Xskill

Latest version: v0.6.0

Safety actively analyzes 945810 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

0.5.2

主要改动 | Highlights

- **feat(team): `connect` 默认直连、绕开公司代理 | client bypasses corporate proxy by default**
瘦客户端 httpx 由 `trust_env=True` 改为默认 `trust_env=False`,不再被 Windows 系统/注册表代理(如华为 SWG)劫持导致 502/504。新增 `--use-proxy` 逃生开关供"唯一出网靠代理"的场景。register 首连与后台同步两处都覆盖。
The thin client no longer routes through the system/registry proxy (which caused 502/504 via corporate SWG). Added a `--use-proxy` escape hatch.

- **feat(cli): `registry list` 支持 team 客户端视图 + 表头 | client-aware `registry list` + header**
客户端模式下从 `detect_known_ecosystems` + 上传游标现算:显示每个生态的真实源目录、已采集数、已上传数,不再永远空。
On a team client, `registry list` now shows detected ecosystems with real source dirs and collected/uploaded counts.

- **feat(pipeline): 过滤无效 trajectory 入流水线 | filter invalid trajectories before atom flow** (41)

- **fix: 修正失效的 DeepSeek embedding 默认值 | replace invalid DeepSeek embedding defaults with working providers** (42)

- **chore(deps): 移除未使用的 scikit-learn | drop unused scikit-learn**
连带去掉 scipy 等约 190MB 传递依赖;numpy 保留(embedding 归一化在用)。
Removes scipy and friends (~190MB transitive); numpy stays.

- **docs(readme): 全面视觉重设计为暖色海滩主题 | full visual redesign with warm beach theme**

**Install:** `pip install -U xskill==0.5.2` · **PyPI:** https://pypi.org/project/xskill/0.5.2/

0.5.1

What's Changed
* docs: add architecture SVG diagram to README by lintaojlu in https://github.com/SkillNerds/xskill/pull/28
* docs: sync architecture diagram to README.zh-CN by lintaojlu in https://github.com/SkillNerds/xskill/pull/29
* fix(openclaw): type-check non-string text fields to prevent .strip() AttributeError by kzclaw in https://github.com/SkillNerds/xskill/pull/30
* feat(ecosystems): 新增 ngagent 适配器 | add ngagent (opencode enterprise fork) ecosystem support by 370025263 in https://github.com/SkillNerds/xskill/pull/33
* feat(rate-limit): TokenBucket 双桶限流 + provider 兼容性 | TokenBucket dual-bucket rate limiter with provider compat by 370025263 in https://github.com/SkillNerds/xskill/pull/36
* feat(team): 重连保持 client 身份不漂移 | preserve client identity across reconnect by 370025263 in https://github.com/SkillNerds/xskill/pull/37
* feat(cluster): 禁 silent drop + partial-fail 重试 + per-atom 日志 | no silent drop, partial-fail retry, per-atom log by 370025263 in https://github.com/SkillNerds/xskill/pull/38
* feat(install): 通用 copy+reverse_sync fallback + Windows junction 修复 | generic copy+reverse_sync chain + Windows junction fixes by 370025263 in https://github.com/SkillNerds/xskill/pull/39
* feat(cli): 加 -v / --version 标志 | add -v / --version flag with single-source __version__ by 370025263 in https://github.com/SkillNerds/xskill/pull/40

New Contributors
* lintaojlu made their first contribution in https://github.com/SkillNerds/xskill/pull/28
* kzclaw made their first contribution in https://github.com/SkillNerds/xskill/pull/30

**Full Changelog**: https://github.com/SkillNerds/xskill/compare/v0.5.0...v0.5.1

0.5.1a2

新功能 | New Features

- **Rate-limit (TokenBucket)**: 双桶(RPM + TPM)限流器接入 LLMClient/agno_factory,避免有并发上限的模型套餐撞 429;默认 max_concurrent 30→4;OpenAI / DeepSeek / vLLM 三 provider 兼容;ADR-0001 写明 DIY 而非 litellm 的选型。Closes 31, 32. (PR 36)
- TokenBucket dual-bucket (RPM + TPM) rate limiter wired through LLMClient/agno_factory to avoid 429s on metered provider plans; max_concurrent default 30→4; provider compat tested across OpenAI / DeepSeek / vLLM; ADR-0001 documents the DIY choice over litellm.

- **Team mode 重连身份保持**: client 重连时把本地 `team_client.json` 里的 client_id 一起 POST 给 /register,server 三级续用(claimed_client_id → (hostname, label) 指纹 → 新发 uuid),消除重连即换身份导致 canary/历史归属/staging 断链的漏洞。(PR 37)
- Team-mode reconnect now preserves identity: client POSTs its existing client_id on /register; server resolves via 3-tier priority (claimed → fingerprint → new uuid). Fixes the regression where reconnect silently dropped canary bucket / trajectory history / user-staging branches.

- **Cluster 政策修订 + 重试 + 去重 + 可观测性**: 禁 silent drop(每个 atom 必 add_task_to_skill,含 ws=1);partial-fail 重试 3 次封顶;调 cluster_agent 前 atom-id 去重,已落地的 atom 不再重投 LLM;per-atom `atom → skill ws=N` 日志 + drop 走 WARNING + 总结行三个数。(PR 38)
- Cluster policy revision: forbids silent drop (every atom must add_task_to_skill, including ws=1); partial-fail retry up to 3; atom_id-level dedup before re-clustering; per-atom log + summary line.

- **通用 install copy + reverse_sync 框架**: `install_dir` 加 install-meta + `_is_link_or_junction` helper(Windows 查 `FILE_ATTRIBUTE_REPARSE_POINT`)+ auto_reset 钩子;`reverse_sync_openclaw_dest` 泛化为 `reverse_sync_copy_dest`;ngagent 改强制 copy + reverse_sync(Closes 34);openclaw junction-aware rmtree(Closes 35)。(PR 39)
- Generic copy + reverse_sync install framework: install_dir gains install-meta + _is_link_or_junction helper + auto_reset hook; reverse_sync_openclaw_dest generalized to reverse_sync_copy_dest; ngagent forced to copy mode + reverse_sync (Closes 34); openclaw junction-aware rmtree (Closes 35).

备注 | Note

CI release workflow 的 publish step 受限于 `pypa/gh-action-pypi-publishrelease/v1` 的 OIDC 要求,本次仍走本地手动 build + twine 发版。后续 PR 会修 release.yml(加 `id-token: write` 权限 + PyPI Trusted Publisher 配置)。

The CI release workflow's publish step still fails due to OIDC requirements in `pypa/gh-action-pypi-publishrelease/v1`; published manually via local build + twine. A follow-up PR will fix release.yml (add `id-token: write` permission + PyPI Trusted Publisher setup).

0.5.1a1

新功能 | New Features

- **ngagent ecosystem 适配**(opencode 企业分支):新增 `NGAGENT_SPEC` / `install_to_ngagent` / `install_all_to_ngagent`,schema 与 opencode 一致复用 SqliteIngester,skill 装到 `~/.config/opencode/skills/` 而非 `~/.agents/skills/`,可与 opencode 并存。详见 PR 33。
- Add ngagent (opencode enterprise fork) ecosystem support — same schema as opencode (shared SqliteIngester), but skills install to `~/.config/opencode/skills/`. Coexists with opencode on the same host. See PR 33.

修复 | Fixes

- **openclaw 适配器** 对非字符串 `text` 字段做类型检查,避免对 thinking/自定义块调 `.strip()` AttributeError(PR 30)。
- **team git_bundle** 移除 4 处 `bundle.close()` 兼容老 dulwich(py3.9 解析到的版本);Windows POSIX mode 测试跳过(PR 30 内含)。
- type-check non-string `text` fields in openclaw adapter to prevent `.strip()` AttributeError on thinking/custom blocks (PR 30).
- Drop `bundle.close()` calls for old-dulwich compat; skip POSIX-mode test on Windows (folded into PR 30).

备注 | Note

CI Release workflow 的 publish 步骤因为 pypa/gh-action-pypi-publish 新版本要求 OIDC 而失败,本次发版改用本地手动 build+twine 完成。需要修 `.github/workflows/release.yml` 加 `id-token: write` 权限,下个版本恢复 CI 发布路径。

0.5.0

Full Changelog

[v0.4.2...v0.5.0](https://github.com/SkillNerds/xskill/compare/v0.4.2...v0.5.0) — 61 commits.

Links

Releases

© 2026 Safety CLI Cybersecurity Inc. All Rights Reserved.