openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #298] [MERGED] feat: anti-squatting protection, backup restore, and ban flow improvements #316

New Issue
Closed
opened 2026-02-15 17:16:51 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:51 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/298
Author: @autogame-17
Created: 2/14/2026
Status: ✅ Merged
Merged: 2/14/2026
Merged by: @steipete

Base: main ← Head: feat/anti-squatting-and-restore

📝 Commits (3)

  • 77ebc21 feat: anti-squatting protection, backup restore, and ban flow improvements
  • 760ca75 chore: merge main into PR branch
  • 96ae4be fix: harden restore/reclaim + ban flow (#298) (thanks @autogame-17)

📊 Changes

13 files changed (+1285 additions, -77 deletions)

View changed files

📝 CHANGELOG.md (+4 -0)
📝 convex/_generated/api.d.ts (+6 -0)
➕ convex/githubRestore.ts (+221 -0)
➕ convex/githubRestoreMutations.ts (+84 -0)
📝 convex/httpApiV1.handlers.test.ts (+122 -0)
📝 convex/httpApiV1.ts (+119 -9)
➕ convex/lib/githubRestoreHelpers.test.ts (+54 -0)
➕ convex/lib/githubRestoreHelpers.ts (+159 -0)
📝 convex/lib/skillPublish.ts (+32 -16)
📝 convex/schema.ts (+15 -0)
📝 convex/skills.rateLimit.test.ts (+8 -0)
📝 convex/skills.ts (+283 -22)
📝 convex/users.ts (+178 -30)

📄 Description

feat: anti-squatting protection, backup restore, and ban flow improvements

  • Add reservedSlugs table with 90-day cooldown to prevent slug squatting
    after skill deletion. Hard-delete finalize phase reserves slugs for the
    original owner; insertVersion blocks non-owners during cooldown.

  • Change ban flow from hard-delete to soft-delete: banUserWithActor now
    sets moderationReason: 'user.banned' and syncs embedding visibility.
    unbanUserWithActor restores all ban-hidden skills and releases slug
    reservations automatically.

  • Align autobanMalwareAuthorInternal with the same soft-delete + embedding
    visibility pattern so unban recovery works uniformly.

  • Add admin reclaimSlug / reclaimSlugInternal mutations for reclaiming
    squatted slugs, with audit logging.

  • Add GitHub backup restore system (githubRestore.ts,
    githubRestoreMutations.ts, githubRestoreHelpers.ts) that reads from
    the clawdbot/skills backup repo and re-creates skill records. Squatter
    eviction runs synchronously in the same transaction as restore to avoid
    async race conditions.

  • Add POST /api/v1/users/restore and POST /api/v1/users/reclaim admin
    HTTP endpoints for bulk operations.

  • Add trustedPublisher flag on users; trusted publishers bypass the
    pending.scan auto-hide for new skill publishes.

  • Add setTrustedPublisher / setTrustedPublisherInternal admin mutations.

Addresses: slug squatting prevention, skill backup/restore, ban recovery,
and trusted publisher workflow improvements.

Greptile Overview

Greptile Summary

This PR implements anti-squatting protection, backup restore, and ban flow improvements for the skills platform.

Key changes:

  • Added reservedSlugs table with 90-day cooldown to prevent slug squatting after skill deletion
  • Changed ban flow from hard-delete to soft-delete: banned users' skills are now hidden but recoverable
  • unbanUserWithActor now restores all ban-hidden skills and releases slug reservations automatically
  • Added GitHub backup restore system that reads from clawdbot/skills repo and re-creates skill records
  • Added reclaimSlug admin mutations for reclaiming squatted slugs with audit logging
  • Added POST /api/v1/users/restore and POST /api/v1/users/reclaim admin HTTP endpoints for bulk operations
  • Added trustedPublisher flag on users to bypass pending.scan auto-hide for new skill publishes
  • Aligned autobanMalwareAuthorInternal with soft-delete pattern for uniform unban recovery

Implementation details:

  • Squatter eviction during restore runs synchronously in the same transaction to avoid race conditions
  • Slug reservations created during hard-delete finalize phase prevent non-owners from claiming slugs during cooldown
  • insertVersion checks slug reservations and blocks non-owners during cooldown period
  • Trusted publishers (and admins/moderators) start with moderationStatus: 'active' instead of hidden

Confidence Score: 4/5

  • This PR is safe to merge with minor considerations for performance optimization
  • The implementation is thorough with proper admin checks, audit logging, and transaction management. The soft-delete ban pattern is a significant improvement for user recovery. One minor performance concern exists with sequential processing of bulk reclaim operations (up to 200 slugs), but this is admin-only functionality and unlikely to cause issues in practice.
  • Pay attention to convex/httpApiV1.ts for the sequential slug processing pattern in bulk operations

Last reviewed commit: 77ebc21

(2/5) Greptile learns from your feedback when you react with thumbs up/down!

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/298 **Author:** [@autogame-17](https://github.com/autogame-17) **Created:** 2/14/2026 **Status:** ✅ Merged **Merged:** 2/14/2026 **Merged by:** [@steipete](https://github.com/steipete) **Base:** `main` ← **Head:** `feat/anti-squatting-and-restore` --- ### 📝 Commits (3) - [`77ebc21`](https://github.com/openclaw/clawhub/commit/77ebc21fd9a7150f58a2b94a09cb8c9fa0c54ebb) feat: anti-squatting protection, backup restore, and ban flow improvements - [`760ca75`](https://github.com/openclaw/clawhub/commit/760ca75db5c9281b2a6e1c8a271d883c7870ec24) chore: merge main into PR branch - [`96ae4be`](https://github.com/openclaw/clawhub/commit/96ae4bed65cb616ba6bac08f2b1901ce03fca0c1) fix: harden restore/reclaim + ban flow (#298) (thanks @autogame-17) ### 📊 Changes **13 files changed** (+1285 additions, -77 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+4 -0) 📝 `convex/_generated/api.d.ts` (+6 -0) ➕ `convex/githubRestore.ts` (+221 -0) ➕ `convex/githubRestoreMutations.ts` (+84 -0) 📝 `convex/httpApiV1.handlers.test.ts` (+122 -0) 📝 `convex/httpApiV1.ts` (+119 -9) ➕ `convex/lib/githubRestoreHelpers.test.ts` (+54 -0) ➕ `convex/lib/githubRestoreHelpers.ts` (+159 -0) 📝 `convex/lib/skillPublish.ts` (+32 -16) 📝 `convex/schema.ts` (+15 -0) 📝 `convex/skills.rateLimit.test.ts` (+8 -0) 📝 `convex/skills.ts` (+283 -22) 📝 `convex/users.ts` (+178 -30) </details> ### 📄 Description feat: anti-squatting protection, backup restore, and ban flow improvements - Add `reservedSlugs` table with 90-day cooldown to prevent slug squatting after skill deletion. Hard-delete finalize phase reserves slugs for the original owner; `insertVersion` blocks non-owners during cooldown. - Change ban flow from hard-delete to soft-delete: `banUserWithActor` now sets `moderationReason: 'user.banned'` and syncs embedding visibility. `unbanUserWithActor` restores all ban-hidden skills and releases slug reservations automatically. - Align `autobanMalwareAuthorInternal` with the same soft-delete + embedding visibility pattern so unban recovery works uniformly. - Add admin `reclaimSlug` / `reclaimSlugInternal` mutations for reclaiming squatted slugs, with audit logging. - Add GitHub backup restore system (`githubRestore.ts`, `githubRestoreMutations.ts`, `githubRestoreHelpers.ts`) that reads from the `clawdbot/skills` backup repo and re-creates skill records. Squatter eviction runs synchronously in the same transaction as restore to avoid async race conditions. - Add `POST /api/v1/users/restore` and `POST /api/v1/users/reclaim` admin HTTP endpoints for bulk operations. - Add `trustedPublisher` flag on users; trusted publishers bypass the `pending.scan` auto-hide for new skill publishes. - Add `setTrustedPublisher` / `setTrustedPublisherInternal` admin mutations. Addresses: slug squatting prevention, skill backup/restore, ban recovery, and trusted publisher workflow improvements. <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR implements anti-squatting protection, backup restore, and ban flow improvements for the skills platform. **Key changes:** - Added `reservedSlugs` table with 90-day cooldown to prevent slug squatting after skill deletion - Changed ban flow from hard-delete to soft-delete: banned users' skills are now hidden but recoverable - `unbanUserWithActor` now restores all ban-hidden skills and releases slug reservations automatically - Added GitHub backup restore system that reads from `clawdbot/skills` repo and re-creates skill records - Added `reclaimSlug` admin mutations for reclaiming squatted slugs with audit logging - Added `POST /api/v1/users/restore` and `POST /api/v1/users/reclaim` admin HTTP endpoints for bulk operations - Added `trustedPublisher` flag on users to bypass `pending.scan` auto-hide for new skill publishes - Aligned `autobanMalwareAuthorInternal` with soft-delete pattern for uniform unban recovery **Implementation details:** - Squatter eviction during restore runs synchronously in the same transaction to avoid race conditions - Slug reservations created during hard-delete finalize phase prevent non-owners from claiming slugs during cooldown - `insertVersion` checks slug reservations and blocks non-owners during cooldown period - Trusted publishers (and admins/moderators) start with `moderationStatus: 'active'` instead of `hidden` <h3>Confidence Score: 4/5</h3> - This PR is safe to merge with minor considerations for performance optimization - The implementation is thorough with proper admin checks, audit logging, and transaction management. The soft-delete ban pattern is a significant improvement for user recovery. One minor performance concern exists with sequential processing of bulk reclaim operations (up to 200 slugs), but this is admin-only functionality and unlikely to cause issues in practice. - Pay attention to `convex/httpApiV1.ts` for the sequential slug processing pattern in bulk operations <sub>Last reviewed commit: 77ebc21</sub> <!-- greptile_other_comments_section --> <sub>(2/5) Greptile learns from your feedback when you react with thumbs up/down!</sub> <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:51 -05:00
yindo closed this issue 2026-02-15 17:16:51 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#316
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?