fix: preserve folder upload mode across refresh (#551) (thanks @MunemHashmi)

Replace the useEffect + useRef approach for setting webkitdirectory/
directory attributes with a ref callback that sets the attributes
every time the input element is mounted. This ensures folder selection
mode persists after page refresh, where React hydration could strip
the non-standard attributes.

Also removes the @ts-expect-error JSX props since the attributes are
now set imperatively via the ref callback.

.env.local.example

@@ -0,0 +1,19 @@
+# Frontend
+VITE_CONVEX_URL=
+VITE_CONVEX_SITE_URL=
+VITE_SOULHUB_SITE_URL=
+VITE_SOULHUB_HOST=
+VITE_SITE_MODE=
+SITE_URL=http://localhost:3000
+CONVEX_SITE_URL=
+
+# Convex Auth (GitHub OAuth App)
+AUTH_GITHUB_ID=
+AUTH_GITHUB_SECRET=
+
+# Convex Auth JWT keys (generated via @convex-dev/auth CLI)
+JWT_PRIVATE_KEY=
+JWKS=
+
+# Embeddings
+OPENAI_API_KEY=

.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.6
+
+      - name: Install
+        run: bun install --frozen-lockfile
+      - name: Peer deps
+        run: bun run check:peers
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Test
+        run: bun run test
+
+      - name: Coverage
+        run: bun run coverage
+
+      - name: Typecheck packages
+        run: |
+          bunx tsc -p packages/schema/tsconfig.json --noEmit
+          bunx tsc -p packages/clawdhub/tsconfig.json --noEmit
+
+      - name: Build
+        run: bun run build

.github/workflows/secret-scan.yml

@@ -0,0 +1,35 @@
+name: "Security Gate: Secret Scanning"
+
+on:
+  pull_request:
+    branches: [main, master]
+
+jobs:
+  trufflehog:
+    name: Scan for Verified Secrets
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # Required to scan the code in the PR
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # necessary to support the scoping requirements below
+
+      - name: TruffleHog OSS
+        id: trufflehog
+        # Use a concrete released ref that resolves in upstream action registry.
+        # v3 (major tag) is not published by trufflesecurity/trufflehog.
+        uses: trufflesecurity/trufflehog@v3.93.6
+        with:
+          path: ./
+          base: ${{ github.event.pull_request.base.sha }} # scope it to the committed files
+          head: ${{ github.event.pull_request.head.sha }}
+          extra_args: --only-verified --debug
+
+      - name: Notify on Failure
+        if: steps.trufflehog.outcome == 'failure'
+        run: |
+          echo "::error::Verified secrets found! This PR contains live credentials that must be rotated immediately."
+          echo "::notice::If these secrets are already in the commit history, they cannot be removed via a simple removal commit/push. A repository owner can contact GitHub Support to purge the cached data: https://support.github.com/contact/private-information"
+          exit 1

.gitignore

@@ -0,0 +1,26 @@
+node_modules
+.DS_Store
+.bun-build
+*.bun-build
+bin/docs-list
+dist
+dist-ssr
+!packages/schema/dist
+!packages/schema/dist/**
+*.local
+.vercel
+count.txt
+.env
+.nitro
+.tanstack
+.wrangler
+.output
+.vinxi
+todos.json
+.cta.json
+.vscode
+.env*.local
+coverage
+playwright-report
+test-results
+.playwright

.oxfmtrc.jsonc

@@ -0,0 +1,20 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "experimentalSortImports": {
+    "newlinesBetween": false,
+  },
+  "experimentalSortPackageJson": {
+    "sortScripts": true,
+  },
+  "ignorePatterns": [
+    ".output/",
+    ".tanstack/",
+    "convex/_generated/",
+    "coverage/",
+    "dist/",
+    "node_modules/",
+    "public/",
+    "src/routeTree.gen.ts",
+    "test-results/",
+  ],
+}

.oxlintrc.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["unicorn", "typescript", "oxc"],
+  "categories": {
+    "correctness": "error",
+    "perf": "error",
+    "suspicious": "error"
+  },
+  "rules": {
+    "curly": "off",
+    "eslint-plugin-unicorn/prefer-array-find": "off",
+    "eslint-plugin-unicorn/no-array-sort": "off",
+    "eslint/no-await-in-loop": "off",
+    "eslint/no-new": "off",
+    "oxc/no-accumulating-spread": "off",
+    "oxc/no-async-endpoint-handlers": "off",
+    "oxc/no-map-spread": "off",
+    "typescript/no-explicit-any": "error",
+    "typescript/no-extraneous-class": "off",
+    "typescript/no-unnecessary-boolean-literal-compare": "off",
+    "typescript/no-unnecessary-type-assertion": "off",
+    "typescript/no-unsafe-type-assertion": "off",
+    "unicorn/consistent-function-scoping": "off",
+    "unicorn/require-post-message-target-origin": "off"
+  },
+  "ignorePatterns": [
+    ".output/",
+    ".tanstack/",
+    "convex/_generated/",
+    "coverage/",
+    "dist/",
+    "node_modules/",
+    "public/",
+    "src/routeTree.gen.ts",
+    "test-results/"
+  ]
+}

AGENTS.md

@@ -0,0 +1,49 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+- `src/` — TanStack Start app code (routes, components, styles).
+- `convex/` — Convex backend (schema, queries/mutations/actions, HTTP routes).
+- `convex/_generated/` — generated Convex API/types; committed for builds.
+- `docs/` — product/spec docs (see `docs/spec.md`).
+- `public/` — static assets.
+
+## Build, Test, and Development Commands
+- `bun run dev` — local app server at `http://localhost:3000`.
+- `bun run build` — production build (Vite + Nitro).
+- `bun run preview` — preview built app.
+- `bunx convex dev` — Convex dev deployment + function watcher.
+- `bunx convex codegen` — regenerate `convex/_generated`.
+- `bun run lint` — Biome + oxlint (type-aware).
+- `bun run test` — Vitest (unit tests).
+- `bun run coverage` — coverage run; keep global >= 80%.
+
+## Coding Style & Naming Conventions
+- TypeScript strict; ESM.
+- Indentation: 2 spaces, single quotes (Biome).
+- Lint/format: Biome + oxlint (type-aware).
+- Convex function names: verb-first (`getBySlug`, `publishVersion`).
+
+## Testing Guidelines
+- Framework: Vitest 4 + jsdom.
+- Tests live in `src/**` and `convex/lib/**`.
+- Coverage threshold: 80% global (lines/functions/branches/statements).
+- Example: `convex/lib/skills.test.ts`.
+
+## Commit & Pull Request Guidelines
+- Commit messages: Conventional Commits (`feat:`, `fix:`, `chore:`, `docs:`…).
+- Keep changes scoped; avoid repo-wide search/replace.
+- PRs: include summary + test commands run. Add screenshots for UI changes.
+- Reject PRs that add skills into source code/repo content directly (for example under `skills/` or seed-only additions intended as published skills). Skills must be uploaded/published via CLI.
+
+## Git Notes
+- If `git branch -d/-D <branch>` is policy-blocked, delete the local ref directly: `git update-ref -d refs/heads/<branch>`.
+
+## Configuration & Security
+- Local env: `.env.local` (never commit secrets).
+- Convex env holds JWT keys; Vercel only needs `VITE_CONVEX_URL` + `VITE_CONVEX_SITE_URL`.
+- OAuth: GitHub OAuth App credentials required for login.
+
+## Convex Ops (Gotchas)
+- New Convex functions must be pushed before `convex run`: use `bunx convex dev --once` (dev) or `bunx convex deploy` (prod).
+- For non-interactive prod deploys, use `bunx convex deploy -y` to skip confirmation.
+- If `bunx convex run --env-file .env.local ...` returns `401 MissingAccessToken` despite `bunx convex login`, workaround: omit `--env-file` and use `--deployment-name <name>` / `--prod`.

CHANGELOG.md

@@ -0,0 +1,262 @@
+# Changelog
+
+## Unreleased
+
+### Added
+- Moderation: add comment reporting with per-user active report caps, unique reporter/target enforcement, and auto-hide on the 4th unique report.
+- Moderation: add AI-driven comment scam backfill (`commentModeration:*`) with persisted verdict/confidence/explainer metadata and strict auto-ban for `certain_scam` + `high` confidence.
+- Admin: add manual unban for banned users (clears `deletedAt` + `banReason`, audit log entry). Revoked API tokens stay revoked.
+- Admin: bulk restore skills from GitHub backup; reclaim squatted slugs via v1 endpoints + internal tooling (#298) (thanks @autogame-17).
+- Users: add `trustedPublisher` flag and admin mutations to bypass pending-scan auto-hide for trusted publishers (#298) (thanks @autogame-17).
+- Skills/Web: show skill owner avatar + handle on skill cards, lists, and detail pages (#312) (thanks @ianalloway).
+- Skills/Web: add file viewer for skill version files on detail page (#44) (thanks @regenrek).
+- CLI: add `uninstall` command for skills (#241) (thanks @superlowburn).
+- CI/Security: add TruffleHog pull-request scanning for verified leaked credentials (#505) (thanks @akses0).
+
+### Changed
+- Security/docs: document comment reporting/auto-hide behavior alongside existing skill reporting rules.
+- Security/moderation: add bounded explainable auto-ban reasons for scam comments and protect moderator/admin accounts from automated bans.
+- Moderation: banning users now also soft-deletes their authored comments (skill + soul), including legacy cleanup on re-ban.
+- Skill metadata: support env vars, dependency declarations, author, and links in parsed manifest metadata + install UI (#360) (thanks @mahsumaktas).
+- Quality gate: language-aware word counting (`Intl.Segmenter`) and new `cjkChars` signal to reduce false rejects for non-Latin docs.
+- Jobs: run skill stat event processing every 5 minutes (was 15).
+- API performance: batch resolve skill/soul tags in v1 list/get endpoints (fewer action->query round-trips) (#112) (thanks @mkrokosz).
+- Skills: reserve deleted slugs for prior owners (90-day cooldown) to prevent squatting; add admin reclaim flow (#298) (thanks @autogame-17).
+- Moderation: ban flow soft-deletes owned skills (reversible) and removes them from vector search (#298) (thanks @autogame-17).
+- LLM helpers: centralize OpenAI Responses text extraction for changelog/summary/eval flows (#502) (thanks @ianalloway).
+- Rate limiting: apply authenticated quotas by user bucket (vs shared IP), emit delay-based reset headers, and improve CLI 429 guidance/retries (#412) (thanks @lc0rp).
+- Search/listing performance: cut embedding hydration and badge read bandwidth via `embeddingSkillMap` + denormalized skill badges; shift stat-doc sync to low-frequency cron (#441) (thanks @sethconvex).
+
+### Fixed
+- Upload: keep folder-picking enabled after page refresh by reapplying `webkitdirectory`/`directory` on the file input ref (#551) (thanks @MunemHashmi).
+- Skills hard-delete: delete `commentReports` rows during moderation cleanup to avoid orphaned report records.
+- Comments: hide entries authored by deleted/deactivated users in `comments:listBySkill`.
+- Admin API: `POST /api/v1/users/reclaim` now performs non-destructive root-slug owner transfer
+  (preserves existing skill versions/stats/metadata) and clears active slug reservations.
+- VirusTotal: use shared AV-engine fallback verdict mapping for pending/backfill flows and keep undetected-only results pending (#591) (thanks @Shuai-DaiDai).
+- CLI publish: use a longer multipart upload timeout and normalize abort rejections into proper Errors (#550) (thanks @MunemHashmi).
+- CLI: forward optional auth tokens for `search` and `explore` against authenticated registries (#608) (thanks @artdaal).
+- Skill metadata: parse top-level `requires.*`, `primaryEnv`, and homepage fallbacks for security review accuracy (#548) (thanks @MunemHashmi).
+- Users: sync handle on ensure when GitHub login changes (#293) (thanks @christianhpoe).
+- Users/Auth: throttle GitHub profile sync on login; also sync avatar when it changes (#312) (thanks @ianalloway).
+- Upload gate: fetch GitHub account age by immutable account ID (prevents username swaps) (#116) (thanks @mkrokosz).
+- VT fallback: activate only VT-pending hidden skills when scans are unavailable/stale; keep quality/scanner-blocked skills hidden (#300) (thanks @superlowburn).
+- API: return proper status codes for delete/undelete errors (#35) (thanks @sergical).
+- API: for owners, return clearer status/messages for hidden/soft-deleted skills instead of a generic 404.
+- Web: allow copying OpenClaw scan summary text (thanks @borisolver, #322).
+- HTTP/CORS: add preflight handler + include CORS headers on API/download errors; CLI: include auth token for owner-visible installs/updates (#146) (thanks @Grenghis-Khan).
+- CLI: clarify `logout` only removes the local token; token remains valid until revoked in the web UI (#166) (thanks @aronchick).
+- CLI: validate skill slugs used for filesystem operations (prevents path traversal) (#241) (thanks @superlowburn).
+- Skills: keep global sorting across pagination on `/skills` (thanks @CodeBBakGoSu, #98).
+- Skills: allow updating skill description/summary from frontmatter on subsequent publishes (#312) (thanks @ianalloway).
+- Skills/Web: prevent filtered pagination dead-ends and loading-state flicker on `/skills`; move highlighted browse filtering into server list query (#339) (thanks @Marvae).
+- Web: align `/skills` total count with public visibility and format header count (thanks @rknoche6, #76).
+- Skills/Web: centralize public visibility checks and keep `globalStats` skill counts in sync incrementally; remove duplicate `/skills` default-sort fallback and share browse test mocks (thanks @rknoche6, #76).
+- Moderation: clear stale `flagged.suspicious` flags when VirusTotal rescans improve to clean verdicts (#418) (thanks @Phineas1500).
+- CLI: respect `HTTPS_PROXY`/`HTTP_PROXY`/`NO_PROXY` env vars for outbound registry requests, with troubleshooting docs (#363) (thanks @kerrypotter).
+- CLI: preserve registry base paths when composing API URLs for search/inspect/moderation commands (#486) (thanks @Liknox).
+- API tests: lock `Retry-After` behavior to relative-delay semantics for v1 search 429s (#421) (thanks @apoorvdarshan).
+- CLI tests: assert 5xx HTTP responses still perform retry attempts before surfacing final error (#457) (thanks @YonghaoZhao722).
+- GitHub import: improve storage/publish failure errors with actionable context; add regression tests for error formatting (#512) (thanks @vassiliylakhonin).
+- CLI: show manual URL guidance when automatic browser opening is unavailable; add regression tests for opener errors (#163) (thanks @aronchick).
+- API/CLI: expose skill security status in version inspect output, with schema wiring and CLI regression coverage (#362) (thanks @abutbul).
+
+## 0.6.1 - 2026-02-13
+
+### Added
+- Security: add LLM-based security evaluation during skill publish.
+- Parsing: recognize `metadata.openclaw` frontmatter and evaluate all skill files for requirements.
+
+### Changed
+- Performance: lazy-load Monaco diff viewer on demand (thanks @alexjcm, #212).
+- Search: improve recall/ranking with lexical fallback and relevance prioritization.
+- Moderation UX: collapse OpenClaw analysis by default; update spacing and default reasoning model.
+
+### Fixed
+- Skills: fix initial `/skills` sort wiring so first page respects selected sort/direction (thanks @bpk9, #92).
+- Search/UI: add embedding request timeout and align `/skills` toolbar + list width (thanks @GhadiSaab, #53).
+- Upload gate: handle GitHub API rate limits and optional authenticated lookup token (thanks @superlowburn, #246).
+- HTTP: remove `allowH2` from Undici agent to prevent `fetch failed` on Node.js 22+ (#245).
+- Tests: add root `undici` dev dependency for Node E2E imports (thanks @tanujbhaud, #255).
+- Downloads: add download rate limiting + per-IP/day dedupe + scheduled dedupe pruning; preserve moderation gating and deterministic zips (thanks @regenrek, #43).
+- VirusTotal: fix scan sync race conditions and retry behavior in scan/backfill paths.
+- Metadata: tolerate trailing commas in JSON metadata.
+- Auth: allow soft-deleted users to re-authenticate on fresh login, while keeping banned users blocked (thanks @tanujbhaud, #177).
+- Web: prevent horizontal overflow from long code blocks in skill pages (thanks @bewithgaurav, #183).
+
+## 0.6.0 - 2026-02-10
+### Added
+- CLI/API: add `set-role` to change user roles (admin only).
+- Security: quarantine skill publishes with VirusTotal scans + UI (thanks @aleph8, #130).
+- Testing: add tests for badges, skillZip, uploadFiles expandDroppedItems, and ark schema error truncation.
+- Moderation: add ban reasons to API/CLI and show in management UI.
+
+### Changed
+- Coverage: track `convex/lib/skillZip.ts` in coverage reports.
+
+### Fixed
+- Web: show pending-scan skills to owners without 404 (thanks @orlyjamie, #136).
+- Users: backfill empty handles from name/email in ensure (thanks @adlai88, #158).
+- Web: update footer branding to OpenClaw (thanks @jontsai, #122).
+- Auth: restore soft-deleted users on reauth, block banned users (thanks @mkrokosz, #106).
+
+## 0.5.0 - 2026-02-02
+
+### Added
+- Admin: ban users and delete owned skills from management console.
+- Moderation: auto-hide skills after 4 unique reports; per-user report cap; moderators can ban users.
+- Uploads: require GitHub accounts to be at least 7 days old for skill + soul publish/import.
+- CLI: add `inspect` to fetch skill metadata/files without installing.
+- CLI: add moderation commands for hide/unhide/delete and ban users.
+- Management: add filters for reported skills and users.
+
+### Changed
+- Deps: update dependencies to latest available versions.
+- Reporting: require reasons, show them in management console, warn about abuse bans.
+
+### Fixed
+- Bans: batch hard-delete cleanup to avoid Convex read limits on large skills.
+
+## 0.4.0 - 2026-01-30
+
+### Added
+- Web: show published skills on user profiles (thanks @njoylab, #20).
+- CLI: include ClawHub + Moltbot fallback skill roots for sync scans.
+- CLI: support OpenClaw configuration files (`OPENCLAW_CONFIG_PATH` / `OPENCLAW_STATE_DIR`).
+
+### Changed
+- Brand: rebrand to ClawHub and publish CLI as `clawhub` (legacy `clawdhub` supported).
+- Domain: default site/registry now `https://clawhub.ai`; `.well-known/clawhub.json` preferred.
+- Theme: persist theme under `clawhub-theme` (legacy key still read).
+
+### Fixed
+- Registry: drop missing skills during search hydration (thanks @aaronn, #28).
+- CLI: use path-based skill metadata lookup for updates (thanks @daveonkels, #22).
+- Search: keep highlighted-only filtering and clamp vector candidates to Convex limits (thanks @aaronn, #30).
+
+## 0.3.0 - 2026-01-19
+
+### Added
+- CLI: add `explore` command for latest updates, with limit clamping + tests/docs (thanks @jdrhyne, #14).
+- CLI: `explore --json` output + new sorts (`installs`, `installsAllTime`, `trending`) and limit up to 200.
+- API: `/api/v1/skills` supports installs + trending sorts (7-day installs).
+- API: idempotent `POST/DELETE /api/v1/stars/{slug}` endpoints.
+- Registry: trending leaderboard + daily stats backfill for installs-based sorts.
+
+### Fixed
+- Web: keep search mode navigation and state in sync (thanks @NACC96, #12).
+
+## 0.2.0 - 2026-01-13
+
+### Added
+- Web: dynamic OG image cards for skills (name, description, version).
+- CLI: auto-scan Clawdbot skill roots (per-agent workspaces, shared skills, extraDirs).
+- Web: import skills from public GitHub URLs (auto-detect `SKILL.md`, smart file selection, provenance).
+- Web/API: SoulHub (SOUL.md registry) with v1 endpoints and first-run auto-seed.
+
+### Fixed
+- Web: stabilize skill OG image generation on server runtimes.
+- Web: prevent skill OG text overflow outside the card.
+- Registry: make SoulHub auto-seed idempotent and non-user-owned.
+- Registry: keep GitHub backup state + publish backups intact (thanks @joshp123, #1).
+- CLI/Registry: restore fork lineage on sync + clamp bulk list queries (thanks @joshp123, #1).
+- CLI: default workdir falls back to Clawdbot workspace (override with `--workdir` / `CLAWHUB_WORKDIR`).
+
+## 0.0.6 - 2026-01-07
+
+
+### Added
+- API: v1 public REST endpoints with rate limits, raw file fetch, and OpenAPI spec.
+- Docs: `docs/api.md` and `DEPRECATIONS.md` for the v1 cutover plan.
+
+### Changed
+- CLI: publish now uses single multipart `POST /api/v1/skills`.
+- Registry: legacy `/api/*` + `/api/cli/*` marked for deprecation (kept for now).
+
+## 0.0.5 - 2026-01-06
+
+### Added
+- Telemetry: track installs via `clawhub sync` (logged-in only), per root, with 120-day staleness.
+- Skills: show current + all-time installs; sort by installs.
+- Profile: private "Installed" tab with JSON export + delete telemetry controls.
+- Docs: add `docs/telemetry.md` (what we track + how to opt out).
+- Web: custom Open Graph image (`/og.png`) + richer OG/Twitter tags.
+- Web: dashboard for managing your published skills (thanks @dbhurley!).
+
+### Changed
+- CLI: telemetry opt-out via `CLAWHUB_DISABLE_TELEMETRY=1`.
+- Web: move theme picker into mobile menu.
+
+### Fixed
+- Web: handle shorthand hex colors in diff theme (thanks @dbhurley!).
+
+## 0.0.5 - 2026-01-06
+
+### Added
+- Maintenance: admin backfill to re-parse `SKILL.md` and repair stored summaries/parsed metadata.
+
+### Fixed
+- CLI sync: ignore plural `skills.md` docs files when scanning for skills.
+- Registry: parse YAML frontmatter (incl multiline `description`) and accept YAML `metadata` objects.
+
+## 0.0.4 - 2026-01-05
+
+### Added
+- Web: `/skills` list view with sorting (newest/downloads/stars/name) + quick filter.
+- Web: admin/moderator highlight toggle on skill detail.
+- Web: canonical skill URLs as `/<owner>/<slug>` (legacy `/skills/<slug>` redirects).
+- Web: upload auto-generates a changelog via OpenAI when left blank (marked as auto-generated).
+
+### Fixed
+- Web: skill detail shows a loading state instead of flashing "Skill not found".
+- Web: user profile shows avatar + loading state (no "User not found" flash).
+- Web: improved mobile responsiveness (nav menu, skill detail layout, install command overflow).
+- Web: upload now unwraps folder picks so `SKILL.md` can be at the bundle root.
+- Registry: cap embedding payload size to avoid model context errors.
+- CLI: ignore legacy `auth.clawdhub.com` registry and prefer site discovery.
+
+### Changed
+- Web: homepage search now expands into full search mode with live results + highlighted toggle.
+- CLI: sync no longer prompts for changelog; registry auto-generates when blank.
+
+## 0.0.3 - 2026-01-04
+
+### Added
+- CLI sync: concurrency flag to limit registry checks.
+- Home: install command switcher (npm/pnpm/bun).
+
+### Changed
+- CLI sync: default `--concurrency` is now 4 (was 8).
+- CLI sync: replace boxed notes with plain output for long lists.
+
+### Fixed
+- CLI sync: wrap note output to avoid terminal overflow; cap list lengths.
+- CLI sync: label fallback scans as fallback locations.
+- CLI package: bundle schema internally (no external `clawhub-schema` publish).
+- Repo: mark `clawhub-schema` as private to prevent publishing.
+
+## 0.0.2 - 2026-01-04
+
+### Added
+- CLI: delete/undelete commands for soft-deleted skills (owner/admin).
+
+### Fixed
+- CLI sync: dedupe duplicate slugs across scan roots; skip duplicates to avoid double-publish errors.
+- CLI sync: show parsing progress while hashing local skills.
+- CLI sync: prompt only actionable skills; preselect all by default; list synced separately; condensed synced summary when nothing to sync.
+- CLI sync: cap long status lists to avoid massive terminal boxes.
+- CLI publish/sync: allow empty changelog on updates; registry accepts empty changelog for updates.
+- CLI: use `--cli-version` to avoid conflict with skill `--version` flags.
+- Registry: hide soft-deleted skills from search/skill/download unless restored.
+- Tests: add delete/undelete coverage (unit + e2e).
+
+## 0.0.1 - 2026-01-04
+
+### Features
+- CLI auth: login/logout/whoami; browser loopback auth; token storage; site/registry discovery; config overrides.
+- CLI workflow: search, install, update (single/all), list, publish, sync (scan workdir + legacy roots), dry-run, version bumping, tags.
+- Registry/API: skills + versions with semver; tags (latest + custom); changelog per version; SKILL.md frontmatter parsing; text-only validation; zip download; hash resolve; stats (downloads/stars/versions/comments).
+- Web app: home (highlighted + latest), search, skill detail (README, versions, tags, stats, files), upload UI, user profiles, stars, settings (profile + API tokens + delete account).
+- Social: stars + comments with moderation hooks; admin console for roles + highlighted curation.
+- Search: semantic/vector search over skill content with limit/approved filters.
+- Security: GitHub OAuth; role-based access (admin/moderator/user); audit logging for admin actions.

CONTRIBUTING.md

@@ -0,0 +1,166 @@
+# Contributing to ClawHub
+
+Welcome! ClawHub is the public skill registry for [OpenClaw](https://github.com/openclaw/openclaw). We appreciate bug fixes, documentation improvements, and feature contributions.
+
+- **Questions?** Ask in [#clawhub on Discord](https://discord.gg/clawd).
+- **Bug fixes** — PRs are welcome.
+- **New features or architectural changes** — please start with a Discord conversation in #clawhub first so we can align on scope.
+
+## Local Development Setup
+
+### Prerequisites
+
+- [Bun](https://bun.sh/) (Convex CLI runs via `bunx`, no global install needed)
+
+### Install and configure
+
+```bash
+bun install
+cp .env.local.example .env.local
+```
+
+Edit `.env.local` with the following values for **local Convex**:
+
+```bash
+# Frontend
+VITE_CONVEX_URL=http://127.0.0.1:3210
+VITE_CONVEX_SITE_URL=http://127.0.0.1:3210
+SITE_URL=http://localhost:3000
+CONVEX_SITE_URL=http://127.0.0.1:3210
+
+# Deployment used by `bunx convex dev`
+CONVEX_DEPLOYMENT=anonymous:anonymous-clawhub
+```
+
+### GitHub OAuth App (for login)
+
+1. Go to [github.com/settings/developers](https://github.com/settings/developers) and create a new OAuth App.
+2. Set **Homepage URL** to `http://localhost:3000`.
+3. Set **Authorization callback URL** to `http://127.0.0.1:3210/api/auth/callback/github`.
+4. Copy the Client ID and generate a Client Secret, then add them to `.env.local`:
+
+```bash
+AUTH_GITHUB_ID=<your-client-id>
+AUTH_GITHUB_SECRET=<your-client-secret>
+```
+
+### JWT keys (for Convex Auth)
+
+Generate the signing keys:
+
+```bash
+bunx @convex-dev/auth
+```
+
+This outputs `JWT_PRIVATE_KEY` and `JWKS` values — paste them into `.env.local`.
+
+### Run the app
+
+```bash
+# Terminal A: local Convex backend
+bunx convex dev
+
+# Terminal B: frontend (port 3000)
+bun run dev
+```
+
+### Seed the database
+
+Populate sample data so the UI isn't empty:
+
+```bash
+# 3 sample skills (padel, gohome, xuezh)
+bunx convex run --no-push devSeed:seedNixSkills
+
+# 50 extra skills for pagination testing (optional)
+bunx convex run --no-push devSeedExtra:seedExtraSkillsInternal
+```
+
+To reset and re-seed:
+
+```bash
+bunx convex run --no-push devSeed:seedNixSkills '{"reset": true}'
+```
+
+### Optional environment variables
+
+These features degrade gracefully without their keys:
+
+| Variable | Purpose |
+|----------|---------|
+| `OPENAI_API_KEY` | Embeddings and vector search (falls back to zero vectors) |
+| `VT_API_KEY` | VirusTotal malware scanning |
+| `DISCORD_WEBHOOK_URL` | Discord notifications |
+| `GITHUB_APP_ID` / `GITHUB_APP_PRIVATE_KEY` / `GITHUB_APP_INSTALLATION_ID` | GitHub backup sync |
+
+## CLI Development
+
+The CLI source lives in [`packages/clawdhub/`](packages/clawdhub/). Both `clawhub` and `clawdhub` are registered as bin aliases.
+
+To test the CLI against your local instance:
+
+```bash
+CLAWHUB_REGISTRY=http://127.0.0.1:3210 CLAWHUB_SITE=http://localhost:3000 clawhub search "padel"
+```
+
+Manual smoke tests are documented in [`docs/manual-testing.md`](docs/manual-testing.md).
+
+## Skill & Soul Publishing
+
+- Skill format reference: [`docs/skill-format.md`](docs/skill-format.md)
+- Soul format reference: [`docs/soul-format.md`](docs/soul-format.md)
+- End-to-end walkthrough (search, install, publish, sync): [`docs/quickstart.md`](docs/quickstart.md)
+
+Quick publish:
+
+```bash
+clawhub publish <path-to-skill-directory>
+```
+
+## Before Submitting a PR
+
+```bash
+bun run lint       # oxlint
+bun run test       # Vitest (80% coverage threshold)
+bun run build      # Vite + Nitro
+```
+
+These are the same checks that run in CI (`.github/workflows/ci.yml`).
+
+**PR guidelines:**
+
+- Keep PRs focused — one concern per PR.
+- Use [Conventional Commits](https://www.conventionalcommits.org/): `feat:`, `fix:`, `chore:`, `docs:`, etc.
+- Include test commands and screenshots for UI changes.
+- Write a clear description of what changed and why.
+
+## AI-Generated Code
+
+AI-assisted contributions are welcome. When submitting AI-generated or AI-assisted code:
+
+- Note it in the PR description.
+- Describe the level of testing you applied.
+- Include prompts if useful for reviewers.
+- Confirm that you understand and can maintain the code.
+
+## Security Reporting
+
+Report vulnerabilities to **security@openclaw.ai** with:
+
+- Severity assessment
+- Technical reproduction steps
+- Suggested remediation
+
+See [`docs/security.md`](docs/security.md) for moderation and upload gating details.
+
+## Reading Order for New Contributors
+
+1. This file (local setup)
+2. [`docs/quickstart.md`](docs/quickstart.md) — end-to-end workflows
+3. [`docs/architecture.md`](docs/architecture.md) — system design
+4. [`docs/skill-format.md`](docs/skill-format.md) — skill structure
+5. [`docs/cli.md`](docs/cli.md) — CLI reference
+6. [`docs/http-api.md`](docs/http-api.md) — HTTP endpoints
+7. [`docs/auth.md`](docs/auth.md) — authentication
+8. [`docs/deploy.md`](docs/deploy.md) — deployment
+9. [`docs/troubleshooting.md`](docs/troubleshooting.md) — common issues

DEPRECATIONS.md

@@ -0,0 +1,7 @@
+# Deprecations
+
+## Legacy /api routes (pre-v1)
+
+- Deprecated: 2026-01-07
+- TODO: remove legacy `/api/*` and `/api/cli/*` routes after clients migrate to `/api/v1`.
+- Legacy handlers live in `convex/http.ts` and `convex/httpApi.ts`.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Peter Steinberger
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,200 @@
+<p align="center">
+  <img src="public/clawd-logo.png" alt="ClawHub" width="120">
+</p>
+
+<h1 align="center">ClawHub</h1>
+
+<p align="center">
+  <a href="https://github.com/openclaw/clawhub/actions/workflows/ci.yml?branch=main"><img src="https://img.shields.io/github/actions/workflow/status/openclaw/clawhub/ci.yml?branch=main&style=for-the-badge" alt="CI status"></a>
+  <a href="https://discord.gg/clawd"><img src="https://img.shields.io/discord/1456350064065904867?label=Discord&logo=discord&logoColor=white&color=5865F2&style=for-the-badge" alt="Discord"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg?style=for-the-badge" alt="MIT License"></a>
+</p>
+
+ClawHub is the **public skill registry for Clawdbot**: publish, version, and search text-based agent skills (a `SKILL.md` plus supporting files).
+It's designed for fast browsing + a CLI-friendly API, with moderation hooks and vector search.
+
+onlycrabs.ai is the **SOUL.md registry**: publish and share system lore the same way you publish skills.
+
+<p align="center">
+  <a href="https://clawhub.ai">ClawHub</a> ·
+  <a href="https://onlycrabs.ai">onlycrabs.ai</a> ·
+  <a href="VISION.md">Vision</a> ·
+  <a href="docs/README.md">Docs</a> ·
+  <a href="CONTRIBUTING.md">Contributing</a> ·
+  <a href="https://discord.gg/clawd">Discord</a>
+</p>
+
+## What you can do with it
+
+- Browse skills + render their `SKILL.md`.
+- Publish new skill versions with changelogs + tags (including `latest`).
+- Browse souls + render their `SOUL.md`.
+- Publish new soul versions with changelogs + tags.
+- Search via embeddings (vector index) instead of brittle keywords.
+- Star + comment; admins/mods can curate and approve skills.
+
+## onlycrabs.ai (SOUL.md registry)
+
+- Entry point is host-based: `onlycrabs.ai`.
+- On the onlycrabs.ai host, the home page and nav default to souls.
+- On ClawHub, souls live under `/souls`.
+- Soul bundles only accept `SOUL.md` for now (no extra files).
+
+## How it works (high level)
+
+- Web app: TanStack Start (React, Vite/Nitro).
+- Backend: Convex (DB + file storage + HTTP actions) + Convex Auth (GitHub OAuth).
+- Search: OpenAI embeddings (`text-embedding-3-small`) + Convex vector search.
+- API schema + routes: `packages/schema` (`clawhub-schema`).
+
+## CLI
+
+Common CLI flows:
+
+- Auth: `clawhub login`, `clawhub whoami`
+- Discover: `clawhub search ...`, `clawhub explore`
+- Manage local installs: `clawhub install <slug>`, `clawhub uninstall <slug>`, `clawhub list`, `clawhub update --all`
+- Inspect without installing: `clawhub inspect <slug>`
+- Publish/sync: `clawhub publish <path>`, `clawhub sync`
+
+Docs: [`docs/quickstart.md`](docs/quickstart.md), [`docs/cli.md`](docs/cli.md).
+
+### Removal permissions
+
+- `clawhub uninstall <slug>` only removes a local install on your machine.
+- Uploaded registry skills use soft-delete/restore (`clawhub delete <slug>` / `clawhub undelete <slug>` or API equivalents).
+- Soft-delete/restore is allowed for the skill owner, moderators, and admins.
+- Hard delete is admin-only (management tools / ban flows).
+
+
+## Telemetry
+
+ClawHub tracks minimal **install telemetry** (to compute install counts) when you run `clawhub sync` while logged in.
+Disable via:
+
+```bash
+export CLAWHUB_DISABLE_TELEMETRY=1
+```
+
+Details: [`docs/telemetry.md`](docs/telemetry.md).
+
+## Repo layout
+
+- `src/` — TanStack Start app (routes, components, styles).
+- `convex/` — schema + queries/mutations/actions + HTTP API routes.
+- `packages/schema/` — shared API types/routes for the CLI and app.
+- [`docs/`](docs/README.md) — project documentation (architecture, CLI, auth, deployment, and more).
+- [`docs/spec.md`](docs/spec.md) — product + implementation spec (good first read).
+
+## Local dev
+
+Prereqs: [Bun](https://bun.sh/) (Convex runs via `bunx`, no global install needed).
+
+```bash
+bun install
+cp .env.local.example .env.local
+# edit .env.local — see CONTRIBUTING.md for local Convex values
+
+# terminal A: local Convex backend
+bunx convex dev
+
+# terminal B: web app (port 3000)
+bun run dev
+
+# seed sample data
+bunx convex run --no-push devSeed:seedNixSkills
+```
+
+For full setup instructions (env vars, GitHub OAuth, JWT keys, database seeding), see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Environment
+
+- `VITE_CONVEX_URL`: Convex deployment URL (`https://<deployment>.convex.cloud`).
+- `VITE_CONVEX_SITE_URL`: Convex site URL (`https://<deployment>.convex.site`).
+- `VITE_SOULHUB_SITE_URL`: onlycrabs.ai site URL (`https://onlycrabs.ai`).
+- `VITE_SOULHUB_HOST`: onlycrabs.ai host match (`onlycrabs.ai`).
+- `VITE_SITE_MODE`: Optional override (`skills` or `souls`) for SSR builds.
+- `CONVEX_SITE_URL`: same as `VITE_CONVEX_SITE_URL` (auth + cookies).
+- `SITE_URL`: App URL (local: `http://localhost:3000`).
+- `AUTH_GITHUB_ID` / `AUTH_GITHUB_SECRET`: GitHub OAuth App.
+- `JWT_PRIVATE_KEY` / `JWKS`: Convex Auth keys.
+- `OPENAI_API_KEY`: embeddings for search + indexing.
+
+## Nix plugins (nixmode skills)
+
+ClawHub can store a nix-clawdbot plugin pointer in SKILL frontmatter so the registry knows which
+Nix package bundle to install. A nix plugin is different from a regular skill pack: it bundles the
+skill pack, the CLI binary, and its config flags/requirements together.
+
+Add this to `SKILL.md`:
+
+```yaml
+---
+name: peekaboo
+description: Capture and automate macOS UI with the Peekaboo CLI.
+metadata: {"clawdbot":{"nix":{"plugin":"github:clawdbot/nix-steipete-tools?dir=tools/peekaboo","systems":["aarch64-darwin"]}}}
+---
+```
+
+Install via nix-clawdbot:
+
+```nix
+programs.clawdbot.plugins = [
+  { source = "github:clawdbot/nix-steipete-tools?dir=tools/peekaboo"; }
+];
+```
+
+You can also declare config requirements + an example snippet:
+
+```yaml
+---
+name: padel
+description: Check padel court availability and manage bookings via Playtomic.
+metadata: {"clawdbot":{"config":{"requiredEnv":["PADEL_AUTH_FILE"],"stateDirs":[".config/padel"],"example":"config = { env = { PADEL_AUTH_FILE = \\\"/run/agenix/padel-auth\\\"; }; };"}}}
+---
+```
+
+To show CLI help (recommended for nix plugins), include the `cli --help` output:
+
+```yaml
+---
+name: padel
+description: Check padel court availability and manage bookings via Playtomic.
+metadata: {"clawdbot":{"cliHelp":"padel --help\\nUsage: padel [command]\\n"}}
+---
+```
+
+`metadata.clawdbot` is preferred, but `metadata.clawdis` and `metadata.openclaw` are accepted as aliases.
+
+## Skill metadata
+
+Skills declare their runtime requirements (env vars, binaries, install specs) in the `SKILL.md` frontmatter. ClawHub's security analysis checks these declarations against actual skill behavior.
+
+Full reference: [`docs/skill-format.md`](docs/skill-format.md#frontmatter-metadata)
+
+Quick example:
+
+```yaml
+---
+name: my-skill
+description: Does a thing with an API.
+metadata:
+  openclaw:
+    requires:
+      env:
+        - MY_API_KEY
+      bins:
+        - curl
+    primaryEnv: MY_API_KEY
+---
+```
+
+## Scripts
+
+```bash
+bun run dev
+bun run build
+bun run test
+bun run coverage
+bun run lint
+```

VISION.md

@@ -0,0 +1,94 @@
+## OpenClaw Vision
+
+OpenClaw is the AI that actually does things.
+It runs on your devices, in your channels, with your rules.
+
+This document explains the current state and direction of the project.
+We are still early, so iteration is fast.
+Project overview and developer docs: [`README.md`](README.md)
+
+OpenClaw started as my personal playground to learn AI and build something genuinely useful:
+an assistant that can run real tasks on my computer.
+It evolved through several names and shells: Warelay -> Clawdbot -> Moltbot -> OpenClaw.
+
+The goal? A personal assistant that's easy to use, supports a wide range of platforms, and respects your privacy and security.
+
+The current focus is:
+
+Priority:
+- Security and safe defaults
+- Bug fixes and stability
+- Setup reliability and first-run UX
+
+Next priorities:
+- Supporting all major model providers
+- Improving support for major messaging channels (and adding a few high-demand ones)
+- Performance and test infrastructure
+- Better computer-use and agent harness capabilities
+- Ergonomics across CLI and web frontend
+- Companion apps on macOS, iOS, Android, Windows, and Linux
+
+## Security
+
+Security in OpenClaw is a deliberate tradeoff: strong defaults without killing capability.
+The goal is to stay powerful for real work while making risky paths explicit and operator-controlled.
+
+Canonical security policy and reporting:
+- https://github.com/openclaw/openclaw/blob/main/SECURITY.md
+
+We prioritize secure defaults, but we also expose clear knobs for trusted high-power workflows.
+
+## Plugins & Memory
+
+OpenClaw has an extensive plugin API.
+Core stays lean; optional capability should usually ship as plugins.
+
+Preferred plugin path is npm package distribution plus local extension loading for development.
+If you build a plugin, please host and maintain it in your own repository.
+The bar for adding optional plugins to core is intentionally high.
+
+Memory is a special plugin slot where only one memory plugin can be active at a time.
+Today we ship multiple memory options; over time we plan to converge on one recommended default path.
+
+### Skills
+
+We still ship some bundled skills for baseline UX.
+New skills should be published to ClawHub first (`clawhub.ai`), not added to core by default.
+Core skill additions should be rare and require a strong product or security reason.
+
+### MCP Support
+
+OpenClaw supports MCP through `mcporter`: https://github.com/steipete/mcporter
+
+This keeps MCP integration flexible and decoupled from core runtime:
+- add or change MCP servers without restarting the gateway
+- keep core tool/context surface lean
+- reduce MCP churn impact on core stability and security
+
+For now, we prefer this bridge model over building first-class MCP runtime into core.
+If there is an MCP server or feature `mcporter` does not support yet, please open an issue there.
+
+### Setup
+
+OpenClaw is currently terminal-first by design.
+This keeps setup explicit: users see docs, auth, permissions, and security posture up front.
+
+Long term, we want easier onboarding flows as hardening matures.
+We do not want convenience wrappers that hide critical security decisions from users.
+
+### Why TypeScript?
+
+OpenClaw is primarily an orchestration system: prompts, tools, protocols, and integrations.
+TypeScript was chosen to keep OpenClaw hackable by default.
+It is widely known, fast to iterate in, and easy to read, modify, and extend.
+
+## What We Will Not Merge (For Now)
+
+- New core skills when they can live on ClawHub
+- Commercial service integrations that do not clearly fit the model-provider category
+- Wrapper channels around already supported channels without a clear capability or security gap
+- First-class MCP runtime in core when `mcporter` already provides the integration path
+- Heavy orchestration layers that duplicate existing agent and tool infrastructure
+
+This list is a roadmap guardrail, not a law of physics.
+Strong user demand and strong technical rationale can change it.

clawdhub

@@ -0,0 +1,46 @@
+#!/usr/bin/env bun
+import { existsSync } from 'node:fs'
+import { stat } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+
+const distCliUrl = new URL('./packages/clawdhub/dist/cli.js', import.meta.url)
+const distCliPath = fileURLToPath(distCliUrl)
+const srcRootPath = fileURLToPath(new URL('./packages/clawdhub/src/', import.meta.url))
+
+const shouldBuild = await (async () => {
+  if (!existsSync(distCliPath)) return true
+  try {
+    const dist = await stat(distCliPath)
+    const latestSrcMtime = await getLatestMtime(srcRootPath)
+    return latestSrcMtime > dist.mtimeMs
+  } catch {
+    return true
+  }
+})()
+
+if (shouldBuild) {
+  const proc = Bun.spawn(['bunx', 'tsc', '-p', 'packages/clawdhub/tsconfig.json'], {
+    stdin: 'inherit',
+    stdout: 'inherit',
+    stderr: 'inherit',
+  })
+  const code = await proc.exited
+  if (code !== 0) process.exit(code)
+}
+
+await import(distCliUrl.href)
+
+async function getLatestMtime(root: string) {
+  let latest = 0
+  const glob = new Bun.Glob('**/*.ts')
+  for await (const rel of glob.scan({ cwd: root, onlyFiles: true })) {
+    const path = `${root}${root.endsWith('/') ? '' : '/'}${rel}`
+    try {
+      const entry = await stat(path)
+      latest = Math.max(latest, entry.mtimeMs)
+    } catch {
+      // ignore
+    }
+  }
+  return latest
+}

clawhub

@@ -0,0 +1,46 @@
+#!/usr/bin/env bun
+import { existsSync } from 'node:fs'
+import { stat } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+
+const distCliUrl = new URL('./packages/clawdhub/dist/cli.js', import.meta.url)
+const distCliPath = fileURLToPath(distCliUrl)
+const srcRootPath = fileURLToPath(new URL('./packages/clawdhub/src/', import.meta.url))
+
+const shouldBuild = await (async () => {
+  if (!existsSync(distCliPath)) return true
+  try {
+    const dist = await stat(distCliPath)
+    const latestSrcMtime = await getLatestMtime(srcRootPath)
+    return latestSrcMtime > dist.mtimeMs
+  } catch {
+    return true
+  }
+})()
+
+if (shouldBuild) {
+  const proc = Bun.spawn(['bunx', 'tsc', '-p', 'packages/clawdhub/tsconfig.json'], {
+    stdin: 'inherit',
+    stdout: 'inherit',
+    stderr: 'inherit',
+  })
+  const code = await proc.exited
+  if (code !== 0) process.exit(code)
+}
+
+await import(distCliUrl.href)
+
+async function getLatestMtime(root: string) {
+  let latest = 0
+  const glob = new Bun.Glob('**/*.ts')
+  for await (const rel of glob.scan({ cwd: root, onlyFiles: true })) {
+    const path = `${root}${root.endsWith('/') ? '' : '/'}${rel}`
+    try {
+      const entry = await stat(path)
+      latest = Math.max(latest, entry.mtimeMs)
+    } catch {
+      // ignore
+    }
+  }
+  return latest
+}

clawhub-ui-proof/pr-2192/2026-05-13T00-12-37-146Z/report.md

@@ -1,23 +0,0 @@
-# ClawHub UI Proof
-Status: pass
-Scenario: `/Users/patrickerichsen/.codex/worktrees/68a3/clawhub/.artifacts/proof-scenarios/sample-text-before-after.pw.ts`
-Baseline: `origin/main`
-Candidate: `worktree`
-Provider: `hetzner`
-## Artifacts
-### baseline
-
-- Output: `/Users/patrickerichsen/.codex/worktrees/68a3/clawhub/.artifacts/clawhub-ui-proof/2026-05-13T00-12-37-146Z/baseline`
-- pass: baseline /skills - `baseline/screenshots/baseline-skills.png`
-- pass: baseline /plugins - `baseline/screenshots/baseline-plugins.png`
-- pass: baseline /souls - `baseline/screenshots/baseline-souls.png`
-- Video: `baseline/full-run.mp4`
-
-### candidate
-
-- Output: `/Users/patrickerichsen/.codex/worktrees/68a3/clawhub/.artifacts/clawhub-ui-proof/2026-05-13T00-12-37-146Z/candidate`
-- pass: candidate /skills - `candidate/screenshots/candidate-skills.png`
-- pass: candidate /plugins - `candidate/screenshots/candidate-plugins.png`
-- pass: candidate /souls - `candidate/screenshots/candidate-souls.png`
-- Video: `candidate/full-run.mp4`
-

clawhub-ui-proof/pr-2192/2026-05-13T00-12-37-146Z/summary.json

@@ -1,77 +0,0 @@
-{
-  "baseline": "origin/main",
-  "candidate": "worktree",
-  "generatedAt": "2026-05-13T00:12:37.148Z",
-  "lanes": [
-    {
-      "localOutputDir": "/Users/patrickerichsen/.codex/worktrees/68a3/clawhub/.artifacts/clawhub-ui-proof/2026-05-13T00-12-37-146Z/baseline",
-      "name": "baseline",
-      "ref": "origin/main",
-      "remoteOutputDir": "/work/crabbox/cbx_2ac97d8c7cd2/clawhub/.artifacts/clawhub-ui-proof/remote-2026-05-13T00-12-37-146Z/baseline",
-      "status": "pass",
-      "steps": [
-        {
-          "lane": "baseline",
-          "name": "baseline /skills",
-          "screenshot": "screenshots/baseline-skills.png",
-          "slug": "baseline-skills",
-          "status": "pass"
-        },
-        {
-          "lane": "baseline",
-          "name": "baseline /plugins",
-          "screenshot": "screenshots/baseline-plugins.png",
-          "slug": "baseline-plugins",
-          "status": "pass"
-        },
-        {
-          "lane": "baseline",
-          "name": "baseline /souls",
-          "screenshot": "screenshots/baseline-souls.png",
-          "slug": "baseline-souls",
-          "status": "pass"
-        }
-      ],
-      "videoPath": "/Users/patrickerichsen/.codex/worktrees/68a3/clawhub/.artifacts/clawhub-ui-proof/2026-05-13T00-12-37-146Z/baseline/full-run.mp4"
-    },
-    {
-      "localOutputDir": "/Users/patrickerichsen/.codex/worktrees/68a3/clawhub/.artifacts/clawhub-ui-proof/2026-05-13T00-12-37-146Z/candidate",
-      "name": "candidate",
-      "ref": "worktree",
-      "remoteOutputDir": "/work/crabbox/cbx_2ac97d8c7cd2/clawhub/.artifacts/clawhub-ui-proof/remote-2026-05-13T00-12-37-146Z/candidate",
-      "status": "pass",
-      "steps": [
-        {
-          "lane": "candidate",
-          "name": "candidate /skills",
-          "screenshot": "screenshots/candidate-skills.png",
-          "slug": "candidate-skills",
-          "status": "pass"
-        },
-        {
-          "lane": "candidate",
-          "name": "candidate /plugins",
-          "screenshot": "screenshots/candidate-plugins.png",
-          "slug": "candidate-plugins",
-          "status": "pass"
-        },
-        {
-          "lane": "candidate",
-          "name": "candidate /souls",
-          "screenshot": "screenshots/candidate-souls.png",
-          "slug": "candidate-souls",
-          "status": "pass"
-        }
-      ],
-      "videoPath": "/Users/patrickerichsen/.codex/worktrees/68a3/clawhub/.artifacts/clawhub-ui-proof/2026-05-13T00-12-37-146Z/candidate/full-run.mp4"
-    }
-  ],
-  "outputDir": "/Users/patrickerichsen/.codex/worktrees/68a3/clawhub/.artifacts/clawhub-ui-proof/2026-05-13T00-12-37-146Z",
-  "provider": "hetzner",
-  "scenario": "/Users/patrickerichsen/.codex/worktrees/68a3/clawhub/.artifacts/proof-scenarios/sample-text-before-after.pw.ts",
-  "status": "pass",
-  "crabbox": {
-    "createdLease": true,
-    "leaseId": "cbx_2ac97d8c7cd2"
-  }
-}

clawhub-ui-proof/pr-2298/2026-05-18T21-29-29Z-security-scans/report.md

@@ -1,11 +0,0 @@
-# ClawHub UI Proof
-
-Status: pass
-Mode: `feature`
-Scenario: `e2e/local-auth/security-scan-management-proof.pw.test.ts`
-Provider: `local-auth`
-
-## Artifacts
-
-- pass: Desktop management security scans - `candidate/screenshots/desktop-security-scans.png`
-- pass: Mobile management security scans - `candidate/screenshots/mobile-security-scans.png`

clawhub-ui-proof/pr-2298/2026-05-18T21-29-29Z-security-scans/summary.json

@@ -1,34 +0,0 @@
-{
-  "baseline": "not run",
-  "candidate": "pe/security-scan-admin-tooling",
-  "generatedAt": "2026-05-18T21:32:12.809Z",
-  "lanes": [
-    {
-      "localOutputDir": "/Users/patrickerichsen/Git/openclaw/clawhub/.artifacts/clawhub-ui-proof/2026-05-18T21-29-29Z-security-scans/candidate",
-      "name": "candidate",
-      "ref": "pe/security-scan-admin-tooling",
-      "status": "pass",
-      "steps": [
-        {
-          "lane": "candidate",
-          "name": "Desktop management security scans",
-          "screenshot": "screenshots/desktop-security-scans.png",
-          "slug": "desktop-security-scans",
-          "status": "pass"
-        },
-        {
-          "lane": "candidate",
-          "name": "Mobile management security scans",
-          "screenshot": "screenshots/mobile-security-scans.png",
-          "slug": "mobile-security-scans",
-          "status": "pass"
-        }
-      ]
-    }
-  ],
-  "mode": "feature",
-  "outputDir": "/Users/patrickerichsen/Git/openclaw/clawhub/.artifacts/clawhub-ui-proof/2026-05-18T21-29-29Z-security-scans",
-  "provider": "local-auth",
-  "scenario": "e2e/local-auth/security-scan-management-proof.pw.test.ts",
-  "status": "pass"
-}

clawhub-ui-proof/pr-2299/clawhub-pr-2299-owner-scoped-proof/report.md

@@ -1,5 +0,0 @@
-# Owner-Scoped Skill Slugs UI Proof
-
-- Scenario: owner-scoped skill slug UI surfaces.
-- Skill detail page proof: owner-qualified route and install command render as `@local/padel`.
-- Install command proof: copyable command uses `openclaw skills install @local/padel`.

clawhub-ui-proof/pr-2299/clawhub-pr-2299-owner-scoped-proof/summary.json

@@ -1,26 +0,0 @@
-{
-  "status": "passed",
-  "mode": "feature",
-  "scenario": "owner-scoped skill slug UI surfaces",
-  "provider": "Codex local browser proof",
-  "candidate": "pe/owner-scoped-skill-slugs",
-  "lanes": [
-    {
-      "name": "owner-scoped-skill-slugs",
-      "steps": [
-        {
-          "name": "Skill detail page shows owner-qualified route and install ref",
-          "slug": "skill-page-owner-ref",
-          "status": "passed",
-          "screenshot": "skill-page-owner-ref.png"
-        },
-        {
-          "name": "Install command uses @owner/slug",
-          "slug": "install-command-owner-ref",
-          "status": "passed",
-          "screenshot": "install-command-owner-ref.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2403/claw-175-local/report.md

@@ -1,7 +0,0 @@
-# Management Security Scan Overview
-
-Feature proof for PR #2403.
-
-- Desktop overview shows ClawScan-first current verdict totals, pipeline status, recent scan window, category rollups, and failed scan samples.
-- Desktop drilldown shows a selected artifact with ClawScan verdict/category/summary first, followed by pipeline status and supporting scanner evidence.
-- Mobile view keeps the management security overview usable at narrow width without overlapping controls.

clawhub-ui-proof/pr-2403/claw-175-local/summary.json

@@ -1,32 +0,0 @@
-{
-  "status": "passed",
-  "mode": "feature",
-  "scenario": "management-security-scan-overview",
-  "provider": "local-playwright",
-  "candidate": "pe/clawscan-visibility",
-  "lanes": [
-    {
-      "name": "candidate",
-      "steps": [
-        {
-          "name": "Management security overview",
-          "slug": "management-security-overview-desktop",
-          "status": "passed",
-          "screenshot": "management-security-overview-desktop.png"
-        },
-        {
-          "name": "Artifact drilldown",
-          "slug": "management-security-drilldown-desktop",
-          "status": "passed",
-          "screenshot": "management-security-drilldown-desktop.png"
-        },
-        {
-          "name": "Mobile management security overview",
-          "slug": "management-security-mobile",
-          "status": "passed",
-          "screenshot": "management-security-mobile.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2465/skill-card-grid-context-1780331337362/report.md

@@ -1,12 +0,0 @@
-# ClawHub UI Proof
-
-Status: pass
-Scenario: Skill grid card metadata layout with nearby skills
-
-Screenshots:
-- baseline desktop: baseline/screenshots/desktop-grid-context.png
-- candidate desktop: candidate/screenshots/desktop-grid-context.png
-- baseline mobile: baseline/screenshots/mobile-grid-context.png
-- candidate mobile: candidate/screenshots/mobile-grid-context.png
-
-Observed target card: Self-Improving + Proactive Agent.

clawhub-ui-proof/pr-2465/skill-card-grid-context-1780331337362/summary.json

@@ -1,156 +0,0 @@
-{
-  "baseline": "origin/main",
-  "candidate": "jesse/fix-skill-card-date-overlap",
-  "generatedAt": "2026-06-01T16:29:49.092Z",
-  "lanes": [
-    {
-      "name": "baseline",
-      "lane": "baseline",
-      "ref": "origin/main",
-      "baseURL": "http://127.0.0.1:3038",
-      "localOutputDir": "/Users/jmerhi/repos/claw-working-space/clawhub-fix-skill-card-date-overlap/.artifacts/clawhub-ui-proof/skill-card-grid-context-1780331337362/baseline",
-      "status": "pass",
-      "steps": [
-        {
-          "name": "Desktop skills grid context",
-          "slug": "desktop-grid-context",
-          "screenshot": "screenshots/desktop-grid-context.png",
-          "status": "pass"
-        },
-        {
-          "name": "Mobile skills grid context",
-          "slug": "mobile-grid-context",
-          "screenshot": "screenshots/mobile-grid-context.png",
-          "status": "pass"
-        }
-      ],
-      "metrics": [
-        {
-          "step": "desktop grid context",
-          "viewport": "desktop",
-          "children": [
-            {
-              "className": "skill-card-tags",
-              "text": "LinuxmacOSWindows"
-            },
-            {
-              "className": "skill-card-header",
-              "text": "Self-Improving + Proactive Agent"
-            },
-            {
-              "className": "skill-card-summary",
-              "text": "Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when..."
-            },
-            {
-              "className": "skill-card-footer",
-              "text": "by@ivangdavilaUpdated 3w ago1.2k·195k"
-            }
-          ],
-          "tagsBelowSummary": false,
-          "authorToUpdatedGap": 14
-        },
-        {
-          "step": "mobile grid context",
-          "viewport": "mobile",
-          "children": [
-            {
-              "className": "skill-card-tags",
-              "text": "LinuxmacOSWindows"
-            },
-            {
-              "className": "skill-card-header",
-              "text": "Self-Improving + Proactive Agent"
-            },
-            {
-              "className": "skill-card-summary",
-              "text": "Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when..."
-            },
-            {
-              "className": "skill-card-footer",
-              "text": "by@ivangdavilaUpdated 3w ago1.2k·195k"
-            }
-          ],
-          "tagsBelowSummary": false,
-          "authorToUpdatedGap": 14
-        }
-      ]
-    },
-    {
-      "name": "candidate",
-      "lane": "candidate",
-      "ref": "jesse/fix-skill-card-date-overlap",
-      "baseURL": "http://127.0.0.1:3037",
-      "localOutputDir": "/Users/jmerhi/repos/claw-working-space/clawhub-fix-skill-card-date-overlap/.artifacts/clawhub-ui-proof/skill-card-grid-context-1780331337362/candidate",
-      "status": "pass",
-      "steps": [
-        {
-          "name": "Desktop skills grid context",
-          "slug": "desktop-grid-context",
-          "screenshot": "screenshots/desktop-grid-context.png",
-          "status": "pass"
-        },
-        {
-          "name": "Mobile skills grid context",
-          "slug": "mobile-grid-context",
-          "screenshot": "screenshots/mobile-grid-context.png",
-          "status": "pass"
-        }
-      ],
-      "metrics": [
-        {
-          "step": "desktop grid context",
-          "viewport": "desktop",
-          "children": [
-            {
-              "className": "skill-card-header",
-              "text": "Self-Improving + Proactive Agent"
-            },
-            {
-              "className": "skill-card-summary",
-              "text": "Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when..."
-            },
-            {
-              "className": "skill-card-tags",
-              "text": "LinuxmacOSWindows"
-            },
-            {
-              "className": "skill-card-footer",
-              "text": "by@ivangdavilaUpdated 3w ago1.2k·195k"
-            }
-          ],
-          "tagsBelowSummary": true,
-          "authorToUpdatedGap": 8
-        },
-        {
-          "step": "mobile grid context",
-          "viewport": "mobile",
-          "children": [
-            {
-              "className": "skill-card-header",
-              "text": "Self-Improving + Proactive Agent"
-            },
-            {
-              "className": "skill-card-summary",
-              "text": "Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when..."
-            },
-            {
-              "className": "skill-card-tags",
-              "text": "LinuxmacOSWindows"
-            },
-            {
-              "className": "skill-card-footer",
-              "text": "by@ivangdavilaUpdated 3w ago1.2k·195k"
-            }
-          ],
-          "tagsBelowSummary": true,
-          "authorToUpdatedGap": 8
-        }
-      ]
-    }
-  ],
-  "mode": "before-after",
-  "outputDir": "/Users/jmerhi/repos/claw-working-space/clawhub-fix-skill-card-date-overlap/.artifacts/clawhub-ui-proof/skill-card-grid-context-1780331337362",
-  "provider": "local",
-  "scenario": "Skill grid card metadata layout with nearby skills",
-  "status": "pass"
-}

clawhub-ui-proof/pr-2465/skill-card-metadata-1780328491887/report.md

@@ -1,6 +0,0 @@
-# ClawHub UI Proof
-
-Status: pass
-Mode: before-after
-Scenario: Skill grid card metadata layout
-

clawhub-ui-proof/pr-2465/skill-card-metadata-1780328491887/summary.json

@@ -1,55 +0,0 @@
-{
-  "baseline": "origin/main",
-  "candidate": "jesse/fix-skill-card-date-overlap",
-  "lanes": [
-    {
-      "baseURL": "http://127.0.0.1:3038",
-      "lane": "baseline",
-      "name": "baseline",
-      "localOutputDir": "/Users/jmerhi/repos/claw-working-space/clawhub-fix-skill-card-date-overlap/.artifacts/clawhub-ui-proof/skill-card-metadata-1780328491887/baseline",
-      "ref": "origin/main",
-      "status": "pass",
-      "steps": [
-        {
-          "name": "Desktop skill card",
-          "slug": "desktop-skill-card",
-          "screenshot": "screenshots/desktop-skill-card.png",
-          "status": "pass"
-        },
-        {
-          "name": "Mobile skill card",
-          "slug": "mobile-skill-card",
-          "screenshot": "screenshots/mobile-skill-card.png",
-          "status": "pass"
-        }
-      ]
-    },
-    {
-      "baseURL": "http://127.0.0.1:3037",
-      "lane": "candidate",
-      "name": "candidate",
-      "localOutputDir": "/Users/jmerhi/repos/claw-working-space/clawhub-fix-skill-card-date-overlap/.artifacts/clawhub-ui-proof/skill-card-metadata-1780328491887/candidate",
-      "ref": "jesse/fix-skill-card-date-overlap",
-      "status": "pass",
-      "steps": [
-        {
-          "name": "Desktop skill card",
-          "slug": "desktop-skill-card",
-          "screenshot": "screenshots/desktop-skill-card.png",
-          "status": "pass"
-        },
-        {
-          "name": "Mobile skill card",
-          "slug": "mobile-skill-card",
-          "screenshot": "screenshots/mobile-skill-card.png",
-          "status": "pass"
-        }
-      ]
-    }
-  ],
-  "mode": "before-after",
-  "outputDir": "/Users/jmerhi/repos/claw-working-space/clawhub-fix-skill-card-date-overlap/.artifacts/clawhub-ui-proof/skill-card-metadata-1780328491887",
-  "provider": "local",
-  "scenario": "Skill grid card metadata layout",
-  "status": "pass"
-}

clawhub-ui-proof/pr-2484/2026-06-03-plugin-download-counts/report.md

@@ -1,14 +0,0 @@
-# ClawHub UI Proof
-
-Status: `passed`
-
-Mode: `feature`
-
-Scenario: `manual-plugin-download-counts`
-
-Provider: `local-playwright`
-
-## Candidate
-
-- `http://127.0.0.1:3001/plugins/clawbits-openclaw-plugin`
-- Confirms plugin detail pages render `Downloads` as the first sidebar stat, above repository and owner metadata.

clawhub-ui-proof/pr-2484/2026-06-03-plugin-download-counts/summary.json

@@ -1,21 +0,0 @@
-{
-  "status": "passed",
-  "mode": "feature",
-  "scenario": "manual-plugin-download-counts",
-  "provider": "local-playwright",
-  "baseline": "not-run",
-  "candidate": "pe/plugin-download-counts",
-  "lanes": [
-    {
-      "name": "candidate",
-      "steps": [
-        {
-          "name": "Plugin detail downloads top stat",
-          "slug": "plugin-downloads-top",
-          "status": "passed",
-          "screenshot": "plugin-downloads-top.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2484/2026-06-05-plugin-list-downloads/report.md

@@ -1,6 +0,0 @@
-# ClawHub UI Proof
-
-- Status: passed
-- Mode: feature
-- Scenario: plugin-list-downloads-sort
-- Proof: plugin list shows the Most downloaded sort option selected and download counts in list rows.

clawhub-ui-proof/pr-2484/2026-06-05-plugin-list-downloads/summary.json

@@ -1,20 +0,0 @@
-{
-  "status": "passed",
-  "mode": "feature",
-  "scenario": "plugin-list-downloads-sort",
-  "provider": "codex-in-app-browser",
-  "candidate": "pe/plugin-download-counts",
-  "lanes": [
-    {
-      "name": "candidate",
-      "steps": [
-        {
-          "name": "Plugin list downloads and sort",
-          "slug": "plugin-list-downloads-sort",
-          "status": "passed",
-          "screenshot": "plugin-list-downloads-sort.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2484/2026-06-05-plugin-list-no-family-badges/report.md

@@ -1,6 +0,0 @@
-# ClawHub UI Proof
-
-- Status: passed
-- Mode: feature
-- Scenario: plugin-list-no-family-badges
-- Proof: plugin list still shows download counts while Code Plugin and Bundle Plugin family badges are absent.

clawhub-ui-proof/pr-2484/2026-06-05-plugin-list-no-family-badges/summary.json

@@ -1,20 +0,0 @@
-{
-  "status": "passed",
-  "mode": "feature",
-  "scenario": "plugin-list-no-family-badges",
-  "provider": "codex-in-app-browser",
-  "candidate": "pe/plugin-download-counts",
-  "lanes": [
-    {
-      "name": "candidate",
-      "steps": [
-        {
-          "name": "Plugin list without family badges",
-          "slug": "plugin-list-no-family-badges",
-          "status": "passed",
-          "screenshot": "plugin-list-no-family-badges.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2520/appeals-flow-account-banned-3b4cc2d9/report.md

@@ -1,6 +0,0 @@
-# PR #2520 proof
-
-Status: pass
-
-- Rendered the account-ban and artifact-level scanner rejection emails from the real email builders; the account-ban email no longer includes scan-results appeal guidance, while the artifact-level email still includes local scan guidance.
-- Captured the dedicated banned-account appeal page from a running local ClawHub preview after `/dashboard?error_description=Account%20banned` redirected to `/account-banned`.

clawhub-ui-proof/pr-2520/appeals-flow-account-banned-3b4cc2d9/summary.json

@@ -1,32 +0,0 @@
-{
-  "generatedAt": "2026-06-05T23:54:26.000Z",
-  "mode": "feature",
-  "status": "pass",
-  "provider": "rendered email builder plus live in-app browser preview",
-  "scenario": "account-ban email without scan-results block plus dedicated banned-account route",
-  "candidate": "worktree 3b4cc2d9",
-  "outputDir": ".artifacts/pr-2520-proof",
-  "lanes": [
-    {
-      "name": "candidate",
-      "ref": "worktree 3b4cc2d9",
-      "status": "pass",
-      "steps": [
-        {
-          "lane": "candidate",
-          "name": "Rendered moderation emails",
-          "slug": "rendered-emails",
-          "status": "pass",
-          "screenshot": "screenshots/rendered-emails.png"
-        },
-        {
-          "lane": "candidate",
-          "name": "Dedicated banned-account appeal page",
-          "slug": "banned-sign-in",
-          "status": "pass",
-          "screenshot": "screenshots/banned-sign-in.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2520/appeals-flow-proof-03bc802e/report.md

@@ -1,6 +0,0 @@
-# PR #2520 proof
-
-Status: pass
-
-- Rendered the account-ban and artifact-level scanner rejection emails from the real email builders.
-- Captured the banned-account sign-in copy from a full-stack local ClawHub preview with local Convex on `/dashboard?error_description=Account%20banned`.

clawhub-ui-proof/pr-2520/appeals-flow-proof-03bc802e/summary.json

@@ -1,32 +0,0 @@
-{
-  "generatedAt": "2026-06-05T23:09:45.000Z",
-  "mode": "feature",
-  "status": "pass",
-  "provider": "rendered email builder plus full-stack local-auth Playwright",
-  "scenario": "email builder rendering plus live ClawHub dashboard auth-error route",
-  "candidate": "worktree 03bc802e",
-  "outputDir": ".artifacts/pr-2520-proof",
-  "lanes": [
-    {
-      "name": "candidate",
-      "ref": "worktree 03bc802e",
-      "status": "pass",
-      "steps": [
-        {
-          "lane": "candidate",
-          "name": "Rendered moderation emails",
-          "slug": "rendered-emails",
-          "status": "pass",
-          "screenshot": "screenshots/rendered-emails.png"
-        },
-        {
-          "lane": "candidate",
-          "name": "Live banned-account dashboard sign-in copy",
-          "slug": "banned-sign-in",
-          "status": "pass",
-          "screenshot": "screenshots/banned-sign-in.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2520/appeals-flow-proof-live-auth-03bc802e/report.md

@@ -1,6 +0,0 @@
-# PR #2520 proof
-
-Status: pass
-
-- Rendered the account-ban and artifact-level scanner rejection emails from the real email builders.
-- Captured the banned-account sign-in copy from a full-stack local ClawHub preview with local Convex on `/dashboard?error_description=Account%20banned`.

clawhub-ui-proof/pr-2520/appeals-flow-proof-live-auth-03bc802e/summary.json

@@ -1,32 +0,0 @@
-{
-  "generatedAt": "2026-06-05T23:09:45.000Z",
-  "mode": "feature",
-  "status": "pass",
-  "provider": "rendered email builder plus full-stack local-auth Playwright",
-  "scenario": "email builder rendering plus live ClawHub dashboard auth-error route",
-  "candidate": "worktree 03bc802e",
-  "outputDir": ".artifacts/pr-2520-proof",
-  "lanes": [
-    {
-      "name": "candidate",
-      "ref": "worktree 03bc802e",
-      "status": "pass",
-      "steps": [
-        {
-          "lane": "candidate",
-          "name": "Rendered moderation emails",
-          "slug": "rendered-emails",
-          "status": "pass",
-          "screenshot": "screenshots/rendered-emails.png"
-        },
-        {
-          "lane": "candidate",
-          "name": "Live banned-account dashboard sign-in copy",
-          "slug": "banned-sign-in",
-          "status": "pass",
-          "screenshot": "screenshots/banned-sign-in.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2520/live-local-scan-download-03bcca63/report.md

@@ -1,13 +0,0 @@
-# PR 2520 live local proof
-
-Status: pass
-
-Captured from a live local ClawHub dev server started with `bun run dev` at `http://localhost:3000`.
-
-Screenshots cover:
-
-- dedicated account-banned page at desktop and mobile widths
-- moderation email output generated from `convex/lib/emails.ts` and served through the same local ClawHub dev server
-- account-ban email appeal-only copy
-- skill rejection email with `clawhub scan download demo-skill --version 1.2.3`
-- plugin rejection email with `clawhub scan download @scope/demo --version 2.0.0 --kind plugin`

clawhub-ui-proof/pr-2520/live-local-scan-download-03bcca63/summary.json

@@ -1,46 +0,0 @@
-{
-  "status": "pass",
-  "mode": "feature",
-  "provider": "local ClawHub dev server",
-  "localServer": "bun run dev -> http://localhost:3000",
-  "commit": "03bcca63",
-  "generatedAt": "2026-06-06T00:39:17.133Z",
-  "screenshots": [
-    {
-      "slug": "account-banned-desktop",
-      "url": "http://localhost:3000/account-banned",
-      "viewport": {
-        "width": 1440,
-        "height": 980
-      },
-      "screenshot": "candidate/screenshots/account-banned-desktop.png"
-    },
-    {
-      "slug": "account-banned-mobile",
-      "url": "http://localhost:3000/account-banned",
-      "viewport": {
-        "width": 390,
-        "height": 844
-      },
-      "screenshot": "candidate/screenshots/account-banned-mobile.png"
-    },
-    {
-      "slug": "moderation-emails-desktop",
-      "url": "http://localhost:3000/__pr-2520-email-proof.html",
-      "viewport": {
-        "width": 1440,
-        "height": 1200
-      },
-      "screenshot": "candidate/screenshots/moderation-emails-desktop.png"
-    },
-    {
-      "slug": "moderation-emails-mobile",
-      "url": "http://localhost:3000/__pr-2520-email-proof.html",
-      "viewport": {
-        "width": 390,
-        "height": 1200
-      },
-      "screenshot": "candidate/screenshots/moderation-emails-mobile.png"
-    }
-  ]
-}

clawhub-ui-proof/pr-2529/2026-06-05-plugin-list-no-family-badges/report.md

@@ -1,6 +0,0 @@
-# ClawHub UI Proof
-
-- Status: passed
-- Mode: feature
-- Scenario: plugin-list-no-family-badges
-- Proof: plugin list still shows download counts while Code Plugin and Bundle Plugin family badges are absent.

clawhub-ui-proof/pr-2529/2026-06-05-plugin-list-no-family-badges/summary.json

@@ -1,20 +0,0 @@
-{
-  "status": "passed",
-  "mode": "feature",
-  "scenario": "plugin-list-no-family-badges",
-  "provider": "codex-in-app-browser",
-  "candidate": "pe/plugin-download-counts",
-  "lanes": [
-    {
-      "name": "candidate",
-      "steps": [
-        {
-          "name": "Plugin list without family badges",
-          "slug": "plugin-list-no-family-badges",
-          "status": "passed",
-          "screenshot": "plugin-list-no-family-badges.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2533/account-deletion-modal-20260605173739/report.md

@@ -1,6 +0,0 @@
-# ClawHub UI Proof
-
-Status: pass
-
-- Account deletion confirmation renders one row per affected skill/plugin, with icon, name, publisher handle, and type badge.
-- Post-cleanup navigation to the deleted plugin shows `Plugin not found`, confirming the resource was removed by the account deletion flow.

clawhub-ui-proof/pr-2533/account-deletion-modal-20260605173739/summary.json

@@ -1,32 +0,0 @@
-{
-  "status": "pass",
-  "mode": "feature",
-  "scenario": "e2e/local-auth/delete-account-resources.pw.test.ts",
-  "provider": "local-auth Playwright",
-  "baseline": null,
-  "candidate": "pe/account-deletion-hard-delete",
-  "generatedAt": "2026-06-06T00:37:39.268Z",
-  "lanes": [
-    {
-      "name": "candidate",
-      "ref": "pe/account-deletion-hard-delete",
-      "status": "pass",
-      "steps": [
-        {
-          "lane": "candidate",
-          "name": "Account deletion confirmation lists each resource row",
-          "screenshot": "screenshots/account-deletion-confirmation.png",
-          "slug": "account-deletion-confirmation",
-          "status": "pass"
-        },
-        {
-          "lane": "candidate",
-          "name": "Deleted plugin route shows resource removed",
-          "screenshot": "screenshots/account-deletion-post-cleanup.png",
-          "slug": "account-deletion-post-cleanup",
-          "status": "pass"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2548/skill-delete-settings/report.md

@@ -1,10 +0,0 @@
-# Skill Settings Delete Action
-
-Real-browser feature proof for the skill settings delete action.
-
-- Route: local-auth seeded skill settings page
-- Browser: Playwright chromium
-- Candidate: pe/skill-settings-delete-action
-- Screenshots:
-  - `local/delete-action.png`
-  - `local/delete-dialog.png`

clawhub-ui-proof/pr-2548/skill-delete-settings/summary.json

@@ -1,26 +0,0 @@
-{
-  "status": "passed",
-  "mode": "feature",
-  "scenario": "skill-settings-delete-action",
-  "provider": "local-auth Playwright chromium",
-  "candidate": "pe/skill-settings-delete-action",
-  "lanes": [
-    {
-      "name": "local",
-      "steps": [
-        {
-          "name": "Skill settings delete action",
-          "slug": "delete-action",
-          "status": "passed",
-          "screenshot": "delete-action.png"
-        },
-        {
-          "name": "Skill settings delete confirmation dialog",
-          "slug": "delete-dialog",
-          "status": "passed",
-          "screenshot": "delete-dialog.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2581/pr-2581-prod-data-2026-06-15T00-56-51-869Z/report.md

@@ -1,11 +0,0 @@
-# PR 2581 prod-backed UI proof
-
-Status: passed
-Mode: feature
-Backend: production Convex read data (`wry-manatee-359`).
-Pages captured:
-- `/skills?sort=installs&dir=desc` showing prod skill rows and install sort.
-- `/search?q=swarm` showing prod search results.
-- `/chair4ce/swarm` showing a prod-backed skill detail page.
-
-Note: default `/plugins` was not used because this PR head can request `sort=recommended`, which requires matching backend code that is not deployed to prod yet.

clawhub-ui-proof/pr-2581/pr-2581-prod-data-2026-06-15T00-56-51-869Z/summary.json

@@ -1,32 +0,0 @@
-{
-  "status": "passed",
-  "mode": "feature",
-  "scenario": "manual prod-backed PR proof: skills browse, search, and detail",
-  "provider": "local Playwright against http://127.0.0.1:3007 with prod Convex",
-  "candidate": "PR #2581 rebased head f43b8ed3",
-  "lanes": [
-    {
-      "name": "candidate",
-      "steps": [
-        {
-          "name": "Skills browse sorted by installs",
-          "slug": "skills-installs",
-          "status": "passed",
-          "screenshot": "skills-installs.png"
-        },
-        {
-          "name": "Search results for swarm",
-          "slug": "search-swarm",
-          "status": "passed",
-          "screenshot": "search-swarm.png"
-        },
-        {
-          "name": "Skill detail for chair4ce/swarm",
-          "slug": "skill-detail-swarm",
-          "status": "passed",
-          "screenshot": "skill-detail-swarm.png"
-        }
-      ]
-    }
-  ]
-}

clawhub-ui-proof/pr-2597/claw-283-email-proof/report.md

@@ -1,5 +0,0 @@
-# CLAW-283 Email Template Proof
-
-- Rendered updated ClawHub transactional email templates with realistic sample data.
-- Rendered generic admin one-off email with sample title/body/action content.
-- Confirmed Plugin Inspector findings email renders without the removed ClawHub CTA button.