admin/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-08-14 00:47:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,560 Commits 189 Branches 496 Tags
main
Commit Graph
100 Commits
Author SHA1 Message Date
Gio Della-Libera 82313c2bb1 feat: require exact ClawPack publication (#3359) 
Accept artifact-only publication for experimental Claws so ClawHub can attest, retry, and serve the exact stored bytes. Preserve exact actor, owner, and digest identity across staged retries and validate current release state before reuse. Add durable contract documentation and real-stack publish, poll, download, and retry proof.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-08-09 12:37:04 -07:00
Sergio PeschieraandPatrick Erichsen 6d935f0595 feat: forward package catalog metadata in publish workflow (#3074) 
* feat: forward package catalog metadata in publish workflow

* docs: make package publish metadata example event-safe

* fix: preserve package metadata clearing

---------

Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
 2026-08-05 21:03:32 -07:00
Conor BronsdonandClaude Fable 5 fd3bef4ae7 docs: document skill categories and topics (#3380) 
* docs: document skill categories and topics

Add a Catalog metadata section to docs/publishing.md covering --categories
and --topics, the 14 valid category slugs, the limits ClawHub enforces, the
reserved topic names, the `other` default, and how stored values change on a
later publish. Cross-reference it from the skill publish and sync entries in
docs/cli.md.

Values read from packages/schema/src/catalogMetadata.ts,
convex/lib/skillPublish.ts, and packages/clawhub/src/cli.ts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: cover the CI and plugin paths for catalog metadata

Three gaps in the first pass, all the same shape as the one this PR set
out to fix -- a way to publish with no way to set catalog metadata:

The reusable skill-publish.yml workflow has no categories or topics
input. It builds the command with --owner and --tags only, so a catalog
repo publishing through CI lands every skill in `other`, exactly like
sync. The new section sat directly under the workflow snippet and said
"set both when you publish," which read as though the block above it
could. Documented in both files.

`package publish` takes the same two flag names against
PLUGIN_CATEGORY_DEFINITIONS -- a different 12-slug list documented
nowhere -- so a reader who followed the new link would try
`development` and have the publish rejected. The cli.md entry now names
the plugin slugs and says the topic rules are shared, which they are:
convex/packages.ts:8585 resolves through resolvePluginCategories but
reuses normalizeCatalogTopics.

Moved the metadata section above the catalog-repo prose so the flags sit
with the command they belong to, and gave the CI content its own
heading rather than leaving it to trail the section. No wording in the
moved block changed.

Also two enforced rules the first pass omitted: repeats are dropped
rather than rejected and are matched after normalization (so `git,Git`
is one topic, and both limits count what survives), and topics cannot
contain invisible formatting characters. Qualified the 3-category limit,
which is applied after `other` is dropped, so `other,development,
operations` stores two rather than failing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: scope plugin-category validation to code and bundle plugins

Review caught that the package-publish bullet claimed every publish
validates --categories against the 12 plugin slugs. The claw family
does not: convex/packages.ts branches on family === "claw" and stores
the declared slugs without resolvePluginCategories, while
normalizeCatalogTopics still runs for every family. The bullet now
limits the slug check to code and bundle plugins, links docs/claws.md
for the exception, and keeps the shared-topic-rules claim, which held.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-05 15:51:27 -07:00
Patrick Erichsen 7571488ab3 fix: allow safe skill latest rollback (#3388) 
* fix: allow safe skill latest rollback

* chore(release): prepare clawhub 0.23.2
 2026-08-03 19:42:03 -07:00
Vincent Koc 1a3ee6e015 fix(publish): wait for definitive package publication 2026-08-01 01:00:02 +08:00
Deepak JainandPatrick Erichsen 9bceec249e fix: add exact and paginated prefix skill discovery (#2969) 
* fix: add exact and prefix skill search modes

* docs: document exact and prefix skill search

---------

Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
 2026-07-28 18:11:58 -05:00
Patrick Erichsen 0f84533e9c feat: add permanent skills.sh mirror storage (#3227) 
* feat: add staged skills.sh mirror storage

* ci: allow guarded CLAW-563 Test deploy

* ci: expose guarded Test deploy diagnostics

* ci: defer branch guard to deploy step

* ci: deploy CLAW-563 PR head to Test

* ci: admit CLAW-563 PR Test job

* fix: make mirror source recovery durable

* ci: trigger labeled mirror load

* feat: activate mirror search queries

* fix: tighten mirror source typing

* fix: bypass protected Test mirror proof

* feat: attribute skill metrics by source

* feat: present stars as bookmarks

* style: format mirror proof changes

* fix: bypass protected mirror readback

* fix: resume mirror past missing scanner pages

* fix: fetch skills.sh mirror audits from api

* fix: validate structural skills.sh identities

* fix: resolve ambiguous skills.sh mirror identities

* feat: stabilize skills.sh mirror ingestion

* fix: account mirror identity conflicts in proof

* fix: quarantine invalid skills.sh detail ids

* fix: resume skills.sh mirror proof

* fix: preserve skills.sh mirror provenance

* fix: recover exact skills.sh mirror runs

* fix: recover stale skills.sh mirror runs

* fix: normalize skills.sh mirror topic facets

* feat: prove complete skills.sh leaderboard mirror

* fix: canonicalize skills.sh source page hashes

* test: enable skills.sh rollout in mirror tests

* ci: skip unrelated Test deploy pull requests

* fix: preserve Vercel preview marker in Test deploy

* fix: tighten Test deploy and metric reconciliation

* fix: bound mirror detail proof pages

* fix: delegate controlled mirror rate limits

* fix: preserve mirror reconciliation progress

* fix: release mirror retry responses

* fix: preserve stale mirror replay state

* fix: authenticate mirror source starts

* fix: delegate mirror identity rate limits

* ci: trigger mirror proof when labeled

* ci: couple mirror deploy and proof opt-in

* fix: admit permanent Vercel Test runtime

* fix: pass Test target to Vercel runtime

* test: align bookmark sync browser labels

* fix: preserve skills.sh source accounting

* fix: preflight active mirror runs

* fix: bind mirror snapshot accounting

* fix: reject truncated replay hashes

* fix: preserve live mirror overlay metadata
 2026-07-24 14:32:00 -05:00
Patrick Erichsen 8d8e99a65f feat: make owner version deletion reversible (#3199) 2026-07-20 21:18:35 -07:00
Patrick Erichsen 3097319ef6 fix: publish complete skill artifacts (#3196) 
* fix: preserve complete skill artifacts

* test: align artifact metadata expectations

* fix: harden complete skill artifact handling

* fix: close complete artifact review gaps

* fix: preserve legacy skill file metadata hints

* fix: close artifact presentation review gaps

* fix(cli): preserve legacy skill file collector export

* refactor: centralize artifact upload helpers

* fix: preserve artifact scan and publish bounds

* fix: scan complete published text artifacts

* fix: harden artifact download presentation

* test: avoid secret-like fixture text

* refactor: preview artifacts by content

* chore(deps): patch transitive audit advisories
 2026-07-20 15:54:47 -07:00
Patrick Erichsen bbe887faac feat(cli): restore skill sync command 
Restores the ClawHub CLI sync command as a one-way skill publish workflow without install/download telemetry updates.
 2026-06-22 18:45:59 -07:00
Jesse Merhi 379c1871f4 Add skill and plugin download activity graphs 
Restore downloads as the public activity metric and add deferred 30-day download graphs for skills and plugins.
 2026-06-22 11:59:30 +10:00
Patrick Erichsen 11ad31aa4e feat: scope skill slugs by owner (#2299) 
* feat: scope skill slugs by owner

* test: cover owner-scoped skill slug publishes

* feat: scope skill slugs by owner

* fix: restore owner-scoped skill ci

* fix: keep package names separate from skill slugs
 2026-06-17 15:31:40 -07:00
Patrick Erichsen e3e5705d89 feat(cli)!: remove sync command (#2669) 
* feat(cli)!: remove sync command

* feat(cli): reconcile skill publishes

* chore: release clawhub cli 0.22.0

* fix(cli): publish new skills after resolver miss

* feat(workflow)!: remove bump input
 2026-06-15 18:22:52 -07:00
Patrick Erichsen f366269519 feat: add owner version deletion 
Add owner-only one-way deletion for individual skill versions and plugin releases, with CLI --version support, latest/only-version guards, and browser proof.
 2026-06-15 17:52:28 -07:00
Patrick Erichsen 44ce895b44 fix: use installs across public adoption surfaces (#2653) 
* fix: use installs across public adoption surfaces

* fix(cli): expose install-based explore sorting

* test: type legacy publisher sort coverage

* fix: preserve install compatibility paths

* fix: bound legacy hover install fallback

* docs: stop advertising downloads sort

* fix: preserve install rollout compatibility

* chore: update ws security override

* test: stub image optimizer in local browser smoke

* fix: normalize legacy download sort aliases
 2026-06-15 11:06:29 -07:00
Patrick Erichsen ee1c80202f fix: prefer app auth for trusted publisher repo lookup (#2623) 2026-06-12 16:31:43 -07:00
Patrick Erichsen 3b53ddbdbe chore: rename ClawHub admin package (#2599) 2026-06-11 16:49:17 -07:00
Patrick Erichsen 9a0671034c feat: expose package trusted publisher CLI commands (#2601) 
* feat: expose package trusted publisher CLI commands

* docs: document package trusted publisher commands

* test: isolate clawhub artifact default help
 2026-06-11 16:43:00 -07:00
Jesse Merhi d6500794c6 feat: rank skills by installs and dedupe install telemetry (#2535) 2026-06-11 14:22:11 +10:00
Patrick Erichsen 27faf50992 feat: surface author remediation for plugin validation 
Adds author-remediation metadata and ClawHub validation UI/CLI/email handling for Plugin Inspector findings.
 2026-06-09 21:09:25 -07:00
Patrick Erichsen be70ae5e9f Publish public Plugin Inspector findings (#2525) 
* feat: gate plugin publishes with inspector warnings

* fix: harden plugin publish inspector gate

* feat: publish public plugin inspector findings

* fix: refine plugin inspector publish errors

* feat: add package validation command

* fix: refine plugin validation findings UI

* fix: scan only latest plugin releases nightly

* feat: add dry run for nightly plugin inspection

* test: fix plugin validation tab e2e matcher
 2026-06-08 19:41:48 -07:00
Patrick Erichsen 8e1bad4ac1 feat: improve account appeal notifications (#2520) 
* feat: improve account appeal notifications

Adds Resend-backed account-action emails for bans/restores, public-safe ban reason summaries, scanner-triggered appeal scan guidance, and inline banned-account sign-in appeal messaging.

Autoreview findings addressed:

- [P2] Wire restored-account email into unban flow

- [P2] Add the scan upload test to the CI selection

* feat: quarantine malicious artifact uploads

* fix: warn on repeated malicious rejections

* fix: route banned sign-ins to appeal page

* feat: add stored scan report downloads

* chore: bump clawhub cli to 0.20.0

* test: cover malicious skill ban journey

* test: align deletion cleanup expectations after merge

* fix: hide deleted account packages before cleanup

* fix: finalize appeals moderation flow
 2026-06-06 16:55:23 -07:00
Patrick Erichsen bd30b182d7 feat: show skill scan queue progress 2026-06-05 11:35:08 -07:00
Patrick Erichsen e8cfbddf17 feat: add clawhub scan command (#2479) 
* docs: design clawhub scan command

* docs: plan clawhub scan command

* feat: add clawhub scan command

* fix: prune ephemeral scan uploads

* fix: avoid scan route slug collision
 2026-06-03 16:05:11 -07:00
Patrick Erichsen 9aaab158cb feat(cli): print stored auth token (#2454) 2026-05-30 21:11:51 -05:00
Patrick Erichsen 6fc5bb7cd8 feat: add reusable skill publish workflow (#2450) 
* feat: add reusable skill publish workflow

* test: cover exact skill sync roots

* fix: keep skill workflow scans exact
 2026-05-30 20:26:51 -05:00
Patrick Erichsen ff48b2cc70 feat!: remove ClawScan note feature (#2432) 
BREAKING CHANGE: ClawScan publisher notes are no longer accepted by publish APIs, CLI commands, schema packages, or UI flows.
 2026-05-28 16:00:45 -05:00
Patrick Erichsen 0b888a2d13 feat: add self-serve publisher creation (#2324) 2026-05-19 14:15:54 -07:00
Peter Steinberger 6c15a481d0 fix: improve search ownership and profile saves 2026-05-13 08:33:19 +01:00
Patrick ErichsenBunsDevcopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
 		c51cfe2459 Add publisher notes and unify ClawScan review pages (#2111) 
* feat: store clawscan notes on artifact versions

* feat: include clawscan notes in evaluation

* feat: unify ClawScan report layout for plugins and skills

* feat: render clawscan notes in publish and security UI

* chore: document local moderation seed fixtures

* fix: remove appeal surfaces

* fix: remove owner-requested rescans

* feat: add publisher note rescan flow

* fix: resolve main rebase fallout

* fix: address review feedback - breadcrumbs, tab guard, merge target, test matcher

Agent-Logs-Url: https://github.com/openclaw/clawhub/sessions/7bfbe5cf-0b8e-44f9-bf0a-e6235f7f3f1d

Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>

* fix: address pr ci fallout

* fix: resolve ci after main rebase

* fix: make package VT AI verdicts advisory

* fix: restore skill sidebar actions

* fix: resolve clawscan ui and ci checks

* fix: align security settings access and pending audits

* fix: restore skill version tabs

* fix: show publisher names in sidebars

* fix: align plugin install command styling

* fix: clarify virustotal audit copy

* fix: polish security summaries

* test: align security UI expectations

* docs: document clawscan note workflow

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
 2026-05-11 14:14:12 -07:00
Peter Steinberger 8287c494b2 fix: align publisher lifecycle permissions 2026-05-11 14:20:37 +01:00
Peter Steinberger 003d243ccc fix: allow staff security rescans 2026-05-10 05:23:41 +01:00
Peter Steinberger 227cce18a0 feat: complete CLI device login flow 
Complete CLI device login with Convex-backed device-code endpoints, the web approval page, API URL discovery, endpoint rate limiting, and approval state hardening.\n\nTests:\n- bunx vitest run convex/httpApi.handlers.test.ts packages/clawhub/src/deviceAuth.test.ts\n- bun run --cwd packages/clawhub test:src -- src/deviceAuth.test.ts\n- bunx tsc --noEmit\n- bunx tsc -p packages/schema/tsconfig.json --noEmit\n- bunx tsc -p packages/clawhub/tsconfig.json --noEmit\n- bun run ci:static\n- bun run ci:types-build\n- bunx convex codegen\n\nCo-authored-by: Lumen <openclaw@openclaw-secure.local>
 2026-05-09 08:42:04 -04:00
Deepak Jain ab3ede496d feat(cli): add per-skill pinning 
Add per-skill CLI pinning and harden install semantics so pinned skills cannot be overwritten by forced installs.\n\nTests:\n- bunx vitest run packages/clawhub/src/cli/commands/skills.test.ts packages/clawhub/src/skills.test.ts packages/schema/src/schemas.test.ts\n- bun run --cwd packages/clawhub verify:build\n- bun run ci:static\n- bunx tsc -p packages/schema/tsconfig.json --noEmit\n- bunx tsc -p packages/clawhub/tsconfig.json --noEmit\n\nCo-authored-by: deepujain <deepujain@users.noreply.github.com>
 2026-05-09 08:35:41 -04:00
Jason b6875e60f6 fix(skills): repair merge ownership and slug reservations 
Fix publisher-owned skill merge authorization, bound historical slug redirects, protect reserved namespaces, and add expiring owner-unpublish slug reservations.

Maintainer follow-up: require current owner-hide provenance before honoring an unpublished slug reservation, clear stale reservation fields on non-owner hide paths, and add regressions for stale moderation-owned reservations.

Verification:
- bunx vitest run convex/skills.rateLimit.test.ts convex/skills.slugAvailability.test.ts convex/skills.undeleteGate.test.ts --reporter verbose
- bun run format:check
- bun run lint
- bunx tsc --noEmit
- bunx tsc -p packages/schema/tsconfig.json --noEmit
- bunx tsc -p packages/clawhub/tsconfig.json --noEmit
- bunx convex codegen
- bun run test
- bun run --cwd packages/clawhub test:src -- src/cli/commands/delete.test.ts --reporter verbose
- git diff --check
- GitHub CI: static, packages, types-build, unit, e2e-http, playwright-smoke, CodeQL, secret scanning all passed on 2d0564d1

Co-authored-by: fuller-stack-dev <263060202+fuller-stack-dev@users.noreply.github.com>
 2026-05-09 04:55:32 -04:00
Momoandmomothemage 5b63d5df60 fix: harden skill owner migration 
Harden skill owner migration across UI, CLI, API, stats, backups, and docs.

Co-authored-by: momothemage <niuzhengnan@163.com>
 2026-05-08 12:23:05 -04:00
Patrick Erichsen 8c86d6f570 Fix plugin publish ownership visibility (#2073) 
* fix: clarify plugin publish ownership state

* test: tolerate publish route migration in prod smoke

* fix: reserve publish route collisions

* fix: preflight package scope owner mismatches in CLI

* fix: keep package scope validation server-side

* docs: explain ClawHub publishing flow

* fix: include publishing docs link in scope errors

* fix: centralize docs links

* fix: build docs links with URL

* fix: shorten package scope docs hint
 2026-05-07 19:03:40 -07:00
Patrick Erichsen 86898837fb docs: split ClawHub public docs from specs (#2095) 
* docs: split clawhub docs source

* docs: make clawhub docs product-facing

* docs: refine public clawhub docs routes
 2026-05-07 18:54:47 -07:00
Patrick Erichsen 0749f16499 feat: split moderator commands into private cli 2026-05-06 19:05:07 -07:00
Patrick Erichsen cab18339e6 docs: align moderation wording with moderator role 2026-05-06 16:42:15 -07:00
Patrick Erichsen c4d1fcdbc6 feat: add skill artifact moderation cases 2026-05-06 15:22:54 -07:00
Peter Steinberger 6925ec761c fix(cli): support org-owned skill publishes 2026-05-06 07:00:40 +01:00
Patrick Erichsen 0c7607bd64 feat: allow package owners to delete plugins 2026-05-05 22:37:19 -07:00
Peter Steinberger 768a50149e fix: support monorepo package publishes 2026-05-03 21:04:34 +01:00
Vincent Koc 7266f4f927 docs(packages): clarify plugin package metadata 2026-05-02 11:39:43 -07:00
Vincent Koc cb320fe2ab docs(packages): document official migrations 2026-05-02 11:02:35 -07:00
Vincent Koc 63164eb762 docs(cli): document package migration status 2026-05-02 10:53:54 -07:00
Vincent Koc 28da510571 feat(packages): resolve package appeals 2026-05-02 10:50:57 -07:00
Vincent Koc 6e5578ee6d feat(packages): submit package appeals 2026-05-02 10:47:26 -07:00
Vincent Koc 68017740e7 feat(packages): show moderation status 2026-05-02 10:44:37 -07:00