antenna-openclaw-plugin 1.3.41 → 1.3.43

package/README.md

@@ -83,6 +83,8 @@ Supabase
 └── pg_cron cleanup        — hourly expired match cleanup
 ```
 
+Profile writes require the user's Antenna API key from antenna.fyi/me. Agents must pass `api_key` to `antenna_profile(action="set")`; the plugin verifies it and writes to the dashboard-linked `user:<uuid>` profile instead of creating a profile from `channel:sender_id`.
+
 ## Supported platforms
 
 Location auto-detection (OpenClaw parses the coordinates):

package/index.ts

@@ -83,6 +83,18 @@ function profileSlugCandidate(displayName: string | null | undefined, deviceId:
   return `user-${createHash("sha1").update(deviceId).digest("hex").slice(0, 10)}`;
 }
 
+async function resolveDashboardDeviceId(supabase: SupabaseClient, apiKey: string | null | undefined) {
+  if (!apiKey) {
+    return { error: "Profile writes require the user's Antenna API key from antenna.fyi/me. Do not create an agent-only profile from sender_id/channel." };
+  }
+  const { data, error } = await supabase.rpc("verify_api_key", { p_key: apiKey });
+  if (error) return { error: error.message };
+  if (!data?.valid) return { error: data?.error || "Invalid Antenna API key" };
+  const deviceId = data.user_id ? `user:${data.user_id}` : data.device_id;
+  if (!deviceId) return { error: "API key verified but did not return a dashboard device_id" };
+  return { deviceId, userId: data.user_id, displayName: data.display_name };
+}
+
 function isRateLimited(deviceId: string): boolean {
   const now = Date.now();
   const last = _lastScanTime.get(deviceId);
@@ -431,13 +443,14 @@ export default function register(api: any) {
         line3: { type: "string", description: "Third line (what you're looking for)" },
         visible: { type: "boolean", description: "Whether to be visible to others" },
         matching_context: { type: "string", description: "More information / free-form context for AI matching (interests, goals, background, etc.)" },
+        api_key: { type: "string", description: "Required for action='set': user's Antenna API key from antenna.fyi/me. Profile writes use the dashboard-linked user:<uuid> profile." },
       },
       required: ["action", "sender_id", "channel", "chat_id"],
     },
     async execute(_id: string, params: any) {
       const cfg = getConfig(api);
       const supabase = getSupabase(cfg);
-      const deviceId = deriveDeviceId(params.sender_id, params.channel, params.chat_id);
+      let deviceId = deriveDeviceId(params.sender_id, params.channel, params.chat_id);
 
       if (params.action === "get") {
         const { data, error } = await supabase.rpc("get_profile", { p_device_id: deviceId });
@@ -451,16 +464,22 @@ export default function register(api: any) {
         });
       }
 
+      const resolved = await resolveDashboardDeviceId(supabase, params.api_key);
+      if (resolved.error) return ok({ error: resolved.error });
+      deviceId = resolved.deviceId!;
+
       const { data, error } = await supabase.rpc("upsert_profile", {
         p_device_id: deviceId,
         p_display_name: params.display_name ?? null, p_emoji: params.emoji ?? null,
         p_line1: params.line1 ?? null, p_line2: params.line2 ?? null,
         p_line3: params.line3 ?? null, p_visible: params.visible ?? true,
         ...(params.matching_context != null ? { p_matching_context: params.matching_context } : {}),
-        p_api_key: null,
+        p_api_key: params.api_key,
       });
 
       if (error) return ok({ error: error.message });
+      if (data?.error) return ok({ error: data.message || data.error });
+      if (data?.device_id) deviceId = data.device_id;
 
       // Read back profile to get slug for public page link
       let publicUrl = null;
@@ -470,7 +489,7 @@ export default function register(api: any) {
         let profileSlug = profile?.profile_slug || null;
         if (!profileSlug) {
           const targetSlug = profileSlugCandidate(params.display_name, deviceId);
-          const { data: slugResult } = await supabase.rpc("set_profile_slug", { p_device_id: deviceId, p_slug: targetSlug, p_api_key: null });
+          const { data: slugResult } = await supabase.rpc("set_profile_slug", { p_device_id: deviceId, p_slug: targetSlug, p_api_key: params.api_key });
           if (slugResult?.set) profileSlug = targetSlug;
         }
         if (profileSlug) {
@@ -520,6 +539,8 @@ export default function register(api: any) {
         profile: { display_name: data.display_name,
           line1: data.line1, line2: data.line2, line3: data.line3, visible: data.visible },
         public_url: publicUrl,
+        api_key_verified: true,
+        dashboard_device_id: deviceId,
         archetype: archetypeResult || null,
         next_step: "IMPORTANT: 1) Send the public_url to the user — this is their shareable profile link. If public_url is null, say profile link generation failed and retry profile save. 2) Tell the user their archetype and the personalized reason. 3) Call antenna_bind to generate a GPS link. Do not skip any step.",
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "antenna-openclaw-plugin",
-  "version": "1.3.41",
+  "version": "1.3.43",
   "description": "Antenna — agent-mediated nearby people discovery for OpenClaw",
   "openclaw": {
     "extensions": [

package/skills/antenna/SKILL.md

@@ -25,6 +25,8 @@ Plugin 安装后,agent 应该**主动**开始引导,不要等用户问"怎么用
 **第一步:打招呼 + 解释**
 > "嘿,你装了 Antenna--它能帮你发现附近有意思的人。先确认一下,你在 antenna.fyi 注册过了吗?拿到 API key 了吗?有了的话我帮你做张名片,然后看看附近有谁。"
 
+**硬约束:** Profile 写入必须通过用户从 antenna.fyi/me 拿到的 API key。`antenna_profile(action="set")` 必须传 `api_key`，tool 会验证 key 并写入 dashboard 绑定的 `user:<uuid>` profile。不要自己拼 `channel:sender_id`，不要在用户拿到 API key 前凭空创建 profile。
+
 **第二步:聊天收集 → 生成名片 → 确认**
 
 Agent 跟用户聊几句,了解他们是谁、做什么、对什么感兴趣、想认识什么人。然后 agent 自己完成以下工作(不需要用户参与):
@@ -40,7 +42,7 @@ Agent 跟用户聊几句,了解他们是谁、做什么、对什么感兴趣、
 >
 > 这样可以吗?要改哪里告诉我。
 
-用户确认后才调 `antenna_profile(action="set")` 保存(matching_context + line1/2/3 + emoji + name 一起存)。
+用户确认后才调 `antenna_profile(action="set", api_key="ant_xxx")` 保存(matching_context + line1/2/3 + emoji + name 一起存)。
 用户要改 → 改完重新预览 → 再确认。
 
 **不要跳过确认。名片是展示给别人看的,必须让用户看过才存。**
@@ -159,7 +161,8 @@ After receiving the nearby profiles, **you decide** who to recommend:
 View or update the user's name card.
 - `action`: "get" or "set"
 - `sender_id`, `channel`: from context
-- For "set": `display_name`, `emoji`, `line1`, `line2`, `line3`, `visible`, `matching_context`
+- For "set": `api_key`, `display_name`, `emoji`, `line1`, `line2`, `line3`, `visible`, `matching_context`
+- `api_key` is mandatory for writes. It must be the user's Antenna API key from antenna.fyi/me. The tool writes to the dashboard-linked `user:<uuid>` profile; do not create profiles from `sender_id/channel`.
 
 The name card has:
 - **emoji**: a single emoji that represents them