[WaterrrForever]

What

Adds a Hide retired skills step to .github/workflows/sync-skills-to-clawhub.yml. It runs the new scripts/clawhub-unlist-retired.mjs, which hides on ClawHub every name in RETIRED_SKILLS (packages/cli/src/utils/skillsManifest.ts) that is still listed under heygen-com. Each hide records that skill's retiredSkillNotice as its moderation note. With the workflow's existing dry_run input, the step only prints the names that are still listed.

Stacked on #5651. The base is miao/oss-skills-slim, so this diff shows only the ClawHub change. Retarget to main after #5651 merges.

Why

#5651 retires 14 skills. clawhub sync stops republishing them, but each one's last version stays listed and installable on ClawHub. A public clawhub inspect heygen-com/<name> --json run today returns all 14, for example general-video 1.0.28 and hyperframes-core 1.0.42.

Related work

Refs #5651

How

What ClawHub offers (clawhub@0.23.1, the version the workflow pins; its --help, its dist/, and openclaw/clawhub docs/http-api.md):

• clawhub hide <skill> [--reason] [--yes]: "Hide one of your skills". In dist/cli/commands/delete.js, cmdHideSkill is cmdDeleteSkill with different labels. Both send DELETE /api/v1/skills/{slug} with { reason, ownerHandle }, which the API docs describe as "Soft-delete / restore a skill (owner, moderator, or admin)". clawhub unhide / clawhub undelete restore it.
• GET /api/v1/skills/{slug} returns 404 "Skill not found" for a soft-deleted skill (convex/httpApiV1/skillsV1.ts). The script inspects first and hides only a skill that still resolves, so a rerun makes no hide call.
• clawhub skill merge <source> <target> also exists. It hides the source listing and keeps the old slug as a redirect to the target. This PR does not use it (see "Left for a human" below).

The script follows scripts/clawhub-sync.mjs: an injectable run, ::error:: lines, and a non-zero exit on any refusal or on an inspect failure other than not-found. It imports RETIRED_SKILLS and retiredSkillNotice straight from the TS manifest; Node 22's default type stripping handles that, because the module imports only node: built-ins. The workflow now also triggers on changes to the script and to skillsManifest.ts. Hiding is a separate step, so publishing does not depend on it.

Left for a human

• I could not tell from here which role the CLAWHUB_TOKEN account holds on the heygen-com publisher. If it is not an owner or admin, the step fails with 403/Forbidden for each name and the job goes red. Publishing still happens in the earlier step.
• An owner-initiated soft delete reserves the slug for 30 days. After that another publisher can claim the bare slug (docs/http-api.md: "Owner-initiated soft deletes reserve the slug for 30 days, then the slug can be claimed by another publisher"). Owner-scoped refs (heygen-com/<name>) are unaffected. If the bare hyperframes-* names should stay ours, run clawhub skill merge heygen-com/<name> heygen-com/hyperframes instead (media-use for hyperframes-audio). That keeps each slug as a permanent redirect, but it is a one-way owner decision, so this PR does not automate it.

Test plan

• node --import tsx --test scripts/clawhub-unlist-retired.test.mjs scripts/clawhub-sync.test.mjs → 17 tests, 17 pass. The new tests cover: hides only the listed names; a second run hides nothing; a moderation-only inspect result counts as unlisted; dry run names without hiding; an inspect error other than not-found is reported without hiding; a refused hide is reported; and end to end with a fake clawhub on PATH, all 14 manifest names print and a refusal exits 1.
• Live dry run, no credentials (config pointed at an empty scratch directory, clawhub@0.23.1 on PATH): DRY_RUN=true node scripts/clawhub-unlist-retired.mjs → exit 0 and "Retired skills still listed on ClawHub (dry run):" followed by all 14 names.
• Without DRY_RUN and with no token, every hide stops locally with Error: Not logged in. Run: clawhub login and the script exits 1. No request is sent.
• bun run lint → exit 0 (0 warnings, 0 errors)
• bunx oxfmt --check on the four changed files → "All matched files use the correct format."
• COMMENT_CHECK_BASE=origin/miao/oss-skills-slim node scripts/check-comment-citations.mjs → comments: OK (2 file(s) examined of 4 in scope); comment-ratchet.mjs → OK
• bun run test:scripts → 728 pass, 5 fail. The failures (creator-editing-recipes, generate-catalog-previews, verify-catalog-payloads) fail the same way on the feat(skills)!: publish seven knowledge skills aligned with Studio and retire the workflow skills #5651 base without this change.
• Unit tests added
• Documentation updated: not applicable

No visible change

CI and scripts only. Nothing under packages/studio or packages/player changes.

🤖 Generated with Claude Code

[jrusso1020]

Reviewed own four-file stacked diff at exact f7e7cbf8669122358151a859a92a4a89f2727e29. Rechecked the base merge: workflow, unlist script and new tests are byte-identical to a761b5b3; the package's own change adds this test to test:scripts.

The workflow runs on main pushes or manual dispatch, with read-only repository permissions and serialized runs. It introduces no pull_request/pull_request_target route, token logging or token artifact/cache. The existing Authenticate step scopes and quotes secrets.CLAWHUB_TOKEN. The script uses owner-qualified names from the retirement manifest, inspects before hiding, performs no hide in dry-run mode, and reports auth/network/refused-hide failures instead of silently succeeding.

Validation: 17 authored tests passed against current source; 11 independent malformed-output, auth/rate-limit/network/not-found and rerun controls passed. Verified all 14 unique retired names/reasons. Inspected the actual pinned clawhub@0.23.1 implementation: hide issues an owner-qualified DELETE with the supplied reason, and inspect's moderation-only result is handled. The ClawHub HTTP API documents owner/moderator/admin deletion permissions and the 30-day reservation for owner-deleted bare slugs; permanent redirects remain an owner decision, as the body discloses.

Operational requirement: a repository owner must supply or verify CLAWHUB_TOKEN for an account authorized to hide heygen-com skills. We cannot provide that secret or establish the existing account's role. A hide failure occurs after the earlier publish step and visibly fails the job. No live hide, publish or credentialed role check was performed. This approval does not clear #5651's separate blocker; land the stack in order.

Verdict: APPROVE
Reasoning: The owner-scoped, idempotent retirement step and its token boundary are sound; execution still requires the owner's correctly authorized secret.

— hf-review

The base branch was changed.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hyperframes	🟢 Ready	View Preview	Oct 21, 2026, 7:53 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[jrusso1020]

Re-reviewed exact 6f8dca2362ac53aacd703b52fe26a60740c84a31 after #5651's squash merge.

All four files and the own added/deleted patch match approved f7e7cbf8 exactly. Independently compared the manifest against current main: removing only the new scripts/clawhub-unlist-retired.test.mjs entry produces main's entire package JSON, preserving its test list and other fields. Workflow/token boundary and unlist implementation remain unchanged; the prior 17 authored tests and 11 independent controls remain applicable, not newly rerun.

The owner-permission question is resolved by Miao's explicit confirmation: the existing CLAWHUB_TOKEN was issued by WaterrrForever, owner/only member of the heygen-com publisher. No replacement secret is needed; I did not inspect it or perform a live hide/publish. Miao authorized the armed auto-merge; I did not merge or enqueue.

Verdict: APPROVE
Reasoning: The rebase preserves the reviewed ClawHub behavior and current-main test wiring; owner authorization for the existing token is now attributable.

— hf-review

[jerrai-bot-heygen]

The four-file rebase preserved the previously reviewed hide logic and retained main's complete test:scripts list plus the new test. I am holding this exact head for the function-local manifest import at scripts/clawhub-unlist-retired.mjs:62; please hoist it or obtain a separate explicit exception. Exact-head Test: skills ran successfully, but that is not the new script test, and other CI jobs remained in progress at review time. Approval, merge, and external ClawHub hide are separate decisions. — Jerrai

[jerrai-bot-heygen]

Please move this import to module scope. main() performs a function-local import(manifest.href), which conflicts with the team's no-local-import rule; the new test already statically imports this same manifest at module scope. The #5069 deferred-import exception was explicitly scoped to that PR and does not apply here. If eager loading has a concrete runtime problem, we need a separate explicit exception rather than carrying this one forward.

[github-actions]

Edit accuracy: accurate 271 (base branch 271), smooth 150 of those

The gate passes.
Smoothness is reported in the artifact, not gated. A case fails only if it fails 2 of 3 runs.

Quarantined, measured but not gated (0)

Unstable (1)

• seqheldtwice-tlhold-px-r0-root-z100: tracking 59.92, pressJump 0.11, drop 0.35, reload 0.35, render 0.02, renderKey -, undo true, teleport true / tracking 0.08, pressJump 0.11, drop 0.35, reload 0.35, render 0.02, renderKey -, undo true, teleport true / tracking 0.08, pressJump 0.11, drop 0.35, reload 0.35, render 0.02, renderKey -, undo true, teleport true

[jrusso1020]

Re-reviewed exact 2f867fc0a41126c8c78c1bf43a4b569842291749, including Jerrai's function-local-import request.

The sole follow-up hoists RETIRED_SKILLS/retiredSkillNotice to a static module import and removes unnecessary async/await from main. Workflow, test-list wiring and hide logic are otherwise unchanged. Plain Node 22 loads the manifest successfully; all 17 authored sync/unlist tests executed green, including the fake-CLI subprocess and refusal exit-code coverage.

Earlier token/privacy/idempotency review remains applicable. Existing-token ownership is attributable to Miao's confirmation. No live hide, publish, merge or enqueue by me; Miao's auto-merge authorization stands.

Verdict: APPROVE
Reasoning: The import concern is resolved without changing the reviewed behavior, and the workflow's Node runtime executes the tests successfully.

— hf-review

[jerrai-bot-heygen]

Re-reviewed the one-commit successor at exact 2f867fc0a41126c8c78c1bf43a4b569842291749 against my prior local-import hold. RETIRED_SKILLS and retiredSkillNotice now load through a static module-scope import; main is synchronous, and the node scripts/clawhub-unlist-retired.mjs workflow entry remains guarded by the same import.meta.url check. The imported TS manifest uses only Node built-ins at module scope, and the workflow pins Node 22; no user credential is read or registry hide invoked merely by importing it. The prior four-file ClawHub inspect/hide, dry-run and error behavior was reviewed at the earlier head and is otherwise unchanged. Rames independently reported a plain Node 22 load plus 17 focused tests, which I did not run myself.

At click time current-head Format and Comments executed green; Test (support) and other hosted checks were still running, not claimed passed. Author-owned auto-merge is armed; Miao previously explicitly authorized that state for this same #5656 review in the owning thread. This is a code approval only: I did not manually merge, publish, hide skills on ClawHub, or run the workflow. The token's ClawHub publisher permissions and bare-slug reservation/redirect choice remain deployment/product decisions disclosed in the PR. — Jerrai