2d2c1e7a72
fix: stabilize CI smoke and local-auth gates ( #2850 )
2026-06-25 11:54:10 +10:00
2deb1b75e9
Harden worker secret logging ( #2784 )
...
* fix: redact scan worker artifact errors
* fix: harden worker secret logging
* fix: keep worker claim failures failing
* fix: scan diagnostics as files
* fix: pin diagnostics scanner image
* fix: narrow worker redaction boundary
* fix: avoid custom worker secret patterns
* fix: centralize worker transport redaction
* fix: redact persisted worker failure secrets
* fix: fail security worker on claim outages
* fix: redact structured diagnostic secret fields
* fix: harden worker failure redaction boundaries
* fix: cover bracketed worker secret values
* test: enforce worker workflow secret references
* fix: redact quoted worker secret values
* fix: redact diagnostic artifact path labels
* test: cover claim failure redaction
* fix: simplify worker redaction boundary
* test: prove worker logger emits structured events
2026-06-25 11:47:39 +10:00
5cbb8bfeb4
fix: redact security dataset public metadata ( #2852 )
2026-06-24 14:08:03 -07:00
f0b37e6ec8
ci: lower security dataset export min page size ( #2848 )
2026-06-24 08:14:28 -07:00
f82709a34e
ci: validate security dataset guardrails structurally ( #2846 )
...
* ci: validate security dataset guardrails structurally
* test: tolerate canonical link nonce in prod smoke
2026-06-24 05:43:43 -07:00
173e28dd84
fix(web): refresh publisher profile detail and catalog UX ( #2818 )
...
* feat(profile): polish publisher detail hero, catalog, and members layout
Refine the publisher profile page with a full-width hero, larger avatar,
Links/Members side-by-side details, chip-based catalog filters, and
segmented Skills/Plugins tabs while extracting profile styles into a
dedicated stylesheet.
* feat(profile): polish catalog grouping, members UI, and chrome layout
Checkpoint before moving publisher stats into the profile header actions slot.
* feat(profile): default catalog tab, plugin links, and visual proof
Open the plugins tab when a publisher has no skills, preserve scoped
plugin detail hrefs on profile rows, and keep catalog pagination active
during search. Includes publisher profile polish follow-ups and UI proof
screenshots for the PR.
* fix(profile): clear lint issues in publisher profile route
* fix(profile): polish avatar/badge details and refresh UI proof
Square org avatars, show icon-only official badge on mobile handles, and
match member placeholder size to photo avatars. Regenerate publisher
profile Playwright screenshots for PR proof.
* test(e2e): assert publisher catalog region on profile smoke
Match the publisher profile catalog landmark after the profile polish
removed the visible "Publisher catalog" heading.
* test(e2e): stabilize org delete profile catalog waits
Wait for the publisher profile heading and catalog region before asserting
seeded skill visibility, matching the async catalog load on the polished
profile page.
* test(e2e): assert publisher catalog skills by slug link
Profile catalog rows truncate display names to 40 chars, so deletion
proofs should wait for the skill detail href instead of the full seed
label text.
* fix(test): add skillSlug to AccountDeletionFixture type
Unblocks types-build after the publisher profile e2e assertion started
reading fixture.skillSlug for the catalog link check.
2026-06-23 23:41:24 -07:00
bbdc14c245
ci: chunk security dataset snapshot export
...
Split the security dataset snapshot workflow into a planning job, bounded export shards, and a final merge/publish job so production exports do not depend on one long-running runner.
2026-06-23 23:11:44 -07:00
898b3bebba
test: stabilize local-auth e2e flake paths
...
Stabilize local-auth e2e tests under CI/Testbox pressure by hardening publish scan enqueue recovery, bounded publish navigation, route/hydration helpers, and local-auth readiness probes.
2026-06-23 16:26:54 -07:00
dfb93eab79
fix: make security dataset export more adaptive
...
Merge PR #2814 after exact-head checks passed.
2026-06-23 15:19:20 -07:00
dfde400fcf
fix(seed): populate public corpus plugin metadata
2026-06-23 13:14:30 -07:00
071c43da43
fix: shrink security dataset export batches
2026-06-23 12:52:50 -07:00
7cc6b22176
feat(web): rename publishers browse to Creators ( #2799 )
...
* feat(web): rename publishers browse to Creators
Align /publishers page heading and filter tabs with clearer creator-focused copy, move Official after All, and show full org labels on desktop only.
* test(e2e): align local-auth flows with owner-qualified routes
Update playwright local-auth helpers and specs for canonical profile, skill, and plugin URLs after the main branch routing migration.
* fix(test): export plugin validation href helper for e2e typecheck
* chore: format local-auth helpers import
* chore: retrigger CI after flaky local-auth shards
* feat(web): move publishers browse to /creators route
Keep /publishers and /users as legacy redirects with search preserved, and align registry copy, tests, and reserved slugs with the new path.
* fix(web): drop unused OpenClaw slug re-export after schema move
* chore: format openClawExtensionSlugs re-export cleanup
2026-06-23 12:24:25 -07:00
2cf2636ab8
chore: remove local staged secret hook
...
Remove the repo-managed local staged-secret hook and scanner now that GitHub secret scanning push protection is the primary secret-blocking control.
2026-06-23 18:08:18 +10:00
e82f0704c8
Publish security dataset from live Convex export ( #2800 )
...
* feat(cli): restore skill sync command
* feat: publish security dataset from live export
2026-06-22 22:40:09 -07:00
6dfe780a29
build: generate llms.txt from canonical metadata ( #2483 )
...
* docs: add llms.txt
* docs: avoid dead llms skill examples
* refactor: centralize public registry routes
* refactor: share canonical ClawHub links
* feat: generate llms.txt from canonical metadata
* build: generate llms.txt for dev and production
* test: follow canonical docs navigation link
2026-06-22 13:04:07 -07:00
39d03a577f
Fix filtered plugin catalog pagination ( #2771 )
...
* fix: resume filtered plugin package pagination
* test: wait for copied publish dialog state
* ci: retry local convex module prep
* test: stabilize banned account local auth flow
2026-06-22 17:07:30 +10:00
503a2bf022
fix(ci): reduce ClawHub worker fanout ( #2770 )
2026-06-22 12:41:56 +08:00
4ccc9a1c62
chore: use worktreeinclude for local state setup ( #2709 )
2026-06-17 12:54:47 -07:00
1e7de4a2a2
fix: remove retired capability metadata surfaces
...
Remove retired capabilities/capabilityTags/executesCode surfaces for skills and plugins, add guarded cleanup tooling for legacy rows, and sanitize pre-cleanup legacy seed/release payloads.
2026-06-16 17:03:44 -07:00
5471fb280f
fix: seed worktree dev previews locally ( #2693 )
2026-06-16 12:53:59 -07:00
303075c82b
Remove retired moderation surfaces ( #2658 )
...
* chore: remove retired moderation surfaces
* test: cover retired moderation action wrappers
* chore: retain moderation security gates
* test: cover retired moderation compatibility paths
* fix: stop settings queries during account deletion
* docs: add retired comment purge command
* chore: delete retired scanner tombstones
2026-06-16 08:01:11 -07:00
e8a75de2b1
refactor: remove root install telemetry ( #2673 )
...
* refactor: remove root install telemetry
* chore: add root telemetry cleanup job
* fix: preserve legacy root telemetry deletion
* fix: handle token list after account deletion
* test: isolate local-auth e2e from production crons
2026-06-15 19:42:51 -07:00
76638de7ad
feat: run full ClawScan for GitHub skills
...
Adds full ClawScan execution for GitHub-backed skills and updates the static audit ignore list for newly reported DOMPurify advisories.
2026-06-15 17:36:41 -07:00
03f97349b0
fix: preserve legacy package ZIP hashes ( #2636 )
...
* test: fix indexed row helper lint
* fix: preserve legacy package zip hashes
2026-06-14 18:56:31 -07:00
fdb4d312f4
docs: restore OpenClaw-hosted ClawHub docs ( #2631 )
...
* Revert "fix: serve docs subdomain root (#2630 )"
This reverts commit 9ef33726b86afb91b772#2609 )"
This reverts commit 71156751ff
2026-06-14 16:05:34 -07:00
9ef33726b8
fix: serve docs subdomain root ( #2630 )
2026-06-14 13:28:45 -07:00
6afb91b772
feat: move docs to canonical subdomain
2026-06-13 15:38:43 -07:00
64e22ae06e
fix: harden clawhub cli release and sync checks
2026-06-13 17:38:03 +08:00
71156751ff
docs: serve ClawHub docs with shared OpenClaw renderer ( #2609 )
...
* feat: serve clawhub docs under docs route
* feat: build ClawHub docs with openclaw docs
* chore: remove unused nav icon export
* docs: use ClawHub logo in docs shell
* docs: prepare ClawHub docs for Mintlify
* test: use static preview readiness for playwright
* chore: ignore current esbuild audit advisories
* docs: build ClawHub docs with shared OpenClaw renderer
* test: print package publish e2e failures
2026-06-12 19:02:44 -07:00
73c32d6296
chore: fix dependabot bun update config ( #2566 )
2026-06-12 16:14:29 -07:00
3b53ddbdbe
chore: rename ClawHub admin package ( #2599 )
2026-06-11 16:49:17 -07:00
79d9a86e6f
ci: dispatch plugin inspector scans on pin bumps ( #2584 )
...
* ci: dispatch plugin inspector bulk scans on pin bump
* ci: rename plugin inspector bulk scan workflow
* fix: include CLI plugin inspector pin in scan dispatch
* chore: remove stale plugin inspector cron comment
* fix: dispatch inspector scans from main pushes
2026-06-09 21:45:29 -07:00
89a89af183
fix: suppress inspector gap findings in clawhub
2026-06-08 21:29:31 -07:00
be70ae5e9f
Publish public Plugin Inspector findings ( #2525 )
...
* feat: gate plugin publishes with inspector warnings
* fix: harden plugin publish inspector gate
* feat: publish public plugin inspector findings
* fix: refine plugin inspector publish errors
* feat: add package validation command
* fix: refine plugin validation findings UI
* fix: scan only latest plugin releases nightly
* feat: add dry run for nightly plugin inspection
* test: fix plugin validation tab e2e matcher
2026-06-08 19:41:48 -07:00
8e1bad4ac1
feat: improve account appeal notifications ( #2520 )
...
* feat: improve account appeal notifications
Adds Resend-backed account-action emails for bans/restores, public-safe ban reason summaries, scanner-triggered appeal scan guidance, and inline banned-account sign-in appeal messaging.
Autoreview findings addressed:
- [P2] Wire restored-account email into unban flow
- [P2] Add the scan upload test to the CI selection
* feat: quarantine malicious artifact uploads
* fix: warn on repeated malicious rejections
* fix: route banned sign-ins to appeal page
* feat: add stored scan report downloads
* chore: bump clawhub cli to 0.20.0
* test: cover malicious skill ban journey
* test: align deletion cleanup expectations after merge
* fix: hide deleted account packages before cleanup
* fix: finalize appeals moderation flow
2026-06-06 16:55:23 -07:00
571cc70c7a
test: limit local-auth playwright retries ( #2538 )
2026-06-06 14:58:18 -07:00
c632b697bb
fix: hide banned user publisher profiles ( #2528 )
...
* fix: hide banned user publisher profiles
* docs: require real ClawHub screenshot proof
* test: stabilize local auth profile visibility checks
2026-06-05 17:33:03 -07:00
94ded18dec
feat: add org deletion cascade
...
Closes #2516 .
2026-06-05 14:52:31 -07:00
4b882b2f43
build(deps): bump the production-minor-and-patch group across 1 directory with 12 updates ( #2510 )
...
* build(deps): bump the production-minor-and-patch group across 1 directory with 12 updates
Bumps the production-minor-and-patch group with 12 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [@convex-dev/auth](https://github.com/get-convex/convex-auth ) | `0.0.92` | `0.0.93` |
| [@shikijs/rehype](https://github.com/shikijs/shiki/tree/HEAD/packages/rehype ) | `4.1.0` | `4.2.0` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router ) | `1.170.8` | `1.170.12` |
| [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start ) | `1.168.13` | `1.168.21` |
| [convex](https://github.com/get-convex/convex-backend/tree/HEAD/npm-packages/convex ) | `1.39.1` | `1.40.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react ) | `1.16.0` | `1.17.0` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react ) | `19.2.6` | `19.2.7` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom ) | `19.2.6` | `19.2.7` |
| [semver](https://github.com/npm/node-semver ) | `7.8.1` | `7.8.2` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki ) | `4.1.0` | `4.2.0` |
| [undici](https://github.com/nodejs/undici ) | `7.26.0` | `7.27.1` |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts ) | `1.4.0` | `1.5.1` |
Updates `@convex-dev/auth` from 0.0.92 to 0.0.93
- [Changelog](https://github.com/get-convex/convex-auth/blob/main/CHANGELOG.md )
- [Commits](https://github.com/get-convex/convex-auth/compare/v0.0.92...v0.0.93 )
Updates `@shikijs/rehype` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/shikijs/shiki/releases )
- [Commits](https://github.com/shikijs/shiki/commits/v4.2.0/packages/rehype )
Updates `@tanstack/react-router` from 1.170.8 to 1.170.12
- [Release notes](https://github.com/TanStack/router/releases )
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md )
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.12/packages/react-router )
Updates `@tanstack/react-start` from 1.168.13 to 1.168.21
- [Release notes](https://github.com/TanStack/router/releases )
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md )
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.168.21/packages/react-start )
Updates `convex` from 1.39.1 to 1.40.0
- [Release notes](https://github.com/get-convex/convex-backend/releases )
- [Changelog](https://github.com/get-convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md )
- [Commits](https://github.com/get-convex/convex-backend/commits/HEAD/npm-packages/convex )
Updates `lucide-react` from 1.16.0 to 1.17.0
- [Release notes](https://github.com/lucide-icons/lucide/releases )
- [Commits](https://github.com/lucide-icons/lucide/commits/1.17.0/packages/lucide-react )
Updates `react` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases )
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md )
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react )
Updates `react-dom` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases )
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md )
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom )
Updates `semver` from 7.8.1 to 7.8.2
- [Release notes](https://github.com/npm/node-semver/releases )
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md )
- [Commits](https://github.com/npm/node-semver/compare/v7.8.1...v7.8.2 )
Updates `shiki` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/shikijs/shiki/releases )
- [Commits](https://github.com/shikijs/shiki/commits/v4.2.0/packages/shiki )
Updates `undici` from 7.26.0 to 7.27.1
- [Release notes](https://github.com/nodejs/undici/releases )
- [Commits](https://github.com/nodejs/undici/compare/v7.26.0...v7.27.1 )
Updates `@clack/prompts` from 1.4.0 to 1.5.1
- [Release notes](https://github.com/bombshell-dev/clack/releases )
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md )
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.5.1/packages/prompts )
---
updated-dependencies:
- dependency-name: "@clack/prompts"
dependency-version: 1.5.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-minor-and-patch
- dependency-name: "@convex-dev/auth"
dependency-version: 0.0.93
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-minor-and-patch
- dependency-name: "@shikijs/rehype"
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-minor-and-patch
- dependency-name: "@tanstack/react-router"
dependency-version: 1.170.11
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-minor-and-patch
- dependency-name: "@tanstack/react-start"
dependency-version: 1.168.20
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-minor-and-patch
- dependency-name: convex
dependency-version: 1.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-minor-and-patch
- dependency-name: lucide-react
dependency-version: 1.17.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-minor-and-patch
- dependency-name: react
dependency-version: 19.2.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-minor-and-patch
- dependency-name: react-dom
dependency-version: 19.2.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-minor-and-patch
- dependency-name: semver
dependency-version: 7.8.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-minor-and-patch
- dependency-name: shiki
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-minor-and-patch
- dependency-name: undici
dependency-version: 7.27.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
* ci: update convex local auth runner
* ci: keep local auth deployment marker prefixed
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-06-05 13:50:43 -07:00
e8cfbddf17
feat: add clawhub scan command ( #2479 )
...
* docs: design clawhub scan command
* docs: plan clawhub scan command
* feat: add clawhub scan command
* fix: prune ephemeral scan uploads
* fix: avoid scan route slug collision
2026-06-03 16:05:11 -07:00
74aa61086e
fix: gate local Codex workers ( #2472 )
2026-06-03 12:26:20 -07:00
858a121d33
fix(plugins): rewrite relative README image URLs to source-host raw URLs ( #2412 )
...
Merged via squash.
Prepared head SHA: 545db16f0135096042+momothemage@users.noreply.github.com >
Co-authored-by: momothemage <35096042+momothemage@users.noreply.github.com >
Reviewed-by: @momothemage
2026-06-03 17:05:58 +08:00
9aa3f37ee1
feat: export skill bundle content for security datasets ( #2448 )
2026-05-30 12:11:19 -05:00
51967bca7f
feat: export skillspector issue details ( #2430 )
2026-05-28 10:32:28 -05:00
0132f1f530
fix: preserve Codex diagnostic messages ( #2429 )
...
* fix: remove global ClawScan claim ceiling
* fix: preserve codex diagnostic messages
2026-05-28 08:46:13 -05:00
05f27f640e
feat: export skillspector dataset signals ( #2424 )
2026-05-28 08:40:54 -05:00
a920323a86
ci: fan out skill card worker ( #2419 )
2026-05-27 14:50:18 -05:00
b8eaada68d
fix: frame skillspector findings as advisory ( #2418 )
2026-05-27 14:29:38 -05:00
a66df774f2
feat: make UI proof full-stack by default ( #2210 )
...
* feat: add full-stack UI proof backend
* docs: prefer here.now links for issue screenshots
2026-05-27 12:33:09 -05:00
b62d8ca813
feat: generate nvidia-style skill cards ( #2382 )
...
* feat: generate nvidia-style skill cards
* fix: harden skill card verification
* fix: use version-specific skill card evidence
* fix: close skill card verification gaps
* fix: refresh stale skill cards
* fix: protect skill card provenance fingerprints
* fix: close skill card review gaps
* fix: harden skill card trust boundaries
* fix: isolate skill card renderer
* fix: harden skill card workflows
2026-05-25 16:53:25 -07:00
Jesse Merhi