Patrick Erichsen

fix: retry transient security scan claims · feat: add skill version revocation · perf: add tenth security scan worker · perf: add ninth security scan worker

fix: keep scan workers refilling after hydration skips · chore: generalize project skill updates · fix: cache approved public skill versions · fix: keep shadow scans off throughput workers

chore: automate design system updates · feat: adopt shared OpenClaw design system palette · chore: install OpenClaw design system · fix: preserve skill markdown in security dataset

fix: terminalize legacy publish conflicts · fix: avoid repeated dashboard pagination · fix: keep prepublication recovery draining · fix: bypass replay rate limits for incident cohort

feat: add ClawScan shadow diagnostics · feat: stage publishes behind prepublication checks · chore: run security dataset snapshot weekly · fix: balance promotion section spacing

feat(web): add publisher dashboard workspace · docs: remove plugin roadmap note

fix(convex): release skill stat doc sync leases on failure · Add ClawScan to ecosystem · feat(ecosystem): add ClawScan (#178)

Allow package publish family overrides · chore: record inspector upload results · fix: target plugin inspector bulk scans · fix: preserve inspector remediation uploads

fix: preload URL skill search results · fix(api): expose skill installs stat · chore: bump plugin inspector session sdk checks · fix(cli): prefer plugin manifests for code plugin detection

docs: clarify scanner sandbox defaults · chore: move openclaw plugin work off main

fix: update codex worker cli pin · fix: reduce static scanner false positives · fix: publish security snapshots to live dataset · fix: raise catalog skills feed cap

ci: default plugin inspector scans to dry run · fix: allow high-shard security dataset exports · fix: export latest security dataset skills only · fix: render static audit findings

fix(ui): harden skill and plugin detail polish · fix(search): keep skills all tab on approved recommended ranking · Reserve OpenClaw publisher handles · Rename Official UI labels to Verified

fix: redact security dataset public metadata · Improve skill publish metadata layout · fix: remove hero category comma separators · ci: lower security dataset export min page size

fix: backfill NVIDIA GitHub skill downloads · Stabilize local-auth e2e flake paths · fix: make security dataset export more adaptive · fix: restrict top-level slug route to publishers

Hide scoped plugin prefixes in display labels · fix: remove activity metric tooltip · fix(web): polish browse listing pages · polish: refine homepage hero

fix: backfill stored plugin manifests · fix: harden plugin manifest backfill · feat: backfill plugin manifest summaries · fix(web): filter New listings, trim CLI steps, and link creator cards

fix: allow github sync owner-scoped skill slugs · Remove registry artifact backup jobs · Add Vercel Speed Insights · Surface HTTPS plugin manifest icons on ClawHub cards

Parallelize registry artifact backup backfill · chore: remove empty legacy cleanup tables · chore: remove legacy rate limits schema · Stop auto-greeting staff emails

fix: remove global slug reservation delete copy · Add deprecated download dedupe cleanup · fix: bound rate limit counter storage · fix: parallelize skill artifact backup uploads

fix: remove retired capability metadata surfaces · fix: seed worktree dev previews locally · docs: strengthen ClawHub PR maintainer reviews · Remove retired comment schema

Add ClawHub content rights case tooling · fix: accept legacy install telemetry snapshots · chore: remove legacy package ZIP backfill · fix: use installs across public adoption surfaces

fix: preserve single-row ClawHub header · docs: restore OpenClaw-hosted ClawHub docs · fix: serve docs subdomain root · docs: remove ClawHub reusable builder path

docs: serve ClawHub docs with shared OpenClaw renderer · feat: make docs builder reusable for ClawHub · Validate ClawHub plugin metadata in PRs · ci: split plugin ClawHub publishing paths

fix: prefer app auth for trusted publisher repo lookup · docs: add session store validation remediation · fix: clarify scoped package publish access errors · feat: render Mermaid diagrams in markdown

docs: interpolate ClawHub npm release tag · fix: use no-reply sender for staff emails · feat: expose package trusted publisher CLI commands · chore: rename ClawHub admin package

Normalize ClawScan review visibility · chore: remove migration lifecycle skill · ci: dispatch plugin inspector scans on pin bumps · Correct org delete moderation note

chore: remove dependency registry cleanup · Remove redundant ban email support note · fix: split dependency cleanup pagination · fix: suppress inspector gap package findings

feat: add plugin export endpoint · Reserve admin as a platform owner handle · feat: add ClawScan security scan visibility · Remove legacy suspicious filtering and scanner rollups

fix: make account recovery purge idempotent · fix: schedule user package digest sync from triggers · fix: make account recovery purge idempotent (#2543) · fix: schedule account deletion digest sync safely

test: cover account recreation after deletion · fix: purge auth-locked deleted accounts · test: limit local-auth Playwright retries · Fix post-merge CI gates

fix(cli): accept legacy verify json flag · feat: show plugin downloads in lists · fix: exclude official orgs from publisher abuse · fix: add targeted legacy publisher ownership repair

feat: install GitHub-backed ClawHub skills · fix: point account recovery to GitHub issues · Add shared download metering · Add skills.sh repo manifest

chore: bump clawhub cli to 0.19.0 · feat: show plugin download counts · feat: add clawhub scan command · fix: use GitHub App auth for GitHub account lookups

docs: refresh ClawHub showcase cards · fix(web): stabilize auth loading states · Add security signals publication PDF · docs: refresh ClawHub showcase cards (#88734)

docs: explain skill catalog publishing · feat(cli): print stored auth token · feat: add reusable skill publish workflow

Export skill bundle content for security datasets · feat: add NVIDIA as official publisher · feat: export skill bundle content for security datasets (#2448) · test: add realistic skill canary fixtures

fix(auth): avoid false sign-in failure on redirect · fix: repair pending VT skill versions · Add VT pending repair command · feat: add ban appeals service endpoints

Remove ClawScan note feature · feat: export SkillSpector issue details · fix: preserve Codex diagnostic messages · Export SkillSpector signals in security dataset

fix: remove global ClawScan claim ceiling · fix: restrict membership management to org publishers · fix(cli): respect subcommand version options · fix: hide package resources when owners are banned

Add bulk skill security verdicts endpoint · fix: reshape skill verify security signals · fix: route static scan findings through clawscan · fix: stabilize local-auth publish lifecycle e2e

feat: generate nvidia-style skill cards · feat: refine SkillSpector audit UI · feat: generate nvidia-style skill cards (#2382) · feat: refine skillspector audit UI (#2397)

fix: increase security scan worker throughput · fix: let Codex adjudicate scan evidence · feat: support artifact-generic security rescans · fix: increase security scan worker throughput (#2389)

fix: streamline security audit agentic lanes · fix: require security scan artifact reads · fix: make security scan worker dispatchable · feat: use SkillSpector for agentic risk findings

Export skills function added by Mirror Site maintainer · fix: cap skill export page size · fix: log skill export failures · fix: cap skill export page size (#2376)

fix: honor skill source install aliases · fix: use generic 404 for missing skill pages · fix: clarify package publish runtime errors · fix: contain skill install command card

feat: consolidate security audit UI · Add category-aware related skills · Fix undetected VirusTotal results staying pending · fix: render CJK text in OG images

Add Telegram progress preview flows · docs: reconcile local dev worktree workflows · chore(release): prepare clawhub cli 0.17.0 · fix: increase clawscan worker throughput

fix: keep inter-session provenance out of transcripts · test: cover gateway exec approval runtime flow · Add autoban remediation command · feat: add security scan admin tooling

Seed local dev with public corpus

Replace search loading boxes with skeletons · fix(web): harden search relevance and count honesty · Show suspicious skills in UI search · fix: replace search loading boxes with skeletons (#2224)

Fix local dev seeding, redirects, and package pinning · feat: add ClawScan finding permalinks · Use canonical /user profile routes · feat: add security audits page

fix(heartbeat): multi-agent cadence — parallel broadcast, per-agent busy check, prompt assembly, connect-timeout, doctor warning · fix(agents/harness): pass tool results through tool-result middleware safely · fix: avoid slug availability crash for duplicate slugs · fix(memory-core): prevent staged dream candidates from leaking into MEMORY.md

fix: clarify skill summary settings copy · docs: clarify pre-pr validation gates · Show full skill descriptions on detail pages · [codex] Expand skill summary clamp

feat: enforce malicious-only moderation appeals

docs: add dedicated ClawHub docs tab · Telegram /model status misleading auth for Codex runtime · [codex] Add ClawHub staging deploy workflow · docs: add ClawHub publishing page

Telegram /model status reports misleading auth for Codex runtime · [codex] Fix Telegram model status Codex auth label · Telegram /model status misleading auth for Codex runtime · control ui: replace assistant-media ?token auth with scoped media tickets

fix(discord): parse provider-prefixed channel targets · docs: add pull request template · Add a friendlier 404 page · fix: bootstrap ClawHub worktree setup

fix(update): restore configured plugins on 4-to-5 updates · Add WhatsApp live QA lane · fix: gate privileged cli help by role · Tolerate corrupt plugins during update

Move package update execution into an external updater · fix(plugins): emit actionable install hint for externalized channel plugins (#77483) · [codex] link fixing PRs in close comments · Merge pull request #38 from openclaw/codex/link-fix-pr-in-close-comments

Clarify ClawScan artifact prompt boundaries · feat(brand): refresh ClawHub logo assets · feat: add ClawHub security eval pipelines

chore: remove clawscan eval corpora · feat: update clawscan analysis · feat: add clawhub unban command · feat: label "suspicious" as "review" for scans

docs: move plugin discovery to ClawHub · Add plugin curation to management · feat: add featured plugin curation · feat: add ClawHub rescan guidance workflow

[codex] Add skills/plugins search typeahead · chore(release): prepare clawhub cli 0.12.1 · fix: hide admin CLI help from non-admins · Allow publishers to submit requests for rescans of skills/plugins

feat(brand): refresh ClawHub logo assets · Allow publishers to submit requests for rescans of skills/plugins · [codex] Add Convex AI guidance and skills · Merge pull request #1837 from openclaw/pe/convex-ai-files

memory/dreaming: CLI-backed agents (Claude CLI, Codex CLI, Gemini CLI) silently fail to dream · fix(agents): repair stale bootstrap completion · chore(ci): Centralize workflow OpenAI model defaults · memory/dreaming: decouple managed cron from heartbeat

control ui: replace assistant-media ?token auth with scoped media tickets · fix(security): allow SVGs through image optimizer so badges render · fix(security): proxy README images via Vercel Image Optimization · chore(lint): clean up 70 oxlint errors from staging merge #1573

fix(memory/dreaming): surface blocked status when heartbeat is disabled for main · fix(browser): reject ax<N> refs in act path instead of timing out

fix(dev): release run-node build lock on SIGINT/SIGTERM/exit · onboard: plain-prose security disclaimer + searchable pickers · fix(dev): release run-node build lock on SIGINT/SIGTERM/exit (#69785) · onboard: plain-prose security disclaimer, searchable pickers for search/plugins/model-provider (#69760)

feat(agents): add adaptive thinking support for Claude Opus 4.7

chore: bump pi packages to 0.67.5 and @anthropic-ai/sdk to 0.90.0