Skip to content

Add OpenClaw EVE ESI Skill - #273

Closed
burnshall-ui wants to merge 1 commit into
esi:mainfrom
burnshall-ui:add-openclaw-eve-esi
Closed

Add OpenClaw EVE ESI Skill#273
burnshall-ui wants to merge 1 commit into
esi:mainfrom
burnshall-ui:add-openclaw-eve-esi

Conversation

@burnshall-ui

Copy link
Copy Markdown

Adds OpenClaw EVE ESI Skill to the community services list.

Service: OpenClaw EVE ESI Skill
Type: Service (End-user tool)
Description: OpenClaw skill for ESI account management with natural language queries, alerts, reports, and market tracking.

Links:

Features:

  • Natural language ESI queries
  • Automated alerts (war, structures, skills, PI, wallet)
  • Scheduled reports
  • Market price tracking
  • Secure token handling
  • Multi-platform (Telegram, Discord, Signal)

The service is actively maintained and production-ready.

@burnshall-ui
burnshall-ui requested review from a team as code owners February 9, 2026 16:03
@steven-noorbergen

Copy link
Copy Markdown
Member

Hi!

Thank you for your submission, but I will have to close it for now.

Please note the requirements for having your service listed:

  • Your service/resource must be public for at least three months.
    Judging from the commit history, this skill has only been available for 18 hours as of moment of writing.

Also, your skill seems to be using the old Swagger interface, ESI has since migrated to OpenAPI, and is using compatibility dates in favor of versioned URLs. Please be advised that both Swagger, as well as using versioned URLs has been deprecated and will be removed in the future.

Feel free to re-open this issue when you feel your service meets all requirements

  • CCP Stroopwafel

burnshall-ui added a commit to burnshall-ui/openclaw-eve-skill that referenced this pull request Aug 14, 2026
CCP closed the esi-docs listing PR (esi/esi-docs#273) on two technical
grounds: the skill spoke Swagger and used versioned URLs, both deprecated.
Fixing that turned out to be the smaller half of this commit.

Versioning. The base URL loses its /latest prefix and every request carries
X-Compatibility-Date, pinned to 2026-08-04 and overridable via
--compatibility-date or EVE_ESI_COMPATIBILITY_DATE. The subtlety is which way
the default falls: a request without the header does not get current
behaviour, it gets the *oldest* ESI still serves, and CCP raises that floor
over time. normalize_endpoint now strips /latest, /legacy, /dev and /vN if one
reaches it anyway — which also repairs the write gate, since a prefixed
/latest/characters/affiliation/ never matched READ_ONLY_POST_PATTERNS and a
documented bulk lookup was being rejected as a state-changing write.

Route planning broke under the new date and had to be rewritten: as of
compatibility date 2025-09-30, GET /route/ is a POST with a JSON body,
flag=shortest|secure|insecure became preference=Shorter|Safer|LessSecure,
avoid became avoid_systems, and the response is {"route": [...]} instead of a
bare array. The CLI flags are unchanged; the mapping is internal. Since the
lookup is read-only despite the method, it joins the read-only POST allowlist.

Worth recording for the next bump: the OpenAPI spec is itself served per
compatibility date. Fetching /meta/openapi.json without one returns the old
spec, in which this route still looks like a GET.

Rate limiting and identification. 429 responses are now retried after
Retry-After alongside the existing 420 handling, and a bucket below 20% warns
on stderr. Every ESI *and* SSO request sends a User-Agent naming the skill,
its version and this repository; the auth scripts previously announced
themselves as Python-urllib, which is the anonymous traffic CCP asks people
not to send. Set EVE_ESI_CONTACT to add an address.

The OAuth callback was unusable. auth_flow.py sent
http://127.0.0.1:8080/callback, but the developer portal accepts the http
scheme only for the host localhost and refuses an IP address on save — so the
redirect URI could not be registered at all, and the flow could not complete
for any newly created application. It now sends localhost. The callback server
still binds 127.0.0.1, which is the tunnel's far end and unrelated.

Four PI bugs that only real colonies revealed. Each degraded silently and
exited 0, so nothing short of reading the output would have caught them:

  - Planet names went to /universe/names/, which does not resolve planet IDs
    at all. Worse, that endpoint rejects an entire batch containing one
    unresolvable ID, so the character lookup failed with it. Names now come
    from /universe/planets/{id}/.
  - PI_PRODUCTS claimed "P0 + P1 complete" with 26 entries and was missing 9
    of the 15 P0 commodities. Unknown type IDs are resolved through ESI now,
    with the table kept only as a fast path.
  - _character_name was read but never written, so "character" always said
    "unknown".
  - estimate_storage_fill_pct was wrong three ways and always returned null,
    meaning the advertised 80% storage alert could never fire. Its capacity
    table held two entries while PI buildings exist per planet type; those two
    were mutually swapped; and it divided item counts by cubic metres, ESI
    reporting contents in units and capacity in m3. Capacity and per-unit
    volume now come from /universe/types/, cached per run.

Documentation that promised things the code does not do. There is no poller,
no scheduler and no notification sender anywhere in this skill, yet the README
advertised "automated alerts, scheduled reports and price tracking"; it now
says the skill defines and validates a config vocabulary and leaves execution
to whatever acts on it. threat_query.py, cache_threat_data.py and
cache_market_prices.py are specifications, not files, and the README implied
they shipped. The full profile covers 17 of the 37 scopes documented in
references/endpoints.md, which the name rather oversells — the 16 remaining
read scopes are reachable through --scopes, and the four write scopes stay out
deliberately. README also still described a 17-scope default that stopped
being true in 1.3.2, and pointed at a SCOPES constant that no longer exists.

SSO token verification moves to /v2/oauth/verify, the userinfo endpoint named
by the SSO metadata document. A .gitignore now sits in the skill directory as
well as here, because the ClawHub bundle was shipping __pycache__.

Tests go from 14 to 32, covering the compatibility header, prefix stripping,
429 retry and the new route contract. Verified against a live account: 2914
assets over three pages, six PI colonies, wallet, mail and killmails, and a
mail POST correctly refused without --allow-write.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants