Release v2.3.3

@axonflow/openclaw v2.3.3

Installation

npm install @axonflow/openclaw

Or via OpenClaw plugin manager:

openclaw plugins install @axonflow/openclaw

Patch release. No runtime behaviour change. Single substantive improvement: artifact format migration that closes the visible "Legacy ZIP" badge on the ClawHub listing.

Fixed

• ClawHub publish migrated from Legacy ZIP → ClawPack via clawhub@0.12.3. .github/workflows/publish.yml Install ClawHub CLI step pinned from clawhub@0.12.0 to clawhub@0.12.3. v0.12.2 (2026-05-02 21:45 UTC) shipped the CLI fix for v0.12.1's tarball-bytes-mismatch regression ("publish code plugins as clawpacks and allow legacy package downloads"); v0.12.3 (2026-05-06) added monorepo support + dry-run --metadata-only + scope-owner inference. Verified working locally via clawhub package pack + clawhub package publish . --dry-run against this repo at v2.3.2 — clean ClawPack tarball with correct sha256/integrity. Closes the "Legacy ZIP — may have compatibility issues" artifact badge on the ClawHub listing and lifts the verification tier from source-linked (lowest) to the modern plugin architecture.

  Safety net unchanged: existing verify-clawhub-install job runs openclaw plugins install clawhub:@axonflow/openclaw@<version> on every publish and fails fast on any bytes-mismatch — same gate that broke v2.0.5/v2.0.6 visibly during the v0.12.1 regression. If broken, revert path is documented in feedback_plugin_manifest_envvars_hygiene.md and feedback_clawhub_cli_v0_12_1_tarball_regression.md (clawhub@0.12.0 + folder upload).

Internal

• ClawScan Credentials review concern remains open and is upstream-blocked. Architectural research (memory: feedback_plugin_manifest_envvars_hygiene.md) confirmed that the env-vars schema landed in clawhub@0.7.0 (2026-02-16) is skill-side only: parsed from SKILL.md frontmatter into the registry capabilities block for skills. Code plugins (this artifact) have no analogous envVars schema slot in their capabilities indexing today — the registry stores bundledSkills, capabilityTags, commandNames, configSchema, executesCode, hooks, providers, etc., but no envVars. The earlier v2.3.1 / v2.3.2 / v2.3.3-WIP attempts to close this client-side via openclaw.plugin.json envVars, README.md table, and a SKILL.md frontmatter file at the package root were all wrong-layer fixes — adding a SKILL.md to a code plugin's root would either be inert (right) or cause OpenClaw runtime to inject our governance prose into the agent's system prompt (wrong, since we're a code plugin that registers hooks, not a skill that injects prompts).

  Path forward: the actual fix is upstream in ClawHub (analog of openclaw/clawhub#350 for skills, but for code-plugin capabilities.envVars). Until that ships, the "Review" verdict on the Credentials dimension is acceptable — plugin remains installable; reviewer text is balanced ("These variables are related to AxonFlow, not unrelated services"). Static Analysis verdict stays Benign; ClawPack format moves the visible badge.

---

v2.3.0 — feature release (carried forward, 5h ago)

Companion plugin release to AxonFlow agent v7.7.0. Surfaces the V1
Plugin Pro structured upgrade envelope to the operator on Community
SaaS rate-limit hits, and adds 5 new agent-callable Pro tools so
OpenClaw agents reach the same V1 Pro toolset that the
axonflow-claude-plugin / axonflow-cursor-plugin /
axonflow-codex-plugin plugins auto-discover from the AxonFlow agent's
MCP server. Total agent-callable tools: 5 → 10.

Added

• V1 Plugin Pro upgrade-prompt envelope handling in
  src/upgrade-prompt.ts — sourced into axonflow-client.ts so every
  4xx response from mcpCheckInput / mcpCheckOutput runs through
  envelope detection. When the agent returns a 429 (daily-quota) or
  403 (graduated / Pro-only) with the structured envelope shape:

  • Parses upgrade.wording + upgrade.buy_url and forwards it to the
    host plugin logger (api.logger.info) at most once per UTC day.
    Surfaced to OpenClaw operators via the standard plugin log channel.
  • Honours Retry-After / resets_at by stamping a back-off file at
    ${AXONFLOW_CACHE_DIR or platform default}/throttle-until.
    governance.ts checks the gate before each governed call and
    short-circuits during the back-off window (no thundering-herd
    retries against the agent).
  • Handles both bare and JSON-RPC-wrapped envelope shapes (the latter
    is what the new V1 Pro MCP tools deliver via writeMCPGateError).

• axonflow_get_tenant_id agent-callable tool — returns the
  install's tenant_id, current tier (Free / Pro / pro_expired),
  endpoint, and the locked V1 upgrade URLs. The other three plugin
  hosts (claude / cursor / codex) get this tool from the agent's MCP
  server via auto-discovery; OpenClaw doesn't proxy that MCP server,
  so we register a local equivalent built from the same status surface
  recover.sh status exposes. Keeps cross-plugin behaviour consistent
  for the "what's my tenant ID?" question.

• Four V1 Plugin Pro proxy tools registered locally so OpenClaw
  agents reach the same V1 Pro toolset that axonflow-claude-plugin /
  axonflow-cursor-plugin / axonflow-codex-plugin auto-discover from
  the agent's MCP server. OpenClaw doesn't proxy
  /api/v1/mcp-server tools/list, so these are registered as
  code-defined AgentToolDefs whose execute() forwards to the agent
  via a single new AxonFlowClient.callMCPTool(name, args) helper:

  • axonflow_request_approval — Free 1/7d rolling, Pro unlimited.
  • axonflow_create_tenant_policy — Free 2 active max, Pro unlimited.
  • axonflow_get_cost_estimate — Pro-only; Free callers get the
    locked V1 feature_pro_only envelope.
  • axonflow_list_pro_features — Free + Pro, locked feature list
    (5 differentiators + $9.99 / 90-day pricing).

  Total agent-callable tools: 5 → 10 (combining axonflow_get_tenant_id
  above with these four).

• clawhub/2.3.0/SKILL.md — frozen per-version skill record for the
  v2.3.0 release. Documents the new agent-callable tools alongside the
  existing 5 governance tools.

Fixed

• AxonFlowClient.handleEnvelope — pre-filter on
  status === 429 || status === 403 was dropping JSON-RPC-wrapped
  envelope responses that come back over HTTP 200 with
  result.isError = true (the path the agent's
  mcp_v1_pro_tools.go writeMCPGateError uses). Removed the
  pre-filter; handleV1Envelope already encodes the full
  status-vs-shape decision and now sees all three envelope-bearing
  paths (429 daily-quota, 403 graduated / Pro-only, 200 + JSON-RPC
  gate). The 4 new proxy tools depend on the 200 path; without this
  fix, Free callers got the envelope content as a generic kind=ok
  result instead of a clean kind=envelope with the upgrade prompt
  surfaced.

Internal

• tests/upgrade-prompt.test.ts — 26 unit assertions across
  detectEnvelope, retryAfterMs, resolveDeadlineMs,
  isThrottleActive, shouldShowPromptToday, the full handleEnvelope
  state machine, and the V1_LIMIT_TYPES locked enumeration.
• runtime-e2e/v1_pro_envelope_surface/ — drives the compiled
  dist/upgrade-prompt.js against a live 429 envelope captured from
  a Free-tier tenant on try.getaxonflow.com past the 200/day cap.
• runtime-e2e/v1_pro_proxy_tools/ — drives the compiled
  dist/agent-tools.js + dist/axonflow-client.js against a real
  registered tenant on https://try.getaxonflow.com. Asserts
  end-to-end that all 5 V1 Pro agent-callable tools dispatch
  correctly: axonflow_list_pro_features returns the locked
  5-differentiators shape; axonflow_get_cost_estimate on a Free
  tenant lands the feature_pro_only envelope with the locked buy
  URL + logger wording + stamped throttle file (and the subsequent
  agent-tool execute() honours the throttle gate);
  axonflow_request_approval and axonflow_create_tenant_policy
  return non-empty approval_id / policy_id on first Free call,
  with top-level success: true alongside submitted: true /
  created: true on the response body.
• tests/agent-tools.test.ts + tests/registration.test.ts —
  updated for the new tool count (5 → 10).

Versions touched

• package.json: 2.2.0 → 2.3.0
• package-lock.json: 2.2.0 → 2.3.0
• src/version.ts (VERSION constant — Jest asserts parity): 2.2.0 → 2.3.0
• This CHANGELOG entry