1245 Commits
Author SHA1 Message Date
Patrick Erichsen 60b02c09f9 fix: stream legacy skill downloads (#3451)
* fix: stream legacy skill downloads

* fix: stream zip entries in bounded chunks

* fix: stream large archives through api owner

* fix: normalize streamed archive chunks

* fix: authenticate archive streaming handoff

* fix: authenticate archive manifest requests

* test: bound archive determinism fixture

* fix: align archive oidc trust with vercel targets

* fix: harden archive runtime boundaries

* test: isolate archive proxy credentials

* test: exercise streamed manifest size cap
2026-08-12 12:19:37 -07:00
Patrick Erichsen fb2515649a fix(search): bound rolling usage query batches (#3456) 2026-08-11 11:30:43 -07:00
Gio Della-Libera 82313c2bb1 feat: require exact ClawPack publication (#3359)
Accept artifact-only publication for experimental Claws so ClawHub can attest, retry, and serve the exact stored bytes. Preserve exact actor, owner, and digest identity across staged retries and validate current release state before reuse. Add durable contract documentation and real-stack publish, poll, download, and retry proof.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-08-09 12:37:04 -07:00
Gio Della-Libera 348851eeb9 feat(claws): align package layers with schema v1 (#3328)
Adds conventional harness profiles, package-root BOOTSTRAP.md, strict OpenClaw validation, portable path hardening, and an official upstream contract pin.
2026-08-09 07:46:06 -07:00
Vyctor H. Brzezowski 34350cd16d fix: restore homepage catalog discovery (#3418)
Restores homepage search and category discovery while preserving the canonical Trending feed contract. Adds the responsive control-group divider and closes #3417.
2026-08-06 17:58:34 -03:00
Patrick Erichsen 788ee762a0 fix: increase HTTP rate limit shard headroom (#3432) 2026-08-06 12:04:18 -07:00
Vyctor H. Brzezowski 3074701740 fix: rank native trending by downloads (#3424) 2026-08-05 16:52:35 -07:00
Yiğit ERDOĞAN cd09e33877 fix: Japanese searches skip the category and summary result tiers (#3363)
* fix: Japanese searches skip the category and summary result tiers

The pre-split in tokenize() treats U+30FC (ー) and U+3005 (々) as separators, so
a katakana word is torn into fragments before Intl.Segmenter can segment it:
"データベース" tokenizes as ["デ", "タベ", "ス"]. Two consequences follow.

Exploratory search requires every query token to be at least three characters
(EXPLORATORY_SEARCH_MIN_TOKEN_LENGTH in search.ts, skills.ts and packages.ts),
so katakana queries never reach the category, topic and summary tiers. And
getFirstSearchToken feeds normalizedDisplayNameFirstToken, an indexed range-scan
bound, which collapses to the single character "デ".

detectCJKLanguage in the same file already counts ー as katakana when it picks a
segmenter; the pre-split now agrees with it.

* fix: resynchronize digest first tokens and keep marks in the fallback

Widening the CJK class moves the first token of any name containing a
prolonged sound mark or an iteration mark. skillSearchDigest rows recompute
that field only when their skill is written, so already-stored rows keep the
old one-character token while search uses the new longer token as a range
index bound - the row stays on disk and out of recall.

Add a cursor-paginated resynchronization next to the existing digest backfills
in maintenance.ts, and stop the no-Segmenter fallback from emitting those two
marks as standalone tokens that exploratory matching discards.

* fix: space the search digest backfill batches apart

The catalog search page subscribes to skillSearchDigest, so a backfill that
reschedules itself with no delay drives reactive re-reads back to back for the
whole run. .agents/skills/clawhub-convex/SKILL.md asks for a delay between
backfill batches that write reactively subscribed tables.

The delay is an optional argument clamped the same way the batch size is, and it
follows repairLegacyPublisherOwnershipForUserHandler, which is the one backfill
in this file that already spaces its batches.

* fix: reindex the mirrored catalog's first tokens too

The skills.sh mirror persists its own normalizedSlugFirstToken and
normalizedDisplayNameFirstToken, derived through the same tokenizer, and external
candidate search range-scans both. Widening the katakana class therefore strands
mirrored rows exactly the way it stranded native digest rows, and the previous
backfill only paged skillSearchDigest.

skillsShMirror.ts had its own copy of the first-token rule. Both callers now share
getMirrorFirstSearchToken so the two cannot drift apart again.

* fix: require confirmation before the first-token backfills write

Both backfills defaulted dryRun to false, and their public admin actions
forward omitted arguments straight through. A bare
`npx convex run maintenance:backfillSkillSearchDigestFirstTokens` therefore
patched skillSearchDigest and scheduled every remaining page, against a table
catalog search subscribes to. An operator typo was an immediate production
apply rather than a preview.

Both now follow the contract the plugin catalog-digest resync already uses:
preview unless dryRun is explicitly false, reject an apply whose confirm token
does not match, and carry that token into the scheduled continuation so the
run does not stall on its own guard after the first page. The native and
mirror paths take separate tokens, so neither unlocks the other.
2026-08-05 16:30:28 -07:00
openclaw-barnacle[bot]andgithub-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 9009eae003 chore: update Convex AI files (#3274)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-05 16:06:40 -07:00
Patrick Erichsen 6381d789ab feat(admin): support org profile updates (#3416) 2026-08-05 12:32:55 -07:00
Peter Steinberger f9ea25e14f fix(api): qualify batch skill security verdicts by owner (#3409) 2026-08-05 08:47:19 -07:00
Patrick Erichsen 98a6e04e39 fix: resolve active skill across retained slug history (#3405) 2026-08-04 18:43:46 -07:00
Patrick Erichsen eb7aa36f80 fix: enforce publisher skill slug invariant (#3383) 2026-08-04 17:37:35 -07:00
Momo 1527462a5d fix: allow Convex base64 upload digests (#3395) 2026-08-04 14:09:42 -07:00
Patrick Erichsen 87ca030c30 fix: upload skill files directly to Convex (#3391)
* fix: upload skill files directly to Convex

* chore: prepare clawhub CLI 0.23.3
2026-08-03 20:37:01 -07:00
Patrick Erichsen 7571488ab3 fix: allow safe skill latest rollback (#3388)
* fix: allow safe skill latest rollback

* chore(release): prepare clawhub 0.23.2
2026-08-03 19:42:03 -07:00
Santiago fd9902b58b fix: search prints no results when a skills.sh row matches (#3379)
Normalize skills.sh installs into the canonical downloads field so released clients can parse and render mixed-source search results.
2026-08-03 19:10:44 -07:00
Patrick Erichsen 50c4ffc1a0 fix: bound prepublication scanner retries (#3353) 2026-08-01 17:26:49 -07:00
Patrick Erichsen 0fb07e5b99 feat: align skills.sh catalog presentation (#3370)
* feat: align skills.sh catalog presentation

* refactor: share skill detail shell with skills.sh

* test: seed skills.sh route fixtures locally

* refactor: share full skill detail page view

* feat: refine skills.sh detail presentation

* feat: refine skills.sh detail metadata

* fix: refine skills.sh detail spacing
2026-08-01 16:46:48 -07:00
Patrick Erichsen a643b75eca fix: reuse verified hourly native pools (#3368) 2026-08-01 00:34:03 -07:00
Patrick Erichsen c83f1711bd fix: verify bounded skills.sh Trending activation (#3366) 2026-07-31 19:46:16 -07:00
Patrick Erichsen a16ff751bb feat: notify plugin owners only for hard compatibility errors (#3365)
* chore: update plugin inspector to 0.3.20

* feat: gate plugin compatibility emails on hard errors
2026-07-31 17:37:52 -07:00
Patrick Erichsen 6dcff11402 fix: persist native trending activation pool (#3360) 2026-07-31 15:02:23 -07:00
Patrick Erichsen fb99952312 fix: reconcile native trending preflight timeouts (#3358) 2026-07-31 14:33:49 -07:00
Vincent Koc 1a3ee6e015 fix(publish): wait for definitive package publication 2026-08-01 01:00:02 +08:00
Patrick Erichsen a9b4494807 fix: refresh Trending download snapshots (#3355) 2026-07-31 09:58:38 -07:00
Patrick Erichsen 476feb2af1 fix: show actual downloads in Trending (#3354) 2026-07-31 09:09:48 -07:00
Patrick Erichsen a15f97470f fix: reconcile skills.sh activation timeouts (#3352) 2026-07-31 08:35:07 -07:00
Patrick Erichsen a5ffae2196 fix: reuse ready native trending preflight (#3350) 2026-07-31 04:26:59 -07:00
Patrick Erichsen 1a0f165291 fix: accept direct workflow oidc claims (#3348) 2026-07-31 03:30:49 -07:00
Vincent Koc c762d8ec6d fix: keep inspector target cache in workspace (#3347) 2026-07-31 17:41:54 +08:00
MomoandVincent Koc e9316c1c7d fix: plugin publishing no longer fails on invalid temp paths (#3344)
* fix: keep plugin inspector workspaces writable

* test: cover inspector temp fallback by platform

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-07-31 16:55:56 +08:00
Patrick Erichsen 41a7578990 fix: scan historical legacy package paths (#3337) 2026-07-30 21:59:30 -07:00
Patrick Erichsen 8b0e5b906e fix: bound canonical trending candidate memory (#3332) 2026-07-30 19:38:00 -07:00
Patrick Erichsen b7bd53a697 fix: advance plugin scan pagination between claims (#3331) 2026-07-30 19:15:16 -07:00
Patrick Erichsen e32c56b69e fix: bound native trending digest reads (#3330) 2026-07-30 18:35:39 -07:00
Patrick Erichsen e986ac3b02 fix: stream canonical trending sources (#3329) 2026-07-30 17:59:33 -07:00
Patrick Erichsen ee065b6d11 feat(admin): export plugin validation reports (#3326)
* feat(admin): add plugin validation report command

* test(admin): cover validation report edge cases

* test(admin): satisfy validation report static gate

* feat(admin): serve plugin validation reports
2026-07-30 16:08:40 -07:00
Patrick Erichsen 6afd21e1a2 feat: refresh beta plugin compatibility nightly (#3325)
* feat: reconcile nightly plugin validation state

* feat: refresh beta plugin validation nightly

* fix: scope nightly scan notification findings
2026-07-30 15:46:11 -07:00
Yiğit ERDOĞANandPatrick Erichsen 3979883360 fix: stop rejecting skills whose SKILL.md uses thematic breaks (#3297)
* fix: stop rejecting skills whose SKILL.md uses thematic breaks

The quality gate stripped frontmatter with a regex carrying the `m` flag, so
`^---` matched at every line start rather than only at the start of the
document. Frontmatter is optional when publishing, so a SKILL.md that opens
with a heading and uses `---` as an ordinary Markdown thematic break had
everything between its first two rules deleted before the body was measured.

The truncated body then fell under the word and character floors and the
publish was rejected outright with "Skill content is too thin or templated".
The same truncation also fed the structural fingerprint used for template-spam
detection.

The three other frontmatter parsers in the repository are all anchored to the
start of the document; this one is now consistent with them.

* fix: share canonical skill frontmatter parsing

---------

Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
2026-07-30 15:00:56 -07:00
Patrick Erichsen f491d5bb34 fix: resolve owner-scoped skill scans (#3322) 2026-07-30 14:48:44 -07:00
Patrick Erichsen f8901222a4 feat: validate plugins against stable OpenClaw (#3321)
* test: preserve generic plugin inspector remediation

* feat: show exact plugin validation reproduction command

* feat: reproduce plugin findings against exact target

* test: preserve static and compatibility findings

* feat: validate plugins against stable OpenClaw

* test: seed reproducible plugin findings

* chore: pin merged plugin inspector

* fix: preserve mixed validation targets

* fix: show every validation target

* fix: label findings with validation target
2026-07-30 14:36:26 -07:00
Patrick Erichsen 87b14acc61 fix: load official skills from curated index (#3314) 2026-07-30 10:26:32 -07:00
Patrick Erichsen dc51281c87 fix: preserve native trending through mirror rollout (#3313) 2026-07-30 10:16:28 -07:00
Patrick Erichsen 3282ff9ad7 fix: verify publishable skills.sh Trending count (#3310) 2026-07-30 08:50:25 -07:00
Patrick Erichsen 58b82dc6d2 fix: verify skills.sh activation corpus safely (#3309) 2026-07-30 05:42:11 -07:00
Vincent Koc 23af0934e4 chore: remove kitchen sink repair tooling (#3307) 2026-07-30 19:16:58 +08:00
Vincent Koc d890dfefe8 fix: guard kitchen sink latest repair (#3306) 2026-07-30 18:59:17 +08:00
Vincent Koc 5a1d2fe7bc fix: repair stale package latest pointers (#3303) 2026-07-30 18:19:59 +08:00
Vincent Koc be94d781ae fix(api): preserve latest across package backports (#3302) 2026-07-30 17:45:25 +08:00