3 Commits

Author	SHA1	Message	Date
João Moura	f0704ebb22	feat(skills)!: promote Skills Repository out of experimental (#6579) ... * feat(skills)!: promote Skills Repository out of experimental The registry-backed Skills Repository (crewai skill create/publish/ install/list, @org/name refs, global cache) is now mainline: - CLI: `crewai skill ...` is a top-level group; the CREWAI_EXPERIMENTAL gate and the now-empty `crewai experimental` group are removed. - Runtime: registry.py, cache.py, and events.py move from crewai.experimental.skills into crewai.skills next to the loader; the require_experimental_skills() gate is gone. crewai.experimental.skills remains as a deprecated re-export shim. - Docs: concepts/skills now leads with the CLI workflow and documents the create -> publish -> install lifecycle. Linear: n/a (requested promotion) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): org-scoped publish only + docs in all languages Skills are always scoped to the publishing organization, like tools: drop the --public/--private flags from `crewai skill publish` and always send is_public=False to the registry. CLI tests assert the flag is rejected and the API never receives a public publish. Translate the new CLI-first Quick Start and the create -> publish -> install lifecycle section into ar, pt-BR, and ko concepts/skills docs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(skills): address review comments on the promotion PR - Back-compat shim now aliases the old submodules in sys.modules so `crewai.experimental.skills.registry/cache/events` imports (and patch targets) resolve to the real crewai.skills modules, not just the package-root re-exports. - `crewai skill publish` actually enforces the git-state check that --force claims to skip: unsynced repos block publishing (mirroring tool publish); standalone skill dirs outside any git repo publish without a check. - Explicit UTF-8 encoding on SKILL.md and cache-metadata reads/writes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(skills): fail closed when git state cannot be validated on publish Follow deploy's pattern: construct git.Repository(fetch=False) and only treat "not a Git repository" as skippable — any other git error (fetch/auth/misconfiguration) now blocks publish with a --force escape hatch instead of silently bypassing the sync check. Also single-style imports in the shim test (CodeQL) with the dotted shim import covered via importlib. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(skills): fetch before sync check on publish; bump mcp past advisories Publish now refreshes remote-tracking refs (repository.fetch()) before is_synced(), so ahead/behind is judged against the actual remote rather than stale local refs; a failing fetch blocks publish with the --force escape hatch. Adds a fail-closed test for fetch errors. Raise mcp to >=1.28.1,<2 (locks 1.28.1): the ~=1.26.0 pin blocked GHSA-hvrp-rf83-w775 / GHSA-jpw9-pfvf-9f58 (fixed 1.27.2) and GHSA-vj7q-gjh5-988w (fixed 1.28.1), which were failing pip-audit on this PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Vinicius Brasil <vini@hey.com>	2026-07-17 14:21:15 +00:00
Greyson LaLonde	ed91100a0f	refactor(skills): move Skills Repository to experimental + CREWAI_EXPERIMENTAL gate ... Moves the registry/cache pieces of PR #5867 under crewai.experimental.skills and the CLI commands under `crewai experimental skill`. The stable local-file skills feature (loader, parser, validation, models) stays in crewai.skills. Both entry points now require CREWAI_EXPERIMENTAL=1: - resolve_registry_ref() calls require_experimental_skills() before resolving - The `crewai experimental` CLI group raises UsageError when the flag is unset SkillDownloadStarted/CompletedEvent move out of crewai.events.types.skill_events into crewai.experimental.skills.events. * refactor(skills): move 'version' off SkillFrontmatter into metadata The skill version is now stored as `metadata.version` rather than a top-level field on `SkillFrontmatter`. A `before` validator lifts any top-level YAML `version:` into `metadata['version']` so existing SKILL.md files keep parsing.	2026-05-28 09:38:10 -07:00
alex-clawd	418afd29e7	feat: Skills Repository — registry, cache, CLI, and SDK integration (#5867) ... * feat: add Skills Repository — registry, cache, CLI, and SDK integration Adds a Skills Repository feature allowing users to publish, install, and use skills from the CrewAI registry with @org/skill-name refs. ## What's New ### SDK (lib/crewai/) - SkillFrontmatter: added optional 'version' field (backward compatible) - SkillCacheManager: manages ~/.crewai/skills/{org}/{name}/ with .crewai_meta.json tracking, path-traversal-safe tar extraction - SkillRegistry: parse @org/skill-name refs, local-first resolution (./skills/ > cache > download), interactive prompt on first use, CI-mode guard (CREWAI_NONINTERACTIVE/CI env vars) - Agent.skills and Crew.skills widened to accept str refs (@org/name) - set_skills() resolves registry refs with org-prefixed dedup keys - New events: SkillDownloadStartedEvent, SkillDownloadCompletedEvent ### CLI (lib/cli/) - crewai skill create <name> — context-aware (project vs standalone) - crewai skill install @org/name — downloads to ./skills/ or cache - crewai skill publish — ZIP + upload to org registry - crewai skill list — show installed skills ### PlusAPI (lib/crewai-core/) - Added SKILLS_RESOURCE, get_skill(), publish_skill(), list_skills() ### Scaffolding - crew and flow templates now include skills/ directory ### Tests - 91 SDK skill tests + 15 CLI skill tests, all passing * fix: address all CI failures and CodeRabbit review comments Lint: - Remove unused imports (click, pytest, json) - Replace try-except-pass with logging (S110) - Fix unprotected zipfile.extractall (S202) Security: - Path traversal: startswith → is_relative_to for tar extraction - Add path traversal protection to ZIP extraction via _safe_extract_zip - Both cache.py and CLI main.py hardened Type checker: - Fix import path: crewai.events.event_bus (not crewai_event_bus) - Remove unused type: ignore comments - Fix type mismatches in set_skills() variable types Code quality: - Fix f-string interpolation in SkillNotCachedError - Use ValidationError instead of Exception in test * style: ruff format + autofix remaining lint errors * refactor: reuse SDK parser and SkillCacheManager in CLI - _parse_frontmatter() now delegates to crewai.skills.parser.parse_frontmatter when available, with a minimal fallback for CLI-only installs - install() global cache path now reuses SkillCacheManager.store() instead of duplicating metadata writing logic * refactor: add _print_current_organization to SkillCommand (matches ToolCommand pattern) * fix: write .crewai_meta.json in fallback install path CodeRabbit caught that the ImportError fallback in install() didn't write cache metadata, making skills invisible to 'crewai skill list'. * fix: tighten @org/name ref validation to prevent path traversal Reject refs with multiple slashes (@org/a/b), dot segments (@../skill), or leading dots in org/name. Applied to both CLI install() and SDK parse_registry_ref() so the contract is enforced consistently. * fix: update test assertions to match tightened error messages * fix: align OSS client with AMP API contract - download_skill(): fetch download_url (presigned URL) instead of expecting inline base64. Falls back to 'file' field for compat. - Read 'latest_version' field, fall back to 'version' - Same fixes applied to CLI install() command * fix: publish as tar.gz (matches AMP content_type validation) + add zip fallback to SDK cache CLI publish: - _build_skill_zip → _build_skill_tarball (tar.gz format) - Content type: application/x-gzip (matches SkillVersion validation) SDK cache: - store() now tries tar.gz first, falls back to zip extraction - Added _safe_extract_zip for path-traversal-safe zip handling - Both formats work for download/install regardless of server format --------- Co-authored-by: João Moura <joaomdmoura@gmail.com>	2026-05-20 14:38:25 -03:00