Fix social cards to show installs instead of downloads

[vyctorbrzezowski]

Summary

This PR changes the OG/social-card stats from downloads to installs for skill, plugin, org, and publisher cards.

The implementation keeps the existing OG rendering path and only changes the stat source plus label:

• Skill cards read stats.installsAllTime from the public skill API.
• Plugin cards read package stats.installs.
• Publisher/org cards read profile stats.installs.
• downloads= is no longer accepted as the stat query param for these OG routes; explicit zero values should use installs=0.
• Skill OG metadata fetches include ownerHandle when the route has an owner, matching the owner-scoped slug lookup added on main.

Production source check

Captured against the candidate route with production Convex configured, without passing stat numbers in the OG URL.

• Skill pskoett/self-improving-agent: production API returned downloads: 462162, installsAllTime: 6923; OG shows Installs 6.9k.
• Plugin zerogpu-router: production API returned downloads: 393, installs: 74; OG shows Installs 74.
• Org openclaw: production profile returned installs: 32; OG shows Installs 32.
• Publisher pskoett: production profile returned installs: 6934; OG shows Installs 6.9k.

Screenshots

Skill	Plugin

Org	Publisher

Validation

• bun run test -- server/og/fetchSkillOgMeta.test.ts server/og/fetchPluginOgMeta.test.ts server/og/fetchPublisherOgMeta.test.ts server/routes/og/skill.png.test.ts server/routes/og/plugin.png.test.ts server/og/skillOgSvg.test.ts src/lib/og.test.ts src/__tests__/skill-route-loader.test.ts
• git diff --check
• bun run ci:static
• bun run ci:unit
• bun run ci:types-build
• bun run ci:e2e-http

CI Notes

• GitHub e2e-http is red on this run because e2e/permissions.e2e.test.ts timed out at 60s on the runner. The same bun run ci:e2e-http command passed locally after the push.
• I attempted gh run rerun 27725259333 --failed, but GitHub rejected it with Must have admin rights to Repository.
• Vercel is red because deploy authorization is required for this fork PR.
• bun run proof:ui could not publish through the repo helper because the local crabbox command is unavailable here, so the screenshots above were captured manually from the local candidate route using production Convex.
• .agents/skills/autoreview/scripts/autoreview --mode branch --base upstream/main could not complete because the external Codex reviewer hit the account usage limit; --engine claude is unavailable on this machine.

[vercel]

@vyctorbrzezowski is attempting to deploy a commit to the Amantus Machina Team on Vercel.

A member of the Team first needs to authorize it.

[vyctorbrzezowski]

@clawsweeper review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/27725667526
• Updated: 2026-06-17T23:38:31.446Z

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 17, 2026, 7:37 PM ET / 23:37 UTC.

Summary
The branch updates skill, plugin, and publisher/org OG social-card routes and tests to source and display install counts, pass ownerHandle for skill metadata fetches, and bump OG cache versions.

Reproducibility: yes. Latest main source still reads and labels downloads for the skill, plugin, and profile OG routes, and the candidate screenshots demonstrate the corrected Installs output.

Review metrics: 2 noteworthy metrics.

• Diff size: +227/-40 across 15 files. The change is small but spans all three social-card surfaces plus helper and route tests.
• OG surfaces touched: 3 route handlers, 3 metadata helpers. Maintainers should keep skill, plugin, and publisher cards aligned on the installs invariant.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Rerun or explicitly accept the red e2e-http timeout before merge.

Risk before merge

• [P2] The GitHub e2e-http check is red from a runner timeout while the PR body reports the same command passed locally, so maintainers still need a rerun or policy acceptance before merge.

Maintainer options:

1. Decide the mitigation before merge
   Merge the focused OG-route/test update after required checks are green or explicitly accepted by maintainers.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• No ClawSweeper repair lane is needed; the remaining action is ordinary maintainer/check handling, not a code change.

Security
Cleared: No security or supply-chain concerns were found; the diff changes OG rendering code and tests without dependencies, workflows, secrets, install scripts, or permission surfaces.

Review details

Best possible solution:

Merge the focused OG-route/test update after required checks are green or explicitly accepted by maintainers.

Do we have a high-confidence way to reproduce the issue?

Yes. Latest main source still reads and labels downloads for the skill, plugin, and profile OG routes, and the candidate screenshots demonstrate the corrected Installs output.

Is this the best way to solve the issue?

Yes. The PR fixes the rendering/fetch layer that owns these OG cards and uses install fields already exposed by the existing public skill, package, and publisher data shapes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 69c79e8f0120.

Label changes

Label changes:

• add P3: This is low-risk social-card polish with focused tests and no core runtime, security, or data-loss impact.
• add proof: sufficient: Contributor real behavior proof is sufficient. The PR body now contains inspected real screenshot proof for skill, plugin, org, and publisher OG cards showing the after-fix Installs output.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The PR body now contains inspected real screenshot proof for skill, plugin, org, and publisher OG cards showing the after-fix Installs output.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: 🛠️ actively grinding: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P3: This is low-risk social-card polish with focused tests and no core runtime, security, or data-loss impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The PR body now contains inspected real screenshot proof for skill, plugin, org, and publisher OG cards showing the after-fix Installs output.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body now contains inspected real screenshot proof for skill, plugin, org, and publisher OG cards showing the after-fix Installs output.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The PR body now contains inspected real screenshot proof for skill, plugin, org, and publisher OG cards showing the after-fix Installs output.

Evidence reviewed

What I checked:

• Current main still shows downloads: Latest main still reads meta?.stats.downloads and labels the skill, plugin, and profile OG stats as Downloads, so the requested behavior is not implemented on main. (server/routes/og/skill.png.ts:103, 69c79e8f0120)
• PR head changes the rendered stat: The PR head switches the skill, plugin, and profile OG routes to installsFromQuery plus the install-backed metadata fields and label Installs. (server/routes/og/skill.png.ts:105, 5601e2b723b2)
• Existing UI already treats these counts as installs: The publisher page renders published item stats with readPublicInstallCount(item) and the visible label installs, supporting the PR's consistency fix for social cards. (src/routes/user/$handle.tsx:541, 69c79e8f0120)
• Install stats exist in current data/API shapes: Current publisher stats aggregate totalInstalls from skills and packages, and package API list items expose stats.installs, so the PR does not need a schema or API feature to render installs. (convex/lib/publisherStats.ts:30, 69c79e8f0120)
• Real behavior proof inspected: Downloaded and inspected the four PR-body screenshots from the contributor branch; they show Skill Installs 6.9k, Plugin Installs 74, Org Installs 32, and Publisher Installs 6.9k on actual generated OG cards. (5601e2b723b2)
• Feature provenance: Git blame and PR history show the current OG route/fetch-helper implementation was introduced by merged pull request feat(cli)!: remove sync command #2669 at commit e3e5705. (server/routes/og/skill.png.ts:103, e3e5705d8969)

Likely related people:

• Patrick-Erichsen: Git blame and PR metadata tie the current skill, plugin, profile OG route handlers and fetch helpers to merged pull request feat(cli)!: remove sync command #2669. (role: introduced current OG/social-card implementation; confidence: high; commits: e3e5705d8969; files: server/routes/og/skill.png.ts, server/routes/og/plugin.png.ts, server/routes/og/profile.png.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.