🚀 Astron Open Source · Bi-Weekly Report (Jun 15 – Jun 28, 2026)

[FenjuFu]

🚀 Astron Open Source · Bi-Weekly Report (Jun 15 – Jun 28, 2026)

---

🌟 Highlights

• Climbing the OSS Insight Java trending board: across the last three months of Java repositories, SkillHub holds # 3 · Astron Agent climbs from # 5 to # 4.
• Astron Agent v1.0.9 ships (Jun 18): the standalone agent's chat runtime was rebuilt on Spring AI, and gained MCP support and a Skill capability that plugs straight into the SkillHub ecosystem; team publish approval and a redesigned workbench landed in the same release. Another 35 PRs merged in two weeks.
• SkillHub v0.2.12 + CLI 0.1.8 released the same day (Jun 18): anonymous CLI search/install of public skills, AgentGuard as a built-in skill, more reliable notifications & SSE push, plus a round of security hardening.
• Astron Agent launched on Product Hunt (Jun 15), opening up overseas community exposure; the Shanghai AI Agent Industry Practice Meetup (Jun 27) featured community architect Dong Jiang presenting "Agent Architecture & Knowledge Engineering Practice on Astron-Agent".

---

👥 Top 10 Active Community Contributors (Jun 15 – Jun 28, 2026)

Based on message volume in the open-source discussion group (automated accounts such as the Astron Q&A bot and the welcome bot excluded); nicknames anonymized. Thank you to everyone who answered questions, asked questions, and built alongside us 🙌

---

📦 Release Highlights

🤖 Astron Agent v1.0.9 (Jun 18) — Standalone Agent rebuilt on Spring AI

• 🚀 Runtime overhaul: the standalone agent's chat runtime migrated from a hand-rolled OpenAI-compatible implementation to Spring AI (OpenAiChatModel + ToolCallback/ToolCallingManager) — model calls, streaming, and tool execution are now framework-managed, and legacy runtime paths were removed (#1418/#1425).
• ✨ MCP support: configure external MCP Server URLs on the capability page; the runtime fetches those tools and lets the model choose them by description (#1418/#1426).
• ✨ Skill module: import SkillHub skills on the capability page (up to 30); at runtime each skill exposes read_skill_* (reads SKILL.md and referenced resources) and run_skill_* (executes commands in the E2B script sandbox) (#1424/#1427).
• 🚀 Team publish approval flow (#1383) + redesigned agent workbench (#1397) + agent debug conversation history.
• 📚 Standardized the VitePress docs site with i18n (#1406); added a community workflow examples gallery (#1407/#1408); FAQ supplemented with community-sourced Q&A (#1413).
• 🔧 Upgrade notes: choose a model explicitly when creating an agent (the built-in default Spark models were removed); Flyway V1.38 migrates automatically on startup; run_skill requires an E2B sandbox configured in resource management. Change scope: 248 files, +18,358/−6,136 lines.
• 📝 Release: https://github.com/iflytek/astron-agent/releases/tag/v1.0.9 ｜ Walkthrough slides: https://iflytek.github.io/astron-agent/releases/astron-agent-v1.0.9-release-notes.pdf

🛡️ SkillHub v0.2.12 + CLI 0.1.8 (Jun 18) — Anonymous installs & security hardening

• ✨ Anonymous public CLI search and install, with installability filtering and restricted-skill handling (#523); ⚠️ Breaking: invalid CLI bearer tokens now fail closed instead of falling back to anonymous access.
• ✨ AgentGuard ships as a built-in skill from the cloud manifest (#526) — security health checks and malicious-skill scanning out of the box.
• 🐛 More reliable notification delivery: profile reviews, promotion reviewer notices, publish events, and SSE live-push streams kept alive with proper headers (#530/#533/#539).
• 🔒 Security review hardening across release/runtime secrets, archive extraction, workflow permissions, scanner gating, and validation gaps (#508).
• 🙌 New contributor @SenLinLeo merged their first PR (#534, CLI interaction fix).
• 📝 Release: https://github.com/iflytek/skillhub/releases/tag/v0.2.12

⚙️ Astron RPA — Local-service security hardening

• 🔒 Scheduler access restricted to local clients (#809); router binary gained a LAN access guard (#810/#811), shrinking the exposure of on-machine services.
• 🐛 Fixed browser-plugin event listening and element picking inside iframes (#808).
• 📚 FAQ.zh supplemented with community-sourced Q&A (#806).

---

💬 Community Q&A & Discussions (Bi-Weekly Picks)

Grouped by product line; all are real community questions + the engineering team's solutions. 🟢 Resolved / 🟡 In progress.

SkillHub (mostly on-prem deployment & upgrades)

• 🟢 502 on login/register after deployment: root cause was skillhub-server failing to start because SKILLHUB_DOWNLOAD_ANON_COOKIE_SECRET was still the placeholder. Set a long random string in .env.release (not .env.release.example) and recreate the container; in offline environments where built-in skill sync fails, set SKILLHUB_BUILTIN_SKILLS_ENABLED=false to get the service up first.
• 🟢 Docker Compose upgrade path (v0.2.6 → v0.2.12): change SKILLHUB_VERSION in .env.release → docker compose pull → up -d; with the data volume preserved, the database schema migrates automatically via Flyway — no manual DB changes.
• 🟢 Getting admin rights after GitLab OAuth login: log in as the bootstrap admin and grant SUPER_ADMIN to the account in user management; if no admin can log in, fall back to the bootstrap-admin route or a database fix.
• 🟢 Connecting Claude Code to SkillHub: official guide published → Discussion #559.
• 🟢 "GitHub issues seem permission-restricted" clarified: the repo only disables blank issues — sign in and file via the Bug Report template with the required fields; there is no permission gate for external accounts.
• 🟡 Claude Code-style hook support: not yet available; the user was invited to file a feature-request issue.

Astron Agent (mostly open-source deployment & new capabilities)

• 🟢 Casdoor auth redirect breaks after changing the port / localhost unreachable: changing EXPOSE_NGINX_PORT is only step one — CASDOOR_EXTERNAL_ENDPOINT in .env and the Casdoor application's callback URLs must exactly match the address the browser actually uses (server IP/domain, not localhost), and the callback URL must be added to the Casdoor app's allow-list.
• 🟢 E2B sandbox + Skills, the right way: the sandbox only executes scripts declared in SKILL.md and returns their output (progressive loading) — it is not a local agent with arbitrary file access; multiple scripts must be explicitly referenced in SKILL.md.
• 🟢 Workflow import/export: both supported; for a file → pdf field on the start node — pass it into a plugin/code node for parsing, hand it to RPA, or (for "chat over PDF" scenarios) ingest into a knowledge base first and retrieve from there.
• 🟢 Is there an open-source MCP marketplace? The open-source Astron Agent ships MCP/plugin marketplace capabilities; to attach your own MCP server, listen on 0.0.0.0 and expose a full URL the platform can reach (intranet address for intranet deployments, public address otherwise).
• 🟡 ModelScope map MCP times out after being added: support could not reproduce (it works in their tests); comparing configurations with the user, who will file issues for tracking.

Astron RPA (mostly client adoption & automation)

• 🟢 Where is the route.exe (Golang) source? Available on the dev branch.
• 🟢 Can the personal-edition RPA be invoked by an Agent or run on a schedule? Yes — see the official doc Calling RPA from an Agent, plus a video course and a hands-on article.
• 🟢 Registration times out with only the client installed: Astron RPA is not a client-only product — registration/login/scheduling depend on the server side, which must be deployed via docker-compose first.
• 🟢 Scheduler occasionally crashes after long runs: provided a mitigation plan (daily scheduled restart, lower concurrency and split tasks for high-risk bots, uniform timeouts/retry caps on external calls, disable the "double pull-up on failure" mechanism) plus a diagnosis path (logs around pid_exist_check, stale pid files, Windows event logs).
• 🟢 Does the EDGE plugin work on an intranet? Yes — provided the server, plugin callback, and target systems are all configured with intranet-reachable addresses, and note the default private-network blacklist.
• ℹ️ No standalone download channel for the browser plugin; no new client build shipped this period.

📌 New self-service Q&A entry point: besides @-mentioning the Astron Q&A bot in the group, you can now ask on the web → https://awesome-astron-workflow.dev/chat

---

🙌 Community Call: Come Contribute! (Good First Issues & Bounties)

Newcomer-friendly and rewarding from your first commit (contribution points are redeemable at the points store):

🌱 Good First Issues (great for a first contribution)

Project	Issue	What it's about
Astron Agent	#1412	Expand the docs FAQ
Astron Agent	#1410	Contribute a workflow example to the gallery
Astron Agent	#1405	"Are you using Astron Agent?" user-story collection
Astron RPA	#805	"Are you using Astron RPA?"
SkillHub	#528	"Are you using SkillHub?"

💰 Bounties (reward · more challenging, more rewarding)

Project	Issue	What it's about
Astron Agent	#1067	Let OpenClaw trigger Astron Agent to schedule an RPA bot for secure operations
Astron Agent	#1066	Build a "ChatClaw" app on the drag-and-drop canvas with visual fine-tuning
Astron Agent	#709	Support the A2A (agent-to-agent) protocol

👉 Want to claim one? Just comment on the issue. Not sure where to start? Ping us in the discussion group and the engineering team will help break the task down.

---

✨ Community Spotlight

• 🗳️ Product Hunt launch: Astron Agent is live on Product Hunt — an upvote helps a lot → https://www.producthunt.com/products/astron-agent
• 🎤 Shanghai AI Agent Industry Practice Meetup (Jun 27): iFLYTEK senior architect Dong Jiang presented "Agent Architecture & Knowledge Engineering Practice on Astron-Agent".
• 📺 Bi-weekly community pick: an overseas creator published a Shorts review — "HarnessClaw Review: The Open Source AI Workspace You Need" — spotlighting the open-source desktop app that turns AI agents into a collaborative workspace, far beyond a typical chatbot → https://youtube.com/shorts/we9L7tre4-o

---

💬 Got questions, ideas, or want to contribute? Join the discussion group, or head straight to the repos under iflytek-astron to open an Issue / PR.
Let's build a thick, solid open-source ecosystem for enterprise-grade AI Agents together 🚀