ModelScope-Hub v0.4.0 Release Notes

Agent-IDP: full OpenAPI coverage for Ed25519 agent identities — create/get/update/delete, key reset, pause/resume, issued-token records, OIDC discovery + JWKS, and locally signed JWT issuance. Available on HubApi and via the new ms-hub agent-idp command. Private JWKs are written 0600, and only to an explicitly requested path.
Studios: the eight remaining published operations — list_studios, the hardware / base-image / SDK-version catalogs, and the four plaintext-variable operations. New CLI: ms-hub studio list|variable|hardware|base-images|sdk-versions, plus ms-hub list --repo-type studio.
MCP: HubApi.list_operational_mcp_servers() and ms-hub mcp list --hosted surface hosted servers with their live URLs.
Studio protected visibility: app public, code hidden — previously inexpressible because visibility was folded into a private bool.
Token permission tiers: TokenScope (read/write/admin) annotations. A read-scoped token can log in with a warning, and a rejected write names the tier it requires.
RepoInfo now carries Studio runtime fields (sdk_type, sdk_version, base_image, hardware, mcp_support, runtime) instead of discarding them.

MCP deployment discovery sends PUT first — the only verb the spec defines — and remembers which verb a deployment serves, so the other is tried at most once.
Listing Studios by owner now requests every status; the endpoint keeps filtering to running spaces even with an owner set, so "list my spaces" returned nothing.

Studio compat shims forwarded token / endpoint into request bodies, serialising the caller's API token into the PATCH body of update_studio_settings. Control kwargs are now split from business fields on every Studio shim.
get_studio_logs(..., token=...) raised TypeError and could never succeed; a per-call token= was silently ignored on every Studio shim.
cover_image was renamed to coverImage on the way out and dropped by the server, so Studio cover images never applied.
Error mapping: 403 now separates insufficient permission from an exhausted quota (new QuotaExceededError, deliberately not retryable), 409 maps to AlreadyExistsError, and the OpenAPI string error codes are recognised at all.
get_studio demanded a token for spaces the spec declares public.
ms-hub studio logs read a total field the response never had, so its pagination footer never printed.

README: the new Studio / MCP / agent-idp command surface, a Token permission levels section, and the SDK method reference. Back-filled the missing 0.3.0 and 0.3.1 News entries and collapsed older releases.

The OpenAPI spec is vendored under tests/data/ and checked against OPERATION_REGISTRY, so an unimplemented published Agent-IDP / MCP / Studios endpoint fails the suite instead of drifting unnoticed.

What's Changed

Full Changelog: v0.3.1...v0.4.0