ivankuznetsov · ivankuznetsov · Jul 22, 2026 · Jul 22, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -13,7 +13,7 @@
       "name": "llm-wiki",
       "source": "./plugins/llm-wiki",
       "description": "Create and query project wikis with optional maintenance automation.",
-      "version": "0.3.4",
+      "version": "0.3.5",
       "author": {
         "name": "ivankuznetsov",
         "url": "https://github.com/ivankuznetsov"

diff --git a/docs/agent-compatibility.md b/docs/agent-compatibility.md
@@ -35,7 +35,7 @@ plugin directory so a copied package does not depend on the repository root.
 | Agent Reviewer | `0.3.1` | Stable | `skills/agent-reviewer/SKILL.md` | agents, references, scripts, eval harness |
 | Agent SEO | `2.0.1` | Stable | `skills/seo/SKILL.md` | agents, context, data sources, hooks, scripts |
 | Agent Writing | `0.5.2` | Stable | `skills/writing/SKILL.md` | agents, voice/style context |
-| LLM Wiki | `0.3.4` | Stable | five files under `skills/` | assets, consent-gated maintenance templates |
+| LLM Wiki | `0.3.5` | Stable | five files under `skills/` | assets, consent-gated maintenance templates |
 | Screenote | `3.0.1` | Stable | `skills/{screenote,snapshot,feedback}/SKILL.md` | CLI launcher, references, evals |
 
 ## Plugin invocations

diff --git a/plugin-surfaces.json b/plugin-surfaces.json
@@ -174,7 +174,7 @@
     {
       "name": "llm-wiki",
       "path": "plugins/llm-wiki",
-      "version": "0.3.4",
+      "version": "0.3.5",
       "stability": "stable",
       "metadata": {
         "display_name": "LLM Wiki",

diff --git a/plugin-surfaces.lock.json b/plugin-surfaces.lock.json
@@ -636,7 +636,7 @@
       }
     },
     "llm-wiki": {
-      "version": "0.3.4",
+      "version": "0.3.5",
       "canonical": {
         "skills/bootstrap/SKILL.md": {
           "sha256": "6e446e783ac32d2f605f036891fcee29651aca14696065f2753cec13eab58a16",
@@ -722,7 +722,7 @@
         },
         "templates": {
           "exists": true,
-          "sha256": "eadb377a0defb2c14f3abb3a63bbf9ce836e8035045f96a2f25a4836540df411",
+          "sha256": "5bfdb6df0bbfc2d23df12e05f47bdab4c99845385ffb3f1528498812dcc9dece",
           "files": [
             "templates/compile-log.sh",
             "templates/install-systemd-scheduler.sh",

diff --git a/plugins/llm-wiki/.claude-plugin/plugin.json b/plugins/llm-wiki/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "llm-wiki",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Create and query project wikis with optional maintenance automation.",
   "author": {
     "name": "ivankuznetsov",

diff --git a/plugins/llm-wiki/.codex-plugin/plugin.json b/plugins/llm-wiki/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "llm-wiki",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Create and query project wikis with optional maintenance automation.",
   "author": {
     "name": "ivankuznetsov",

diff --git a/plugins/llm-wiki/CHANGELOG.md b/plugins/llm-wiki/CHANGELOG.md
@@ -4,6 +4,17 @@ All notable changes to **llm-wiki** are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.3.5] - 2026-07-22
+
+### Security
+
+- Remove the undocumented `LLM_WIKI_REFRESH_CMD` arbitrary executable
+  override from the shipped worker. Headless refreshes now dispatch only to
+  the explicitly configured Codex, Claude Code, Pi, or validated OpenClaw
+  owner through fixed, bounded command shapes.
+- Vendor the standalone llm-wiki 0.1.19 provider-only dispatch fix while
+  retaining the marketplace consent gate and OpenClaw owner adaptation.
+
 ## [0.3.4] - 2026-07-22
 
 ### Fixed

diff --git a/plugins/llm-wiki/openclaw.plugin.json b/plugins/llm-wiki/openclaw.plugin.json
@@ -2,7 +2,7 @@
   "id": "llm-wiki",
   "name": "LLM Wiki",
   "description": "Create and query project wikis with optional maintenance automation.",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "skills": [
     "./openclaw/skills"
   ],

diff --git a/plugins/llm-wiki/package.json b/plugins/llm-wiki/package.json
@@ -1,6 +1,6 @@
 {
   "name": "llm-wiki",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "type": "module",
   "description": "Create and query project wikis with optional maintenance automation.",
   "homepage": "https://github.com/ivankuznetsov/llm-wiki",

diff --git a/plugins/llm-wiki/templates/post-commit-refresh.sh b/plugins/llm-wiki/templates/post-commit-refresh.sh
@@ -800,12 +800,6 @@ wiki_only_changes() {
 
 run_refresh_agent() {
   local prompt="$1"
-  if [ -n "${LLM_WIKI_REFRESH_CMD:-}" ]; then
-    run_with_timeout "${LLM_WIKI_REFRESH_TIMEOUT:-1800}" \
-      "$LLM_WIKI_REFRESH_CMD" "$refresh_root" "$prompt" >>"$log_file" 2>&1
-    return $?
-  fi
-
   local headless_agent timeout_seconds owner_config openclaw_agent_id
   owner_config="$canonical_config"
   [ -f "$owner_config" ] || owner_config="$committing_tree/.llm-wiki/config.json"

diff --git a/tests/test_llm_wiki_openclaw.py b/tests/test_llm_wiki_openclaw.py
@@ -116,6 +116,7 @@ def test_post_commit_runtime_bounds_recovery_and_publishes_only_refresh_branch(s
         self.assertIn('refresh_branch="${LLM_WIKI_REFRESH_BRANCH:-llm-wiki/refresh}"', template)
         self.assertIn('push "$refresh_remote" "HEAD:refs/heads/$refresh_branch"', template)
         self.assertNotIn('push "$refresh_remote" "HEAD:refs/heads/$base_branch"', template)
+        self.assertNotIn("LLM_WIKI_REFRESH_CMD", template)
 
     def test_compiled_log_only_commit_does_not_queue_or_launch_refresh(self):
         with tempfile.TemporaryDirectory() as directory:

diff --git a/wiki/architecture.md b/wiki/architecture.md
@@ -46,6 +46,8 @@ variables from the standard socket and retain the installed service marker
 after a transient signal failure. Compiled-`wiki/log.md`-only commits do not
 enter the queue. Successful wiki-only batches are merged with and pushed only
 to `origin/llm-wiki/refresh`, never the protected default branch.
+The runtime has no arbitrary command override: provider dispatch is limited to
+fixed Codex, Claude Code, Pi, and validated OpenClaw command shapes.
 Large queued-source pin sets are processed in bounded Git transactions, and
 recoverable interrupted queue files are rebuilt from their source commits.
 

diff --git a/wiki/gaps.md b/wiki/gaps.md
@@ -13,9 +13,9 @@
   separate version lines (`0.1.x` upstream runtime and `0.3.x` consent-gated
   marketplace package). A marketplace release must preserve the consent and
   OpenClaw adaptations while vendoring the released runtime. Marketplace
-  0.3.3 vendors the released standalone 0.1.17 headless scheduler fix; public
-  ClawHub scan and catalog visibility remain release-time evidence rather than
-  source-tree facts.
+  0.3.5 vendors the released standalone 0.1.19 provider-only dispatch fix;
+  public ClawHub scan and catalog visibility remain release-time evidence
+  rather than source-tree facts.
 - Compatibility with OpenClaw releases older than `2026.7.1-beta.2` remains
   unverified. ClawHub packages therefore declare that tested version as their
   conservative plugin API floor while leaving the broader host minimum

diff --git a/wiki/log.d/20260722T211700Z-llm-wiki-provider-only-dispatch.md b/wiki/log.d/20260722T211700Z-llm-wiki-provider-only-dispatch.md
@@ -0,0 +1,16 @@
+---
+title: Restrict LLM Wiki refreshes to configured providers
+date: 2026-07-22T21:17:00Z
+tags: [llm-wiki, security, providers, clawhub]
+---
+
+Marketplace LLM Wiki 0.3.5 vendors standalone runtime 0.1.19 and removes the
+undocumented `LLM_WIKI_REFRESH_CMD` arbitrary executable override. The worker
+retains its separate automation and provider-access consent gate, but once
+enabled it can dispatch only to the configured Codex, Claude Code, Pi, or
+validated OpenClaw owner through fixed command shapes and existing timeouts.
+
+This closes the one unexpected issue from ClawHub's delayed semantic scan of
+0.3.4. Findings about durable hooks, timers, wiki writes, and refresh-branch
+publication describe the package's disclosed opt-in purpose and remain subject
+to the existing consent, path, lock, memory, and wiki-only publication guards.
diff --git a/wiki/plugins.md b/wiki/plugins.md
@@ -8,7 +8,7 @@ OpenClaw.
 | `agent-reviewer` | `0.3.0` | `agent-reviewer` | agents, references, scripts, eval |
 | `agent-seo` | `2.0.0` | `seo` | agents, context, data sources, hooks, scripts |
 | `agent-writing` | `0.5.1` | `writing` | agents, context |
-| `llm-wiki` | `0.3.3` | `bootstrap`, `upgrade`, `research`, `wiki-plan`, `wiki-status` | assets, consent-gated templates |
+| `llm-wiki` | `0.3.5` | `bootstrap`, `upgrade`, `research`, `wiki-plan`, `wiki-status` | assets, consent-gated templates |
 | `screenote` | `3.0.0` | `screenote`, `snapshot`, `feedback` | CLI launcher, references, evals |
 
 Claude and Codex install through their root marketplaces. Pi and OpenClaw
@@ -25,9 +25,11 @@ Version 2.0 makes the removed mutation contract explicit and documents the
 LLM Wiki bootstrap creates the requested project wiki. Scheduler, managed-hook,
 shared-Git, and provider-backed maintenance are a separate opt-in; 0.2.x
 configs without both consent flags are automation-disabled under the 0.3
-runtime. Version 0.3.3 reconciles linked checkouts to one non-persistent,
+runtime. Version 0.3.5 reconciles linked checkouts to one non-persistent,
 memory-bounded timer per repository, serializes providers across repositories,
 publishes wiki-only output to `origin/llm-wiki/refresh`, and bounds source-ref
 recovery transactions. Headless hooks reconstruct the standard user bus,
 retain the scheduler marker after transient signal failure, and ignore commits
-that only rewrite compiled `wiki/log.md`.
+that only rewrite compiled `wiki/log.md`. The worker accepts only its configured
+Codex, Claude Code, Pi, or validated OpenClaw owner; it no longer exposes an
+arbitrary refresh-command environment override.