[duharry0915]

What was broken

The three-target 0.2.2 package from #16 (35.7 MiB unpacked, 13.4 MB tarball) cannot be published to ClawHub. With a ClawHub CLI built from source (which uses staged uploads), the upload URL and storage upload succeed, then POST /api/v1/packages returns a bare {"code":"[Request ID: …] Server Error"} 500. That happened six times per run, across three runs, and continued after my account was added to the agentmail publisher. ClawHub still shows 0.2.1, and the publication endpoint reports 0.2.2 as absent, so the version number is still free.

Why (from openclaw/clawhub source):

• The publish handler converts every error it throws to a 400, or a 503 for write contention. A bare Convex 500 only appears when the action itself dies.
• The tarball is parsed inside the Convex HTTP action, which has a 64 MiB memory limit, before any ownership check. Peak memory is roughly tarball + 2× unpacked, because both gunzipBounded and parseTarEntries copy the data: about 88 MB for our package, versus about 30 MB for 0.2.1.
• The largest package ClawHub has ever accepted is about 24 MB unpacked (@openclaw/matrix). Two targets (about 25.7 MB) would have no margin.

ClawHub advertises a 50 MiB limit, but in practice it is far lower.

What changed

• One bundled target: only darwin-arm64 ships, the same as 0.2.1. The package is 12.6 MB unpacked, 4,476,551 bytes packed (0.2.1: 4,476,974), 76 files.
  • Mac users keep a working CLI skill.
  • Linux users never had a working CLI from ClawHub; they now get the "not bundled, install from releases" message from Bundle three CLI targets so 0.2.2 fits ClawHub's package size limit #16 instead of Exec format error.
  • The email channel, which carries the SecretRef fix, works on every platform.
• Realistic size guard: pack:verify now enforces CLAWHUB_PUBLISHABLE_UNPACKED_BYTES (20 MiB) instead of the advertised 50 MiB, which let an unpublishable package pass. It now rejects the three-target tarball.
• README: documents the single bundled target and the real limit, and notes that clawhub 0.23.3 from npm sends tarballs up to 18 MiB inline, while clawhub.ai rejects request bodies over 4.5 MB with 413. Use a CLI that includes fix: ClawPack publishes over 4.5 MB fail with 413 through clawhub.ai openclaw/clawhub#3584.

Verification

• npm test: 241 passed.
• From a clean vendor/: plugin:check, plugin:validate, and pack:verify (both modes) pass.
• The tarball contains dist/secret-contract-api.js and vendor/agentmail/darwin-arm64/agentmail.

Next

• After merge, publish 0.2.2 from the merge commit using the staged-upload CLI.
• A follow-up 0.2.3 should stop bundling executables: download and checksum-verify the current platform's CLI on first use, into a writable cache. That covers all eight targets with a package of about 1 MB. scripts/prepare-agentmail-cli.mjs already has the download, checksum, and atomic-rename logic.
• Report the publish OOM to openclaw/clawhub with the Request IDs.

🤖 Generated with Claude Code