* feat(skill-hub): add Skill Hub catalog, publish flow, and lite materialize pipeline
Introduce Skill Hub for browsing, importing, publishing, and installing skills, with lite instance package materialization and runtime sync support.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(skill-hub): remove token-governance hooks from Skill Hub PR
Strip validateManagedRuntimeEnvironmentOverrides, network lock policy sync,
and egress proxy audit wiring that belong to the upcoming token-usage work,
so the Skill Hub branch compiles independently.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(skill-hub): update migration number in materialize docs
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(skill-hub): make RuntimeAgentClient test stub and hub tests compile-safe
Add ResyncInstanceSkills to the runtime pool handler fake client, and harden
skill hub payload helpers/tests against nil storage/instance repos so go test passes.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: add Skill Hub hardening with session usage tracking and egress governance
Unify Skill Hub runtime sync improvements with session-token observability,
egress network policy, and admin/instance usage reporting for reopenable PR.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(skill-hub): repair CI tests and nested skill install
* fix(ci): restore release deployment configuration
---------
Co-authored-by: heshengran <heshengran@ieisystem.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: ignore local agency and team snapshots
* feat: add team agent profile templates
* KANBAN
* template
* prototype
* Fix tenant runtime pool deployment
* Fix local team profiles runtime override
* Update local team profiles testing guide
* Adapt local team profiles test deployment
* Patch tenant NFS server to ClusterIP
* Use NFS export root for workspace mounts
* Tighten team task completion projection
* Fix team event body map comparison
* before modification
* temp_peer1
* leadermodel
* team_fix
* fix(team): harden workflow completion and workspace handling
* fix(team): harden redis workflow protocol
* discord link updated
* chore: checkpoint team workflow fixes
* fix: stabilize leader kanban ledger
* fix: coalesce leader mediated work items
* fix: confirm leader-mediated member results
* fix: harden leader mediated team state
* fix: stabilize team shared runtime state
* Fix team task reconciliation and create flow
* fix: stabilize leader mediated team orchestration
* fix: refine team workspace presentation
* checkpoint: persist team workflow ledger fixes
* fix: reconcile team workflow delivery state
* fix: preserve meaningful team chat events
* docs: add team workspace quick guides
* chore: ignore local team deployment files
* fix: preserve setgid on team shared directories
* chore: ignore local agency and team snapshots
* feat: add team agent profile templates
* KANBAN
* template
* prototype
* Fix tenant runtime pool deployment
* Fix local team profiles runtime override
* Update local team profiles testing guide
* Adapt local team profiles test deployment
* Patch tenant NFS server to ClusterIP
* Use NFS export root for workspace mounts
* Tighten team task completion projection
* Fix team event body map comparison
* before modification
* temp_peer1
* leadermodel
* team_fix
* fix(team): harden workflow completion and workspace handling
* fix(team): harden redis workflow protocol
- Add APIs for batch creating and deleting Lite instances
- Support Lite batch create, selection, and delete flows in the instance list
- Fix Lite OpenClaw/Hermes workspace initial paths and skill directory paths
- Hide transient skill temp directories from workspace browsing
- Preserve runtime query tokens when stripping ClawManager desktop access tokens
- Add an available-skills endpoint for instances with actor-aware filtering
- Persist gateway token, agent bootstrap token, and OpenClaw config snapshots for Lite instances
- Inject agent and OpenClaw bootstrap env into gateway runtimes
- Materialize and remove Lite instance skills in the workspace filesystem
- Improve instance detail skill upload, bulk attachment, workspace refresh, and layout syncing
- Support multi-select skill attachment and show risk-policy filtering hints
- Mark instance skills as removed after successful uninstall commands
- Sync skill removal state when related workspace files are deleted
- Hide removed skills and avoid reactivating them from agent inventory reports
- Clear proxy-scoped OpenClaw control storage to prevent cross-instance state leakage
- Add leader election to avoid duplicate sync and Team event consumers
- Proxy desktop traffic directly from nginx to instance Services to reduce load during concurrent viewers
- Add desktop stream profiles with low / standard / high options
- Limit hostPath PV fallback to manual storageClass only
Add cursor-based GET /teams/:id/tasks and GET /teams/:id/events APIs.
Team detail page loads older messages on scroll/click and deduplicates
collaboration chat messages with improved thread ordering.
- Add migrations plus Team/Member/Task/Event APIs; Redis Streams consumer projects inbox/events into DB as source of truth
- Inject Team Secret (Redis URL, team token) via envFrom; shared RWX PVC at /team; sync ConfigMap roster to /team/team.json
- Create member Pods through InstanceService; extend K8s (PVC/Secret/Pod/ConfigMap); stale-task sweep and Team/member deletion with cleanup
- Add /teams, /teams/new, /teams/🆔 creation wizard (roster, presets, shared env/OpenClaw plan), per-member desktops, collaboration timeline, debug dispatch (defaults to Leader when target omitted)
- add configurable /dev/shm mounts for instance pods with a bounded SHM_SIZE_GB override
- introduce pod security modes and use chromium-compat for OpenClaw instead of privileged
- keep privileged mode only as an explicit admin fallback
- remove the node-level clawmanager-node-tuner manifest to avoid changing host security defaults
- fix k3s HTTPS and API/proxy service port mappings
- add tests for SHM parsing and pod security mode behavior
Address three HIGH-severity issues from the memory-leak and bloat
analysis (issue #56).
1. Graceful shutdown (main.go)
- Replace gin's r.Run() with an explicit http.Server so the process
can intercept SIGINT / SIGTERM.
- On signal: drain active HTTP requests (10 s timeout), then stop
SyncService, WebSocket Hub, and InstanceAccessService cleanup
goroutine in order.
- Ensures database connections, K8s watchers, and background loops
are released cleanly on deploy or restart.
2. WebSocket Hub init race (websocket_service.go)
- GetHub() used a bare nil-check with no synchronisation; two
goroutines could each create a Hub and start a Run() loop.
- Replaced with sync.Once to guarantee exactly one Hub instance.
- Added a stop channel to Hub.Run() so the hub can be shut down
gracefully, closing all connected clients.
3. InstanceAccessService goroutine leak (instance_access_service.go)
- cleanupExpiredTokens() looped on ticker.C with no exit path,
leaking the goroutine for the lifetime of the process.
- Added a stopChan; cleanupExpiredTokens now selects on both the
ticker and the stop signal.
- Exposed Stop() on the service; InstanceHandler.Shutdown() calls
it during graceful shutdown.
Tests:
- TestGetHubReturnsSameInstance: singleton guarantee
- TestGetHubConcurrentAccess: 50-goroutine race test
- TestHubStopClosesClients: verifies client cleanup on Stop()
- TestInstanceAccessServiceStopTerminatesCleanup: Stop() is safe and
the service remains functional for token ops afterward
All existing tests continue to pass; full project build and regression
verified.
Ref: #56
Summary
-------
Logging in as an admin and navigating to Workspace → My Instances
returned every instance in the cluster instead of the admin's own.
Role was overloaded to both widen the admin console surface AND
widen the self-scoped list endpoint, so the workspace view broke
the owner-isolation contract users expect.
Root cause
----------
`InstanceService.GetVisibleInstances(userID, role, ...)` branched
on role: admin callers fell through to `instanceRepo.GetAll`,
non-admin callers fell through to `GetByUserID`. The single
`GET /instances` handler passed the caller's role into that
function, so the same URL meant "my instances" for users and
"every instance in the system" for admins.
Fix
---
Split the two views at the API surface, not inside the service:
- `GET /instances` is now always caller-scoped. The handler calls
`GetByUserID` unconditionally and never reads the caller's role.
- `GET /admin/instances` is a new route, gated by the existing
admin middleware trio (`Auth` + `SetUserInfo` + `NewAdminAuth`).
It calls a new `InstanceService.GetAllInstances` that does not
look at any userID.
- `GetVisibleInstances` is removed; nothing else in the codebase
called it.
Frontend follows: `AdminDashboard` and `InstanceManagementPage`
switch to a new `adminInstanceService.getInstances()` that hits
`/admin/instances`. Per-instance admin actions (start, stop,
delete, proxy, etc.) are intentionally out of scope for this PR
and continue to use the existing endpoints.
Tests
-----
Two new service tests in `instance_visibility_test.go`:
- `TestGetByUserIDFiltersByCaller` pins the workspace contract:
regardless of how many admins or other users exist, a caller
only ever sees their own instances through this path.
- `TestGetAllInstancesReturnsEveryUser` covers the admin-console
path, including pagination.
`go build ./...`, `go test ./...`, and `npm run build` all pass.
Scope note
----------
This PR fixes the listing leak only. Per-instance handlers in
`instance_handler.go` retain their existing inline role checks
and will be audited separately.
Background
This update focuses on three areas:
- Improve model onboarding capabilities by supporting unified configuration across multiple model service platforms
- Optimize the AI audit detail page to improve trace troubleshooting and readability
- Upgrade the OpenClaw runtime image and automatically enable the Gateway after instance startup
Changes
1. Support multiple model service platforms
- Introduce a vendor template mechanism for model onboarding, allowing quick selection of different model service platforms through a searchable dropdown
- Preconfigure fixed `base_url` values for common platforms to reduce manual input and configuration errors
- Support custom `base_url` for `Local / Internal`, compatible with local gateways, internal proxies, and self-hosted compatible services
- Add vendor icons to improve recognizability on the model configuration page
- Optimize the model creation experience so newly created cards appear at the top, making them easier to find when many models exist
- Optimize provider model discovery logic to support OpenAI-compatible services with non-standard version paths
2. Optimize the AI audit detail page
- Rework the trace detail layout to improve information hierarchy and readability
- Change audit timestamps to a combined relative + absolute format for more intuitive troubleshooting
- Add an execution flow view so the full process can be inspected by execution node
- Add a minimap to quickly locate execution nodes and keep navigation aligned with detail scrolling
- Remove duplicated or low-value information blocks to simplify the trace detail experience
- Optimize status rendering and failure reason unwrapping to prevent error payloads from polluting the status field
3. Upgrade the OpenClaw image and automatically enable the Gateway
- Upgrade the default OpenClaw runtime image to the new image address
- Automatically initialize and enable the Gateway when the new image starts, reducing manual instance-side operations
- Update the system default image configuration and add migration logic for existing default values
heranran