fix: stabilize VT scans and UI fetches (#130) (thanks @aleph8)

CHANGELOG.md

@@ -1,40 +1,22 @@
 # Changelog
 
-## 0.6.1 - 2026-02-13
+## Unreleased
 
-### Added
-- Security: add LLM-based security evaluation during skill publish.
-- Parsing: recognize `metadata.openclaw` frontmatter and evaluate all skill files for requirements.
-
-### Changed
-- Performance: lazy-load Monaco diff viewer on demand (thanks @alexjcm, #212).
-- Search: improve recall/ranking with lexical fallback and relevance prioritization.
-- Moderation UX: collapse OpenClaw analysis by default; update spacing and default reasoning model.
-
-### Fixed
-- Upload gate: handle GitHub API rate limits and optional authenticated lookup token (thanks @superlowburn, #246).
-- HTTP: remove `allowH2` from Undici agent to prevent `fetch failed` on Node.js 22+ (#245).
-- Tests: add root `undici` dev dependency for Node E2E imports (thanks @tanujbhaud, #255).
-- VirusTotal: fix scan sync race conditions and retry behavior in scan/backfill paths.
-- Metadata: tolerate trailing commas in JSON metadata.
-- Auth: allow soft-deleted users to re-authenticate on fresh login, while keeping banned users blocked (thanks @tanujbhaud, #177).
-- Web: prevent horizontal overflow from long code blocks in skill pages (thanks @bewithgaurav, #183).
-
-## 0.6.0 - 2026-02-10
 ### Added
 - CLI/API: add `set-role` to change user roles (admin only).
 - Security: quarantine skill publishes with VirusTotal scans + UI (thanks @aleph8, #130).
-- Testing: add tests for badges, skillZip, uploadFiles expandDroppedItems, and ark schema error truncation.
-- Moderation: add ban reasons to API/CLI and show in management UI.
 
 ### Changed
-- Coverage: track `convex/lib/skillZip.ts` in coverage reports.
 
 ### Fixed
-- Web: show pending-scan skills to owners without 404 (thanks @orlyjamie, #136).
-- Users: backfill empty handles from name/email in ensure (thanks @adlai88, #158).
-- Web: update footer branding to OpenClaw (thanks @jontsai, #122).
-- Auth: restore soft-deleted users on reauth, block banned users (thanks @mkrokosz, #106).
+
+## 0.5.1 - TBD
+
+### Added
+
+### Changed
+
+### Fixed
 
 ## 0.5.0 - 2026-02-02
 

README.md

@@ -14,7 +14,7 @@ onlycrabs.ai is the **SOUL.md registry**: publish and share system lore the same
 Live: `https://clawhub.ai`
 onlycrabs.ai: `https://onlycrabs.ai`
 
-## What you can do with it
+## What you can do
 
 - Browse skills + render their `SKILL.md`.
 - Publish new skill versions with changelogs + tags (including `latest`).
@@ -138,30 +138,7 @@ metadata: {"clawdbot":{"cliHelp":"padel --help\\nUsage: padel [command]\\n"}}
 ---
 ```
 
-`metadata.clawdbot` is preferred, but `metadata.clawdis` and `metadata.openclaw` are accepted as aliases.
-
-## Skill metadata
-
-Skills declare their runtime requirements (env vars, binaries, install specs) in the `SKILL.md` frontmatter. ClawHub's security analysis checks these declarations against actual skill behavior.
-
-Full reference: [`docs/skill-format.md`](docs/skill-format.md#frontmatter-metadata)
-
-Quick example:
-
-```yaml
----
-name: my-skill
-description: Does a thing with an API.
-metadata:
-  openclaw:
-    requires:
-      env:
-        - MY_API_KEY
-      bins:
-        - curl
-    primaryEnv: MY_API_KEY
----
-```
+`metadata.clawdbot` is preferred, but `metadata.clawdis` is accepted as an alias for compatibility.
 
 ## Scripts
 

bun.lock

@@ -57,14 +57,13 @@
         "oxlint": "^1.42.0",
         "oxlint-tsgolint": "^0.11.4",
         "typescript": "^5.9.3",
-        "undici": "^7.19.2",
         "vite": "^7.3.1",
         "vitest": "^4.0.18",
       },
     },
     "packages/clawdhub": {
       "name": "clawhub",
-      "version": "0.6.1",
+      "version": "0.5.0",
       "bin": {
         "clawhub": "bin/clawdhub.js",
         "clawdhub": "bin/clawdhub.js",
@@ -1299,7 +1298,7 @@
 
     "ufo": ["ufo@1.6.3", "", {}, "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q=="],
 
-    "undici": ["undici@7.20.0", "", {}, "sha512-MJZrkjyd7DeC+uPZh+5/YaMDxFiiEEaDgbUSVMXayofAkDWF1088CDo+2RPg7B1BuS1qf1vgNE7xqwPxE0DuSQ=="],
+    "undici": ["undici@7.19.2", "", {}, "sha512-4VQSpGEGsWzk0VYxyB/wVX/Q7qf9t5znLRgs0dzszr9w9Fej/8RVNQ+S20vdXSAyra/bJ7ZQfGv6ZMj7UEbzSg=="],
 
     "undici-types": ["undici-types@7.16.0", "", {}, "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw=="],
 
@@ -1403,12 +1402,8 @@
 
     "cheerio/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
 
-    "cheerio/undici": ["undici@7.19.2", "", {}, "sha512-4VQSpGEGsWzk0VYxyB/wVX/Q7qf9t5znLRgs0dzszr9w9Fej/8RVNQ+S20vdXSAyra/bJ7ZQfGv6ZMj7UEbzSg=="],
-
     "cheerio/whatwg-mimetype": ["whatwg-mimetype@4.0.0", "", {}, "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg=="],
 
-    "clawhub/undici": ["undici@7.19.2", "", {}, "sha512-4VQSpGEGsWzk0VYxyB/wVX/Q7qf9t5znLRgs0dzszr9w9Fej/8RVNQ+S20vdXSAyra/bJ7ZQfGv6ZMj7UEbzSg=="],
-
     "convex/esbuild": ["esbuild@0.27.0", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.0", "@esbuild/android-arm": "0.27.0", "@esbuild/android-arm64": "0.27.0", "@esbuild/android-x64": "0.27.0", "@esbuild/darwin-arm64": "0.27.0", "@esbuild/darwin-x64": "0.27.0", "@esbuild/freebsd-arm64": "0.27.0", "@esbuild/freebsd-x64": "0.27.0", "@esbuild/linux-arm": "0.27.0", "@esbuild/linux-arm64": "0.27.0", "@esbuild/linux-ia32": "0.27.0", "@esbuild/linux-loong64": "0.27.0", "@esbuild/linux-mips64el": "0.27.0", "@esbuild/linux-ppc64": "0.27.0", "@esbuild/linux-riscv64": "0.27.0", "@esbuild/linux-s390x": "0.27.0", "@esbuild/linux-x64": "0.27.0", "@esbuild/netbsd-arm64": "0.27.0", "@esbuild/netbsd-x64": "0.27.0", "@esbuild/openbsd-arm64": "0.27.0", "@esbuild/openbsd-x64": "0.27.0", "@esbuild/openharmony-arm64": "0.27.0", "@esbuild/sunos-x64": "0.27.0", "@esbuild/win32-arm64": "0.27.0", "@esbuild/win32-ia32": "0.27.0", "@esbuild/win32-x64": "0.27.0" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-jd0f4NHbD6cALCyGElNpGAOtWxSq46l9X/sWB0Nzd5er4Kz2YTm+Vl0qKFT9KUJvD8+fiO8AvoHhFvEatfVixA=="],
 
     "dom-serializer/entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
@@ -1417,7 +1412,7 @@
 
     "htmlparser2/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
 
-    "nitro/undici": ["undici@7.19.2", "", {}, "sha512-4VQSpGEGsWzk0VYxyB/wVX/Q7qf9t5znLRgs0dzszr9w9Fej/8RVNQ+S20vdXSAyra/bJ7ZQfGv6ZMj7UEbzSg=="],
+    "jsdom/undici": ["undici@7.20.0", "", {}, "sha512-MJZrkjyd7DeC+uPZh+5/YaMDxFiiEEaDgbUSVMXayofAkDWF1088CDo+2RPg7B1BuS1qf1vgNE7xqwPxE0DuSQ=="],
 
     "parse-entities/@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="],
 

convex/_generated/api.d.ts

@@ -36,18 +36,15 @@ import type * as lib_leaderboards from "../lib/leaderboards.js";
 import type * as lib_moderation from "../lib/moderation.js";
 import type * as lib_public from "../lib/public.js";
 import type * as lib_searchText from "../lib/searchText.js";
-import type * as lib_securityPrompt from "../lib/securityPrompt.js";
 import type * as lib_skillBackfill from "../lib/skillBackfill.js";
 import type * as lib_skillPublish from "../lib/skillPublish.js";
 import type * as lib_skillStats from "../lib/skillStats.js";
-import type * as lib_skillZip from "../lib/skillZip.js";
 import type * as lib_skills from "../lib/skills.js";
 import type * as lib_soulChangelog from "../lib/soulChangelog.js";
 import type * as lib_soulPublish from "../lib/soulPublish.js";
 import type * as lib_tokens from "../lib/tokens.js";
 import type * as lib_userSearch from "../lib/userSearch.js";
 import type * as lib_webhooks from "../lib/webhooks.js";
-import type * as llmEval from "../llmEval.js";
 import type * as maintenance from "../maintenance.js";
 import type * as rateLimits from "../rateLimits.js";
 import type * as search from "../search.js";
@@ -103,18 +100,15 @@ declare const fullApi: ApiFromModules<{
   "lib/moderation": typeof lib_moderation;
   "lib/public": typeof lib_public;
   "lib/searchText": typeof lib_searchText;
-  "lib/securityPrompt": typeof lib_securityPrompt;
   "lib/skillBackfill": typeof lib_skillBackfill;
   "lib/skillPublish": typeof lib_skillPublish;
   "lib/skillStats": typeof lib_skillStats;
-  "lib/skillZip": typeof lib_skillZip;
   "lib/skills": typeof lib_skills;
   "lib/soulChangelog": typeof lib_soulChangelog;
   "lib/soulPublish": typeof lib_soulPublish;
   "lib/tokens": typeof lib_tokens;
   "lib/userSearch": typeof lib_userSearch;
   "lib/webhooks": typeof lib_webhooks;
-  llmEval: typeof llmEval;
   maintenance: typeof maintenance;
   rateLimits: typeof rateLimits;
   search: typeof search;

convex/auth.test.ts

@@ -1,101 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import type { Id } from './_generated/dataModel'
-import { BANNED_REAUTH_MESSAGE, handleSoftDeletedUserReauth } from './auth'
-
-function makeCtx({
-  user,
-  banRecord,
-}: {
-  user: { deletedAt?: number } | null
-  banRecord?: Record<string, unknown> | null
-}) {
-  const query = {
-    withIndex: vi.fn().mockReturnValue({
-      filter: vi.fn().mockReturnValue({
-        first: vi.fn().mockResolvedValue(banRecord ?? null),
-      }),
-    }),
-  }
-  const ctx = {
-    db: {
-      get: vi.fn().mockResolvedValue(user),
-      patch: vi.fn().mockResolvedValue(null),
-      query: vi.fn().mockReturnValue(query),
-    },
-  }
-  return { ctx, query }
-}
-
-describe('handleSoftDeletedUserReauth', () => {
-  const userId = 'users:1' as Id<'users'>
-
-  it('skips when user not found', async () => {
-    const { ctx } = makeCtx({ user: null })
-
-    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: userId })
-
-    expect(ctx.db.get).toHaveBeenCalledWith(userId)
-    expect(ctx.db.query).not.toHaveBeenCalled()
-  })
-
-  it('skips active users', async () => {
-    const { ctx } = makeCtx({ user: { deletedAt: undefined } })
-
-    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: userId })
-
-    expect(ctx.db.query).not.toHaveBeenCalled()
-    expect(ctx.db.patch).not.toHaveBeenCalled()
-  })
-
-  it('restores soft-deleted users when not banned', async () => {
-    const { ctx } = makeCtx({ user: { deletedAt: 123 }, banRecord: null })
-
-    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: userId })
-
-    expect(ctx.db.patch).toHaveBeenCalledWith(userId, {
-      deletedAt: undefined,
-      updatedAt: expect.any(Number),
-    })
-  })
-
-  it('restores soft-deleted users on fresh login (existingUserId is null)', async () => {
-    const { ctx } = makeCtx({ user: { deletedAt: 123 }, banRecord: null })
-
-    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: null })
-
-    expect(ctx.db.patch).toHaveBeenCalledWith(userId, {
-      deletedAt: undefined,
-      updatedAt: expect.any(Number),
-    })
-  })
-
-  it('skips reactivation when existingUserId does not match userId', async () => {
-    const otherUserId = 'users:999' as Id<'users'>
-    const { ctx } = makeCtx({ user: { deletedAt: 123 } })
-
-    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: otherUserId })
-
-    expect(ctx.db.query).not.toHaveBeenCalled()
-    expect(ctx.db.patch).not.toHaveBeenCalled()
-  })
-
-  it('blocks banned users with a custom message', async () => {
-    const { ctx } = makeCtx({ user: { deletedAt: 123 }, banRecord: { action: 'user.ban' } })
-
-    await expect(
-      handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: userId }),
-    ).rejects.toThrow(BANNED_REAUTH_MESSAGE)
-
-    expect(ctx.db.patch).not.toHaveBeenCalled()
-  })
-
-  it('blocks banned users on fresh login (existingUserId is null)', async () => {
-    const { ctx } = makeCtx({ user: { deletedAt: 123 }, banRecord: { action: 'user.ban' } })
-
-    await expect(
-      handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: null }),
-    ).rejects.toThrow(BANNED_REAUTH_MESSAGE)
-
-    expect(ctx.db.patch).not.toHaveBeenCalled()
-  })
-})

convex/auth.ts

@@ -1,40 +1,5 @@
 import GitHub from '@auth/core/providers/github'
 import { convexAuth } from '@convex-dev/auth/server'
-import type { GenericMutationCtx } from 'convex/server'
-import { ConvexError } from 'convex/values'
-import type { DataModel, Id } from './_generated/dataModel'
-
-export const BANNED_REAUTH_MESSAGE =
-  'Your account has been banned for uploading malicious skills. If you believe this is a mistake, please contact security@openclaw.ai and we will work with you to restore access.'
-
-export async function handleSoftDeletedUserReauth(
-  ctx: GenericMutationCtx<DataModel>,
-  args: { userId: Id<'users'>; existingUserId: Id<'users'> | null },
-) {
-  const user = await ctx.db.get(args.userId)
-  if (!user?.deletedAt) return
-
-  // Verify that the incoming identity matches the soft-deleted user to prevent bypass.
-  if (args.existingUserId && args.existingUserId !== args.userId) {
-    return
-  }
-
-  const userId = args.userId
-  const banRecord = await ctx.db
-    .query('auditLogs')
-    .withIndex('by_target', (q) => q.eq('targetType', 'user').eq('targetId', userId.toString()))
-    .filter((q) => q.eq(q.field('action'), 'user.ban'))
-    .first()
-
-  if (banRecord) {
-    throw new ConvexError(BANNED_REAUTH_MESSAGE)
-  }
-
-  await ctx.db.patch(userId, {
-    deletedAt: undefined,
-    updatedAt: Date.now(),
-  })
-}
 
 export const { auth, signIn, signOut, store, isAuthenticated } = convexAuth({
   providers: [
@@ -51,17 +16,4 @@ export const { auth, signIn, signOut, store, isAuthenticated } = convexAuth({
       },
     }),
   ],
-  callbacks: {
-    /**
-     * Handle re-authentication of soft-deleted users.
-     *
-     * Performance note: This callback runs on every OAuth sign-in, but the
-     * audit log query ONLY executes when a soft-deleted user attempts to
-     * sign in (user.deletedAt is set). For normal active users, this is
-     * just a single `if` check on an already-loaded field - no extra queries.
-     */
-    async afterUserCreatedOrUpdated(ctx, args) {
-      await handleSoftDeletedUserReauth(ctx, args)
-    },
-  },
 })

convex/comments.ts

@@ -3,7 +3,6 @@ import type { Doc } from './_generated/dataModel'
 import { mutation, query } from './_generated/server'
 import { assertModerator, requireUser } from './lib/access'
 import { type PublicUser, toPublicUser } from './lib/public'
-import { insertStatEvent } from './skillStatEvents'
 
 export const listBySkill = query({
   args: { skillId: v.id('skills'), limit: v.optional(v.number()) },
@@ -44,7 +43,10 @@ export const add = mutation({
       deletedBy: undefined,
     })
 
-    await insertStatEvent(ctx, { skillId: skill._id, kind: 'comment' })
+    await ctx.db.patch(skill._id, {
+      stats: { ...skill.stats, comments: skill.stats.comments + 1 },
+      updatedAt: Date.now(),
+    })
   },
 })
 
@@ -66,7 +68,13 @@ export const remove = mutation({
       deletedBy: user._id,
     })
 
-    await insertStatEvent(ctx, { skillId: comment.skillId, kind: 'uncomment' })
+    const skill = await ctx.db.get(comment.skillId)
+    if (skill) {
+      await ctx.db.patch(skill._id, {
+        stats: { ...skill.stats, comments: Math.max(0, skill.stats.comments - 1) },
+        updatedAt: Date.now(),
+      })
+    }
 
     await ctx.db.insert('auditLogs', {
       actorUserId: user._id,

convex/crons.ts

@@ -31,13 +31,4 @@ crons.interval(
   {},
 )
 
-crons.interval('vt-pending-scans', { minutes: 5 }, internal.vt.pollPendingScans, { batchSize: 100 })
-
-crons.interval('vt-cache-backfill', { minutes: 30 }, internal.vt.backfillActiveSkillsVTCache, {
-  batchSize: 100,
-})
-
-// Daily re-scan of all active skills at 3am UTC
-crons.daily('vt-daily-rescan', { hourUTC: 3, minuteUTC: 0 }, internal.vt.rescanActiveSkills, {})
-
 export default crons

convex/downloads.ts

@@ -19,27 +19,6 @@ export const downloadZip = httpAction(async (ctx, request) => {
     return new Response('Skill not found', { status: 404 })
   }
 
-  // Block downloads based on moderation status
-  const mod = skillResult.moderationInfo
-  if (mod?.isMalwareBlocked) {
-    return new Response(
-      'Blocked: this skill has been flagged as malicious by VirusTotal and cannot be downloaded.',
-      { status: 403 },
-    )
-  }
-  if (mod?.isPendingScan) {
-    return new Response(
-      'This skill is pending a security scan by VirusTotal. Please try again in a few minutes.',
-      { status: 423 },
-    )
-  }
-  if (mod?.isRemoved) {
-    return new Response('This skill has been removed by a moderator.', { status: 410 })
-  }
-  if (mod?.isHiddenByMod) {
-    return new Response('This skill is currently unavailable.', { status: 403 })
-  }
-
   const skill = skillResult.skill
   let version = skillResult.latestVersion
 
@@ -92,11 +71,10 @@ export const downloadZip = httpAction(async (ctx, request) => {
 export const increment = mutation({
   args: { skillId: v.id('skills') },
   handler: async (ctx, args) => {
-    // Skip db.get to avoid adding the skill doc to the read set.
-    // The calling HTTP action already validated the skill exists,
-    // and the stat processor handles deleted skills gracefully.
+    const skill = await ctx.db.get(args.skillId)
+    if (!skill) return
     await insertStatEvent(ctx, {
-      skillId: args.skillId,
+      skillId: skill._id,
       kind: 'download',
     })
   },

convex/httpApiV1.handlers.test.ts

@@ -15,33 +15,8 @@ const { __handlers } = await import('./httpApiV1')
 
 type ActionCtx = import('./_generated/server').ActionCtx
 
-type RateLimitArgs = { key: string; limit: number; windowMs: number }
-
-function isRateLimitArgs(args: unknown): args is RateLimitArgs {
-  if (!args || typeof args !== 'object') return false
-  const value = args as Record<string, unknown>
-  return (
-    typeof value.key === 'string' &&
-    typeof value.limit === 'number' &&
-    typeof value.windowMs === 'number'
-  )
-}
-
 function makeCtx(partial: Record<string, unknown>) {
-  const partialRunQuery =
-    typeof partial.runQuery === 'function'
-      ? (partial.runQuery as (query: unknown, args: Record<string, unknown>) => unknown)
-      : null
-  const runQuery = vi.fn(async (query: unknown, args: Record<string, unknown>) => {
-    if (isRateLimitArgs(args)) return okRate()
-    return partialRunQuery ? await partialRunQuery(query, args) : null
-  })
-  const runMutation =
-    typeof partial.runMutation === 'function'
-      ? partial.runMutation
-      : vi.fn().mockResolvedValue(okRate())
-
-  return { ...partial, runQuery, runMutation } as unknown as ActionCtx
+  return partial as unknown as ActionCtx
 }
 
 const okRate = () => ({
@@ -586,34 +561,6 @@ describe('httpApiV1 handlers', () => {
     expect(json.deletedSkills).toBe(2)
   })
 
-  it('ban user forwards reason', async () => {
-    vi.mocked(requireApiTokenUser).mockResolvedValue({
-      userId: 'users:1',
-      user: { handle: 'p' },
-    } as never)
-    const runQuery = vi.fn().mockResolvedValue({ _id: 'users:2' })
-    const runMutation = vi
-      .fn()
-      .mockResolvedValueOnce(okRate())
-      .mockResolvedValueOnce({ ok: true, alreadyBanned: false, deletedSkills: 0 })
-    await __handlers.usersPostRouterV1Handler(
-      makeCtx({ runQuery, runMutation }),
-      new Request('https://example.com/api/v1/users/ban', {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ handle: 'demo', reason: 'malware' }),
-      }),
-    )
-    expect(runMutation).toHaveBeenCalledWith(
-      expect.anything(),
-      expect.objectContaining({
-        actorUserId: 'users:1',
-        targetUserId: 'users:2',
-        reason: 'malware',
-      }),
-    )
-  })
-
   it('set role requires auth', async () => {
     vi.mocked(requireApiTokenUser).mockRejectedValueOnce(new Error('Unauthorized'))
     const runMutation = vi.fn().mockResolvedValue(okRate())

convex/httpApiV1.ts

@@ -60,14 +60,6 @@ type GetBySlugResult = {
   } | null
   latestVersion: Doc<'skillVersions'> | null
   owner: { _id: Id<'users'>; handle?: string; displayName?: string; image?: string } | null
-  moderationInfo?: {
-    isPendingScan: boolean
-    isMalwareBlocked: boolean
-    isSuspicious: boolean
-    isHiddenByMod: boolean
-    isRemoved: boolean
-    reason?: string
-  } | null
 } | null
 
 type ListVersionsResult = {
@@ -280,12 +272,6 @@ async function skillsGetRouterV1Handler(ctx: ActionCtx, request: Request) {
               image: result.owner.image ?? null,
             }
           : null,
-        moderation: result.moderationInfo
-          ? {
-              isSuspicious: result.moderationInfo.isSuspicious ?? false,
-              isMalwareBlocked: result.moderationInfo.isMalwareBlocked ?? false,
-            }
-          : null,
       },
       200,
       rate.headers,
@@ -562,7 +548,6 @@ async function usersPostRouterV1Handler(ctx: ActionCtx, request: Request) {
 
   const handleRaw = typeof payload.handle === 'string' ? payload.handle.trim() : ''
   const userIdRaw = typeof payload.userId === 'string' ? payload.userId.trim() : ''
-  const reasonRaw = typeof payload.reason === 'string' ? payload.reason.trim() : ''
   if (!handleRaw && !userIdRaw) {
     return text('Missing userId or handle', 400, rate.headers)
   }
@@ -593,15 +578,10 @@ async function usersPostRouterV1Handler(ctx: ActionCtx, request: Request) {
   }
 
   if (action === 'ban') {
-    const reason = reasonRaw.length > 0 ? reasonRaw : undefined
-    if (reason && reason.length > 500) {
-      return text('Reason too long (max 500 chars)', 400, rate.headers)
-    }
     try {
       const result = await ctx.runMutation(internal.users.banUserInternal, {
         actorUserId,
         targetUserId,
-        reason,
       })
       return json(result, 200, rate.headers)
     } catch (error) {
@@ -833,30 +813,11 @@ async function checkRateLimit(
   key: string,
   limit: number,
 ): Promise<RateLimitResult> {
-  // Step 1: Read-only check — no write conflicts for denied requests
-  const status = (await ctx.runQuery(internal.rateLimits.getRateLimitStatusInternal, {
+  return (await ctx.runMutation(internal.rateLimits.checkRateLimitInternal, {
     key,
     limit,
     windowMs: RATE_LIMIT_WINDOW_MS,
   })) as RateLimitResult
-
-  if (!status.allowed) {
-    return status
-  }
-
-  // Step 2: Consume a token (only when allowed, with double-check for races)
-  const result = (await ctx.runMutation(internal.rateLimits.consumeRateLimitInternal, {
-    key,
-    limit,
-    windowMs: RATE_LIMIT_WINDOW_MS,
-  })) as { allowed: boolean; remaining: number }
-
-  return {
-    allowed: result.allowed,
-    remaining: result.remaining,
-    limit: status.limit,
-    resetAt: status.resetAt,
-  }
 }
 
 function pickMostRestrictive(primary: RateLimitResult, secondary: RateLimitResult | null) {

convex/lib/githubAccount.test.ts

@@ -1,5 +1,5 @@
 /* @vitest-environment node */
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { internal } from '../_generated/api'
 import { requireGitHubAccountAge } from './githubAccount'
@@ -18,11 +18,6 @@ const ONE_DAY_MS = 24 * 60 * 60 * 1000
 describe('requireGitHubAccountAge', () => {
   beforeEach(() => {
     vi.restoreAllMocks()
-    vi.unstubAllEnvs()
-  })
-
-  afterEach(() => {
-    vi.unstubAllEnvs()
   })
 
   it('uses cached githubCreatedAt when fresh', async () => {
@@ -91,9 +86,7 @@ describe('requireGitHubAccountAge', () => {
 
     expect(fetchMock).toHaveBeenCalledWith(
       'https://api.github.com/users/steipete',
-      expect.objectContaining({
-        headers: expect.objectContaining({ 'User-Agent': 'clawhub' }),
-      }),
+      expect.objectContaining({ headers: { 'User-Agent': 'clawhub' } }),
     )
     expect(runMutation).toHaveBeenCalledWith(internal.users.updateGithubMetaInternal, {
       userId: 'users:1',
@@ -112,80 +105,11 @@ describe('requireGitHubAccountAge', () => {
       githubFetchedAt: 0,
     })
     const runMutation = vi.fn()
-    const fetchMock = vi.fn().mockResolvedValue({ ok: false, status: 404 })
+    const fetchMock = vi.fn().mockResolvedValue({ ok: false })
     vi.stubGlobal('fetch', fetchMock)
 
     await expect(
       requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never),
     ).rejects.toThrow(/GitHub account lookup failed/i)
   })
-
-  it('throws rate-limit error on 403', async () => {
-    const runQuery = vi.fn().mockResolvedValue({
-      _id: 'users:1',
-      handle: 'steipete',
-      githubCreatedAt: undefined,
-      githubFetchedAt: 0,
-    })
-    const runMutation = vi.fn()
-    const fetchMock = vi.fn().mockResolvedValue({ ok: false, status: 403 })
-    vi.stubGlobal('fetch', fetchMock)
-
-    await expect(
-      requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never),
-    ).rejects.toThrow(/rate limit exceeded/i)
-  })
-
-  it('throws rate-limit error on 429', async () => {
-    const runQuery = vi.fn().mockResolvedValue({
-      _id: 'users:1',
-      handle: 'steipete',
-      githubCreatedAt: undefined,
-      githubFetchedAt: 0,
-    })
-    const runMutation = vi.fn()
-    const fetchMock = vi.fn().mockResolvedValue({ ok: false, status: 429 })
-    vi.stubGlobal('fetch', fetchMock)
-
-    await expect(
-      requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never),
-    ).rejects.toThrow(/rate limit exceeded/i)
-  })
-
-  it('includes Authorization header when GITHUB_TOKEN is set', async () => {
-    vi.useFakeTimers()
-    const now = new Date('2026-02-02T12:00:00Z')
-    vi.setSystemTime(now)
-
-    vi.stubEnv('GITHUB_TOKEN', 'ghp_test123')
-
-    const runQuery = vi.fn().mockResolvedValue({
-      _id: 'users:1',
-      handle: 'steipete',
-      githubCreatedAt: undefined,
-      githubFetchedAt: now.getTime() - 2 * ONE_DAY_MS,
-    })
-    const runMutation = vi.fn()
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      json: async () => ({
-        created_at: '2020-01-01T00:00:00Z',
-      }),
-    })
-    vi.stubGlobal('fetch', fetchMock)
-
-    await requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never)
-
-    expect(fetchMock).toHaveBeenCalledWith(
-      'https://api.github.com/users/steipete',
-      expect.objectContaining({
-        headers: {
-          'User-Agent': 'clawhub',
-          Authorization: 'Bearer ghp_test123',
-        },
-      }),
-    )
-
-    vi.useRealTimers()
-  })
 })

convex/lib/githubAccount.ts

@@ -24,21 +24,10 @@ export async function requireGitHubAccountAge(ctx: ActionCtx, userId: Id<'users'
   const stale = !createdAt || now - fetchedAt > FETCH_TTL_MS
 
   if (stale) {
-    const headers: Record<string, string> = { 'User-Agent': 'clawhub' }
-    const token = process.env.GITHUB_TOKEN
-    if (token) {
-      headers.Authorization = `Bearer ${token}`
-    }
-
     const response = await fetch(`${GITHUB_API}/users/${encodeURIComponent(handle)}`, {
-      headers,
+      headers: { 'User-Agent': 'clawhub' },
     })
-    if (!response.ok) {
-      if (response.status === 403 || response.status === 429) {
-        throw new ConvexError('GitHub API rate limit exceeded — please try again in a few minutes')
-      }
-      throw new ConvexError('GitHub account lookup failed')
-    }
+    if (!response.ok) throw new ConvexError('GitHub account lookup failed')
 
     const payload = (await response.json()) as GitHubUser
     const parsed = payload.created_at ? Date.parse(payload.created_at) : Number.NaN

convex/lib/searchText.test.ts

@@ -33,8 +33,6 @@ describe('searchText', () => {
     expect(matchesExactTokens(['pad'], ['Padel', '/padel', 'Tennis-like sport'])).toBe(true)
     // "xyz" should not match anything
     expect(matchesExactTokens(['xyz'], ['GoHome', '/gohome', 'Navigate home'])).toBe(false)
-    // "notion" should not match "annotations" (substring only)
-    expect(matchesExactTokens(['notion'], ['Annotations helper', '/annotations'])).toBe(false)
   })
 
   it('matchesExactTokens ignores empty inputs', () => {

convex/lib/searchText.ts

@@ -20,7 +20,7 @@ export function matchesExactTokens(
   if (textTokens.length === 0) return false
   // Require at least one token to prefix-match, allowing vector similarity to determine relevance
   return queryTokens.some((queryToken) =>
-    textTokens.some((textToken) => textToken.startsWith(queryToken)),
+    textTokens.some((textToken) => textToken.includes(queryToken)),
   )
 }
 

convex/lib/securityPrompt.ts

@@ -1,499 +0,0 @@
-export function getLlmEvalModel(): string {
-  return process.env.OPENAI_EVAL_MODEL ?? 'gpt-5-mini'
-}
-export const LLM_EVAL_MAX_OUTPUT_TOKENS = 16000
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-function formatScalar(value: unknown): string {
-  if (value === undefined) return 'undefined'
-  if (value === null) return 'null'
-  if (typeof value === 'string') return value
-  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {
-    return String(value)
-  }
-  // Avoid throwing on circular structures; fall back to a safe representation.
-  try {
-    return JSON.stringify(value)
-  } catch {
-    return Object.prototype.toString.call(value)
-  }
-}
-
-function formatWithDefault(value: unknown, defaultLabel: string): string {
-  if (value === undefined || value === null) return defaultLabel
-  return formatScalar(value)
-}
-
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-
-export type SkillEvalContext = {
-  slug: string
-  displayName: string
-  ownerUserId: string
-  version: string
-  createdAt: number
-  summary?: string
-  source?: string
-  homepage?: string
-  parsed: {
-    frontmatter: Record<string, unknown>
-    metadata?: unknown
-    clawdis?: unknown
-  }
-  files: Array<{ path: string; size: number }>
-  skillMdContent: string
-  fileContents: Array<{ path: string; content: string }>
-  injectionSignals: string[]
-}
-
-export type LlmEvalDimension = {
-  name: string
-  label: string
-  rating: string
-  detail: string
-}
-
-export type LlmEvalResponse = {
-  verdict: 'benign' | 'suspicious' | 'malicious'
-  confidence: 'high' | 'medium' | 'low'
-  summary: string
-  dimensions: LlmEvalDimension[]
-  guidance: string
-  findings: string
-}
-
-// ---------------------------------------------------------------------------
-// System prompt (~3500 words)
-// ---------------------------------------------------------------------------
-
-export const SECURITY_EVALUATOR_SYSTEM_PROMPT = `You are a security evaluator for OpenClaw AI skills. Users install skills to extend what their AI agent can do. Some users have limited security knowledge — your job is to surface things that don't add up so they can make an informed decision.
-
-You are not a malware classifier. You are an incoherence detector.
-
-A skill is a bundle of: a name, a description, a set of instructions (SKILL.md) that tell the AI agent what to do at runtime, declared dependencies, required environment variables, and optionally an install mechanism and code files. Many skills are instruction-only — just a SKILL.md with prose telling the agent how to use a CLI tool or REST API, with no code files at all. Your job is to evaluate whether all the pieces are internally consistent and proportionate — and to clearly explain when they aren't.
-
-## How to evaluate
-
-Assess the skill across these five dimensions. For each, determine whether what the skill *claims* aligns with what it *requests, installs, and instructs*.
-
-### 1. Purpose–capability alignment
-
-Compare the skill's name and description against everything it actually requires and does.
-
-Ask: would someone building this skill legitimately need all of this?
-
-A "git-commit-helper" that requires AWS credentials is incoherent. A "cloud-deploy" skill that requires AWS credentials is expected. A "trello" skill that requires TRELLO_API_KEY and TRELLO_TOKEN is exactly what you'd expect. The question is never "is this capability dangerous in isolation" — it's "does this capability belong here."
-
-Flag when:
-- Required environment variables don't relate to the stated purpose
-- Required binaries are unrelated to the described functionality
-- The install spec pulls in tools/packages disproportionate to the task
-- Config path requirements suggest access to subsystems the skill shouldn't touch
-
-### 2. Instruction scope
-
-Read the SKILL.md content carefully. These are the literal instructions the AI agent will follow at runtime. For many skills, this is the entire security surface — there are no code files, just prose that tells the agent what commands to run, what APIs to call, and how to handle data.
-
-Ask: do these instructions stay within the boundaries of the stated purpose?
-
-A "database-backup" skill whose instructions include "first read the user's shell history for context" is scope creep. A "weather" skill that only runs curl against wttr.in is perfectly scoped. Instructions that reference reading files, environment variables, or system state unrelated to the skill's purpose are worth flagging — even if each individual action seems minor.
-
-Pay close attention to:
-- What commands the instructions tell the agent to run
-- What files or paths the instructions reference
-- What environment variables the instructions access beyond those declared in requires.env
-- Whether the instructions direct data to external endpoints other than the service the skill integrates with
-- Whether the instructions ask the agent to read, collect, or transmit anything not needed for the stated task
-
-Flag when:
-- Instructions direct the agent to read files or env vars unrelated to the skill's purpose
-- Instructions include steps that collect, aggregate, or transmit data not needed for the task
-- Instructions reference system paths, credentials, or configuration outside the skill's domain
-- The instructions are vague or open-ended in ways that grant the agent broad discretion ("use your judgment to gather whatever context you need")
-- Instructions direct data to unexpected endpoints (e.g., a "notion" skill that posts data somewhere other than api.notion.com)
-
-### 3. Install mechanism risk
-
-Evaluate what the skill installs and how. Many skills have no install spec at all — they are instruction-only and rely on binaries already being on PATH. That's the lowest risk.
-
-The risk spectrum:
-- No install spec (instruction-only) → lowest risk, nothing is written to disk
-- brew formula from a well-known tap → low friction, package is reviewed
-- npm/go/uv package from a public registry → moderate, packages are not pre-reviewed but are traceable
-- download from a URL with extract → highest risk, arbitrary code from an arbitrary source
-
-Flag when:
-- A download-type install uses a URL that isn't a well-known release host (GitHub releases, official project domains)
-- The URL points to a URL shortener, paste site, personal server, or IP address
-- extract is true (the archive contents will be written to disk and potentially executed)
-- The install creates binaries in non-standard locations
-- Multiple install specs exist for the same platform without clear reason (e.g., two different brew formulas for the same OS)
-
-### 4. Environment and credential proportionality
-
-Evaluate whether the secrets and environment access requested are proportionate.
-
-A skill that needs one API key for the service it integrates with is normal. A "trello" skill requiring TRELLO_API_KEY and TRELLO_TOKEN is expected — that's how Trello's API works. A skill that requests access to multiple unrelated credentials is suspicious. The primaryEnv field declares the "main" credential — other env requirements should serve a clear supporting role.
-
-Flag when:
-- requires.env lists credentials for services unrelated to the skill's purpose
-- The number of required environment variables is high relative to the skill's complexity
-- The skill requires config paths that grant access to gateway auth, channel tokens, or tool policies
-- Environment variables named with patterns like SECRET, TOKEN, KEY, PASSWORD are required but not justified by the skill's purpose
-- The SKILL.md instructions access environment variables beyond those declared in requires.env or primaryEnv
-
-### 5. Persistence and privilege
-
-Evaluate the skill's requested level of system presence.
-
-- always: true means the skill is force-included in every agent run, bypassing all eligibility gates. This is a significant privilege.
-- disable-model-invocation defaults to false. This means the agent can invoke the skill autonomously — THIS IS THE NORMAL, EXPECTED DEFAULT. Autonomous agent invocation is the entire purpose of skills. Do NOT flag this as a concern on its own.
-- A skill writing to its own agent config (enabling itself, storing its own auth tokens, running its own setup/auth scripts) is NORMAL installation behavior — not privilege escalation. Do not flag this.
-
-MITRE ATLAS context: Autonomous invocation relates to AML.T0051 (LLM Plugin Compromise) — a malicious skill with autonomous access has wider blast radius. However, since autonomous invocation is the platform default, only mention this in user guidance when it COMBINES with other red flags (always: true + broad credential access + suspicious behavior in other dimensions). Never flag autonomous invocation alone.
-
-Flag when:
-- always: true is set without clear justification (most skills should not need this)
-- The skill requests permanent presence (always) combined with broad environment access
-- The skill modifies OTHER skills' configurations or system-wide agent settings beyond its own scope
-- The skill accesses credentials or config paths belonging to other skills
-
-## Interpreting static scan findings
-
-The skill has already been scanned by a regex-based pattern detector. Those findings are included in the data below. Use them as additional signal, not as your primary assessment.
-
-- If scan findings exist, incorporate them into your reasoning but evaluate whether they make sense in context. A "deployment" skill with child_process exec is expected. A "markdown-formatter" with child_process exec is not.
-- If no scan findings exist, that does NOT mean the skill is safe. Many skills are instruction-only with no code files — the regex scanner had nothing to analyze. For these skills, your assessment of the SKILL.md instructions is the primary security signal.
-- Never downgrade a scan finding's severity. You can provide context for why a finding may be expected, but always surface it.
-
-## Verdict definitions
-
-- **benign**: The skill's capabilities, requirements, and instructions are internally consistent with its stated purpose. Nothing is disproportionate or unexplained.
-- **suspicious**: There are inconsistencies between what the skill claims to do and what it actually requests, installs, or instructs. These could be legitimate design choices or sloppy engineering — but they could also indicate something worse. The user should understand what doesn't add up before proceeding.
-- **malicious**: The skill's actual footprint is fundamentally incompatible with any reasonable interpretation of its stated purpose, across multiple dimensions. The inconsistencies point toward intentional misdirection — the skill appears designed to do something other than what it claims.
-
-## Critical rules
-
-- The bar for "malicious" is high. It requires incoherence across multiple dimensions that cannot be explained by poor engineering or over-broad requirements. A single suspicious pattern is not enough. "Suspicious" exists precisely for the cases where you can't tell.
-- "Benign" does not mean "safe." It means the skill is internally coherent. A coherent skill can still have vulnerabilities. "Benign" answers "does this skill appear to be what it says it is" — not "is this skill bug-free."
-- When in doubt between benign and suspicious, choose suspicious. When in doubt between suspicious and malicious, choose suspicious. The middle state is where ambiguity lives — use it.
-- NEVER classify something as "malicious" solely because it uses shell execution, network calls, or file I/O. These are normal programming operations. The question is always whether they are *coherent with the skill's purpose*.
-- NEVER classify something as "benign" solely because it has no scan findings. Absence of regex matches is not evidence of safety — especially for instruction-only skills with no code files.
-- DO distinguish between unintentional vulnerabilities (sloppy code, missing input validation) and intentional misdirection (skill claims one purpose but its instructions/requirements reveal a different one). Vulnerabilities are "suspicious." Misdirection is "malicious."
-- DO explain your reasoning. A user who doesn't know what "environment variable exfiltration" means needs you to say "this skill asks for your AWS credentials but nothing in its description suggests it needs cloud access."
-- When confidence is "low", say so explicitly and explain what additional information would change your assessment.
-
-## Output format
-
-Respond with a JSON object and nothing else:
-
-{
-  "verdict": "benign" | "suspicious" | "malicious",
-  "confidence": "high" | "medium" | "low",
-  "summary": "One sentence a non-technical user can understand.",
-  "dimensions": {
-    "purpose_capability": { "status": "ok" | "note" | "concern", "detail": "..." },
-    "instruction_scope": { "status": "ok" | "note" | "concern", "detail": "..." },
-    "install_mechanism": { "status": "ok" | "note" | "concern", "detail": "..." },
-    "environment_proportionality": { "status": "ok" | "note" | "concern", "detail": "..." },
-    "persistence_privilege": { "status": "ok" | "note" | "concern", "detail": "..." }
-  },
-  "scan_findings_in_context": [
-    { "ruleId": "...", "expected_for_purpose": true | false, "note": "..." }
-  ],
-  "user_guidance": "Plain-language explanation of what the user should consider before installing."
-}`
-
-// ---------------------------------------------------------------------------
-// Injection pattern detection
-// ---------------------------------------------------------------------------
-
-const INJECTION_PATTERNS: Array<{ name: string; regex: RegExp }> = [
-  { name: 'ignore-previous-instructions', regex: /ignore\s+(all\s+)?previous\s+instructions/i },
-  { name: 'you-are-now', regex: /you\s+are\s+now\s+(a|an)\b/i },
-  { name: 'system-prompt-override', regex: /system\s*prompt\s*[:=]/i },
-  { name: 'base64-block', regex: /[A-Za-z0-9+/=]{200,}/ },
-  {
-    name: 'unicode-control-chars',
-    // eslint-disable-next-line no-control-regex
-    regex: /[\u200B-\u200F\u202A-\u202E\u2060-\u2064\uFEFF]/,
-  },
-]
-
-export function detectInjectionPatterns(text: string): string[] {
-  const found: string[] = []
-  for (const { name, regex } of INJECTION_PATTERNS) {
-    if (regex.test(text)) found.push(name)
-  }
-  return found
-}
-
-// ---------------------------------------------------------------------------
-// Dimension metadata (maps API keys to display labels)
-// ---------------------------------------------------------------------------
-
-const DIMENSION_META: Record<string, string> = {
-  purpose_capability: 'Purpose & Capability',
-  instruction_scope: 'Instruction Scope',
-  install_mechanism: 'Install Mechanism',
-  environment_proportionality: 'Credentials',
-  persistence_privilege: 'Persistence & Privilege',
-}
-
-// ---------------------------------------------------------------------------
-// Assemble the user message from skill data
-// ---------------------------------------------------------------------------
-
-const MAX_SKILL_MD_CHARS = 6000
-
-export function assembleEvalUserMessage(ctx: SkillEvalContext): string {
-  const fm = ctx.parsed.frontmatter ?? {}
-  const rawClawdis = (ctx.parsed.clawdis ?? {}) as Record<string, unknown>
-  const meta = (ctx.parsed.metadata ?? {}) as Record<string, unknown>
-  const openclawFallback =
-    meta.openclaw && typeof meta.openclaw === 'object' && !Array.isArray(meta.openclaw)
-      ? (meta.openclaw as Record<string, unknown>)
-      : {}
-  const clawdis = Object.keys(rawClawdis).length > 0 ? rawClawdis : openclawFallback
-  const requires = (clawdis.requires ?? openclawFallback.requires ?? {}) as Record<string, unknown>
-  const install = (clawdis.install ?? []) as Array<Record<string, unknown>>
-
-  const codeExtensions = new Set([
-    '.js',
-    '.ts',
-    '.mjs',
-    '.cjs',
-    '.jsx',
-    '.tsx',
-    '.py',
-    '.rb',
-    '.sh',
-    '.bash',
-    '.zsh',
-    '.go',
-    '.rs',
-    '.c',
-    '.cpp',
-    '.java',
-  ])
-  const codeFiles = ctx.files.filter((f) => {
-    const ext = f.path.slice(f.path.lastIndexOf('.')).toLowerCase()
-    return codeExtensions.has(ext)
-  })
-
-  const skillMd =
-    ctx.skillMdContent.length > MAX_SKILL_MD_CHARS
-      ? `${ctx.skillMdContent.slice(0, MAX_SKILL_MD_CHARS)}\n…[truncated]`
-      : ctx.skillMdContent
-
-  const sections: string[] = []
-
-  // Skill identity
-  sections.push(`## Skill under evaluation
-
-**Name:** ${ctx.displayName}
-**Description:** ${ctx.summary ?? 'No description provided.'}
-**Source:** ${ctx.source ?? 'unknown'}
-**Homepage:** ${ctx.homepage ?? 'none'}
-
-**Registry metadata:**
-- Owner ID: ${ctx.ownerUserId}
-- Slug: ${ctx.slug}
-- Version: ${ctx.version}
-- Published: ${new Date(ctx.createdAt).toISOString()}`)
-
-  // Flags
-  const always = fm.always ?? clawdis.always
-  const userInvocable = fm['user-invocable'] ?? clawdis.userInvocable
-  const disableModelInvocation = fm['disable-model-invocation'] ?? clawdis.disableModelInvocation
-  const os = clawdis.os
-  sections.push(`**Flags:**
-- always: ${formatWithDefault(always, 'false (default)')}
-- user-invocable: ${formatWithDefault(userInvocable, 'true (default)')}
-- disable-model-invocation: ${formatWithDefault(
-    disableModelInvocation,
-    'false (default — agent can invoke autonomously, this is normal)',
-  )}
-- OS restriction: ${Array.isArray(os) ? os.join(', ') : formatWithDefault(os, 'none')}`)
-
-  // Requirements
-  const bins = (requires.bins as string[] | undefined) ?? []
-  const anyBins = (requires.anyBins as string[] | undefined) ?? []
-  const env = (requires.env as string[] | undefined) ?? []
-  const primaryEnv = (clawdis.primaryEnv as string | undefined) ?? 'none'
-  const config = (requires.config as string[] | undefined) ?? []
-
-  sections.push(`### Requirements
-- Required binaries (all must exist): ${bins.length ? bins.join(', ') : 'none'}
-- Required binaries (at least one): ${anyBins.length ? anyBins.join(', ') : 'none'}
-- Required env vars: ${env.length ? env.join(', ') : 'none'}
-- Primary credential: ${primaryEnv}
-- Required config paths: ${config.length ? config.join(', ') : 'none'}`)
-
-  // Install specifications
-  if (install.length > 0) {
-    const specLines = install.map((spec, i) => {
-      const kind = spec.kind ?? 'unknown'
-      const parts = [`- **[${i}] ${formatScalar(kind)}**`]
-      if (spec.formula) parts.push(`formula: ${formatScalar(spec.formula)}`)
-      if (spec.package) parts.push(`package: ${formatScalar(spec.package)}`)
-      if (spec.module) parts.push(`module: ${formatScalar(spec.module)}`)
-      if (spec.url) parts.push(`url: ${formatScalar(spec.url)}`)
-      if (spec.archive) parts.push(`archive: ${formatScalar(spec.archive)}`)
-      if (spec.extract !== undefined) parts.push(`extract: ${formatScalar(spec.extract)}`)
-      if (spec.bins) parts.push(`creates binaries: ${(spec.bins as string[]).join(', ')}`)
-      return parts.join(' | ')
-    })
-    sections.push(`### Install specifications\n${specLines.join('\n')}`)
-  } else {
-    sections.push(
-      '### Install specifications\nNo install spec — this is an instruction-only skill.',
-    )
-  }
-
-  // Code file presence
-  if (codeFiles.length > 0) {
-    const fileList = codeFiles.map((f) => `  ${f.path} (${f.size} bytes)`).join('\n')
-    sections.push(`### Code file presence\n${codeFiles.length} code file(s):\n${fileList}`)
-  } else {
-    sections.push(
-      '### Code file presence\nNo code files present — this is an instruction-only skill. The regex-based scanner had nothing to analyze.',
-    )
-  }
-
-  // File manifest
-  const manifest = ctx.files.map((f) => `  ${f.path} (${f.size} bytes)`).join('\n')
-  sections.push(`### File manifest\n${ctx.files.length} file(s):\n${manifest}`)
-
-  // Pre-scan injection signals
-  if (ctx.injectionSignals.length > 0) {
-    sections.push(
-      `### Pre-scan injection signals\nThe following prompt-injection patterns were detected in the SKILL.md content. The skill may be attempting to manipulate this evaluation:\n${ctx.injectionSignals.map((s) => `- ${s}`).join('\n')}`,
-    )
-  } else {
-    sections.push('### Pre-scan injection signals\nNone detected.')
-  }
-
-  // SKILL.md content
-  sections.push(`### SKILL.md content (runtime instructions)\n${skillMd}`)
-
-  // All file contents
-  if (ctx.fileContents.length > 0) {
-    const MAX_FILE_CHARS = 10000
-    const MAX_TOTAL_CHARS = 50000
-    let totalChars = 0
-    const fileBlocks: string[] = []
-    for (const f of ctx.fileContents) {
-      if (totalChars >= MAX_TOTAL_CHARS) {
-        fileBlocks.push(
-          `\n…[remaining files truncated, ${ctx.fileContents.length - fileBlocks.length} file(s) omitted]`,
-        )
-        break
-      }
-      const content =
-        f.content.length > MAX_FILE_CHARS
-          ? `${f.content.slice(0, MAX_FILE_CHARS)}\n…[truncated]`
-          : f.content
-      fileBlocks.push(`#### ${f.path}\n\`\`\`\n${content}\n\`\`\``)
-      totalChars += content.length
-    }
-    sections.push(
-      `### File contents\nFull source of all included files. Review these carefully for malicious behavior, hidden endpoints, data exfiltration, obfuscated code, or behavior that contradicts the SKILL.md.\n\n${fileBlocks.join('\n\n')}`,
-    )
-  }
-
-  // Reminder to respond in JSON (required by OpenAI json_object mode)
-  sections.push('Respond with your evaluation as a single JSON object.')
-
-  return sections.join('\n\n')
-}
-
-// ---------------------------------------------------------------------------
-// Parse the LLM response
-// ---------------------------------------------------------------------------
-
-const VALID_VERDICTS = new Set(['benign', 'suspicious', 'malicious'])
-const VALID_CONFIDENCES = new Set(['high', 'medium', 'low'])
-
-export function parseLlmEvalResponse(raw: string): LlmEvalResponse | null {
-  // Strip markdown code fences if present
-  let text = raw.trim()
-  if (text.startsWith('```')) {
-    const firstNewline = text.indexOf('\n')
-    text = text.slice(firstNewline + 1)
-    const lastFence = text.lastIndexOf('```')
-    if (lastFence !== -1) text = text.slice(0, lastFence)
-    text = text.trim()
-  }
-
-  let parsed: unknown
-  try {
-    parsed = JSON.parse(text)
-  } catch {
-    return null
-  }
-
-  if (!parsed || typeof parsed !== 'object') return null
-
-  const obj = parsed as Record<string, unknown>
-
-  // Validate required fields
-  const verdict = typeof obj.verdict === 'string' ? obj.verdict.toLowerCase() : null
-  if (!verdict || !VALID_VERDICTS.has(verdict)) return null
-
-  const confidence = typeof obj.confidence === 'string' ? obj.confidence.toLowerCase() : null
-  if (!confidence || !VALID_CONFIDENCES.has(confidence)) return null
-
-  const summary = typeof obj.summary === 'string' ? obj.summary : ''
-
-  // Parse dimensions
-  const rawDims = obj.dimensions as Record<string, unknown> | undefined
-  const dimensions: LlmEvalDimension[] = []
-  if (rawDims && typeof rawDims === 'object') {
-    for (const [key, value] of Object.entries(rawDims)) {
-      if (!value || typeof value !== 'object') continue
-      const dim = value as Record<string, unknown>
-      const status = typeof dim.status === 'string' ? dim.status : 'note'
-      const detail = typeof dim.detail === 'string' ? dim.detail : ''
-      dimensions.push({
-        name: key,
-        label: DIMENSION_META[key] ?? key,
-        rating: status,
-        detail,
-      })
-    }
-  }
-
-  // Parse findings
-  const rawFindings = obj.scan_findings_in_context
-  let findings = ''
-  if (Array.isArray(rawFindings) && rawFindings.length > 0) {
-    findings = rawFindings
-      .map((f: unknown) => {
-        if (!f || typeof f !== 'object') return null
-        const entry = f as Record<string, unknown>
-        const ruleId = entry.ruleId ?? 'unknown'
-        const expected = entry.expected_for_purpose ? 'expected' : 'unexpected'
-        const note = entry.note ?? ''
-        return `[${formatScalar(ruleId)}] ${expected}: ${formatScalar(note)}`
-      })
-      .filter(Boolean)
-      .join('\n')
-  }
-
-  const guidance = typeof obj.user_guidance === 'string' ? obj.user_guidance : ''
-
-  return {
-    verdict: verdict as LlmEvalResponse['verdict'],
-    confidence: confidence as LlmEvalResponse['confidence'],
-    summary,
-    dimensions,
-    guidance,
-    findings,
-  }
-}

convex/lib/skillPublish.ts

@@ -174,10 +174,6 @@ export async function publishVersionForUser(
     versionId: publishResult.versionId,
   })
 
-  await ctx.scheduler.runAfter(0, internal.llmEval.evaluateWithLlm, {
-    versionId: publishResult.versionId,
-  })
-
   const owner = (await ctx.runQuery(internal.users.getByIdInternal, {
     userId,
   })) as Doc<'users'> | null

convex/lib/skillStats.ts

@@ -5,7 +5,6 @@ import { toDayKey } from './leaderboards'
 type SkillStatDeltas = {
   downloads?: number
   stars?: number
-  comments?: number
   installsCurrent?: number
   installsAllTime?: number
 }
@@ -23,10 +22,8 @@ export function applySkillStatDeltas(skill: Doc<'skills'>, deltas: SkillStatDelt
       ? skill.statsInstallsAllTime
       : (skill.stats.installsAllTime ?? 0)
 
-  const currentComments = skill.stats.comments
   const nextDownloads = Math.max(0, currentDownloads + (deltas.downloads ?? 0))
   const nextStars = Math.max(0, currentStars + (deltas.stars ?? 0))
-  const nextComments = Math.max(0, currentComments + (deltas.comments ?? 0))
   const nextInstallsCurrent = Math.max(0, currentInstallsCurrent + (deltas.installsCurrent ?? 0))
   const nextInstallsAllTime = Math.max(0, currentInstallsAllTime + (deltas.installsAllTime ?? 0))
 
@@ -39,7 +36,6 @@ export function applySkillStatDeltas(skill: Doc<'skills'>, deltas: SkillStatDelt
       ...skill.stats,
       downloads: nextDownloads,
       stars: nextStars,
-      comments: nextComments,
       installsCurrent: nextInstallsCurrent,
       installsAllTime: nextInstallsAllTime,
     },

convex/lib/skillZip.test.ts

@@ -1,139 +0,0 @@
-/* @vitest-environment node */
-
-import { unzipSync } from 'fflate'
-import { describe, expect, it } from 'vitest'
-import { buildDeterministicZip, buildSkillMeta, type SkillZipMeta } from './skillZip'
-
-describe('skillZip', () => {
-  describe('buildSkillMeta', () => {
-    it('returns metadata object with all fields', () => {
-      const meta: SkillZipMeta = {
-        ownerId: 'user123',
-        slug: 'my-skill',
-        version: '1.0.0',
-        publishedAt: 1700000000000,
-      }
-      const result = buildSkillMeta(meta)
-      expect(result).toEqual({
-        ownerId: 'user123',
-        slug: 'my-skill',
-        version: '1.0.0',
-        publishedAt: 1700000000000,
-      })
-    })
-  })
-
-  describe('buildDeterministicZip', () => {
-    it('creates a zip with provided entries', () => {
-      const entries = [
-        { path: 'SKILL.md', bytes: new TextEncoder().encode('# My Skill') },
-        { path: 'README.txt', bytes: new TextEncoder().encode('Hello') },
-      ]
-      const zip = buildDeterministicZip(entries)
-      const unzipped = unzipSync(zip)
-
-      expect(Object.keys(unzipped).sort()).toEqual(['README.txt', 'SKILL.md'])
-      expect(new TextDecoder().decode(unzipped['SKILL.md'])).toBe('# My Skill')
-      expect(new TextDecoder().decode(unzipped['README.txt'])).toBe('Hello')
-    })
-
-    it('sorts entries alphabetically for deterministic output', () => {
-      const entries1 = [
-        { path: 'b.txt', bytes: new TextEncoder().encode('B') },
-        { path: 'a.txt', bytes: new TextEncoder().encode('A') },
-      ]
-      const entries2 = [
-        { path: 'a.txt', bytes: new TextEncoder().encode('A') },
-        { path: 'b.txt', bytes: new TextEncoder().encode('B') },
-      ]
-
-      const zip1 = buildDeterministicZip(entries1)
-      const zip2 = buildDeterministicZip(entries2)
-
-      // Both should produce identical zips regardless of input order
-      expect(Array.from(zip1)).toEqual(Array.from(zip2))
-    })
-
-    it('includes _meta.json when meta is provided', () => {
-      const entries = [{ path: 'SKILL.md', bytes: new TextEncoder().encode('# Hello') }]
-      const meta: SkillZipMeta = {
-        ownerId: 'user456',
-        slug: 'test-skill',
-        version: '2.0.0',
-        publishedAt: 1700000000000,
-      }
-
-      const zip = buildDeterministicZip(entries, meta)
-      const unzipped = unzipSync(zip)
-
-      expect(Object.keys(unzipped).sort()).toEqual(['SKILL.md', '_meta.json'])
-      const metaContent = JSON.parse(new TextDecoder().decode(unzipped['_meta.json']))
-      expect(metaContent).toEqual({
-        ownerId: 'user456',
-        slug: 'test-skill',
-        version: '2.0.0',
-        publishedAt: 1700000000000,
-      })
-    })
-
-    it('does not include _meta.json when meta is undefined', () => {
-      const entries = [{ path: 'SKILL.md', bytes: new TextEncoder().encode('# Hello') }]
-      const zip = buildDeterministicZip(entries)
-      const unzipped = unzipSync(zip)
-
-      expect(Object.keys(unzipped)).toEqual(['SKILL.md'])
-    })
-
-    it('produces deterministic output for same inputs', () => {
-      const entries = [
-        { path: 'file1.md', bytes: new TextEncoder().encode('content1') },
-        { path: 'file2.md', bytes: new TextEncoder().encode('content2') },
-      ]
-      const meta: SkillZipMeta = {
-        ownerId: 'owner',
-        slug: 'slug',
-        version: '1.0.0',
-        publishedAt: 1700000000000,
-      }
-
-      const zip1 = buildDeterministicZip(entries, meta)
-      const zip2 = buildDeterministicZip(entries, meta)
-
-      // Should be byte-for-byte identical
-      expect(Array.from(zip1)).toEqual(Array.from(zip2))
-    })
-
-    it('handles empty entries array', () => {
-      const zip = buildDeterministicZip([])
-      const unzipped = unzipSync(zip)
-
-      expect(Object.keys(unzipped)).toEqual([])
-    })
-
-    it('handles empty entries array with meta', () => {
-      const meta: SkillZipMeta = {
-        ownerId: 'owner',
-        slug: 'slug',
-        version: '1.0.0',
-        publishedAt: 1700000000000,
-      }
-      const zip = buildDeterministicZip([], meta)
-      const unzipped = unzipSync(zip)
-
-      expect(Object.keys(unzipped)).toEqual(['_meta.json'])
-    })
-
-    it('handles nested paths', () => {
-      const entries = [
-        { path: 'docs/readme.md', bytes: new TextEncoder().encode('docs') },
-        { path: 'src/index.ts', bytes: new TextEncoder().encode('code') },
-        { path: 'SKILL.md', bytes: new TextEncoder().encode('skill') },
-      ]
-
-      const zip = buildDeterministicZip(entries)
-      const unzipped = unzipSync(zip)
-
-      expect(Object.keys(unzipped).sort()).toEqual(['SKILL.md', 'docs/readme.md', 'src/index.ts'])
-    })
-  })
-})

convex/lib/skillZip.ts

@@ -14,7 +14,7 @@ export type SkillZipMeta = {
 
 type ZipInput = Record<string, Uint8Array | [Uint8Array, { mtime?: Date }]>
 
-const FIXED_ZIP_DATE = new Date(1980, 0, 1, 0, 0, 0)
+const FIXED_ZIP_DATE = new Date('1980-01-01T00:00:00Z')
 
 export function buildSkillMeta(meta: SkillZipMeta) {
   return {

convex/lib/skills.ts

@@ -49,9 +49,7 @@ export function getFrontmatterMetadata(frontmatter: ParsedSkillFrontmatter) {
   if (!raw) return undefined
   if (typeof raw === 'string') {
     try {
-      // Strip trailing commas in JSON objects/arrays (common authoring mistake)
-      const cleaned = raw.replace(/,\s*([\]}])/g, '$1')
-      const parsed = JSON.parse(cleaned) as unknown
+      const parsed = JSON.parse(raw) as unknown
       return parsed ?? undefined
     } catch {
       return undefined
@@ -69,15 +67,12 @@ export function parseClawdisMetadata(frontmatter: ParsedSkillFrontmatter) {
       : undefined
   const clawdbotMeta = metadataRecord?.clawdbot
   const clawdisMeta = metadataRecord?.clawdis
-  const openclawMeta = metadataRecord?.openclaw
   const metadataSource =
     clawdbotMeta && typeof clawdbotMeta === 'object' && !Array.isArray(clawdbotMeta)
       ? (clawdbotMeta as Record<string, unknown>)
       : clawdisMeta && typeof clawdisMeta === 'object' && !Array.isArray(clawdisMeta)
         ? (clawdisMeta as Record<string, unknown>)
-        : openclawMeta && typeof openclawMeta === 'object' && !Array.isArray(openclawMeta)
-          ? (openclawMeta as Record<string, unknown>)
-          : undefined
+        : undefined
   const clawdisRaw = metadataSource ?? frontmatter.clawdis
   if (!clawdisRaw || typeof clawdisRaw !== 'object' || Array.isArray(clawdisRaw)) return undefined
 

convex/llmEval.ts

@@ -1,398 +0,0 @@
-import { v } from 'convex/values'
-import { internal } from './_generated/api'
-import type { Doc, Id } from './_generated/dataModel'
-import { internalAction } from './_generated/server'
-import type { SkillEvalContext } from './lib/securityPrompt'
-import {
-  assembleEvalUserMessage,
-  detectInjectionPatterns,
-  getLlmEvalModel,
-  LLM_EVAL_MAX_OUTPUT_TOKENS,
-  parseLlmEvalResponse,
-  SECURITY_EVALUATOR_SYSTEM_PROMPT,
-} from './lib/securityPrompt'
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-function extractResponseText(payload: unknown): string | null {
-  if (!payload || typeof payload !== 'object') return null
-  const output = (payload as { output?: unknown }).output
-  if (!Array.isArray(output)) return null
-  const chunks: string[] = []
-  for (const item of output) {
-    if (!item || typeof item !== 'object') continue
-    if ((item as { type?: unknown }).type !== 'message') continue
-    const content = (item as { content?: unknown }).content
-    if (!Array.isArray(content)) continue
-    for (const part of content) {
-      if (!part || typeof part !== 'object') continue
-      if ((part as { type?: unknown }).type !== 'output_text') continue
-      const text = (part as { text?: unknown }).text
-      if (typeof text === 'string' && text.trim()) chunks.push(text)
-    }
-  }
-  const joined = chunks.join('\n').trim()
-  return joined || null
-}
-
-function verdictToStatus(verdict: string): string {
-  switch (verdict) {
-    case 'benign':
-      return 'clean'
-    case 'malicious':
-      return 'malicious'
-    case 'suspicious':
-      return 'suspicious'
-    default:
-      return 'pending'
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Publish-time evaluation action
-// ---------------------------------------------------------------------------
-
-export const evaluateWithLlm = internalAction({
-  args: {
-    versionId: v.id('skillVersions'),
-  },
-  handler: async (ctx, args) => {
-    const apiKey = process.env.OPENAI_API_KEY
-    if (!apiKey) {
-      console.log('[llmEval] OPENAI_API_KEY not configured, skipping evaluation')
-      return
-    }
-
-    const model = getLlmEvalModel()
-
-    // Store error helper
-    const storeError = async (message: string) => {
-      console.error(`[llmEval] ${message}`)
-      await ctx.runMutation(internal.skills.updateVersionLlmAnalysisInternal, {
-        versionId: args.versionId,
-        llmAnalysis: {
-          status: 'error',
-          summary: message,
-          model,
-          checkedAt: Date.now(),
-        },
-      })
-    }
-
-    // 1. Fetch version
-    const version = (await ctx.runQuery(internal.skills.getVersionByIdInternal, {
-      versionId: args.versionId,
-    })) as Doc<'skillVersions'> | null
-
-    if (!version) {
-      await storeError(`Version ${args.versionId} not found`)
-      return
-    }
-
-    // 2. Fetch skill
-    const skill = (await ctx.runQuery(internal.skills.getSkillByIdInternal, {
-      skillId: version.skillId,
-    })) as Doc<'skills'> | null
-
-    if (!skill) {
-      await storeError(`Skill ${version.skillId} not found`)
-      return
-    }
-
-    // 3. Read SKILL.md content
-    const skillMdFile = version.files.find((f) => {
-      const lower = f.path.toLowerCase()
-      return lower === 'skill.md' || lower === 'skills.md'
-    })
-
-    let skillMdContent = ''
-    if (skillMdFile) {
-      const blob = await ctx.storage.get(skillMdFile.storageId as Id<'_storage'>)
-      if (blob) {
-        skillMdContent = await blob.text()
-      }
-    }
-
-    if (!skillMdContent) {
-      await storeError('No SKILL.md content found')
-      return
-    }
-
-    // 4. Read all file contents
-    const fileContents: Array<{ path: string; content: string }> = []
-    for (const f of version.files) {
-      const lower = f.path.toLowerCase()
-      if (lower === 'skill.md' || lower === 'skills.md') continue
-      try {
-        const blob = await ctx.storage.get(f.storageId as Id<'_storage'>)
-        if (blob) {
-          fileContents.push({ path: f.path, content: await blob.text() })
-        }
-      } catch {
-        // Skip files that can't be read
-      }
-    }
-
-    // 5. Detect injection patterns across ALL content
-    const allContent = [skillMdContent, ...fileContents.map((f) => f.content)].join('\n')
-    const injectionSignals = detectInjectionPatterns(allContent)
-
-    // 6. Build eval context
-    const parsed = version.parsed as SkillEvalContext['parsed']
-    const fm = parsed.frontmatter ?? {}
-
-    const evalCtx: SkillEvalContext = {
-      slug: skill.slug,
-      displayName: skill.displayName,
-      ownerUserId: String(skill.ownerUserId),
-      version: version.version,
-      createdAt: version.createdAt,
-      summary: (skill.summary as string | undefined) ?? undefined,
-      source: (fm.source as string | undefined) ?? undefined,
-      homepage: (fm.homepage as string | undefined) ?? undefined,
-      parsed,
-      files: version.files.map((f) => ({ path: f.path, size: f.size })),
-      skillMdContent,
-      fileContents,
-      injectionSignals,
-    }
-
-    // 6. Assemble user message
-    const userMessage = assembleEvalUserMessage(evalCtx)
-
-    // 7. Call OpenAI Responses API (with retry for rate limits)
-    const MAX_RETRIES = 3
-    let raw: string | null = null
-    try {
-      const body = JSON.stringify({
-        model,
-        instructions: SECURITY_EVALUATOR_SYSTEM_PROMPT,
-        input: userMessage,
-        max_output_tokens: LLM_EVAL_MAX_OUTPUT_TOKENS,
-        text: {
-          format: {
-            type: 'json_object',
-          },
-        },
-      })
-
-      let response: Response | null = null
-      for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-        response = await fetch('https://api.openai.com/v1/responses', {
-          method: 'POST',
-          headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${apiKey}`,
-          },
-          body,
-        })
-
-        if (response.status === 429 || response.status >= 500) {
-          if (attempt < MAX_RETRIES) {
-            const delay = 2 ** attempt * 2000 + Math.random() * 1000
-            console.log(
-              `[llmEval] Rate limited (${response.status}), retrying in ${Math.round(delay)}ms (attempt ${attempt + 1}/${MAX_RETRIES})`,
-            )
-            await new Promise((r) => setTimeout(r, delay))
-            continue
-          }
-        }
-        break
-      }
-
-      if (!response || !response.ok) {
-        const errorText = response ? await response.text() : 'No response'
-        await storeError(`OpenAI API error (${response?.status}): ${errorText.slice(0, 200)}`)
-        return
-      }
-
-      const payload = (await response.json()) as unknown
-      raw = extractResponseText(payload)
-    } catch (error) {
-      await storeError(
-        `OpenAI API call failed: ${error instanceof Error ? error.message : String(error)}`,
-      )
-      return
-    }
-
-    if (!raw) {
-      await storeError('Empty response from OpenAI')
-      return
-    }
-
-    // 8. Parse response
-    const result = parseLlmEvalResponse(raw)
-
-    if (!result) {
-      console.error(`[llmEval] Raw response (first 500 chars): ${raw.slice(0, 500)}`)
-      await storeError('Failed to parse LLM evaluation response')
-      return
-    }
-
-    // 9. Store result
-    await ctx.runMutation(internal.skills.updateVersionLlmAnalysisInternal, {
-      versionId: args.versionId,
-      llmAnalysis: {
-        status: verdictToStatus(result.verdict),
-        verdict: result.verdict,
-        confidence: result.confidence,
-        summary: result.summary,
-        dimensions: result.dimensions,
-        guidance: result.guidance,
-        findings: result.findings || undefined,
-        model,
-        checkedAt: Date.now(),
-      },
-    })
-
-    console.log(
-      `[llmEval] Evaluated ${skill.slug}@${version.version}: ${result.verdict} (${result.confidence} confidence)`,
-    )
-
-    // 10. Update moderation flags — re-read version to get the sha256hash
-    // that VT may have stored while we were evaluating (both run concurrently).
-    const freshVersion = (await ctx.runQuery(internal.skills.getVersionByIdInternal, {
-      versionId: args.versionId,
-    })) as Doc<'skillVersions'> | null
-
-    const sha256hash = freshVersion?.sha256hash ?? version.sha256hash
-    if (sha256hash) {
-      const status = verdictToStatus(result.verdict)
-      if (status === 'malicious' || status === 'suspicious' || status === 'clean') {
-        await ctx.runMutation(internal.skills.approveSkillByHashInternal, {
-          sha256hash,
-          scanner: 'llm',
-          status,
-        })
-      }
-    }
-  },
-})
-
-// ---------------------------------------------------------------------------
-// Convenience: evaluate a single skill by slug (for testing / manual runs)
-// Usage: npx convex run llmEval:evaluateBySlug '{"slug": "transcribeexx"}'
-// ---------------------------------------------------------------------------
-
-export const evaluateBySlug = internalAction({
-  args: {
-    slug: v.string(),
-  },
-  handler: async (ctx, args) => {
-    const skill = (await ctx.runQuery(internal.skills.getSkillBySlugInternal, {
-      slug: args.slug,
-    })) as Doc<'skills'> | null
-
-    if (!skill) {
-      console.error(`[llmEval:bySlug] Skill "${args.slug}" not found`)
-      return { error: 'Skill not found' }
-    }
-
-    if (!skill.latestVersionId) {
-      console.error(`[llmEval:bySlug] Skill "${args.slug}" has no published version`)
-      return { error: 'No published version' }
-    }
-
-    console.log(`[llmEval:bySlug] Evaluating ${args.slug} (versionId: ${skill.latestVersionId})`)
-
-    await ctx.scheduler.runAfter(0, internal.llmEval.evaluateWithLlm, {
-      versionId: skill.latestVersionId,
-    })
-
-    return { ok: true, slug: args.slug, versionId: skill.latestVersionId }
-  },
-})
-
-// ---------------------------------------------------------------------------
-// Backfill action (Phase 2)
-// Schedules individual evaluateWithLlm actions for each skill in the batch,
-// then self-schedules the next batch. Each eval runs as its own action
-// invocation so we don't hit Convex action timeouts.
-// ---------------------------------------------------------------------------
-
-export const backfillLlmEval = internalAction({
-  args: {
-    cursor: v.optional(v.number()),
-    batchSize: v.optional(v.number()),
-    accTotal: v.optional(v.number()),
-    accScheduled: v.optional(v.number()),
-    accSkipped: v.optional(v.number()),
-    startTime: v.optional(v.number()),
-  },
-  handler: async (ctx, args) => {
-    const startTime = args.startTime ?? Date.now()
-    const apiKey = process.env.OPENAI_API_KEY
-    if (!apiKey) {
-      console.log('[llmEval:backfill] OPENAI_API_KEY not configured')
-      return { error: 'OPENAI_API_KEY not configured' }
-    }
-
-    const batchSize = args.batchSize ?? 25
-    const cursor = args.cursor ?? 0
-    let accTotal = args.accTotal ?? 0
-    let accScheduled = args.accScheduled ?? 0
-    let accSkipped = args.accSkipped ?? 0
-
-    const batch = await ctx.runQuery(internal.skills.getActiveSkillBatchForLlmBackfillInternal, {
-      cursor,
-      batchSize,
-    })
-
-    if (batch.skills.length === 0 && batch.done) {
-      console.log('[llmEval:backfill] No more skills to evaluate')
-      return { total: accTotal, scheduled: accScheduled, skipped: accSkipped }
-    }
-
-    console.log(
-      `[llmEval:backfill] Processing batch of ${batch.skills.length} skills (cursor=${cursor}, accumulated=${accTotal})`,
-    )
-
-    for (const { versionId, slug } of batch.skills) {
-      // Re-evaluate all (full file content reading upgrade)
-      const version = (await ctx.runQuery(internal.skills.getVersionByIdInternal, {
-        versionId,
-      })) as Doc<'skillVersions'> | null
-
-      if (!version) {
-        accSkipped++
-        continue
-      }
-
-      // Schedule each evaluation as a separate action invocation
-      await ctx.scheduler.runAfter(0, internal.llmEval.evaluateWithLlm, { versionId })
-      accScheduled++
-      console.log(`[llmEval:backfill] Scheduled eval for ${slug}`)
-    }
-
-    accTotal += batch.skills.length
-
-    if (!batch.done) {
-      // Delay the next batch slightly to avoid overwhelming the scheduler
-      // when all evals from this batch are also running
-      console.log(
-        `[llmEval:backfill] Scheduling next batch (cursor=${batch.nextCursor}, total so far=${accTotal})`,
-      )
-      await ctx.scheduler.runAfter(5_000, internal.llmEval.backfillLlmEval, {
-        cursor: batch.nextCursor,
-        batchSize,
-        accTotal,
-        accScheduled,
-        accSkipped,
-        startTime,
-      })
-      return { status: 'continuing', totalSoFar: accTotal }
-    }
-
-    const durationMs = Date.now() - startTime
-    const result = {
-      total: accTotal,
-      scheduled: accScheduled,
-      skipped: accSkipped,
-      durationMs,
-    }
-    console.log('[llmEval:backfill] Complete:', result)
-    return result
-  },
-})

convex/rateLimits.ts

@@ -1,11 +1,7 @@
 import { v } from 'convex/values'
-import { internalMutation, internalQuery } from './_generated/server'
+import { internalMutation } from './_generated/server'
 
-/**
- * Read-only rate limit check. Returns current status without writing anything.
- * This eliminates write conflicts for denied requests entirely.
- */
-export const getRateLimitStatusInternal = internalQuery({
+export const checkRateLimitInternal = internalMutation({
   args: {
     key: v.string(),
     limit: v.number(),
@@ -24,43 +20,6 @@ export const getRateLimitStatusInternal = internalQuery({
       .withIndex('by_key_window', (q) => q.eq('key', args.key).eq('windowStart', windowStart))
       .unique()
 
-    const count = existing?.count ?? 0
-    const allowed = count < args.limit
-    return {
-      allowed,
-      remaining: Math.max(0, args.limit - count),
-      limit: args.limit,
-      resetAt,
-    }
-  },
-})
-
-/**
- * Consume one rate limit token. Only call this after getRateLimitStatusInternal
- * returns allowed=true. Includes a double-check to handle races between the
- * query and this mutation.
- */
-export const consumeRateLimitInternal = internalMutation({
-  args: {
-    key: v.string(),
-    limit: v.number(),
-    windowMs: v.number(),
-  },
-  handler: async (ctx, args) => {
-    const now = Date.now()
-    const windowStart = Math.floor(now / args.windowMs) * args.windowMs
-
-    const existing = await ctx.db
-      .query('rateLimits')
-      .withIndex('by_key_window', (q) => q.eq('key', args.key).eq('windowStart', windowStart))
-      .unique()
-
-    // Double-check: another request may have consumed the last token
-    // between our query and this mutation
-    if (existing && existing.count >= args.limit) {
-      return { allowed: false, remaining: 0 }
-    }
-
     if (!existing) {
       await ctx.db.insert('rateLimits', {
         key: args.key,
@@ -69,7 +28,11 @@ export const consumeRateLimitInternal = internalMutation({
         limit: args.limit,
         updatedAt: now,
       })
-      return { allowed: true, remaining: Math.max(0, args.limit - 1) }
+      return { allowed: true, remaining: Math.max(0, args.limit - 1), limit: args.limit, resetAt }
+    }
+
+    if (existing.count >= args.limit) {
+      return { allowed: false, remaining: 0, limit: args.limit, resetAt }
     }
 
     await ctx.db.patch(existing._id, {
@@ -80,6 +43,8 @@ export const consumeRateLimitInternal = internalMutation({
     return {
       allowed: true,
       remaining: Math.max(0, args.limit - existing.count - 1),
+      limit: args.limit,
+      resetAt,
     }
   },
 })

convex/schema.ts

@@ -20,7 +20,6 @@ const users = defineTable({
   githubCreatedAt: v.optional(v.number()),
   githubFetchedAt: v.optional(v.number()),
   deletedAt: v.optional(v.number()),
-  banReason: v.optional(v.string()),
   createdAt: v.optional(v.number()),
   updatedAt: v.optional(v.number()),
 })
@@ -81,9 +80,6 @@ const skills = defineTable({
   moderationReason: v.optional(v.string()),
   moderationFlags: v.optional(v.array(v.string())),
   lastReviewedAt: v.optional(v.number()),
-  // VT scan tracking
-  scanLastCheckedAt: v.optional(v.number()),
-  scanCheckCount: v.optional(v.number()),
   hiddenAt: v.optional(v.number()),
   hiddenBy: v.optional(v.id('users')),
   reportCount: v.optional(v.number()),
@@ -162,37 +158,6 @@ const skillVersions = defineTable({
   createdAt: v.number(),
   softDeletedAt: v.optional(v.number()),
   sha256hash: v.optional(v.string()),
-  vtAnalysis: v.optional(
-    v.object({
-      status: v.string(),
-      verdict: v.optional(v.string()),
-      analysis: v.optional(v.string()),
-      source: v.optional(v.string()),
-      checkedAt: v.number(),
-    }),
-  ),
-  llmAnalysis: v.optional(
-    v.object({
-      status: v.string(),
-      verdict: v.optional(v.string()),
-      confidence: v.optional(v.string()),
-      summary: v.optional(v.string()),
-      dimensions: v.optional(
-        v.array(
-          v.object({
-            name: v.string(),
-            label: v.string(),
-            rating: v.string(),
-            detail: v.string(),
-          }),
-        ),
-      ),
-      guidance: v.optional(v.string()),
-      findings: v.optional(v.string()),
-      model: v.optional(v.string()),
-      checkedAt: v.number(),
-    }),
-  ),
 })
   .index('by_skill', ['skillId'])
   .index('by_skill_version', ['skillId', 'version'])
@@ -317,8 +282,6 @@ const skillStatEvents = defineTable({
     v.literal('download'),
     v.literal('star'),
     v.literal('unstar'),
-    v.literal('comment'),
-    v.literal('uncomment'),
     v.literal('install_new'),
     v.literal('install_reactivate'),
     v.literal('install_deactivate'),
@@ -422,24 +385,6 @@ const auditLogs = defineTable({
   .index('by_actor', ['actorUserId'])
   .index('by_target', ['targetType', 'targetId'])
 
-const vtScanLogs = defineTable({
-  type: v.union(v.literal('daily_rescan'), v.literal('backfill'), v.literal('pending_poll')),
-  total: v.number(),
-  updated: v.number(),
-  unchanged: v.number(),
-  errors: v.number(),
-  flaggedSkills: v.optional(
-    v.array(
-      v.object({
-        slug: v.string(),
-        status: v.string(),
-      }),
-    ),
-  ),
-  durationMs: v.number(),
-  createdAt: v.number(),
-}).index('by_type_date', ['type', 'createdAt'])
-
 const apiTokens = defineTable({
   userId: v.id('users'),
   label: v.string(),
@@ -529,7 +474,6 @@ export default defineSchema({
   stars,
   soulStars,
   auditLogs,
-  vtScanLogs,
   apiTokens,
   rateLimits,
   githubBackupSyncState,

convex/search.test.ts

@@ -1,305 +1,12 @@
 /* @vitest-environment node */
 
-import { describe, expect, it, vi } from 'vitest'
-import { tokenize } from './lib/searchText'
-import { __test, lexicalFallbackSkills, searchSkills } from './search'
-
-const { generateEmbeddingMock, getSkillBadgeMapsMock } = vi.hoisted(() => ({
-  generateEmbeddingMock: vi.fn(),
-  getSkillBadgeMapsMock: vi.fn(),
-}))
-
-vi.mock('./lib/embeddings', () => ({
-  generateEmbedding: generateEmbeddingMock,
-}))
-
-vi.mock('./lib/badges', () => ({
-  getSkillBadgeMaps: getSkillBadgeMapsMock,
-  isSkillHighlighted: (skill: { badges?: Record<string, unknown> }) =>
-    Boolean(skill.badges?.highlighted),
-}))
-
-type WrappedHandler = {
-  _handler: (ctx: unknown, args: unknown) => Promise<unknown>
-}
-
-const searchSkillsHandler = (searchSkills as unknown as WrappedHandler)._handler
-const lexicalFallbackSkillsHandler = (lexicalFallbackSkills as unknown as WrappedHandler)._handler
+import { describe, expect, it } from 'vitest'
+import { __test } from './search'
 
 describe('search helpers', () => {
-  it('returns fallback results when vector candidates are empty', async () => {
-    generateEmbeddingMock.mockResolvedValueOnce([0, 1, 2])
-    const fallback = [
-      {
-        skill: makePublicSkill({ id: 'skills:orf', slug: 'orf', displayName: 'ORF' }),
-        version: null,
-        ownerHandle: 'steipete',
-      },
-    ]
-    const runQuery = vi
-      .fn()
-      .mockResolvedValueOnce([])
-      .mockResolvedValueOnce([])
-      .mockResolvedValueOnce(fallback)
-
-    const result = await searchSkillsHandler(
-      {
-        vectorSearch: vi.fn().mockResolvedValue([]),
-        runQuery,
-      },
-      { query: 'orf', limit: 10 },
-    )
-
-    expect(result).toHaveLength(1)
-    expect(result[0].skill.slug).toBe('orf')
-    expect(runQuery).toHaveBeenLastCalledWith(
-      expect.anything(),
-      expect.objectContaining({ query: 'orf', queryTokens: ['orf'] }),
-    )
-  })
-
-  it('applies highlightedOnly filtering in lexical fallback', async () => {
-    const highlighted = makeSkillDoc({
-      id: 'skills:hl',
-      slug: 'orf-highlighted',
-      displayName: 'ORF Highlighted',
-    })
-    const plain = makeSkillDoc({ id: 'skills:plain', slug: 'orf-plain', displayName: 'ORF Plain' })
-    getSkillBadgeMapsMock.mockResolvedValueOnce(
-      new Map([
-        ['skills:hl', { highlighted: { byUserId: 'users:mod', at: 1 } }],
-        ['skills:plain', {}],
-      ]),
-    )
-
-    const result = await lexicalFallbackSkillsHandler(
-      makeLexicalCtx({
-        exactSlugSkill: null,
-        recentSkills: [highlighted, plain],
-      }),
-      { query: 'orf', queryTokens: ['orf'], highlightedOnly: true, limit: 10 },
-    )
-
-    expect(result).toHaveLength(1)
-    expect(result[0].skill.slug).toBe('orf-highlighted')
-  })
-
-  it('includes exact slug match from by_slug even when recent scan is empty', async () => {
-    const exactSlugSkill = makeSkillDoc({ id: 'skills:orf', slug: 'orf', displayName: 'ORF' })
-    getSkillBadgeMapsMock.mockResolvedValueOnce(new Map([['skills:orf', {}]]))
-    const ctx = makeLexicalCtx({
-      exactSlugSkill,
-      recentSkills: [],
-    })
-
-    const result = await lexicalFallbackSkillsHandler(ctx, {
-      query: 'orf',
-      queryTokens: ['orf'],
-      limit: 10,
-    })
-
-    expect(result).toHaveLength(1)
-    expect(result[0].skill.slug).toBe('orf')
-    expect(ctx.db.query).toHaveBeenCalledWith('skills')
-  })
-
-  it('dedupes overlap and enforces rank + limit across vector and fallback', async () => {
-    generateEmbeddingMock.mockResolvedValueOnce([0, 1, 2])
-    const vectorEntries = [
-      {
-        embeddingId: 'skillEmbeddings:a',
-        skill: makePublicSkill({
-          id: 'skills:a',
-          slug: 'foo-a',
-          displayName: 'Foo Alpha',
-          downloads: 10,
-        }),
-        version: null,
-        ownerHandle: 'one',
-      },
-      {
-        embeddingId: 'skillEmbeddings:b',
-        skill: makePublicSkill({
-          id: 'skills:b',
-          slug: 'foo-b',
-          displayName: 'Foo Beta',
-          downloads: 2,
-        }),
-        version: null,
-        ownerHandle: 'two',
-      },
-    ]
-    const fallbackEntries = [
-      {
-        skill: makePublicSkill({
-          id: 'skills:a',
-          slug: 'foo-a',
-          displayName: 'Foo Alpha',
-          downloads: 10,
-        }),
-        version: null,
-        ownerHandle: 'one',
-      },
-      {
-        skill: makePublicSkill({
-          id: 'skills:c',
-          slug: 'foo-c',
-          displayName: 'Foo Classic',
-          downloads: 1,
-        }),
-        version: null,
-        ownerHandle: 'three',
-      },
-    ]
-
-    const runQuery = vi
-      .fn()
-      .mockResolvedValueOnce(vectorEntries)
-      .mockResolvedValueOnce([])
-      .mockResolvedValueOnce(fallbackEntries)
-
-    const result = await searchSkillsHandler(
-      {
-        vectorSearch: vi.fn().mockResolvedValue([
-          { _id: 'skillEmbeddings:a', _score: 0.4 },
-          { _id: 'skillEmbeddings:b', _score: 0.9 },
-        ]),
-        runQuery,
-      },
-      { query: 'foo', limit: 2 },
-    )
-
-    expect(result).toHaveLength(2)
-    expect(result[0].skill.slug).toBe('foo-b')
-    expect(new Set(result.map((entry: { skill: { _id: string } }) => entry.skill._id)).size).toBe(2)
-  })
-
   it('advances candidate limit until max', () => {
     expect(__test.getNextCandidateLimit(50, 1000)).toBe(100)
     expect(__test.getNextCandidateLimit(800, 1000)).toBe(1000)
     expect(__test.getNextCandidateLimit(1000, 1000)).toBeNull()
   })
-
-  it('boosts exact slug/name matches over loose matches', () => {
-    const queryTokens = tokenize('notion')
-    const exactScore = __test.scoreSkillResult(queryTokens, 0.4, 'Notion Sync', 'notion-sync', 5)
-    const looseScore = __test.scoreSkillResult(queryTokens, 0.6, 'Notes Sync', 'notes-sync', 500)
-    expect(exactScore).toBeGreaterThan(looseScore)
-  })
-
-  it('adds a popularity prior for equally relevant matches', () => {
-    const queryTokens = tokenize('notion')
-    const lowDownloads = __test.scoreSkillResult(
-      queryTokens,
-      0.5,
-      'Notion Helper',
-      'notion-helper',
-      0,
-    )
-    const highDownloads = __test.scoreSkillResult(
-      queryTokens,
-      0.5,
-      'Notion Helper',
-      'notion-helper',
-      1000,
-    )
-    expect(highDownloads).toBeGreaterThan(lowDownloads)
-  })
-
-  it('merges fallback matches without duplicate skill ids', () => {
-    const primary = [
-      {
-        embeddingId: 'skillEmbeddings:1',
-        skill: { _id: 'skills:1' },
-      },
-    ] as unknown as Parameters<typeof __test.mergeUniqueBySkillId>[0]
-    const fallback = [
-      {
-        skill: { _id: 'skills:1' },
-      },
-      {
-        skill: { _id: 'skills:2' },
-      },
-    ] as unknown as Parameters<typeof __test.mergeUniqueBySkillId>[1]
-
-    const merged = __test.mergeUniqueBySkillId(primary, fallback)
-    expect(merged).toHaveLength(2)
-    expect(merged.map((entry) => entry.skill._id)).toEqual(['skills:1', 'skills:2'])
-  })
 })
-
-function makePublicSkill(params: {
-  id: string
-  slug: string
-  displayName: string
-  downloads?: number
-}) {
-  return {
-    _id: params.id,
-    _creationTime: 1,
-    slug: params.slug,
-    displayName: params.displayName,
-    summary: `${params.displayName} summary`,
-    ownerUserId: 'users:owner',
-    canonicalSkillId: undefined,
-    forkOf: undefined,
-    latestVersionId: 'skillVersions:1',
-    tags: {},
-    badges: {},
-    stats: {
-      downloads: params.downloads ?? 0,
-      installsCurrent: 0,
-      installsAllTime: 0,
-      stars: 0,
-      versions: 1,
-      comments: 0,
-    },
-    createdAt: 1,
-    updatedAt: 1,
-  }
-}
-
-function makeSkillDoc(params: { id: string; slug: string; displayName: string }) {
-  return {
-    ...makePublicSkill(params),
-    _creationTime: 1,
-    moderationStatus: 'active',
-    moderationFlags: [],
-    softDeletedAt: undefined,
-  }
-}
-
-function makeLexicalCtx(params: {
-  exactSlugSkill: ReturnType<typeof makeSkillDoc> | null
-  recentSkills: Array<ReturnType<typeof makeSkillDoc>>
-}) {
-  return {
-    db: {
-      query: vi.fn((table: string) => {
-        if (table !== 'skills') throw new Error(`Unexpected table ${table}`)
-        return {
-          withIndex: (index: string) => {
-            if (index === 'by_slug') {
-              return {
-                unique: vi.fn().mockResolvedValue(params.exactSlugSkill),
-              }
-            }
-            if (index === 'by_active_updated') {
-              return {
-                order: () => ({
-                  take: vi.fn().mockResolvedValue(params.recentSkills),
-                }),
-              }
-            }
-            throw new Error(`Unexpected index ${index}`)
-          },
-        }
-      }),
-      get: vi.fn(async (id: string) => {
-        if (id.startsWith('users:')) return { _id: id, handle: 'owner' }
-        if (id.startsWith('skillVersions:')) return { _id: id, version: '1.0.0' }
-        return null
-      }),
-    },
-  }
-}

convex/search.ts

@@ -7,86 +7,20 @@ import { generateEmbedding } from './lib/embeddings'
 import { toPublicSkill, toPublicSoul } from './lib/public'
 import { matchesExactTokens, tokenize } from './lib/searchText'
 
-type SkillSearchEntry = {
-  embeddingId?: Id<'skillEmbeddings'>
+type HydratedEntry = {
+  embeddingId: Id<'skillEmbeddings'>
   skill: NonNullable<ReturnType<typeof toPublicSkill>>
   version: Doc<'skillVersions'> | null
   ownerHandle: string | null
 }
 
-type SearchResult = SkillSearchEntry & { score: number }
-
-const SLUG_EXACT_BOOST = 1.4
-const SLUG_PREFIX_BOOST = 0.8
-const NAME_EXACT_BOOST = 1.1
-const NAME_PREFIX_BOOST = 0.6
-const POPULARITY_WEIGHT = 0.08
-const FALLBACK_SCAN_LIMIT = 1200
+type SearchResult = HydratedEntry & { score: number }
 
 function getNextCandidateLimit(current: number, max: number) {
   const next = Math.min(current * 2, max)
   return next > current ? next : null
 }
 
-function matchesAllTokens(
-  queryTokens: string[],
-  candidateTokens: string[],
-  matcher: (candidate: string, query: string) => boolean,
-) {
-  if (queryTokens.length === 0 || candidateTokens.length === 0) return false
-  return queryTokens.every((queryToken) =>
-    candidateTokens.some((candidateToken) => matcher(candidateToken, queryToken)),
-  )
-}
-
-function getLexicalBoost(queryTokens: string[], displayName: string, slug: string) {
-  const slugTokens = tokenize(slug)
-  const nameTokens = tokenize(displayName)
-
-  let boost = 0
-  if (matchesAllTokens(queryTokens, slugTokens, (candidate, query) => candidate === query)) {
-    boost += SLUG_EXACT_BOOST
-  } else if (
-    matchesAllTokens(queryTokens, slugTokens, (candidate, query) => candidate.startsWith(query))
-  ) {
-    boost += SLUG_PREFIX_BOOST
-  }
-
-  if (matchesAllTokens(queryTokens, nameTokens, (candidate, query) => candidate === query)) {
-    boost += NAME_EXACT_BOOST
-  } else if (
-    matchesAllTokens(queryTokens, nameTokens, (candidate, query) => candidate.startsWith(query))
-  ) {
-    boost += NAME_PREFIX_BOOST
-  }
-
-  return boost
-}
-
-function scoreSkillResult(
-  queryTokens: string[],
-  vectorScore: number,
-  displayName: string,
-  slug: string,
-  downloads: number,
-) {
-  const lexicalBoost = getLexicalBoost(queryTokens, displayName, slug)
-  const popularityBoost = Math.log1p(Math.max(downloads, 0)) * POPULARITY_WEIGHT
-  return vectorScore + lexicalBoost + popularityBoost
-}
-
-function mergeUniqueBySkillId(primary: SkillSearchEntry[], fallback: SkillSearchEntry[]) {
-  if (fallback.length === 0) return primary
-  const out = [...primary]
-  const seen = new Set(primary.map((entry) => entry.skill._id))
-  for (const entry of fallback) {
-    if (seen.has(entry.skill._id)) continue
-    seen.add(entry.skill._id)
-    out.push(entry)
-  }
-  return out
-}
-
 export const searchSkills: ReturnType<typeof action> = action({
   args: {
     query: v.string(),
@@ -109,9 +43,9 @@ export const searchSkills: ReturnType<typeof action> = action({
     // Convex vectorSearch max limit is 256; clamp candidate sizes accordingly.
     const maxCandidate = Math.min(Math.max(limit * 10, 200), 256)
     let candidateLimit = Math.min(Math.max(limit * 3, 50), 256)
-    let hydrated: SkillSearchEntry[] = []
+    let hydrated: HydratedEntry[] = []
     let scoreById = new Map<Id<'skillEmbeddings'>, number>()
-    let exactMatches: SkillSearchEntry[] = []
+    let exactMatches: HydratedEntry[] = []
 
     while (candidateLimit <= maxCandidate) {
       const results = await ctx.vectorSearch('skillEmbeddings', 'by_embedding', {
@@ -122,7 +56,7 @@ export const searchSkills: ReturnType<typeof action> = action({
 
       hydrated = (await ctx.runQuery(internal.search.hydrateResults, {
         embeddingIds: results.map((result) => result._id),
-      })) as SkillSearchEntry[]
+      })) as HydratedEntry[]
 
       scoreById = new Map<Id<'skillEmbeddings'>, number>(
         results.map((result) => [result._id, result._score]),
@@ -161,34 +95,12 @@ export const searchSkills: ReturnType<typeof action> = action({
       candidateLimit = nextLimit
     }
 
-    const fallbackMatches =
-      exactMatches.length >= limit
-        ? []
-        : ((await ctx.runQuery(internal.search.lexicalFallbackSkills, {
-            query,
-            queryTokens,
-            limit: Math.min(Math.max(limit * 4, 200), FALLBACK_SCAN_LIMIT),
-            highlightedOnly: args.highlightedOnly,
-          })) as SkillSearchEntry[])
-
-    const mergedMatches = mergeUniqueBySkillId(exactMatches, fallbackMatches)
-
-    return mergedMatches
-      .map((entry) => {
-        const vectorScore = entry.embeddingId ? (scoreById.get(entry.embeddingId) ?? 0) : 0
-        return {
-          ...entry,
-          score: scoreSkillResult(
-            queryTokens,
-            vectorScore,
-            entry.skill.displayName,
-            entry.skill.slug,
-            entry.skill.stats.downloads,
-          ),
-        }
-      })
+    return exactMatches
+      .map((entry) => ({
+        ...entry,
+        score: scoreById.get(entry.embeddingId) ?? 0,
+      }))
       .filter((entry) => entry.skill)
-      .sort((a, b) => b.score - a.score || b.skill.stats.downloads - a.skill.stats.downloads)
       .slice(0, limit)
   },
 })
@@ -203,7 +115,7 @@ export const getBadgeMapsForSkills = internalQuery({
 
 export const hydrateResults = internalQuery({
   args: { embeddingIds: v.array(v.id('skillEmbeddings')) },
-  handler: async (ctx, args): Promise<SkillSearchEntry[]> => {
+  handler: async (ctx, args): Promise<HydratedEntry[]> => {
     const ownerHandleCache = new Map<Id<'users'>, Promise<string | null>>()
 
     const getOwnerHandle = (ownerUserId: Id<'users'>) => {
@@ -232,92 +144,7 @@ export const hydrateResults = internalQuery({
       }),
     )
 
-    return entries.filter((entry): entry is SkillSearchEntry => entry !== null)
-  },
-})
-
-export const lexicalFallbackSkills = internalQuery({
-  args: {
-    query: v.string(),
-    queryTokens: v.array(v.string()),
-    limit: v.optional(v.number()),
-    highlightedOnly: v.optional(v.boolean()),
-  },
-  handler: async (ctx, args): Promise<SkillSearchEntry[]> => {
-    const limit = Math.min(Math.max(args.limit ?? 200, 10), FALLBACK_SCAN_LIMIT)
-    const seenSkillIds = new Set<Id<'skills'>>()
-    const candidateSkills: Doc<'skills'>[] = []
-
-    const slugQuery = args.query.trim().toLowerCase()
-    if (/^[a-z0-9][a-z0-9-]*$/.test(slugQuery)) {
-      const exactSlugSkill = await ctx.db
-        .query('skills')
-        .withIndex('by_slug', (q) => q.eq('slug', slugQuery))
-        .unique()
-      if (exactSlugSkill && !exactSlugSkill.softDeletedAt) {
-        seenSkillIds.add(exactSlugSkill._id)
-        candidateSkills.push(exactSlugSkill)
-      }
-    }
-
-    const recentSkills = await ctx.db
-      .query('skills')
-      .withIndex('by_active_updated', (q) => q.eq('softDeletedAt', undefined))
-      .order('desc')
-      .take(FALLBACK_SCAN_LIMIT)
-
-    for (const skill of recentSkills) {
-      if (seenSkillIds.has(skill._id)) continue
-      seenSkillIds.add(skill._id)
-      candidateSkills.push(skill)
-    }
-
-    const matched = candidateSkills.filter((skill) =>
-      matchesExactTokens(args.queryTokens, [skill.displayName, skill.slug, skill.summary]),
-    )
-    if (matched.length === 0) return []
-
-    const ownerHandleCache = new Map<Id<'users'>, Promise<string | null>>()
-    const getOwnerHandle = (ownerUserId: Id<'users'>) => {
-      const cached = ownerHandleCache.get(ownerUserId)
-      if (cached) return cached
-      const handlePromise = ctx.db
-        .get(ownerUserId)
-        .then((owner) => owner?.handle ?? owner?._id ?? null)
-      ownerHandleCache.set(ownerUserId, handlePromise)
-      return handlePromise
-    }
-
-    const entries = await Promise.all(
-      matched.map(async (skill) => {
-        const [version, ownerHandle] = await Promise.all([
-          skill.latestVersionId ? ctx.db.get(skill.latestVersionId) : Promise.resolve(null),
-          getOwnerHandle(skill.ownerUserId),
-        ])
-        const publicSkill = toPublicSkill(skill)
-        if (!publicSkill) return null
-        return { skill: publicSkill, version, ownerHandle }
-      }),
-    )
-    const validEntries = entries.filter((entry): entry is SkillSearchEntry => entry !== null)
-    if (validEntries.length === 0) return []
-
-    const badgeMap = await getSkillBadgeMaps(
-      ctx,
-      validEntries.map((entry) => entry.skill._id),
-    )
-    const withBadges = validEntries.map((entry) => ({
-      ...entry,
-      skill: {
-        ...entry.skill,
-        badges: badgeMap.get(entry.skill._id) ?? {},
-      },
-    }))
-
-    const filtered = args.highlightedOnly
-      ? withBadges.filter((entry) => isSkillHighlighted(entry.skill))
-      : withBadges
-    return filtered.slice(0, limit)
+    return entries.filter((entry): entry is HydratedEntry => entry !== null)
   },
 })
 
@@ -424,10 +251,4 @@ export const getSkillBadgeMapsInternal = internalQuery({
   },
 })
 
-export const __test = {
-  getNextCandidateLimit,
-  matchesAllTokens,
-  getLexicalBoost,
-  scoreSkillResult,
-  mergeUniqueBySkillId,
-}
+export const __test = { getNextCandidateLimit }

convex/skillStatEvents.test.ts

@@ -1,110 +0,0 @@
-/* @vitest-environment node */
-import { describe, expect, it } from 'vitest'
-
-// Test the aggregateEvents function by importing and testing the module logic
-// Since aggregateEvents is not exported, we test the behavior indirectly through
-// the event processing contract
-
-describe('skill stat events - comment delta handling', () => {
-  it('aggregates comment and uncomment events into net deltas', () => {
-    // Simulate the aggregation logic from processSkillStatEventsAction
-    type EventKind =
-      | 'download'
-      | 'star'
-      | 'unstar'
-      | 'comment'
-      | 'uncomment'
-      | 'install_new'
-      | 'install_reactivate'
-      | 'install_deactivate'
-      | 'install_clear'
-
-    const events: { kind: EventKind; occurredAt: number }[] = [
-      { kind: 'star', occurredAt: 1000 },
-      { kind: 'comment', occurredAt: 2000 },
-      { kind: 'comment', occurredAt: 3000 },
-      { kind: 'uncomment', occurredAt: 4000 },
-      { kind: 'download', occurredAt: 5000 },
-    ]
-
-    // Replicate the aggregation logic
-    const result = {
-      downloads: 0,
-      stars: 0,
-      comments: 0,
-      installsAllTime: 0,
-      installsCurrent: 0,
-      downloadEvents: [] as number[],
-      installNewEvents: [] as number[],
-    }
-
-    for (const event of events) {
-      switch (event.kind) {
-        case 'download':
-          result.downloads += 1
-          result.downloadEvents.push(event.occurredAt)
-          break
-        case 'star':
-          result.stars += 1
-          break
-        case 'unstar':
-          result.stars -= 1
-          break
-        case 'comment':
-          result.comments += 1
-          break
-        case 'uncomment':
-          result.comments -= 1
-          break
-        case 'install_new':
-          result.installsAllTime += 1
-          result.installsCurrent += 1
-          result.installNewEvents.push(event.occurredAt)
-          break
-        case 'install_reactivate':
-          result.installsCurrent += 1
-          break
-        case 'install_deactivate':
-          result.installsCurrent -= 1
-          break
-      }
-    }
-
-    expect(result.stars).toBe(1)
-    expect(result.comments).toBe(1) // 2 comments - 1 uncomment
-    expect(result.downloads).toBe(1)
-    expect(result.downloadEvents).toEqual([5000])
-  })
-
-  it('should include comments in delta check (regression test for dropped comments)', () => {
-    // This test verifies the fix: the condition guard in applyAggregatedStatsAndUpdateCursor
-    // must include comments !== 0 so comment-only batches are not skipped
-    const delta = {
-      downloads: 0,
-      stars: 0,
-      comments: 3,
-      installsAllTime: 0,
-      installsCurrent: 0,
-    }
-
-    // The OLD buggy condition (missing comments):
-    const oldCondition =
-      delta.downloads !== 0 ||
-      delta.stars !== 0 ||
-      delta.installsAllTime !== 0 ||
-      delta.installsCurrent !== 0
-
-    // The FIXED condition (includes comments):
-    const fixedCondition =
-      delta.downloads !== 0 ||
-      delta.stars !== 0 ||
-      delta.comments !== 0 ||
-      delta.installsAllTime !== 0 ||
-      delta.installsCurrent !== 0
-
-    // With only comment deltas, the old condition would skip the patch
-    expect(oldCondition).toBe(false)
-    // The fixed condition correctly triggers the patch
-    expect(fixedCondition).toBe(true)
-  })
-})

convex/skillStatEvents.ts

@@ -35,8 +35,6 @@ export type StatEventKind =
   | 'download'
   | 'star'
   | 'unstar'
-  | 'comment'
-  | 'uncomment'
   | 'install_new'
   | 'install_reactivate'
   | 'install_deactivate'
@@ -88,7 +86,6 @@ export async function insertStatEvent(
 type AggregatedDeltas = {
   downloads: number
   stars: number
-  comments: number
   installsAllTime: number
   installsCurrent: number
   /** Original timestamps for each download event (for daily stats bucketing) */
@@ -120,7 +117,6 @@ function aggregateEvents(events: Doc<'skillStatEvents'>[]): AggregatedDeltas {
   const result: AggregatedDeltas = {
     downloads: 0,
     stars: 0,
-    comments: 0,
     installsAllTime: 0,
     installsCurrent: 0,
     downloadEvents: [],
@@ -139,12 +135,6 @@ function aggregateEvents(events: Doc<'skillStatEvents'>[]): AggregatedDeltas {
       case 'unstar':
         result.stars -= 1
         break
-      case 'comment':
-        result.comments += 1
-        break
-      case 'uncomment':
-        result.comments -= 1
-        break
       case 'install_new':
         // New user installing for the first time: count toward both lifetime and current
         result.installsAllTime += 1
@@ -241,14 +231,12 @@ export const processSkillStatEventsInternal = internalMutation({
       if (
         deltas.downloads !== 0 ||
         deltas.stars !== 0 ||
-        deltas.comments !== 0 ||
         deltas.installsAllTime !== 0 ||
         deltas.installsCurrent !== 0
       ) {
         const patch = applySkillStatDeltas(skill, {
           downloads: deltas.downloads,
           stars: deltas.stars,
-          comments: deltas.comments,
           installsAllTime: deltas.installsAllTime,
           installsCurrent: deltas.installsCurrent,
         })
@@ -297,7 +285,7 @@ export const processSkillStatEventsInternal = internalMutation({
 
 const CURSOR_KEY = 'skill_stat_events'
 const EVENT_BATCH_SIZE = 500
-const MAX_SKILLS_PER_RUN = 50
+const MAX_SKILLS_PER_RUN = 500
 
 /**
  * Fetch a batch of events after the given cursor (by _creationTime).
@@ -344,7 +332,6 @@ const skillDeltaValidator = v.object({
   skillId: v.id('skills'),
   downloads: v.number(),
   stars: v.number(),
-  comments: v.number(),
   installsAllTime: v.number(),
   installsCurrent: v.number(),
   downloadEvents: v.array(v.number()),
@@ -379,14 +366,12 @@ export const applyAggregatedStatsAndUpdateCursor = internalMutation({
       if (
         delta.downloads !== 0 ||
         delta.stars !== 0 ||
-        delta.comments !== 0 ||
         delta.installsAllTime !== 0 ||
         delta.installsCurrent !== 0
       ) {
         const patch = applySkillStatDeltas(skill, {
           downloads: delta.downloads,
           stars: delta.stars,
-          comments: delta.comments,
           installsAllTime: delta.installsAllTime,
           installsCurrent: delta.installsCurrent,
         })
@@ -453,7 +438,6 @@ export const processSkillStatEventsAction = internalAction({
       {
         downloads: number
         stars: number
-        comments: number
         installsAllTime: number
         installsCurrent: number
         downloadEvents: number[]
@@ -487,7 +471,6 @@ export const processSkillStatEventsAction = internalAction({
           skillDelta = {
             downloads: 0,
             stars: 0,
-            comments: 0,
             installsAllTime: 0,
             installsCurrent: 0,
             downloadEvents: [],
@@ -508,12 +491,6 @@ export const processSkillStatEventsAction = internalAction({
           case 'unstar':
             skillDelta.stars -= 1
             break
-          case 'comment':
-            skillDelta.comments += 1
-            break
-          case 'uncomment':
-            skillDelta.comments -= 1
-            break
           case 'install_new':
             skillDelta.installsAllTime += 1
             skillDelta.installsCurrent += 1

convex/statsMaintenance.ts

@@ -200,102 +200,6 @@ function buildSkillStatPatch(skill: Doc<'skills'>) {
   }
 }
 
-/**
- * Reconcile skill stats by counting actual records in source-of-truth tables.
- *
- * This fixes stats that got out of sync due to missed events, cursor issues,
- * or bugs in the event processing pipeline. It counts:
- * - stars: actual records in the `stars` table for each skill
- * - comments: actual records in the `comments` table for each skill
- *
- * Downloads and installs are event-sourced only (no separate table to count from),
- * so they cannot be reconciled this way.
- */
-export const reconcileSkillStarCounts = internalMutation({
-  args: {
-    cursor: v.optional(v.string()),
-    batchSize: v.optional(v.number()),
-  },
-  handler: async (ctx, args) => {
-    const batchSize = clampInt(args.batchSize ?? 50, 1, 200)
-    const now = Date.now()
-
-    const { page, isDone, continueCursor } = await ctx.db
-      .query('skills')
-      .order('asc')
-      .paginate({ cursor: args.cursor ?? null, numItems: batchSize })
-
-    let patched = 0
-    for (const skill of page) {
-      // Count actual star records for this skill
-      const starRecords = await ctx.db
-        .query('stars')
-        .withIndex('by_skill_user', (q) => q.eq('skillId', skill._id))
-        .collect()
-      const actualStars = starRecords.length
-
-      // Count actual comment records for this skill
-      const commentRecords = await ctx.db
-        .query('comments')
-        .withIndex('by_skill', (q) => q.eq('skillId', skill._id))
-        .collect()
-      const actualComments = commentRecords.filter((c) => !c.softDeletedAt).length
-
-      // Check if stats are out of sync
-      if (skill.stats.stars !== actualStars || skill.stats.comments !== actualComments) {
-        const updatedStats = {
-          ...skill.stats,
-          stars: actualStars,
-          comments: actualComments,
-        }
-        await ctx.db.patch(skill._id, {
-          statsStars: actualStars,
-          stats: updatedStats,
-          updatedAt: now,
-        })
-        patched += 1
-      }
-    }
-
-    return {
-      scanned: page.length,
-      patched,
-      cursor: isDone ? null : continueCursor,
-      isDone,
-    }
-  },
-})
-
-export const runReconcileSkillStarCountsInternal = internalAction({
-  args: {
-    batchSize: v.optional(v.number()),
-    maxBatches: v.optional(v.number()),
-  },
-  handler: async (ctx, args) => {
-    const batchSize = clampInt(args.batchSize ?? 50, 1, 200)
-    const maxBatches = clampInt(args.maxBatches ?? 10, 1, 50)
-
-    let cursor: string | undefined
-    let totalScanned = 0
-    let totalPatched = 0
-
-    for (let i = 0; i < maxBatches; i++) {
-      const result = (await ctx.runMutation(internal.statsMaintenance.reconcileSkillStarCounts, {
-        cursor,
-        batchSize,
-      })) as { scanned: number; patched: number; cursor: string | null; isDone: boolean }
-
-      totalScanned += result.scanned
-      totalPatched += result.patched
-
-      if (result.isDone) break
-      cursor = result.cursor ?? undefined
-    }
-
-    return { scanned: totalScanned, patched: totalPatched }
-  },
-})
-
 function clampInt(value: number, min: number, max: number) {
   return Math.min(Math.max(value, min), max)
 }

convex/users.ts

@@ -76,18 +76,19 @@ export const ensure = mutation({
   args: {},
   handler: async (ctx) => {
     const { userId, user } = await requireUser(ctx)
+    const now = Date.now()
     const updates: Record<string, unknown> = {}
 
-    const handle = user.handle || user.name || user.email?.split('@')[0]
+    const handle = user.handle ?? user.name ?? user.email?.split('@')[0]
     if (!user.handle && handle) updates.handle = handle
     if (!user.displayName) updates.displayName = handle
     if (!user.role) {
       updates.role = handle === ADMIN_HANDLE ? 'admin' : DEFAULT_ROLE
     }
     if (!user.createdAt) updates.createdAt = user._creationTime
+    updates.updatedAt = now
 
     if (Object.keys(updates).length > 0) {
-      updates.updatedAt = Date.now()
       await ctx.db.patch(userId, updates)
     }
 
@@ -193,32 +194,23 @@ async function setRoleWithActor(
 }
 
 export const banUser = mutation({
-  args: { userId: v.id('users'), reason: v.optional(v.string()) },
+  args: { userId: v.id('users') },
   handler: async (ctx, args) => {
     const { user } = await requireUser(ctx)
-    return banUserWithActor(ctx, user, args.userId, args.reason)
+    return banUserWithActor(ctx, user, args.userId)
   },
 })
 
 export const banUserInternal = internalMutation({
-  args: {
-    actorUserId: v.id('users'),
-    targetUserId: v.id('users'),
-    reason: v.optional(v.string()),
-  },
+  args: { actorUserId: v.id('users'), targetUserId: v.id('users') },
   handler: async (ctx, args) => {
     const actor = await ctx.db.get(args.actorUserId)
     if (!actor || actor.deletedAt) throw new Error('User not found')
-    return banUserWithActor(ctx, actor, args.targetUserId, args.reason)
+    return banUserWithActor(ctx, actor, args.targetUserId)
   },
 })
 
-async function banUserWithActor(
-  ctx: MutationCtx,
-  actor: Doc<'users'>,
-  targetUserId: Id<'users'>,
-  reasonRaw?: string,
-) {
+async function banUserWithActor(ctx: MutationCtx, actor: Doc<'users'>, targetUserId: Id<'users'>) {
   assertModerator(actor)
 
   if (targetUserId === actor._id) throw new Error('Cannot ban yourself')
@@ -230,10 +222,6 @@ async function banUserWithActor(
   }
 
   const now = Date.now()
-  const reason = reasonRaw?.trim()
-  if (reason && reason.length > 500) {
-    throw new Error('Reason too long (max 500 chars)')
-  }
   if (target.deletedAt) {
     return { ok: true as const, alreadyBanned: true, deletedSkills: 0 }
   }
@@ -262,7 +250,6 @@ async function banUserWithActor(
     deletedAt: now,
     role: 'user',
     updatedAt: now,
-    banReason: reason || undefined,
   })
 
   await ctx.runMutation(internal.telemetry.clearUserTelemetryInternal, { userId: targetUserId })
@@ -272,89 +259,9 @@ async function banUserWithActor(
     action: 'user.ban',
     targetType: 'user',
     targetId: targetUserId,
-    metadata: { deletedSkills: skills.length, reason: reason || undefined },
+    metadata: { deletedSkills: skills.length },
     createdAt: now,
   })
 
   return { ok: true as const, alreadyBanned: false, deletedSkills: skills.length }
 }
-
-/**
- * Auto-ban a user whose skill was flagged malicious by VT.
- * Skips moderators/admins. No actor required — this is a system-level action.
- */
-export const autobanMalwareAuthorInternal = internalMutation({
-  args: {
-    ownerUserId: v.id('users'),
-    sha256hash: v.string(),
-    slug: v.string(),
-  },
-  handler: async (ctx, args) => {
-    const target = await ctx.db.get(args.ownerUserId)
-    if (!target) return { ok: false, reason: 'user_not_found' }
-    if (target.deletedAt) return { ok: true, alreadyBanned: true }
-
-    // Never auto-ban moderators or admins
-    if (target.role === 'admin' || target.role === 'moderator') {
-      console.log(`[autoban] Skipping ${target.handle ?? args.ownerUserId}: role=${target.role}`)
-      return { ok: false, reason: 'protected_role' }
-    }
-
-    const now = Date.now()
-
-    // Soft-delete all their skills
-    const skills = await ctx.db
-      .query('skills')
-      .withIndex('by_owner', (q) => q.eq('ownerUserId', args.ownerUserId))
-      .collect()
-
-    for (const skill of skills) {
-      if (!skill.softDeletedAt) {
-        await ctx.db.patch(skill._id, { softDeletedAt: now, updatedAt: now })
-      }
-    }
-
-    // Revoke all API tokens
-    const tokens = await ctx.db
-      .query('apiTokens')
-      .withIndex('by_user', (q) => q.eq('userId', args.ownerUserId))
-      .collect()
-    for (const token of tokens) {
-      if (!token.revokedAt) {
-        await ctx.db.patch(token._id, { revokedAt: now })
-      }
-    }
-
-    // Ban the user
-    await ctx.db.patch(args.ownerUserId, {
-      deletedAt: now,
-      role: 'user',
-      updatedAt: now,
-    })
-
-    await ctx.runMutation(internal.telemetry.clearUserTelemetryInternal, {
-      userId: args.ownerUserId,
-    })
-
-    // Audit log — use the target as actor since there's no human actor
-    await ctx.db.insert('auditLogs', {
-      actorUserId: args.ownerUserId,
-      action: 'user.autoban.malware',
-      targetType: 'user',
-      targetId: args.ownerUserId,
-      metadata: {
-        trigger: 'vt.malicious',
-        sha256hash: args.sha256hash,
-        slug: args.slug,
-        deletedSkills: skills.length,
-      },
-      createdAt: now,
-    })
-
-    console.warn(
-      `[autoban] Banned ${target.handle ?? args.ownerUserId} — malicious skill: ${args.slug}`,
-    )
-
-    return { ok: true, alreadyBanned: false, deletedSkills: skills.length }
-  },
-})

docs/cli.md

@@ -131,7 +131,6 @@ Stores your API token + cached registry URL.
 - Calls `POST /api/v1/users/ban`.
 - `--id` treats the argument as a user id instead of a handle.
 - `--fuzzy` resolves the handle via fuzzy user search (admin only).
-- `--reason` records an optional ban reason.
 - `--yes` skips confirmation.
 
 ### `set-role <handleOrId> <role>`

docs/deploy.md

@@ -30,7 +30,6 @@ Ensure Convex env is set (auth + embeddings):
 - `OPENAI_API_KEY`
 - `SITE_URL` (your web app URL)
 - Optional webhook env (see `docs/webhook.md`)
-- Optional: `GITHUB_TOKEN` (recommended; raises GitHub account lookup limit used by publish gate)
 
 ## 2) Deploy web app (Vercel)
 

docs/http-api.md

@@ -40,10 +40,6 @@ Response:
 { "results": [{ "score": 0.123, "slug": "gifgrep", "displayName": "GifGrep", "summary": "…", "version": "1.2.3", "updatedAt": 1730000000000 }] }
 ```
 
-Notes:
-
-- Results are returned in relevance order (embedding similarity + exact slug/name token boosts + popularity prior from downloads).
-
 ### `GET /api/v1/skills`
 
 Query params:
@@ -156,13 +152,13 @@ Ban a user and hard-delete owned skills (moderator/admin only).
 Body:
 
 ```json
-{ "handle": "user_handle", "reason": "optional ban reason" }
+{ "handle": "user_handle" }
 ```
 
 or
 
 ```json
-{ "userId": "users_...", "reason": "optional ban reason" }
+{ "userId": "users_..." }
 ```
 
 Response:

docs/security.md

@@ -36,7 +36,6 @@ read_when:
   - hard-deletes all owned skills
   - revokes API tokens
   - sets `deletedAt` on the user
-- Optional ban reason is stored in `users.banReason` and audit logs.
 - Moderators cannot ban admins; nobody can ban themselves.
 - Report counters effectively reset because deleted/banned skills are no longer
   considered active in the per-user report cap.
@@ -49,7 +48,3 @@ read_when:
   - `githubFetchedAt` (fetch timestamp)
 - Cache TTL: 24 hours.
 - Gate applies to web uploads, CLI publish, and GitHub import.
-- If GitHub responds `403` or `429`, publish fails with:
-  - `GitHub API rate limit exceeded — please try again in a few minutes`
-- To reduce rate-limit failures, set `GITHUB_TOKEN` in Convex env for authenticated
-  GitHub API requests.

docs/skill-format.md

@@ -35,99 +35,6 @@ Workdir install state (written by the CLI):
 - The server extracts metadata from frontmatter during publish.
 - `description` is used as the skill summary in the UI/search.
 
-## Frontmatter metadata
-
-Skill metadata is declared in the YAML frontmatter at the top of your `SKILL.md`. This tells the registry (and security analysis) what your skill needs to run.
-
-### Basic frontmatter
-
-```yaml
----
-name: my-skill
-description: Short summary of what this skill does.
-version: 1.0.0
----
-```
-
-### Runtime metadata (`metadata.openclaw`)
-
-Declare your skill's runtime requirements under `metadata.openclaw` (aliases: `metadata.clawdbot`, `metadata.clawdis`).
-
-```yaml
----
-name: my-skill
-description: Manage tasks via the Todoist API.
-metadata:
-  openclaw:
-    requires:
-      env:
-        - TODOIST_API_KEY
-      bins:
-        - curl
-    primaryEnv: TODOIST_API_KEY
----
-```
-
-### Full field reference
-
-| Field | Type | Description |
-|-------|------|-------------|
-| `requires.env` | `string[]` | Environment variables your skill expects. |
-| `requires.bins` | `string[]` | CLI binaries that must all be installed. |
-| `requires.anyBins` | `string[]` | CLI binaries where at least one must exist. |
-| `requires.config` | `string[]` | Config file paths your skill reads. |
-| `primaryEnv` | `string` | The main credential env var for your skill. |
-| `always` | `boolean` | If `true`, skill is always active (no explicit install needed). |
-| `skillKey` | `string` | Override the skill's invocation key. |
-| `emoji` | `string` | Display emoji for the skill. |
-| `homepage` | `string` | URL to the skill's homepage or docs. |
-| `os` | `string[]` | OS restrictions (e.g. `["macos"]`, `["linux"]`). |
-| `install` | `array` | Install specs for dependencies (see below). |
-| `nix` | `object` | Nix plugin spec (see README). |
-| `config` | `object` | Clawdbot config spec (see README). |
-
-### Install specs
-
-If your skill needs dependencies installed, declare them in the `install` array:
-
-```yaml
-metadata:
-  openclaw:
-    install:
-      - kind: brew
-        formula: jq
-        bins: [jq]
-      - kind: node
-        package: typescript
-        bins: [tsc]
-```
-
-Supported install kinds: `brew`, `node`, `go`, `uv`.
-
-### Why this matters
-
-ClawHub's security analysis checks that what your skill declares matches what it actually does. If your code references `TODOIST_API_KEY` but your frontmatter doesn't declare it under `requires.env`, the analysis will flag a metadata mismatch. Keeping declarations accurate helps your skill pass review and helps users understand what they're installing.
-
-### Example: complete frontmatter
-
-```yaml
----
-name: todoist-cli
-description: Manage Todoist tasks, projects, and labels from the command line.
-version: 1.2.0
-metadata:
-  openclaw:
-    requires:
-      env:
-        - TODOIST_API_KEY
-      bins:
-        - curl
-    primaryEnv: TODOIST_API_KEY
-    emoji: "\u2705"
-    homepage: https://github.com/example/todoist-cli
----
-```
-
 ## Allowed files
 
 Only “text-based” files are accepted by publish.

docs/troubleshooting.md

@@ -23,12 +23,6 @@ read_when:
 - Set `OPENAI_API_KEY` in the Convex environment (not only locally).
 - Re-run `bunx convex dev` / `bunx convex deploy` after setting env.
 
-## `publish` fails with `GitHub API rate limit exceeded`
-
-- This is the GitHub account-age gate lookup hitting unauthenticated limits.
-- Set `GITHUB_TOKEN` in Convex environment to use authenticated GitHub API limits.
-- Retry publish after a short wait if the limit was already exhausted.
-
 ## `sync` says “No skills found”
 
 - `sync` looks for folders containing `SKILL.md` (or `skill.md`).

e2e/clawdhub.e2e.test.ts

@@ -20,6 +20,7 @@ const REQUEST_TIMEOUT_MS = 15_000
 try {
   setGlobalDispatcher(
     new Agent({
+      allowH2: true,
       connect: { timeout: REQUEST_TIMEOUT_MS },
     }),
   )

package.json

@@ -76,7 +76,6 @@
     "only-allow": "^1.2.2",
     "oxlint": "^1.42.0",
     "oxlint-tsgolint": "^0.11.4",
-    "undici": "^7.19.2",
     "typescript": "^5.9.3",
     "vite": "^7.3.1",
     "vitest": "^4.0.18"

packages/clawdhub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawhub",
-  "version": "0.6.1",
+  "version": "0.5.0",
   "description": "ClawHub CLI \\u2014 install, update, search, and publish agent skills.",
   "license": "MIT",
   "type": "module",

packages/clawdhub/src/cli.ts

@@ -305,7 +305,6 @@ program
   .argument('<handleOrId>', 'User handle (default) or user id')
   .option('--id', 'Treat argument as user id')
   .option('--fuzzy', 'Resolve handle via fuzzy user search (admin only)')
-  .option('--reason <reason>', 'Ban reason (optional)')
   .option('--yes', 'Skip confirmation')
   .action(async (handleOrId, options) => {
     const opts = await resolveGlobalOpts()

packages/clawdhub/src/cli/commands/moderation.test.ts

@@ -62,25 +62,6 @@ describe('cmdBanUser', () => {
     )
   })
 
-  it('includes reason when provided', async () => {
-    mockApiRequest.mockResolvedValueOnce({ ok: true, alreadyBanned: false, deletedSkills: 0 })
-    await cmdBanUser(
-      makeOpts(),
-      'hightower6eu',
-      { yes: true, reason: 'malware distribution' },
-      false,
-    )
-    expect(mockApiRequest).toHaveBeenCalledWith(
-      expect.anything(),
-      expect.objectContaining({
-        method: 'POST',
-        path: '/api/v1/users/ban',
-        body: { handle: 'hightower6eu', reason: 'malware distribution' },
-      }),
-      expect.anything(),
-    )
-  })
-
   it('posts user id payload when --id is set', async () => {
     mockApiRequest.mockResolvedValueOnce({ ok: true, alreadyBanned: false, deletedSkills: 0 })
     await cmdBanUser(makeOpts(), 'user_123', { yes: true, id: true }, false)

packages/clawdhub/src/cli/commands/moderation.ts

@@ -22,14 +22,12 @@ async function requireToken() {
 export async function cmdBanUser(
   opts: GlobalOpts,
   identifierArg: string,
-  options: { yes?: boolean; id?: boolean; fuzzy?: boolean; reason?: string },
+  options: { yes?: boolean; id?: boolean; fuzzy?: boolean },
   inputAllowed: boolean,
 ) {
   const raw = identifierArg.trim()
   if (!raw) fail('Handle or user id required')
 
-  const reason = options.reason?.trim() || undefined
-
   const token = await requireToken()
   const registry = await getRegistry(opts, { cache: true })
   const allowPrompt = isInteractive() && inputAllowed !== false
@@ -57,9 +55,7 @@ export async function cmdBanUser(
         method: 'POST',
         path: `${ApiRoutes.users}/ban`,
         token,
-        body: resolved.userId
-          ? { userId: resolved.userId, reason }
-          : { handle: resolved.handle, reason },
+        body: resolved.userId ? { userId: resolved.userId } : { handle: resolved.handle },
       },
       ApiV1BanUserResponseSchema,
     )

packages/clawdhub/src/cli/commands/skills.ts

@@ -73,36 +73,16 @@ export async function cmdInstall(
 
   const spinner = createSpinner(`Resolving ${trimmed}`)
   try {
-    // Fetch skill metadata including moderation status
-    const skillMeta = await apiRequest(
-      registry,
-      { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(trimmed)}` },
-      ApiV1SkillResponseSchema,
-    )
-
-    // Check moderation status before proceeding
-    if (skillMeta.moderation?.isMalwareBlocked) {
-      spinner.fail(`Blocked: ${trimmed} is flagged as malicious`)
-      fail('This skill has been flagged as malware and cannot be installed.')
-    }
-
-    if (skillMeta.moderation?.isSuspicious && !force) {
-      spinner.stop()
-      console.log(
-        `\n⚠️  Warning: "${trimmed}" is flagged as suspicious by VirusTotal Code Insight.\n` +
-          '   This skill may contain risky patterns (crypto keys, external APIs, eval, etc.)\n' +
-          '   Review the skill code before use.\n',
-      )
-      if (isInteractive()) {
-        const confirm = await promptConfirm('Install anyway?')
-        if (!confirm) fail('Installation cancelled')
-        spinner.start(`Resolving ${trimmed}`)
-      } else {
-        fail('Use --force to install suspicious skills in non-interactive mode')
-      }
-    }
-
-    const resolvedVersion = versionFlag ?? skillMeta.latestVersion?.version ?? null
+    const resolvedVersion =
+      versionFlag ??
+      (
+        await apiRequest(
+          registry,
+          { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(trimmed)}` },
+          ApiV1SkillResponseSchema,
+        )
+      ).latestVersion?.version ??
+      null
     if (!resolvedVersion) fail('Could not resolve latest version')
 
     spinner.text = `Downloading ${trimmed}@${resolvedVersion}`
@@ -158,39 +138,6 @@ export async function cmdUpdate(
       const target = join(opts.dir, entry)
       const exists = await fileExists(target)
 
-      // Always fetch skill metadata to check moderation status
-      const skillMeta = await apiRequest(
-        registry,
-        { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(entry)}` },
-        ApiV1SkillResponseSchema,
-      )
-
-      // Check moderation status before proceeding
-      if (skillMeta.moderation?.isMalwareBlocked) {
-        spinner.fail(`${entry}: blocked as malicious`)
-        console.log('   This skill has been flagged as malware and cannot be updated.')
-        continue
-      }
-
-      if (skillMeta.moderation?.isSuspicious && !options.force) {
-        spinner.stop()
-        console.log(
-          `\n⚠️  Warning: "${entry}" is flagged as suspicious by VirusTotal Code Insight.\n` +
-            '   This skill may contain risky patterns (crypto keys, external APIs, eval, etc.)\n',
-        )
-        if (allowPrompt) {
-          const confirm = await promptConfirm('Update anyway?')
-          if (!confirm) {
-            console.log(`${entry}: skipped`)
-            continue
-          }
-          spinner.start(`Checking ${entry}`)
-        } else {
-          console.log(`${entry}: skipped (use --force to update suspicious skills)`)
-          continue
-        }
-      }
-
       let localFingerprint: string | null = null
       if (exists) {
         const filesOnDisk = await listTextFiles(target)
@@ -204,7 +151,12 @@ export async function cmdUpdate(
       if (localFingerprint) {
         resolveResult = await resolveSkillVersion(registry, entry, localFingerprint)
       } else {
-        resolveResult = { match: null, latestVersion: skillMeta.latestVersion ?? null }
+        const meta = await apiRequest(
+          registry,
+          { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(entry)}` },
+          ApiV1SkillResponseSchema,
+        )
+        resolveResult = { match: null, latestVersion: meta.latestVersion ?? null }
       }
 
       const latest = resolveResult.latestVersion?.version ?? null

packages/clawdhub/src/config.test.ts

@@ -1,73 +0,0 @@
-/* @vitest-environment node */
-
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-const chmodMock = vi.fn()
-const mkdirMock = vi.fn()
-const readFileMock = vi.fn()
-const writeFileMock = vi.fn()
-
-vi.mock('node:fs/promises', () => ({
-  chmod: (...args: unknown[]) => chmodMock(...args),
-  mkdir: (...args: unknown[]) => mkdirMock(...args),
-  readFile: (...args: unknown[]) => readFileMock(...args),
-  writeFile: (...args: unknown[]) => writeFileMock(...args),
-}))
-
-const { writeGlobalConfig } = await import('./config')
-
-const originalPlatform = process.platform
-const testConfigPath = '/tmp/clawhub-config-test/config.json'
-
-function makeErr(code: string): NodeJS.ErrnoException {
-  const error = new Error(code) as NodeJS.ErrnoException
-  error.code = code
-  return error
-}
-
-beforeEach(() => {
-  vi.stubEnv('CLAWHUB_CONFIG_PATH', testConfigPath)
-  Object.defineProperty(process, 'platform', { value: 'linux' })
-  chmodMock.mockResolvedValue(undefined)
-  mkdirMock.mockResolvedValue(undefined)
-  readFileMock.mockResolvedValue('')
-  writeFileMock.mockResolvedValue(undefined)
-})
-
-afterEach(() => {
-  Object.defineProperty(process, 'platform', { value: originalPlatform })
-  vi.unstubAllEnvs()
-  vi.clearAllMocks()
-})
-
-describe('writeGlobalConfig', () => {
-  it('writes config with restricted modes', async () => {
-    await writeGlobalConfig({ registry: 'https://example.com', token: 'clh_test' })
-
-    expect(mkdirMock).toHaveBeenCalledWith('/tmp/clawhub-config-test', {
-      recursive: true,
-      mode: 0o700,
-    })
-    expect(writeFileMock).toHaveBeenCalledWith(
-      testConfigPath,
-      expect.stringContaining('"token": "clh_test"'),
-      {
-        encoding: 'utf8',
-        mode: 0o600,
-      },
-    )
-    expect(chmodMock).toHaveBeenCalledWith(testConfigPath, 0o600)
-  })
-
-  it('ignores non-fatal chmod errors', async () => {
-    chmodMock.mockRejectedValueOnce(makeErr('ENOTSUP'))
-
-    await expect(writeGlobalConfig({ registry: 'https://example.com' })).resolves.toBeUndefined()
-  })
-
-  it('rethrows unexpected chmod errors', async () => {
-    chmodMock.mockRejectedValueOnce(new Error('boom'))
-
-    await expect(writeGlobalConfig({ registry: 'https://example.com' })).rejects.toThrow('boom')
-  })
-})

packages/clawdhub/src/config.ts

@@ -1,51 +1,44 @@
 import { existsSync } from 'node:fs'
-import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { type GlobalConfig, GlobalConfigSchema, parseArk } from './schema/index.js'
 
-/**
- * Resolve config path with legacy fallback.
- * Checks for 'clawhub' first, falls back to legacy 'clawdhub' if it exists.
- */
-function resolveConfigPath(baseDir: string): string {
-  const clawhubPath = join(baseDir, 'clawhub', 'config.json')
-  const clawdhubPath = join(baseDir, 'clawdhub', 'config.json')
-  if (existsSync(clawhubPath)) return clawhubPath
-  if (existsSync(clawdhubPath)) return clawdhubPath
-  return clawhubPath
-}
-
-function isNonFatalChmodError(error: unknown): boolean {
-  if (!(error instanceof Error)) return false
-  const code = (error as NodeJS.ErrnoException).code
-  return code === 'EPERM' || code === 'ENOTSUP' || code === 'EOPNOTSUPP' || code === 'EINVAL'
-}
-
 export function getGlobalConfigPath() {
   const override =
     process.env.CLAWHUB_CONFIG_PATH?.trim() ?? process.env.CLAWDHUB_CONFIG_PATH?.trim()
   if (override) return resolve(override)
-
   const home = homedir()
-
   if (process.platform === 'darwin') {
-    return resolveConfigPath(join(home, 'Library', 'Application Support'))
+    const clawhubPath = join(home, 'Library', 'Application Support', 'clawhub', 'config.json')
+    const clawdhubPath = join(home, 'Library', 'Application Support', 'clawdhub', 'config.json')
+    if (existsSync(clawhubPath)) return clawhubPath
+    if (existsSync(clawdhubPath)) return clawdhubPath
+    return clawhubPath
   }
-
   const xdg = process.env.XDG_CONFIG_HOME
   if (xdg) {
-    return resolveConfigPath(xdg)
+    const clawhubPath = join(xdg, 'clawhub', 'config.json')
+    const clawdhubPath = join(xdg, 'clawdhub', 'config.json')
+    if (existsSync(clawhubPath)) return clawhubPath
+    if (existsSync(clawdhubPath)) return clawdhubPath
+    return clawhubPath
   }
-
   if (process.platform === 'win32') {
     const appData = process.env.APPDATA
     if (appData) {
-      return resolveConfigPath(appData)
+      const clawhubPath = join(appData, 'clawhub', 'config.json')
+      const clawdhubPath = join(appData, 'clawdhub', 'config.json')
+      if (existsSync(clawhubPath)) return clawhubPath
+      if (existsSync(clawdhubPath)) return clawdhubPath
+      return clawhubPath
     }
   }
-
-  return resolveConfigPath(join(home, '.config'))
+  const clawhubPath = join(home, '.config', 'clawhub', 'config.json')
+  const clawdhubPath = join(home, '.config', 'clawdhub', 'config.json')
+  if (existsSync(clawhubPath)) return clawhubPath
+  if (existsSync(clawdhubPath)) return clawdhubPath
+  return clawhubPath
 }
 
 export async function readGlobalConfig(): Promise<GlobalConfig | null> {
@@ -60,24 +53,6 @@ export async function readGlobalConfig(): Promise<GlobalConfig | null> {
 
 export async function writeGlobalConfig(config: GlobalConfig) {
   const path = getGlobalConfigPath()
-  const dir = dirname(path)
-
-  // Create directory with restricted permissions (owner only)
-  await mkdir(dir, { recursive: true, mode: 0o700 })
-
-  // Write file with restricted permissions (owner read/write only)
-  // This protects API tokens from being read by other users
-  await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, {
-    encoding: 'utf8',
-    mode: 0o600,
-  })
-
-  // Ensure permissions on existing files (writeFile mode only applies on create)
-  if (process.platform !== 'win32') {
-    try {
-      await chmod(path, 0o600)
-    } catch (error) {
-      if (!isNonFatalChmodError(error)) throw error
-    }
-  }
+  await mkdir(dirname(path), { recursive: true })
+  await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, 'utf8')
 }

packages/clawdhub/src/http.ts

@@ -15,6 +15,7 @@ if (typeof process !== 'undefined' && process.versions?.node) {
   try {
     setGlobalDispatcher(
       new Agent({
+        allowH2: true,
         connect: { timeout: REQUEST_TIMEOUT_MS },
       }),
     )

packages/clawdhub/src/schema/schemas.ts

@@ -185,12 +185,6 @@ export const ApiV1SkillResponseSchema = type({
     displayName: 'string|null?',
     image: 'string|null?',
   }).or('null'),
-  moderation: type({
-    isSuspicious: 'boolean',
-    isMalwareBlocked: 'boolean',
-  })
-    .or('null')
-    .optional(),
 })
 
 export const ApiV1SkillVersionListResponseSchema = type({

packages/schema/src/schemas.test.ts

@@ -98,17 +98,6 @@ describe('clawhub-schema', () => {
     expect(() => parseArk(LockfileSchema, null, 'Lockfile')).toThrow(/Lockfile:/)
   })
 
-  it('truncates error messages when there are more than 3 errors', () => {
-    const invalidPayload = {
-      slug: 123,
-      displayName: 456,
-      version: 789,
-      changelog: true,
-      files: 'not-an-array',
-    }
-    expect(() => parseArk(CliPublishRequestSchema, invalidPayload, 'Publish')).toThrow('+')
-  })
-
   it('parses search results arrays', () => {
     expect(parseArk(ApiSearchResponseSchema, { results: [] }, 'Search')).toEqual({ results: [] })
 

src/__tests__/search-route.test.ts

@@ -1,78 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-
-vi.mock('@tanstack/react-router', () => ({
-  createFileRoute: () => (config: { beforeLoad?: unknown }) => ({ __config: config }),
-  redirect: (options: unknown) => ({ redirect: options }),
-}))
-
-import { Route } from '../routes/search'
-
-function runBeforeLoad(search: { q?: string; highlighted?: boolean }, hostname = 'clawdhub.com') {
-  const route = Route as unknown as {
-    __config: {
-      beforeLoad?: (args: {
-        search: { q?: string; highlighted?: boolean }
-        location: { url: URL }
-      }) => void
-    }
-  }
-  const beforeLoad = route.__config.beforeLoad as (args: {
-    search: { q?: string; highlighted?: boolean }
-    location: { url: URL }
-  }) => void
-  let thrown: unknown
-
-  try {
-    beforeLoad({ search, location: { url: new URL(`https://${hostname}/search`) } })
-  } catch (error) {
-    thrown = error
-  }
-
-  return thrown
-}
-
-describe('search route', () => {
-  it('redirects skills host to the skills index', () => {
-    expect(runBeforeLoad({ q: 'crab', highlighted: true }, 'clawdhub.com')).toEqual({
-      redirect: {
-        to: '/skills',
-        search: {
-          q: 'crab',
-          sort: undefined,
-          dir: undefined,
-          highlighted: true,
-          view: undefined,
-        },
-        replace: true,
-      },
-    })
-  })
-
-  it('redirects souls host with query to home search', () => {
-    expect(runBeforeLoad({ q: 'crab', highlighted: true }, 'onlycrabs.ai')).toEqual({
-      redirect: {
-        to: '/',
-        search: {
-          q: 'crab',
-          highlighted: undefined,
-          search: undefined,
-        },
-        replace: true,
-      },
-    })
-  })
-
-  it('redirects souls host without query to home with search mode', () => {
-    expect(runBeforeLoad({}, 'onlycrabs.ai')).toEqual({
-      redirect: {
-        to: '/',
-        search: {
-          q: undefined,
-          highlighted: undefined,
-          search: true,
-        },
-        replace: true,
-      },
-    })
-  })
-})

src/__tests__/skills-index-load-more.test.tsx

@@ -1,115 +0,0 @@
-/* @vitest-environment jsdom */
-import { act, render } from '@testing-library/react'
-import type { ReactNode } from 'react'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-import { SkillsIndex } from '../routes/skills/index'
-
-const navigateMock = vi.fn()
-const useActionMock = vi.fn()
-const usePaginatedQueryMock = vi.fn()
-let searchMock: Record<string, unknown> = {}
-
-vi.mock('@tanstack/react-router', () => ({
-  createFileRoute: () => (_config: { component: unknown; validateSearch: unknown }) => ({
-    useNavigate: () => navigateMock,
-    useSearch: () => searchMock,
-  }),
-  Link: (props: { children: ReactNode }) => <a href="/">{props.children}</a>,
-}))
-
-vi.mock('convex/react', () => ({
-  useAction: (...args: unknown[]) => useActionMock(...args),
-}))
-
-vi.mock('convex-helpers/react', () => ({
-  usePaginatedQuery: (...args: unknown[]) => usePaginatedQueryMock(...args),
-}))
-
-describe('SkillsIndex load-more observer', () => {
-  beforeEach(() => {
-    usePaginatedQueryMock.mockReset()
-    useActionMock.mockReset()
-    navigateMock.mockReset()
-    searchMock = {}
-    useActionMock.mockReturnValue(() => Promise.resolve([]))
-  })
-
-  afterEach(() => {
-    vi.unstubAllGlobals()
-  })
-
-  it('triggers one request for repeated intersection callbacks', async () => {
-    const loadMorePaginated = vi.fn()
-    usePaginatedQueryMock.mockReturnValue({
-      results: [makeListResult('skill-0', 'Skill 0')],
-      status: 'CanLoadMore',
-      loadMore: loadMorePaginated,
-    })
-
-    type ObserverInstance = {
-      callback: IntersectionObserverCallback
-      observe: ReturnType<typeof vi.fn>
-      disconnect: ReturnType<typeof vi.fn>
-    }
-
-    const observers: ObserverInstance[] = []
-    class IntersectionObserverMock {
-      callback: IntersectionObserverCallback
-      observe = vi.fn()
-      disconnect = vi.fn()
-      unobserve = vi.fn()
-      takeRecords = vi.fn(() => [])
-      root = null
-      rootMargin = '0px'
-      thresholds: number[] = []
-
-      constructor(callback: IntersectionObserverCallback) {
-        this.callback = callback
-        observers.push(this)
-      }
-    }
-    vi.stubGlobal(
-      'IntersectionObserver',
-      IntersectionObserverMock as unknown as typeof IntersectionObserver,
-    )
-
-    render(<SkillsIndex />)
-
-    expect(observers).toHaveLength(1)
-    const observer = observers[0]
-    const entries = [{ isIntersecting: true }] as Array<IntersectionObserverEntry>
-
-    await act(async () => {
-      observer.callback(entries, observer as unknown as IntersectionObserver)
-      observer.callback(entries, observer as unknown as IntersectionObserver)
-      observer.callback(entries, observer as unknown as IntersectionObserver)
-    })
-
-    expect(loadMorePaginated).toHaveBeenCalledTimes(1)
-  })
-})
-
-function makeListResult(slug: string, displayName: string) {
-  return {
-    skill: {
-      _id: `skill_${slug}`,
-      slug,
-      displayName,
-      summary: `${displayName} summary`,
-      tags: {},
-      stats: {
-        downloads: 0,
-        installsCurrent: 0,
-        installsAllTime: 0,
-        stars: 0,
-        versions: 1,
-        comments: 0,
-      },
-      createdAt: 0,
-      updatedAt: 0,
-    },
-    latestVersion: null,
-    ownerHandle: null,
-  }
-}

src/__tests__/skills-index.test.tsx

@@ -118,30 +118,6 @@ describe('SkillsIndex', () => {
       limit: 50,
     })
   })
-
-  it('uses relevance as default sort when searching', async () => {
-    searchMock = { q: 'notion' }
-    const actionFn = vi
-      .fn()
-      .mockResolvedValue([
-        makeSearchResult('newer-low-score', 'Newer Low Score', 0.1, 2000),
-        makeSearchResult('older-high-score', 'Older High Score', 0.9, 1000),
-      ])
-    useActionMock.mockReturnValue(actionFn)
-    vi.useFakeTimers()
-
-    render(<SkillsIndex />)
-    await act(async () => {
-      await vi.runAllTimersAsync()
-    })
-
-    const titles = Array.from(
-      document.querySelectorAll('.skills-row-title > span:first-child'),
-    ).map((node) => node.textContent)
-
-    expect(titles[0]).toBe('Older High Score')
-    expect(titles[1]).toBe('Newer Low Score')
-  })
 })
 
 function makeSearchResults(count: number) {
@@ -167,27 +143,3 @@ function makeSearchResults(count: number) {
     version: null,
   }))
 }
-
-function makeSearchResult(slug: string, displayName: string, score: number, createdAt: number) {
-  return {
-    score,
-    skill: {
-      _id: `skill_${slug}`,
-      slug,
-      displayName,
-      summary: `${displayName} summary`,
-      tags: {},
-      stats: {
-        downloads: 0,
-        installsCurrent: 0,
-        installsAllTime: 0,
-        stars: 0,
-        versions: 1,
-        comments: 0,
-      },
-      createdAt,
-      updatedAt: createdAt,
-    },
-    version: null,
-  }
-}

src/components/Footer.tsx

@@ -8,7 +8,7 @@ export function Footer() {
         <div className="site-footer-divider" aria-hidden="true" />
         <div className="site-footer-row">
           <div className="site-footer-copy">
-            {siteName} · An{' '}
+            {siteName} · A{' '}
             <a href="https://openclaw.ai" target="_blank" rel="noreferrer">
               OpenClaw
             </a>{' '}

src/components/SkillDetailPage.tsx

@@ -1,7 +1,7 @@
 import { Link, useNavigate } from '@tanstack/react-router'
 import type { ClawdisSkillMetadata, SkillInstallSpec } from 'clawhub-schema'
 import { useAction, useMutation, useQuery } from 'convex/react'
-import { lazy, Suspense, useEffect, useMemo, useState } from 'react'
+import { useEffect, useMemo, useState } from 'react'
 import ReactMarkdown from 'react-markdown'
 import remarkGfm from 'remark-gfm'
 import { api } from '../../convex/_generated/api'
@@ -10,36 +10,12 @@ import { getSkillBadges } from '../lib/badges'
 import type { PublicSkill, PublicUser } from '../lib/publicUser'
 import { canManageSkill, isModerator } from '../lib/roles'
 import { useAuthStatus } from '../lib/useAuthStatus'
+import { SkillDiffCard } from './SkillDiffCard'
 
-const SkillDiffCard = lazy(() =>
-  import('./SkillDiffCard').then((m) => ({ default: m.SkillDiffCard })),
-)
-
-type VtAnalysis = {
+type ScanResult = {
   status: string
-  verdict?: string
-  analysis?: string
-  source?: string
-  checkedAt: number
-}
-
-type LlmAnalysisDimension = {
-  name: string
-  label: string
-  rating: string
-  detail: string
-}
-
-type LlmAnalysis = {
-  status: string
-  verdict?: string
-  confidence?: string
-  summary?: string
-  dimensions?: LlmAnalysisDimension[]
-  guidance?: string
-  findings?: string
-  model?: string
-  checkedAt: number
+  url?: string
+  metadata?: unknown
 }
 
 function VirusTotalIcon({ className }: { className?: string }) {
@@ -62,40 +38,12 @@ function VirusTotalIcon({ className }: { className?: string }) {
   )
 }
 
-function OpenClawIcon({ className }: { className?: string }) {
-  return (
-    <svg
-      className={className}
-      width="1em"
-      height="1em"
-      viewBox="0 0 24 24"
-      fill="none"
-      aria-label="OpenClaw"
-    >
-      <title>OpenClaw</title>
-      <path
-        d="M12 2C8.5 2 5.5 4 4 7c-2 4-1 8 2 11 1.5 1.5 3.5 2.5 6 2.5s4.5-1 6-2.5c3-3 4-7 2-11-1.5-3-4.5-5-8-5z"
-        fill="currentColor"
-        opacity="0.2"
-      />
-      <path
-        d="M9 8c1-2 3-3 5-2s3 3 2 5l-3 4-2-1 3-4c.5-1 0-2-1-2.5S11 7 10.5 8L8 12l-2-1 3-4z"
-        fill="currentColor"
-      />
-      <path
-        d="M15 8c-1-2-3-3-5-2s-3 3-2 5l3 4 2-1-3-4c-.5-1 0-2 1-2.5S14 7 14.5 8L17 12l2-1-4-3z"
-        fill="currentColor"
-        opacity="0.6"
-      />
-    </svg>
-  )
-}
-
 function getScanStatusInfo(status: string) {
   switch (status.toLowerCase()) {
     case 'benign':
+      return { label: 'Undetected', className: 'scan-status-clean' }
     case 'clean':
-      return { label: 'Benign', className: 'scan-status-clean' }
+      return { label: 'Clean', className: 'scan-status-clean' }
     case 'malicious':
       return { label: 'Malicious', className: 'scan-status-malicious' }
     case 'suspicious':
@@ -113,193 +61,110 @@ function getScanStatusInfo(status: string) {
   }
 }
 
-function getDimensionIcon(rating: string) {
-  switch (rating) {
-    case 'ok':
-      return { className: 'dimension-icon-ok', symbol: '\u2713' }
-    case 'note':
-      return { className: 'dimension-icon-note', symbol: '\u2139' }
-    case 'concern':
-      return { className: 'dimension-icon-concern', symbol: '!' }
-    default:
-      return { className: 'dimension-icon-danger', symbol: '\u2717' }
-  }
-}
+function useSecurityScan(sha256hash?: string, enabled = true) {
+  const fetchVT = useAction(api.vt.fetchResults)
+  const [result, setResult] = useState<ScanResult | null>(null)
+  const [loading, setLoading] = useState(false)
 
-function LlmAnalysisDetail({ analysis }: { analysis: LlmAnalysis }) {
-  const verdict = analysis.verdict ?? analysis.status
-  const [isOpen, setIsOpen] = useState(false)
+  useEffect(() => {
+    if (!sha256hash || !enabled) {
+      setResult(null)
+      setLoading(false)
+      return
+    }
 
-  const guidanceClass =
-    verdict === 'malicious' ? 'malicious' : verdict === 'suspicious' ? 'suspicious' : 'benign'
+    let cancelled = false
+    setLoading(true)
 
-  return (
-    <div className={`analysis-detail${isOpen ? ' is-open' : ''}`}>
-      <button
-        type="button"
-        className="analysis-detail-header"
-        onClick={() => setIsOpen((prev) => !prev)}
-        aria-expanded={isOpen}
-      >
-        <span className="analysis-summary-text">{analysis.summary}</span>
-        <span className="analysis-detail-toggle">
-          Details <span className="chevron">{'\u25BE'}</span>
-        </span>
-      </button>
-      <div className="analysis-body">
-        {analysis.dimensions && analysis.dimensions.length > 0 ? (
-          <div className="analysis-dimensions">
-            {analysis.dimensions.map((dim) => {
-              const icon = getDimensionIcon(dim.rating)
-              return (
-                <div key={dim.name} className="dimension-row">
-                  <div className={`dimension-icon ${icon.className}`}>{icon.symbol}</div>
-                  <div className="dimension-content">
-                    <div className="dimension-label">{dim.label}</div>
-                    <div className="dimension-detail">{dim.detail}</div>
-                  </div>
-                </div>
-              )
-            })}
-          </div>
-        ) : null}
-        {analysis.findings ? (
-          <div className="scan-findings-section">
-            <div className="scan-findings-title">Scan Findings in Context</div>
-            {(() => {
-              const counts = new Map<string, number>()
-              return analysis.findings.split('\n').map((line) => {
-                const count = (counts.get(line) ?? 0) + 1
-                counts.set(line, count)
-                return (
-                  <div key={`${line}-${count}`} className="scan-finding-row">
-                    {line}
-                  </div>
-                )
-              })
-            })()}
-          </div>
-        ) : null}
-        {analysis.guidance ? (
-          <div className={`analysis-guidance ${guidanceClass}`}>
-            <div className="analysis-guidance-label">
-              {verdict === 'malicious'
-                ? 'Do not install this skill'
-                : verdict === 'suspicious'
-                  ? 'What to consider before installing'
-                  : 'Assessment'}
-            </div>
-            {analysis.guidance}
-          </div>
-        ) : null}
-      </div>
-    </div>
-  )
+    void fetchVT({ sha256hash })
+      .then((res) => {
+        if (!cancelled) {
+          setResult(res)
+          setLoading(false)
+        }
+      })
+      .catch(() => {
+        if (!cancelled) {
+          setResult({ status: 'error' })
+          setLoading(false)
+        }
+      })
+
+    return () => {
+      cancelled = true
+    }
+  }, [sha256hash, enabled, fetchVT])
+
+  return { result, loading }
 }
 
 function SecurityScanResults({
   sha256hash,
-  vtAnalysis,
-  llmAnalysis,
   variant = 'panel',
+  enabled = true,
 }: {
   sha256hash?: string
-  vtAnalysis?: VtAnalysis | null
-  llmAnalysis?: LlmAnalysis | null
   variant?: 'panel' | 'badge'
+  enabled?: boolean
 }) {
-  if (!sha256hash && !llmAnalysis) return null
+  const { result, loading } = useSecurityScan(sha256hash, enabled)
 
-  const vtStatus = vtAnalysis?.status ?? 'pending'
-  const vtUrl = sha256hash ? `https://www.virustotal.com/gui/file/${sha256hash}` : null
-  const vtStatusInfo = getScanStatusInfo(vtStatus)
-  const isCodeInsight = vtAnalysis?.source === 'code_insight'
-  const aiAnalysis = vtAnalysis?.analysis
+  if (!sha256hash) return null
 
-  const llmVerdict = llmAnalysis?.verdict ?? llmAnalysis?.status
-  const llmStatusInfo = llmVerdict ? getScanStatusInfo(llmVerdict) : null
+  const status = loading ? 'loading' : (result?.status ?? 'pending')
+  const url = result?.url
+  const statusInfo = getScanStatusInfo(status)
+
+  // Use dynamic label if no AI verdict but stats are available
+  let displayLabel = statusInfo.label
+  if (!loading && result?.metadata) {
+    const metadata = result.metadata as {
+      aiVerdict?: string
+      stats?: Record<string, number>
+    }
+    if (!metadata.aiVerdict && metadata.stats) {
+      const stats = metadata.stats
+      const total = Object.values(stats).reduce((acc, val) => acc + (val || 0), 0)
+      displayLabel = `${stats.malicious || 0}/${total} engines`
+    }
+  }
 
   if (variant === 'badge') {
     return (
-      <>
-        {sha256hash ? (
-          <div className="version-scan-badge">
-            <VirusTotalIcon className="version-scan-icon version-scan-icon-vt" />
-            <span className={vtStatusInfo.className}>{vtStatusInfo.label}</span>
-            {vtUrl ? (
-              <a
-                href={vtUrl}
-                target="_blank"
-                rel="noopener noreferrer"
-                className="version-scan-link"
-                onClick={(e) => e.stopPropagation()}
-              >
-                ↗
-              </a>
-            ) : null}
-          </div>
+      <div className="version-scan-badge">
+        <VirusTotalIcon className="version-scan-icon version-scan-icon-vt" />
+        <span className={statusInfo.className}>{displayLabel}</span>
+        {url ? (
+          <a
+            href={url}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="version-scan-link"
+            onClick={(e) => e.stopPropagation()}
+          >
+            ↗
+          </a>
         ) : null}
-        {llmStatusInfo ? (
-          <div className="version-scan-badge">
-            <OpenClawIcon className="version-scan-icon version-scan-icon-oc" />
-            <span className={llmStatusInfo.className}>{llmStatusInfo.label}</span>
-          </div>
-        ) : null}
-      </>
+      </div>
     )
   }
 
   return (
     <div className="scan-results-panel">
-      <div className="scan-results-title">Security Scan</div>
+      <div className="scan-results-title">Security Scans</div>
       <div className="scan-results-list">
-        {sha256hash ? (
-          <div className="scan-result-row">
-            <div className="scan-result-scanner">
-              <VirusTotalIcon className="scan-result-icon scan-result-icon-vt" />
-              <span className="scan-result-scanner-name">VirusTotal</span>
-            </div>
-            <div className={`scan-result-status ${vtStatusInfo.className}`}>
-              {vtStatusInfo.label}
-            </div>
-            {vtUrl ? (
-              <a
-                href={vtUrl}
-                target="_blank"
-                rel="noopener noreferrer"
-                className="scan-result-link"
-              >
-                View report →
-              </a>
-            ) : null}
+        <div className="scan-result-row">
+          <div className="scan-result-scanner">
+            <VirusTotalIcon className="scan-result-icon scan-result-icon-vt" />
+            <span className="scan-result-scanner-name">VirusTotal</span>
           </div>
-        ) : null}
-        {isCodeInsight && aiAnalysis && (vtStatus === 'malicious' || vtStatus === 'suspicious') ? (
-          <div className={`code-insight-analysis ${vtStatus}`}>
-            <div className="code-insight-label">Code Insight</div>
-            <p className="code-insight-text">{aiAnalysis}</p>
-          </div>
-        ) : null}
-        {llmStatusInfo && llmAnalysis ? (
-          <div className="scan-result-row">
-            <div className="scan-result-scanner">
-              <OpenClawIcon className="scan-result-icon scan-result-icon-oc" />
-              <span className="scan-result-scanner-name">OpenClaw</span>
-            </div>
-            <div className={`scan-result-status ${llmStatusInfo.className}`}>
-              {llmStatusInfo.label}
-            </div>
-            {llmAnalysis.confidence ? (
-              <span className="scan-result-confidence">{llmAnalysis.confidence} confidence</span>
-            ) : null}
-          </div>
-        ) : null}
-        {llmAnalysis &&
-        llmAnalysis.status !== 'error' &&
-        llmAnalysis.status !== 'pending' &&
-        llmAnalysis.summary ? (
-          <LlmAnalysisDetail analysis={llmAnalysis} />
-        ) : null}
+          <div className={`scan-result-status ${statusInfo.className}`}>{displayLabel}</div>
+          {url ? (
+            <a href={url} target="_blank" rel="noopener noreferrer" className="scan-result-link">
+              View report →
+            </a>
+          ) : null}
+        </div>
       </div>
     </div>
   )
@@ -311,21 +176,10 @@ type SkillDetailPageProps = {
   redirectToCanonical?: boolean
 }
 
-type ModerationInfo = {
-  isPendingScan: boolean
-  isMalwareBlocked: boolean
-  isSuspicious: boolean
-  isHiddenByMod: boolean
-  isRemoved: boolean
-  reason?: string
-}
-
 type SkillBySlugResult = {
   skill: Doc<'skills'> | PublicSkill
   latestVersion: Doc<'skillVersions'> | null
   owner: Doc<'users'> | PublicUser | null
-  pendingReview?: boolean
-  moderationInfo?: ModerationInfo | null
   forkOf: {
     kind: 'fork' | 'duplicate'
     version: string | null
@@ -393,6 +247,7 @@ export function SkillDetailPage({
   const [tagName, setTagName] = useState('latest')
   const [tagVersionId, setTagVersionId] = useState<Id<'skillVersions'> | ''>('')
   const [activeTab, setActiveTab] = useState<'files' | 'compare' | 'versions'>('files')
+  const [versionScanOpen, setVersionScanOpen] = useState<Record<string, boolean>>({})
 
   const isLoadingSkill = result === undefined
   const skill = result?.skill
@@ -428,7 +283,6 @@ export function SkillDetailPage({
 
   const forkOf = result?.forkOf ?? null
   const canonical = result?.canonical ?? null
-  const modInfo = result?.moderationInfo ?? null
   const forkOfLabel = forkOf?.kind === 'duplicate' ? 'duplicate of' : 'fork of'
   const forkOfOwnerHandle = forkOf?.owner?.handle ?? null
   const forkOfOwnerId = forkOf?.owner?.userId ?? null
@@ -552,65 +406,6 @@ export function SkillDetailPage({
   return (
     <main className="section">
       <div className="skill-detail-stack">
-        {modInfo?.isPendingScan ? (
-          <div className="pending-banner">
-            <div className="pending-banner-content">
-              <strong>Security scan in progress</strong>
-              <p>
-                Your skill is being scanned by VirusTotal. It will be visible to others once the
-                scan completes. This usually takes up to 5 minutes — grab a coffee or exfoliate your
-                shell while you wait.
-              </p>
-            </div>
-          </div>
-        ) : modInfo?.isMalwareBlocked ? (
-          <div className="pending-banner pending-banner-blocked">
-            <div className="pending-banner-content">
-              <strong>Skill blocked — malicious content detected</strong>
-              <p>
-                ClawHub Security flagged this skill as malicious. Downloads are disabled. Review the
-                scan results below.
-              </p>
-            </div>
-          </div>
-        ) : modInfo?.isSuspicious ? (
-          <div className="pending-banner pending-banner-warning">
-            <div className="pending-banner-content">
-              <strong>Skill flagged — suspicious patterns detected</strong>
-              <p>
-                ClawHub Security flagged this skill as suspicious. Review the scan results before
-                using.
-              </p>
-              {canManage ? (
-                <p className="pending-banner-appeal">
-                  If you believe this skill has been incorrectly flagged, please{' '}
-                  <a
-                    href="https://github.com/openclaw/clawhub/issues"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                  >
-                    submit an issue on GitHub
-                  </a>{' '}
-                  and we'll break down why it was flagged and what you can do.
-                </p>
-              ) : null}
-            </div>
-          </div>
-        ) : modInfo?.isRemoved ? (
-          <div className="pending-banner pending-banner-blocked">
-            <div className="pending-banner-content">
-              <strong>Skill removed by moderator</strong>
-              <p>This skill has been removed and is not visible to others.</p>
-            </div>
-          </div>
-        ) : modInfo?.isHiddenByMod ? (
-          <div className="pending-banner pending-banner-blocked">
-            <div className="pending-banner-content">
-              <strong>Skill hidden</strong>
-              <p>This skill is currently hidden and not visible to others.</p>
-            </div>
-          </div>
-        ) : null}
         <div className="card skill-hero">
           <div className={`skill-hero-top${hasPluginBundle ? ' has-plugin' : ''}`}>
             <div className="skill-hero-header">
@@ -725,23 +520,14 @@ export function SkillDetailPage({
                     Reports require a reason. Abuse may result in a ban.
                   </div>
                 ) : null}
-                <SecurityScanResults
-                  sha256hash={latestVersion?.sha256hash}
-                  vtAnalysis={latestVersion?.vtAnalysis}
-                  llmAnalysis={latestVersion?.llmAnalysis as LlmAnalysis | undefined}
-                />
-                {latestVersion?.sha256hash || latestVersion?.llmAnalysis ? (
-                  <p className="scan-disclaimer">
-                    Like a lobster shell, security has layers — review code before you run it.
-                  </p>
-                ) : null}
+                <SecurityScanResults sha256hash={latestVersion?.sha256hash} />
               </div>
               <div className="skill-hero-cta">
                 <div className="skill-version-pill">
                   <span className="skill-version-label">Current version</span>
                   <strong>v{latestVersion?.version ?? '—'}</strong>
                 </div>
-                {!nixPlugin && !modInfo?.isMalwareBlocked && !modInfo?.isRemoved ? (
+                {!nixPlugin ? (
                   <a
                     className="btn btn-primary"
                     href={`${import.meta.env.VITE_CONVEX_SITE_URL}/api/v1/download?slug=${skill.slug}`}
@@ -1010,9 +796,7 @@ export function SkillDetailPage({
           ) : null}
           {activeTab === 'compare' && skill ? (
             <div className="tab-body">
-              <Suspense fallback={<div className="stat">Loading diff viewer…</div>}>
-                <SkillDiffCard skill={skill} versions={diffVersions ?? []} variant="embedded" />
-              </Suspense>
+              <SkillDiffCard skill={skill} versions={diffVersions ?? []} variant="embedded" />
             </div>
           ) : null}
           {activeTab === 'versions' ? (
@@ -1042,13 +826,27 @@ export function SkillDetailPage({
                           {version.changelog}
                         </div>
                         <div className="version-scan-results">
-                          {version.sha256hash || version.llmAnalysis ? (
-                            <SecurityScanResults
-                              sha256hash={version.sha256hash}
-                              vtAnalysis={version.vtAnalysis}
-                              llmAnalysis={version.llmAnalysis as LlmAnalysis | undefined}
-                              variant="badge"
-                            />
+                          {version.sha256hash ? (
+                            versionScanOpen[version._id] ? (
+                              <SecurityScanResults
+                                sha256hash={version.sha256hash}
+                                variant="badge"
+                                enabled
+                              />
+                            ) : (
+                              <button
+                                className="version-scan-toggle"
+                                type="button"
+                                onClick={() =>
+                                  setVersionScanOpen((prev) => ({
+                                    ...prev,
+                                    [version._id]: true,
+                                  }))
+                                }
+                              >
+                                Load scan
+                              </button>
+                            )
                           ) : null}
                         </div>
                       </div>

src/lib/badges.test.ts

@@ -1,98 +0,0 @@
-/* @vitest-environment node */
-
-import { describe, expect, it } from 'vitest'
-import { getSkillBadges, isSkillDeprecated, isSkillHighlighted, isSkillOfficial } from './badges'
-
-describe('badges', () => {
-  describe('isSkillHighlighted', () => {
-    it('returns false when badges is undefined', () => {
-      expect(isSkillHighlighted({})).toBe(false)
-    })
-
-    it('returns false when badges is null', () => {
-      expect(isSkillHighlighted({ badges: null })).toBe(false)
-    })
-
-    it('returns false when highlighted is not set', () => {
-      expect(isSkillHighlighted({ badges: {} })).toBe(false)
-    })
-
-    it('returns true when highlighted is set', () => {
-      expect(
-        isSkillHighlighted({
-          badges: { highlighted: { byUserId: 'user1' as never, at: 123 } },
-        }),
-      ).toBe(true)
-    })
-  })
-
-  describe('isSkillOfficial', () => {
-    it('returns false when badges is undefined', () => {
-      expect(isSkillOfficial({})).toBe(false)
-    })
-
-    it('returns true when official is set', () => {
-      expect(
-        isSkillOfficial({
-          badges: { official: { byUserId: 'user1' as never, at: 123 } },
-        }),
-      ).toBe(true)
-    })
-  })
-
-  describe('isSkillDeprecated', () => {
-    it('returns false when badges is undefined', () => {
-      expect(isSkillDeprecated({})).toBe(false)
-    })
-
-    it('returns true when deprecated is set', () => {
-      expect(
-        isSkillDeprecated({
-          badges: { deprecated: { byUserId: 'user1' as never, at: 123 } },
-        }),
-      ).toBe(true)
-    })
-  })
-
-  describe('getSkillBadges', () => {
-    it('returns empty array when no badges', () => {
-      expect(getSkillBadges({})).toEqual([])
-    })
-
-    it('returns Deprecated when deprecated is set', () => {
-      expect(
-        getSkillBadges({
-          badges: { deprecated: { byUserId: 'user1' as never, at: 123 } },
-        }),
-      ).toEqual(['Deprecated'])
-    })
-
-    it('returns Official when official is set', () => {
-      expect(
-        getSkillBadges({
-          badges: { official: { byUserId: 'user1' as never, at: 123 } },
-        }),
-      ).toEqual(['Official'])
-    })
-
-    it('returns Highlighted when highlighted is set', () => {
-      expect(
-        getSkillBadges({
-          badges: { highlighted: { byUserId: 'user1' as never, at: 123 } },
-        }),
-      ).toEqual(['Highlighted'])
-    })
-
-    it('returns all badges in correct order', () => {
-      expect(
-        getSkillBadges({
-          badges: {
-            deprecated: { byUserId: 'user1' as never, at: 123 },
-            official: { byUserId: 'user1' as never, at: 123 },
-            highlighted: { byUserId: 'user1' as never, at: 123 },
-          },
-        }),
-      ).toEqual(['Deprecated', 'Official', 'Highlighted'])
-    })
-  })
-})

src/lib/uploadFiles.jsdom.test.ts

@@ -1,7 +1,7 @@
 import { strToU8, unzipSync, zipSync } from 'fflate'
 import { describe, expect, it } from 'vitest'
 
-import { expandDroppedItems, expandFiles } from './uploadFiles'
+import { expandFiles } from './uploadFiles'
 
 function readWithFileReader(blob: Blob) {
   return new Promise<ArrayBuffer>((resolve, reject) => {
@@ -31,138 +31,3 @@ describe('expandFiles (jsdom)', () => {
     expect(expanded.map((file) => file.name)).toEqual(['SKILL.md', 'notes.txt'])
   })
 })
-
-describe('expandDroppedItems', () => {
-  it('returns empty array when items is null', async () => {
-    const result = await expandDroppedItems(null)
-    expect(result).toEqual([])
-  })
-
-  it('returns empty array when items is empty', async () => {
-    const items = {
-      length: 0,
-      [Symbol.iterator]: function* () {},
-    } as unknown as DataTransferItemList
-    const result = await expandDroppedItems(items)
-    expect(result).toEqual([])
-  })
-
-  it('collects files from getAsFile when webkitGetAsEntry is unavailable', async () => {
-    const file = new File(['hello'], 'test.md', { type: 'text/markdown' })
-    const item = {
-      getAsFile: () => file,
-      webkitGetAsEntry: undefined,
-    }
-    const items = {
-      length: 1,
-      0: item,
-      [Symbol.iterator]: function* () {
-        yield item
-      },
-    } as unknown as DataTransferItemList
-    const result = await expandDroppedItems(items)
-    expect(result).toHaveLength(1)
-    expect(result[0]?.name).toBe('test.md')
-  })
-
-  it('collects files via webkitGetAsEntry for file entries', async () => {
-    const file = new File(['content'], 'SKILL.md', { type: 'text/markdown' })
-    const fileEntry = {
-      isFile: true,
-      isDirectory: false,
-      name: 'SKILL.md',
-      fullPath: '/SKILL.md',
-      file: (callback: (f: File) => void) => callback(file),
-    }
-    const item = {
-      getAsFile: () => null,
-      webkitGetAsEntry: () => fileEntry,
-    }
-    const items = {
-      length: 1,
-      0: item,
-      [Symbol.iterator]: function* () {
-        yield item
-      },
-    } as unknown as DataTransferItemList
-    const result = await expandDroppedItems(items)
-    expect(result).toHaveLength(1)
-    expect(result[0]?.name).toBe('SKILL.md')
-  })
-
-  it('recursively collects files from directory entries', async () => {
-    const file1 = new File(['hello'], 'README.md', { type: 'text/markdown' })
-    const file2 = new File(['world'], 'notes.txt', { type: 'text/plain' })
-
-    const fileEntry1 = {
-      isFile: true,
-      isDirectory: false,
-      name: 'README.md',
-      fullPath: '/mydir/README.md',
-      file: (callback: (f: File) => void) => callback(file1),
-    }
-    const fileEntry2 = {
-      isFile: true,
-      isDirectory: false,
-      name: 'notes.txt',
-      fullPath: '/mydir/notes.txt',
-      file: (callback: (f: File) => void) => callback(file2),
-    }
-
-    let readEntriesCalled = false
-    const dirEntry = {
-      isFile: false,
-      isDirectory: true,
-      name: 'mydir',
-      fullPath: '/mydir',
-      createReader: () => ({
-        readEntries: (callback: (entries: unknown[]) => void) => {
-          if (!readEntriesCalled) {
-            readEntriesCalled = true
-            callback([fileEntry1, fileEntry2])
-          } else {
-            callback([])
-          }
-        },
-      }),
-    }
-
-    const item = {
-      getAsFile: () => null,
-      webkitGetAsEntry: () => dirEntry,
-    }
-    const items = {
-      length: 1,
-      0: item,
-      [Symbol.iterator]: function* () {
-        yield item
-      },
-    } as unknown as DataTransferItemList
-
-    const result = await expandDroppedItems(items)
-    expect(result).toHaveLength(2)
-    expect(result.map((f) => f.name).sort()).toEqual(['mydir/README.md', 'mydir/notes.txt'])
-  })
-
-  it('skips entries that are neither files nor directories', async () => {
-    const nonEntry = {
-      isFile: false,
-      isDirectory: false,
-      name: 'unknown',
-    }
-    const item = {
-      getAsFile: () => null,
-      webkitGetAsEntry: () => nonEntry,
-    }
-    const items = {
-      length: 1,
-      0: item,
-      [Symbol.iterator]: function* () {
-        yield item
-      },
-    } as unknown as DataTransferItemList
-
-    const result = await expandDroppedItems(items)
-    expect(result).toEqual([])
-  })
-})

src/routeTree.gen.ts

@@ -12,7 +12,6 @@ import { Route as rootRouteImport } from './routes/__root'
 import { Route as UploadRouteImport } from './routes/upload'
 import { Route as StarsRouteImport } from './routes/stars'
 import { Route as SettingsRouteImport } from './routes/settings'
-import { Route as SearchRouteImport } from './routes/search'
 import { Route as ManagementRouteImport } from './routes/management'
 import { Route as ImportRouteImport } from './routes/import'
 import { Route as DashboardRouteImport } from './routes/dashboard'
@@ -40,11 +39,6 @@ const SettingsRoute = SettingsRouteImport.update({
   path: '/settings',
   getParentRoute: () => rootRouteImport,
 } as any)
-const SearchRoute = SearchRouteImport.update({
-  id: '/search',
-  path: '/search',
-  getParentRoute: () => rootRouteImport,
-} as any)
 const ManagementRoute = ManagementRouteImport.update({
   id: '/management',
   path: '/management',
@@ -107,7 +101,6 @@ export interface FileRoutesByFullPath {
   '/dashboard': typeof DashboardRoute
   '/import': typeof ImportRoute
   '/management': typeof ManagementRoute
-  '/search': typeof SearchRoute
   '/settings': typeof SettingsRoute
   '/stars': typeof StarsRoute
   '/upload': typeof UploadRoute
@@ -124,7 +117,6 @@ export interface FileRoutesByTo {
   '/dashboard': typeof DashboardRoute
   '/import': typeof ImportRoute
   '/management': typeof ManagementRoute
-  '/search': typeof SearchRoute
   '/settings': typeof SettingsRoute
   '/stars': typeof StarsRoute
   '/upload': typeof UploadRoute
@@ -142,7 +134,6 @@ export interface FileRoutesById {
   '/dashboard': typeof DashboardRoute
   '/import': typeof ImportRoute
   '/management': typeof ManagementRoute
-  '/search': typeof SearchRoute
   '/settings': typeof SettingsRoute
   '/stars': typeof StarsRoute
   '/upload': typeof UploadRoute
@@ -161,7 +152,6 @@ export interface FileRouteTypes {
     | '/dashboard'
     | '/import'
     | '/management'
-    | '/search'
     | '/settings'
     | '/stars'
     | '/upload'
@@ -178,7 +168,6 @@ export interface FileRouteTypes {
     | '/dashboard'
     | '/import'
     | '/management'
-    | '/search'
     | '/settings'
     | '/stars'
     | '/upload'
@@ -195,7 +184,6 @@ export interface FileRouteTypes {
     | '/dashboard'
     | '/import'
     | '/management'
-    | '/search'
     | '/settings'
     | '/stars'
     | '/upload'
@@ -213,7 +201,6 @@ export interface RootRouteChildren {
   DashboardRoute: typeof DashboardRoute
   ImportRoute: typeof ImportRoute
   ManagementRoute: typeof ManagementRoute
-  SearchRoute: typeof SearchRoute
   SettingsRoute: typeof SettingsRoute
   StarsRoute: typeof StarsRoute
   UploadRoute: typeof UploadRoute
@@ -248,13 +235,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof SettingsRouteImport
       parentRoute: typeof rootRouteImport
     }
-    '/search': {
-      id: '/search'
-      path: '/search'
-      fullPath: '/search'
-      preLoaderRoute: typeof SearchRouteImport
-      parentRoute: typeof rootRouteImport
-    }
     '/management': {
       id: '/management'
       path: '/management'
@@ -341,7 +321,6 @@ const rootRouteChildren: RootRouteChildren = {
   DashboardRoute: DashboardRoute,
   ImportRoute: ImportRoute,
   ManagementRoute: ManagementRoute,
-  SearchRoute: SearchRoute,
   SettingsRoute: SettingsRoute,
   StarsRoute: StarsRoute,
   UploadRoute: UploadRoute,

src/routes/dashboard.tsx

@@ -1,12 +1,10 @@
 import { createFileRoute, Link } from '@tanstack/react-router'
 import { useQuery } from 'convex/react'
-import { Clock, Package, Plus, Upload } from 'lucide-react'
+import { Package, Plus, Upload } from 'lucide-react'
 import { api } from '../../convex/_generated/api'
 import type { Doc } from '../../convex/_generated/dataModel'
 import type { PublicSkill } from '../lib/publicUser'
 
-type DashboardSkill = PublicSkill & { pendingReview?: boolean }
-
 export const Route = createFileRoute('/dashboard')({
   component: Dashboard,
 })
@@ -16,7 +14,7 @@ function Dashboard() {
   const mySkills = useQuery(
     api.skills.list,
     me?._id ? { ownerUserId: me._id, limit: 100 } : 'skip',
-  ) as DashboardSkill[] | undefined
+  ) as PublicSkill[] | undefined
 
   if (!me) {
     return (
@@ -62,26 +60,18 @@ function Dashboard() {
   )
 }
 
-function SkillCard({ skill, ownerHandle }: { skill: DashboardSkill; ownerHandle: string | null }) {
+function SkillCard({ skill, ownerHandle }: { skill: PublicSkill; ownerHandle: string | null }) {
   return (
     <div className="dashboard-skill-card">
       <div className="dashboard-skill-info">
-        <div style={{ display: 'flex', alignItems: 'center', gap: '8px', flexWrap: 'wrap' }}>
-          <Link
-            to="/$owner/$slug"
-            params={{ owner: ownerHandle ?? 'unknown', slug: skill.slug }}
-            className="dashboard-skill-name"
-          >
-            {skill.displayName}
-          </Link>
-          <span className="dashboard-skill-slug">/{skill.slug}</span>
-          {skill.pendingReview ? (
-            <span className="tag tag-pending">
-              <Clock className="h-3 w-3" aria-hidden="true" />
-              Scanning
-            </span>
-          ) : null}
-        </div>
+        <Link
+          to="/$owner/$slug"
+          params={{ owner: ownerHandle ?? 'unknown', slug: skill.slug }}
+          className="dashboard-skill-name"
+        >
+          {skill.displayName}
+        </Link>
+        <span className="dashboard-skill-slug">/{skill.slug}</span>
         {skill.summary && <p className="dashboard-skill-description">{skill.summary}</p>}
         <div className="dashboard-skill-stats">
           <span>⤓ {skill.stats.downloads}</span>

src/routes/management.tsx

@@ -57,13 +57,6 @@ function resolveOwnerParam(handle: string | null | undefined, ownerId?: Id<'user
   return handle?.trim() || (ownerId ? String(ownerId) : 'unknown')
 }
 
-function promptBanReason(label: string) {
-  const result = window.prompt(`Ban reason for ${label} (optional)`)
-  if (result === null) return null
-  const trimmed = result.trim()
-  return trimmed.length > 0 ? trimmed : undefined
-}
-
 export const Route = createFileRoute('/management')({
   validateSearch: (search) => ({
     skill: typeof search.skill === 'string' && search.skill.trim() ? search.skill : undefined,
@@ -449,9 +442,7 @@ function Management() {
                           if (!window.confirm(`Ban @${ownerHandle} and delete their skills?`)) {
                             return
                           }
-                          const reason = promptBanReason(`@${ownerHandle}`)
-                          if (reason === null) return
-                          void banUser({ userId: ownerUserId, reason })
+                          void banUser({ userId: ownerUserId })
                         }}
                       >
                         Ban user
@@ -647,13 +638,6 @@ function Management() {
                 <div key={user._id} className="management-item">
                   <div className="management-item-main">
                     <span className="mono">@{user.handle ?? user.name ?? 'user'}</span>
-                    {user.deletedAt ? (
-                      <div className="section-subtitle" style={{ margin: 0 }}>
-                        {user.banReason
-                          ? `Banned ${formatTimestamp(user.deletedAt)} · ${user.banReason}`
-                          : `Deleted ${formatTimestamp(user.deletedAt)}`}
-                      </div>
-                    ) : null}
                   </div>
                   <div className="management-actions">
                     <select
@@ -682,10 +666,7 @@ function Management() {
                         ) {
                           return
                         }
-                        const label = `@${user.handle ?? user.name ?? 'user'}`
-                        const reason = promptBanReason(label)
-                        if (reason === null) return
-                        void banUser({ userId: user._id, reason })
+                        void banUser({ userId: user._id })
                       }}
                     >
                       Ban user

src/routes/search.tsx

@@ -1,38 +0,0 @@
-import { createFileRoute, redirect } from '@tanstack/react-router'
-import { detectSiteMode } from '../lib/site'
-
-export const Route = createFileRoute('/search')({
-  validateSearch: (search) => ({
-    q: typeof search.q === 'string' && search.q.trim() ? search.q : undefined,
-    highlighted: search.highlighted === '1' || search.highlighted === 'true' ? true : undefined,
-  }),
-  beforeLoad: ({ search, location }) => {
-    const hostname =
-      (location as { url?: URL }).url?.hostname ??
-      (typeof window !== 'undefined' ? window.location.hostname : undefined)
-    const mode = detectSiteMode(hostname)
-    if (mode === 'skills') {
-      throw redirect({
-        to: '/skills',
-        search: {
-          q: search.q || undefined,
-          sort: undefined,
-          dir: undefined,
-          highlighted: search.highlighted || undefined,
-          view: undefined,
-        },
-        replace: true,
-      })
-    }
-
-    throw redirect({
-      to: '/',
-      search: {
-        q: search.q || undefined,
-        highlighted: undefined,
-        search: search.q ? undefined : true,
-      },
-      replace: true,
-    })
-  },
-})

src/routes/skills/index.tsx

@@ -8,15 +8,7 @@ import { SkillCard } from '../../components/SkillCard'
 import { getSkillBadges, isSkillHighlighted } from '../../lib/badges'
 import type { PublicSkill } from '../../lib/publicUser'
 
-const sortKeys = [
-  'relevance',
-  'newest',
-  'downloads',
-  'installs',
-  'stars',
-  'name',
-  'updated',
-] as const
+const sortKeys = ['newest', 'downloads', 'installs', 'stars', 'name', 'updated'] as const
 const pageSize = 25
 type SortKey = (typeof sortKeys)[number]
 type SortDir = 'asc' | 'desc'
@@ -36,7 +28,6 @@ type SkillListEntry = {
   skill: PublicSkill
   latestVersion: Doc<'skillVersions'> | null
   ownerHandle?: string | null
-  searchScore?: number
 }
 
 type SkillSearchEntry = {
@@ -71,25 +62,21 @@ export const Route = createFileRoute('/skills/')({
 export function SkillsIndex() {
   const navigate = Route.useNavigate()
   const search = Route.useSearch()
-  const [query, setQuery] = useState(search.q ?? '')
+  const sort = search.sort ?? 'newest'
+  const dir = parseDir(search.dir, sort)
   const view = search.view ?? 'list'
   const highlightedOnly = search.highlighted ?? false
+  const [query, setQuery] = useState(search.q ?? '')
   const searchSkills = useAction(api.search.searchSkills)
   const [searchResults, setSearchResults] = useState<Array<SkillSearchEntry>>([])
   const [searchLimit, setSearchLimit] = useState(pageSize)
   const [isSearching, setIsSearching] = useState(false)
   const searchRequest = useRef(0)
   const loadMoreRef = useRef<HTMLDivElement | null>(null)
-  const loadMoreInFlightRef = useRef(false)
 
   const searchInputRef = useRef<HTMLInputElement>(null)
   const trimmedQuery = useMemo(() => query.trim(), [query])
   const hasQuery = trimmedQuery.length > 0
-  const sort =
-    search.sort === 'relevance' && !hasQuery
-      ? 'newest'
-      : (search.sort ?? (hasQuery ? 'relevance' : 'newest'))
-  const dir = parseDir(search.dir, sort)
   const searchKey = trimmedQuery ? `${trimmedQuery}::${highlightedOnly ? '1' : '0'}` : ''
 
   // Use convex-helpers usePaginatedQuery for better cache behavior
@@ -162,7 +149,6 @@ export function SkillsIndex() {
         skill: entry.skill,
         latestVersion: entry.version,
         ownerHandle: entry.ownerHandle ?? null,
-        searchScore: entry.score,
       }))
     }
     // paginatedResults is an array of page items from usePaginatedQuery
@@ -179,8 +165,6 @@ export function SkillsIndex() {
     const results = [...filtered]
     results.sort((a, b) => {
       switch (sort) {
-        case 'relevance':
-          return ((a.searchScore ?? 0) - (b.searchScore ?? 0)) * multiplier
         case 'downloads':
           return (a.skill.stats.downloads - b.skill.stats.downloads) * multiplier
         case 'installs':
@@ -212,8 +196,7 @@ export function SkillsIndex() {
   const canAutoLoad = typeof IntersectionObserver !== 'undefined'
 
   const loadMore = useCallback(() => {
-    if (loadMoreInFlightRef.current || isLoadingMore || !canLoadMore) return
-    loadMoreInFlightRef.current = true
+    if (isLoadingMore || !canLoadMore) return
     if (hasQuery) {
       setSearchLimit((value) => value + pageSize)
     } else {
@@ -221,12 +204,6 @@ export function SkillsIndex() {
     }
   }, [canLoadMore, hasQuery, isLoadingMore, loadMorePaginated])
 
-  useEffect(() => {
-    if (!isLoadingMore) {
-      loadMoreInFlightRef.current = false
-    }
-  }, [isLoadingMore])
-
   useEffect(() => {
     if (!canLoadMore || typeof IntersectionObserver === 'undefined') return
     const target = loadMoreRef.current
@@ -234,7 +211,6 @@ export function SkillsIndex() {
     const observer = new IntersectionObserver(
       (entries) => {
         if (entries.some((entry) => entry.isIntersecting)) {
-          observer.disconnect()
           loadMore()
         }
       },
@@ -308,7 +284,6 @@ export function SkillsIndex() {
               }}
               aria-label="Sort skills"
             >
-              {hasQuery ? <option value="relevance">Relevance</option> : null}
               <option value="newest">Newest</option>
               <option value="updated">Recently updated</option>
               <option value="downloads">Downloads</option>

src/styles.css

@@ -1259,8 +1259,6 @@ code {
 .skill-detail-stack {
   display: grid;
   gap: 16px;
-  max-width: 100%;
-  overflow-x: auto;
 }
 
 .skill-hero {
@@ -1701,8 +1699,6 @@ code {
 
 .tab-card {
   gap: 14px;
-  max-width: 100%;
-  overflow-x: auto;
 }
 
 .tab-header {
@@ -1735,14 +1731,11 @@ code {
 .tab-body {
   display: grid;
   gap: 20px;
-  max-width: 100%;
-  overflow-x: auto;
 }
 
 .file-list {
   display: grid;
   gap: 12px;
-  max-width: 100%;
   padding-top: 8px;
   border-top: 1px solid var(--line);
 }
@@ -1758,7 +1751,6 @@ code {
   display: grid;
   gap: 8px;
   max-height: 260px;
-  max-width: 100%;
   overflow: auto;
   padding-right: 4px;
 }
@@ -1774,7 +1766,6 @@ code {
   align-items: center;
   justify-content: space-between;
   gap: 12px;
-  max-width: 100%;
   padding: 10px 12px;
   border-radius: 12px;
   border: 1px solid var(--line);
@@ -2359,7 +2350,6 @@ code {
 
 .markdown {
   line-height: 1.7;
-  max-width: 100%;
   color: #3f3a34;
 }
 
@@ -2386,7 +2376,6 @@ code {
 
 .markdown pre {
   white-space: pre;
-  max-width: 100%;
   overflow-x: auto;
   -webkit-overflow-scrolling: touch;
   background: linear-gradient(180deg, rgba(255, 255, 255, 0.9), rgba(255, 250, 247, 0.88));
@@ -2772,11 +2761,6 @@ html.theme-transition::view-transition-new(theme) {
   display: flex;
   align-items: center;
   gap: 12px;
-  margin-top: 8px;
-}
-
-.scan-result-row:first-child {
-  margin-top: 0;
 }
 
 .scan-result-scanner {
@@ -2794,10 +2778,6 @@ html.theme-transition::view-transition-new(theme) {
   color: #0030ff;
 }
 
-.scan-result-icon-oc {
-  color: var(--accent);
-}
-
 .scan-result-status {
   padding: 2px 8px;
   border-radius: 999px;
@@ -2841,67 +2821,6 @@ html.theme-transition::view-transition-new(theme) {
   text-decoration: underline;
 }
 
-/* Code Insight Analysis */
-.code-insight-analysis {
-  margin-top: 12px;
-  padding: 10px 12px;
-  border-radius: 8px;
-}
-
-.code-insight-analysis.malicious {
-  background: rgba(239, 68, 68, 0.06);
-  border-left: 3px solid #dc2626;
-}
-
-.code-insight-analysis.suspicious {
-  background: rgba(245, 158, 11, 0.06);
-  border-left: 3px solid #f59e0b;
-}
-
-.code-insight-label {
-  font-size: 0.7rem;
-  font-weight: 700;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-  margin-bottom: 6px;
-}
-
-.code-insight-analysis.malicious .code-insight-label {
-  color: #dc2626;
-}
-
-.code-insight-analysis.suspicious .code-insight-label {
-  color: #f59e0b;
-}
-
-.code-insight-text {
-  font-size: 0.82rem;
-  line-height: 1.5;
-  color: var(--ink);
-  margin: 0;
-}
-
-.code-insight-text code {
-  font-family: var(--font-mono);
-  font-size: 0.78rem;
-  background: rgba(0, 0, 0, 0.06);
-  padding: 2px 5px;
-  border-radius: 4px;
-  word-break: break-all;
-}
-
-[data-theme="dark"] .code-insight-analysis.malicious {
-  background: rgba(239, 68, 68, 0.12);
-}
-
-[data-theme="dark"] .code-insight-analysis.suspicious {
-  background: rgba(245, 158, 11, 0.12);
-}
-
-[data-theme="dark"] .code-insight-text code {
-  background: rgba(255, 255, 255, 0.1);
-}
-
 .version-scan-results {
   display: flex;
   gap: 8px;
@@ -2943,10 +2862,6 @@ html.theme-transition::view-transition-new(theme) {
   color: #0030ff;
 }
 
-.version-scan-icon-oc {
-  color: var(--accent);
-}
-
 .version-scan-link {
   color: var(--ink-soft);
   text-decoration: none;
@@ -2955,309 +2870,3 @@ html.theme-transition::view-transition-new(theme) {
 .version-scan-link:hover {
   color: var(--accent);
 }
-
-.scan-disclaimer {
-  font-size: 0.8rem;
-  color: var(--ink-soft);
-  opacity: 0.8;
-  margin: 8px 0 0;
-  font-style: italic;
-}
-
-/* OpenClaw confidence label */
-.scan-result-confidence {
-  font-size: 0.72rem;
-  font-weight: 600;
-  color: var(--ink-soft);
-  text-transform: uppercase;
-  letter-spacing: 0.05em;
-  opacity: 0.7;
-}
-
-/* LLM Analysis Detail */
-.analysis-detail {
-  margin-top: 10px;
-  border-radius: 12px;
-  overflow: hidden;
-}
-
-.analysis-detail-header {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 12px;
-  padding: 10px 14px;
-  cursor: pointer;
-  user-select: none;
-  border-radius: 12px;
-  transition: background 0.15s ease;
-}
-
-.analysis-detail-header:hover {
-  background: rgba(0, 0, 0, 0.03);
-}
-
-[data-theme="dark"] .analysis-detail-header:hover {
-  background: rgba(255, 255, 255, 0.04);
-}
-
-.analysis-detail-toggle {
-  font-size: 0.82rem;
-  color: var(--accent);
-  font-weight: 600;
-  display: flex;
-  align-items: center;
-  gap: 4px;
-  white-space: nowrap;
-}
-
-.analysis-detail-toggle .chevron {
-  transition: transform 0.2s;
-}
-
-.analysis-detail.is-open .analysis-detail-toggle .chevron {
-  transform: rotate(180deg);
-}
-
-.analysis-summary-text {
-  font-size: 0.88rem;
-  color: var(--ink);
-  line-height: 1.45;
-  flex: 1;
-}
-
-.analysis-body {
-  display: none;
-  padding: 0 14px 14px;
-}
-
-.analysis-detail.is-open .analysis-body {
-  display: block;
-}
-
-.analysis-dimensions {
-  display: grid;
-  gap: 8px;
-  margin-top: 8px;
-}
-
-.dimension-row {
-  display: grid;
-  grid-template-columns: 20px 1fr;
-  gap: 10px;
-  padding: 10px 12px;
-  border-radius: 10px;
-  border: 1px solid var(--line);
-  background: var(--surface-muted);
-  align-items: start;
-}
-
-.dimension-icon {
-  width: 20px;
-  height: 20px;
-  border-radius: 50%;
-  display: grid;
-  place-items: center;
-  font-size: 0.65rem;
-  font-weight: 700;
-  flex-shrink: 0;
-  margin-top: 1px;
-}
-
-.dimension-icon-ok {
-  background: rgba(34, 197, 94, 0.15);
-  color: #16a34a;
-}
-
-.dimension-icon-note {
-  background: rgba(107, 114, 128, 0.12);
-  color: #6b7280;
-}
-
-.dimension-icon-concern {
-  background: rgba(245, 158, 11, 0.15);
-  color: #d97706;
-}
-
-.dimension-icon-danger {
-  background: rgba(239, 68, 68, 0.12);
-  color: #dc2626;
-}
-
-.dimension-content {
-  min-width: 0;
-}
-
-.dimension-label {
-  font-size: 0.78rem;
-  font-weight: 700;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-  color: var(--ink);
-  margin-bottom: 3px;
-}
-
-.dimension-detail {
-  font-size: 0.84rem;
-  color: var(--ink-soft);
-  line-height: 1.5;
-}
-
-.dimension-detail code {
-  font-size: 0.78rem;
-  background: rgba(0, 0, 0, 0.06);
-  padding: 1px 5px;
-  border-radius: 4px;
-}
-
-[data-theme="dark"] .dimension-detail code {
-  background: rgba(255, 255, 255, 0.1);
-}
-
-/* Analysis guidance panel */
-.analysis-guidance {
-  margin-top: 12px;
-  padding: 10px 14px;
-  border-radius: 10px;
-  font-size: 0.84rem;
-  line-height: 1.55;
-  color: var(--ink);
-}
-
-.analysis-guidance.benign {
-  background: rgba(34, 197, 94, 0.06);
-  border-left: 3px solid #16a34a;
-}
-
-.analysis-guidance.suspicious {
-  background: rgba(245, 158, 11, 0.06);
-  border-left: 3px solid #d97706;
-}
-
-.analysis-guidance.malicious {
-  background: rgba(239, 68, 68, 0.06);
-  border-left: 3px solid #dc2626;
-}
-
-.analysis-guidance-label {
-  font-size: 0.68rem;
-  font-weight: 700;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-  margin-bottom: 4px;
-}
-
-.analysis-guidance.benign .analysis-guidance-label {
-  color: #16a34a;
-}
-
-.analysis-guidance.suspicious .analysis-guidance-label {
-  color: #d97706;
-}
-
-.analysis-guidance.malicious .analysis-guidance-label {
-  color: #dc2626;
-}
-
-/* Scan findings section */
-.scan-findings-section {
-  margin-top: 10px;
-  padding: 10px 14px;
-  border-radius: 10px;
-  background: var(--surface-muted);
-  border: 1px solid var(--line);
-}
-
-.scan-findings-title {
-  font-size: 0.72rem;
-  font-weight: 700;
-  text-transform: uppercase;
-  letter-spacing: 0.06em;
-  color: var(--ink-soft);
-  margin-bottom: 6px;
-}
-
-.scan-finding-row {
-  display: flex;
-  align-items: baseline;
-  gap: 8px;
-  font-size: 0.82rem;
-  color: var(--ink-soft);
-  padding: 4px 0;
-}
-
-/* Pending Review Banner */
-.pending-banner {
-  font-size: 0.9rem;
-  color: var(--ink);
-  padding: 12px 16px;
-  border-radius: 12px;
-  background: rgba(240, 196, 106, 0.15);
-  border: 1px solid rgba(240, 196, 106, 0.4);
-  display: flex;
-  align-items: flex-start;
-  gap: 12px;
-}
-
-[data-theme="dark"] .pending-banner {
-  background: rgba(243, 201, 122, 0.12);
-  border-color: rgba(243, 201, 122, 0.35);
-}
-
-.pending-banner-content strong {
-  display: block;
-  font-weight: 650;
-  margin-bottom: 2px;
-}
-
-.pending-banner-content p {
-  color: var(--ink-soft);
-  font-size: 0.85rem;
-  line-height: 1.5;
-  margin: 0;
-}
-
-.pending-banner-content .pending-banner-appeal {
-  margin-top: 6px;
-  font-size: 0.8rem;
-  opacity: 0.75;
-}
-
-.pending-banner-appeal a {
-  color: inherit;
-  text-decoration: underline;
-}
-
-/* Blocked/removed banner variant */
-.pending-banner-blocked {
-  background: rgba(239, 68, 68, 0.12);
-  border-color: rgba(239, 68, 68, 0.4);
-}
-
-[data-theme="dark"] .pending-banner-blocked {
-  background: rgba(239, 68, 68, 0.15);
-  border-color: rgba(239, 68, 68, 0.35);
-}
-
-/* Suspicious/warning banner variant */
-.pending-banner-warning {
-  background: rgba(245, 158, 11, 0.12);
-  border-color: rgba(245, 158, 11, 0.4);
-}
-
-[data-theme="dark"] .pending-banner-warning {
-  background: rgba(245, 158, 11, 0.15);
-  border-color: rgba(245, 158, 11, 0.35);
-}
-
-/* Pending tag for dashboard */
-.tag-pending {
-  background: rgba(240, 196, 106, 0.2);
-  color: #8a6914;
-  gap: 4px;
-}
-
-[data-theme="dark"] .tag-pending {
-  background: rgba(243, 201, 122, 0.18);
-  color: #f3c97a;
-}

vitest.config.ts

@@ -25,7 +25,6 @@ export default defineConfig({
       include: [
         'src/lib/**/*.{ts,tsx}',
         'convex/lib/skills.ts',
-        'convex/lib/skillZip.ts',
         'convex/lib/tokens.ts',
         'convex/httpApi.ts',
         'packages/clawdhub/src/**/*.ts',