Skip to content

clawhub 0.26.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Nov 02:58
· 3 commits to main since this release
v0.26.0
a1567fb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.26.0 - 2026-11-12

  • Templates: accept native agent settings, including agent.tools, and top-level skills and plugins dependencies in CLAW.md. Dependencies can reference exact ClawHub versions or bundled package directories. This fixes the stable CLI rejecting the supported Template format before upload (#4551). Publish an already-built .tgz; successful publication does not establish compatibility with a particular OpenClaw consumer release.

  • CLI: add clawhub package publication <name> --version <version>. It prints whether that exact version is published, still pending, failed, or was never accepted. The public version list hides a pending release, and package readiness remains the official-migration check. Older registries that answer the publication URL with a version document or 404 are checked through the version endpoint. A failed attempt says an authorized publisher may recover it with package recover and a reason.

  • Publishing: run reusable package-publish plugin validation with Node.js 24. The CLI refuses package validate under Bun, so the workflow builds the pinned CLI and runs node packages/clawhub/bin/clawdhub.js package validate.

  • CLI login: the device page no longer fills the approval code from the link. Type the code from the terminal. The page shows the token label and that approval creates a full API token. A scope other than read write is rejected. Authorize and Deny turn off when the code's expiry time passes, including when the page was already open before the code was typed, and the pending query does not read the clock. Expired, used, and mistyped codes say how to continue, and a finished approval no longer shows the code as already used.

  • CI: verify and cache a pinned Convex backend through the release-asset API before local-auth browser tests, with bounded download retries.

  • CLI: keep a saved API token on the registry that issued it. A --site well-known document cannot send that token to another origin, and it does not replace the saved login, including a legacy auth.clawhub.ai registry. Discovered registry URLs must be http or https and must not contain userinfo. clawhub-admin commands follow the same rule.

  • Skills: recognize a single top-level env name as a required variable so installation guidance and scanner metadata retain the declared credential.

  • CLI: on Bun, send the API token to curl on stdin instead of the command line. JSON, form, text, download, and binary upload requests use the same header stdin path.

  • API: return one publish-token rejection when a package is missing, hidden, or the GitHub identity does not match, without naming the trusted repository. The body tells the caller to ask a package manager to check the trusted-publisher configuration and the workflow OIDC claims. A GitHub signing-key outage answers a retryable 503 instead of a rejection.

  • CI: right-size Skill Card workers and credential canaries to two-vCPU runners, retaining four-vCPU skill evaluations and existing resource checks.

  • CLI: explain a missing npm when packing a package folder. On Windows, packing runs the installed npm directly, so a package folder cannot substitute its own npm.cmd. Other platforms keep the normal npm lookup.

  • Security: retire VirusTotal entirely. ClawHub no longer uploads skill or plugin artifacts to VirusTotal, polls or backfills its results, re-queues ClawScan from VirusTotal updates, delays ClawScan for it, or shows VirusTotal data in the UI, CLI, public API, scan reports, or audit exports. The clawhub-admin skills repair-vt-pending command and its API route are removed.

  • Publishing: remove the in-publish static scan, which ran out of memory on large plugin packages and duplicated the ClawScan pre-publication gate. Static results are no longer computed, sent to ClawScan, or displayed; Skill Cards now wait only for ClawScan.

  • Publishing: return 503 with Retry-After instead of 400/401 when Convex reports a transient platform failure (overload, internal/transient error, write admission or conflict) on publish, upload, token-mint, recovery and API-token auth paths; genuine validation errors keep their 4xx and message.

  • API: send rate-limit headers only on a real 429, never on admitted requests or while the rate limiter is switched off.

  • CLI: retry 503 and real 429 responses with bounded, jittered backoff that honors Retry-After, and show quota/reset hints only for a real 429.

  • Publishing: pin the server Plugin Inspector to 0.4.3 so large plugin publishes (such as @openclaw/matrix and @openclaw/whatsapp) stay under the 512 MiB Node action limit; 0.4.4+ type-checks the whole OpenClaw declaration surface while preparing the publish target. Until a bounded Inspector release, retirement notices may name replacements the selected OpenClaw release does not export yet.

  • CLI: reuse canonical schema implementations during builds while retaining standalone npm artifacts and embedding their debug sources.

  • Catalog: keep skill and plugin browsing available when optional heading counts fail.

  • Search: propagate cancelled initial requests without logging expected navigation changes as search failures.

  • Publishing: bound stored-file metadata verification to 16 concurrent reads and drain started work before cleanup, preserving server-computed hashes and archive bytes.

  • Tooling: preserve the component example correction and canonical AGENTS.md when refreshing Convex AI guidance.

  • Docs: clarify that API retirement notices require replacement APIs available in the selected OpenClaw release and appear in the manager dashboard.

  • Tests: refresh development dependencies and anchor frozen-clock fixtures to Convex transaction timestamps and stored expiration boundaries.

  • Dependencies: patch Undici to 7.30.1 in the CLI, admin CLI, and development tools to address upstream transport advisories.

  • Dependencies: refresh production packages, including Convex 1.49 and Workpool 0.4.15. Convex now requires Node.js 22 or newer; do not downgrade Workpool after its new queue pointers are stored, and complete its upstream backfill before a future 0.5 upgrade.

  • CI: escape Unicode line separators in security dataset JSONL so line readers preserve complete records during snapshot validation.

  • CI: reuse Playwright browser downloads across unrelated dependency updates by keying caches to the installed Playwright version and runner architecture.

  • CI: use a single-commit checkout for static checks instead of fetching full history.

  • CI: cache the pinned OpenClaw contract package store while retaining frozen installs and full contract proof on every run.

  • Tooling: use the existing pinned Bun formatter for format commands while preserving Oxfmt configuration and exclusions.

  • Publishing: prepare staged ClawPacks in the Node runtime so large archives can reach package validation without exhausting the HTTP action memory limit.

  • Scanning: stop classifying Manifest V3 browser host permissions as installation sources while retaining checks for install URLs elsewhere in the manifest.

  • CI: speed up the Linux root typecheck with pinned tsrs while retaining native TypeScript for local checks and package builds.

  • CI: run native package typechecks in the packages job only, retaining full package checks in local ci:types-build.

  • CI: run command-script tests in Node instead of starting jsdom for each suite.

  • skills.sh: sync once a day at 03:00 Pacific and mirror the top 4,000 rows of the all-time and trending views, so the sync completes again after skills.sh expanded its default feed to ~93k rows; Trending keeps the last skills.sh run for up to 50 hours.

  • Workers: include bounded, redacted skill evaluation failure reasons in CI logs so operators can diagnose failed runs.

  • Tooling: accept Bun's environment-file loading diagnostic in local dependency audits while preserving tool-error and malware failures.

  • Plugins: show informational notices for OpenClaw APIs with scheduled retirement dates, with replacement details and a publisher dashboard nudge.

  • Dependencies: update Plugin Inspector to 0.4.0 in the app and CLI to retain structured API retirement guidance; the CLI now requires Node.js 22.13+ on the 22.x line or Node.js 24+.

  • CLI/Scans: load Plugin Inspector only for validation, select Node.js 24 for hosted Convex actions, and run bulk scans under Node.js; ordinary Bun CLI commands remain available, while local plugin validation explains its Node.js requirement.

  • Dependencies: patch vulnerable DOMPurify, Next.js preview tooling, shell-quote, and source-map-js versions.

  • Dependencies: refresh supported React, TanStack, Radix, email, CLI utility, lint, format, and test packages while retaining the current Node and compiler compatibility contracts.

  • Tests: update Vitest and its V8 coverage provider together to 5.0.3; retain registered auth callbacks across per-test mock cleanup.

  • Tests: update jsdom to 30.1.2 and allow its required Undici 8 transport while keeping the CLI on Undici 7.

  • Runtime: use Bun 1.3.14 across CI and deployment tooling to preserve labelled conditional blocks when compiling React server rendering.

  • Tests: revalidate cached npm metadata before installing updated Convex external dependencies, retaining cached package tarballs and bounded fetches.

  • Dependencies: refresh production packages and synchronize the Sharp pin; let each package resolve its supported Undici transport and use the unpatched upstream Workpool release. Retain the old Workpool typecheck patch only for the previous-version test fixture.

  • Use one shared autoreview installation from openclaw/agent-skills; repository entrypoints now receive upstream fixes without copied helpers or test suites.

  • CI: batch main CodeQL scans every six hours while preserving PR and manual scans; include local composite actions and attribute-only PR changes.

  • Tooling: generate schema build output during workspace install and Worktrunk setup instead of tracking compiled files; installs that skip scripts must build the schema package before use.

Release Proof

Assets 2
Loading