Skip to content

Add hosted external catalog feed loader#95868

Merged
giodl73-repo merged 5 commits into
openclaw:mainfrom
giodl73-repo:feeds-hosted-catalog-fetch
Jun 27, 2026
Merged

Add hosted external catalog feed loader#95868
giodl73-repo merged 5 commits into
openclaw:mainfrom
giodl73-repo:feeds-hosted-catalog-fetch

Conversation

@giodl73-repo

@giodl73-repo giodl73-repo commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

Hosted Marketplace Feed Stack

This is PR2 in the hosted marketplace feed stack. The stack should land in order, with maintainer review at each step before the later PRs wire hosted marketplace data into broader user flows.

  1. Refactor external plugin catalog toward feeds #95846: refactor the bundled external plugin catalog toward the feed-shaped data model.
  2. Add hosted external catalog feed loader #95868: add the lazy hosted marketplace feed loader for the configured public feed URL, with guarded HTTPS fetch, checksum, schema, size, timeout, and bundled fallback behavior.
  3. Add hosted catalog snapshot fallback #95877: add accepted hosted snapshot fallback so a failed or unchanged hosted fetch can reuse the last valid feed payload.
  4. Persist hosted catalog snapshots in state #95964: persist hosted marketplace feed snapshots in OpenClaw state.
  5. Add hosted catalog source profile validation #95969: add marketplace source profile validation for hosted feed install candidates.
  6. Add hosted catalog config profiles #95981: add configurable marketplaces.feeds and marketplaces.sources profiles.
  7. Add marketplace feed refresh command #96155: add openclaw plugins marketplace refresh as the explicit manual snapshot refresh path.
  8. Add marketplace feed entries command #96158: add openclaw plugins marketplace entries as the explicit manual read path over hosted, snapshot, or bundled fallback entries.
  9. Add marketplace feed telemetry #96194: add marketplace feed telemetry.

The broader follow-up after this stack is to decide whether and how marketplace entries should feed install/search/startup behavior, add automatic conditional refresh using ETag / Last-Modified, or move to ClawHub producer-side validation for /v1/feeds/plugins and /v1/feeds/skills.

Journey Context

This is step 2 of the hosted OpenClaw feed path from RFC 19. #95846 made the bundled catalog feed-shaped. This PR adds the guarded hosted fetch path for that same marketplace feed, while leaving the existing synchronous bundled-catalog startup path unchanged.

What This PR Does

  • Adds an async hosted loader for the configured public marketplace feed URL.
  • Routes hosted fetches through the existing SSRF guard with HTTPS required and the allowed public feed host constrained.
  • Sends optional If-None-Match and If-Modified-Since headers so callers can perform freshness checks.
  • Reads response bodies with byte and chunk-timeout limits.
  • Keeps the network guard import lazy so bundled-catalog cold paths do not load the guarded network stack.
  • Computes sha256 metadata for the hosted response body.
  • Validates the hosted document against the feed-shaped official external plugin catalog schema.
  • Preserves live ClawHub metadata-only feed entries through hosted parsing and dedupe.
  • Falls back to the bundled catalog on network, status, checksum, size, JSON, or schema failures.
  • Leaves hosted candidate-to-install metadata synthesis out of this transport slice; Add hosted catalog source profile validation #95969 owns source-profile validation and ClawHub candidate integrity semantics.

What This PR Intentionally Does Not Do

This PR does not wire the hosted loader into startup, add persistent snapshots, add source-profile selection, interpret install.candidates[].integrity, add auth, add signed envelopes, add regional feeds, or change plugin install/search behavior. #95877 adds the loader-level last-known-good snapshot contract on top of this fetch path, and #95969 owns source-profile validation plus ClawHub checksum semantics.

How To Review

Review this as the hosted transport and validation layer. The important contract is: a hosted marketplace feed can be tried safely, but any unsafe or unusable hosted result falls back to the bundled catalog instead of changing current behavior.

Maintainer acceptance requested: this slice establishes the default ClawHub feed URL, hostname allowlist, accepted feed schema versions, checksum metadata, and bundled-fallback transport contract. It deliberately keeps install interpretation, snapshot persistence, config, and search/startup wiring in follow-up PRs.

Validation

  • pnpm exec oxfmt --check src/plugins/official-external-plugin-catalog.ts src/plugins/official-external-plugin-catalog.test.ts
  • pnpm exec oxlint --deny-warnings src/plugins/official-external-plugin-catalog.ts src/plugins/official-external-plugin-catalog.test.ts
  • git diff --check
  • CI=1 node scripts/test-projects.mjs src/plugins/official-external-plugin-catalog.test.ts (26 tests)
  • pnpm tsgo:core
  • codex review --base origin/main after the metadata-only dedupe fix: no actionable correctness issues
  • Repeated codex review --base origin/main after pushing head 76da9328af8498b99f133f8f0fe3f10f42cbee3d: no actionable correctness issues
  • Maintainer wrapper: scripts/pr review-validate-artifacts 95868, OPENCLAW_TESTBOX=1 scripts/pr prepare-gates 95868, OPENCLAW_TESTBOX=1 scripts/pr prepare-push 95868

Real Behavior Proof

Behavior or issue addressed:
The hosted catalog fetch path uses the live ClawHub plugin feed by default, accepts the live feed wrapper, preserves raw marketplace package metadata without synthesizing OpenClaw install metadata, and still falls back safely on invalid hosted responses.

Real environment tested:
Windows checkout C:\src\openclaw-prflow\.worktrees\pr-95868 at pushed head 76da9328af8498b99f133f8f0fe3f10f42cbee3d, source harness via node --import tsx, live HTTPS request to https://clawhub.ai/v1/feeds/plugins.

Exact steps or command run after this patch:

  1. node --import tsx -e "... loadHostedOfficialExternalPluginCatalogEntries({ snapshotStore: null }) ..."
  2. pnpm exec oxlint --deny-warnings src/plugins/official-external-plugin-catalog.ts src/plugins/official-external-plugin-catalog.test.ts
  3. pnpm exec oxfmt --check src/plugins/official-external-plugin-catalog.ts src/plugins/official-external-plugin-catalog.test.ts
  4. git diff --check
  5. CI=1 node scripts/test-projects.mjs src/plugins/official-external-plugin-catalog.test.ts
  6. codex review --base origin/main

Evidence after fix:

{
  "head": "76da9328af8498b99f133f8f0fe3f10f42cbee3d",
  "defaultFeedUrl": "https://clawhub.ai/v1/feeds/plugins",
  "resultSource": "hosted",
  "metadata": {
    "url": "https://clawhub.ai/v1/feeds/plugins",
    "status": 200,
    "checksum": "sha256:cf3d85c1d6ede1907ca265e9b214ac6ff1c715c90c30ec65e8017addb590e32d",
    "etag": "\"sha256:cf3d85c1d6ede1907ca265e9b214ac6ff1c715c90c30ec65e8017addb590e32d-gzip\"",
    "lastModified": "Sat, 27 Jun 2026 18:43:36 GMT"
  },
  "entryCount": 59,
  "feed": {
    "id": "clawhub-official",
    "sequence": 16,
    "schemaVersion": 1
  },
  "firstEntries": [
    {
      "id": "@expediagroup/expedia-openclaw",
      "label": "plugin",
      "npmSpec": "@expediagroup/expedia-openclaw",
      "state": "available",
      "type": "plugin"
    },
    {
      "id": "@openclaw/acpx",
      "label": "plugin",
      "npmSpec": "@openclaw/acpx",
      "state": "available",
      "type": "plugin"
    },
    {
      "id": "@openclaw/amazon-bedrock-mantle-provider",
      "label": "plugin",
      "npmSpec": "@openclaw/amazon-bedrock-mantle-provider",
      "state": "available",
      "type": "plugin"
    }
  ]
}

Observed result after fix:
The default hosted fetch accepted the live ClawHub feed as hosted, returned 59 hosted entries, preserved response checksum/validators, and left marketplace candidates as raw feed metadata so #95969 owns source-profile install interpretation.

What was not tested:
Snapshot reuse and candidate-to-install interpretation are not part of this PR. Snapshot reuse is covered by #95877; source-profile install interpretation is covered by #95969. Maintainer acceptance is still needed for the default ClawHub feed URL, hostname allowlist, schema acceptance, checksum metadata, and bundled-fallback transport contract.

@Patrick-Erichsen

Copy link
Copy Markdown
Contributor

@giodl73-repo
giodl73-repo force-pushed the feeds-hosted-catalog-fetch branch from 2acadea to f184d6d Compare June 23, 2026 16:09
@giodl73-repo

Copy link
Copy Markdown
Contributor Author

Updated this slice to use the generic marketplace endpoint Patrick suggested: https://register.openclaw.ai/official-marketplace.json. I kept the bundled fallback file name unchanged so this PR stays focused on the public hosted endpoint contract.

@clawsweeper

clawsweeper Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 27, 2026, 4:15 PM ET / 20:15 UTC.

Summary
Adds a lazy hosted external plugin catalog feed loader with guarded HTTPS fetch, schema and checksum validation, conditional request headers, size/time limits, metadata preservation, and bundled fallback behavior.

PR surface: Source +323, Tests +313. Total +636 across 2 files.

Reproducibility: not applicable. This PR adds a new hosted marketplace feed transport path rather than fixing a reproduced bug. Source inspection and the PR body's live ClawHub feed output confirm the intended after-change behavior path.

Review metrics: 1 noteworthy metric.

  • Hosted feed trust surface: 1 default URL added, 1 hostname allowlist added, 2 schema versions accepted. These constants define which remote marketplace document core can fetch and validate before later marketplace flows consume hosted data.

Stored data model
Persistent data-model change detected: database schema: src/plugins/official-external-plugin-catalog.test.ts, database schema: src/plugins/official-external-plugin-catalog.ts, vector/embedding metadata: src/plugins/official-external-plugin-catalog.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: canonical
Canonical: #95868
Summary: This PR is the canonical hosted-fetch slice in the hosted marketplace feed stack; related items are a merged prerequisite or adjacent follow-up slices rather than replacements.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Maintainer should explicitly accept or revise the default ClawHub feed host, schema versions, and bundled-fallback contract before merge.

Risk before merge

  • [P2] Merging this PR establishes a core-owned remote marketplace metadata trust boundary for clawhub.ai; SSRF guarding, HTTPS, schema checks, checksums, and bundled fallback reduce exposure, but green CI cannot decide whether that default host and schema contract should be accepted.
  • [P1] This slice intentionally lands before snapshot reuse, source-profile validation, signed envelopes, install interpretation, and startup/search wiring, so maintainers need to accept the stack order and keep those later trust layers isolated.

Maintainer options:

  1. Confirm Hosted Feed Boundary (recommended)
    Maintainers can explicitly accept clawhub.ai as the default public feed host, schema versions 1 and 2, checksum metadata, and bundled fallback as this slice's contract.
  2. Pause For Later Trust Layers
    Keep this PR paused if snapshot persistence, source-profile validation, signed-feed policy, or install interpretation should be reviewed before the hosted fetch boundary lands.
  3. Require Explicit Feed URL First
    Revise the loader to require an explicit caller-provided feed URL if maintainers do not want a core default host before the config/source-profile stack is accepted.

Next step before merge

  • [P2] The remaining action is maintainer product/security acceptance of the hosted feed boundary and stack order, not a narrow automated repair.

Security
Needs attention: Needs maintainer attention because the diff adds a default remote ClawHub feed URL and hostname allowlist for marketplace metadata; no concrete exploit was found in the guarded loader itself.

Review details

Best possible solution:

Keep this as the isolated hosted transport slice, merge only after maintainers accept the default ClawHub feed URL, hostname allowlist, schema acceptance, checksum metadata, and bundled-fallback contract, and leave install/search/startup wiring to the follow-up PRs.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this PR adds a new hosted marketplace feed transport path rather than fixing a reproduced bug. Source inspection and the PR body's live ClawHub feed output confirm the intended after-change behavior path.

Is this the best way to solve the issue?

Yes, as an isolated transport-layer slice with a maintainer decision still required. The implementation stays in the plugin catalog control-plane module, keeps the fetch guard lazy, and avoids startup/install wiring while the remaining question is acceptance of the remote feed boundary.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c52adf7505a7.

Label changes

Label justifications:

  • P2: This is normal-priority hosted marketplace infrastructure with limited immediate blast radius because it is not yet wired into startup or install behavior.
  • merge-risk: 🚨 compatibility: The PR establishes hosted feed schema, loader result, and bundled-fallback contracts that dependent marketplace snapshot, config, CLI, and install-read paths will build on.
  • merge-risk: 🚨 security-boundary: The PR adds a core-owned default remote marketplace feed URL and hostname allowlist for metadata that later flows may trust.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes current-head live output showing the loader used https://clawhub.ai/v1/feeds/plugins, returned source hosted, checksum/validator metadata, sequence 16, and 59 entries.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes current-head live output showing the loader used https://clawhub.ai/v1/feeds/plugins, returned source hosted, checksum/validator metadata, sequence 16, and 59 entries.
Evidence reviewed

PR surface:

Source +323, Tests +313. Total +636 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 1 339 16 +323
Tests 1 316 3 +313
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 2 655 19 +636

Security concerns:

  • [medium] Accept the hosted feed trust boundary — src/plugins/official-external-plugin-catalog.ts:156
    The new default feed URL and hostname allowlist let core fetch marketplace metadata from clawhub.ai; SSRF guarding, schema checks, checksums, and bundled fallback reduce exposure, but maintainers should explicitly accept this boundary before later marketplace flows trust the data.
    Confidence: 0.88

What I checked:

  • Repository policy applied: Root and scoped plugin AGENTS.md were read; the review applied the plugin-loader, lazy import, compatibility, fallback, and security-boundary guidance to this hosted marketplace feed change. (AGENTS.md:31, c52adf7505a7)
  • Current main does not implement the requested loader: Current main only lists bundled official catalog sources through listOfficialExternalPluginCatalogEntries and has no hosted loader export, default hosted feed URL, or ClawHub feed URL. (src/plugins/official-external-plugin-catalog.ts:235, c52adf7505a7)
  • Latest release does not contain the hosted loader: The latest release tag v2026.6.10 has only the v1 bundled feed schema constant and no hosted loader or default ClawHub feed URL, so this PR is not obsolete in the shipped release. (src/plugins/official-external-plugin-catalog.ts:110, aa69b12d0086)
  • PR head adds the hosted feed boundary: The PR head defines the default ClawHub feed URL, accepts feed schema versions 1 and 2, and constrains the hosted feed hostname allowlist to clawhub.ai. (src/plugins/official-external-plugin-catalog.ts:155, 76da9328af84)
  • PR head uses the guarded fetch path lazily: The hosted loader lazily imports fetchWithSsrFGuard, requires HTTPS, passes the clawhub.ai allowlist to the guard, sets redirect and timeout limits, and returns bundled fallback on fetch or validation failure. (src/plugins/official-external-plugin-catalog.ts:422, 76da9328af84)
  • Fetch guard contract checked: The guard enforces HTTP/HTTPS parsing, requireHttps, hostname policy per redirect, DNS pinning or explicit mocked-fetch policy checks, redirect limits, and safe cross-origin redirect header handling. (src/infra/net/fetch-guard.ts:414, c52adf7505a7)

Likely related people:

  • giodl73-repo: Authored and merged the current-main feed-shaped bundled catalog prerequisite at commit 4010b81, and owns the hosted marketplace feed stack around this PR. (role: feature owner and recent area contributor; confidence: high; commits: 4010b81a77f4; files: src/plugins/official-external-plugin-catalog.ts, src/plugins/official-external-plugin-catalog.test.ts, scripts/lib/official-external-plugin-catalog.json)
  • Patrick-Erichsen: Approved this PR and gave endpoint-shape feedback that the author incorporated during the hosted feed URL iteration. (role: reviewer; confidence: medium; files: src/plugins/official-external-plugin-catalog.ts)
  • Bartok: Current blame shows recent touches to this file in commit 4d9cd7d, though that commit appears adjacent rather than specific to the hosted feed work. (role: recent adjacent contributor; confidence: low; commits: 4d9cd7d22755; files: src/plugins/official-external-plugin-catalog.ts, src/plugins/official-external-plugin-catalog.test.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jun 23, 2026
@giodl73-repo

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 26, 2026
@giodl73-repo

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot added the merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. label Jun 27, 2026
@giodl73-repo
giodl73-repo marked this pull request as ready for review June 27, 2026 17:49
@giodl73-repo

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 27, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@giodl73-repo

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 27, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 27, 2026
@giodl73-repo
giodl73-repo merged commit c29e1fe into openclaw:main Jun 27, 2026
130 of 132 checks passed
@giodl73-repo

Copy link
Copy Markdown
Contributor Author

Merged via squash.

Thanks @giodl73-repo!

@giodl73-repo
giodl73-repo deleted the feeds-hosted-catalog-fetch branch June 27, 2026 20:20
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 28, 2026
Merged via squash.

Prepared head SHA: 76da932
Co-authored-by: giodl73-repo <[email protected]>
Co-authored-by: giodl73-repo <[email protected]>
Reviewed-by: @giodl73-repo
QiuYuang pushed a commit to QiuYuang/openclaw that referenced this pull request Jul 1, 2026
Merged via squash.

Prepared head SHA: 76da932
Co-authored-by: giodl73-repo <[email protected]>
Co-authored-by: giodl73-repo <[email protected]>
Reviewed-by: @giodl73-repo
chenyangjun-xy pushed a commit to chenyangjun-xy/openclaw that referenced this pull request Jul 1, 2026
Merged via squash.

Prepared head SHA: 76da932
Co-authored-by: giodl73-repo <[email protected]>
Co-authored-by: giodl73-repo <[email protected]>
Reviewed-by: @giodl73-repo
chenyangjun-xy pushed a commit to chenyangjun-xy/openclaw that referenced this pull request Jul 3, 2026
Merged via squash.

Prepared head SHA: 76da932
Co-authored-by: giodl73-repo <[email protected]>
Co-authored-by: giodl73-repo <[email protected]>
Reviewed-by: @giodl73-repo
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: L status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants