fix(plugins): require host floor for new sdk subpaths#51982
fix(plugins): require host floor for new sdk subpaths#51982vincentkoc wants to merge 2 commits intomainfrom
Conversation
Greptile SummaryThis PR moves the install-time failure gate earlier for 17 npm-installable channel plugins that depend on new Key findings:
Confidence Score: 3/5
Prompt To Fix All With AIThis is a comment left during a code review.
Path: src/plugins/install-host-peer-guardrails.test.ts
Line: 6-24
Comment:
**Installable plugins missing from guardrail**
Two npm-installable plugins that also import from `openclaw/plugin-sdk/*` subpaths are absent from both this test's `INSTALLABLE_PLUGIN_IDS_REQUIRING_HOST_FLOOR` list and the manifest fixes in this PR:
- `extensions/synology-chat/package.json` — has `"install": { "npmSpec": "@openclaw/synology-chat", ... }` and imports from over a dozen `openclaw/plugin-sdk/*` subpaths (`/core`, `/webhook-ingress`, `/setup`, `/runtime-store`, `/channel-config-schema`, etc.), yet declares no `peerDependencies` at all.
- `extensions/memory-lancedb/package.json` — has `"install": { "npmSpec": "@openclaw/memory-lancedb", ... }` and imports from `openclaw/plugin-sdk` in `api.ts`, yet also declares no `peerDependencies`.
These two plugins share the exact same vulnerability the PR is fixing: an older OpenClaw host can successfully install them via npm (because there is no mandatory peer version gate) but will crash at runtime when the new SDK subpaths cannot resolve. They should be added to the `INSTALLABLE_PLUGIN_IDS_REQUIRING_HOST_FLOOR` array here, and `"peerDependencies": { "openclaw": ">=2026.3.14" }` should be added to both of their manifests.
How can I resolve this? If you propose a fix, please make it concise.
---
This is a comment left during a code review.
Path: src/plugins/install-host-peer-guardrails.test.ts
Line: 39-42
Comment:
**Strict equality check may produce false negatives for future version bumps**
The assertion `toBe(MIN_HOST_VERSION)` checks that the peer version string is exactly `">=2026.3.14"`. If a plugin legitimately raises its floor to, say, `">=2026.4.0"` (a stricter, still-valid requirement), the test will fail even though the plugin correctly gates on a host that includes the new SDK subpaths. Consider asserting only that a peer floor exists and is not optional, without pinning the exact semver string:
```suggestion
expect(
manifest.peerDependencies?.openclaw,
`${pluginId} should declare an openclaw peer`,
).toBeDefined();
expect(
manifest.peerDependencies?.openclaw,
`${pluginId} should declare an openclaw peer floor >= ${MIN_HOST_VERSION}`,
).toMatch(/^>=/);
```
How can I resolve this? If you propose a fix, please make it concise.Last reviewed commit: "Merge branch 'main' ..." |
| const INSTALLABLE_PLUGIN_IDS_REQUIRING_HOST_FLOOR = [ | ||
| "bluebubbles", | ||
| "discord", | ||
| "feishu", | ||
| "googlechat", | ||
| "irc", | ||
| "line", | ||
| "matrix", | ||
| "mattermost", | ||
| "msteams", | ||
| "nextcloud-talk", | ||
| "nostr", | ||
| "tlon", | ||
| "twitch", | ||
| "voice-call", | ||
| "whatsapp", | ||
| "zalo", | ||
| "zalouser", | ||
| ] as const; |
There was a problem hiding this comment.
Two npm-installable plugins that also import from openclaw/plugin-sdk/* subpaths are absent from both this test's INSTALLABLE_PLUGIN_IDS_REQUIRING_HOST_FLOOR list and the manifest fixes in this PR:
extensions/synology-chat/package.json— has"install": { "npmSpec": "@openclaw/synology-chat", ... }and imports from over a dozenopenclaw/plugin-sdk/*subpaths (/core,/webhook-ingress,/setup,/runtime-store,/channel-config-schema, etc.), yet declares nopeerDependenciesat all.extensions/memory-lancedb/package.json— has"install": { "npmSpec": "@openclaw/memory-lancedb", ... }and imports fromopenclaw/plugin-sdkinapi.ts, yet also declares nopeerDependencies.
These two plugins share the exact same vulnerability the PR is fixing: an older OpenClaw host can successfully install them via npm (because there is no mandatory peer version gate) but will crash at runtime when the new SDK subpaths cannot resolve. They should be added to the INSTALLABLE_PLUGIN_IDS_REQUIRING_HOST_FLOOR array here, and "peerDependencies": { "openclaw": ">=2026.3.14" } should be added to both of their manifests.
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/plugins/install-host-peer-guardrails.test.ts
Line: 6-24
Comment:
**Installable plugins missing from guardrail**
Two npm-installable plugins that also import from `openclaw/plugin-sdk/*` subpaths are absent from both this test's `INSTALLABLE_PLUGIN_IDS_REQUIRING_HOST_FLOOR` list and the manifest fixes in this PR:
- `extensions/synology-chat/package.json` — has `"install": { "npmSpec": "@openclaw/synology-chat", ... }` and imports from over a dozen `openclaw/plugin-sdk/*` subpaths (`/core`, `/webhook-ingress`, `/setup`, `/runtime-store`, `/channel-config-schema`, etc.), yet declares no `peerDependencies` at all.
- `extensions/memory-lancedb/package.json` — has `"install": { "npmSpec": "@openclaw/memory-lancedb", ... }` and imports from `openclaw/plugin-sdk` in `api.ts`, yet also declares no `peerDependencies`.
These two plugins share the exact same vulnerability the PR is fixing: an older OpenClaw host can successfully install them via npm (because there is no mandatory peer version gate) but will crash at runtime when the new SDK subpaths cannot resolve. They should be added to the `INSTALLABLE_PLUGIN_IDS_REQUIRING_HOST_FLOOR` array here, and `"peerDependencies": { "openclaw": ">=2026.3.14" }` should be added to both of their manifests.
How can I resolve this? If you propose a fix, please make it concise.| expect( | ||
| manifest.peerDependencies?.openclaw, | ||
| `${pluginId} should declare an openclaw peer`, | ||
| ).toBe(MIN_HOST_VERSION); |
There was a problem hiding this comment.
The assertion toBe(MIN_HOST_VERSION) checks that the peer version string is exactly ">=2026.3.14". If a plugin legitimately raises its floor to, say, ">=2026.4.0" (a stricter, still-valid requirement), the test will fail even though the plugin correctly gates on a host that includes the new SDK subpaths. Consider asserting only that a peer floor exists and is not optional, without pinning the exact semver string:
| expect( | |
| manifest.peerDependencies?.openclaw, | |
| `${pluginId} should declare an openclaw peer`, | |
| ).toBe(MIN_HOST_VERSION); | |
| expect( | |
| manifest.peerDependencies?.openclaw, | |
| `${pluginId} should declare an openclaw peer`, | |
| ).toBeDefined(); | |
| expect( | |
| manifest.peerDependencies?.openclaw, | |
| `${pluginId} should declare an openclaw peer floor >= ${MIN_HOST_VERSION}`, | |
| ).toMatch(/^>=/); |
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/plugins/install-host-peer-guardrails.test.ts
Line: 39-42
Comment:
**Strict equality check may produce false negatives for future version bumps**
The assertion `toBe(MIN_HOST_VERSION)` checks that the peer version string is exactly `">=2026.3.14"`. If a plugin legitimately raises its floor to, say, `">=2026.4.0"` (a stricter, still-valid requirement), the test will fail even though the plugin correctly gates on a host that includes the new SDK subpaths. Consider asserting only that a peer floor exists and is not optional, without pinning the exact semver string:
```suggestion
expect(
manifest.peerDependencies?.openclaw,
`${pluginId} should declare an openclaw peer`,
).toBeDefined();
expect(
manifest.peerDependencies?.openclaw,
`${pluginId} should declare an openclaw peer floor >= ${MIN_HOST_VERSION}`,
).toMatch(/^>=/);
```
How can I resolve this? If you propose a fix, please make it concise.There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e691dbe624
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "peerDependencies": { | ||
| "openclaw": ">=2026.3.14" |
There was a problem hiding this comment.
Validate host OpenClaw version before requiring peer
Making openclaw a mandatory peer here does not actually enforce a host-version floor during plugin install: installPackageDir runs npm install --omit=dev (without --omit=peer) in an isolated staging directory, so npm resolves peers from the registry rather than checking the running host version (src/infra/install-package-dir.ts:188-195). That means once openclaw@>=2026.3.14 is published, older hosts can still install these plugins (peer is fetched into the plugin dir), so the intended early compatibility gate is bypassed and runtime failures on old hosts can still occur.
Useful? React with 👍 / 👎.
|
Superseded by #52094. The peer-dependency approach was not a reliable host-version gate because plugin install resolves peers inside the staged package directory. The replacement PR adds explicit host-side enforcement via \ during install and manifest loading instead. |
Summary
openclaw/plugin-sdk/*subpaths still marked theopenclawpeer optional, andirc/twitchhad no host peer floor at all.npm install --omit=devin the unpacked plugin directory, so optional-or-missing host peers let older OpenClaw releases accept the install and only fail later at runtime when the new subpaths cannot resolve.peerDependenciesMeta.openclaw.optionalfrom the affected installable channel plugins, added the missing mandatoryopenclaw >=2026.3.14peer toircandtwitch, and added a guardrail test that locks this host-version gate in place.Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
User-visible / Behavior Changes
Older OpenClaw hosts now fail plugin installation earlier for the affected npm-installable channel plugins instead of accepting the package and failing later when the new plugin-sdk subpaths are loaded.
Security Impact (required)
No)No)No)No)No)Yes, explain risk + mitigation:Repro + Verification
Environment
Steps
openclaw/plugin-sdk/*subpaths.peerDependenciesMeta.openclaw.optionalwhere present and add the missing mandatoryopenclaw >=2026.3.14peer where absent.Expected
openclaw >=2026.3.14host peer.Actual
pnpm installin the clean worktree fails on unpublishedopenclaw@>=2026.3.14, which is the intended early gate for older npm-host installs.Evidence
Attach at least one:
Human Verification (required)
What you personally verified (not just CI), and how:
pnpm test -- src/plugins/install-host-peer-guardrails.test.tsandpnpm test -- src/infra/install-package-dir.test.tsin the clean worktree.irc/twitchnow declare the peer explicitly.2026.3.14host, because that package is not published yet.Review Conversations
If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.
Compatibility / Migration
No)No)No)Failure Recovery (if this breaks)
cb0ef3f49fandf55ea62b7dif needed.extensions/*/package.jsonmanifests andsrc/plugins/install-host-peer-guardrails.test.ts.>=2026.3.14, or guardrail-test drift if another installable plugin starts using new plugin-sdk subpaths without a mandatory host peer floor.Risks and Mitigations
AI-assisted: Yes. Tested locally.