Skip to content

Release v2.0.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 May 22:54
· 97 commits to main since this release
v2.0.6
c2dfae9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

@axonflow/openclaw v2.0.6

Installation

npm install @axonflow/openclaw

Or via OpenClaw plugin manager:

openclaw plugins install @axonflow/openclaw

v2.0.5 switched the ClawHub publish artifact from folder upload (Legacy ZIP) to the npm-pack tarball (ClawPack). That triggered two ClawHub-side regressions specific to the ClawPack handling path that left v2.0.5 unusable for adopters:

  1. Install integrity mismatch. openclaw plugins install clawhub:@axonflow/openclaw@2.0.5 failed with ClawHub archive integrity mismatch: expected sha256-RJwSW6ANBH3JKUkP06oA++JY9r1XAx58NDWKCeD6hwQ=, got sha256-7gGhfvJM/LuF9HfTZG2EsbjkSoImPau6h2wt+nwlhKo=. The expected hash matched the published tarball; the bytes ClawHub's install endpoint actually served did not. ClawHub's CLI download path (clawhub package download) returned the correct bytes — only the install resolution path was broken.
  2. LLM scanner hallucinated "missing implementation". ClawScan flagged dimensions at concern claiming "the bundle contains only package.json and openclaw.plugin.json", "implementation code is absent", and "registry presents this as an instruction-only skill with no code" — all factually false. ClawHub's own package record correctly tagged the artifact as family: "code-plugin" with npmFileCount: 70 and unpackedSize: 280368. Static Analysis (deterministic — reads actual bytes) returned Benign. Only the LLM scanner pipeline saw an incomplete prompt context.

Changed

  • Revert ClawHub publish step to folder upload. .github/workflows/publish.yml now runs clawhub package publish . (folder) instead of clawhub package publish ./<tarball>.tgz. This re-introduces the "Legacy ZIP — may have compatibility issues" badge on the ClawHub install page but restores openclaw plugins install for every adopter. Trade-off accepted until ClawHub fixes the ClawPack handling path.

Carried forward from v2.0.5

  • @anthropic-ai/sdk >=0.91.1 override remains in package.json (closes the moderate GHSA on insecure default file permissions; @anthropic-ai/sdk is a transitive dev-only dependency through the openclaw peerDep).
  • Explicit permissions: contents: read remains on the Heartbeat Real-Stack E2E workflow (CodeQL parity).

Upgrade

openclaw plugins install @axonflow/openclaw@latest. No code or configuration changes on your side. If you tried to install v2.0.5 and hit ClawHub archive integrity mismatch, retry with v2.0.6 — install resolves cleanly via the Legacy ZIP path.

Assets 2
Loading