Skip to content

Commit 5b29a8b

Browse files
Asif2BDAsif2BD
authored
Merge pull request #4 from Asif2BD/claude/xcloud-skills-public-release-ge2x72
chore(release): v4.0.1 — version bumps, per-issue status, release readiness
2 parents 282d4ad + 5a4993c commit 5b29a8b

14 files changed

Lines changed: 183 additions & 130 deletions

File tree

‎.claude-plugin/marketplace.json‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,22 @@
99
"name": "xcloud",
1010
"source": "./plugins/xcloud",
1111
"description": "Official xCloud skills for agents: servers, sites, WordPress, SSL, account data, and hosting automation — MCP-first (app.xcloud.host/mcp) with a bundled REST fallback.",
12-
"version": "4.0.0",
12+
"version": "4.0.1",
1313
"author": {
1414
"name": "xCloudDev",
1515
"url": "https://github.com/xCloudDev"
1616
},
1717
"homepage": "https://github.com/xCloudDev/xcloud-agent-skills",
1818
"license": "MIT",
19-
"keywords": ["xcloud", "mcp", "api", "wordpress", "hosting", "deployment", "devops"]
19+
"keywords": [
20+
"xcloud",
21+
"mcp",
22+
"api",
23+
"wordpress",
24+
"hosting",
25+
"deployment",
26+
"devops"
27+
]
2028
}
2129
]
2230
}

‎.clawhubinfo.json‎

Lines changed: 84 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
{
22
"name": "xcloud-agent-skills",
3-
"version": "4.0.0",
3+
"version": "4.0.1",
44
"display_name": "xCloud Agent Skills",
55
"description": "Operate xCloud in plain language from any AI agent — five capability skills paired with the xCloud MCP server (110 native tools), with a bundled REST fallback.",
66
"long_description": "The xCloud agent skills let any AI agent (Claude Code and others) operate xCloud in plain language: reboot a server, renew SSL, scan for vulnerabilities, provision WordPress or Git-deployed sites, delete sites safely. v4.0.0 is MCP-first: connect the xCloud MCP server (https://app.xcloud.host/mcp — OAuth, 110 tools with per-action destructive-operation confirmation) and the skills use it automatically; agents without MCP fall back to the shared auth + curl layer. A legacy Python SDK and CLI remain under src/ for direct scripting.",
7-
87
"category": "deployment",
98
"subcategories": [
109
"hosting",
@@ -13,7 +12,6 @@
1312
"devops",
1413
"automation"
1514
],
16-
1715
"keywords": [
1816
"xcloud",
1917
"xcloud-agent-skills",
@@ -28,21 +26,99 @@
2826
"claude-code",
2927
"skills"
3028
],
31-
3229
"author": {
3330
"name": "xCloudDev",
3431
"email": "dev@xcloud.host",
3532
"url": "https://xcloud.host"
3633
},
37-
3834
"homepage": "https://xcloud.host",
3935
"repository": "https://github.com/xCloudDev/xcloud-agent-skills",
4036
"documentation": "https://github.com/xCloudDev/xcloud-agent-skills/blob/main/docs/USER_GUIDE.md",
41-
"changelog": "https://github.com/xCloudDev/xcloud-agent-skills/blob/main/CHANGELOG.md",
42-
37+
"changelog": {
38+
"v4.0.1": {
39+
"date": "2026-08-02",
40+
"changes": [
41+
"Security hardening across the wrapper: HTTPS-only base URLs (explicit local-dev override), bearer-token redaction in verbose output, request bodies via stdin — never argv (fixes upstream #14, #15, #16)",
42+
"Injection-proof JSON via jq -n in legacy src/ and secret-bearing skill examples (fixes #17)",
43+
"Untrusted-output (prompt-injection) rules and a written high-risk-write confirmation policy (fixes #18, #19)",
44+
"Hosted-chat token guidance: scoped short-lived tokens, never wildcard in chat, compromise rotation steps (fixes #21)",
45+
"Async state files owner-only 0600 with secrets masked (fixes #22); CLI set -u crash, poller readiness field, and SSL provider fixed (from #8)",
46+
"CI: offline wrapper + JSON-safety test suites, script-safety pattern lint (partial #20), and a manifest version-consistency gate (partial #26)"
47+
]
48+
},
49+
"v4.0.0": {
50+
"date": "2026-07-29",
51+
"changes": [
52+
"MCP-first: skills pair with the xCloud MCP server (https://app.xcloud.host/mcp, 110 tools, full API parity) with OAuth and per-action destructive-op confirmation",
53+
"New shared reference/mcp.md: connect instructions per client, tool naming, confirm contract, REST-only surface",
54+
"Added site deletion (DELETE /sites/{uuid}) with granular delete_* flags",
55+
"Added Git-deployed site provisioning (POST /servers/{uuid}/sites/git) for Laravel/Node/PHP/WordPress/Lovable",
56+
"Added domain update status; documented Node/PM2/OpenClaw rescue flags",
57+
"README and onboarding lead with the MCP connector; token setup is the REST fallback"
58+
]
59+
},
60+
"v3.0.3": {
61+
"date": "2026-07-10",
62+
"changes": [
63+
"Changed ClawHub category metadata from infrastructure to deployment",
64+
"Closed live API coverage gaps for team-wide vulnerabilities, Git deployment settings, manual Git deploys, and service disable",
65+
"Added proactive xCloud-branded onboarding and safer API token setup guidance",
66+
"Added direct xCloud tutorial, video, and YouTube links for marketplace indexing"
67+
]
68+
},
69+
"v3.0.2": {
70+
"date": "2026-07-10",
71+
"changes": [
72+
"Restored the original xcloud ClawHub listing to preserve download history",
73+
"Hid the duplicate xcloud-agent-skills listing",
74+
"Added first-screen ClawHub, version, license, xCloud, and OpenClaw badges",
75+
"Added Token Optimizer-style badges and links to the rendered SKILL.md tab",
76+
"Added direct xCloud, dashboard, GitHub, user guide, install guide, and API documentation links"
77+
]
78+
},
79+
"v3.0.1": {
80+
"date": "2026-07-10",
81+
"changes": [
82+
"ClawHub release metadata and safety files",
83+
"Root SKILL.md for marketplace indexing",
84+
"README badges and official xCloud links",
85+
"API coverage audit and CI from the public-release branch"
86+
]
87+
},
88+
"v3.0.0": {
89+
"date": "2026-06-16",
90+
"changes": [
91+
"Renamed the plugin to xcloud; skills invoked as xcloud:servers, :sites, :ssl, :wordpress, :account",
92+
"Plugin directory moved to plugins/xcloud/"
93+
]
94+
},
95+
"v2.0.0": {
96+
"date": "2026-06-09",
97+
"changes": [
98+
"Split the single skill into five capability-domain skills",
99+
"Shared scripts/xcloud.sh + reference/{auth,conventions}.md layer",
100+
"Per-skill smoke tests; environment-driven base URL"
101+
]
102+
},
103+
"v1.1.0": {
104+
"date": "2026-04-22",
105+
"changes": [
106+
"Python SDK with 20+ API methods (now legacy, under src/)",
107+
"Async polling and state persistence",
108+
"CLI tool; error recovery guide; automation scenarios"
109+
]
110+
},
111+
"v1.0.0": {
112+
"date": "2024",
113+
"changes": [
114+
"Initial release with API documentation",
115+
"curl examples for all operations",
116+
"Troubleshooting guide"
117+
]
118+
}
119+
},
43120
"license": "MIT",
44121
"license_url": "https://github.com/xCloudDev/xcloud-agent-skills/blob/main/LICENSE",
45-
46122
"features": [
47123
"MCP-first: pairs with the xCloud MCP server (110 native tools, full API parity)",
48124
"OAuth connection — no raw token to store; per-action confirmation on destructive tools",
@@ -58,7 +134,6 @@
58134
"Git deployment, team vulnerability rollup, and service-disable coverage",
59135
"Legacy Python SDK, async helpers, and CLI under src/"
60136
],
61-
62137
"badges": [
63138
"production-ready",
64139
"mcp-ready",
@@ -70,7 +145,6 @@
70145
"error-recovery",
71146
"official-xcloud"
72147
],
73-
74148
"requirements": {
75149
"environment": {
76150
"XCLOUD_API_TOKEN": "REST fallback only — not needed when the xCloud MCP connector is used. Token from https://app.xcloud.host/settings/api-tokens"
@@ -81,14 +155,12 @@
81155
"backoff >= 2.2.0"
82156
]
83157
},
84-
85158
"quick_start": {
86159
"1_connect_mcp": "claude mcp add xcloud --transport http https://app.xcloud.host/mcp then /mcp -> Authenticate (OAuth; no token needed)",
87160
"2_install": "/plugin marketplace add xCloudDev/xcloud-agent-skills then /plugin install xcloud@xcloud-agent-skills",
88161
"3_fallback": "No MCP support? Add {\"env\": {\"XCLOUD_API_TOKEN\": \"your-token\"}} to your Claude Code settings instead",
89162
"4_use": "Ask in plain language, e.g. \"List my xCloud servers\" or \"Renew SSL for example.com\""
90163
},
91-
92164
"mcp_info": {
93165
"endpoint": "https://app.xcloud.host/mcp",
94166
"transport": "streamable-http",
@@ -97,22 +169,19 @@
97169
"tools": 110,
98170
"notes": "Full parity with the authenticated Public API; destructive tools require per-action confirmation; team-scoped."
99171
},
100-
101172
"agent_support": {
102173
"infrastructure_automation": "Provisioning, deployment, backups, CI/CD integration",
103174
"monitoring": "Fleet health checks, capacity planning, cost analysis",
104175
"security": "SSL monitoring, vulnerability scans, firewall/fail2ban, site verification",
105176
"operations": "Bulk updates, status reporting, disaster recovery"
106177
},
107-
108178
"api_info": {
109179
"base_url": "https://app.xcloud.host/api/v1",
110180
"docs_url": "https://app.xcloud.host/api/v1/docs",
111181
"auth": "Bearer token (Sanctum)",
112182
"rate_limit": "60 requests/minute",
113183
"version": "1.0.0"
114184
},
115-
116185
"installation": {
117186
"mcp": "claude mcp add xcloud --transport http https://app.xcloud.host/mcp",
118187
"mcp_docs": "https://app.xcloud.host/mcp/docs",
@@ -127,80 +196,6 @@
127196
"youtube": "https://www.youtube.com/@xCloud-Hosting",
128197
"other_frameworks": "Copy plugins/xcloud/skills/* into your agent's skills directory"
129198
},
130-
131-
"changelog": {
132-
"v4.0.0": {
133-
"date": "2026-07-29",
134-
"changes": [
135-
"MCP-first: skills pair with the xCloud MCP server (https://app.xcloud.host/mcp, 110 tools, full API parity) with OAuth and per-action destructive-op confirmation",
136-
"New shared reference/mcp.md: connect instructions per client, tool naming, confirm contract, REST-only surface",
137-
"Added site deletion (DELETE /sites/{uuid}) with granular delete_* flags",
138-
"Added Git-deployed site provisioning (POST /servers/{uuid}/sites/git) for Laravel/Node/PHP/WordPress/Lovable",
139-
"Added domain update status; documented Node/PM2/OpenClaw rescue flags",
140-
"README and onboarding lead with the MCP connector; token setup is the REST fallback"
141-
]
142-
},
143-
"v3.0.3": {
144-
"date": "2026-07-10",
145-
"changes": [
146-
"Changed ClawHub category metadata from infrastructure to deployment",
147-
"Closed live API coverage gaps for team-wide vulnerabilities, Git deployment settings, manual Git deploys, and service disable",
148-
"Added proactive xCloud-branded onboarding and safer API token setup guidance",
149-
"Added direct xCloud tutorial, video, and YouTube links for marketplace indexing"
150-
]
151-
},
152-
"v3.0.2": {
153-
"date": "2026-07-10",
154-
"changes": [
155-
"Restored the original xcloud ClawHub listing to preserve download history",
156-
"Hid the duplicate xcloud-agent-skills listing",
157-
"Added first-screen ClawHub, version, license, xCloud, and OpenClaw badges",
158-
"Added Token Optimizer-style badges and links to the rendered SKILL.md tab",
159-
"Added direct xCloud, dashboard, GitHub, user guide, install guide, and API documentation links"
160-
]
161-
},
162-
"v3.0.1": {
163-
"date": "2026-07-10",
164-
"changes": [
165-
"ClawHub release metadata and safety files",
166-
"Root SKILL.md for marketplace indexing",
167-
"README badges and official xCloud links",
168-
"API coverage audit and CI from the public-release branch"
169-
]
170-
},
171-
"v3.0.0": {
172-
"date": "2026-06-16",
173-
"changes": [
174-
"Renamed the plugin to xcloud; skills invoked as xcloud:servers, :sites, :ssl, :wordpress, :account",
175-
"Plugin directory moved to plugins/xcloud/"
176-
]
177-
},
178-
"v2.0.0": {
179-
"date": "2026-06-09",
180-
"changes": [
181-
"Split the single skill into five capability-domain skills",
182-
"Shared scripts/xcloud.sh + reference/{auth,conventions}.md layer",
183-
"Per-skill smoke tests; environment-driven base URL"
184-
]
185-
},
186-
"v1.1.0": {
187-
"date": "2026-04-22",
188-
"changes": [
189-
"Python SDK with 20+ API methods (now legacy, under src/)",
190-
"Async polling and state persistence",
191-
"CLI tool; error recovery guide; automation scenarios"
192-
]
193-
},
194-
"v1.0.0": {
195-
"date": "2024",
196-
"changes": [
197-
"Initial release with API documentation",
198-
"curl examples for all operations",
199-
"Troubleshooting guide"
200-
]
201-
}
202-
},
203-
204199
"support": {
205200
"github_issues": "https://github.com/xCloudDev/xcloud-agent-skills/issues",
206201
"email": "dev@xcloud.host",
@@ -212,7 +207,6 @@
212207
"youtube": "https://www.youtube.com/@xCloud-Hosting",
213208
"xcloud": "https://xcloud.host"
214209
},
215-
216210
"verified": true,
217211
"maintained": true,
218212
"production_ready": true

‎.env.example‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
XCLOUD_API_TOKEN=
44

55
# Optional: override the API base URL (default: https://app.xcloud.host).
6-
# Local development: http://xcloud.test
6+
# Local development: http://xcloud.test (plaintext http also requires
7+
# XCLOUD_ALLOW_INSECURE_HTTP=1 — never over a real network)
78
# White-label host: https://panel.your-host.com
89
# XCLOUD_API_BASE_URL=https://app.xcloud.host

‎CHANGELOG.md‎

Lines changed: 51 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,28 @@
22

33
All notable changes to the xCloud Public API skill are documented in this file.
44

5-
## [4.0.0] - 2026-07-29
6-
7-
**The MCP release.** The xCloud MCP server is live at
8-
`https://app.xcloud.host/mcp` — 110 native tools, one per authenticated Public
9-
API operation — and the skills are now **MCP-first**. Nothing breaks: skill IDs
10-
are unchanged and the REST token path still works everywhere it did before.
11-
12-
### Security & hardening (upstream issues #14–#22)
5+
## [4.0.1] - 2026-08-02
6+
7+
**The security-hardening release.** Every open upstream issue was examined;
8+
this release fixes all that are resolvable in this repository. Issue status
9+
(refs are `xCloudDev/xcloud-agent-skills` issue numbers):
10+
11+
| Issue | Status |
12+
|---|---|
13+
| [#14](https://github.com/xCloudDev/xcloud-agent-skills/issues/14) Harden base URL & token handling | ✅ **Fixed** |
14+
| [#15](https://github.com/xCloudDev/xcloud-agent-skills/issues/15) Redact bearer tokens from verbose output | ✅ **Fixed** |
15+
| [#16](https://github.com/xCloudDev/xcloud-agent-skills/issues/16) Stop passing sensitive bodies through argv | ✅ **Fixed** |
16+
| [#17](https://github.com/xCloudDev/xcloud-agent-skills/issues/17) Replace unsafe shell JSON interpolation | ✅ **Fixed** |
17+
| [#18](https://github.com/xCloudDev/xcloud-agent-skills/issues/18) Agent safety rules for untrusted output | ✅ **Fixed** |
18+
| [#19](https://github.com/xCloudDev/xcloud-agent-skills/issues/19) Confirmation policy for high-risk writes | ✅ **Fixed** |
19+
| [#21](https://github.com/xCloudDev/xcloud-agent-skills/issues/21) Token setup guidance for hosted chat | ✅ **Fixed** |
20+
| [#22](https://github.com/xCloudDev/xcloud-agent-skills/issues/22) Harden async state persistence | ✅ **Fixed** |
21+
| [#8](https://github.com/xCloudDev/xcloud-agent-skills/issues/8) v1.2.0 test report | 🟡 **Live bugs fixed** (BUG-01/02/03); doc findings superseded by v2–v4 — suggest closing |
22+
| [#20](https://github.com/xCloudDev/xcloud-agent-skills/issues/20) Hook-based safety harness | 🟡 **Partial** — CI safety-pattern lint landed; runtime PreToolUse/redaction hooks deferred (MCP `confirm: true` already gates destructive calls) |
23+
| [#26](https://github.com/xCloudDev/xcloud-agent-skills/issues/26) Ship through managed marketplaces | 🟡 **Partial** — CI version-consistency gate landed; Anthropic directory submission is a maintainer action |
24+
| [#6](https://github.com/xCloudDev/xcloud-agent-skills/issues/6) OpenAPI-accurate & publishable | ✅ **Superseded** by v2.0–v4.0 — suggest closing |
25+
26+
### Security
1327

1428
- **Wrapper (`scripts/xcloud.sh`):**
1529
- Plaintext `http://` base URLs are refused unless
@@ -21,8 +35,6 @@ are unchanged and the REST token path still works everywhere it did before.
2135
on curl's command line; a new `-` body argument reads the wrapper's own
2236
stdin so secret-bearing payloads (private keys, passwords) never touch any
2337
argv. The JSON-argument form still works (#16).
24-
- New offline test suite `scripts/tests/wrapper-test.sh` (fake token, local
25-
echo server) covering all of the above; wired into CI.
2638
- **Skill docs:** SSL custom-certificate, sudo-user, and site-SSH password
2739
examples now build JSON with `jq -n` and pipe it via stdin (#16, #17).
2840
- **Shared conventions:** new *Untrusted output* section — all API output is
@@ -34,16 +46,35 @@ are unchanged and the REST token path still works everywhere it did before.
3446
tokens only, never `*` in chat, plus token-compromise rotation/revocation
3547
steps (#21).
3648
- **Legacy `src/`:** JSON payloads in `xcloud-api.sh`/`xcloud-cli.sh` are built
37-
with `jq -n` (injection-proof; covered by the new offline
38-
`src/tests/json-safety-test.sh`) (#17); `xcloud_async.py` state files are
39-
written owner-only (0600) with known secret fields masked (#22); the CLI's
40-
empty-`extra_args` crash under `set -u` and the async poller's wrong
41-
readiness field (`provisioned` → `is_provisioned`/`status`) are fixed, and
42-
the CLI's rejected `letsencrypt` SSL provider now uses `xcloud` (test-report
43-
bugs 01–03 from #8).
44-
- **CI:** version-consistency check across all four version-bearing manifests
45-
(#26), both offline test suites, and a script-safety pattern check (no
46-
`--data-raw` in scripts, no unredacted `curl -v` in `src/`) (#20).
49+
with `jq -n`, injection-proof (#17); `xcloud_async.py` state files are
50+
written owner-only (0600) with known secret fields masked (#22).
51+
52+
### Fixed
53+
54+
- CLI crash on every no-payload command under `set -u` (empty `extra_args`;
55+
#8 BUG-03).
56+
- Async poller readiness check now accepts live payload shapes
57+
(`is_provisioned` / `status == "provisioned"`; #8 BUG-02).
58+
- CLI WordPress-create SSL provider `letsencrypt` → `xcloud` (#8 BUG-01; both
59+
are valid per the current live spec — `xcloud` is the managed default).
60+
61+
### Added
62+
63+
- Offline test suites, wired into CI: `plugins/xcloud/scripts/tests/`
64+
`wrapper-test.sh` (8 tests: refusal paths, redaction with a fake token,
65+
stdin/argv body round-trips, unchanged envelope/exit codes) and
66+
`src/tests/json-safety-test.sh` (8 tests: hostile quotes, control
67+
characters, field-injection attempts).
68+
- CI: version-consistency gate across `plugin.json`, `marketplace.json`,
69+
`.clawhubinfo.json`, and root `SKILL.md` (#26), plus a script-safety pattern
70+
check — no `--data-raw` in scripts, no unredacted `curl -v` in `src/` (#20).
71+
72+
## [4.0.0] - 2026-07-29
73+
74+
**The MCP release.** The xCloud MCP server is live at
75+
`https://app.xcloud.host/mcp` — 110 native tools, one per authenticated Public
76+
API operation — and the skills are now **MCP-first**. Nothing breaks: skill IDs
77+
are unchanged and the REST token path still works everywhere it did before.
4778

4879
### Added
4980

0 commit comments

Comments
 (0)