clawgram 2.31.0 → 2.31.1

package/README.md

@@ -958,6 +958,39 @@ npm run clawgram-cli:auth
 
 ## Releases
 
+The **Release** workflow uses npm [trusted publishing](https://docs.npmjs.com/trusted-publishers/)
+through GitHub OIDC. npm issues short-lived credentials per run; `NPM_TOKEN` is
+not used. One-time setup in the npm package's **Settings → Trusted publishing**:
+
+| Field | Value |
+|---|---|
+| Provider | GitHub Actions |
+| Organization/user | `d3pre5s` |
+| Repository | `clawgram` |
+| Workflow filename | `release.yml` |
+| Environment | `npm-publish` |
+| Allowed actions | Enable `npm publish` |
+
+Complete the first real publish within two days of creating the trust. A dry
+run does not validate OIDC. After a successful OIDC release, revoke the old npm
+publishing token and remove its unused GitHub secret.
+
+npm and ClawHub run as separate jobs, with release writes serialized. Re-running
+a release skips an existing npm version only if its `gitHead` matches the release
+commit. If npm succeeds but ClawHub fails, run **Release** from `main` with
+`clawhub_only=true` and `release_tag` set to the existing tag. Recovery uses current
+release safeguards with the original tag's code, builds and tests it, and never
+publishes to npm. Manual runs without this option build, test and run
+`npm pack --dry-run`, which also works when the version already exists on npm.
+
+ClawHub still uses `CLAWHUB_TOKEN` for tag releases: its OIDC path currently only
+supports `workflow_dispatch` via its official reusable workflow. Explicit rate
+limits are retried up to four times. An existing pending release is polled without
+another upload, for up to 30 minutes. Success requires public availability and a
+matching source commit; failed scans, auth errors and timeouts remain failures.
+Login checks and dry runs also retry transient network failures; an ambiguous
+upload failure does not trigger another upload.
+
 Every push and pull request is built and tested on Node 22 and 24. Releases are cut by pushing a
 `v<version>` tag: CI then builds from a clean checkout and publishes to npm with
 [provenance](https://docs.npmjs.com/generating-provenance-statements), so each published tarball is

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "clawgram",
-  "version": "2.31.0",
+  "version": "2.31.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clawgram",
-      "version": "2.31.0",
+      "version": "2.31.1",
       "license": "MIT",
       "dependencies": {
         "json5": "2.2.3",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "clawgram",
   "name": "Clawgram",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
-  "version": "2.31.0",
+  "version": "2.31.1",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawgram",
-  "version": "2.31.0",
+  "version": "2.31.1",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
   "main": "./dist/index.js",
   "scripts": {
@@ -8,7 +8,7 @@
     "verify:actions": "node scripts/verify/action-probe.cjs",
     "build": "tsc -p tsconfig.json",
     "build:test": "tsc -p tsconfig.test.json",
-    "test": "node scripts/check-pii.mjs && npm run build:test && node test/ensure-compiled.mjs && node --test \"dist-test/test/*.test.js\"",
+    "test": "node scripts/check-pii.mjs && npm run build:test && node test/ensure-compiled.mjs && node --test \"dist-test/test/*.test.js\" \"test/*.test.mjs\"",
     "check:pii": "node scripts/check-pii.mjs",
     "prepublishOnly": "npm run build && npm test",
     "release:clawhub": "node scripts/publish-clawhub.mjs",