Closes CLAW-526.\n\nSummary:\n- create pending skill versions and plugin releases that remain hidden until TruffleHog and ClawScan pass\n- preserve older CLI response compatibility while newer CLI output explains pending security checks\n- run prepublication worker promotion/blocking for skills and plugins\n- add local-auth coverage for clean skill/plugin publish and secret-positive skill rejection\n\nValidation on PR head d2482434:\n- local: bunx tsc -p packages/schema/tsconfig.json --noEmit\n- local: bunx tsc -p packages/clawhub/tsconfig.json --noEmit\n- local: bunx vitest run convex/lib/skillPublish.test.ts convex/publishAttempts.test.ts convex/skills.versions.public.test.ts convex/packages.public.test.ts packages/schema/src/schemas.test.ts scripts/security/run-prepublication-worker.test.ts scripts/security/prepublication-worker-workflow.test.ts\n- local: bun run ci:static\n- local: bun run ci:types-build && bun run ci:packages\n- GitHub: pr-gates, static, unit, packages, types-build, e2e-http, old-cli-publish, playwright-smoke, secret scanning, CodeQL, and Vercel preview passed\n\nKnown CI note:\n- unrelated local-auth shards continued to rotate failures under the already-diagnosed local Convex starvation issue; ignored per maintainer instruction.
Removes the SOULS content type and the SoulHub/onlycrabs.ai dual-site mode:
six Convex tables, the /api/v1/souls HTTP API, /souls routes, soul OG
images, GitHub soul backups, seeds, the VITE_FEATURE_SOULS flag, and the
site-mode machinery. Surviving skills-only code paths are de-branched and
simplified (tag resolution, publish form, nav/footer, ban flow, search).
Product decisions: /souls URLs and /api/v1/souls return plain 404s (no
redirect or 410 tombstone); reserved slugs souls/soulhub/onlycrabs stay.
Deploy prerequisite: clear the six soul tables and four storage blobs in
the prod Convex dashboard first (see PR description runbook).
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
* fix: restrict membership management to org publishers
* fix(api): ignore stale personal publisher memberships
* fix(api): reject stale personal publisher publish targets
* fix(api): reject stale personal publisher memberships
* fix(api): use personal publisher links for package access
* fix(api): guard personal publisher owner scopes
* fix: enforce publisher ownership for skill reads
* fix: narrow personal publisher dashboard owner
* fix: ignore stale personal package memberships
* fix: allow own legacy personal skill destination
* fix: preserve legacy personal package dashboards
* fix: preserve legacy personal skill dashboards
* fix: avoid redundant personal publisher boolean coercion
* fix: preserve legacy personal publisher access
* fix: include legacy direct packages in personal dashboard
* fix: close stale personal publisher ownership gaps
---------
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
- Enhanced AGENTS.md with clearer project structure and development commands.
- Updated CHANGELOG.md to reflect recent fixes and additions.
- Improved formatting in CONTRIBUTING.md for better readability.
- Adjusted package.json and configuration files for consistent command structure.
- Refined README.md and VISION.md for clarity and organization.
- Standardized code formatting in various TypeScript files for consistency.
These changes aim to enhance documentation clarity and maintainability across the repository.
The schema import in skills.ts (needed for getPage) transitively pulls
in authTables from @convex-dev/auth/server. All test files that import
from skills.ts need this export in their mock.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Patrick Erichsen