fix: show published versions after pending releases

[goutamadwant]

Closes #3687

What Problem This Solves

Fixes an issue where users opening version history for packages with an unpublished newest release would receive an HTTP 500 response instead of the available published versions.

Why This Change Was Made

The shared package-version query now applies publication and owner-deletion filters before one native Convex pagination operation. This preserves opaque cursor behavior and continues to include both explicit published releases and legacy releases without a publication status.

User Impact

Package version history remains available when a newer release is still pending, while pending, blocked, soft-deleted, and owner-deleted releases remain hidden.

Evidence

Before the fix, the focused regression reaches a second native pagination call and fails with A query can only invoke paginate once.

After the fix:

• The focused package test completes with one filtered pagination call.
• A Convex runtime test returns the explicit published release after a pending release, then reaches a legacy published release through the native continuation cursor.
• The exact package and HTTP test command passes 819 tests.
• The full unit coverage gate passes 6,664 tests.

Validation:

bunx vitest run convex/packages.public.test.ts convex/httpApiV1.handlers.test.ts
bunx vitest run convex/packages.catalogVisibility.runtime.test.ts -t "paginates published versions past a pending release with native cursors"
bun run ci:static
bun run ci:unit
bun run ci:types-build
bun run ci:e2e-http

Limitation: production request traces were not available, so this source-proven pagination defect may not explain every reported package-specific 500.

Disclosure: AI was used to understand the codebase and review the fix.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

@goutamadwant is attempting to deploy a commit to the OpenClaw Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 14, 2026, 9:59 AM ET / 13:59 UTC.

ClawSweeper review

What this changes

The PR filters unpublished and deleted package releases before a single Convex pagination call and adds regression coverage for published and legacy versions.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open: the pagination defect remains on main and in v0.23.3. This is a focused repair, but it removes an existing page-size guard and still needs real-runtime proof.

Priority: P2
Reviewed head: d53e80eda2b49f81b420d4a3008c0009a5868ab1

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The repair is focused and has useful regression tests, but the removed request bound and test-only proof prevent merge readiness.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: The changed shared query is covered by mocked handlers and convex-test, but no after-fix request against a real Convex setup demonstrates published-version recovery and cursor continuation. Repository policy also requests an actual browser capture for backend visibility fixes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The changed shared query is covered by mocked handlers and convex-test, but no after-fix request against a real Convex setup demonstrates published-version recovery and cursor continuation. Repository policy also requests an actual browser capture for backend visibility fixes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	7 items	Current-main defect remains: The main helper still loops over native paginate calls when unpublished records leave a page short; the PR replaces this exact path. Direct dependency contract: ClawHub directly invokes native Convex pagination. The backend rejects multiple paginated queries within one function with MultiplePaginatedDatabaseQueries. Introduced loss of request bound: The previous helper clamped numItems to 1–200. The new helper passes paginationOpts directly; public listVersions accepts paginationOptsValidator without an equivalent clamp. The HTTP route’s separate 100-item limit does not protect direct Convex callers.
Findings	1 actionable finding	[P2] Restore the page-size bound for direct Convex callers
Security	None	None.

How this fits together

ClawHub’s version-history queries read stored package releases for the HTTP API and plugin details interface. They enforce package visibility and return published versions with continuation cursors.

flowchart LR
 A[Version history request] --> B[Package visibility check]
 B --> C[Package release index]
 C --> D[Published and active filter]
 D --> E[Single pagination operation]
 E --> F[Versions and continuation cursor]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The changed shared query is covered by mocked handlers and convex-test, but no after-fix request against a real Convex setup demonstrates published-version recovery and cursor continuation. Repository policy also requests an actual browser capture for backend visibility fixes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Restore the page-size bound for direct Convex callers (P2) - Passing paginationOpts unchanged removes the helper’s existing 1–200 clamp. Public listVersions accepts numItems through paginationOptsValidator without another bound, so a direct request for thousands of versions now reads and returns far more records than before, potentially hitting transaction or response limits on large histories. The HTTP route’s 100-item clamp does not cover this public Convex entrypoint. Preserve the request bound while retaining optional native cursor metadata and the single pagination call.
• Resolve merge risk (P1) - The pending-release mechanism has not been correlated with the production request failures for all three packages in the linked report.
• Complete next step (P2) - Restore the direct-query page-size guard and add after-fix real Convex HTTP evidence with cursor continuation, plus an actual browser capture identifying the local URL and fixture. Redact credentials, private endpoints, and other private details. Updating the PR body should trigger a fresh review; otherwise ask a maintainer to comment @clawsweeper re-review.

Findings

• [P2] Restore the page-size bound for direct Convex callers — convex/packages.ts:1402

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Diff size	+127/-43 across 3 files	The change stays within the shared package query and its tests.
Production and test delta	production -19 net; tests +103 net	The repair simplifies production code while adding pagination regression coverage.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3687
Summary: This PR is the explicit candidate repair for the linked version-history failure report.

Members:

• canonical: GET /api/v1/packages/{name}/versions returns 500 for @openclaw/copilot, @openclaw/lobster, @openclaw/perplexity-plugin #3687 - The open report contains the observed HTTP failures that this PR targets.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Keep one native pagination operation in the shared query while preserving bounded requests, release visibility, legacy records, and native continuation metadata.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep one native pagination operation in the shared query while preserving bounded requests, release visibility, legacy records, and native continuation metadata.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: requesting one version when a pending release precedes a published release reaches a second native pagination call on main, which Convex rejects. This review did not execute the fixture.

Is this the best way to solve the issue?

The shared-query repair is the right layer, but the patch should retain the existing request bound. Client retries cannot fix the deterministic backend error, and a schema migration is unnecessary for this focused repair.

Full review comments:

• [P2] Restore the page-size bound for direct Convex callers — convex/packages.ts:1402
  Passing paginationOpts unchanged removes the helper’s existing 1–200 clamp. Public listVersions accepts numItems through paginationOptsValidator without another bound, so a direct request for thousands of versions now reads and returns far more records than before, potentially hitting transaction or response limits on large histories. The HTTP route’s 100-item clamp does not cover this public Convex entrypoint. Preserve the request bound while retaining optional native cursor metadata and the single pagination call.
  Confidence: 0.93

Overall correctness: patch is incorrect
Overall confidence: 0.92

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8c2de6c506bb.

Labels

Label changes:

• add P2: This repairs version-history failures for a limited set of packages without evidence of a broader outage.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The changed shared query is covered by mocked handlers and convex-test, but no after-fix request against a real Convex setup demonstrates published-version recovery and cursor continuation. Repository policy also requests an actual browser capture for backend visibility fixes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This repairs version-history failures for a limited set of packages without evidence of a broader outage.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The changed shared query is covered by mocked handlers and convex-test, but no after-fix request against a real Convex setup demonstrates published-version recovery and cursor continuation. Repository policy also requests an actual browser capture for backend visibility fixes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Current-main defect remains: The main helper still loops over native paginate calls when unpublished records leave a page short; the PR replaces this exact path. (convex/packages.ts:1382, 8c2de6c506bb)
• Direct dependency contract: ClawHub directly invokes native Convex pagination. The backend rejects multiple paginated queries within one function with MultiplePaginatedDatabaseQueries. (crates/isolate/src/environment/udf/async_syscall.rs:1916, 25e6440284e8)
• Introduced loss of request bound: The previous helper clamped numItems to 1–200. The new helper passes paginationOpts directly; public listVersions accepts paginationOptsValidator without an equivalent clamp. The HTTP route’s separate 100-item limit does not protect direct Convex callers. (convex/packages.ts:1402, d53e80eda2b4)
• Proof coverage: The captured PR body reports focused tests and broader gates. The added runtime-named test uses convex-test with an in-memory fixture; it does not exercise a deployed Convex backend or the HTTP endpoint. No after-fix real-setup artifact was supplied. (convex/packages.catalogVisibility.runtime.test.ts:157, d53e80eda2b4)
• Latest release retains old helper: The v0.23.3 source still contains the looping pagination helper. No merged replacement for this repair was established. (convex/packages.ts:1308, 87ca030c30f3)
• Related report and discussion: GET /api/v1/packages/{name}/versions returns 500 for @openclaw/copilot, @openclaw/lobster, @openclaw/perplexity-plugin #3687 records repeated package-specific HTTP 500s and successful controls. Its existing review identifies the same pagination mechanism while leaving correlation with all reported production failures unproven. This PR explicitly proposes closing that open issue.

Likely related people:

• Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Restore bounded direct-query pagination and add a regression with numItems above 200 while preserving continuation metadata.
• Provide after-fix HTTP output from a real Convex setup with pending, published, and legacy releases, plus the real browser visibility capture required by repository policy.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.