main to prod

.github/workflows/desktop-release.yml

@@ -97,6 +97,31 @@ jobs:
 
           echo "::notice::Building $CHANNEL v$VERSION against $API_URL"
 
+      - name: Refuse a duplicate release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ steps.compute.outputs.release-tag }}
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          # Prod's version comes from tauri.conf.json alone, so a second push to
+          # `prod` without a version bump collides with the existing tag. Left
+          # to the publish job that surfaces as a ~25-minute build that dies at
+          # the last step; catch it here in seconds instead.
+          #
+          # Re-running the *same* commit is legitimate (e.g. a flaky publish),
+          # so that case passes through — the publish job replaces the assets.
+          EXISTING=$(gh release view "$RELEASE_TAG" --json targetCommitish -q .targetCommitish 2>/dev/null || true)
+          if [ -z "$EXISTING" ]; then
+            echo "No release exists for $RELEASE_TAG — proceeding."
+          elif [ "$EXISTING" = "$SOURCE_SHA" ]; then
+            echo "::notice::$RELEASE_TAG already exists for this commit; its assets will be replaced."
+          else
+            echo "::error::Release $RELEASE_TAG already exists, built from $EXISTING. Bump \"version\" in desktop/src-tauri/tauri.conf.json (or delete that release) before releasing again."
+            exit 1
+          fi
+
   build:
     name: build (${{ matrix.platform }})
     needs: setup
@@ -358,6 +383,9 @@ jobs:
       - name: Publish release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # This job has no checkout, so `gh` can't infer the repo from a git
+          # remote — it must be told explicitly or it exits "not a git repository".
+          GH_REPO: ${{ github.repository }}
           RELEASE_TAG: ${{ needs.setup.outputs.release-tag }}
           CHANNEL: ${{ needs.setup.outputs.channel }}
           IS_PRE: ${{ needs.setup.outputs.is-prerelease }}
@@ -389,8 +417,19 @@ jobs:
             EXTRA+=( --prerelease )
           fi
 
-          gh release create "$RELEASE_TAG" \
-            --title "Clawbits $RELEASE_TAG" \
-            --notes "$NOTES" \
-            "${EXTRA[@]}" \
-            "${FILES[@]}"
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            # Only reachable when the release belongs to this same commit — the
+            # setup job already rejected the forgot-to-bump case. Replace the
+            # assets so a failed publish can be re-run without hand-deleting
+            # the release.
+            echo "::notice::$RELEASE_TAG exists for this commit — replacing its assets"
+            gh release upload "$RELEASE_TAG" --clobber "${FILES[@]}"
+            gh release edit "$RELEASE_TAG" --notes "$NOTES"
+          else
+            gh release create "$RELEASE_TAG" \
+              --title "Clawbits $RELEASE_TAG" \
+              --notes "$NOTES" \
+              --target "$SOURCE_SHA" \
+              "${EXTRA[@]}" \
+              "${FILES[@]}"
+          fi

.github/workflows/release.yaml

@@ -32,4 +32,9 @@ jobs:
         uses: cycjimmy/semantic-release-action@v4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # workflow_run events carry GITHUB_REF/GITHUB_SHA of the default branch,
+          # not of the branch that triggered Test; semantic-release reads these to
+          # pick the release branch, so point them at the triggering branch.
+          GITHUB_REF: refs/heads/${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.ref_name }}
+          GITHUB_SHA: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
 

README.md

@@ -1,8 +1,5 @@
 <p align="center">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset=".github/assets/clawbits-wordmark-dark.svg">
-    <img src=".github/assets/clawbits-wordmark.svg" alt="Clawbits" width="360">
-  </picture>
+  <img src=".github/assets/github-preview.png" alt="Clawbits" width="880">
 </p>
 
 <p align="center">Team chat where the agents are members, not integrations - with their own mailbox, git repos, and automations.</p>
@@ -13,6 +10,8 @@
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT"></a>
 </p>
 
+<p align="center"><a href="https://clawbits.ai/">Website</a> · <a href="https://x.com/clawbitsai">X</a></p>
+
 An agent holds its own API key and its own row in every membership, post, and reaction table, so it reads and writes exactly like a teammate:
 
 ```bash

desktop/src-tauri/tauri.conf.json

@@ -42,7 +42,7 @@
       "endpoints": [
         "https://github.com/skalenetwork/clawbits/releases/latest/download/latest.json"
       ],
-      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEI5NTRCQ0U4NkQzRjQ0QjQKUldTMFJEOXQ2THhVdVNjZ25yNmJ2Sml0eFhabU5rWG1NeFlYbjFIQjlDK1JBRXY2dW8vaFJOVWwK"
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI1NjBDMjBBRkVCRjlDQzQKUldURW5MLytDc0pnSlM4ZUNvWnFBSkI5V3NzM1AyemdyaWZCdnlHTXUyWHhMNGlBa0dHQXNIZXkK"
     }
   },
   "bundle": {