v1.3.0

Release v1.3.0 — Import third-party skill repositories straight from a Git URL

Release date: 2026-10-14

Overview

This is a minor release. It adds a one-click Import from Git entry point for third-party repositories: paste a Git URL (https:// / ssh:// / git:// / file:// / user@host:path), Flint clones the repository into its own managed directory and hands it straight to the existing registration flow. Imported sources stay read-only, and updates keep working through the usual Check updates / Sync actions.

Usage

No migration needed — install or update as before:

npx flint-skills-hub
# or
npm i -g flint-skills-hub

• Library ▸ Repositories now has two toolbar actions: Import from Git and Register repository.
• Click Import from Git, paste a Git URL, and hit Pull. The code is cloned into <flint data dir>/sources/<repo-name>, then the registration dialog opens on its own with the Third-party repository type selected and the path already filled in — confirm the layout, preview, and register as usual.
• A repeat import reuses the existing clone (it fetches instead of re-downloading). Private repositories without cached credentials fail in seconds instead of hanging on a credential prompt.
• After registration the source behaves like any other third-party repository: read-only, with Check updates / Sync available (the remote is read from git remote, so nothing extra is stored in your config).

What's New

Features & Improvements

• Import third-party repositories from a Git URL — a dedicated entry point next to Register repository, with support for https://, ssh://, git://, file://, and the user@host:path shorthand. URLs that try to inject Git options or use ext::-style remote helpers are rejected.
• Clone once, reuse after — code lands in Flint's managed <flint data dir>/sources/<repo-name> directory; importing the same URL again reuses the existing clone and fetches, so you never download twice.
• Hands off to the existing registration flow — the normal registration dialog (type, id, layout, preview, confirm) is reused, so an imported repository is registered and diagnosed exactly like a locally-pointed one; the default id comes from the repository name.
• Async, time-bounded Git — cloning runs in the background with a timeout and process-group cleanup (the UI never freezes), and interactive credential prompts are disabled so an unreachable private repo fails quickly instead of hanging.

---

Notes

• Importing writes only to Flint's managed sources directory — the clone step never changes your config, and pulling without completing registration leaves nothing registered (the local clone is simply reused next time).

v1.2.0

Release v1.2.0 — Skill content health: security scan and frontmatter validation

Release date: 2026-10-09

Overview

This is a minor release. It adds content health checks for your own-repository skills: a read-only security scan (dangerous callbacks, leaked credentials, prompt injection, obfuscation payloads) and SKILL.md frontmatter validation (missing name / description, name differing from the directory name). Findings surface in three places — the health center, the skill list, and the skill detail page.

Usage

No migration needed — install or update as before:

npx flint-skills-hub
# or
npm i -g flint-skills-hub

• Health shows a new Content dimension: each item lists the rule, the file and the line.
• Library marks skills with detected issues using a risk badge (red when any error is present, amber otherwise).
• A skill's detail page gains a collapsible Content check section (collapsed by default) that runs on demand, can be re-run, and shows the excerpt of each matched line for review.

All checks are read-only, run entirely on your machine, and never touch third-party read-only sources — no network access at runtime.

What's New

Features & Improvements

• Content security scan — own-repository skills are scanned for remote-code-execution patterns (curl | sh, eval, child_process, …), leaked credentials (OpenAI / Anthropic / AWS / GitHub / Slack / Stripe / Google / npm tokens, private key blocks), prompt-injection phrasing, and obfuscation payloads (zero-width and bidi characters, long base64 blobs).
• Frontmatter validation — flags broken YAML, missing name / description, a name that differs from the directory name, and non-slug names: exactly the mismatches that silently make an agent fail to load a skill.
• Health center: a consolidated content dimension — one read-only view reporting every finding with ok / warn / error per item.
• Skill list: risk badge — a skill with issues is marked at a glance, so you can spot problems without opening the health center.
• Skill detail: on-demand content check — a collapsible section (collapsed by default) with a Re-check button; each finding shows its rule, file:line, and the excerpt of the matched line.
• Low false positives by design — placeholder values (sk-xxxx, your-api-key) and low-entropy assignments are dropped, and illustrative mentions ("never use …") are demoted by one severity level.
• Detection rules are data, not code — rules live in a vendored YAML snapshot (server/rules/security/*.yaml) compiled into a TypeScript constant table at build time (npm run gen:security-rules). No new runtime dependency, and the compiled table ships with the package.

v1.1.1

Release v1.1.1 — Remove any skill from a directory, preview before registering

Release date: 2026-10-08

Overview

v1.1.1 is a patch release that makes deleting a skill do what the button says, and rounds out
the registration path. Deleting a skill from an agent or project directory no longer refuses
external symlinks and agent-owned directories: a symlink is unlinked (its target is never touched),
while a real directory or file is removed — with a confirmation first. Registering a repository or
third-party source now previews what will be picked up before anything is saved, and a
single-skill repository whose root holds a SKILL.md is recognised as one skill instead of being
silently dropped.

Usage

npm install -g flint-skills-hub   # update an existing install
flint -v                           # check the version in use
flint                              # start in the background, open the browser

No migration needed: existing configuration, repositories and skill directories keep working. See
the note at the end for the one behaviour change in this release.

What's New

Features & Improvements

• Preview before registering a repository or source. Registering is now two steps: fill in the
  form, press Preview, and the dialog reports what was actually found — the resolved layout,
  the skill count, the skill list, the id derived from the directory name, and any problem with it.
  Nothing is written until you confirm, and any edit to the form invalidates the preview so you
  are never confirming a stale scan. Leaving the id empty uses the directory name; when that name
  cannot produce a valid id, the id field is required and Confirm stays disabled until you type
  one. Editing an existing repository stays single-step.
• Id rules are enforced for real. Ids are validated on the server for both own repositories and
  third-party sources (letters, digits and . _ - only, starting with a letter or digit), and a
  duplicate id is rejected instead of silently overwriting. Previously the check only existed in
  the browser.
• Single-skill repositories are recognised. When the scan root itself contains a SKILL.md —
  a repository that is one skill — the whole directory is treated as a single skill, and its
  skills/ subdirectories count as that skill's internals rather than separate skills. This
  applies uniformly to repository and third-party source scanning, layout detection and importing.
  Previously such a root was misdetected as nested and its own skill never showed up.

Bug Fixes

• Deleting a skill no longer fails on entries this tool did not deploy. The delete action on an
  agent's skill directory, on a project's .agents/skills, and the switch in Distribute to
  agents all now remove the entry that is actually there: a symlink is unlinked only — the file
  it points at is never modified — and a real directory or file is deleted. Previously symlinks
  pointing outside this tool's own libraries, and agent-owned real directories, were refused with
  an error, so the Delete button could not succeed and the distribution switch was greyed out for
  those rows. Those restrictions are gone, and every removal asks for confirmation describing what
  will happen.
• The action list no longer offers impossible actions. Rows that are listed but not on disk
  (a project skill matched by a tag that has not been copied into .agents/skills yet) used to
  show a Delete button that could only fail; they now offer no actions.

---

Upgrade note

Deleting a skill now removes whatever is in that directory. A symlink is always safe — only the
link goes away, the skill body it points at stays where it is — but deleting an agent-owned real
directory deletes your files, exactly as the confirmation dialog says. Removing a symlink that
another tool created is therefore fine; removing a real directory is a real deletion, so read the
dialog before confirming.

v1.1.0

Release v1.1.0 — Flint starts in the background, like start.sh

Release date: 2026-09-28

Overview

v1.1.0 is a minor release that changes how the flint command behaves: it now starts the
server in the background and returns as soon as the server answers, instead of holding your
terminal as a foreground process. The startup model matches ./start.sh from a source checkout,
so both entry points behave the same way: background server, logs on disk, browser opened once
ready, shell prompt back.

Usage

npm install -g flint-skills-hub   # update an existing install
flint -v                           # check the version in use
flint                              # start in the background, open the browser, exit

Stopping and restarting the background instance:

kill <PID>      # PID is printed at startup (also stored in ~/.flint/logs/flint.pid)
flint -y        # force restart: stop the running instance, then start fresh
flint -f        # run in the foreground instead (debugging, containers)
flint -p 9000   # custom port
flint --no-open # start without opening the browser

Running flint while an instance is already up re-opens the page rather than starting a second
one. A port held by another program is reported and left alone — Flint never kills processes it
does not own.

What's New

Features & Improvements

• The command no longer occupies your terminal. flint spawns the server as a detached
  process, waits until it answers, opens the browser and exits; the server keeps running in the
  background. Startup prints the URL, the process PID, the log paths and the kill command you
  need to stop it again.
• Startup logs go to disk. Console output stays short (banner, URL, PID, logs, stop hint)
  while the server's own output is written to ~/.flint/logs/flint.log; the application log
  remains ~/.flint/logs/app.log. FLINT_LOGS overrides the directory.
• Running it twice no longer fails with "port in use". The command recognises an existing
  Flint instance — by its PID file and process command line — and simply re-opens the page. A
  process that holds the port but no longer answers is reported as stale, with a hint to restart
  with -y.
• Ports held by other programs are never killed. Other occupants are reported with their PID
  and Flint exits; only the explicit force-restart flag (-y / -r) restarts a Flint instance.
• --foreground for debugging and containers. -f keeps the old behaviour — server in the
  same process, logs on the console, Ctrl+C stops it — which is what container entry points and
  troubleshooting sessions want.
• Node.js version check at startup, matching the >= 20 requirement the package declares.

---

No migration needed: existing configuration, repositories and skill directories keep working. If
you scripted around the old foreground behaviour (for example in Docker), add -f.

v1.0.6

Release v1.0.6 — Distribute skills to agents, body search, source tracking

Release date: 2026-09-28

Overview

v1.0.6 is a patch release that rounds out the Library: a skill can now be distributed to
agents straight from its detail page, keyword search also matches SKILL.md bodies, and skills
collected from a git repository or a directory remember their source and can be refreshed from
it with one click.

Usage

npm install -g flint-skills-hub   # update an existing install
flint -v                           # check the version in use
flint                              # starts the server, opens the browser

No migration needed: existing configuration, repositories and skill directories keep working.

What's New

Features & Improvements

• Distribute a skill to agents from its detail page. The skill detail page has a
  "Distribute to agents" action that opens a dialog listing every agent skill directory as a
  card — the same cards, search (name / key / directory), "installed only" filter and
  cards / list views as the Agents page. Turning a switch on deploys the skill into that
  directory once (symlink or copy, following the directory's strategy); turning it off removes
  the link / copy this tool deployed. Directories that hold the skill are listed first and the
  switch is disabled — with an explaining badge — for agent-owned directories and external
  symlinks, which this tool never deletes. The dialog answers "which agents already have this
  skill?" with a single fast lookup, and toggles apply in place without reloading the list.
• The skill detail is now a page, not a dialog. Opening a skill from the Library navigates
  to #/library/<skill>: metadata, tag editing, provenance, the SKILL.md preview and the
  distribute dialog live on one page, the URL stays shareable and refresh-safe, and "Back"
  returns to the list with filters intact.
• Keyword search matches SKILL.md bodies. The Library search box now finds skills by their
  content as well as by name, title and description; matches that only exist in the body are
  listed with the matching context, so it is clear why a skill turned up.
• Provenance and update-from-source. Skills collected from an agent or imported from a
  directory remember where they came from and when; the detail page shows the source, and
  "Update from source" copies the current source content over the repository copy (the source
  itself is never modified). Own repositories and third-party sources also show their git remote
  with ahead / behind counts, plus "Check updates" (fetch) and "Sync" (pull) actions.

---

No migration needed.

v1.0.5

Release v1.0.5 — Skill lists now reflect the directory itself

Release date: 2026-09-23

Overview

v1.0.5 is a patch release that finishes the move to a file-system-first model: an agent's or
project's skill list shows exactly what is physically in the directory, and skills enter it in a
single shot ("Apply preset" / "Add") instead of being tracked by an on/off switch. The
copy-mode watcher — which no longer had anything to do — and its Settings switch are gone, and
the badges and hints that still promised automatic syncing have been corrected.

Usage

npm install -g flint-skills-hub   # update an existing install
flint -v                           # check the version in use
flint                              # starts the server, opens the browser

No migration needed: existing configuration, repositories and skill directories keep working.
Historical explicitOn / explicitOff / watchers fields in ~/.flint/config.json are ignored
on load and disappear the next time the file is written.

What's New

Features & Improvements

• Skill lists are directory-authoritative. An agent's (or a project's) skills page lists what
  the directory actually contains — nothing more. A skill is placed with "Add from the vault"
  or "Apply preset", and removed with "Delete"; there is no enable/disable switch and no
  expected set kept behind the scenes.
• Presets are applied once, explicitly. Linking a preset only records the decision; pressing
  "Apply preset" deploys its members into that directory once. Later membership or linked-tag
  changes do not sync on their own — apply again to pick them up.
• The copy-mode watcher is retired. With no automatic deployment left to drive, the directory
  watcher had nothing to do (the vault is re-scanned per request, never cached), so its
  implementation, the watchers config field and the Settings switch were removed together. A
  copy-mode skill that changes in the vault needs one explicit re-deploy for that directory.

Bug Fixes

• Third-party skills are cleaned up correctly. Links deployed by this tool for skills coming
  from a read-only third-party source are now recognized as tool-deployed, so deleting them
  removes the link instead of reporting it as a foreign link that must be left alone.
• Copy that described removed behaviour is gone. Badges, tooltips and hints that still talked
  about automatic syncing, per-skill switches, "distribution baselines" or an inactive-directory
  follow-up were rewritten to match what the tool actually does (Agents, Presets, Library badge
  guide, Settings).

---

No migration needed.

v1.0.4

Release v1.0.4 — flint -r restarts a busy port

Release date: 2026-09-22

Overview

v1.0.4 is a patch release for the CLI: a new -r / --restart flag that force-stops
whatever already occupies the port and starts fresh. It also adds the package's npm badges
to the README and mirrors each release to GitHub Packages as @lcy362/flint.

Usage

npm install -g flint-skills-hub   # or: npm run dev in the repo
flint                              # starts the server, opens the browser
flint -r                           # restart if the port is already in use

What's New

Features & Improvements

• flint -r restarts on a busy port. If port 8787 (or your --port) is already taken,
  flint -r finds the process holding it and force-stops it (graceful, then kill), waits for
  the port to free up, and starts a fresh instance. Without -r the CLI still refuses to start
  on a held port, and the error message now suggests flint -r as the fastest fix. Also works
  as flint-skills-hub -r.
• Now mirrored to GitHub Packages. Each release is also published to GitHub Packages as
  @lcy362/flint, so the package shows up in the GitHub sidebar and can be installed straight
  from GitHub's registry (@lcy362:registry=https://npm.pkg.github.com).
• npm badges on the README. Version, downloads and license badges link to the npm page.

---

No migration needed: existing configuration and behaviour are unchanged.

v1.0.3

Release v1.0.3 — Shared skill directory shown as one entity

Release date: 2026-09-22

Overview

v1.0.3 is a patch release about how shared skill directories are presented. The
ecosystem-recommended directory (~/.agents/skills) is now marked on the directory itself
instead of on every agent that reads it, a directory gets a single detail page shared by all
of its agents, and the active toggle applies to the whole directory.

Usage

npm install -g flint-skills-hub   # or: npm run dev in the repo
flint                              # starts the server, opens the browser

What's New

Features & Improvements

• The ecosystem-recommended directory is called out on its own. ~/.agents/skills is
  read by most agents in the ecosystem, so an "also reads" badge on each of them carried no
  information. It is now marked on the directory itself: its card uses a dedicated accent
  colour with the title "Ecosystem-recommended directory", an info button explaining which
  agents are its current representatives, and it sorts first within both the active and the
  inactive groups. Only ~/.agents/skills is styled this way — other shared directories such
  as ~/.config/agents/skills render as ordinary cards.
• One detail page per skill directory. Agents that share a directory no longer get one
  page each: the title lists the whole group (Codex / OpenHands / Warp), the agent names are
  no longer individually clickable, and a URL pointing at a single member is redirected to the
  shared page. The "primary / alias" badges are gone — a directory is one thing.
• Active state is directory-wide. The active badge and the toggle now follow the directory
  (a directory is active when any of its members is), matching what the list already showed.
  "Remove from active" therefore really stops the directory from auto-syncing, instead of
  silently leaving another member of the same directory active.

Bug Fixes

• Fixed the info button's hover explanation never appearing on cards, and made it show
  instantly rather than relying on the browser's slow native tooltip.
• Removed an explanatory line on the directory detail page that only repeated the tooltip.

---

No migration needed: existing configuration keeps working, only the presentation changed.

v1.0.2

Release v1.0.2 — npm tarball shipped on GitHub Releases

Release date: 2026-09-17

Overview

v1.0.2 is a patch release on the delivery side: every GitHub Release now bundles the
npm package tarball as a downloadable asset, so each version can be installed straight
from the release page without depending on registry propagation timing.

Usage

npm install -g flint-skills-hub   # or: npm run dev in the repo
flint                              # starts the server, opens the browser
./start.sh                         # one-click: banner → background → browser

If you want to try the packaged artifact from a specific release:

npm install -g ./flint-skills-hub-1.0.2.tgz

What's New

Features & Improvements

• GitHub Releases now carry the npm tarball (flint-skills-hub-<version>.tgz) as a
  download asset. Each version is directly installable from the release page, and the
  artifact can be inspected offline instead of waiting for the registry to serve it.

v1.0.1

Release v1.0.1 — Smoother startup and clean config location

Release date: 2026-09-17

Overview

v1.0.1 is a patch release focused on the startup experience and on-site hygiene:
the one-click launcher now daemonizes, keeps noisy logs out of the console, prints a
clear banner and helpful restart hints, and correctly tells which process owns a port.
Configuration and logs also move from the old ~/.skills-hub to ~/.flint, and a few
leftover version badges were removed from the UI.

Usage

npm install -g flint-skills-hub   # or: npm run dev in the repo
flint                              # starts the server, opens the browser
./start.sh                         # one-click: banner → background → browser

Migrating existing data (only if you used a version before v1.0.1): config and logs
move to a new location in this release. If you already have a setup under the old path,
move it once:

mkdir -p ~/.flint/logs
mv ~/.skills-hub/config.json ~/.flint/config.json
mv ~/.skills-hub/logs/app.log ~/.flint/logs/app.log

Environment overrides are renamed accordingly: FLINT_CONFIG replaces SKILLS_HUB_CONFIG
(config path), FLINT_LOG_LEVEL / FLINT_LOG_MAX_MB replace SKILLS_HUB_LOG_LEVEL /
SKILLS_HUB_LOG_MAX_MB. Runtime logs live under ~/.flint/logs/.

What's New

Features & Improvements

• Daemonized launcher: ./start.sh draws a FLINT banner, starts front and back
  end in the background, prints the ready URLs and then exits — the console is kept for
  essentials only, while full output goes to ~/.flint/logs/dev.log.
• Smarter "already running" check: instead of assuming a port is busy, the launcher
  verifies whether the page is actually reachable. If this project is already up it
  reuses it (no kill), tells you it is safe to continue, and shows both restart options
  (./start.sh -y or npm start) plus where the logs are.
• Process ownership is detected by working directory too, so instances started via
  npm start, npx flint-skills-hub, or the repo's node dist/index.js are recognized
  as this project rather than as a foreign process occupying the port.

Refactoring & Optimizations

• Config and logs moved from ~/.skills-hub to ~/.flint, and the SKILLS_HUB_*
  env vars were renamed to the FLINT_* family so the on-disk footprint matches the
  product name.

Bug Fixes

• Removed leftover hardcoded version badges from the UI (sidebar and settings), while
  keeping each skill's own metadata version.
• The launcher banner now unmistakably reads FLINT across terminal fonts.

---

Upgrade note: this release relocates config/log files to ~/.flint (see Usage).
No data is changed or lost — you only need to move the old files if you were using a
pre-v1.0.1 setup and want to keep that configuration.