v0.10.0 Release Notes

Added

  • ZCode tool adapter: Added ZCode as the 48th built-in tool, with global and project-level Skill sync through ~/.zcode/skills and .zcode/skills, installation detection through ~/.zcode, and the Z.ai product icon across tool management and sync flows (fixes #144, PR #146).
  • Multi-device Skill library sync: Delivered the multi-device synchronization requested in #56. Skill content, descriptions, and tags can sync through a GitHub, GitLab, or Gitee repository, with browser authorization when configured, Token/SSH fallback, repository selection, read-only checks, manual sync, optional startup sync, and interval or daily schedules (PR #127).
  • Standalone recycle bin: Deleted Skills remain recoverable on the current device for 30 days. Restore brings back files and saved local configuration, while startup and daily cleanup remove expired entries (PR #140).
  • Empty recycle bin action: Added a one-click action for permanently removing every recycle bin item, protected by a GitHub-style typed confirmation and localized failure recovery.
  • Korean interface language: Added Korean translations, a three-language selector, and persistent language preferences. Korean users receive English release notes in the updater (PR #135).

Changed

  • Safer, clearer device sync: Three-way reconciliation automatically combines independent edits and keeps real conflicts isolated per Skill. Device-local source bindings stay private, same-name downloads remain separate, failures and per-Skill changes are inspectable, device names are shared, and history is limited to 100 meaningful runs (PR #134, PR #137, PR #139, PR #140).
  • Safer Skill lifecycle operations: Storage migration, automatic replacement, deletion, custom-tool removal, and cache cleanup now protect original sources, overlapping paths, independently edited copies, and rollback data. This extends the fix for #123 (PR #125, PR #128).
  • Streamlined management workspace: My Skills uses compact scope filters and accurate counts, bulk actions apply only to visible selections, Skill warnings open on demand, and Management Center now places device sync first and recycle bin last (PR #133, PR #136, PR #140).
  • Local desktop OAuth configuration: npm run tauri:dev and local npm run tauri:build* commands now require and inject both SKILLS_HUB_GITHUB_CLIENT_ID and SKILLS_HUB_GITLAB_CLIENT_ID, using each process-environment value first and otherwise reading only the two allowlisted fields from the repository-root .env or an explicit configuration file. This makes configured GitLab browser authorization available in development and packaged builds. Launch stops before compilation when either public Client ID is missing or malformed; Client Secrets, user tokens, and unrelated fields are never imported.

Fixed

  • Sync credential recovery and development isolation: Development builds now use a separate application data directory as well as a separate credential namespace, preventing them from replacing packaged-app sync configuration. Missing credentials are distinguished from inaccessible secure storage, and sync failures offer a user-triggered credential setup entry without disconnecting. Background failures never automatically open authorization, and settings display does not read tokens.
  • Gitee manual Token setup: Entering a personal access token now exposes repository loading and passes that one-time value to the provider API, allowing Skills Hub to identify repository visibility before the first sync even when Gitee browser authorization is unavailable. Repository loading uses Gitee's supported visibility=all filter, accepts its real response shape where the HTTPS Git URL is returned in html_url while clone_url is null, automatically matches typed repository URLs with or without the .git suffix, and supports the first sync to an empty repository before its configured branch exists.
  • Unified network proxy routing: Device-sync Git clone, fetch, and push operations; GitHub, GitLab, and Gitee provider APIs; OAuth authorization and token refresh; system Git; and the libgit2 fallback now all use the proxy configured in the app. Disabling the app proxy also prevents inherited process or global Git proxy settings from silently changing network routing, and an automated boundary check blocks future direct network clients outside the shared transport module.
  • Windows Rust build compatibility: Fixed MSVC-only type and lint failures that prevented cargo clippy --all-targets and Rust test targets from compiling on Windows. The separate pre-existing STATUS_ENTRYPOINT_NOT_FOUND test-runtime failure remains outside this fix (fixes #142, PR #143).
  • Consistent source and tool issue status: Source-update failures now survive unrelated device syncs, current status refreshes across pages, and tool-copy failures no longer fail central-library synchronization. Skill details remain usable when the original source is missing (PR #136, PR #138).
  • Accurate filtered installation: Add actions remain disabled until a source is provided, and multi-Skill Git or local imports install only checked candidates visible in the current search results (PR #124, PR #132).
  • Nested Git Skill discovery: Repository root and standard skills/ URLs now discover skills/<category>/<skill>/SKILL.md layouts within bounded, safe scan rules (fixes #129, PR #131).
  • Kimi Code CLI paths and identity: Corrected global, project, and detection paths to use .kimi-code, added KIMI_CODE_HOME support, and adopted the official product icon without removing legacy-path content (fixes #122, PR #126).

Security

  • Protected credentials and portable sync boundary: HTTPS tokens stay in the operating system credential store and SSH uses the system agent. Public reads avoid credentials, public uploads require confirmation, private-key content is rejected, and tool targets, project paths, settings, caches, and credentials remain device-local (PR #127, PR #134).