fix(onboarding): trust official optional plugin installs

vincentkoc · vincentkoc · commit 39bc94e4ddf5 · 2026-05-03T00:29:04.000-07:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -19,6 +19,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Plugins/onboarding: trust optional official plugin installs selected from the official catalog so npm security scanning treats them like other source-linked official install paths. Thanks @vincentkoc.
 - CLI/plugins: keep `plugins enable` and `plugins disable` from creating unconfigured channel config sections, so channel plugins with required setup fields no longer fail validation during lifecycle probes. Thanks @vincentkoc.
 - Agents/sessions: keep delayed `sessions_send` A2A replies alive after soft wait-window timeouts, while preserving terminal run timeouts and avoiding stale target replies in requester sessions. Fixes #76443. Thanks @ryswork1993 and @vincentkoc.
 - CLI/sessions: keep intentional empty agent replies silent after tool-delivered channel output, instead of surfacing a misleading "No reply from agent." fallback. Thanks @vincentkoc.
diff --git a/src/wizard/setup.official-plugins.test.ts b/src/wizard/setup.official-plugins.test.ts
@@ -112,6 +112,7 @@ describe("setupOfficialPluginInstalls", () => {
       expect.objectContaining({
         entry: expect.objectContaining({
           pluginId: "diagnostics-otel",
+          trustedSourceLinkedOfficialInstall: true,
           install: expect.objectContaining({
             clawhubSpec: "clawhub:@openclaw/diagnostics-otel",
             npmSpec: "@openclaw/diagnostics-otel",
diff --git a/src/wizard/setup.official-plugins.ts b/src/wizard/setup.official-plugins.ts
@@ -18,6 +18,7 @@ export type OfficialPluginOnboardingInstallEntry = {
   label: string;
   description?: string;
   install: PluginPackageInstall;
+  trustedSourceLinkedOfficialInstall?: boolean;
 };
 
 function isInstalledOrConfigured(config: OpenClawConfig, pluginId: string): boolean {
@@ -76,6 +77,7 @@ export function resolveOfficialPluginOnboardingInstallEntries(params: {
       label: resolveOfficialExternalPluginLabel(entry),
       ...(entry.description ? { description: entry.description } : {}),
       install,
+      trustedSourceLinkedOfficialInstall: true,
     });
   }
   return entries.toSorted((left, right) => left.label.localeCompare(right.label));
