Add download activity trend graphs

[jesse-merhi]

Summary

• Remove public install metric cards, install trend graphs, install sort labels, and install-count table columns from the UI.
• Show downloads as the public activity metric across skill/plugin detail metadata, browse cards, publisher/profile cards, dashboard rows, home cards, hover stats, and audits tables.
• Keep install tracking/API compatibility internally: legacy sort=installs links now map to downloads, and install telemetry/management abuse signals remain intact.

Validation

• bun run test convex/httpApiV1.handlers.test.ts src/components/SkillHeader.test.tsx src/__tests__/skill-detail-page.test.tsx src/__tests__/package-detail-route.test.tsx src/__tests__/user-profile-route.test.tsx src/__tests__/skills-index.test.tsx src/__tests__/packages-route.test.tsx src/routes/skills/-params.test.ts src/lib/packageApi.test.ts src/components/PublisherListItem.test.tsx src/components/PublishedItemCard.test.tsx src/components/UserBadge.test.tsx src/routes/-dashboard.test.tsx passed: 13 files, 597 tests.
• bun run test convex/skills.packageCatalog.test.ts convex/skills.publicListCursor.test.ts convex/httpApiV1.handlers.test.ts passed: 3 files, 405 tests.
• bunx convex codegen passed.
• bunx tsc --noEmit passed.
• bun run lint passed.
• bun run deadcode:ci passed.
• bun run format:check passed.
• bun run ci:unit passed: 282 files passed, 1 skipped; 3614 tests passed, 1 skipped.
• bun run ci:static failed only at bun audit on existing advisories: dompurify GHSA-cmwh-pvxp-8882 and undici GHSA-vmh5-mc38-953g / GHSA-pr7r-676h-xcf6. check:peers passed; the remaining static subcommands above passed individually.

Browser proof

Checked the running local app at http://localhost:3000 with Playwright at 390, 768, and 1440 widths.

Pages checked:

• /local-corpus-alta-beatty/notion-im-helper
• /skills
• /plugins
• /user/local-corpus-alta-beatty
• /audits

Results:

• 0 horizontal overflow failures.
• 0 public Installs, Most installed, 30-day Installs, or daily-install chart labels found.
• 0 install trend charts found.
• Downloads labels were present on reachable desktop/tablet surfaces; mobile browse sort labels are hidden behind the responsive controls.
• 0 unexpected console errors. The ignored console noise was existing external image DNS failures.
• Impeccable source detection reported existing global stylesheet warnings outside the changed downloads selectors.

Screenshots saved locally under /tmp/clawhub-downloads-only-proof-rerun.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Ready	Preview, Comment	Jun 19, 2026 5:44am

[clawsweeper]

Codex review: needs changes before merge. Reviewed June 20, 2026, 1:56 AM ET / 05:56 UTC.

Summary
The PR adds daily download activity graphs for skill and plugin detail pages, shifts public adoption UI and sorts from installs to downloads, and adds package daily-stat storage with tests and spec notes.

Reproducibility: yes. for the blocking review finding: the live merge-result types-build log fails because packageDailyStats is missing from the retention policy. The feature behavior itself is not a bug reproduction path.

Review metrics: 3 noteworthy metrics.

• Diff Size: +2633/-270 across 51 files. The change spans Convex schema/stat processing, generated API types, UI components, routes, styles, tests, and specs.
• Stored Tables: 1 table added. Adding packageDailyStats changes the persisted Convex model and requires retention and upgrade review.
• Type/Build Gate: 1 failed job. The live merge-result types-build failure is directly tied to the missing retention policy entry.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🦐 gold shrimp
Patch quality: 🧂 unranked krab
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Add packageDailyStats to convex/lib/retentionPolicy.ts and rerun the type/build gate.
• Rebase or otherwise refresh the branch so GitHub has a clean merge result.
• Attach or publish inspectable browser proof if maintainers want visual evidence beyond local screenshot paths.

Mantis proof suggestion
The change is visible browser UI and the PR body references local screenshot paths that maintainers cannot inspect from GitHub. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis visual task: verify skill and plugin detail pages show 30-day download activity graphs and public browse/profile/audits surfaces show downloads instead of installs at mobile and desktop widths.

Risk before merge

• [P1] The merge result currently fails types-build until packageDailyStats is classified in convex/lib/retentionPolicy.ts.
• [P1] The PR is currently conflicting against main, so maintainers need a fresh merge result before trusting the prior green checks.
• [P1] Existing package pages with historical activity will hide the new graph until PACKAGE_DAILY_STATS_ROLLOUT_AT is set and the 30-day window is trustworthy; that rollout choice needs maintainer/operator acceptance.

Maintainer options:

1. Fix Retention And Refresh Merge (recommended)
   Add a packageDailyStats retention policy entry, resolve the current-main conflict, and rerun the type/build gate before merge.
2. Accept The Env-Gated Warm-Up
   Maintainers can keep the fail-closed package graph rollout if production deployment explicitly sets PACKAGE_DAILY_STATS_ROLLOUT_AT.
3. Backfill Or Defer Package Graphs
   If immediate package graph visibility is required, add a cursor-based package daily stats backfill or split package graphs into a later PR.

Next step before merge

• [P2] A narrow repair exists for the blocking build issue: refresh against current main and add the new table to retention policy without changing the product rollout behavior.

Security
Cleared: No concrete security or supply-chain regression was found; the diff adds bounded public queries, schema/UI code, and tests without new dependencies, workflows, secrets handling, or downloaded code execution.

Review findings

• [P2] Classify packageDailyStats in retention policy — convex/schema.ts:1681-1687

Review details

Best possible solution:

Land a refreshed branch that keeps the bounded daily-stat approach, classifies the new table in retention policy, resolves current-main conflicts, and has maintainers explicitly accept or adjust the env-gated package rollout.

Do we have a high-confidence way to reproduce the issue?

Yes for the blocking review finding: the live merge-result types-build log fails because packageDailyStats is missing from the retention policy. The feature behavior itself is not a bug reproduction path.

Is this the best way to solve the issue?

No in the current form. The bounded indexed daily-stat approach is plausible, but the missing retention classification, conflicting merge state, and rollout decision must be resolved before this is the best mergeable solution.

Full review comments:

• [P2] Classify packageDailyStats in retention policy — convex/schema.ts:1681-1687
  Adding this table makes packageDailyStats part of TableNames, but the merge result leaves RETENTION_POLICIES without a matching entry. The live types-build job fails with the missing property, so add the retention classification when rebasing onto current main.
  Confidence: 0.97

Overall correctness: patch is incorrect
Overall confidence: 0.92

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6f28659e7bfb.

Label changes

Label changes:

• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦐 gold shrimp and patch quality is 🧂 unranked krab.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external-contributor proof gate does not apply to this member-authored PR; the body reports local Playwright browser checks, but the referenced screenshot paths are not inspectable from GitHub.
• remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.

Label justifications:

• P2: This is a bounded user-facing feature and build blocker with normal maintainer priority, not an urgent production outage.
• merge-risk: 🚨 compatibility: The PR adds persisted package daily stats and an operator rollout timestamp that affect upgrade and production graph visibility behavior.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦐 gold shrimp and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external-contributor proof gate does not apply to this member-authored PR; the body reports local Playwright browser checks, but the referenced screenshot paths are not inspectable from GitHub.

Evidence reviewed

Acceptance criteria:

• [P1] bunx convex codegen.
• [P1] bunx tsc --noEmit.
• [P1] bun run ci:types-build.
• [P1] bun run test convex/packages.stats.test.ts convex/lib/downloadTrend.test.ts.

What I checked:

• Repository policy read: Read the full target AGENTS.md and applied its Convex schema, retention, stored data-model, and UI proof guidance to this PR review. (AGENTS.md:1, 6f28659e7bfb)
• Convex and retention guidance read: Read the generated Convex guidelines and the repo-local convex-retention skill before reviewing the schema/table change. (convex/_generated/ai/guidelines.md:1, 6f28659e7bfb)
• New table added by the PR: The PR head adds packageDailyStats to the schema and exports it from defineSchema, making it part of the Convex table set. (convex/schema.ts:1681, 093cfd778036)
• Current retention enforcement requires every table: Current main enforces RETENTION_POLICIES as Record<TableNames, RetentionPolicy> and already classifies adjacent stats tables such as skillDailyStats. (convex/lib/retentionPolicy.ts:60, 6f28659e7bfb)
• Live CI failure confirms the missing policy entry: The live merge-result types-build job fails with TS1360 because packageDailyStats is missing from RETENTION_POLICIES, and TS7053 because the policy object cannot be indexed for that table. (convex/lib/retentionPolicy.ts:241, 83cefa16e32a)
• Live PR state: Live GitHub state shows the PR is open, member-authored, 51 files changed, currently CONFLICTING/DIRTY, and has one failed types-build check while other gates mostly passed. (093cfd778036)

Likely related people:

• Patrick-Erichsen: Introduced the current Convex retention policy enforcement and recently maintained package/schema/plugin-detail surfaces that this PR now intersects. (role: recent area contributor; confidence: high; commits: b1b3c5e1cd09, f381b0182921, 08a95f3c748e; files: convex/lib/retentionPolicy.ts, convex/schema.ts, convex/packages.ts)
• jesse-merhi: Beyond authoring this PR, Jesse has current-main history on adjacent skill install/stat migration work that touches the same metric foundation. (role: recent adjacent contributor; confidence: high; commits: 8090d4ecea75; files: convex/schema.ts, convex/skills.ts, convex/packages.ts)
• Jason (Json): Recent current-main work touched plugin catalog/detail routes that this PR extends with download metrics and activity cards. (role: recent plugin detail/catalog contributor; confidence: medium; commits: 776069636274, fc07846839ee, 04ec212100f5; files: src/routes/plugins/$name.tsx, src/routes/plugins/index.tsx)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.