was out of date, causing sha256sum verification
to fail and abort the build.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
wget is called immediately after apt-get install but was not included
in the package list, causing the build to fail.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Scope metadata update WHERE clause to companyId for defence-in-depth
- Add CompanySkillUpdateAuth inferred type export to match other schemas
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove duplicate `delete` method (identical to `remove`)
- Route delete-by-source through confirmation dialog with source
locator displayed and "Remove all from source" button
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Pre-check all skills for agent usage before deleting any in deleteBySource
to prevent partial/failed deletions
- Delete (rotate to empty) the skill-pat:<skillId> secret when a skill is
deleted to prevent orphaned PAT secrets
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add optional authToken to skill import for GitHub private repos
- Store PAT as encrypted company secret (skill-pat:{skillId})
- Thread auth token through ghFetch, fetchText, fetchJson, and all GitHub resolution functions
- Add PATCH /companies/:companyId/skills/:skillId/auth for managing PAT per skill
- Add DELETE /companies/:companyId/skills/by-source for bulk deleting skills from a repo
- Preserve sourceAuthSecretId across skill re-imports/updates
- UI: Add PAT input field in import form for GitHub URLs
- UI: Add SkillAuthSection with ShieldCheck icon for viewing/updating/removing PAT
- UI: Add trash icon next to source label for delete-by-source
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update runner name and GHCR image path in build workflow to reflect
the repo transfer from cpfarhood/paperclip to farhoodliquor/paperclip.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Required by the custom minimax provider in opencode.json which uses
@ai-sdk/anthropic to hit minimax's Anthropic-compatible API endpoint.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Chris Farhood
Flea Flicker