Replace full release-history scans during package publication with durable four-release cleanup batches derived from the package tag map. This keeps finalization under Convex read limits while preserving tag reassignment across retries and concurrent publishes.
A second preview deploy-key consumer runs --preview-create on raw branch
names; Convex replaces same-name previews by delete-and-create, so it was
deleting Vercel's fresh deployments mid-push (get_config_hashes and
wait_for_schema 404s on every PR preview today; confirmed via the Convex
team audit log create/delete pairs seconds apart). Suffix all Vercel-built
preview names with -vercel so no other consumer can collide with them.
* test: make ClawScan process-tree timeout test deterministic
The timeout test raced its 500ms deadline against the fixture writing
descendant.pid, and treated zombies as live processes via kill(pid, 0).
Under parallel coverage runs it flaked. Now waits for the pid barrier,
drives the timeout with fake timers, and treats zombie state as exited.
* ci: retry transient convex preview provisioning failures
Fresh Convex preview deployments intermittently 404 on get_config_hashes
while provisioning, failing the whole Vercel preview build after the
CLI's internal retries. Retry the preview deploy step up to 3 attempts
with 20s/40s backoff; other steps keep fail-fast behavior.
* fix: restore promotion bar icon geometry token
77459acc dropped border-radius: var(--oc-radius-inset) from
.promotion-bar-icon while folding the removed fallback rule into it,
breaking the ui-design-contract test on main.
* ci: retry preview pipeline under fresh preview names
Retrying --preview-create under the same name leaves two deployments and
convex run --preview-name can resolve to the dead one (seen live: seed
failed with missing functions after a successful retry). Each retry now
reruns deploy plus seed under <branch>-retry-N so resolution is unique.
* fix: keep CLI device codes out of the OAuth code handler
The global AuthCodeHandler consumed any ?code= query param as a GitHub
OAuth completion code. CLI device login links (/cli/device?code=XXXX-XXXX)
hit that path: the device code was stripped before the page could read it,
the failed code exchange erased the active session, and the retry logic
bounced users through a surprise GitHub redirect.
Device verification links now use user_code, the OAuth handler ignores
device-shaped codes as defense in depth, and the device page accepts the
legacy param only when it matches the device code format.
* chore: refresh stale convex generated api for skillTags
Dashboard list rows and Needs-attention cards rendered the full title with no truncation, overflowing the row.
- Catalog list row: .skill-list-item-main (flex) lacked min-width: 0, so the nowrap title's min-content floored the body's auto grid track and the ellipsis never fired; flex-wrap: wrap also dropped the version/visibility icon to a second line. Added min-width: 0 + flex-wrap: nowrap so the title truncates in place.
- Needs-attention card: .skill-list-item-main (grid) had the same issue plus an implicit auto column that never shrinks and justify-items: start sizing the title to its content. Added grid-template-columns: minmax(0, 1fr) + min-width: 0 so the column shrinks, and justify-self: stretch on the title so the ellipsis fires.
Scoped to dashboard rows; browse pages are untouched.
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
Closes CLAW-526.\n\nSummary:\n- create pending skill versions and plugin releases that remain hidden until TruffleHog and ClawScan pass\n- preserve older CLI response compatibility while newer CLI output explains pending security checks\n- run prepublication worker promotion/blocking for skills and plugins\n- add local-auth coverage for clean skill/plugin publish and secret-positive skill rejection\n\nValidation on PR head d2482434:\n- local: bunx tsc -p packages/schema/tsconfig.json --noEmit\n- local: bunx tsc -p packages/clawhub/tsconfig.json --noEmit\n- local: bunx vitest run convex/lib/skillPublish.test.ts convex/publishAttempts.test.ts convex/skills.versions.public.test.ts convex/packages.public.test.ts packages/schema/src/schemas.test.ts scripts/security/run-prepublication-worker.test.ts scripts/security/prepublication-worker-workflow.test.ts\n- local: bun run ci:static\n- local: bun run ci:types-build && bun run ci:packages\n- GitHub: pr-gates, static, unit, packages, types-build, e2e-http, old-cli-publish, playwright-smoke, secret scanning, CodeQL, and Vercel preview passed\n\nKnown CI note:\n- unrelated local-auth shards continued to rotate failures under the already-diagnosed local Convex starvation issue; ignored per maintainer instruction.
Patrick Erichsen