🔧 update: dependencies and improve commit workflow configuration

[warengonzaga]

This pull request introduces a range of improvements and maintenance updates across the codebase, focusing on configuration flexibility, CI/CD workflow modernization, dependency upgrades, and documentation enhancements. The most significant changes include expanding provider configuration options, updating and streamlining CI/CD workflows, and improving project documentation for contributors.

Configuration Enhancements

• Added providerId and mode (with allowed values local or cloud) fields to the ProviderEntrySchema in packages/config/src/types.ts, allowing for more flexible provider definitions. Updated the schema to accept arbitrary provider keys and added corresponding tests for new fields and validation logic. [1] [2] [3] [4] [5]

CI/CD Workflow and Tooling Updates

• Upgraded GitHub Actions and third-party workflow actions to their latest versions across multiple workflow files, including ci.yml, codeql.yml, container.yml, landing.yml, package.yml, and release.yml. Also updated Docker base images to newer versions. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]
• Added .gitattributes file to enforce consistent line endings and file type handling.
• Introduced .contributerc.json to standardize contribution workflow and commit conventions.
• Removed Husky commit message validation scripts, shifting commit convention enforcement to CI/CD and repository configuration. [1] [2]

Dependency and Toolchain Upgrades

• Updated Biome, TypeScript, and related dependencies to their latest versions in package.json, biome.json, and packages/compactor/package.json. [1] [2] [3]

Documentation Improvements

• Enhanced the README.md with clearer contributing instructions, improved licensing and author attribution, and updated project structure and feature descriptions. [1] [2] [3] [4]

Minor Core and Type Additions

• Added StreamEvent and Tool to imports in packages/core/src/loop.ts, and introduced a constant for the restart tool name. [1] [2]

[Copilot]

Pull request overview

This PR modernizes Tiny Claw’s configuration + plugin ecosystem and refreshes tooling/CI, while also updating branding/theme assets for the web + landing surfaces.

Changes:

• Extend provider configuration support (e.g., providerId, mode) and update provider/plugin initialization paths accordingly.
• Add/expand plugin management capabilities (community plugin install/remove/list, pairing-tool discovery, plugin update checks) plus new Telegram (channel) and Ollama (provider) plugins.
• Upgrade dependencies/toolchain and refresh CI/CD workflows, Docker base images, and contributor/line-ending configuration.

Reviewed changes

Copilot reviewed 67 out of 78 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/web/src/app.css	Update web UI theme colors/branding variables
src/web/package.json	Bump Vite version for web UI
src/landing/src/components/Hero.svelte	Replace hero icon with animated/clickable logo behavior
src/landing/src/components/Footer.svelte	Update footer branding content/layout
src/landing/src/App.svelte	Replace navbar icon with logo image
src/landing/src/app.css	Update landing theme colors and add logo animation CSS
src/landing/public/favicon/site.webmanifest	Add PWA manifest for new favicon set
src/landing/public/favicon/favicon.ico	Add favicon asset
src/landing/public/favicon/favicon-32x32.png	Add favicon asset
src/landing/public/favicon/favicon-16x16.png	Add favicon asset
src/landing/package.json	Bump Vite version for landing app
src/landing/index.html	Register favicon/manifest links
src/cli/tests/purge.test.ts	Add test for purge fallback when secrets store is corrupt
src/cli/tests/commands/start.test.ts	Expand start-command mocks/tests (discord status tool, plugin plumbing)
src/cli/src/utils/secrets.ts	Centralize secrets integrity error detection + recovery messaging
src/cli/src/index.ts	Add plugin command entrypoint to CLI
src/cli/src/commands/start.ts	Add plugin discovery/tools, provider selection tweaks, update nudges, discord status tool, secrets integrity handling
src/cli/src/commands/setup.ts	Add secrets integrity recovery handling during setup
src/cli/src/commands/setup-web.ts	Add secrets integrity recovery handling during web setup
src/cli/src/commands/purge.ts	Improve purge robustness (Windows retry, secrets-engine destroy when possible)
src/cli/src/commands/plugin.ts	New CLI subcommand to manage community plugins
README.md	Documentation/structure/contributing + wording/link updates
plugins/provider/README.md	Update provider plugin dev docs for new createProvider(secrets, configManager) signature and add Ollama reference
plugins/provider/plugin-provider-openai/src/index.ts	Update provider plugin factory signature and read config values
plugins/provider/plugin-provider-ollama/tsconfig.json	Add TS build config for new Ollama provider plugin
plugins/provider/plugin-provider-ollama/tests/provider.test.ts	Add provider behavior tests (local vs cloud auth header)
plugins/provider/plugin-provider-ollama/tests/pairing.test.ts	Add pairing-tool tests for Ollama provider
plugins/provider/plugin-provider-ollama/src/provider.ts	Implement Ollama provider (chat + availability checks)
plugins/provider/plugin-provider-ollama/src/pairing.ts	Implement Ollama pairing/list/set/unpair tools
plugins/provider/plugin-provider-ollama/src/index.ts	Wire Ollama plugin entrypoint (provider factory + pairing tools)
plugins/provider/plugin-provider-ollama/src/catalog.ts	Add Ollama constants, defaults, model discovery helpers
plugins/provider/plugin-provider-ollama/README.md	Document Ollama provider plugin usage
plugins/provider/plugin-provider-ollama/package.json	Define Ollama provider plugin package metadata/scripts
plugins/provider/plugin-provider-ollama/CHANGELOG.md	Add changelog for new Ollama plugin
plugins/channel/README.md	Update channel plugin dev docs to include Telegram
plugins/channel/plugin-channel-telegram/tsconfig.json	Add TS build config for new Telegram channel plugin
plugins/channel/plugin-channel-telegram/tests/pairing.test.ts	Add Telegram pairing-tool tests
plugins/channel/plugin-channel-telegram/tests/index.test.ts	Add Telegram plugin metadata/utility tests
plugins/channel/plugin-channel-telegram/src/pairing.ts	Implement Telegram pairing/unpair tools
plugins/channel/plugin-channel-telegram/src/index.ts	Implement Telegram runtime (long polling, routing, chunking)
plugins/channel/plugin-channel-telegram/README.md	Document Telegram channel plugin usage
plugins/channel/plugin-channel-telegram/package.json	Define Telegram plugin package metadata/scripts
plugins/channel/plugin-channel-telegram/CHANGELOG.md	Add changelog for new Telegram plugin
plugins/channel/plugin-channel-discord/tests/index.test.ts	Extend Discord tests to cover runtime status exposure
plugins/channel/plugin-channel-discord/src/pairing.ts	Improve Discord pairing tool guidance text
plugins/channel/plugin-channel-discord/src/index.ts	Add runtime status tracking + helper export
packages/types/src/index.ts	Extend types (owner-only tools, SecretsManagerInterface destroy, ProviderPlugin signature)
packages/secrets/src/secrets-engine.d.ts	Extend secrets-engine typings with destroy()
packages/secrets/src/manager.ts	Add SecretsManager destroy() wrapper
packages/plugins/src/update-checker.ts	Add plugin update checker with caching + prompt-context builder
packages/plugins/src/index.ts	Add pairing-tool discovery + re-export community/update helpers
packages/plugins/src/community.ts	Add community plugin install/remove/list management
packages/delegation/src/background.ts	Improve background queue error handling + cleanup/notifications
packages/core/tests/loop.test.ts	Add loop tests for plugin guidance and auto-restart behavior
packages/core/src/loop.ts	Add plugin setup guidance, auto-restart after pairing, improved tool-result natural reply behavior
packages/config/tests/types.test.ts	Add schema tests for providerId/mode support
packages/config/src/types.ts	Extend provider schema (providerId/mode) and allow arbitrary provider keys
packages/compactor/package.json	Bump TypeScript devDependency
package.json	Remove Husky prepare hook, bump Biome/TypeScript/@types/node
Dockerfile	Bump Bun base images
bun.lock	Update lockfile for dependency/tooling changes and new workspaces
biome.json	Bump Biome schema version reference
.husky/validate-commit-msg.mjs	Remove Husky commit-msg validation script
.husky/commit-msg	Remove Husky commit-msg hook
.gitignore	Ignore .contributerc.json
.github/workflows/release.yml	Bump release action version
.github/workflows/package.yml	Update Node setup/action versions and package workflow options
.github/workflows/landing.yml	Bump deploy-pages action version
.github/workflows/container.yml	Bump container tooling/action versions and workflow options
.github/workflows/codeql.yml	Bump CodeQL action pins
.github/workflows/ci.yml	Bump retry action version
.gitattributes	Add line-ending normalization and binary file rules
.contributerc.json	Add contributor workflow/commit convention configuration

[github-actions]

📦 Package Build Flow — Monorepo Build

🔀 Pull Request Build — Pre-release package for testing PR changes

Package	Version	Status	Install
@tinyclaw/plugins	2.0.0-dev.6c85ab5	✅ Published	npm i @tinyclaw/plugins@2.0.0-dev.6c85ab5
@tinyclaw/types	2.0.0-dev.6c85ab5	✅ Published	npm i @tinyclaw/types@2.0.0-dev.6c85ab5
tinyclaw	2.0.0-dev.6c85ab5	✅ Published	npm i tinyclaw@2.0.0-dev.6c85ab5
@tinyclaw/plugin-channel-discord	2.0.0-dev.6c85ab5	✅ Published	npm i @tinyclaw/plugin-channel-discord@2.0.0-dev.6c85ab5
@tinyclaw/plugin-channel-friends	2.0.0-dev.6c85ab5	✅ Published	npm i @tinyclaw/plugin-channel-friends@2.0.0-dev.6c85ab5
@tinyclaw/plugin-channel-telegram	2.0.0-dev.6c85ab5	⚠️ Built (not published)	—
@tinyclaw/plugin-provider-ollama	2.0.0-dev.6c85ab5	⚠️ Built (not published)	—
@tinyclaw/plugin-provider-openai	2.0.0-dev.6c85ab5	⚠️ Built (not published)	—

📥 Quick Install (changed packages)

npm i @tinyclaw/types@2.0.0-dev.6c85ab5 @tinyclaw/plugins@2.0.0-dev.6c85ab5 @tinyclaw/plugin-channel-discord@2.0.0-dev.6c85ab5 @tinyclaw/plugin-channel-friends@2.0.0-dev.6c85ab5 tinyclaw@2.0.0-dev.6c85ab5

---

This package was built automatically by the Package Build Flow action.

[github-actions]

🛠️ Container Build Complete - Dev Build

Build Status: ✅ Success
Flow Type: dev
Description: Development and testing

---

📦 Pull Image

Docker Hub: docker pull warengonzaga/tinyclaw:dev-6c85ab5

GHCR: docker pull ghcr.io/warengonzaga/tinyclaw:dev-6c85ab5

---

📋 Build Details

Property	Value
Flow Type	dev
Commit	7fde6f5
Registry	Docker Hub + GHCR

🏷️ Image Tags

• warengonzaga/tinyclaw:dev-6c85ab5
• ghcr.io/warengonzaga/tinyclaw:dev-6c85ab5

---

🔍 Testing Your Changes

1. Pull the image using one of the commands above
2. Run the container with your test configuration
3. Verify the changes work as expected
4. Report any issues in this PR

---

🚀 Quick Start

# Pull and run the container
Docker Hub: docker pull warengonzaga/tinyclaw:dev-6c85ab5
docker run <your-options> <image>

---

---

🔒 Security Scan Results

📋 Pre-Build Security Checks

✅ Source Code Scan: 0 vulnerabilities found
✅ Dockerfile Scan: 0 misconfigurations found

🐳 Container Image Vulnerabilities

Severity	Count
Total	0

📊 Detailed Security Reports

View detailed vulnerability reports in the GitHub Security tab.

---

_{🤖 Powered by Container Build Flow Action vv1.7.1
💻 with ❤️ by Waren Gonzaga under WG Technology Labs, and Him 🙏}

[github-actions]

📦 Package Build Flow — Monorepo Build

🔀 Pull Request Build — Pre-release package for testing PR changes

Package	Version	Status	Install
@tinyclaw/plugins	2.0.0-dev.fa2f03f	⚠️ Built (not published)	—
@tinyclaw/types	2.0.0-dev.fa2f03f	⚠️ Built (not published)	—
tinyclaw	2.0.0-dev.fa2f03f	⚠️ Built (not published)	—
@tinyclaw/plugin-channel-discord	2.0.0-dev.fa2f03f	⚠️ Built (not published)	—
@tinyclaw/plugin-channel-friends	2.0.0-dev.fa2f03f	⚠️ Built (not published)	—
@tinyclaw/plugin-channel-telegram	2.0.0-dev.fa2f03f	⚠️ Built (not published)	—
@tinyclaw/plugin-provider-ollama	2.0.0-dev.fa2f03f	⚠️ Built (not published)	—
@tinyclaw/plugin-provider-openai	2.0.0-dev.fa2f03f	⚠️ Built (not published)	—

📥 Quick Install

⚠️ No packages were published to any registry.

---

This package was built automatically by the Package Build Flow action.