clawhub update always reports 'local changes (no match)' even on freshly installed skills #92

Open
opened 2026-02-15 17:15:38 -05:00 by yindo · 0 comments
Owner

Originally created by @ethanjharlan on GitHub (Feb 7, 2026).

Bug Report — clawhub v0.5.0

Summary

clawhub update --all reports "local changes (no match)" for every installed skill, even immediately after a fresh clawhub install. This makes update unusable without --force.

Reproduction Steps

  1. Remove a skill folder and its lockfile entry
  2. clawhub install sag (fresh install, clean)
  3. Immediately run clawhub update sag
  4. Output: sag: local changes (no match). Use --force to overwrite.

Expected Behavior

A freshly installed skill with no local modifications should pass the integrity check and either report "already up to date" or update cleanly.

Root Cause (suspected)

The install command stores origin.json with only version + timestamp — no file hash/checksum. The update command then computes a local hash but has no stored reference to compare against, so it always fails the match.

origin.json after fresh install:

{
  "version": 1,
  "registry": "https://clawhub.ai",
  "slug": "sag",
  "installedVersion": "1.0.0",
  "installedAt": 1770508599025
}

No hash field is present.

Environment

  • clawhub CLI v0.5.0 (3376dc6c)
  • macOS (Darwin arm64)
  • Node v25.6.0

Workaround

clawhub update --all --force bypasses the check, but this defeats the purpose of local change detection.

Originally created by @ethanjharlan on GitHub (Feb 7, 2026). ## Bug Report — clawhub v0.5.0 ### Summary `clawhub update --all` reports "local changes (no match)" for every installed skill, even immediately after a fresh `clawhub install`. This makes `update` unusable without `--force`. ### Reproduction Steps 1. Remove a skill folder and its lockfile entry 2. `clawhub install sag` (fresh install, clean) 3. Immediately run `clawhub update sag` 4. Output: `sag: local changes (no match). Use --force to overwrite.` ### Expected Behavior A freshly installed skill with no local modifications should pass the integrity check and either report "already up to date" or update cleanly. ### Root Cause (suspected) The `install` command stores `origin.json` with only version + timestamp — no file hash/checksum. The `update` command then computes a local hash but has no stored reference to compare against, so it always fails the match. `origin.json` after fresh install: ```json { "version": 1, "registry": "https://clawhub.ai", "slug": "sag", "installedVersion": "1.0.0", "installedAt": 1770508599025 } ``` No hash field is present. ### Environment - clawhub CLI v0.5.0 (3376dc6c) - macOS (Darwin arm64) - Node v25.6.0 ### Workaround `clawhub update --all --force` bypasses the check, but this defeats the purpose of local change detection.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#92