release

A release checklist for ClawRouter, the software package named in the instructions.

In plain words
What is it for?
Bumping the package version, writing changelog entries, building, testing, publishing to npm, and creating the related Git tag and GitHub release.
Why use it?
It reduces the chance of publishing a release with mismatched versions, missing notes, failed checks, or missing tags.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/blockrunai/clawrouter/release
Any agent
npx skills add BlockRunAI/ClawRouter --skill release
Clone the repo
git clone --depth 1 https://github.com/BlockRunAI/ClawRouter

Made for: Claude Code, Codex.

Per session 44 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,367 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00044 $0.01367
Opus 5 $0.00022 $0.00683
Sonnet 5 $0.00009 $0.00273
Haiku 4.5 $0.00004 $0.00137

Measured 3d ago against content hash 072804f07d2a, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/release/SKILL.md · 211 lines

How it starts

The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ClawRouter Release Checklist

This skill is mandatory for every release. Execute every step in order. Do not skip.

Step 1: Confirm the New Version

Read the current version:

cat package.json | grep '"version"'

Ask: "What version are we releasing?" Confirm it follows semver and is higher than current.


Step 2: Update package.json Version

Edit package.json — bump "version" to the new version.


Step 3: Write CHANGELOG Entry

Open CHANGELOG.md. Add a new section at the top (after the header) in this format:

## v{VERSION} — {DATE}

- **Feature/Fix name** — description
- **Feature/Fix name** — description

Rules:

  • Date format: Mar 8, 2026
  • One bullet per logical change
  • Every bullet must be present — no "see git log"
  • Include all changes since the previous release

Step 4: Confirm No Manual Server Sync Required

No file edit needed here. Earlier releases (pre-v0.12.x) required manually updating a CURRENT_CLAWROUTER_VERSION constant in blockrun's src/app/api/v1/chat/completions/route.ts. That constant has been replaced: the server now fetch-es https://registry.npmjs.org/@blockrun/clawrouter/latest at process startup and uses the returned version to drive the update_available hint embedded in 429 responses to outdated clients.

// blockrun/src/app/api/v1/chat/completions/route.ts
let latestClawRouterVersion: string | null = process.env.CLAWROUTER_CURRENT_VERSION || null;
fetch("https://registry.npmjs.org/@blockrun/clawrouter/latest", {
  signal: AbortSignal.timeout(5000),
})
  .then((r) => r.json())
  .then((data) => {
    if (data.version) latestClawRouterVersion = data.version;
  })
  .catch(() => {
    /* keep env var fallback */
  });

Implications:

  • The npm publish in Step 11 IS the entire "sync blockrun" action. After that step lands, the next blockrun server restart will fetch and surface the new version. No manual constant edit. No separate PR in the blockrun repo.
  • CLAWROUTER_CURRENT_VERSION env var is the cold-start fallback (used only when the registry fetch fails). It exists for resilience, not as the primary mechanism — don't touch it on every release.
  • Verification of the user-facing update nudge happens in Step 12 via npm view @blockrun/clawrouter version (the same registry endpoint blockrun's server hits).

Read the full file on GitHub · 211 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 211 lines · 44 tokens per session scan A 072804f07d2a

Subscribe to this mod's changes

release is a skill published in the GitHub repository BlockRunAI/ClawRouter (6,574 stars, last pushed today), licensed MIT. It adds 44 tokens to every session and 1,367 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.