Patrick Erichsen
60b02c09f9
fix: stream legacy skill downloads ( #3451 )
...
* fix: stream legacy skill downloads
* fix: stream zip entries in bounded chunks
* fix: stream large archives through api owner
* fix: normalize streamed archive chunks
* fix: authenticate archive streaming handoff
* fix: authenticate archive manifest requests
* test: bound archive determinism fixture
* fix: align archive oidc trust with vercel targets
* fix: harden archive runtime boundaries
* test: isolate archive proxy credentials
* test: exercise streamed manifest size cap
2026-08-12 12:19:37 -07:00
Peter Steinberger
f9ea25e14f
fix(api): qualify batch skill security verdicts by owner ( #3409 )
2026-08-05 08:47:19 -07:00
Deepak Jain and Patrick Erichsen
9bceec249e
fix: add exact and paginated prefix skill discovery ( #2969 )
...
* fix: add exact and prefix skill search modes
* docs: document exact and prefix skill search
---------
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com >
2026-07-28 18:11:58 -05:00
Patrick Erichsen
0f84533e9c
feat: add permanent skills.sh mirror storage ( #3227 )
...
* feat: add staged skills.sh mirror storage
* ci: allow guarded CLAW-563 Test deploy
* ci: expose guarded Test deploy diagnostics
* ci: defer branch guard to deploy step
* ci: deploy CLAW-563 PR head to Test
* ci: admit CLAW-563 PR Test job
* fix: make mirror source recovery durable
* ci: trigger labeled mirror load
* feat: activate mirror search queries
* fix: tighten mirror source typing
* fix: bypass protected Test mirror proof
* feat: attribute skill metrics by source
* feat: present stars as bookmarks
* style: format mirror proof changes
* fix: bypass protected mirror readback
* fix: resume mirror past missing scanner pages
* fix: fetch skills.sh mirror audits from api
* fix: validate structural skills.sh identities
* fix: resolve ambiguous skills.sh mirror identities
* feat: stabilize skills.sh mirror ingestion
* fix: account mirror identity conflicts in proof
* fix: quarantine invalid skills.sh detail ids
* fix: resume skills.sh mirror proof
* fix: preserve skills.sh mirror provenance
* fix: recover exact skills.sh mirror runs
* fix: recover stale skills.sh mirror runs
* fix: normalize skills.sh mirror topic facets
* feat: prove complete skills.sh leaderboard mirror
* fix: canonicalize skills.sh source page hashes
* test: enable skills.sh rollout in mirror tests
* ci: skip unrelated Test deploy pull requests
* fix: preserve Vercel preview marker in Test deploy
* fix: tighten Test deploy and metric reconciliation
* fix: bound mirror detail proof pages
* fix: delegate controlled mirror rate limits
* fix: preserve mirror reconciliation progress
* fix: release mirror retry responses
* fix: preserve stale mirror replay state
* fix: authenticate mirror source starts
* fix: delegate mirror identity rate limits
* ci: trigger mirror proof when labeled
* ci: couple mirror deploy and proof opt-in
* fix: admit permanent Vercel Test runtime
* fix: pass Test target to Vercel runtime
* test: align bookmark sync browser labels
* fix: preserve skills.sh source accounting
* fix: preflight active mirror runs
* fix: bind mirror snapshot accounting
* fix: reject truncated replay hashes
* fix: preserve live mirror overlay metadata
2026-07-24 14:32:00 -05:00
Patrick Erichsen
3097319ef6
fix: publish complete skill artifacts ( #3196 )
...
* fix: preserve complete skill artifacts
* test: align artifact metadata expectations
* fix: harden complete skill artifact handling
* fix: close complete artifact review gaps
* fix: preserve legacy skill file metadata hints
* fix: close artifact presentation review gaps
* fix(cli): preserve legacy skill file collector export
* refactor: centralize artifact upload helpers
* fix: preserve artifact scan and publish bounds
* fix: scan complete published text artifacts
* fix: harden artifact download presentation
* test: avoid secret-like fixture text
* refactor: preview artifacts by content
* chore(deps): patch transitive audit advisories
2026-07-20 15:54:47 -07:00
Vincent Koc
11d70e3f88
feat(search): add freshness-aware discovery ranking
...
feat(search): add freshness-aware discovery ranking
2026-06-25 15:11:24 +08:00
Jesse Merhi
088339b5d2
fix: harden API rate limits ( #2783 )
2026-06-25 16:22:00 +10:00
Patrick Erichsen
63ca5c2a2e
feat: add github-backed skill handoffs to downloads and export
2026-06-23 17:08:46 -07:00
Patrick Erichsen
55fe4a8563
feat: add owner-qualified catalog routes
...
Adds canonical owner-qualified publisher, skill, and plugin routes while preserving legacy redirects.\n\nIncludes API, CLI, docs, and user-facing copy updates for /<owner>/skills/<slug> and /<owner>/plugins/<slug>.\n\nMerged by request before the local-auth matrix was green; static, unit, packages, types-build, e2e-http, and playwright-smoke were green on a1328b8
2026-06-22 21:35:56 -07:00
Jesse Merhi
379c1871f4
Add skill and plugin download activity graphs
...
Restore downloads as the public activity metric and add deferred 30-day download graphs for skills and plugins.
2026-06-22 11:59:30 +10:00
Jason (Json) and Patrick Erichsen
04ec212100
feat: add controlled catalog taxonomy and topics ( #2699 )
...
* feat: add controlled catalog taxonomy and topics
* refactor: limit taxonomy input to publish surfaces
* fix: omit inactive official-first filter
* fix: preserve unsaved catalog metadata edits
* fix: enforce catalog taxonomy invariants
* fix: close catalog taxonomy review gaps
* fix: tolerate retired stored skill categories
* fix: bound catalog metadata filter scans
* fix: preserve comma-containing topic labels
* fix: tolerate retired stored plugin categories
* fix: ignore empty secret integration metadata
* fix: honor explicit categories in related skills
* fix: harden taxonomy rollout migration
* fix: harden taxonomy browse pagination
* fix: preserve skill topic recommendation fallback
* fix: scale curated skill category browse
* fix: preserve legacy plugin category filters
* fix: preserve taxonomy compatibility semantics
* fix: preserve legacy catalog browse links
* feat: make catalog metadata editing explicit
* test: update plugin manage context contract
* fix: address taxonomy review findings
* fix: preserve empty category publish flags
* fix: preserve catalog search and publish metadata
* chore: keep taxonomy migration operator-run
* docs: keep taxonomy migrations operator-run
* fix: reject inherited category aliases
* fix: preserve normalized topic search behavior
* test: cover full topic pagination cursors
* fix: tolerate invalid stored topics
---------
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com >
2026-06-17 18:20:54 -06:00
Patrick Erichsen
11ad31aa4e
feat: scope skill slugs by owner ( #2299 )
...
* feat: scope skill slugs by owner
* test: cover owner-scoped skill slug publishes
* feat: scope skill slugs by owner
* fix: restore owner-scoped skill ci
* fix: keep package names separate from skill slugs
2026-06-17 15:31:40 -07:00
Jesse Merhi
0189ddd5c2
fix: add install sort support to package catalog APIs
...
- Add install sorting to package and plugin catalog API paths.
- Reject removed downloads sort requests with 400.
- Keep recommended browse stable during recommendation-score backfill.
- Normalize stale plugin UI downloads sort URLs back to the default browse state.
2026-06-17 17:36:36 +10:00
Patrick Erichsen
1e7de4a2a2
fix: remove retired capability metadata surfaces
...
Remove retired capabilities/capabilityTags/executesCode surfaces for skills and plugins, add guarded cleanup tooling for legacy rows, and sanitize pre-cleanup legacy seed/release payloads.
2026-06-16 17:03:44 -07:00
Patrick Erichsen
44ce895b44
fix: use installs across public adoption surfaces ( #2653 )
...
* fix: use installs across public adoption surfaces
* fix(cli): expose install-based explore sorting
* test: type legacy publisher sort coverage
* fix: preserve install compatibility paths
* fix: bound legacy hover install fallback
* docs: stop advertising downloads sort
* fix: preserve install rollout compatibility
* chore: update ws security override
* test: stub image optimizer in local browser smoke
* fix: normalize legacy download sort aliases
2026-06-15 11:06:29 -07:00
Jesse Merhi
078425f074
feat: add plugin install ranking ( #2633 )
2026-06-15 09:28:26 -07:00
44a552f3da
fix: add guarded personal publisher recovery ( #2642 )
...
Summary:
- The PR adds an admin-only personal publisher recovery flow with HTTP API, admin CLI support, shared response schema, docs/spec notes, and tests.
- Reproducibility: yes. Source inspection shows current main lacks a publisher-recovery route and personal pub ... to an existing ClawHub user, so a replacement GitHub principal has no staff recovery path without this PR.
Automerge notes:
- PR branch already contained follow-up commit before automerge: fix: migrate publisher recovery resource owners
- PR branch already contained follow-up commit before automerge: fix: add guarded personal publisher recovery
Validation:
- ClawSweeper review passed for head 5cfb3605205cfb360520https://github.com/openclaw/clawhub/pull/2642#issuecomment-4704078560
Co-authored-by: momothemage <niuzhengnan@163.com >
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com>
Approved-by: momothemage
Co-authored-by: momothemage <35096042+momothemage@users.noreply.github.com >
2026-06-15 02:57:31 +00:00
Patrick Erichsen
03f97349b0
fix: preserve legacy package ZIP hashes ( #2636 )
...
* test: fix indexed row helper lint
* fix: preserve legacy package zip hashes
2026-06-14 18:56:31 -07:00
Jesse Merhi
d6500794c6
feat: rank skills by installs and dedupe install telemetry ( #2535 )
2026-06-11 14:22:11 +10:00
Patrick Erichsen
f5bf1b61e6
chore: remove stale maintenance backfills
...
Remove completed/stale maintenance backfills and their obsolete package artifact HTTP/CLI/schema surface. Keep the targeted legacy publisher ownership repair path.
2026-06-09 18:47:30 -07:00
Jesse Merhi
c0143b1cd1
fix: retire dependency registry scans
2026-06-09 22:28:13 +10:00
Patrick Erichsen
1fa4f9049d
feat: add plugin export endpoint ( #2547 )
...
Add an authenticated /api/v1/plugins/export route that mirrors the skills export shape, supports an optional plugin family filter, defaults to both code and bundle plugins, and emits ZIP archives with manifest, error, and per-plugin metadata entries.
Autoreview findings addressed:
- [P1] Do not mark partially consumed plugin pages done
Keep merged plugin export family cursor state active while buffered rows remain, and cover the pagination regression.
- [P1] Block release-level security states in plugin export
Apply the package release download security block before reading release storage blobs.
- [P2] Avoid colliding with exported plugin metadata
Move generated plugin metadata under __clawhub_export/ so plugin file paths cannot overwrite it.
2026-06-07 22:52:04 -07:00
Patrick Erichsen
8e1bad4ac1
feat: improve account appeal notifications ( #2520 )
...
* feat: improve account appeal notifications
Adds Resend-backed account-action emails for bans/restores, public-safe ban reason summaries, scanner-triggered appeal scan guidance, and inline banned-account sign-in appeal messaging.
Autoreview findings addressed:
- [P2] Wire restored-account email into unban flow
- [P2] Add the scan upload test to the CI selection
* feat: quarantine malicious artifact uploads
* fix: warn on repeated malicious rejections
* fix: route banned sign-ins to appeal page
* feat: add stored scan report downloads
* chore: bump clawhub cli to 0.20.0
* test: cover malicious skill ban journey
* test: align deletion cleanup expectations after merge
* fix: hide deleted account packages before cleanup
* fix: finalize appeals moderation flow
2026-06-06 16:55:23 -07:00
Patrick Erichsen
bd30b182d7
feat: show skill scan queue progress
2026-06-05 11:35:08 -07:00
Patrick Erichsen
e8cfbddf17
feat: add clawhub scan command ( #2479 )
...
* docs: design clawhub scan command
* docs: plan clawhub scan command
* feat: add clawhub scan command
* fix: prune ephemeral scan uploads
* fix: avoid scan route slug collision
2026-06-03 16:05:11 -07:00
Jesse Merhi
dcbc38999f
fix: require multipart package publishes
...
Require multipart package publishes so public clients cannot provide trusted file or artifact metadata.
Preserve released CLI multipart field names (`files` and `clawpack`), derive stored file and npm-pack artifact metadata from uploaded bytes, and keep large ClawPack tarballs working through ticketed staged uploads.
Tests:
- bunx vitest run convex/uploads.test.ts --reporter=dot
- bunx vitest run convex/httpApi.handlers.test.ts convex/httpApiV1.handlers.test.ts --testNamePattern "package publish|multipart package publish|multipart ClawPack|staged ClawPack|browser session auth|cliUploadUrl|upload tickets" --reporter=dot
- bun run --cwd packages/clawhub test:src -- src/cli/commands/packages.test.ts --testNamePattern "ClawPack tarballs over|stages ClawPack|publishes a ClawPack|cleans generated ClawPack"
- bun run format:check
- bun run lint
- bunx tsc -p packages/schema/tsconfig.json --noEmit --pretty false
- bunx tsc -p packages/clawhub/tsconfig.json --noEmit --pretty false
- bunx tsc --noEmit --pretty false
- bun run ci:unit
- git diff --check origin/main
2026-06-02 09:59:53 +10:00
Jesse Merhi
01aa28ccda
feat: make recommended the default skill ranking
...
Make Recommended the default public skill ranking while preserving the v1 API no-sort default. Adds recommended/default API support, digest rank indexes/backfill safety, OpenAPI/docs updates, and regression coverage.
2026-06-02 08:20:37 +10:00
Patrick Erichsen
5ed0ddd066
fix: keep mod org creation actor out of members ( #2360 )
2026-05-27 12:03:29 -05:00
Patrick Erichsen
667bc55299
Add bulk skill security verdicts endpoint ( #2404 )
...
* feat: add bulk skill security verdicts endpoint
* fix: keep bulk verdict lookup lightweight
* fix: harden bulk verdict review findings
2026-05-26 10:05:56 -07:00
Jesse Merhi
90de729fe1
fix: simplify official publisher policy ( #2380 )
2026-05-26 21:44:43 +10:00
Patrick Erichsen
07fed45f42
fix: reshape skill verify security signals ( #2402 )
2026-05-25 18:49:56 -07:00
Patrick Erichsen
cc16d7fbd9
fix: route static scan findings through clawscan ( #2398 )
...
* fix: route static scan findings through clawscan
* fix: preserve clawscan-only security verdicts after merge
2026-05-25 18:33:33 -07:00
Jesse Merhi
5f6b73024c
fix: separate financial capability tags from crypto ( #2344 )
2026-05-20 17:07:39 -07:00
Patrick Erichsen
0b888a2d13
feat: add self-serve publisher creation ( #2324 )
2026-05-19 14:15:54 -07:00
Patrick Erichsen
66f3d07ca1
feat: add ban reclassification tool ( #2305 )
2026-05-18 18:42:59 -07:00
Peter Steinberger and vyctorbrzezowski
50858282b3
feat: add plugin discovery categories
...
Co-authored-by: vyctorbrzezowski <krzyszchweski@gmail.com >
2026-05-13 12:18:05 +01:00
Peter Steinberger
b1206ed994
fix: land catalog docs and starred page fixes
2026-05-13 12:11:10 +01:00
Peter Steinberger
4ca5ba9d1e
fix: tighten ClawHub publish and API edge cases
2026-05-13 10:50:13 +01:00
Peter Steinberger
6c15a481d0
fix: improve search ownership and profile saves
2026-05-13 08:33:19 +01:00
Jesse Merhi
f0a6789c31
feat: add exact release trust endpoint ( #2191 )
2026-05-12 20:12:56 -07:00
c51cfe2459
Add publisher notes and unify ClawScan review pages ( #2111 )
...
* feat: store clawscan notes on artifact versions
* feat: include clawscan notes in evaluation
* feat: unify ClawScan report layout for plugins and skills
* feat: render clawscan notes in publish and security UI
* chore: document local moderation seed fixtures
* fix: remove appeal surfaces
* fix: remove owner-requested rescans
* feat: add publisher note rescan flow
* fix: resolve main rebase fallout
* fix: address review feedback - breadcrumbs, tab guard, merge target, test matcher
Agent-Logs-Url: https://github.com/openclaw/clawhub/sessions/7bfbe5cf-0b8e-44f9-bf0a-e6235f7f3f1d
Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com >
* fix: address pr ci fallout
* fix: resolve ci after main rebase
* fix: make package VT AI verdicts advisory
* fix: restore skill sidebar actions
* fix: resolve clawscan ui and ci checks
* fix: align security settings access and pending audits
* fix: restore skill version tabs
* fix: show publisher names in sidebars
* fix: align plugin install command styling
* fix: clarify virustotal audit copy
* fix: polish security summaries
* test: align security UI expectations
* docs: document clawscan note workflow
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com >
2026-05-11 14:14:12 -07:00
Peter Steinberger
003d243ccc
fix: allow staff security rescans
2026-05-10 05:23:41 +01:00
Jason
b6875e60f6
fix(skills): repair merge ownership and slug reservations
...
Fix publisher-owned skill merge authorization, bound historical slug redirects, protect reserved namespaces, and add expiring owner-unpublish slug reservations.
Maintainer follow-up: require current owner-hide provenance before honoring an unpublished slug reservation, clear stale reservation fields on non-owner hide paths, and add regressions for stale moderation-owned reservations.
Verification:
- bunx vitest run convex/skills.rateLimit.test.ts convex/skills.slugAvailability.test.ts convex/skills.undeleteGate.test.ts --reporter verbose
- bun run format:check
- bun run lint
- bunx tsc --noEmit
- bunx tsc -p packages/schema/tsconfig.json --noEmit
- bunx tsc -p packages/clawhub/tsconfig.json --noEmit
- bunx convex codegen
- bun run test
- bun run --cwd packages/clawhub test:src -- src/cli/commands/delete.test.ts --reporter verbose
- git diff --check
- GitHub CI: static, packages, types-build, unit, e2e-http, playwright-smoke, CodeQL, secret scanning all passed on 2d0564d1263060202+fuller-stack-dev@users.noreply.github.com >
2026-05-09 04:55:32 -04:00
Momo and momothemage
5b63d5df60
fix: harden skill owner migration
...
Harden skill owner migration across UI, CLI, API, stats, backups, and docs.
Co-authored-by: momothemage <niuzhengnan@163.com >
2026-05-08 12:23:05 -04:00
Patrick Erichsen
86898837fb
docs: split ClawHub public docs from specs ( #2095 )
...
* docs: split clawhub docs source
* docs: make clawhub docs product-facing
* docs: refine public clawhub docs routes
2026-05-07 18:54:47 -07:00
Peter Steinberger
5e7797df72
fix: explain blocked and unauthorized API states
2026-05-07 03:47:08 +01:00
Patrick Erichsen
e62935762b
Merge pull request #2055 from openclaw/pe/artifact-moderation-cases
...
Add skill and package artifact moderation cases
2026-05-06 17:10:19 -07:00
Patrick Erichsen
cab18339e6
docs: align moderation wording with moderator role
2026-05-06 16:42:15 -07:00
Peter Steinberger
4f4d7dd563
docs: document slug routing contract
2026-05-07 00:24:20 +01:00
Patrick Erichsen
c4d1fcdbc6
feat: add skill artifact moderation cases
2026-05-06 15:22:54 -07:00
Patrick Erichsen