mirror of https://github.com/openclaw/clawhub.git synced 2026-08-14 08:52:21 +00:00

Files

T

Patrick Erichsen 8c86d6f570 Fix plugin publish ownership visibility (#2073 )

* fix: clarify plugin publish ownership state

* test: tolerate publish route migration in prod smoke

* fix: reserve publish route collisions

* fix: preflight package scope owner mismatches in CLI

* fix: keep package scope validation server-side

* docs: explain ClawHub publishing flow

* fix: include publishing docs link in scope errors

* fix: centralize docs links

* fix: build docs links with URL

* fix: shorten package scope docs hint

2026-05-07 19:03:40 -07:00

2.6 KiB

Raw Blame History

summary, read_when

summary

read_when

How ClawHub publishing works for skills, plugins, owners, scopes, releases, and review.

Publishing a skill or plugin

Debugging owner or package scope errors

Adding publish UI, CLI, or backend behavior

Publishing

ClawHub publishing is owner-scoped: every publish targets a publisher, and the server decides whether the signed-in user is allowed to publish there.

Owners

An owner is a ClawHub publisher handle, such as @alice or @openclaw. Personal owners are created for users. Org owners can have multiple members.

When you publish, you either use your personal owner or choose an org owner where you have publisher access.

Skills

Skills are published from a skill folder. The public page is:

https://clawhub.ai/<owner>/<slug>

Example:

https://clawhub.ai/alice/review-helper

The publish request includes the selected owner, slug, version, changelog, and files. The server verifies that the actor can publish as that owner before it creates the release.

Plugins

Plugins use npm-style package names. Scoped package names include the owner in the first part of the name:

@owner/package-name

The scope must match the selected publish owner. If your package is named @openclaw/dronzer, it can only be published as @openclaw. If you publish as @vintageayu, rename the package to @vintageayu/dronzer.

This prevents a package from claiming an org namespace that the publisher does not control.

Release Flow

The UI, CLI, or GitHub workflow gathers package metadata and files.
The publish request is sent to ClawHub with the selected owner.
The server validates owner permissions, package scope, package name, version, file limits, and source metadata.
ClawHub stores the release and starts automated security checks.
New releases are hidden from normal install/download surfaces until review and verification finish.

If validation fails, the release is not created.

FAQ

Why does the package scope need to match the selected owner?

If the package scope and selected owner do not match, ClawHub rejects the publish:

Package scope "@openclaw" must match selected owner "@vintageayu".
Publish as "@openclaw" or rename this package to "@vintageayu/dronzer".

To fix it, either choose the owner named by the package scope, or rename the package so the scope matches the owner you can publish as.

This protects org namespaces. A package named @openclaw/dronzer claims the @openclaw namespace, so only publishers with access to the @openclaw owner can publish it.

2.6 KiB Raw Blame History