Source-only release

Skill Recorder 0.5.0 is published from commit c7f2fe4402527a0eb7f4fc1b653bf438229bac61.

This release is source-only. No installers or portable binaries are attached; GitHub's generated archives contain the tagged repository source only.

Highlights

• Adds a persisted screen selector so recordings can target a specific display.
• Resolves displays through stable identity when Electron reassigns source IDs, shows monitor model labels, and falls back safely when a selected display is disconnected.
• Keeps the recorder controls at a stable width while their height is fitted automatically.
• Upgrades Archiver to 8 and refreshes transitive dependencies.
• Clarifies that transitive deprecation notices shown during source installation do not by themselves indicate an installation failure.

Security, compatibility, and licensing

• The dependency refresh preserves the exact-version lifecycle-script allowlist and canonical registry.npmjs.org lockfile URLs.
• Changed lockfile components use reviewed permissive terms (MIT, ISC, Apache-2.0, BSD-3-Clause, BlueOak-1.0.0, or MIT/CC0), and no changed component introduces a lifecycle install script.
• Existing notices and redistribution controls for GitHub Copilot CLI, Electron/Chromium, Sharp/libvips, ONNX Runtime, Tesseract, and Artistic-2.0 components remain enforced.
• Local release validation produced a 281-package Windows x64 license inventory with zero unresolved entries and passed the lockfile portability, test, build, eval typecheck, and license gates under Node.js 24.19.0 and npm 11.17.0.
• The exact release commit passed the Windows x64, Windows ARM64, macOS, and Ubuntu workflows.
• No data migration is required. Re-run the commit-pinned source installer below to update an existing source installation.

Installer script SHA-256

13b5d14ff6ecd9d519a708fa2663e11b297231955c78781efb69bc4d2a2e8bb6  install.ps1
bd8b5200a2c140c5a5ed9299d565ac72cee5420181774008977eaf75f210db1d  install.sh

Commit-pinned installation

Windows 11 x64 or ARM64

$commit="c7f2fe4402527a0eb7f4fc1b653bf438229bac61"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex

macOS or Ubuntu

commit="c7f2fe4402527a0eb7f4fc1b653bf438229bac61"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash

What's changed

• Reduce source-install deprecation-warning noise (92456db)
• Add screen selection for recordings (#61)
• Release 0.5.0 (#63)

Full changelog: v0.4.2...v0.5.0

Source-only release

Skill Recorder 0.4.2 is published from commit 93b3ccf887a46d3e3b91ed856d888d399b02c6e4.

This release is source-only. No installers or portable binaries are attached; GitHub's generated archives contain the tagged repository source only.

Highlights

This is a hotfix for installation failures on networks that block registry.npmjs.org.

• Fixes source installs failing with ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE on machines whose npm registry is configured globally, such as corporate-managed devices behind a proxy. The installers download a portable Node.js runtime, and portable Node archives do not ship the builtin npmrc that the Windows MSI uses to locate the machine's global npm configuration. The bundled npm therefore never saw the configured registry and fell back to the public one, which those networks block.
• Both installers now point the portable runtime at the machine's existing npm configuration, so a configured mirror is discovered automatically.
• npm ci failures now report which registry was actually contacted and how to configure a mirror.
• INSTALL.md documents the behaviour in a new "Networks that block registry.npmjs.org" section.

Users with no npm configuration are unaffected: the installers only apply the machine's configuration when a config file actually exists on disk.

Security, compatibility, and licensing

• The installers discover the registry configured on the machine; they never pin, override, or dictate one. A regression test enforces this.
• The lockfile's resolved URLs remain canonical registry.npmjs.org URLs, and its integrity hashes are verified whichever registry serves the packages, so a mirror cannot substitute different content.
• Dependency install-script policy is unchanged and still passed on the command line, which outranks any configuration file.
• No dependencies, bundled assets, or compliance-policy entries changed from v0.4.1.
• Local release validation produced a 227-package license inventory and passed the lockfile portability, license, build, typecheck, and test gates. The release commit passed the Windows and Non-Windows workflows.
• No data migration is required. Re-run the commit-pinned source installer below to update an existing source installation.

Installer script SHA-256

dfe8800cad133175e63b2671acef76923f2e9389dd3c05d3e7fb937c7378fcc3  install.ps1
1a7d35c54a6c7f11b12aad1021e0758045544b082e38d986337aecfd2c247e2b  install.sh

Commit-pinned installation

Windows 11 x64 or ARM64

$commit="93b3ccf887a46d3e3b91ed856d888d399b02c6e4"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex

macOS or Ubuntu

commit="93b3ccf887a46d3e3b91ed856d888d399b02c6e4"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash

What's changed

• Make the portable runtime honour the machine's npm configuration (#57)
• Release 0.4.2 (#58)

Full changelog: v0.4.1...v0.4.2

Source-only release

Skill Recorder 0.4.1 is published from commit 87fdf397ea85f07595b2645bc52cdbcda14eb36f.

This release is source-only. No installers or portable binaries are attached; GitHub's generated archives contain the tagged repository source only.

Highlights

• Fixes a Windows regression that could make the recorder window grow wider on every content-height update until it overflowed the screen.
• Corrects the Advanced Protection ready status so it accurately reports on-device without claiming multilingual support.
• Adds regression coverage for repeated Windows frame-style and content-size updates.

Security, compatibility, and licensing

• No dependencies, bundled assets, installer scripts, or compliance-policy entries changed from v0.4.0.
• The release commit passed Windows x64, Windows ARM64, macOS, and Ubuntu source-install, license, test, build, package, and architecture gates.
• Local release validation produced a 295-package license inventory and passed all 148 tests.
• No data migration is required. Re-run the commit-pinned source installer below to update an existing source installation.

Installer script SHA-256

afd0c3b9ef5c6cb3502edde05e7306f745192050535c022a337f848f33491c2a  install.ps1
6c60091ed9da414f2a81c151ad9769709ccc54aa77826089ed03cb15e3751d29  install.sh

Commit-pinned installation

Windows 11 x64 or ARM64

$commit="87fdf397ea85f07595b2645bc52cdbcda14eb36f"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex

macOS or Ubuntu

commit="87fdf397ea85f07595b2645bc52cdbcda14eb36f"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash

What's changed

• Advanced Protection status correction and Windows window-sizing fix (#51)
• Release metadata (#52)

Full changelog: v0.4.0...v0.4.1

Source-only release

Skill Recorder 0.4.0 is published from commit 7b0efa9534d59efb4e488a9fe855862ecba45844.

This release is source-only. No installers or portable binaries are attached; GitHub's generated archives contain the tagged repository source only.

Highlights

• Adds on-device, pre-send sensitive-detail detection and redaction, including OCR and secret scanning.
• Adds a generic Agent Skill export target, a centralized architecture registry, and data-driven skill placement.
• Improves recorder resilience for stream and file-system failures and gives described skills clearer narrated intent names.
• Hardens commit-pinned source installation with canonical lockfile URLs, reviewed dependency lifecycle scripts, verified Electron downloads, and Windows file-lock retries.

Security and licensing

• Retains main's Dependabot remediations for tar, adm-zip, and fast-uri, plus the reviewed Sharp 0.35.3 / sharp-libvips compliance update.
• Includes the reviewed notices, license texts, provenance, and corresponding-source policy for Tesseract.js, Tesseract.js-core, tessdata, Electron/Chromium, Sharp/libvips, and their relevant transitive/native materials.
• The release candidate produced a 295-package license inventory and passed Windows x64, Windows ARM64, macOS, and Ubuntu compliance gates.

Installer script SHA-256

afd0c3b9ef5c6cb3502edde05e7306f745192050535c022a337f848f33491c2a  install.ps1
6c60091ed9da414f2a81c151ad9769709ccc54aa77826089ed03cb15e3751d29  install.sh

Commit-pinned installation

Windows 11 x64 or ARM64

$commit="7b0efa9534d59efb4e488a9fe855862ecba45844"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex

macOS or Ubuntu

commit="7b0efa9534d59efb4e488a9fe855862ecba45844"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash

What's changed

• Recorder stream-error containment and recovery (#21)
• Narrated-goal intent naming (#25)
• External target architecture registry (#28)
• Dependency security remediations (#34)
• Sharp 0.35.3 and compliance hardening (#36)
• Portable source-install hardening (#46)
• Data-driven skill placement (#44)
• Generic Agent Skill export target (#47)
• On-device sensitive-detail detection and redaction (#32)
• Release integration (#48)

Full changelog: v0.3.1...v0.4.0

Skill Recorder v0.3.1

This is a source-only patch release. No prebuilt application, installer, or portable binary is attached. GitHub provides the tagged source archives, and the commands below build the exact release commit locally.

Fixed

• The Windows source installer now handles dependency paths longer than legacy MAX_PATH while moving and cleaning its staging tree.
• The extracted source is renamed to a shorter build path before npm ci creates deeply nested dependencies.
• Temporary-file cleanup can no longer hide the original installation error.
• PowerShell 5.1 regression coverage exercises a path longer than 260 characters and a read-only dependency file.

Upgrade and compatibility notes

• Windows users should use v0.3.1 instead of v0.3.0. The v0.3.0 Windows command pins the defective installer and cannot receive this correction in place.
• Existing successful installations remain usable. Re-run the command below to install the corrected revision.
• macOS and Ubuntu behavior is unchanged.
• No dependencies or compliance boundaries changed.

Release identity

• Tag: v0.3.1
• Commit: 32fd0b57e02c3ea1e016cca0d64e59052e93a9b9

Installer script SHA-256 values:

f0251c09a7c3481b15850f77a512bd95850652b1d0991804290d16bc70ecf65d  install.ps1
cda37c728b8bf8341075d4fb6225f4387f22df1ef880a172f186bbd1aa19481d  install.sh

Install from the exact release

Windows PowerShell:

$commit="32fd0b57e02c3ea1e016cca0d64e59052e93a9b9"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex

macOS or Ubuntu:

commit="32fd0b57e02c3ea1e016cca0d64e59052e93a9b9"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash

For the inspect-first procedure, use the immutable installation guide and compare the downloaded script with the hash above.

Licensing boundary

The MIT license covers Skill Recorder's own code. Third-party components remain under their respective licenses and notices. The source installers retain applicable legal materials in the local installation. A locally assembled application is for local execution only and must not be redistributed as a release artifact.

Skill Recorder v0.3.0

This is a source-only release. No prebuilt application, installer, or
portable binary is attached. GitHub provides the tagged source archives, and
the commands below build the exact release commit locally.

Highlights

• The Windows source installer now saves a Skill Recorder (Source) shortcut
  on your desktop, in addition to the existing Start Menu entry. It resolves
  the real desktop folder, so OneDrive-redirected desktops work correctly.
• The installer finishes with a confirmation that lists exactly where both
  shortcuts were saved, so it is clear how to reopen the tool later.
• Shortcut creation is no longer fatal. If Windows refuses to write a shortcut,
  the installer reports a warning instead of discarding an installation that
  already passed every integrity, license, and build check.
• Set SKILL_RECORDER_NO_DESKTOP_SHORTCUT=1 to keep only the Start Menu entry.
  The published one-line commands are unchanged.
• No redundant downloads. Re-running the same commit already reused the
  installed revision, and now says so plainly. An attempt that failed part-way
  used to download everything again; the portable Node.js archive and the pinned
  source archive are now kept in <install root>\cache and reused on the next
  attempt.

Cached files are re-verified by SHA-256 before use and discarded if they do
not match: the Node.js archive against the SHASUMS256.txt that nodejs.org
publishes, re-fetched on every run, and the source archive against a digest
recorded at download time, on top of the existing commit-directory and
required-path checks. Entries are deleted once the revision is installed, so the
cache only ever holds work from an interrupted attempt. Deleting it is always
safe.

Upgrade and compatibility notes

• Upgrading is optional. v0.2.1 installations keep working; re-run the command
  below with this release's commit to pick up the desktop shortcut.
• Existing shortcuts are refreshed in place, so they point at this revision.
• Windows uninstall now has one extra step. INSTALL.md documents removing the
  desktop .lnk alongside the Start Menu one.
• No new dependencies and no third-party code were added. Shortcuts use the
  built-in Windows WScript.Shell COM object and existing .NET APIs, and the
  caching change only adds verification steps to the existing verify-then-build
  chain.
• macOS and Ubuntu behaviour is unchanged in this release.

Release identity

• Tag: v0.3.0
• Commit: fc5274fa5a5257dbf092602280bfd506eb7ba5ee

Installer script SHA-256 values:

ff3a6e03936f6c7d1aeddb32829be2fe7a9a2574e614d5145f65745f5b8c1530  install.ps1
a67893701328c14f74b8694d9ab7248b73fdf0076a8631ef9a87d15e9692e481  install.sh

Install from the exact release

Windows PowerShell:

$commit="fc5274fa5a5257dbf092602280bfd506eb7ba5ee"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex

macOS or Ubuntu:

commit="fc5274fa5a5257dbf092602280bfd506eb7ba5ee"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash

The safer procedure is to download and inspect the script, verify its SHA-256
against the values above, and only then execute it. See the immutable
installation guide.

The source installers do not require administrator access or a global Node.js
or Copilot CLI installation. GitHub Copilot authentication, entitlement, and
network access are still required.

Licensing boundary

The MIT license covers Skill Recorder's own code. Third-party components remain
under their respective licenses and notices. The source installers retain the
applicable legal materials in the local installation. A locally assembled
application is for local execution only and must not be redistributed as a
release artifact.

Maintainers should follow the immutable
release runbook
before publishing later versions or any binary artifact.

Skill Recorder v0.2.1

This is a source-only release. No prebuilt application, installer, or
portable binary is attached. GitHub provides the tagged source archives, and
the commands below build the exact release commit locally.

Highlights

• Sign in to GitHub Copilot from the app. Skill Recorder installs the Copilot
  CLI as an application dependency, so a source installation has no global
  copilot command. A failed analysis or build now says so plainly and offers
  Sign in to Copilot, which opens a terminal running the bundled CLI's
  login command and prints that command so it can also be run by hand.
• The readiness check resolves the bundled Copilot CLI before falling back to
  PATH, so a source installation no longer reports GitHub Copilot: missing
  while analysis works.
• The macOS source installer now installs a relaunch app bundle.

Upgrading is recommended for anyone who installed with the commit-pinned
source installers and was told to run a copilot command that does not exist
on their machine.

Release identity

• Tag: v0.2.1
• Commit: 790da396d881a4810a8831a804c3c5b848f71a5b

Installer script SHA-256 values:

873b9601e998b710e9db455e60e455ea57e34c3470c75c9bbcfc34058343dcae  install.ps1
a67893701328c14f74b8694d9ab7248b73fdf0076a8631ef9a87d15e9692e481  install.sh

Install from the exact release

Windows PowerShell:

$commit="790da396d881a4810a8831a804c3c5b848f71a5b"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex

macOS or Ubuntu:

commit="790da396d881a4810a8831a804c3c5b848f71a5b"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash

The safer procedure is to download and inspect the script, verify its SHA-256
against the values above, and only then execute it. See the immutable
installation guide.

The source installers do not require administrator access or a global Node.js
or Copilot CLI installation. GitHub Copilot authentication, entitlement, and
network access are required; this release makes that sign-in reachable from
the app itself.

Licensing boundary

The MIT license covers Skill Recorder's own code. Third-party components remain
under their respective licenses and notices. The source installers retain the
applicable legal materials in the local installation. A locally assembled
application is for local execution only and must not be redistributed as a
release artifact.

Maintainers should follow the immutable
release runbook
before publishing later versions or any binary artifact.

Skill Recorder v0.2.0

This is a source-only release. No prebuilt application, installer, or
portable binary is attached. GitHub provides the tagged source archives, and
the commands below build the exact release commit locally.

Highlights

• Fixes source installation on Windows PowerShell 5.1 by using compatible
  native architecture detection and Node.js release selection.
• The complete source installer now runs in CI under Windows PowerShell 5.1 on
  both Windows x64 and ARM64.
• Replaces separate skill inputs with editable inline value pills.
• Makes automation export deterministic and checks for unresolved value tokens.
• Keeps captured native tools as read-only annotations in the review UI.

The macOS and Ubuntu installer was not affected by the v0.1.0 Windows issue.

Release identity

• Tag: v0.2.0
• Commit: 14c54d0a26e55c02e146c3b03c4d4bd717538293

Installer script SHA-256 values:

873b9601e998b710e9db455e60e455ea57e34c3470c75c9bbcfc34058343dcae  install.ps1
5e3fc341df54ad2a112a95432a65c2b4dd4e1e72f8c2291838d796278783c475  install.sh

Install from the exact release

Windows PowerShell:

$commit="14c54d0a26e55c02e146c3b03c4d4bd717538293"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex

macOS or Ubuntu:

commit="14c54d0a26e55c02e146c3b03c4d4bd717538293"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash

The safer procedure is to download and inspect the script, verify its SHA-256
against the values above, and only then execute it. See the immutable
installation guide.

The source installers do not require administrator access or a global Node.js
or Copilot CLI installation. GitHub Copilot authentication, entitlement, and
network access are required.

Licensing boundary

The MIT license covers Skill Recorder's own code. Third-party components remain
under their respective licenses and notices. The source installers retain the
applicable legal materials in the local installation. A locally assembled
application is for local execution only and must not be redistributed as a
release artifact.

Maintainers should follow the immutable
release runbook
before publishing later versions or any binary artifact.

Skill Recorder v0.1.0

This is a source-only release. No prebuilt application, installer, or
portable binary is attached. GitHub provides the tagged source archives, and
the commands below build the exact release commit locally.

Highlights

• Commit-pinned source installation on Windows 11 x64/ARM64, macOS, and Ubuntu.
• Verified Node.js and Electron inputs with lockfile-pinned npm dependencies.
• Fail-closed recursive license inventory and reviewed third-party versions.
• Exact Electron/Chromium notices plus corresponding source, patches, build
  information, and relinking materials for components that require them.
• Native Windows, macOS, and Ubuntu CI, including end-to-end source installation.
• Documented inspect-first installation, development, update, uninstall, and
  future release procedures.

Release identity

• Tag: v0.1.0
• Commit: 0ab8e2d2f99eb841a49bd5e3e2f0f991da5d9d76

Installer script SHA-256 values:

2ebcdf650bda680a7f8e8308f68865d74369cc7754f74c779b8fd2381d908a63  install.ps1
5e3fc341df54ad2a112a95432a65c2b4dd4e1e72f8c2291838d796278783c475  install.sh

Install from the exact release

Windows PowerShell:

$commit="0ab8e2d2f99eb841a49bd5e3e2f0f991da5d9d76"; $env:SKILL_RECORDER_COMMIT=$commit; irm "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.ps1" | iex

macOS or Ubuntu:

commit="0ab8e2d2f99eb841a49bd5e3e2f0f991da5d9d76"; curl -fsSL "https://raw.githubusercontent.com/microsoft/skill-recorder/$commit/install.sh" | SKILL_RECORDER_COMMIT="$commit" bash

The safer procedure is to download and inspect the script, verify its SHA-256
against the values above, and only then execute it. See the immutable
installation guide.

The source installers do not require administrator access or a global Node.js
or Copilot CLI installation. GitHub Copilot authentication, entitlement, and
network access are required.

Licensing boundary

The MIT license covers Skill Recorder's own code. Third-party components remain
under their respective licenses and notices. The source installers retain the
applicable legal materials in the local installation. A locally assembled
application is for local execution only and must not be redistributed as a
release artifact.

Maintainers should follow the immutable
release runbook
before publishing later versions or any binary artifact.