admin/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-08-14 00:47:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,560 Commits 189 Branches 496 Tags
main
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Vincent Koc e590103d70 fix(ci): authenticate skill updater pull requests (#3404) 
Punchcard-Session: amber-orchard-valley-s4
 2026-08-05 10:24:35 +08:00
Vincent Koc b15bd52506 fix(security): prevent package scans from exhausting worker memory (#3393) 
* fix(security): scope SkillSpector to bundled roots

* fix(security): bound bundled SkillSpector scans

* chore(security): format SkillSpector worker changes

* fix(security): import path separator for scan roots
 2026-08-04 14:53:24 +08:00
Vincent Koc 00dd3c3055 fix: prevent worker artifact directory collisions (#3392) 
* fix(workers): share verified artifact materialization

* fix(ci): restore prepublication batch limit
 2026-08-04 14:21:00 +08:00
Vincent Koc 44cee65cac fix(deploy): preserve active rollout modes (#3357) 2026-08-01 01:36:35 +08:00
Vincent Koc 1a3ee6e015 fix(publish): wait for definitive package publication 2026-08-01 01:00:02 +08:00
Vincent Koc c762d8ec6d fix: keep inspector target cache in workspace (#3347) 2026-07-31 17:41:54 +08:00
Vincent Koc 23af0934e4 chore: remove kitchen sink repair tooling (#3307) 2026-07-30 19:16:58 +08:00
Vincent Koc d890dfefe8 fix: guard kitchen sink latest repair (#3306) 2026-07-30 18:59:17 +08:00
Vincent Koc 5a1d2fe7bc fix: repair stale package latest pointers (#3303) 2026-07-30 18:19:59 +08:00
Vincent Koc be94d781ae fix(api): preserve latest across package backports (#3302) 2026-07-30 17:45:25 +08:00
Vincent Koc 873b7e9a34 fix(api): decouple rate-limit metadata writes (#3063) 2026-07-12 15:40:54 +02:00
Vincent Koc 6d1d5afeca fix(ci): right-size heavy local auth shards 2026-07-12 19:47:46 +08:00
Vincent Koc 725c1c9cc5 chore(autoreview): sync canonical review skill (#3061) 
* chore(autoreview): stage canonical runtime

* chore(autoreview): sync canonical review skill

* chore(autoreview): sync canonical review skill

* chore(autoreview): sync canonical review skill
 2026-07-12 17:40:39 +08:00
Vincent Koc 74113da8a9 fix(ci): retry transient bun install failures 2026-07-12 15:32:22 +08:00
Vincent Koc f96ae4a54e fix(workers): harden ClawHub background retries (#2924) 2026-06-28 11:13:37 -07:00
Vincent Koc 8f98128aab fix(security): tolerate transient scan claim failures 
Treats transient partial claim failures as nonfatal for Codex security scan workers while keeping no-work claim outages fatal. Validation: targeted worker test, format check, git diff --check, ci:static, autoreview clean, PR CI green.
 2026-06-27 09:26:14 -07:00
Vincent Koc 91dc9b1486 fix(ci): right-size security dataset snapshots 
Right-size the ClawHub security dataset snapshot workflow after the scheduled run exposed a 120-minute shard timeout. Raises the default shard split while preserving hosted-runner max parallelism, tightens override caps, and cancels only superseded manual dry-run exports.\n\nProof: bun test scripts/security-dataset/security-dataset-snapshot-workflow.test.ts; bun run format:check -- .github/workflows/security-dataset-snapshot.yml scripts/security-dataset/security-dataset-snapshot-workflow.test.ts; bun run ci:static; autoreview clean; PR CI 22 successful / 1 skipped.
 2026-06-27 06:45:22 -07:00
Vincent Koc a5c7888937 fix(ci): give skill card worker Convex fallback 
Fix Skill Card Worker to use the same production Convex fallback URL as the security worker and dataset snapshot workflows.\n\nEvidence:\n- Failed run 28269571442 had CONVEX_URL empty in all worker shards.\n- PR CI run 28270423479 passed: 14/14 jobs.\n- Local targeted workflow test passed.
 2026-06-27 07:20:35 +08:00
Vincent Koc 81a5116073 fix(ci): hard cap security dataset fanout (#2901) 2026-06-27 06:03:12 +08:00
Vincent Koc a3cc536f08 fix(ci): bound security dataset page exports (#2900) 2026-06-27 05:37:09 +08:00
Vincent Koc aa82eea8d3 fix(ci): bound security scan worker runtime 2026-06-25 20:43:31 +08:00
Vincent Koc 997203b190 fix(ui): mark plugin SkillSpector as not applicable 
Show plugin releases without bundled skills as not applicable instead of showing a pending SkillSpector result.
 2026-06-25 16:14:23 +08:00
Vincent Koc 8e56a9f812 fix: preserve publisher across add flow (#2874) 2026-06-25 16:08:32 +08:00
Vincent Koc 5388ca7b41 fix: authenticate GitHub repo discovery 
fix: authenticate GitHub repo discovery
 2026-06-25 16:07:30 +08:00
Vincent Koc 164959d772 feat: streamline skill and plugin publishing 
Adds the unified skill/plugin add flow and surfaces it from profiles, navigation, and empty states.
 2026-06-25 15:46:22 +08:00
Vincent Koc ebf1797434 ci(docs): retry fallback docs dispatch token 
Captures token helper status directly so the docs sync dispatch tries OPENCLAW_GH_TOKEN and then OPENCLAW_DOCS_SYNC_TOKEN before warning and exiting green.\n\nEvidence: PR CI green after rerun, including playwright-local-auth account-cleanup.
 2026-06-25 15:38:36 +08:00
Vincent Koc d639f6720b fix(search): warm trending before leaderboard snapshot 2026-06-25 15:36:53 +08:00
Vincent Koc 7ee573b137 fix(maintenance): repair legacy plugin SkillSpector results 
Add a guarded, cursor-batched cleanup for stale plugin-level SkillSpector results and queue rescans only for plugins with bundled skills.
 2026-06-25 15:36:42 +08:00
Vincent Koc bb2f752571 fix: use Barnacle app for docs dispatch (#2870) 2026-06-25 15:35:51 +08:00
Vincent Koc b7d19075ed ci(docs): soften ClawHub docs dispatch auth failures 
Treat OpenClaw docs sync dispatch credentials as best-effort: token retries still dispatch on 204, missing credentials warn and skip, auth rejection warns with token-rotation guidance, and unexpected HTTP/network failures stay red.\n\nEvidence: git diff --check; YAML parse; extracted run script bash -n; prior PR CI green before rebase, rebase rerun pending.
 2026-06-25 15:25:47 +08:00
Vincent Koc 27a9b3b6ae fix: retry docs dispatch credentials (#2866) 2026-06-25 15:23:51 +08:00
Vincent Koc c0cf9e0621 fix(search): keep trending populated during rollout 
fix(search): keep trending populated during rollout
 2026-06-25 15:22:03 +08:00
Vincent Koc 3f66813e70 fix(security): limit SkillSpector to bundled skills (#2863) 
fix(security): limit SkillSpector to bundled skills
 2026-06-25 15:16:15 +08:00
Vincent Koc f47f28e908 fix: use shared OpenClaw token for docs dispatch (#2862) 2026-06-25 15:14:49 +08:00
Vincent Koc 11d70e3f88 feat(search): add freshness-aware discovery ranking 
feat(search): add freshness-aware discovery ranking
 2026-06-25 15:11:24 +08:00
Vincent Koc 3e6ad6b3b5 fix: grant app token workflow dispatch access (#2861) 2026-06-25 15:06:35 +08:00
Vincent Koc 765ac64191 fix: use app auth for OpenClaw docs dispatch (#2859) 2026-06-25 14:57:26 +08:00
Vincent Koc b5d1371af7 fix: use authenticated GitHub API for imports (#2858) 2026-06-25 14:32:58 +08:00
Vincent Koc 843cf78c74 fix: include official owners in skill browse (#2856) 2026-06-25 13:24:07 +08:00
Vincent Koc d1716c6c81 fix: show official badge on skills (#2855) 
fix: show official badge on skills

Show the compact verified tick for skills owned by official publishers as well as skills with an explicit verified badge. Thread resolved owner metadata through search and browse card renderers, with focused regression coverage.
 2026-06-25 13:02:29 +08:00
Vincent Koc 8e7c8d447b feat: add durable organization logo uploads 
Adds Convex Storage-backed organization logos with validated upload tickets, safe legacy preservation, and the settings UI upload flow.
 2026-06-25 12:55:53 +08:00
Vincent Koc 01bc23c0c7 ci: smooth blacksmith worker bursts 
Cap ClawHub Blacksmith worker fanout and cancel superseded Testbox runs to reduce org runner-registration bursts.
 2026-06-24 21:16:49 +08:00
Vincent Koc eb48c40fd5 fix(ci): bundle ClawHub PR gates 
Reduce ClawHub PR CI runner-registration fanout by bundling short gates into one Blacksmith job, preserving required check names as hosted mirrors, and grouping local-auth Playwright shards from 10 rows to 6.\n\nValidation: git diff --check; YAML load of .github/workflows/ci.yml; bunx --bun oxfmt --check .github/workflows/ci.yml specs/ci.md; autoreview clean; GitHub PR checks green on 9091d0f776.
 2026-06-24 15:28:29 +08:00
Vincent Koc 94f2f532c3 fix(catalog): version and harden hosted plugin feed (#2806) 2026-06-23 16:11:40 +08:00
Vincent Koc 72c5cdd864 feat(catalog): publish hosted OpenClaw plugin feed (#2805) 
* feat(schema): define hosted catalog feed contract

* feat(catalog): publish cached hosted plugin feed

* feat(catalog): add feed publication and edge delivery

* fix(catalog): recheck live official publisher state

* fix(workflow): require main for catalog publication

* fix(catalog): harden publication inputs

* docs(catalog): document consumer rollout boundary
 2026-06-23 15:41:24 +08:00
Vincent Koc d4205c8a7e fix(ci): report testbox hydration failures (#2787) 2026-06-23 12:07:47 +08:00
Vincent Koc 503a2bf022 fix(ci): reduce ClawHub worker fanout (#2770) 2026-06-22 12:41:56 +08:00
Vincent Koc 5256b9e2ba fix(agents): sync autoreview scope guard 
Sync the vendored autoreview skill from openclaw/agent-skills#32, including the closeout scope guard from openclaw/openclaw#93435.\n\nVerification: diff whitespace check, shell syntax, Python compile, prompt-policy assertion, and repo oxfmt check for SKILL.md.
 2026-06-16 08:40:52 +08:00
Vincent Koc e86aa30a77 fix: require npm publish proof artifact 2026-06-13 18:06:27 +08:00
Vincent Koc 7d69b337c7 fix: make skill updates rollback safe 2026-06-13 18:04:04 +08:00
Vincent Koc 9fb09e0793 fix: retire cli browser token callback 2026-06-13 17:58:32 +08:00
Vincent Koc 3711b45d08 fix: default cli login to device flow 2026-06-13 17:55:09 +08:00
Vincent Koc 49b0c33fe8 fix: require confirmation for cli token handoff 2026-06-13 17:50:24 +08:00
Vincent Koc 84f2216d73 fix: harden clawhub cli sync reporting 2026-06-13 17:45:21 +08:00
Vincent Koc 64e22ae06e fix: harden clawhub cli release and sync checks 2026-06-13 17:38:03 +08:00
Vincent Koc 9321c83b93 fix: block moderated skill version metadata 
Block exact skill-version metadata and scan responses when the requested version is the moderated source version. Apply the same guard to package-compatible skill version metadata and cover public-null fallback cases.
 2026-06-09 11:23:55 +09:00
Vincent Koc b8e5486f63 chore(ci): harden security ownership and workflow permissions (#2045) 
* chore(security): expand protected automation owners

* chore(ci): default workflows to no token permissions
 2026-05-07 01:13:54 -07:00
Vincent Koc caac39ce29 fix(convex): scope rate limit buckets by kind 
Scope HTTP rate limit buckets by request kind and raise healthy production limits so plugin downloads are not throttled by unrelated API reads.
 2026-05-04 20:25:15 -07:00
Vincent Koc 199e6a0cdf fix(api): expose legacy zip artifact aliases 
Expose legacy ZIP resolver compatibility aliases without confusing publish-time content hashes for downloaded archive integrity.
 2026-05-03 10:34:37 -07:00
Vincent Koc 59fc54ff64 fix(web): canonicalize scoped plugin paths 2026-05-03 09:35:02 -07:00
Vincent Koc 343781a668 fix(api): decode scoped package paths 2026-05-03 09:26:13 -07:00
Vincent Koc 62b10f829d fix(packages): use single-window search fallback 2026-05-03 02:20:53 -07:00
Vincent Koc eb3113c1f3 fix(packages): rebuild search queries per page 2026-05-03 02:09:54 -07:00
Vincent Koc 887e81eb85 fix(api): return lean skill list payloads 2026-05-03 02:04:16 -07:00
Vincent Koc d6cfc891f0 fix(search): reduce lexical fallback scan budget 2026-05-03 02:02:19 -07:00
Vincent Koc cf5778d7d5 fix(api): route package search through digest index 2026-05-03 02:01:20 -07:00
Vincent Koc e76b72cdb1 fix(search): cap vector hydration window 2026-05-03 01:13:31 -07:00
Vincent Koc f53b49041a fix(api): avoid redundant latest tag version reads 2026-05-03 01:11:43 -07:00
Vincent Koc 21abd07672 fix(search): bound lexical fallback scans 2026-05-03 01:09:44 -07:00
Vincent Koc 6085ee4852 fix(convex): raise download rate limit 2026-05-03 00:24:42 -07:00
Vincent Koc 05653453ea fix(convex): reduce download and token write contention 2026-05-03 00:06:59 -07:00
Vincent Koc 86f8aa88af test(convex): update leaderboard page size expectation 2026-05-02 23:45:27 -07:00
Vincent Koc 2d42c3d57a fix(convex): reduce hot rate-limit and catalog reads 2026-05-02 23:42:15 -07:00
Vincent Koc cf5a6f6e8b fix(scanner): avoid generic pay purchase tags 2026-05-02 23:13:59 -07:00
Vincent Koc 46354c9967 fix(security): flag python file upload exfiltration 2026-05-02 22:50:57 -07:00
Vincent Koc 063ee210a7 fix(github): keep scanner appeal issues open 2026-05-02 22:50:09 -07:00
Vincent Koc f84c894e4e fix(ui): restore skill downloads and search paging 2026-05-02 22:46:30 -07:00
Vincent Koc f8141bc517 fix(convex): gate large index deletion 2026-05-02 19:07:44 -07:00
Vincent Koc ca4899078d fix(convex): retain built rate limit index 2026-05-02 18:37:10 -07:00
Vincent Koc 51d4633df0 fix(convex): avoid rate limit index backfill 2026-05-02 18:19:08 -07:00
Vincent Koc 6139dcd052 fix(convex): drop unused package stat index 2026-05-02 17:20:27 -07:00
Vincent Koc ab48c07b98 test(rate-limits): expect consumed shard quota 2026-05-02 16:19:00 -07:00
Vincent Koc 0a49b75e2f fix(convex): reduce hot stat write contention 2026-05-02 16:16:06 -07:00
Vincent Koc 5e9c61a185 fix(convex): bound skill health reads 2026-05-02 16:16:02 -07:00
Vincent Koc 8234c92dcf fix(packages): keep mirror artifact URLs on public host 2026-05-02 15:54:57 -07:00
Vincent Koc 9edff6fd38 build(schema): update package response dist 2026-05-02 15:45:05 -07:00
Vincent Koc 2ebcdd4ed0 test(packages): include required plugin manifests 2026-05-02 15:38:08 -07:00
Vincent Koc f5183cae9b fix(security): flag confirmation bypasses 2026-05-02 15:33:49 -07:00
Vincent Koc 4196789c6d chore(cli): bump to 0.12.2 2026-05-02 14:43:47 -07:00
Vincent Koc 4c69f2af2e fix(schema): allow nullable package sha 2026-05-02 14:42:57 -07:00
Vincent Koc 4c52dc23c1 fix(cli): allow legacy package downloads 2026-05-02 14:39:04 -07:00
Vincent Koc 8916167505 style(api): format scoped route changes 2026-05-02 14:29:08 -07:00
Vincent Koc f4f2da7fe7 fix(api): resolve scoped package routes 2026-05-02 14:28:27 -07:00
Vincent Koc 01529aaaf1 fix(cli): publish code plugins as clawpacks 2026-05-02 14:27:10 -07:00
Vincent Koc 05efb81669 chore(cli): bump to 0.12.1 2026-05-02 13:47:48 -07:00
Vincent Koc ca0d0bd1bd docs(security): clarify clawpack scan scope 2026-05-02 13:47:05 -07:00
Vincent Koc f82e07fd3a ci: add clean production deploy tags 2026-05-02 13:29:59 -07:00
Vincent Koc f2a61c9d94 fix(packages): scan clawpack artifacts with virustotal 2026-05-02 13:09:03 -07:00
Vincent Koc 3c09df3b77 ci: tag production frontend deploys 2026-05-02 13:06:55 -07:00
Vincent Koc 6d4cf0cfe7 test(packages): avoid unsafe optional chaining 2026-05-02 12:44:28 -07:00