Gio Della-Libera 85a3fde608 feat(claws): add gated publication and profile validation (#3090) ...

Gate Claw publication before storage access or mutation, validate bounded exact package/profile bytes and archive hierarchy, implement the managed CLAW.md body envelope, and prevent disabled-family list/search starvation.

Validated at exact head a9f1bb419f with all repository CI, CodeQL, secret scanning, focused tests, real local Convex schema/function validation, and clean final autoreview.

Co-authored-by: Gio Della-Libera <giodl73@gmail.com>

2026-07-24 18:14:12 -05:00

..

_generated

feat(claws): add gated publication and profile validation (#3090)

2026-07-24 18:14:12 -05:00

fixtures

feat: add controlled skills.sh scanned installs (#3221)

2026-07-22 02:00:19 -07:00

httpApiV1

feat(claws): add gated publication and profile validation (#3090)

2026-07-24 18:14:12 -05:00

lib

feat(claws): add gated publication and profile validation (#3090)

2026-07-24 18:14:12 -05:00

agentSkillsHttp.test.ts

feat: support npx skills discovery (#3233)

2026-07-22 22:37:34 -07:00

agentSkillsHttp.ts

feat: support npx skills discovery (#3233)

2026-07-22 22:37:34 -07:00

appMeta.ts

docs: update repository guidelines and improve formatting across multiple files

2026-03-18 21:56:01 -05:00

auth.callbacks.test.ts

fix: route banned users to account page (#2785)

2026-06-22 18:07:27 -07:00

auth.config.ts

docs: update repository guidelines and improve formatting across multiple files

2026-03-18 21:56:01 -05:00

auth.test.ts

feat: verify organization GitHub profiles (#3169)

2026-07-17 18:02:30 -07:00

auth.ts

feat: verify organization GitHub profiles (#3169)

2026-07-17 18:02:30 -07:00

catalogClassification.test.ts

feat: add catalog classification backfill (#2719)

2026-06-17 17:58:26 -07:00

catalogClassification.ts

chore: remove catalog classification rollout migrations (#2735)

2026-06-18 15:52:46 -07:00

catalogClassificationNode.ts

feat: add catalog classification backfill (#2719)

2026-06-17 17:58:26 -07:00

catalogFeed.test.ts

feat: order featured catalog by recency (#3168)

2026-07-17 17:46:50 -07:00

catalogFeed.ts

feat: order featured catalog by recency (#3168)

2026-07-17 17:46:50 -07:00

catalogMetadataSettings.test.ts

fix: make catalog metadata publisher-owned (#2757)

2026-06-19 17:14:03 -07:00

catalogTopics.test.ts

fix(web): polish browse listing pages (#2767)

2026-06-22 13:11:51 -07:00

catalogTopics.ts

fix(web): polish browse listing pages (#2767)

2026-06-22 13:11:51 -07:00

cliDeviceAuth.test.ts

fix: surface CLI device code errors (#3166)

2026-07-17 15:46:45 -07:00

cliDeviceAuth.ts

fix: surface CLI device code errors (#3166)

2026-07-17 15:46:45 -07:00

convex.config.ts

fix: harden API rate limits (#2783)

2026-06-25 16:22:00 +10:00

crons.test.ts

feat(observability): log prepublication queue health (#3192)

2026-07-20 12:22:56 -07:00

crons.ts

feat(observability): log prepublication queue health (#3192)

2026-07-20 12:22:56 -07:00

dashboard.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

depRegistryScan.test.ts

fix: retire dependency registry scans

2026-06-09 22:28:13 +10:00

depRegistryScan.ts

fix: retire dependency registry scans

2026-06-09 22:28:13 +10:00

devSeed.localFixtures.test.ts

feat: make Featured the default ClawHub catalog (#3096)

2026-07-15 21:55:18 -07:00

devSeed.ts

feat: make owner version deletion reversible (#3199)

2026-07-20 21:18:35 -07:00

devSeedExtra.ts

feat: Add support for Chinese Japanese and Korean(CJK) skills search (#1596)

2026-04-10 12:20:40 +08:00

downloadMetrics.test.ts

fix: harden API rate limits (#2783)

2026-06-25 16:22:00 +10:00

downloadMetrics.ts

feat: enforce Convex retention policy

2026-06-18 17:30:48 -07:00

downloads.test.ts

feat: add skill version revocation (#3049)

2026-07-09 21:36:21 -07:00

downloads.ts

feat: support npx skills discovery (#3233)

2026-07-22 22:37:34 -07:00

emailsNode.test.ts

Warn before publisher abuse autobans

2026-06-26 15:29:20 +10:00

emailsNode.ts

feat: stage publishes behind prepublication checks (#2979)

2026-07-06 15:54:04 -05:00

functions.test.ts

feat: add controlled catalog taxonomy and topics (#2699)

2026-06-17 18:20:54 -06:00

functions.ts

feat: add permanent Test ranking metrics import (#3259)

2026-07-24 16:00:27 -05:00

githubAccountAgeBackfill.ts

fix: use GitHub App auth for GitHub account lookups

2026-06-03 00:24:23 -07:00

githubIdentity.ts

docs: update repository guidelines and improve formatting across multiple files

2026-03-18 21:56:01 -05:00

githubImport.test.ts

fix: publish complete skill artifacts (#3196)

2026-07-20 15:54:47 -07:00

githubImport.ts

fix: publish complete skill artifacts (#3196)

2026-07-20 15:54:47 -07:00

githubOrgMemberships.ts

feat: verify organization GitHub profiles (#3169)

2026-07-17 18:02:30 -07:00

githubSkillSources.test.ts

feat: generalize GitHub Skill Sync engine (#3249)

2026-07-23 15:50:49 -07:00

githubSkillSources.ts

feat: generalize GitHub Skill Sync engine (#3249)

2026-07-23 15:50:49 -07:00

githubSkillSync.live.test.ts

fix: restore rollout automation checks (#3253)

2026-07-24 15:39:16 -05:00

githubSkillSync.test.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

githubSkillSync.ts

feat: generalize GitHub Skill Sync engine (#3249)

2026-07-23 15:50:49 -07:00

githubSkillSyncNode.ts

feat: run full ClawScan for GitHub skills

2026-06-15 17:36:41 -07:00

http.test.ts

fix(api): decouple rate-limit metadata writes (#3063)

2026-07-12 15:40:54 +02:00

http.ts

feat: support npx skills discovery (#3233)

2026-07-22 22:37:34 -07:00

httpApi.handlers.test.ts

feat: count successful OpenClaw plugin installs (#3242)

2026-07-23 12:12:58 -07:00

httpApi.test.ts

docs: update repository guidelines and improve formatting across multiple files

2026-03-18 21:56:01 -05:00

httpApi.ts

feat: count successful OpenClaw plugin installs (#3242)

2026-07-23 12:12:58 -07:00

httpApiV1.ambiguousSkillSlug.test.ts

fix: harden API rate limits (#2783)

2026-06-25 16:22:00 +10:00

httpApiV1.catalogFeed.test.ts

feat(catalog): publish verified organization skills feed

2026-06-23 17:04:26 +08:00

httpApiV1.handlers.test.ts

feat(claws): add gated publication and profile validation (#3090)

2026-07-24 18:14:12 -05:00

httpApiV1.promotions.test.ts

feat: promotions — runtime-fetchable promotional offers (#2961)

2026-07-06 10:02:52 -07:00

httpApiV1.shared.test.ts

feat: remove the souls feature end to end

2026-06-11 10:45:58 -07:00

httpApiV1.ts

feat: add controlled skills.sh scanned installs (#3221)

2026-07-22 02:00:19 -07:00

httpPreflight.ts

docs: update repository guidelines and improve formatting across multiple files

2026-03-18 21:56:01 -05:00

leaderboards.test.ts

test(convex): update leaderboard page size expectation

2026-05-02 23:45:27 -07:00

leaderboards.ts

fix(convex): reduce hot rate-limit and catalog reads

2026-05-02 23:42:15 -07:00

maintenance.test.ts

fix: repair both sides of skill lineage cycles (#3248)

2026-07-23 15:01:02 -07:00

maintenance.ts

fix: repair both sides of skill lineage cycles (#3248)

2026-07-23 15:01:02 -07:00

managementDevSeed.test.ts

feat: add publisher abuse review dashboard (#2471)

2026-06-05 09:05:50 +10:00

managementDevSeed.ts

feat: add publisher abuse review dashboard (#2471)

2026-06-05 09:05:50 +10:00

migrations.publishAttempts.test.ts

fix: match exact recovery verdict markers

2026-07-07 10:58:51 -05:00

migrations.test.ts

fix: backfill NVIDIA GitHub skill downloads

2026-06-23 16:45:54 -07:00

migrations.ts

revert: remove Test prepublication repair (#3101)

2026-07-15 22:42:56 -07:00

openclaw-plugin-inspector.d.ts

Publish public Plugin Inspector findings (#2525)

2026-06-08 19:41:48 -07:00

packageInspectorHttp.test.ts

Publish public Plugin Inspector findings (#2525)

2026-06-08 19:41:48 -07:00

packageInspectorHttp.ts

Publish public Plugin Inspector findings (#2525)

2026-06-08 19:41:48 -07:00

packageInspectorNode.test.ts

chore: bump plugin inspector session sdk checks (#2932)

2026-06-29 19:11:41 -07:00

packageInspectorNode.ts

chore: bump plugin inspector session sdk checks (#2932)

2026-06-29 19:11:41 -07:00

packageLeaderboards.test.ts

feat(search): add freshness-aware discovery ranking

2026-06-25 15:11:24 +08:00

packageLeaderboards.ts

feat: make Featured the default ClawHub catalog (#3096)

2026-07-15 21:55:18 -07:00

packagePublishTokens.ts

fix(convex): reduce download and token write contention

2026-05-03 00:06:59 -07:00

packages.countPublicPlugins.test.ts

Show unfiltered browse totals

2026-06-12 19:04:57 +10:00

packages.public.test.ts

feat(claws): add gated publication and profile validation (#3090)

2026-07-24 18:14:12 -05:00

packages.stats.test.ts

feat: count successful OpenClaw plugin installs (#3242)

2026-07-23 12:12:58 -07:00

packages.ts

feat(claws): add gated publication and profile validation (#3090)

2026-07-24 18:14:12 -05:00

prepublicationObservability.test.ts

feat(observability): log prepublication queue health (#3192)

2026-07-20 12:22:56 -07:00

prepublicationObservability.ts

feat(observability): log prepublication queue health (#3192)

2026-07-20 12:22:56 -07:00

promotions.test.ts

feat: promotions — runtime-fetchable promotional offers (#2961)

2026-07-06 10:02:52 -07:00

promotions.ts

feat: promotions — runtime-fetchable promotional offers (#2961)

2026-07-06 10:02:52 -07:00

promotionsFeed.test.ts

feat: promotions — runtime-fetchable promotional offers (#2961)

2026-07-06 10:02:52 -07:00

promotionsFeed.ts

feat: promotions — runtime-fetchable promotional offers (#2961)

2026-07-06 10:02:52 -07:00

publishAttempts.runtime.test.ts

fix: terminalize orphaned publish attempts (#3224)

2026-07-22 12:34:05 -07:00

publishAttempts.test.ts

fix: terminalize orphaned publish attempts (#3224)

2026-07-22 12:34:05 -07:00

publishAttempts.ts

fix: terminalize orphaned publish attempts (#3224)

2026-07-22 12:34:05 -07:00

publisherAbuse.test.ts

feat: add 30-day activity trends to abuse signal drawer (#3216)

2026-07-22 14:49:52 +10:00

publisherAbuse.ts

feat: add 30-day activity trends to abuse signal drawer (#3216)

2026-07-22 14:49:52 +10:00

publisherAbuseDevSeed.test.ts

feat: add 30-day activity trends to abuse signal drawer (#3216)

2026-07-22 14:49:52 +10:00

publisherAbuseDevSeed.ts

feat: add 30-day activity trends to abuse signal drawer (#3216)

2026-07-22 14:49:52 +10:00

publisherAbuseTemporalScan.test.ts

fix: require six times P99 for sustained signals (#3204)

2026-07-22 00:14:12 +10:00

publisherAbuseTemporalScan.ts

fix: alert when signal scans stop retrying (#3202)

2026-07-21 13:58:09 +10:00

publishers.test.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

publishers.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

rateLimits.test.ts

fix(api): decouple rate-limit metadata writes (#3063)

2026-07-12 15:40:54 +02:00

rateLimits.ts

fix(api): decouple rate-limit metadata writes (#3063)

2026-07-12 15:40:54 +02:00

retention.test.ts

fix: require org member acceptance (#2885)

2026-06-26 18:26:50 +10:00

retention.ts

fix: require org member acceptance (#2885)

2026-06-26 18:26:50 +10:00

rolloutCapabilities.test.ts

feat: keep external skill rollouts production-dark (#3236)

2026-07-23 08:36:41 -07:00

rolloutCapabilities.ts

feat: keep external skill rollouts production-dark (#3236)

2026-07-23 08:36:41 -07:00

schema.ts

feat(claws): add gated publication and profile validation (#3090)

2026-07-24 18:14:12 -05:00

search.test.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

search.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

securityDataset.test.ts

fix: export latest security dataset skills only

2026-06-26 16:24:07 -07:00

securityDataset.ts

fix: export latest security dataset skills only

2026-06-26 16:24:07 -07:00

securityDatasetNode.test.ts

Publish security dataset from live Convex export (#2800)

2026-06-22 22:40:09 -07:00

securityDatasetNode.ts

Publish security dataset from live Convex export (#2800)

2026-06-22 22:40:09 -07:00

securityScan.test.ts

feat: generalize GitHub Skill Sync engine (#3249)

2026-07-23 15:50:49 -07:00

securityScan.ts

feat: generalize GitHub Skill Sync engine (#3249)

2026-07-23 15:50:49 -07:00

securityScanDispatch.test.ts

feat: add continuously refilled security scan workers (#3039)

2026-07-09 13:43:47 -07:00

securityScanDispatch.ts

feat: add continuously refilled security scan workers (#3039)

2026-07-09 13:43:47 -07:00

skillCards.test.ts

Harden worker secret logging (#2784)

2026-06-25 11:47:39 +10:00

skillCards.ts

Harden worker secret logging (#2784)

2026-06-25 11:47:39 +10:00

skills.backportLatest.test.ts

fix: cache approved public skill versions (#3041)

2026-07-09 14:24:03 -07:00

skills.banBatches.test.ts

feat: add skill version revocation (#3049)

2026-07-09 21:36:21 -07:00

skills.countPublicSkills.test.ts

fix(stats): avoid scan fallback for public skill count

2026-04-29 23:29:17 -07:00

skills.dashboard.test.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

skills.deleteTags.test.ts

test: cover skill summary digest sync (#2638)

2026-06-14 19:26:28 -07:00

skills.exportList.test.ts

feat: add github-backed skill handoffs to downloads and export

2026-06-23 17:08:46 -07:00

skills.hardDeleteAdmin.test.ts

feat: add audited admin skill hard delete (#3167)

2026-07-17 17:33:50 -07:00

skills.list.test.ts

feat: seed local rescan fixtures

2026-04-27 13:53:14 -07:00

skills.listPublicPage.test.ts

docs: update repository guidelines and improve formatting across multiple files

2026-03-18 21:56:01 -05:00

skills.listPublicPageV2.test.ts

docs: update repository guidelines and improve formatting across multiple files

2026-03-18 21:56:01 -05:00

skills.listPublicPageV4.test.ts

feat: order featured catalog by recency (#3168)

2026-07-17 17:46:50 -07:00

skills.manualOverrides.test.ts

fix: remove virustotal code insight scans (#2311)

2026-05-18 22:22:42 -07:00

skills.moderationHold.test.ts

fix(moderation): restore from current scan verdict (#3129)

2026-07-16 19:14:03 -07:00

skills.ownerMigration.test.ts

fix: allow transfers to replace owned redirects (#3189)

2026-07-20 16:57:21 -07:00

skills.ownership.test.ts

fix: prevent and repair skill lineage cycles (#3246)

2026-07-23 13:39:39 -07:00

skills.packageCatalog.test.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

skills.pendingScanQueue.test.ts

fix: repair pending vt skill versions (#2442)

2026-05-29 16:10:36 -05:00

skills.public.test.ts

fix: publish complete skill artifacts (#3196)

2026-07-20 15:54:47 -07:00

skills.publicListCursor.test.ts

fix: cache approved public skill versions (#3041)

2026-07-09 14:24:03 -07:00

skills.publicModeration.test.ts

feat: scope skill slugs by owner (#2299)

2026-06-17 15:31:40 -07:00

skills.rateLimit.test.ts

fix: raise new skill publish rate limit (#3030)

2026-07-08 22:21:47 -07:00

skills.reclaim.test.ts

feat: scope skill slugs by owner (#2299)

2026-06-17 15:31:40 -07:00

skills.resolve.test.ts

Add skill and plugin download activity graphs

2026-06-22 11:59:30 +10:00

skills.slugAvailability.test.ts

feat: scope skill slugs by owner (#2299)

2026-06-17 15:31:40 -07:00

skills.staffAuditLogs.test.ts

feat: scope skill slugs by owner (#2299)

2026-06-17 15:31:40 -07:00

skills.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

skills.undeleteGate.test.ts

feat: scope skill slugs by owner (#2299)

2026-06-17 15:31:40 -07:00

skills.versions.public.test.ts

feat: make owner version deletion reversible (#3199)

2026-07-20 21:18:35 -07:00

skillsShCatalog.test.ts

feat: keep external skill rollouts production-dark (#3236)

2026-07-23 08:36:41 -07:00

skillsShCatalog.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

skillsShCatalogCanary.test.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

skillsShMirror.test.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

skillsShMirror.ts

feat: add permanent skills.sh mirror storage (#3227)

2026-07-24 14:32:00 -05:00

skillStatEvents.test.ts

fix(convex): release skill stat doc sync leases on failure

2026-07-01 15:16:44 -07:00

skillStatEvents.ts

fix(convex): release skill stat doc sync leases on failure

2026-07-01 15:16:44 -07:00

skillTransfers.test.ts

fix: block direct skill transfers under moderation (#2282)

2026-05-27 12:01:51 -07:00

skillTransfers.ts

fix: block direct skill transfers under moderation (#2282)

2026-05-27 12:01:51 -07:00

skillVersionRevocation.test.ts

feat: add skill version revocation (#3049)

2026-07-09 21:36:21 -07:00

stars.test.ts

Add skill and plugin download activity graphs

2026-06-22 11:59:30 +10:00

stars.ts

Fix synchronous skill star counts (#2301)

2026-05-18 17:11:23 -07:00

statsMaintenance.test.ts

Remove retired moderation surfaces (#2658)

2026-06-16 08:01:11 -07:00

statsMaintenance.ts

feat(search): add freshness-aware discovery ranking

2026-06-25 15:11:24 +08:00

telemetry.test.ts

feat: count successful OpenClaw plugin installs (#3242)

2026-07-23 12:12:58 -07:00

telemetry.ts

feat: count successful OpenClaw plugin installs (#3242)

2026-07-23 12:12:58 -07:00

tokens.listMine.test.ts

refactor: remove root install telemetry (#2673)

2026-06-15 19:42:51 -07:00

tokens.touch.test.ts

fix(convex): reduce download and token write contention

2026-05-03 00:06:59 -07:00

tokens.ts

refactor: remove root install telemetry (#2673)

2026-06-15 19:42:51 -07:00

tsconfig.json

fix(convex): page owner-publisher digest syncs

2026-04-30 03:32:43 -07:00

uploads.test.ts

fix: require multipart package publishes

2026-06-02 09:59:53 +10:00

uploads.ts

fix: require multipart package publishes

2026-06-02 09:59:53 +10:00

users.test.ts

feat: verify organization GitHub profiles (#3169)

2026-07-17 18:02:30 -07:00

users.ts

feat: verify organization GitHub profiles (#3169)

2026-07-17 18:02:30 -07:00

versionDeletion.test.ts

feat: make owner version deletion reversible (#3199)

2026-07-20 21:18:35 -07:00

versionFileAccess.test.ts

fix: publish complete skill artifacts (#3196)

2026-07-20 15:54:47 -07:00

vt.test.ts

fix: preserve legacy package ZIP hashes (#2636)

2026-06-14 18:56:31 -07:00

vt.ts

fix: serialize skill stat event drain

2026-06-15 17:48:58 -07:00

webhooks.ts

docs: update repository guidelines and improve formatting across multiple files

2026-03-18 21:56:01 -05:00