docs(v2.2.0): clawhub skill + URL fix for Plugin Pro upgrade pointer

CHANGELOG.md

@@ -21,7 +21,7 @@ every governed request.
 
 ### Added
 
-- **Status surface tier line + plugin-init canary now surface Pro license expiry date.** The `tier` field in `buildStatusReport()` / `formatStatusReport()` / the `axonflow-openclaw-status` CLI parses the JWT `exp` claim from the configured Pro license token and renders one of three shapes: `Pro (expires YYYY-MM-DD, N days remaining)` when active, `Free (Pro expired YYYY-MM-DD — visit https://getaxonflow.com/pro to renew)` when the token is on disk but its `exp` has passed (plugin will not forward an expired token), or `Free (no Pro license configured)` when no token is loaded. The plugin-init canary line emitted by `registerAxonFlowGovernance` matches the same three shapes so users notice their renewal window on every plugin reload. New exports: `buildProTierInitLogLine`, `parseLicenseTokenExpiry`, `formatExpiryDate`, `daysUntil`. New `StatusReport` fields: `expires_at` (YYYY-MM-DD UTC, nullable) and `expires_in_days` (integer, negative when expired, nullable). New `StatusTier` value `"pro_expired"` distinguishes a configured-but-lapsed token from `"free"` for renew-CTA rendering. Display only — JWT signature validation remains the platform's job. Tokens whose JWT body fails to parse fall back to the legacy `Pro tier active — license token configured, X-License-Token will be forwarded on every governed request` canary so byte-exact compat with mode-clarity assertions and any external grep on the v2.1.x string is preserved.
+- **Status surface tier line + plugin-init canary now surface Pro license expiry date.** The `tier` field in `buildStatusReport()` / `formatStatusReport()` / the `axonflow-openclaw-status` CLI parses the JWT `exp` claim from the configured Pro license token and renders one of three shapes: `Pro (expires YYYY-MM-DD, N days remaining)` when active, `Free (Pro expired YYYY-MM-DD — visit https://getaxonflow.com/pricing/ to renew)` when the token is on disk but its `exp` has passed (plugin will not forward an expired token), or `Free (no Pro license configured)` when no token is loaded. The plugin-init canary line emitted by `registerAxonFlowGovernance` matches the same three shapes so users notice their renewal window on every plugin reload. New exports: `buildProTierInitLogLine`, `parseLicenseTokenExpiry`, `formatExpiryDate`, `daysUntil`. New `StatusReport` fields: `expires_at` (YYYY-MM-DD UTC, nullable) and `expires_in_days` (integer, negative when expired, nullable). New `StatusTier` value `"pro_expired"` distinguishes a configured-but-lapsed token from `"free"` for renew-CTA rendering. Display only — JWT signature validation remains the platform's job. Tokens whose JWT body fails to parse fall back to the legacy `Pro tier active — license token configured, X-License-Token will be forwarded on every governed request` canary so byte-exact compat with mode-clarity assertions and any external grep on the v2.1.x string is preserved.
 - **`axonflow-openclaw-status` CLI for tenant + tier introspection.** New bin script (`npx @axonflow/openclaw axonflow-openclaw-status`, also exported as `buildStatusReport` / `formatStatusReport` / `resolveStatusInputs` / `redactLicenseToken` / `readPersistedTenantId` from the package entry point) prints the user's `tenant_id` (read from `$AXONFLOW_CONFIG_DIR/try-registration.json`), the AxonFlow endpoint the plugin would talk to, and a tier indicator (Pro when `AXONFLOW_LICENSE_TOKEN` or `pluginConfig.licenseToken` is set, Free otherwise). Surfaces the upgrade URL on free, and a redacted preview of the license token (last 4 chars only — full token is **never** printed) on Pro. Closes the W4 paid-Pro launch UX gap where users had no way to read their `tenant_id` before pasting it into the Stripe checkout custom field. `--json` flag emits the same shape as machine-readable output.
 - **Pro tier activation via `X-License-Token`.** New `licenseToken` pluginConfig field (and `AXONFLOW_LICENSE_TOKEN` env var, env wins) carries the AXON-prefixed plugin-claim token issued by AxonFlow Pro Stripe Checkout. When set, the plugin forwards it on every governed request via the `X-License-Token` header so the agent's plugin-claim middleware can apply Pro-tier entitlements (extended audit retention, higher quotas, license-gated capabilities). On every plugin init the canary log emits `[AxonFlow] Pro tier active …` alongside the existing connection canary so users always know the token is wired through. Free-tier installs are unaffected — when no token is configured the header is omitted entirely.
 - **`axonflow-openclaw-recover` CLI for Community-SaaS credential recovery.** New bin script (`npx @axonflow/openclaw axonflow-openclaw-recover <email>`, also exported as `requestRecovery` / `verifyRecovery` / `extractRecoveryToken` / `persistRecoveredCredentials` from the package entry point) drives the platform's email-based recovery flow when `try-registration.json` is lost: posts to `/api/v1/recover`, prompts for the magic-link token (or accepts the full magic-link URL), posts to `/api/v1/recover/verify`, and persists the freshly-issued tenant_id + secret at `$AXONFLOW_CONFIG_DIR/try-registration.json` (mode 0o600) so the next plugin reload picks them up automatically. Magic-link tokens are one-shot and short-lived; replays return 401.
@@ -30,6 +30,7 @@ every governed request.
 ### Fixed
 
 - **`runtime-e2e/v1_paid_tier/`: pass when stack is long-running.** Previously the test silently exited as `PARTIAL PASS` after Feature 1 whenever `/api/v1/register` returned 429, mislabeling the cause as "agent not in community-saas mode". The agent's per-IP rate limiter (5 calls per source-IP per hour, shared between `/api/v1/register` and `/api/v1/recover`) trips quickly when the test runs against a stack that has already absorbed any traffic in the current hour, which silently turns the recovery handler into a no-op (handler returns generic 202 to prevent enumeration). The test now sends a per-run synthetic source-IP via `X-Forwarded-For` (override with `RUNTIME_E2E_XFF`) so each run gets a fresh rate-limit bucket, and surfaces a real failure with a remediation hint when the bucket is somehow still saturated. Step 2g also now probes `$AXONFLOW_ENDPOINT/api/request` (the agent's primary Basic-auth surface) instead of `$PERSISTED_ENDPOINT/api/v1/audit/tool-call` — the persisted endpoint is hardcoded by the platform to `https://try.getaxonflow.com` and is correct for production users but useless for a runtime test pointing at a local stack, and the audit/tool-call route additionally requires the operator to have set `AXONFLOW_INTERNAL_SERVICE_SECRET` in non-Community deployments. Feature 1 PASSED, Feature 2 PASSED end-to-end on local docker-compose with v7.7.0.
+- **Upgrade-pointer URL aligned with the canonical pricing page.** `STATUS_DEFAULT_UPGRADE_URL` (the URL surfaced by `axonflow-openclaw-status` to free-tier users, and embedded in the `tier=Free (Pro expired ... — visit ... to renew)` line) is now `https://getaxonflow.com/pricing/`. The previous default `https://getaxonflow.com/pro` returned 404 — that page was referenced in PRDs but never built. The pricing page already resolves and carries the Plugin Pro $9.99 tier card with the Stripe buy button, so plugin status output now points free-tier users at a working URL. Override via `AXONFLOW_UPGRADE_URL` env var if needed. Same fix landed in companion plugin releases (claude-plugin v1.2.0, cursor-plugin v1.2.0, codex-plugin v1.2.0).
 
 ## [2.1.1] - 2026-05-05 — exclude runtime-e2e/ from published artifact
 

README.md

@@ -90,11 +90,21 @@ export AXONFLOW_TELEMETRY=off      # disable 7-day heartbeat
 
 ### Activate Pro tier
 
-Plugin Pro is the paid tier on top of free Community SaaS — it unlocks longer audit retention, higher per-tenant quotas, and license-gated capabilities listed at [getaxonflow.com/plugins/pro](https://getaxonflow.com/plugins/pro). To activate:
+Plugin Pro is the paid tier on top of free Community SaaS — it unlocks longer audit retention, higher per-tenant quotas, and license-gated capabilities. **$9.99 USD for 90 days**, one-time payment, no auto-renewal, 14-day no-questions refund. See [getaxonflow.com/pricing/](https://getaxonflow.com/pricing/) for the full breakdown and the Stripe buy button.
 
-1. Buy through Stripe Checkout. The agent issues an `AXON-…` token and emails it to the address you used at checkout.
-2. Either set `AXONFLOW_LICENSE_TOKEN=<the token>` in the environment OpenClaw runs in, or set `pluginConfig.licenseToken` in your OpenClaw config.
-3. Reload OpenClaw. The plugin will emit `[AxonFlow] Pro tier active …` on every init alongside the connection canary, and forward `X-License-Token` on every governed request automatically.
+To activate Pro on an installed plugin:
+
+1. **Find your tenant ID.** Run the bundled status CLI from a terminal:
+
+    ```bash
+    npx @axonflow/openclaw axonflow-openclaw-status
+    ```
+
+    The output includes a `tenant_id:  cs_<uuid>` line — that's the value Stripe Checkout needs to bind the license to your tenant. Copy it. (See [Check status](#check-status) below for the full output shape and `--json` mode.)
+
+2. **Buy at the pricing page.** Visit [getaxonflow.com/pricing/](https://getaxonflow.com/pricing/) and click **Buy Plugin Pro — $9.99**. At Stripe Checkout, paste your `tenant_id` into the **AxonFlow tenant ID** custom field. The agent issues an `AXON-…` token and emails it to the address you used at checkout.
+3. **Install the issued license token.** Either set `AXONFLOW_LICENSE_TOKEN=<the token>` in the environment OpenClaw runs in, or set `pluginConfig.licenseToken` in your OpenClaw config.
+4. **Reload OpenClaw.** The plugin emits `[AxonFlow] Pro tier active …` on every init alongside the connection canary, and forwards `X-License-Token` on every governed request automatically.
 
 If you lose the token (laptop reinstall, never archived the email), use the recovery CLI below to issue a fresh one against the same email.
 
@@ -122,7 +132,7 @@ AxonFlow OpenClaw plugin status
               (paste this into the Stripe checkout custom field when buying Pro)
   endpoint:   https://try.getaxonflow.com
   tier:       Free
-  upgrade:    https://getaxonflow.com/pro
+  upgrade:    https://getaxonflow.com/pricing/
 ```
 
 Sample output (Pro tier active):
@@ -361,7 +371,7 @@ See [Configure](#configure) below for the full pluginConfig schema (`highRiskToo
 | `endpoint` | No | `https://try.getaxonflow.com` (Community SaaS) when unset; `http://localhost:8080` when self-hosted with no endpoint specified | AxonFlow agent gateway URL |
 | `clientId` | No | `"community"` (self-hosted) or auto-bootstrapped `cs_<uuid>` (Community SaaS) | Tenant identity for data isolation. Override for Evaluation License or Enterprise tenants. |
 | `clientSecret` | No | `""` (self-hosted) or auto-bootstrapped (Community SaaS) | Basic-auth secret paired with `clientId`. Required for self-hosted Community Edition with an Evaluation License or AxonFlow Enterprise; auto-populated for Community SaaS; can be left unset for self-hosted Community Edition without a license. |
-| `licenseToken` | No | `process.env.AXONFLOW_LICENSE_TOKEN` if set | AxonFlow Pro plugin-claim license token (begins with `AXON-`). When set, the plugin sends `X-License-Token` on every governed request and the agent applies Pro-tier entitlements (extended retention, higher quotas, license-gated capabilities). Get one at [getaxonflow.com/plugins/pro](https://getaxonflow.com/plugins/pro) — buy through Stripe Checkout, the token arrives by email. Env var wins over `pluginConfig.licenseToken`. |
+| `licenseToken` | No | `process.env.AXONFLOW_LICENSE_TOKEN` if set | AxonFlow Pro plugin-claim license token (begins with `AXON-`). When set, the plugin sends `X-License-Token` on every governed request and the agent applies Pro-tier entitlements (extended retention, higher quotas, license-gated capabilities). Get one at [getaxonflow.com/pricing/](https://getaxonflow.com/pricing/) — buy through Stripe Checkout, the token arrives by email. Env var wins over `pluginConfig.licenseToken`. |
 | `userEmail` | No | — | Per-user identity forwarded on explain/override calls. Shared agents should set this from session context. |
 | `highRiskTools` | No | `[]` | Tools that require human approval even when policy allows |
 | `governedTools` | No | `[]` (all) | Tools to govern. Empty = all tools. |

bin/axonflow-openclaw-status.mjs

@@ -26,7 +26,7 @@
  *                               https://try.getaxonflow.com.
  *     AXONFLOW_UPGRADE_URL    — override for the upgrade URL surfaced
  *                               to free-tier users. Defaults to
- *                               https://getaxonflow.com/pro.
+ *                               https://getaxonflow.com/pricing/.
  *     AXONFLOW_CONFIG_DIR     — where try-registration.json is read
  *                               from. Defaults to per-OS convention
  *                               (see src/cache-dir.ts).