Patrick Erichsen
bb6ed6eae6
fix: match homepage hero accent ( #3260 )
2026-07-24 18:25:47 -05:00
Gio Della-Libera
85a3fde608
feat(claws): add gated publication and profile validation ( #3090 )
...
Gate Claw publication before storage access or mutation, validate bounded exact package/profile bytes and archive hierarchy, implement the managed CLAW.md body envelope, and prevent disabled-family list/search starvation.
Validated at exact head a9f1bb419fgiodl73@gmail.com >
2026-07-24 18:14:12 -05:00
Gio Della-Libera and Patrick Erichsen
cfcb6bf0a6
Add experimental portable Claw package schema ( #3089 )
...
* feat(claws): add experimental package schema
* fix(claws): use canonical memory search config
* feat(claws): separate portable and harness profiles
* fix(claws): require portable profile pointers
* fix(schema): align portable claw validation
* fix(schema): reject ambiguous runner options
---------
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com >
2026-07-24 16:58:37 -05:00
Patrick Erichsen
62a697ef1e
feat: add permanent Test ranking metrics import ( #3259 )
...
* feat: add Test ranking metrics import
* fix: harden ranking metric table replacement
* fix: reserve Test for ranking imports
* fix: bind ranking rollback to imported state
* fix: persist rollback guard before import
* fix: quiesce ranking metric writes during imports
* fix: bind ranking imports to target identities
* fix: lock ranking target identities during imports
2026-07-24 16:00:27 -05:00
Patrick Erichsen
258c82d4a9
fix(deps): upgrade postcss past path traversal advisory ( #3258 )
2026-07-24 15:48:16 -05:00
Patrick Erichsen
17f8118d7c
fix: restore rollout automation checks ( #3253 )
2026-07-24 15:39:16 -05:00
Patrick Erichsen
ead9d9409c
chore(deps): migrate to Carapace v0.2.0
2026-07-24 15:27:21 -05:00
Patrick Erichsen
0f84533e9c
feat: add permanent skills.sh mirror storage ( #3227 )
...
* feat: add staged skills.sh mirror storage
* ci: allow guarded CLAW-563 Test deploy
* ci: expose guarded Test deploy diagnostics
* ci: defer branch guard to deploy step
* ci: deploy CLAW-563 PR head to Test
* ci: admit CLAW-563 PR Test job
* fix: make mirror source recovery durable
* ci: trigger labeled mirror load
* feat: activate mirror search queries
* fix: tighten mirror source typing
* fix: bypass protected Test mirror proof
* feat: attribute skill metrics by source
* feat: present stars as bookmarks
* style: format mirror proof changes
* fix: bypass protected mirror readback
* fix: resume mirror past missing scanner pages
* fix: fetch skills.sh mirror audits from api
* fix: validate structural skills.sh identities
* fix: resolve ambiguous skills.sh mirror identities
* feat: stabilize skills.sh mirror ingestion
* fix: account mirror identity conflicts in proof
* fix: quarantine invalid skills.sh detail ids
* fix: resume skills.sh mirror proof
* fix: preserve skills.sh mirror provenance
* fix: recover exact skills.sh mirror runs
* fix: recover stale skills.sh mirror runs
* fix: normalize skills.sh mirror topic facets
* feat: prove complete skills.sh leaderboard mirror
* fix: canonicalize skills.sh source page hashes
* test: enable skills.sh rollout in mirror tests
* ci: skip unrelated Test deploy pull requests
* fix: preserve Vercel preview marker in Test deploy
* fix: tighten Test deploy and metric reconciliation
* fix: bound mirror detail proof pages
* fix: delegate controlled mirror rate limits
* fix: preserve mirror reconciliation progress
* fix: release mirror retry responses
* fix: preserve stale mirror replay state
* fix: authenticate mirror source starts
* fix: delegate mirror identity rate limits
* ci: trigger mirror proof when labeled
* ci: couple mirror deploy and proof opt-in
* fix: admit permanent Vercel Test runtime
* fix: pass Test target to Vercel runtime
* test: align bookmark sync browser labels
* fix: preserve skills.sh source accounting
* fix: preflight active mirror runs
* fix: bind mirror snapshot accounting
* fix: reject truncated replay hashes
* fix: preserve live mirror overlay metadata
2026-07-24 14:32:00 -05:00
Patrick Erichsen
306035cad7
feat: generalize GitHub Skill Sync engine ( #3249 )
2026-07-23 15:50:49 -07:00
Patrick Erichsen
588be4e858
fix: repair both sides of skill lineage cycles ( #3248 )
2026-07-23 15:01:02 -07:00
Patrick Erichsen
edd4e01a07
feat: replace creators directory with official orgs ( #3247 )
2026-07-23 14:07:20 -07:00
Patrick Erichsen
a402451282
fix: prevent and repair skill lineage cycles ( #3246 )
...
* fix: prevent self-referential skill merges
* fix: add guarded skill lineage repair
2026-07-23 13:39:39 -07:00
Patrick Erichsen
9339df42f0
fix(ui): default homepage catalog to list view ( #3245 )
2026-07-23 13:16:35 -07:00
Patrick Erichsen
9c63ed9b6b
fix(ui): show stats on trending cards ( #3243 )
2026-07-23 12:38:09 -07:00
Patrick Erichsen
fec0f5bd23
feat: count successful OpenClaw plugin installs ( #3242 )
2026-07-23 12:12:58 -07:00
Patrick Erichsen
c8066fe89c
chore: update social preview headline
2026-07-23 11:16:20 -07:00
Patrick Erichsen
eb3050fdcc
fix(ui): restore official terminology
2026-07-23 10:59:05 -07:00
Patrick Erichsen
594a7be992
fix: update auth core security patch ( #3238 )
2026-07-23 08:55:08 -07:00
Patrick Erichsen
fe8eff20ee
feat: keep external skill rollouts production-dark ( #3236 )
...
* feat: add fail-closed skill rollout gates
* fix: preserve scan queue pagination semantics
2026-07-23 08:36:41 -07:00
Patrick Erichsen
688329b343
fix(deps): update Next.js security override ( #3234 )
2026-07-23 00:04:53 -07:00
Patrick Erichsen
7aff40d26a
feat: support npx skills discovery ( #3233 )
2026-07-22 22:37:34 -07:00
Patrick Erichsen
97bc586209
fix: terminalize orphaned publish attempts ( #3224 )
2026-07-22 12:34:05 -07:00
Patrick Erichsen
904038cbb4
fix(security): prevent ClawScan timeout worker leaks ( #3223 )
2026-07-22 12:33:49 -07:00
Patrick Erichsen
89f5e62ef7
feat: add controlled skills.sh scanned installs ( #3221 )
...
* feat: add controlled skills.sh scanned installs
* fix: resolve exact skills.sh install references
* fix: verify exact skills.sh catalog references
2026-07-22 02:00:19 -07:00
Patrick Erichsen
ee9fac51cd
feat: add controlled skills.sh metadata canary ( #3217 )
2026-07-21 23:21:19 -07:00
Patrick Erichsen
a9775fc39b
ci: restore static and unit baseline gates ( #3219 )
...
* test: use valid artifact fixture hashes
* chore(deps): override newly vulnerable transitive packages
2026-07-21 22:19:53 -07:00
Patrick Erichsen
eb47a7c177
fix: remove skill slug alias quotas ( #3218 )
2026-07-21 21:49:59 -07:00
Jesse Merhi
987ad8bdec
feat: add 30-day activity trends to abuse signal drawer ( #3216 )
...
Adds 30-day download and install trend charts to the abuse signal drawer, places them near the top for immediate context, and improves development fixtures for realistic manual validation.
2026-07-22 14:49:52 +10:00
Patrick Erichsen
b34a0d69ff
feat: add dark skills.sh catalog control plane ( #3211 )
...
Ships the fail-closed skills.sh catalog control plane validated by the bounded 500-row permanent Test gate. No production ingestion, schedule, visibility, or bulk scanning is enabled.
2026-07-21 20:50:07 -07:00
Jesse Merhi
7ef2b15cfb
Dedupe abuse signal alerts and add bulk review ( #3214 )
...
* fix: dedupe abuse alerts and add bulk review
* fix: use white bulk selection checks
2026-07-22 13:25:54 +10:00
Patrick Erichsen
f9713e81cd
fix(security): handle artifact directory markers ( #3206 )
2026-07-21 17:55:22 -07:00
Jesse Merhi
a09d42484a
fix: require six times P99 for sustained signals ( #3204 )
2026-07-22 00:14:12 +10:00
Jesse Merhi
723f1551e9
fix: make abuse signal snoozes evidence-aware ( #3203 )
2026-07-21 15:24:57 +10:00
Patrick Erichsen
8d8e99a65f
feat: make owner version deletion reversible ( #3199 )
2026-07-20 21:18:35 -07:00
Jesse Merhi
8a8e692730
fix: alert when signal scans stop retrying ( #3202 )
2026-07-21 13:58:09 +10:00
Patrick Erichsen
f754faa390
chore(autoreview): sync TruffleHog scanning ( #3201 )
2026-07-20 20:42:00 -07:00
Peter Steinberger
81f2dfc856
fix: preserve graphemes in webhook titles
2026-07-20 19:58:37 -07:00
Peter Steinberger
15702c1c01
docs: note Discord webhook title limit
2026-07-20 19:58:37 -07:00
Patrick Erichsen
492708207a
fix: bound Discord webhook titles
2026-07-20 19:58:37 -07:00
Jesse Merhi
a68f707f0b
fix(moderation): cap signal scan retries ( #3197 )
...
* fix(moderation): replace stale signal scans
* fix(moderation): bound stale scan recovery
* fix(moderation): cap signal scan retries
* fix(management): show terminal signal scan failures
* docs: add signal failure UI proof
* fix(moderation): preserve signal retry status
2026-07-21 12:23:56 +10:00
34ad6ab0ac
fix: owner-qualified skill reports for ambiguous slugs ( #3172 )
...
* fix: allow owner-qualified skill reports for ambiguous slugs
Report API/CLI previously resolved bare slugs only, so collisions
collapsed into "Skill not found" and blocked listing reports.
Accept ownerHandle/owner query/body and optional skillId, and surface
the standard ambiguous-slug guidance.
Fixes #3111
* fix: keep skill report target owner-scoped
---------
Co-authored-by: norbert-bounty-scout <bountybot@hermes.nousresearch.com >
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com >
2026-07-20 17:07:45 -07:00
Patrick Erichsen
1a964d7441
ci: retry transient GitHub package fixture failures ( #3194 )
...
* fix(ci): retry transient GitHub fixture failures
* test(ci): use first-party GitHub package fixture
2026-07-20 16:59:07 -07:00
Patrick Erichsen
aca16d7885
fix: allow transfers to replace owned redirects ( #3189 )
2026-07-20 16:57:21 -07:00
Patrick Erichsen
3097319ef6
fix: publish complete skill artifacts ( #3196 )
...
* fix: preserve complete skill artifacts
* test: align artifact metadata expectations
* fix: harden complete skill artifact handling
* fix: close complete artifact review gaps
* fix: preserve legacy skill file metadata hints
* fix: close artifact presentation review gaps
* fix(cli): preserve legacy skill file collector export
* refactor: centralize artifact upload helpers
* fix: preserve artifact scan and publish bounds
* fix: scan complete published text artifacts
* fix: harden artifact download presentation
* test: avoid secret-like fixture text
* refactor: preview artifacts by content
* chore(deps): patch transitive audit advisories
2026-07-20 15:54:47 -07:00
Patrick Erichsen
39a8db49fd
fix(build): use exported Monaco worker path ( #3195 )
2026-07-20 14:54:04 -07:00
Patrick Erichsen
3ff331925b
fix(cli): clarify pending publication results ( #3193 )
2026-07-20 12:58:04 -07:00
Patrick Erichsen
b0984d33c0
feat(observability): log prepublication queue health ( #3192 )
2026-07-20 12:22:56 -07:00
Yiğit ERDOĞAN
1821e80950
fix: show one year instead of 12 months in relative timestamps ( #3174 )
...
Listings updated 360-364 days ago rendered as "12mo ago" because 30-day
months do not tile a 365-day year, leaving a five-day gap that still
divided into twelve whole months.
Derive years from whole months so they roll over at 12, matching
formatRelativeUpdatedAt in routes/user/$handle.tsx, which already caps
months at 11.
2026-07-20 12:03:07 -07:00
Patrick Erichsen
a9c8efdd93
fix(security): extend prepublication ClawScan timeout ( #3190 )
2026-07-20 11:39:57 -07:00
Patrick Erichsen
57d1e1530b
fix: isolate ClawScan worker shard concurrency ( #3188 )
2026-07-20 11:17:46 -07:00
Patrick Erichsen