docs: changelog credit + v1 delete status codes

[steipete]

• Add Unreleased changelog credit for fix: return proper HTTP status codes for delete/undelete errors #35 (thanks @sergical)\n- Document v1 skill delete/undelete status codes\n- Include pending main commit: CF-only client IP parsing default\n\nTests: bun run lint; bun run test

Greptile Overview

Greptile Summary

This PR makes three documentation improvements:

• Adds changelog credit for PR fix: return proper HTTP status codes for delete/undelete errors #35 (@sergical) which fixed delete/undelete error handling
• Documents the v1 API status codes (200, 401, 403, 404, 500) for skill delete/undelete endpoints
• Updates IP parsing documentation to reflect the security hardening change that defaults to Cloudflare-only client IP detection

The httpRateLimit.ts change improves security by defaulting to CF-only IP parsing (requiring explicit opt-in via TRUST_FORWARDED_IPS=true for other forwarded headers), preventing IP spoofing attacks. Tests were properly updated to reflect the new behavior with correct environment variable cleanup.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• All changes are documentation updates and a security hardening improvement (CF-only IP default). The code change is well-tested with proper environment cleanup in tests. The documented status codes accurately match the softDeleteErrorToResponse implementation in convex/httpApiV1.ts.
• No files require special attention

_{Last reviewed commit: a85faf7}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Building	Preview, Comment	Feb 14, 2026 9:21pm

[cursor]

PR Summary

Medium Risk
Changes how client IPs are derived for rate limiting; misconfiguration could cause many requests to share an unknown IP bucket or change rate-limit behavior in non-Cloudflare deployments.

Overview
Hardens rate limiting IP detection by making getClientIp ignore spoofable forwarded headers unless TRUST_FORWARDED_IPS=true, updating unit tests to cover the new default behavior.

Updates docs/http-api.md to reflect the opt-in forwarded-header behavior and documents status codes for v1 skill delete/undelete endpoints; also adds changelog credit for the delete/undelete status-code fix (#35).

^{Written by Cursor Bugbot for commit a85faf7. This will update automatically on new commits. Configure here.}

[ianalloway]

king claw