Community

SoduWork is developed in the open. You can ask questions, report problems, suggest features and send changes.

Where to talk​

Please search existing issues and discussions before opening a new one.

Report a bug​

Open a bug report

Include:

• Source version (commit or release), operating system, Python and Node.js versions
• How you run the Hub (start.py, Docker or your own setup)
• Steps to reproduce, what you expected, and what happened
• The harness (runtime) and model involved, if any
• Logs with secrets removed. For a source Hub, the log is startup.log in the data directory.

Use separate test accounts and made-up data. Do not paste API keys, passwords, tokens, private addresses or customer data, and do not attach screenshots that show personal information.

Suggest a feature​

Open a feature request

Describe the problem you want to solve and who has it. A concrete example helps more than a proposed solution. Maintainers reply in the issue; larger changes may be discussed in Discussions first.

Contribute​

Code​

1. Start a local instance with Run from source, and read the repository CONTRIBUTING.md. What the first release includes is set by tools/distribution/PUBLIC-SOURCE.json and docs/release-scope.md.

2. Open an issue or comment on an existing one before starting a large change.

3. Create a short-lived branch. Use separate test accounts, temporary ports and made-up data.

4. Describe the user problem, how to reproduce it and the expected behavior. Database changes need an Alembic migration; do not delete device identities, user data or public protocol fields.

5. Run the checks for what you changed:

   Area	Command
   Client	npm test in client/
   Admin console	npm run build and node --test tests/*.test.mjs in hub-frontend/
   Hub	python quality_gate.py --help in hub-backend/ to choose a gate
   Launcher	python -m unittest tools.dev.test_start_local
   Public source and third-party	node tools/check-public-source.cjs, node tools/check-third-party.cjs
   Docs and secrets	node tools/check-docs.cjs, python tools/security/scan_secrets.py --download

6. Add new public files to Git, then update the source manifest with node tools/check-source-manifest.cjs --write-manifest, check it with node tools/check-source-manifest.cjs, and commit the updated manifest.

7. Leave out logs, screenshots, databases, accounts, tokens, private addresses, installers and dependency caches.

8. In the pull request, describe the problem and behavior, the checks you actually ran and on which platform, and anything not covered. Test fixtures don't replace real-model or production acceptance.

Sign your commits​

The project uses the Developer Certificate of Origin 1.1 (DCO). Signing off a commit certifies that you have the right to submit the change under the project's license.

git commit -s -m "Fix upload retry after a timeout"

This adds a Signed-off-by: Your Name <you@example.com> line. Use your real name and an email address where you can be reached. To sign off commits you already made, run git commit --amend -s for the last commit, or git rebase --signoff main for all commits on your branch.

Documentation and translations​

The guides that ship with the source are in the repository's docs/ folder. To report a problem on this site, open an issue.

• Fix errors, unclear steps or broken links in any language.
• Keep Chinese and English pages in step. If you change one, note it in the pull request so the other can be updated.
• Write short sentences and give exact commands, paths and version numbers.

Plugins and Skills​

You can share plugins and Skills you built.

• Put each plugin in its own folder with plugin.json, a README and a license.
• Do not include secrets, internal addresses or customer data.
• Third-party material must keep its license and source. Do not submit material whose license does not allow redistribution.
• New dependencies need a recorded source, version and license.
• A new built-in Skill also needs an explicit update to the release scope in tools/distribution/PUBLIC-SOURCE.json.

See Plugin authoring for the package format.

Report a security issue​

Do not report security issues in public issues or discussions.

Report credential leaks, permission bypasses, arbitrary code execution and unauthorized access privately: open the repository's Security tab and choose Report a vulnerability (open the form). If you can't use GitHub, email soduwork@outlook.com with a subject starting with [Security].

Include the affected version, operating system, deployment method, minimal steps to reproduce, impact, and logs with secrets removed. Test only in an environment you control. Do not access other people's workspaces, runners or data.

After a fix is released, maintainers publish the impact and upgrade steps. See SECURITY.md.

Code of conduct​

Everyone taking part in the project follows the Code of Conduct (Contributor Covenant 2.1). To report unacceptable behavior, email soduwork@outlook.com.

Contributors​

Thank you to everyone who has contributed.

See everyone who has contributed on GitHub.

License​

SoduWork's own source is copyright MDiRi and released under the MIT license. Third-party code, dependencies and assets keep their own licenses. Documentation text on this site is licensed under CC BY 4.0, and code samples under MIT.

harness harnesses runtime runtimes 底座