fix(plugins): fall back to bundled plugin when npm spec resolves to non-OpenClaw package by scoootscooob · Pull Request #32096 · openclaw/openclaw

scoootscooob · 2026-03-02T19:34:41Z

Closes #32019

Summary

openclaw plugins install diffs downloads the unrelated npm package diffs@0.1.1 (a simple object-diff utility by synder) which lacks openclaw.extensions
The install fails with "package.json missing openclaw.extensions" without trying the bundled @openclaw/diffs plugin
Root cause 1: the bundled-fallback trigger only fires on npm 404 errors, not on "downloaded but not an OpenClaw plugin" errors
Root cause 2: findBundledPluginByNpmSpec only matches by npmSpec (@openclaw/diffs), not by pluginId (diffs)

Changes

src/cli/plugins-cli.ts: add isNotAnOpenClawPluginError() check; broaden fallback trigger to also fire on missing/empty openclaw.extensions errors
src/plugins/bundled-sources.ts: match bundled plugins by pluginId in addition to npmSpec
src/plugins/bundled-sources.test.ts: new test for pluginId-based lookup

What did NOT change

No changes to npm download logic, plugin discovery, or manifest validation
Existing behavior for 404 errors and exact npmSpec matches is preserved
No changes to how bundled plugins are resolved or loaded

Test plan

Existing bundled source tests still pass
New test: findBundledPluginByNpmSpec({ spec: "diffs" }) resolves via pluginId when npmSpec is @openclaw/diffs
npx tsgo type check passes (pre-existing error in gateway-chat.ts only)

🤖 Generated with Claude Code

greptile-apps · 2026-03-02T19:38:42Z

Greptile Summary

This PR fixes a two-part bug where openclaw plugins install diffs silently downloads the unrelated npm package diffs@0.1.1 and then fails without falling back to the bundled @openclaw/diffs plugin.

Changes:

src/cli/plugins-cli.ts: Adds isNotAnOpenClawPluginError() to detect the "package downloaded but missing openclaw.extensions" failure mode, and widens the bundled-fallback trigger to cover it alongside existing 404 errors.
src/plugins/bundled-sources.ts: Adds a secondary pluginId match in findBundledPluginByNpmSpec so a bare spec like diffs can resolve to a bundled plugin whose npmSpec is @openclaw/diffs.
src/plugins/bundled-sources.test.ts: New test for the pluginId-based lookup that reproduces the Plugin diffs v0.1.1 install fails: package.json missing openclaw.extensions #32019 scenario.

Issue found:

The warning message on line 683 — "npm package unavailable for ${raw}" — is unchanged and is now reused for both the 404 case and the new "not an OpenClaw plugin" case. In the latter scenario the package is available on npm; it just isn't a valid plugin. A user seeing this message could incorrectly conclude the package doesn't exist.

Confidence Score: 4/5

This PR is safe to merge; it fixes a real regression with minimal, well-scoped changes and no breakage to existing behavior.
The two root-cause fixes are correct and well-tested. The only noted issue is a user-facing warning message that remains accurate for the 404 case but becomes slightly misleading for the new "not an OpenClaw plugin" case — this is a UX polish concern, not a functional or safety problem.
The warning message in src/cli/plugins-cli.ts around line 683 is worth a quick look before merging.

_{Last reviewed commit: b006503}

greptile-apps

_{3 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-03-02T19:38:52Z

Additional Comments (1)

src/cli/plugins-cli.ts
Misleading warning message for non-OpenClaw plugin case

When the fallback is triggered by isNotAnOpenClawPluginError (i.e. the npm package was found and downloaded, but it isn't an OpenClaw plugin), the message "npm package unavailable for ${raw}" is factually incorrect — the package exists; it just doesn't implement openclaw.extensions. This could confuse users into thinking the npm package doesn't exist at all.

Consider distinguishing the two reasons:

          theme.warn(
            isPackageNotFoundInstallError(result.error)
              ? `npm package unavailable for ${raw}; using bundled plugin at ${shortenHomePath(bundledFallback.localPath)}.`
              : `npm package "${raw}" is not a valid OpenClaw plugin; using bundled plugin at ${shortenHomePath(bundledFallback.localPath)}.`,
          ),

(This would require hoisting shouldTryBundledFallback's sub-conditions so both are still available here.)

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/cli/plugins-cli.ts
Line: 683

Comment:
**Misleading warning message for non-OpenClaw plugin case**

When the fallback is triggered by `isNotAnOpenClawPluginError` (i.e. the npm package _was_ found and downloaded, but it isn't an OpenClaw plugin), the message `"npm package unavailable for ${raw}"` is factually incorrect — the package exists; it just doesn't implement `openclaw.extensions`. This could confuse users into thinking the npm package doesn't exist at all.

Consider distinguishing the two reasons:

```suggestion
          theme.warn(
            isPackageNotFoundInstallError(result.error)
              ? `npm package unavailable for ${raw}; using bundled plugin at ${shortenHomePath(bundledFallback.localPath)}.`
              : `npm package "${raw}" is not a valid OpenClaw plugin; using bundled plugin at ${shortenHomePath(bundledFallback.localPath)}.`,
          ),
```

(This would require hoisting `shouldTryBundledFallback`'s sub-conditions so both are still available here.)

How can I resolve this? If you propose a fix, please make it concise.

…on-OpenClaw package (openclaw#32019) When `openclaw plugins install diffs` downloads the unrelated npm package `diffs@0.1.1` (which lacks `openclaw.extensions`), the install fails without trying the bundled `@openclaw/diffs` plugin. Two fixes: 1. Broaden the bundled-fallback trigger to also fire on "missing openclaw.extensions" errors (not just npm 404s) 2. Match bundled plugins by pluginId in addition to npmSpec so unscoped names like "diffs" resolve to `@openclaw/diffs` Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Address Greptile review: show "not a valid OpenClaw plugin" when the npm package was found but lacks openclaw.extensions, instead of the misleading "npm package unavailable" message. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@scoootscooob

… (thanks @scoootscooob)

steipete · 2026-03-02T20:50:03Z

Landed via temp rebase onto main.

Gate: pnpm test src/plugins/bundled-sources.test.ts && pnpm test src/plugins/install.test.ts -t "openclaw.extensions"
Land commit: bca352e
Merge commit: 320920d

Thanks @scoootscooob!

@stakeswky

* main: (154 commits) fix: harden exec allowlist regex literal handling (openclaw#32162) (thanks @stakeswky) fix(exec): escape regex literals in allowlist path matching fix: OpenAI OAuth TLS preflight gating (openclaw#32051) (thanks @alexfilatov) Auth: gate OpenAI OAuth TLS preflight in doctor Fix TLS cert preflight classification false positive Add OpenAI OAuth TLS preflight and doctor prerequisite check fix(gateway): hot-reload channelHealthCheckMinutes without full restart refactor: harden plugin install flow and main DM route pinning fix: propagate whatsapp inbound fromMe context (openclaw#32167) (thanks @scoootscooob) fix(whatsapp): propagate fromMe through inbound message pipeline refactor: harden msteams lifecycle and attachment flows fix(config): move sensitive-schema hint warnings to debug test(perf): reduce heavy fixture and guardrail overhead perf(core): speed up routing, pairing, slack, and security scans refactor: unify queueing and normalize telegram slack flows fix: harden bundled plugin install fallback semantics (openclaw#32096) (thanks @scoootscooob) fix(plugins): prefer bundled plugin ids over bare npm specs fix: distinguish warning message for non-OpenClaw vs missing npm package fix(plugins): fall back to bundled plugin when npm spec resolves to non-OpenClaw package (openclaw#32019) fix: harden msteams revoked-context fallback delivery (openclaw#27224) (thanks @openperf) ...

@scoootscooob

… (thanks @scoootscooob)

@scoootscooob

… (thanks @scoootscooob)

@scoootscooob

… (thanks @scoootscooob)

openclaw-barnacle bot added cli CLI command changes size: XS trusted-contributor labels Mar 2, 2026

greptile-apps bot reviewed Mar 2, 2026

View reviewed changes

openclaw-barnacle bot added size: S and removed size: XS labels Mar 2, 2026

scoootscooob and others added 4 commits March 2, 2026 20:47

fix(plugins): prefer bundled plugin ids over bare npm specs

bbbf2d1

fix: harden bundled plugin install fallback semantics (openclaw#32096)…

bca352e

… (thanks @scoootscooob)

steipete force-pushed the fix/plugin-install-bundled-fallback branch from d214958 to bca352e Compare March 2, 2026 20:49

steipete merged commit 320920d into openclaw:main Mar 2, 2026
3 checks passed

openclaw-barnacle bot added the docs Improvements or additions to documentation label Mar 2, 2026

dawi369 pushed a commit to dawi369/davis that referenced this pull request Mar 3, 2026

fix: harden bundled plugin install fallback semantics (openclaw#32096)…

68bc91c

… (thanks @scoootscooob)

OWALabuy pushed a commit to kcinzgg/openclaw that referenced this pull request Mar 4, 2026

fix: harden bundled plugin install fallback semantics (openclaw#32096)…

faabab3

… (thanks @scoootscooob)

zooqueen pushed a commit to hanzoai/bot that referenced this pull request Mar 6, 2026

fix: harden bundled plugin install fallback semantics (openclaw#32096)…

838eef2

… (thanks @scoootscooob)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(plugins): fall back to bundled plugin when npm spec resolves to non-OpenClaw package#32096

fix(plugins): fall back to bundled plugin when npm spec resolves to non-OpenClaw package#32096
steipete merged 4 commits intoopenclaw:mainfrom
scoootscooob:fix/plugin-install-bundled-fallback

scoootscooob commented Mar 2, 2026

Uh oh!

greptile-apps bot commented Mar 2, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot commented Mar 2, 2026

Uh oh!

Uh oh!

steipete commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

scoootscooob commented Mar 2, 2026

Summary

Changes

What did NOT change

Test plan

Uh oh!

greptile-apps bot commented Mar 2, 2026

Greptile Summary

Confidence Score: 4/5

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot commented Mar 2, 2026

Uh oh!

Uh oh!

steipete commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants