admin/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-08-14 00:47:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,560 Commits 189 Branches 496 Tags
main
Commit Graph
194 Commits
Author SHA1 Message Date
Patrick Erichsen 60b02c09f9 fix: stream legacy skill downloads (#3451) 
* fix: stream legacy skill downloads

* fix: stream zip entries in bounded chunks

* fix: stream large archives through api owner

* fix: normalize streamed archive chunks

* fix: authenticate archive streaming handoff

* fix: authenticate archive manifest requests

* test: bound archive determinism fixture

* fix: align archive oidc trust with vercel targets

* fix: harden archive runtime boundaries

* test: isolate archive proxy credentials

* test: exercise streamed manifest size cap
 2026-08-12 12:19:37 -07:00
Gio Della-Libera 82313c2bb1 feat: require exact ClawPack publication (#3359) 
Accept artifact-only publication for experimental Claws so ClawHub can attest, retry, and serve the exact stored bytes. Preserve exact actor, owner, and digest identity across staged retries and validate current release state before reuse. Add durable contract documentation and real-stack publish, poll, download, and retry proof.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-08-09 12:37:04 -07:00
Gio Della-Libera 348851eeb9 feat(claws): align package layers with schema v1 (#3328) 
Adds conventional harness profiles, package-root BOOTSTRAP.md, strict OpenClaw validation, portable path hardening, and an official upstream contract pin.
 2026-08-09 07:46:06 -07:00
Vyctor H. Brzezowski 2f428b4e1b fix: align discovery icons by content type and viewport (#3427) 
Remove Skill listing icons across discovery, retain Plugin recognition icons on desktop, and collapse both icon columns at the existing mobile breakpoints. Keep loading skeletons aligned with settled rows and cards.

Closes #3425.

Co-authored-by: Vyctor H. Brzezowski <krzyszchweski@gmail.com>
 2026-08-06 17:17:16 -03:00
Patrick Erichsen 0b6017548c feat: add local UI proof fallback (#3429) 
* feat: add local UI proof fallback

* style: format generated Convex skills
 2026-08-05 16:30:58 -07:00
Peter Steinberger f9ea25e14f fix(api): qualify batch skill security verdicts by owner (#3409) 2026-08-05 08:47:19 -07:00
Momo 1527462a5d fix: allow Convex base64 upload digests (#3395) 2026-08-04 14:09:42 -07:00
Vincent Koc b15bd52506 fix(security): prevent package scans from exhausting worker memory (#3393) 
* fix(security): scope SkillSpector to bundled roots

* fix(security): bound bundled SkillSpector scans

* chore(security): format SkillSpector worker changes

* fix(security): import path separator for scan roots
 2026-08-04 14:53:24 +08:00
Patrick Erichsen 87ca030c30 fix: upload skill files directly to Convex (#3391) 
* fix: upload skill files directly to Convex

* chore: prepare clawhub CLI 0.23.3
 2026-08-03 20:37:01 -07:00
Patrick Erichsen 7571488ab3 fix: allow safe skill latest rollback (#3388) 
* fix: allow safe skill latest rollback

* chore(release): prepare clawhub 0.23.2
 2026-08-03 19:42:03 -07:00
Vincent Koc 44cee65cac fix(deploy): preserve active rollout modes (#3357) 2026-08-01 01:36:35 +08:00
Vincent Koc 1a3ee6e015 fix(publish): wait for definitive package publication 2026-08-01 01:00:02 +08:00
Patrick Erichsen 49771f5a69 feat: make GitHub Skill Sync refreshes version-safe (#3229) 2026-07-29 23:26:05 -07:00
Patrick Erichsen 9784710147 fix: separate skill metrics by source (#3228) 
* fix: use bookmark icons consistently

* fix: separate skill metrics by source
 2026-07-29 22:41:06 -07:00
Gio Della-Libera 79ef4af17f feat(claws): publish CLAW.md prompts (#3262) 
* feat(claws): publish CLAW.md prompts

* docs(claws): link prompt bridge PR

* fix(claws): align prompt package validation

* test(claws): repin OpenClaw prompt contract

* test(claws): repin updated OpenClaw contract

* test(claws): pin merged OpenClaw prompt contract
 2026-07-28 21:42:27 -07:00
Patrick Erichsen 79cdd938c4 feat: claim skills.sh listings through GitHub Skill Sync (#3230) 
* feat: add verified mirrored skill adoption state

* feat: add mirrored skill adoption preview

* feat: route skills.sh claims through GitHub sync

* ci: allow guarded CLAW-560 Test deploy

* fix: canonicalize claimed GitHub source repos

* fix: use public GitHub auth for skill sync

* fix: authenticate public GitHub source reads
 2026-07-25 10:32:09 -05:00
Patrick Erichsen cb9c6d8381 feat: add external skills.sh detail and install flow (#3231) 
* feat: integrate external skills.sh listings

* test: record permanent Test external flow

* fix: distinguish GitHub alias source fingerprints

* fix: match controlled skills.sh source URL

* test: disambiguate external detail heading

* fix: use folder hash for controlled skills.sh fixture

* test: prepare controlled external fixture for proof

* fix: preserve OpenClaw external trust state
 2026-07-25 05:17:04 -05:00
Patrick Erichsen 65ea02f4ca feat: add canonical mixed skill search (#3264) 
* feat: add canonical mixed skill search

* test: add permanent Test search proof
 2026-07-25 02:06:41 -05:00
Patrick Erichsen 5fbd52e137 feat: add skills.sh trending rank overlay (#3256) 
* feat: add skills.sh trending rank overlay

* test: prove trending overlay in permanent Test

* fix: preflight trending hydration bound

* fix: exclude known quarantines from trending hydration

* fix: preserve authoritative trending quarantine state

* fix: read legacy leaderboard captures for trending

* fix: bound trending drift to one mirror batch

* fix: preserve trending hydration overflow

* fix: keep trending replays hydration-free
 2026-07-25 01:23:58 -05:00
Patrick Erichsen 906428a557 test: isolate GitHub Skill Sync proof jobs (#3257) 2026-07-24 21:36:16 -05:00
Gio Della-LiberaandPatrick Erichsen 5a3b050751 Add gated Claw hosted feed and lifecycle proof (#3092) 
* feat(claws): publish hosted feed with OpenClaw proof

* test(claws): prove package-local profile feed flow

* fix(claws): encode scoped package artifact routes

* fix(claws): enforce feed rollback and binding

* test(claws): pin hosted OpenClaw contract proof

* test(claws): add Convex feed runtime smoke

* chore(schema): refresh experimental feed declarations

---------

Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
 2026-07-24 19:29:12 -05:00
Gio Della-LiberaandPatrick Erichsen 6efbcb768f Add gated Claw discovery and API projection (#3091) 
* feat(claws): add gated discovery APIs

* test(claws): distinguish latest and exact summaries

* fix(claws): bound public release projection

* chore(claws): refresh schema declarations

* fix(claws): select release projection by family

* fix(claws): hide unpublished release summaries

---------

Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
 2026-07-24 19:10:55 -05:00
Gio Della-Libera 85a3fde608 feat(claws): add gated publication and profile validation (#3090) 
Gate Claw publication before storage access or mutation, validate bounded exact package/profile bytes and archive hierarchy, implement the managed CLAW.md body envelope, and prevent disabled-family list/search starvation.

Validated at exact head a9f1bb419f with all repository CI, CodeQL, secret scanning, focused tests, real local Convex schema/function validation, and clean final autoreview.

Co-authored-by: Gio Della-Libera <giodl73@gmail.com>
 2026-07-24 18:14:12 -05:00
Gio Della-LiberaandPatrick Erichsen cfcb6bf0a6 Add experimental portable Claw package schema (#3089) 
* feat(claws): add experimental package schema

* fix(claws): use canonical memory search config

* feat(claws): separate portable and harness profiles

* fix(claws): require portable profile pointers

* fix(schema): align portable claw validation

* fix(schema): reject ambiguous runner options

---------

Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
 2026-07-24 16:58:37 -05:00
Patrick Erichsen 62a697ef1e feat: add permanent Test ranking metrics import (#3259) 
* feat: add Test ranking metrics import

* fix: harden ranking metric table replacement

* fix: reserve Test for ranking imports

* fix: bind ranking rollback to imported state

* fix: persist rollback guard before import

* fix: quiesce ranking metric writes during imports

* fix: bind ranking imports to target identities

* fix: lock ranking target identities during imports
 2026-07-24 16:00:27 -05:00
Patrick Erichsen 17f8118d7c fix: restore rollout automation checks (#3253) 2026-07-24 15:39:16 -05:00
Patrick Erichsen 0f84533e9c feat: add permanent skills.sh mirror storage (#3227) 
* feat: add staged skills.sh mirror storage

* ci: allow guarded CLAW-563 Test deploy

* ci: expose guarded Test deploy diagnostics

* ci: defer branch guard to deploy step

* ci: deploy CLAW-563 PR head to Test

* ci: admit CLAW-563 PR Test job

* fix: make mirror source recovery durable

* ci: trigger labeled mirror load

* feat: activate mirror search queries

* fix: tighten mirror source typing

* fix: bypass protected Test mirror proof

* feat: attribute skill metrics by source

* feat: present stars as bookmarks

* style: format mirror proof changes

* fix: bypass protected mirror readback

* fix: resume mirror past missing scanner pages

* fix: fetch skills.sh mirror audits from api

* fix: validate structural skills.sh identities

* fix: resolve ambiguous skills.sh mirror identities

* feat: stabilize skills.sh mirror ingestion

* fix: account mirror identity conflicts in proof

* fix: quarantine invalid skills.sh detail ids

* fix: resume skills.sh mirror proof

* fix: preserve skills.sh mirror provenance

* fix: recover exact skills.sh mirror runs

* fix: recover stale skills.sh mirror runs

* fix: normalize skills.sh mirror topic facets

* feat: prove complete skills.sh leaderboard mirror

* fix: canonicalize skills.sh source page hashes

* test: enable skills.sh rollout in mirror tests

* ci: skip unrelated Test deploy pull requests

* fix: preserve Vercel preview marker in Test deploy

* fix: tighten Test deploy and metric reconciliation

* fix: bound mirror detail proof pages

* fix: delegate controlled mirror rate limits

* fix: preserve mirror reconciliation progress

* fix: release mirror retry responses

* fix: preserve stale mirror replay state

* fix: authenticate mirror source starts

* fix: delegate mirror identity rate limits

* ci: trigger mirror proof when labeled

* ci: couple mirror deploy and proof opt-in

* fix: admit permanent Vercel Test runtime

* fix: pass Test target to Vercel runtime

* test: align bookmark sync browser labels

* fix: preserve skills.sh source accounting

* fix: preflight active mirror runs

* fix: bind mirror snapshot accounting

* fix: reject truncated replay hashes

* fix: preserve live mirror overlay metadata
 2026-07-24 14:32:00 -05:00
Patrick Erichsen 306035cad7 feat: generalize GitHub Skill Sync engine (#3249) 2026-07-23 15:50:49 -07:00
Patrick Erichsen 904038cbb4 fix(security): prevent ClawScan timeout worker leaks (#3223) 2026-07-22 12:33:49 -07:00
Patrick Erichsen 89f5e62ef7 feat: add controlled skills.sh scanned installs (#3221) 
* feat: add controlled skills.sh scanned installs

* fix: resolve exact skills.sh install references

* fix: verify exact skills.sh catalog references
 2026-07-22 02:00:19 -07:00
Patrick Erichsen ee9fac51cd feat: add controlled skills.sh metadata canary (#3217) 2026-07-21 23:21:19 -07:00
Patrick Erichsen eb47a7c177 fix: remove skill slug alias quotas (#3218) 2026-07-21 21:49:59 -07:00
Jesse Merhi 987ad8bdec feat: add 30-day activity trends to abuse signal drawer (#3216) 
Adds 30-day download and install trend charts to the abuse signal drawer, places them near the top for immediate context, and improves development fixtures for realistic manual validation.
 2026-07-22 14:49:52 +10:00
Jesse Merhi 7ef2b15cfb Dedupe abuse signal alerts and add bulk review (#3214) 
* fix: dedupe abuse alerts and add bulk review

* fix: use white bulk selection checks
 2026-07-22 13:25:54 +10:00
Jesse Merhi a09d42484a fix: require six times P99 for sustained signals (#3204) 2026-07-22 00:14:12 +10:00
Jesse Merhi 723f1551e9 fix: make abuse signal snoozes evidence-aware (#3203) 2026-07-21 15:24:57 +10:00
Jesse Merhi 8a8e692730 fix: alert when signal scans stop retrying (#3202) 2026-07-21 13:58:09 +10:00
Patrick Erichsen 492708207a fix: bound Discord webhook titles 2026-07-20 19:58:37 -07:00
Jesse Merhi a68f707f0b fix(moderation): cap signal scan retries (#3197) 
* fix(moderation): replace stale signal scans

* fix(moderation): bound stale scan recovery

* fix(moderation): cap signal scan retries

* fix(management): show terminal signal scan failures

* docs: add signal failure UI proof

* fix(moderation): preserve signal retry status
 2026-07-21 12:23:56 +10:00
Patrick Erichsen 1a964d7441 ci: retry transient GitHub package fixture failures (#3194) 
* fix(ci): retry transient GitHub fixture failures

* test(ci): use first-party GitHub package fixture
 2026-07-20 16:59:07 -07:00
Patrick Erichsen aca16d7885 fix: allow transfers to replace owned redirects (#3189) 2026-07-20 16:57:21 -07:00
Patrick Erichsen 3097319ef6 fix: publish complete skill artifacts (#3196) 
* fix: preserve complete skill artifacts

* test: align artifact metadata expectations

* fix: harden complete skill artifact handling

* fix: close complete artifact review gaps

* fix: preserve legacy skill file metadata hints

* fix: close artifact presentation review gaps

* fix(cli): preserve legacy skill file collector export

* refactor: centralize artifact upload helpers

* fix: preserve artifact scan and publish bounds

* fix: scan complete published text artifacts

* fix: harden artifact download presentation

* test: avoid secret-like fixture text

* refactor: preview artifacts by content

* chore(deps): patch transitive audit advisories
 2026-07-20 15:54:47 -07:00
Patrick Erichsen 57d1e1530b fix: isolate ClawScan worker shard concurrency (#3188) 2026-07-20 11:17:46 -07:00
Jesse Merhi ed9c8fdda2 feat(moderation): rescan signals from signals tab (#3180) 2026-07-20 17:11:15 +10:00
Jesse MerhiandPeter Steinberger c688ab845d fix: recover scheduled temporal abuse scans (#3176) 
* fix: recover scheduled temporal abuse scans

* test: strengthen temporal scan regression proof

Co-authored-by: Jesse Merhi <79823012+jesse-merhi@users.noreply.github.com>

* fix(ci): pin design system source commit

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
 2026-07-20 14:22:53 +10:00
Patrick Erichsen af3d01c6ad feat: verify organization GitHub profiles (#3169) 2026-07-17 18:02:30 -07:00
Patrick Erichsen 5c52b27bf7 fix: show plugin download activity graphs (#3165) 2026-07-17 15:40:32 -07:00
Peter Steinberger f3ece75ee4 ci: namespace Vercel convex preview names per builder (#3161) 
A second preview deploy-key consumer runs --preview-create on raw branch
names; Convex replaces same-name previews by delete-and-create, so it was
deleting Vercel's fresh deployments mid-push (get_config_hashes and
wait_for_schema 404s on every PR preview today; confirmed via the Convex
team audit log create/delete pairs seconds apart). Suffix all Vercel-built
preview names with -vercel so no other consumer can collide with them.
 2026-07-17 21:43:02 +01:00
Peter Steinberger 0c04d6a9d5 ci: harden flaky ClawScan test and preview deploys; restore promo icon token (#3159) 
* test: make ClawScan process-tree timeout test deterministic

The timeout test raced its 500ms deadline against the fixture writing
descendant.pid, and treated zombies as live processes via kill(pid, 0).
Under parallel coverage runs it flaked. Now waits for the pid barrier,
drives the timeout with fake timers, and treats zombie state as exited.

* ci: retry transient convex preview provisioning failures

Fresh Convex preview deployments intermittently 404 on get_config_hashes
while provisioning, failing the whole Vercel preview build after the
CLI's internal retries. Retry the preview deploy step up to 3 attempts
with 20s/40s backoff; other steps keep fail-fast behavior.

* fix: restore promotion bar icon geometry token

77459acc dropped border-radius: var(--oc-radius-inset) from
.promotion-bar-icon while folding the removed fallback rule into it,
breaking the ui-design-contract test on main.

* ci: retry preview pipeline under fresh preview names

Retrying --preview-create under the same name leaves two deployments and
convex run --preview-name can resolve to the dead one (seen live: seed
failed with missing functions after a successful retry). Each retry now
reruns deploy plus seed under <branch>-retry-N so resolution is unique.
 2026-07-17 21:08:51 +01:00
Peter Steinberger 8142b3562a fix: keep CLI device codes out of the GitHub OAuth code handler (#3158) 
* fix: keep CLI device codes out of the OAuth code handler

The global AuthCodeHandler consumed any ?code= query param as a GitHub
OAuth completion code. CLI device login links (/cli/device?code=XXXX-XXXX)
hit that path: the device code was stripped before the page could read it,
the failed code exchange erased the active session, and the retry logic
bounced users through a surprise GitHub redirect.

Device verification links now use user_code, the OAuth handler ignores
device-shaped codes as defense in depth, and the device page accepts the
legacy param only when it matches the device code format.

* chore: refresh stale convex generated api for skillTags
 2026-07-17 19:42:48 +01:00