What's Changed

• fix(imports): allow namespaced skill names and surface skipped skills... by @Riseonelimit in #66
• fix(api): drop content_md from GET /v1/skills list response (closes #65) by @Riseonelimit in #67
• Release/0.5.6 by @Riseonelimit in #68
• chore(package): update version to 0.5.6 by @Riseonelimit in #69
• chore(cli): sync version to 0.5.6 (fixes failed npm publish) by @latentloop07 in #70

New Contributors

• @Riseonelimit made their first contribution in #66

Full Changelog: cli-v0.5.5...cli-v0.5.6

Contributors

• @latentloop07
• @Riseonelimit

Visibility fix for bundled skills (closes #57).

Skills imported from a marketplace, plugin, or skill_bundle import source were indistinguishable from locally-authored skills in the grid/list views — the only origin surface was the right-rail SourceCard on the detail page, which required clicking into a skill to see. This release adds a single small BundlePill component used consistently in three places so bundled-vs-local is identifiable at a glance.

Card view showing bundled-skill pill

What's new

• 📦 owner/repo pill on every bundled skill, in card view, list view, and the detail page header
• Forked/edited variant: amber tint + ·edited suffix when a bundled skill has diverged from upstream
• Smart label fallback: origin.owner/repo → source_path → origin.host → literal Bundled
• Truncation: long owner/repo names ellipsize; full source path available via native tooltip

Compatibility

• No API changes — the pill reads fields the backend already returns (origin, source_path, import_source_id)
• No schema changes, no migrations
• No breaking changes
• CLI version synced to 0.5.5 with no CLI code changes (per release convention)

Install / upgrade

# Self-hosted via Docker
docker pull ghcr.io/luna-prompts/skillnote-web:0.5.5
docker pull ghcr.io/luna-prompts/skillnote-api:0.5.5
# CLI (no functional change vs 0.5.4)
npm install -g skillnote@0.5.5
# or
npx skillnote@0.5.5 start

Deferred (intentionally out of scope)

• Sources management page, bulk actions, filter facet for Source on the home page — held back until users actually have enough bundled skills to need them. Premature dashboarding tends to clutter.

Full changelog

See CHANGELOG.md#055 for the complete release notes.

PRs in this release:

• #58 — release(0.5.5): bundled-skill marker (closes #57)
• #59 — chore(cli): sync version to 0.5.5

[0.5.4] - 2026年05月15日

Hotfix release for a post-0.5.3 /analytics page crash. Single bug, plus an audit pass to verify no related null-safety issues lurking elsewhere.

Fixed

• /analytics page no longer crashes the Chrome renderer with TypeError: Cannot read properties of undefined (reading 'toFixed'). Root cause was a three-way contract mismatch in the Top Skills table: the backend (app/api/analytics.py) returns success_rate as float | None, but the frontend type (src/lib/api/analytics.ts) declared it as completion_rate: number (wrong name, non-null), and the page (src/app/(app)/analytics/page.tsx:1254-1265) read s.completion_rate (always undefined) and called .toFixed(0) inside a rating_count > 0 gate. As soon as any skill had rating_count: 1 with success_rate: null (e.g. one rating but no completed-outcome runs yet), the page entered the conditional and threw. Fixed by:
  1. Renaming the frontend type field to success_rate: number | null with a doc comment.
  2. Updating the three page references and changing the gate from rating_count > 0 to the actually-meaningful success_rate != null.
• MOST CALLED card in the analytics summary row no longer overflows its container when the most-called skill has a long slug (e.g. superpowers:brainstorming). String values now render at 15px monospace with break-words plus zero-width-space soft-break hints after : - / _ so the browser breaks at natural slug separators (yields superpowers: / brainstorming rather than superpowers:bra / instorming). Numeric values still render at the existing 22px tabular display.

Tests

• New regression test e2e/r7-workflow-bugs.spec.ts → "Top Skills row with rating_count > 0 and success_rate null renders an em-dash, not a crash". Mocks the exact production crash payload ({ slug, call_count: 1, avg_rating: 3.0, rating_count: 1, success_rate: null }), asserts the page renders the em-dash fallback, and listens on pageerror to catch any future toFixed regression. The previous Top Skills e2e test only exercised rows with rating_count: 0 (which short-circuits the buggy branch), which is why the suite missed this in 0.5.3.
• Existing analytics mock updated to use the correct API field name (success_rate) instead of the legacy completion_rate, so future tests stay aligned with the real backend shape.

Internal

• Audit of similar patterns. Swept all .toFixed / .toLocaleString call sites in src/. All other ratings call sites (skill-card.tsx, skill-list-item.tsx, skill-detail.tsx, SkillViewTab.tsx) were already properly null-guarded. SkillHistoryTab.tsx:33 declares versionRating?.avg_rating: number (non-null) but the backend's GROUP BY-with-AVG SQL guarantees that field is never null for the rows it returns; documented as a latent risk to tighten in a follow-up but not a current crash.

[0.5.3] - 2026年05月13日

UX polish and discoverability release. Reorganised the sidebar information architecture so each group label predicts its contents, completed R9's "drop teal from PWA chrome" by fixing the maskable icon that was still bleeding teal in dock and home-screen previews, and fully rewrote the README for problem-first resonance with fresh post-R9 screenshots.

No new APIs, no new commands, no breaking changes.

Changed

• Sidebar IA reorganization. Analytics and Marketplace both moved into the WORKSPACE group; they're views of skills you own (Analytics = how your skills perform; Marketplace = how to add more), not part of the agent wire-up flow. The Connect group label was renamed to INTEGRATIONS so it stops repeating its only item (was "CONNECT > Connect"; now "INTEGRATIONS > Connect"). Net layout:

  WORKSPACE INTEGRATIONS
   Skills Connect
   Collections
   Analytics
   Marketplace
  

• README full rewrite for discoverability + problem-first resonance. 659 → ~495 lines. Lead the body with the 8,000-character pain Claude Code users actually feel (truncated descriptions, GitHub issue numbers, Anthropic doc link) plus a Without/With comparison table. Inline Claude Code + OpenClaw install commands; alternative install paths stay collapsed. Feature section is 6 bullets with inline screenshots. Footer adds a contrib.rocks contributor wall.

• Marketplace section in README now lists 5 popular community sources to import skills from: anthropics/skills (Anthropic's official Agent Skills repo), ComposioHQ/awesome-claude-skills (800+ skills, the largest curated set), alirezarezvani/claude-skills (600+ multi-agent skills), garrytan/gstack (50+ YC-flavored tools), obra/superpowers (Jesse Vincent's agentic framework). Helps SkillNote's discoverability through the GitHub graph and gives new installs immediate starter content.

• 4 LLM-search-friendly FAQ entries added at the top of the README FAQ ("What is SkillNote?", "How is SkillNote different from MCP?", "How do I share Claude Code skills across my team?", "Is SkillNote free?"). These match the natural phrasing of how people query ChatGPT, Claude, or Google about a project. Existing troubleshooting Q&As stay below.

• README hero now displays a tighter (×ばつ580) crop of the Connect → Browse view showing Claude Code + OpenClaw cards with their canonical marks. Replaces the older full-page screenshot.

• README badges added npm total downloads next to the version badge. Star history chart removed (looked weak at the project's current 45 stars; will revisit once there's a growth curve worth showing).

Fixed

• PWA maskable icon teal bleed. R9 set theme_color: '#000000' in the manifest and themeColor in the root layout, but missed public/icon-512-maskable.png, which still had teal (#0d9488) baked into the outer 16% as the bleed zone. Chrome / macOS rendered the dock icon through the maskable adaptive-icon path, so the safe-area black square sat inside a teal frame, exactly what R9 was trying to kill. Regenerated as all-black ×ばつ512 background with the LP logo resized to 80% to fit the maskable safe area. Now matches icon-512.png, icon-192.png, and the manifest theme_color (one continuous black mark).

  Note for existing PWA users: browsers cache installed-PWA icons aggressively. To pick up the new icon, uninstall the existing SkillNote PWA from your dock or home screen and reinstall it via Chrome's address bar (Install SkillNote) or ⋮ → Cast/Save/Share → Install SkillNote.

Internal

• Em-dashes purged from README (20 instances → 0). Replaced with periods, commas, and colons as the surrounding clause required. Em-dashes are a strong AI-writing tell, and removing them noticeably lifted the natural-human reading.
• README screenshots re-shot at v0.5.2 UI for Collections, Marketplace workspace, and Analytics, so the README matches the current sidebar layout and Connect-page redesign. Analytics screenshot kept the data-rich (22 calls, populated leaderboard) variant; cropped to the top half so the visually-empty Activity Timeline isn't pulling weight in the scroll.

[0.5.2] - 2026年05月13日

Production-readiness sweep ("Round 9" of the 10-round hardening exercise). Drove the first-bite path (GitHub → npx skillnote start → web open) and the Connect page end-to-end under stressed conditions — bridge daemon missing, ports occupied, corrupted localStorage, killed api, hung locks, podman vs docker, fresh-browser vs returning-user. Catalogued 44 issues; landed 29 fixes. Every silent failure now surfaces an actionable message; every modal has the right ARIA roles; the install-stage UX no longer wedges.

Added

• Production /health endpoint — now returns {status, db, migration} instead of {status: "ok"}. Kubernetes / Prometheus / image-vs-DB-drift detection all work without scraping logs. status: "ok" remains the load-bearing field for backwards compat (install.sh wait loop, README curl).
• Pre-flight check + --force flag on install.sh / skillnote start — install.sh --check runs only the runtime + binary detection and exits 0/1 (CI-friendly). skillnote start --force overrides a stale-but-alive lockfile when a previous start hung.
• <ApiUrlBootstrap /> + synchronous <head> script for ?api=<URL> overrides — npx skillnote start --api-port <X> now auto-opens the web UI with ?api=..., which a synchronous pre-React script reads + writes to localStorage['skillnote:api-url'] before the first fetch fires. Same-host-family validation prevents phishing-style cross-origin overrides.
• Bridge timeout + actionable error in the Connect modal — if no skillnote bridge daemon claims a dispatched job within 25 seconds, the modal flips from "Waiting for bridge..." to a structured error with the exact remediation copy (start the bridge in another terminal, or use the manual install command).
• Skill-list "ghost cleanup" — syncSkillsFromApi now stamps every API-returned skill with _syncedAt and drops previously-synced skills that disappear from the API (e.g., after docker compose down -v). Genuinely-local skills (no _syncedAt) survive intact.
• /skills/<slug>/history → /versions redirect — old bookmarks keep working; rename-aware slug resolution.
• Rich empty state on Connected tab — first-time users land on a styled prompt explaining what connecting an agent buys them, plus a "Browse agents" primary CTA and a "How it works" docs link.
• Two CI smoke scripts — scripts/check-readme-links.sh (link-rot detector, 26+ URLs) and scripts/check-install-preflight.sh (asserts install.sh --check returns 0).
• R9 regression test suite — e2e/r9-first-bite-fixes.spec.ts (11 specs pinning F28 + F30 + F32 + F38 + F40 + F49 + F50 + F52/F53 + F61).

Changed

• Connect page revamp — tabs reordered to Connected | Browse (was Browse | Connected). "Connected" is now the default landing tab on every visit, even for users with zero agents wired. Pairs with the new empty-state UX.
• Canonical Claude Code + OpenClaw marks — Claude Code card now shows the actual @ClaudeDevs X/Twitter avatar (pixel-robot mascot, sourced verbatim from pbs.twimg.com); OpenClaw card shows the canonical claw mark from the homarr-labs/dashboard-icons project. Replaces the prior hand-drawn placeholders.
• PWA titlebar + dock-icon frame are now neutral black (#000000) instead of teal. The standalone-window chrome no longer reads as a "teal frame around the black icon" — the icon and the titlebar form one continuous mark. In-app accent stays teal (sidebar highlights + focus rings — the SkillNote brand color in functional positions).
• docker-compose.yml Postgres password is now an env var — ${SKILLNOTE_DB_PASSWORD:-skillnote}. Default preserved for backwards compatibility with existing pgdata volumes; override path documented in the header comment.
• README prerequisite line lists every supported runtime — Docker Desktop, OrbStack, Rancher Desktop, Colima, plain Docker Engine on Linux, plus an explicit Podman path for the install.sh + raw-docker compose flows. Replaces the prior "Docker Desktop only" framing.
• Connection banner is role="status" aria-live="polite" — screen readers now announce when the backend goes offline without interrupting the user mid-task.
• Delete-skill, Discard-changes, and Disconnect-agent modals are now role="alertdialog" with proper aria-modal + aria-labelledby + aria-describedby. The Disconnect modal also gained an explicit Cancel button paired with the destructive action.
• API error envelope is now universal — added a Starlette-level handler so unrouted paths (/v1/totally-unknown) return {error: {code: "NOT_FOUND", message}} instead of FastAPI's default {detail: "Not Found"}. The contract documented in CLAUDE.md now holds without exceptions.

Fixed

• getApiBaseUrl() validates the stored override — corrupted localStorage['skillnote:api-url'] values (e.g. "not-a-url") no longer resolve as relative paths against the page origin. Malformed values are silently wiped; the build-time default is restored.
• readStorage() self-heals corrupted JSON — non-array shapes and parse failures wipe the key so the next sync writes clean state. Previously the user stayed in a broken-cache state until they manually cleared localStorage.
• TipTap editor no longer warns about duplicate link extensions — StarterKit.configure({ link: false }) so our custom Link.configure({ openOnClick: false }) wins.
• Four pages no longer hit React hydration mismatch on first paint — /skills/<slug>/history, /skills/<slug>/versions, /collections, and /collections/<slug> previously used useState(() => getSkills()) (a lazy initializer that reads localStorage). Server returned []; client hydrated with the cached array. Switched all four to useState(empty) + populate-from-localStorage in useEffect.
• Stale-but-alive lockfile shows actionable remediation — skillnote start now prints lock age + PID + ps -p + kill + --force instructions when the holder has been alive for ≥ 2 hours.
• /v1/analytics/ratings/<slug> returns 200 with empty data instead of 404 for skills that have no ratings yet. Stopped polluting the browser console on every skill-detail page on a fresh install.
• FirstRunGate checks API skills, not just localStorage — a fresh-browser user with empty localStorage but seeded backend now lands on / (with the seeded skills visible) instead of redirecting to /integrations.
• PWA install prompt is gated on visit-count >= 2 — no more "install our app?" on the very first visit. Strict-mode-double-mount-safe via a useRef guard.
• PWA install button shows a fallback toast on browsers without beforeinstallprompt — previously a silent no-op. Now: "Use your browser's address-bar Install button, or open the menu and choose 'Install SkillNote'."
• CLI UserFacingError now prints with full remediation — the top-level parseAsync().catch handler was using bare console.error('Unexpected error:', err.message), dropping the body + remediation list. Now routes through prettyError so structured errors render correctly (caught when testing the stale-lock UX).
• README boot-banner version no longer drifts — was hardcoded to v0.5.0 while package.json was 0.5.1.
• README docker-compose curl URL is now pinned to the release tag (cli-v0.5.2/deploy/docker-compose.yml) instead of master. Prevents a future master commit from breaking old README readers.
• SKILLS.md → SKILL.md in the SkillViewTab file-header bar — matched the breadcrumb (singular, the Anthropic convention).
• source ~/.zshrc README copy now mentions bash fallback — or ~/.bashrc if you use bash so non-zsh users don't follow a broken instruction.

Security & Deployment

• New "Security & Deployment" section in README.md — explicitly documents that SkillNote has no API auth layer, lists local-only / LAN-only / internet-exposed deployment shapes, and points at reverse-proxy + auth as the recommended path for any deployment beyond a single dev machine.
• docker-compose.yml default Postgres password documented as dev-only, with override path + a one-line note about needing to either rotate via psql or wipe the pgdata volume before a new value takes effect (Postgres only initialises the password from env vars on the very first start).

Internal

• Build hygiene retro-deploy — all earlier-round fixes are now baked into the api + web images, not just the running containers. Container recreation no longer loses transient docker compose cp fixes.
• Podman build-cache gotcha documented — Podman's COPY layer cache occasionally fails to invalidate when new alembic migrations are added (image ships with 0001–0016 only while DB is on 0018, causing a crash loop). Workaround: docker compose build --no-cache api. Logged for a proper investigation.

Notes

• All 33 regression specs pass (r5-r9 + journey-first-time-user + integrations + connect-modal-a11y).
• 140/140 CLI unit tests pass.
• npx tsc --noEmit clean.
• 30/30 README links healthy via the new link-checker.
• Full audit trail in docs/HARDENING_LOG.md (R9 section).

Three small fixes from the v0.5.0 audit followup list. No new features, no breaking changes — just close out the loose ends.

Fixed

• skillnote open no longer crashes on headless systems (#37) — over SSH, in WSL2 without an X server, in a CI runner, etc., open() used to throw spawn xdg-open ENOENT. Now catches the rejection and prints Could not open a browser — visit http://localhost:3000 manually.
• skillnote start recognizes disk-full errors (#38) — when Docker can't pull because the host disk is full, the user now sees a clean Disk full message with docker system prune -a remediation instead of a raw ExecaError stack trace.

Docs

• MIGRATION-v0.5.md rewritten (#36) — the table that described connect / disconnect / reconnect as "scheduled for a later release" was already wrong at the time of v0.5.0 (those commands shipped IN 0.5.0). Replaced with an accurate "what's new in v0.5" table.

Upgrade

# npm
npx skillnote@0.5.1 start
# or pure Docker
curl -fsSL https://raw.githubusercontent.com/luna-prompts/skillnote/master/deploy/docker-compose.yml -o docker-compose.yml
docker compose up -d

Artifacts

• npm: skillnote@0.5.1 (latest)
• Docker: ghcr.io/luna-prompts/skillnote-{api,web}:0.5.1 (multi-arch)

Full changelog · Compare v0.5.0...v0.5.1

First stable release of the rewritten SkillNote CLI. One command, no clone, no setup.

npx skillnote start

Opens http://localhost:3000. Requires Docker Desktop and Node.js 20+.

Highlights

• npx skillnote start — boots web + API + Postgres on your machine in under 90 seconds, opens the browser, no git clone, no ./install.sh.
• Lifecycle CLI — start / stop / restart / status / logs / open / doctor / reset. The CLI owns the lifecycle of the Docker stack. Real-time log tailing, per-service health table, --json for scripts.
• Multi-arch Docker images — ghcr.io/luna-prompts/skillnote-{api,web}:0.5.0, public, amd64 + arm64, anonymously pullable. Mac M-series, Intel, and Linux servers all just work.
• Agent connect commands — npx skillnote connect claude-code / connect openclaw runs the canonical /setup/agent script against your local registry. The agent is wired in 5 seconds.
• Web ↔ CLI bridge — /v1/cli/jobs API + npx skillnote bridge. [Run via CLI] buttons in the integrations page dispatch jobs to your terminal and stream logs back.
• PWA install — the web UI is installable as a Chrome / Safari PWA with a dock icon and chromeless window. Same data, no browser tab.
• Provenance — npm publish ships with Sigstore SLSA provenance attestations. Verifiable build origin.

Try it

# 1. Install Docker Desktop (if you don't have it)
# 2. Run:
npx skillnote start
# 3. Open the URL it prints

Or with pure Docker (no Node required):

curl -fsSL https://raw.githubusercontent.com/luna-prompts/skillnote/master/deploy/docker-compose.yml -o docker-compose.yml
docker compose up -d

Migrating from v0.4

Existing v0.4 users: your Docker volumes (skillnote_pgdata, skillnote_bundles) are preserved. The v0.4 file-push commands (login, list, add, update, check, remove, doctor) still work for backward compatibility. See MIGRATION-v0.5.md for the full upgrade path.

Artifacts

• npm: skillnote@0.5.0 (latest)
• Docker API: ghcr.io/luna-prompts/skillnote-api:0.5.0
• Docker Web: ghcr.io/luna-prompts/skillnote-web:0.5.0

Full changelog

See CHANGELOG.md.

Or compare directly: v0.5.0-alpha.0...v0.5.0

What's Changed

• feat: skill-push, Claude Code plugin, and extra_frontmatter by @novavex1 in #17
• fix: require user confirmation before drafting a skill by @novavex1 in #18
• Release 0.3.1 — collections as first-class DB entity by @tylernash01 in #20
• feat: collection picker — Create / Skip / (Recommended) + validation hardening + UX polish by @latentloop07 in #21
• chore(release): 0.3.2 by @latentloop07 in #22
• feat(marketplace): rename Browse to Marketplace + upsert on re-install + origin on skills by @latentloop07 in #23
• docs(readme): consolidate Marketplace section to a single screenshot by @latentloop07 in #24
• feat(marketplace): swap examples to gstack + superpowers, fix preview wrap + comment strip by @latentloop07 in #25
• docs(readme): trim Marketplace section by @latentloop07 in #26
• fix: harden plugin cleanup + bundle extraction against symlinks by @latentloop07 in #28
• feat: SkillNote ×ばつ OpenClaw foundation (v0.4.0) by @latentloop07 in #29
• hotfix: untrack 13 stale .pyc files in backend/ by @latentloop07 in #30
• feat(openclaw): v0.4.1 scan-mitigation refactor + SECURITY.md by @latentloop07 in #31
• feat(cli): v0.5.0 — npx skillnote start lifecycle CLI by @latentloop07 in #32

New Contributors

• @tylernash01 made their first contribution in #20
• @latentloop07 made their first contribution in #21

Full Changelog: https://github.com/luna-prompts/skillnote/commits/cli-v0.5.0-alpha.0

Contributors

• @latentloop07
• @tylernash01
• @novavex1