antenna-openclaw-plugin 1.3.40 → 1.3.42

package/README.md

@@ -83,6 +83,8 @@ Supabase
 └── pg_cron cleanup        — hourly expired match cleanup
 ```
 
+Profile writes require the user's Antenna API key from antenna.fyi/me. Agents must pass `api_key` to `antenna_profile(action="set")`; the plugin verifies it and writes to the dashboard-linked `user:<uuid>` profile instead of creating a profile from `channel:sender_id`.
+
 ## Supported platforms
 
 Location auto-detection (OpenClaw parses the coordinates):

package/index.ts

@@ -1,5 +1,6 @@
 import { createClient, SupabaseClient } from "@supabase/supabase-js";
 import { execSync } from "child_process";
+import { createHash } from "crypto";
 
 // ─── Built-in Supabase config (shared backend, zero config) ─────────
 
@@ -72,6 +73,28 @@ function getSupabase(cfg: AntennaConfig): SupabaseClient {
   return _supabaseClient;
 }
 
+function profileSlugCandidate(displayName: string | null | undefined, deviceId: string) {
+  const fromName = String(displayName || "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-|-$/g, "")
+    .substring(0, 30);
+  if (fromName) return fromName;
+  return `user-${createHash("sha1").update(deviceId).digest("hex").slice(0, 10)}`;
+}
+
+async function resolveDashboardDeviceId(supabase: SupabaseClient, apiKey: string | null | undefined) {
+  if (!apiKey) {
+    return { error: "Profile writes require the user's Antenna API key from antenna.fyi/me. Do not create an agent-only profile from sender_id/channel." };
+  }
+  const { data, error } = await supabase.rpc("verify_api_key", { p_key: apiKey });
+  if (error) return { error: error.message };
+  if (!data?.valid) return { error: data?.error || "Invalid Antenna API key" };
+  const deviceId = data.user_id ? `user:${data.user_id}` : data.device_id;
+  if (!deviceId) return { error: "API key verified but did not return a dashboard device_id" };
+  return { deviceId, userId: data.user_id, displayName: data.display_name };
+}
+
 function isRateLimited(deviceId: string): boolean {
   const now = Date.now();
   const last = _lastScanTime.get(deviceId);
@@ -420,13 +443,14 @@ export default function register(api: any) {
         line3: { type: "string", description: "Third line (what you're looking for)" },
         visible: { type: "boolean", description: "Whether to be visible to others" },
         matching_context: { type: "string", description: "More information / free-form context for AI matching (interests, goals, background, etc.)" },
+        api_key: { type: "string", description: "Required for action='set': user's Antenna API key from antenna.fyi/me. Profile writes use the dashboard-linked user:<uuid> profile." },
       },
       required: ["action", "sender_id", "channel", "chat_id"],
     },
     async execute(_id: string, params: any) {
       const cfg = getConfig(api);
       const supabase = getSupabase(cfg);
-      const deviceId = deriveDeviceId(params.sender_id, params.channel, params.chat_id);
+      let deviceId = deriveDeviceId(params.sender_id, params.channel, params.chat_id);
 
       if (params.action === "get") {
         const { data, error } = await supabase.rpc("get_profile", { p_device_id: deviceId });
@@ -440,12 +464,17 @@ export default function register(api: any) {
         });
       }
 
+      const resolved = await resolveDashboardDeviceId(supabase, params.api_key);
+      if (resolved.error) return ok({ error: resolved.error });
+      deviceId = resolved.deviceId!;
+
       const { data, error } = await supabase.rpc("upsert_profile", {
         p_device_id: deviceId,
         p_display_name: params.display_name ?? null, p_emoji: params.emoji ?? null,
         p_line1: params.line1 ?? null, p_line2: params.line2 ?? null,
         p_line3: params.line3 ?? null, p_visible: params.visible ?? true,
         ...(params.matching_context != null ? { p_matching_context: params.matching_context } : {}),
+        p_api_key: params.api_key,
       });
 
       if (error) return ok({ error: error.message });
@@ -455,8 +484,14 @@ export default function register(api: any) {
       let archetypeResult = null;
       try {
         const { data: profile } = await supabase.rpc("get_profile", { p_device_id: deviceId });
-        if (profile?.profile_slug) {
-          publicUrl = `https://www.antenna.fyi/p/${profile.profile_slug}`;
+        let profileSlug = profile?.profile_slug || null;
+        if (!profileSlug) {
+          const targetSlug = profileSlugCandidate(params.display_name, deviceId);
+          const { data: slugResult } = await supabase.rpc("set_profile_slug", { p_device_id: deviceId, p_slug: targetSlug, p_api_key: params.api_key });
+          if (slugResult?.set) profileSlug = targetSlug;
+        }
+        if (profileSlug) {
+          publicUrl = `https://www.antenna.fyi/p/${profileSlug}`;
         }
       } catch {}
 
@@ -502,8 +537,10 @@ export default function register(api: any) {
         profile: { display_name: data.display_name,
           line1: data.line1, line2: data.line2, line3: data.line3, visible: data.visible },
         public_url: publicUrl,
+        api_key_verified: true,
+        dashboard_device_id: deviceId,
         archetype: archetypeResult || null,
-        next_step: "IMPORTANT: 1) Send the public_url to the user — this is their shareable profile link. 2) Tell the user their archetype and the personalized reason. 3) Call antenna_bind to generate a GPS link. Do not skip any step.",
+        next_step: "IMPORTANT: 1) Send the public_url to the user — this is their shareable profile link. If public_url is null, say profile link generation failed and retry profile save. 2) Tell the user their archetype and the personalized reason. 3) Call antenna_bind to generate a GPS link. Do not skip any step.",
       });
     },
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "antenna-openclaw-plugin",
-  "version": "1.3.40",
+  "version": "1.3.42",
   "description": "Antenna — agent-mediated nearby people discovery for OpenClaw",
   "openclaw": {
     "extensions": [

package/skills/antenna/SKILL.md

@@ -25,6 +25,8 @@ Plugin 安装后,agent 应该**主动**开始引导,不要等用户问"怎么用
 **第一步:打招呼 + 解释**
 > "嘿,你装了 Antenna--它能帮你发现附近有意思的人。先确认一下,你在 antenna.fyi 注册过了吗?拿到 API key 了吗?有了的话我帮你做张名片,然后看看附近有谁。"
 
+**硬约束:** Profile 写入必须通过用户从 antenna.fyi/me 拿到的 API key。`antenna_profile(action="set")` 必须传 `api_key`，tool 会验证 key 并写入 dashboard 绑定的 `user:<uuid>` profile。不要自己拼 `channel:sender_id`，不要在用户拿到 API key 前凭空创建 profile。
+
 **第二步:聊天收集 → 生成名片 → 确认**
 
 Agent 跟用户聊几句,了解他们是谁、做什么、对什么感兴趣、想认识什么人。然后 agent 自己完成以下工作(不需要用户参与):
@@ -40,7 +42,7 @@ Agent 跟用户聊几句,了解他们是谁、做什么、对什么感兴趣、
 >
 > 这样可以吗?要改哪里告诉我。
 
-用户确认后才调 `antenna_profile(action="set")` 保存(matching_context + line1/2/3 + emoji + name 一起存)。
+用户确认后才调 `antenna_profile(action="set", api_key="ant_xxx")` 保存(matching_context + line1/2/3 + emoji + name 一起存)。
 用户要改 → 改完重新预览 → 再确认。
 
 **不要跳过确认。名片是展示给别人看的,必须让用户看过才存。**
@@ -159,7 +161,8 @@ After receiving the nearby profiles, **you decide** who to recommend:
 View or update the user's name card.
 - `action`: "get" or "set"
 - `sender_id`, `channel`: from context
-- For "set": `display_name`, `emoji`, `line1`, `line2`, `line3`, `visible`, `matching_context`
+- For "set": `api_key`, `display_name`, `emoji`, `line1`, `line2`, `line3`, `visible`, `matching_context`
+- `api_key` is mandatory for writes. It must be the user's Antenna API key from antenna.fyi/me. The tool writes to the dashboard-linked `user:<uuid>` profile; do not create profiles from `sender_id/channel`.
 
 The name card has:
 - **emoji**: a single emoji that represents them
@@ -172,6 +175,10 @@ The name card has:
 **During onboarding, generate `matching_context` FIRST** based on your conversation with the user (+ memory, SOUL.md, etc.). Then derive line1/2/3 from it. Don't ask the user to write matching_context - you write it. Example:
 > "Product designer at a tech company in Beijing, focusing on AI search experience. Interested in music (Sakamoto), swimming, cooking, language learning. Recently exploring AI agent ecosystems and social discovery. Looking to connect with AI builders, indie hackers, and creative technologists."
 
+After setting a profile, the tool returns `public_url`. **You must immediately send that link to the user** as their shareable public profile. If `public_url` is empty, retry profile save or report that link generation failed.
+
+**i18n:** Save and show user-written profile content in the user's original language. Do not machine-translate their personal description, looking-for text, or conversation style. Antenna UI labels can switch language; the user's own text stays as written.
+
 ### `antenna_accept`
 Accept a match after the user sees results. Can optionally include contact info to share.
 - `sender_id`, `channel`, `target_device_id`