Ships the fail-closed skills.sh catalog control plane validated by the bounded 500-row permanent Test gate. No production ingestion, schedule, visibility, or bulk scanning is enabled.
* test: make ClawScan process-tree timeout test deterministic
The timeout test raced its 500ms deadline against the fixture writing
descendant.pid, and treated zombies as live processes via kill(pid, 0).
Under parallel coverage runs it flaked. Now waits for the pid barrier,
drives the timeout with fake timers, and treats zombie state as exited.
* ci: retry transient convex preview provisioning failures
Fresh Convex preview deployments intermittently 404 on get_config_hashes
while provisioning, failing the whole Vercel preview build after the
CLI's internal retries. Retry the preview deploy step up to 3 attempts
with 20s/40s backoff; other steps keep fail-fast behavior.
* fix: restore promotion bar icon geometry token
77459acc dropped border-radius: var(--oc-radius-inset) from
.promotion-bar-icon while folding the removed fallback rule into it,
breaking the ui-design-contract test on main.
* ci: retry preview pipeline under fresh preview names
Retrying --preview-create under the same name leaves two deployments and
convex run --preview-name can resolve to the dead one (seen live: seed
failed with missing functions after a successful retry). Each retry now
reruns deploy plus seed under <branch>-retry-N so resolution is unique.
Closes CLAW-526.\n\nSummary:\n- create pending skill versions and plugin releases that remain hidden until TruffleHog and ClawScan pass\n- preserve older CLI response compatibility while newer CLI output explains pending security checks\n- run prepublication worker promotion/blocking for skills and plugins\n- add local-auth coverage for clean skill/plugin publish and secret-positive skill rejection\n\nValidation on PR head d2482434:\n- local: bunx tsc -p packages/schema/tsconfig.json --noEmit\n- local: bunx tsc -p packages/clawhub/tsconfig.json --noEmit\n- local: bunx vitest run convex/lib/skillPublish.test.ts convex/publishAttempts.test.ts convex/skills.versions.public.test.ts convex/packages.public.test.ts packages/schema/src/schemas.test.ts scripts/security/run-prepublication-worker.test.ts scripts/security/prepublication-worker-workflow.test.ts\n- local: bun run ci:static\n- local: bun run ci:types-build && bun run ci:packages\n- GitHub: pr-gates, static, unit, packages, types-build, e2e-http, old-cli-publish, playwright-smoke, secret scanning, CodeQL, and Vercel preview passed\n\nKnown CI note:\n- unrelated local-auth shards continued to rotate failures under the already-diagnosed local Convex starvation issue; ignored per maintainer instruction.
Implements CLAW-541: an artifact-only OSS ClawScan path at the canonical worker seam while preserving the legacy production default. Includes strict artifact validation, complete secret-safe diagnostics, required VirusTotal wiring, and focused route/failure coverage.
Patrick Erichsen