463e9f2704
docs: document plugin install metadata helpers
2026-06-04 04:21:07 -04:00
154f439c81
Add operator install policy and remove dangerous-code install scanners ( #89516 )
...
* feat: add operator install policy
* test: cover plain-file plugin install code
* fix: preserve locationless install policy findings
* refactor: remove install-time plugin scanner
* test: remove stale plugin install helper
* fix: preserve before-install builtin scan type
* fix: preserve plugin dependency denylist
---------
Co-authored-by: Mainframe <mainframe@MainfraacStudio.localdomain >
2026-06-03 14:17:29 -07:00
a326faa10c
fix: recover corrupt managed npm installs
2026-06-02 05:21:19 -07:00
2d61521bd3
fix(update): pin post-core plugin compatibility to the downgraded core version ( #87914 ) ( #87952 )
...
* fix(update): pin post-core plugin compatibility to the downgraded core version (#87914 )
* fix(update): force plugin compatibility repair on rollback
* style(update): clarify downgrade compatibility note
* fix(plugins): resolve compatible prerelease plugin downgrades
* fix(plugins): honor host gates during npm downgrade repair
* fix(plugins): keep prerelease downgrade fallback on channel
---------
Co-authored-by: Gio Della-Libera <giodl73@gmail.com >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-06-02 07:13:26 -04:00
9d55fc4579
fix(plugins): skip peer links in rollback snapshots
2026-06-01 10:18:30 +01:00
fda5254e99
fix: preserve npm plugin root on blocked install ( #77237 )
...
Preserve the active per-plugin managed npm project when npm-backed install validation blocks a candidate after npm has already mutated local state.
This snapshots package.json, package-lock.json, and node_modules before managed npm installs, restores that exact project state on failed validation, and rolls back staged npm-pack archives so blocked pack installs do not leave candidate debris.
Validation:
- OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/plugins/install.npm-spec.test.ts
- pnpm tsgo:core && pnpm tsgo:core:test
- node scripts/run-oxlint.mjs src/plugins/install.ts src/plugins/install.npm-spec.test.ts
- .agents/skills/autoreview/scripts/autoreview --mode local
- GitHub CI 26729255950
- Crabbox run_26e9f9f7591c
Thanks @zhuisDEV.
Co-authored-by: Brian <95547369+zhuisDEV@users.noreply.github.com >
2026-05-31 20:59:32 -04:00
00d8d7ead0
refactor: extract normalization core package
...
Extract shared normalization/coercion helpers into private @openclaw/normalization-core workspace package while preserving existing plugin SDK helper subpaths.\n\nAlso keeps direct normalization-core imports internal, wires UI/build/loader resolution, and replaces the slow PR network CodeQL lane with a fast added-line boundary scan while retaining full CodeQL for scheduled/manual runs.\n\nVerification: local moved tests, plugin SDK boundary tests, extension loader tests, agents-support shard, UI build/test, build artifacts, lint, workflow guards, autoreview, and GitHub CI passed on PR head 963d893715
2026-05-31 01:33:00 +01:00
4491232874
fix: resolve compatible npm plugin versions
...
* fix: resolve compatible npm plugin versions
* fix: satisfy plugin install lint
* fix: refresh plugin install tests on latest main
2026-05-28 23:20:32 +01:00
ea682182d0
fix: isolate npm plugin installs per package ( #87647 )
...
* fix: isolate npm plugin installs per package
* test: assert isolated npm plugin projects in upgrade survivor
* test: assert plugin lifecycle npm project roots
* test: resolve npm project deps in live assertions
* fix: resolve codex bins from isolated npm projects
* docs: document isolated npm plugin projects
* ci: configure testbox workflow for crabbox
* fix: stabilize npm project fingerprint
* fix: keep fetch runtime import side-effect free
* test: keep dynamic live model unit hermetic
* ci: handle empty node toolcache roots
* test: make nounset toolcache probe deterministic
2026-05-28 21:16:07 +01:00
376b03f8ea
fix(plugins): reject incompatible package plugin API installs ( #87477 )
...
* fix(plugins): enforce package plugin API compatibility
* fix(plugins): preserve plugin API prerelease floors
* fix(plugins): gate persisted plugin api compatibility
* fix(plugins): skip incompatible package discovery
* fix(plugins): check api compatibility before package shape
* fix(plugins): gate bundle package api compatibility
* docs(plugins): clarify plugin API release sync
* test(agents): keep dynamic live model unit test runtime-free
* fix(plugins): normalize correction plugin api floors
* test(agents): align dynamic normalizer expectation
* fix(plugins): reject malformed plugin api metadata
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-05-28 20:25:30 +01:00
8061d66713
fix(update): allow package-manager hardlinks in swaps
...
Allow package-manager-managed hardlinked package roots during update/install swaps while keeping generic plugin, hook, and dependency-free install moves fail-closed.
Fixes #85559 .
Co-authored-by: ai-hpc <mail.speedy.hpc@hotmail.com >
2026-05-25 18:30:49 +01:00
793e300cc5
fix(plugins): support linked source checkouts on Windows
2026-05-25 03:36:06 +02:00
85a3d5312f
fix: bypass npm freshness for managed installs ( #83761 )
...
* fix: bypass npm freshness for managed installs
* test: tolerate npm config json differences
* test: align npm freshness bypass expectation
* fix: resolve npm config path expansions
* test: tolerate npm zero config encoding
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-05-19 00:31:02 +02:00
97d1f5fd15
fix: bypass npm freshness filters during updates
...
Bypass npm min-release-age/before quarantine for OpenClaw-managed package installs and update installer scripts/tests/docs.\n\nFixes #82630 .
2026-05-16 18:17:18 +01:00
d2e0a8231f
fix(plugins): reject malformed package entries
2026-05-16 03:44:33 +08:00
d9ff8cfb01
fix: plan managed npm peer pins with npm
...
Plan managed npm peer dependency pins from npm's lockfile planner instead of recursively scanning nested node_modules packages, preserving host peer ranges when npm cannot produce a usable root pin.
Also preserves active root-managed OpenClaw host runtimes during npm plugin installs, folding the active-host guard/test from #81632 .
Verification:
- codex-review --full-access
- pnpm check:test-types
- pnpm exec oxfmt --check --threads=1 src/infra/npm-managed-root.ts src/infra/npm-managed-root.test.ts src/plugins/install.npm-spec.test.ts CHANGELOG.md test/scripts/mantis-build-telegram-desktop-proof-evidence.test.ts && git diff --check
- OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test src/infra/npm-managed-root.test.ts src/plugins/install.npm-spec.test.ts -- --reporter=verbose
- OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/test-projects.mjs src/plugins/install.npm-spec.e2e.test.ts -- --reporter=verbose
- node scripts/run-vitest.mjs run --config test/vitest/vitest.full-core-support-boundary.config.ts test/scripts/mantis-build-telegram-desktop-proof-evidence.test.ts --reporter=verbose
- GitHub current-head checks: 55 completed, 0 failures; remaining Blacksmith-backed jobs capacity-queued at merge decision time.
Co-authored-by: fuller-stack-dev <263060202+fuller-stack-dev@users.noreply.github.com >
2026-05-14 21:25:22 +01:00
402b0df3b6
fix: preserve owned plugin dependencies during peer repair
2026-05-13 15:26:40 +01:00
f4cb20300f
fix: harden managed plugin peer recovery
2026-05-13 15:26:40 +01:00
6e5042cd62
fix: avoid rescanning repaired plugin peers
2026-05-13 15:26:40 +01:00
18ca285ed6
fix: preserve managed plugin peer dependencies
2026-05-13 15:26:40 +01:00
39bcd1e088
fix(plugins): scan installed dependency runtime code [AI] ( #81066 )
...
* fix: scan installed plugin dependency code
* addressing review-skill
* addressing review-skill
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing ci
* addressing ci
* docs: add changelog entry for PR merge
2026-05-13 10:26:24 +05:30
d4998d7b88
fix(plugins): retry npm alias override installs ( #80539 )
...
* fix(plugins): retry npm alias override installs
* fix(onboarding): space install retry warning
* fix(onboarding): shorten retry progress label
* docs(changelog): note npm alias install retry
---------
Co-authored-by: pashpashpash <nik@vault77.ai >
2026-05-12 19:58:21 -07:00
a5dce367ce
fix: scan plugin runtime entries during install [AI] ( #80998 )
...
* fix: scan plugin runtime entries during install
* addressing review-skill
* addressing claude review
* docs: add changelog entry for PR merge
2026-05-12 20:28:40 +05:30
a290cd633f
fix(doctor): repair managed plugin peer links
...
Repair managed npm plugin OpenClaw peer links across doctor, install, and update flows.
- relink `peerDependencies.openclaw` packages under managed npm roots during doctor repair
- make read-only doctor preview broken peer links with a `doctor --fix` hint
- reject target plugin installs when their own peer link cannot be repaired, without blocking unrelated installs for stale sibling packages
- preserve update warning behavior for unrepairable package-local `node_modules`
Verification:
- `pnpm test src/plugins/plugin-peer-link.test.ts src/plugins/install.test.ts src/plugins/install.npm-spec.test.ts src/plugins/update.test.ts src/commands/doctor-plugin-registry.test.ts src/commands/doctor/repair-sequencing.test.ts -- --reporter=verbose`
- `pnpm exec oxfmt --check --threads=1 ...`
- `git diff --check`
- Crabbox/Testbox `tbx_01krde1jx199rnpm2rv1rdcj76`: focused tests + `pnpm check:changed`, exit 0
- Real CLI proof in PR body: read-only `openclaw doctor` warning plus `openclaw doctor --fix` symlink repair
Thanks @TheCrazyLex.
2026-05-12 07:49:08 +01:00
2db6bde617
fix(plugins): fail unresolved openclaw peer installs ( #79494 )
2026-05-09 17:19:54 +09:00
3ba2ce6694
fix(plugins): avoid managed npm prefix on Windows
...
Fixes #78514 .
2026-05-09 07:51:49 +08:00
aa9247e0ce
fix(plugins): skip managed npm peer resolution ( #78348 )
2026-05-06 12:17:34 -07:00
5d557171b3
fix(plugins): apply npm overrides to managed roots ( #78386 )
2026-05-06 02:47:25 -07:00
0ddbf2e258
fix(plugins): keep managed npm mutations in legacy peer mode
2026-05-06 01:29:52 -07:00
2eaf8ad712
feat(plugins): support npm pack installs
2026-05-06 09:16:49 +01:00
8e533490ab
fix(plugins): repair managed npm openclaw peers
...
Remove stale managed-root openclaw manifests, locks, hidden locks, and installed copies before npm plugin installs.
Relink plugin-local openclaw peer symlinks after shared-root npm install, rollback, update, and uninstall mutations so SDK-using plugins keep resolving openclaw/plugin-sdk/*.
Force safe npm commands out of inherited legacy/strict peer-dependency modes.
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com >
2026-05-06 07:32:25 +01:00
538605ff44
[codex] Extract filesystem safety primitives ( #77918 )
...
* refactor: extract filesystem safety primitives
* refactor: use fs-safe for file access helpers
* refactor: reuse fs-safe for media reads
* refactor: use fs-safe for image reads
* refactor: reuse fs-safe in qqbot media opener
* refactor: reuse fs-safe for local media checks
* refactor: consume cleaner fs-safe api
* refactor: align fs-safe json option names
* fix: preserve fs-safe migration contracts
* refactor: use fs-safe primitive subpaths
* refactor: use grouped fs-safe subpaths
* refactor: align fs-safe api usage
* refactor: adapt private state store api
* chore: refresh proof gate
* refactor: follow fs-safe json api split
* refactor: follow reduced fs-safe surface
* build: default fs-safe python helper off
* fix: preserve fs-safe plugin sdk aliases
* refactor: consolidate fs-safe usage
* refactor: unify fs-safe store usage
* refactor: trim fs-safe temp workspace usage
* refactor: hide low-level fs-safe primitives
* build: use published fs-safe package
* fix: preserve outbound recovery durability after rebase
* chore: refresh pr checks
2026-05-06 02:15:17 +01:00
5ca0aa1d15
fix(plugins): accept stable correction releases
2026-05-03 20:53:23 -07:00
cde9591168
fix(plugins): prefer newest official prerelease install
2026-05-03 16:25:02 -07:00
88b983a713
fix: stabilize Google Meet realtime audio
2026-05-04 00:17:57 +01:00
3efa82de86
fix(plugins): allow prerelease-only official packages
2026-05-03 16:12:39 -07:00
250be27f64
fix(plugins): fall back to stable official npm versions
2026-05-03 16:07:53 -07:00
41bbc4c048
test(plugins): cover pinned npm installs
2026-05-03 14:27:58 +01:00
fb3ee066d8
fix(plugins): pin npm plugin installs
2026-05-03 14:27:58 +01:00
f7522edb96
fix(plugins): preserve sibling npm installs
...
Run npm install from the managed npm-root manifest so sequential @openclaw/* plugin installs preserve siblings on disk.
Fixes #76571 .
Thanks @byungskers and @crpol.
2026-05-03 12:51:50 +01:00
5ecd01ff94
fix(plugins): trust managed npm peer links
2026-05-03 01:49:24 -07:00
2a22eb68aa
fix(plugins): require provenance for official npm trust
...
Require OpenClaw-owned install provenance before granting official npm plugin scanner trust. Direct npm package names now scan normally; catalog, onboarding, and doctor paths pass explicit provenance.\n\nValidation:\n- pnpm test:serial src/plugins/install.npm-spec.test.ts src/cli/plugins-cli.install.test.ts src/commands/onboarding-plugin-install.test.ts src/commands/doctor/shared/missing-configured-plugin-install.test.ts src/channels/plugins/contracts/channel-catalog.contract.test.ts src/commands/auth-choice.apply.plugin-provider.test.ts\n- pnpm test:serial src/plugins/install.test.ts src/plugins/provider-auth-choices.test.ts src/plugins/provider-install-catalog.test.ts src/commands/channel-setup/plugin-install.test.ts\n- pnpm exec oxfmt --check --threads=1 ...\n- node scripts/run-oxlint.mjs ...\n- Crabbox cbx_6157440c9bbe / run_cbd813956eed: pnpm check:changed passed\n\nThanks @fede-kamel and @vincentkoc.
2026-05-02 23:30:45 -07:00
ba3c0fc78e
fix(plugins): roll back failed npm install debris
2026-05-02 19:41:16 -07:00
006bd56dd6
fix(plugins): trust reviewed official npm launch packages
2026-05-02 19:41:15 -07:00
d7dbf11504
fix(plugins): preserve npm plugin installs across repairs
2026-05-02 18:31:59 -07:00
05c9492bff
fix: reduce WebUI session latency churn ( #76277 ) thanks @BunsDev
...
Reduce WebUI/Gateway latency churn by avoiding redundant session reloads, carrying session keys through transcript update events, and deferring explicit media provider discovery. Includes changelog attribution and closes the referenced runtime latency issues.
2026-05-02 18:39:06 -05:00
5ed7f1fd26
fix: trusted installs
2026-05-02 16:14:52 -07:00
23ac9ccfd5
test: add codex npm plugin Docker live proof
2026-05-02 20:08:48 +01:00
db06fcd990
refactor: unify lazy module loaders
2026-05-02 10:15:25 +01:00
eaf1f53d60
fix: stabilize plugin metadata release checks
2026-05-02 07:27:27 +01:00
Peter Steinberger