* fix(skills): keep ClawHub search results on the source the operator picked
ClawHub search returns each result's origin under `install.reference`, but the
response model expected a flat `installRef`. That field is never present, so
every row fell through to a synthesized `@owner/slug` reference. External
skills.sh results were rewritten onto a ClawHub-native identity, dropping both
the commit-pinned source and the "not scanned by ClawHub" trust record.
Map the search wire shape explicitly and make the search contract
action-specific: `installRef` always names the result's own source, `detailRef`
appears only while ClawHub can serve a detail card for that identity, and
`trustState` travels with unscanned sources. Clients render install directly
when detail is absent instead of offering a review the Gateway must refuse.
Covers the Control UI, macOS, iOS Settings, iOS AgentPro, and Android, which
previously routed every row through review and could not install an external
skill at all.
* fix(skills): make install-only sources explicit and keep legacy review intact
Address review findings on the search identity contract:
- Replace the detail-reference capability with an explicit `installOnly` flag.
A Gateway released before this field omits it, and reading omission as
install-only made ordinary registry results skip the reviewed-version flow on
every client. Absence now means the existing review-then-install path.
- Parse closed source variants in the producer. A row whose source is unknown,
whose external reference is missing, or whose registry publisher is absent is
dropped instead of falling through to `@owner/slug`, which was the original
source swap in a different disguise.
- Carry the exact install reference alongside the canonical slug. The Gateway
already records `requestedReference`; the clients dropped it and matched
installs by slug, so a completed external install read back as unknown.
- Gate the direct-install action on admin rights. The row previously stayed
enabled for read-only operators and reached a guard that silently returned.
- Route the unscanned-source warning through the native and Control UI string
catalogs instead of a hardcoded literal.
* chore(i18n): leave generated native locale artifacts to the refresh workflow
Preflight isolates generated locale output from source changes: only the native
sources and apps/.i18n/native-source.json belong in a feature commit.
* fix(skills): satisfy Android ktlint wrapping and Swift test link construction
Extract the ClawHub result action guard into a named value so the multiline
condition follows ktlint wrapping, and pass the new requestedReference field in
the OpenClawKit installed-link fixtures.
* fix(skills): preserve external install identity across clients
* test(skills): add exact refs to recommendation fixtures
---------
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
* fix(ui): fork active sessions from stable history
* fix(protocol): align active fork types
* test(ui): match main-session fork routing
* fix(sessions): unify stable fork admission
* fix(native): fork active sessions from stable history
* fix(android): fork active sessions from stable history
* style(android): simplify active fork result handling
* fix(native): preserve legacy fork transport API
* test(native): complete legacy fork transport stub
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(skills): keep ClawHub publisher identity from search through install
ClawHub search returns one entry per publisher, so several results can share a
slug. Every client collapsed the selection to that bare slug before calling
skills.detail and skills.install, and ClawHub answered 409 AMBIGUOUS_SKILL_SLUG
with no in-product way forward.
searchClawHubSkills now records the publisher-qualified reference once, on the
result that carries it, and the Gateway protocol documents it. skills.detail
parses the same reference grammar skills.install already accepted, so review and
install cannot resolve to different publishers. Control UI carries that one
reference through row actions, detail, busy state, and acknowledgement retries,
and shows it so otherwise identical rows are distinguishable.
Fixes#117633
* fix(apps): send the ClawHub publisher reference from native skill browsers
macOS, iOS, and Android read the qualified reference from search results and use
it for skills.detail, install, busy state, installed matching, and list identity,
so two publishers sharing a slug stay distinct instead of collapsing into one
ambiguous request.
* fix(skills): refuse external-source skill detail instead of reading a same-slug skill
ClawHub has no source-qualified read endpoint, so a skills-sh reference parsed
down to its bare slug would have returned a registry skill's card while install
resolved the external artifact. Review and install could name different skills.
skills.detail now fails closed on any reference that carries a source, and the
macOS and AgentPro rows show the publisher reference next to the summary instead
of only when a summary is missing, so same-slug rows stay distinguishable.
* chore(apps): refresh native i18n source baseline for the skill row references
* refactor(skills): drop the unread search-result ownerHandle field
installRef is the one reference clients send back, and no client reads the
publisher handle separately, so the protocol and Control UI carry one field
instead of two.
* fix(skills): name the next step when external skill detail is refused
Clients that gate install behind a successful review would otherwise see only a
refusal, so the error names the direct install path and the CLI equivalent.
* fix(macos): use a doc comment on the ClawHub row subtitle
swift-format's docComments rule requires doc comments on declarations; the
subtitle property carried a regular comment and failed macos-swift.
* fix(skills): carry ClawHub trust state to clients that can install
Forwarding installRef let clients install the exact publisher the operator
picked, including external skills-sh sources. It did not forward the trust
state that says ClawHub never scanned that source, so iOS AgentPro — the one
surface that installs in a single tap with no review step — could install an
unscanned artifact with nothing on screen saying so. The CLI already labels
these (docs/clawhub/cli.md, docs/cli/skills.md); native clients could not,
because trustState was never on the wire.
trustState becomes an optional field on SkillsSearchResultSchema. It is purely
additive: older clients ignore an unknown key and the field is absent for
registry results, so downgraded readers are unaffected and no protocol version
moves.
Every client that renders a search row now shows "Not scanned by ClawHub",
matching the CLI wording exactly: iOS AgentPro in the row above the install
button, macOS and Android beside the review action, and Control UI on the row
that explains why review is refused for these sources.
Covered by a wire assertion that the state reaches clients for an external
source and stays absent for registry rows, plus decode-and-label tests on the
shared Swift kit and the Android parser, and a Control UI render assertion.
* fix(ui): size the ClawHub detail dialog to a refusal message
Refusing detail for an external source made an error-only dialog reachable.
The shared preview panel reserves a tall reader height for skill documents, so
a two-line refusal rendered in a mostly empty dialog and read as broken rather
than deliberate. Found by inspecting the review captures.
* revert(ui,apps): drop the ClawHub trust label layer
Maintainer product decision: skills.sh runs its own scanners, so OpenClaw does
not add a second alert layer in the apps. Removes the label from Control UI,
iOS, macOS and Android, and drops the trustState wire field that nothing would
render. The CLI keeps its existing label; changing that is a separate call.
Publisher identity, the fail-closed detail refusal, and the message-only dialog
are unchanged. Splits the oversized skills view test file to satisfy max-lines
without a suppression.
* test(ui): fix ClawHub skill fixture checks
* chore(plugin-sdk): refresh API baseline
---------
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>
* fix(ios): forgetting a paired gateway does nothing
Confirming "Forget Gateway" in Settings never removed the gateway. The
confirmation dialog derived its isPresented binding from the payload it
later needed and cleared that payload on dismissal, so by the time the
destructive button's action ran, forgetPendingGateway() found nil at its
opening guard and returned without calling forgetGateway(stableID:).
Nothing was logged either, because the failure branch was never reached.
Hand the entry to the action through the dialog's presenting: parameter
instead of reading it back from view state, and take it as a parameter
rather than looking it up. Everything downstream is unchanged; it simply
runs now.
* Shorten the dialog comment to one line
The three-line version repeated in prose what the next line already shows.
What is worth keeping is the trap: someone simplifying this back to reading
the entry from view state reintroduces the bug.
* fix(ios): harden forget gateway payload handoff
Co-authored-by: Cihat Gündüz <anthropic@fline.dev>
* test(ios): run gateway settings source guards
* test(ios): allow forget dialog state cleanup
* test(ci): provide rg in PR review fixture
---------
Co-authored-by: Cihat Gündüz <anthropic@fline.dev>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(mobile): session dashboard screens on iOS and Android via authenticated Control UI webview
* fix(android): keep configured Control UI base path in session dashboard URL
* docs(android): note system-trust boundary of the shared Control UI webview
* fix(android): origin-only document-start rule for Control UI auth script
* chore(i18n): refresh native inventory on rebased head
* fix(ios): swiftlint closure form in session dashboard toolbar
* fix(i18n): tolerate workflow-owned pending native rows in PR alignment checks
* fix(android): KTX toUri per lint and refresh native inventory
* fix(android): ktlint import order incl. main-inherited fleet test, refresh inventory
* feat(clients): adopt model controls, session management, and keyboard history recall on iOS
* chore(i18n): translate iOS adoption strings and realign locale artifacts
* refactor(clients): drop test-only group response inits flagged by the shared dead-code intersect
* chore: retrigger ci
* chore(i18n): resync inventory after voice-unification main rebase
* chore(i18n): resync inventory after main rebase
* chore(i18n): resync inventory after main rebase
* chore(i18n): realign locale artifacts after main rebase
* fix(clients): preserve native chat API and locale copy
* fix(ios): retain public session DTO initializers
* refactor(clients): delete test-only session DTO inits flagged dead instead of suppressing
* feat(ios): mascot moods for onboarding and gateway quick setup
The activation glyph now takes a mood: the onboarding welcome step
shows the hard-hat working mascot while connecting, the success step
celebrates, and the gateway quick-setup header derives working/sad/
curious/idle from its connect state.
* fix(ios): quick-setup mood reflects app-level gateway problems too
The sheet renders two error surfaces — the local connect error and the
app-level gateway problem banner — and the mascot now goes sad for
either instead of only the sheet-local failure.
Reorder Settings -> Gateway by intent: pairing (Add Gateway with Scan QR,
setup code, discovered gateways) right below status, nav-bar QR scanner
button on the gateway route, and a Scan QR to Pair status-card hero while
nothing is paired (honoring the shared connect lock). Manual Gateway and
credentials move to the bottom. Fix setup-code Connect busy spinner to
track the whole attempt. New strings ran the full native i18n pipeline.
Closes#106013
Vyctor H. Brzezowski