Closing this PR because it looks dirty (too many unrelated or unexpected changes). This usually happens when a branch picks up unrelated commits or a merge went sideways. Please recreate the PR from a clean branch.

Closing this PR because it looks dirty (too many unrelated or unexpected changes). This usually happens when a branch picks up unrelated commits or a merge went sideways. Please recreate the PR from a clean branch.

Greptile Summary

This PR adds a minHostVersion compatibility gate for installable plugins, preventing older hosts from loading plugins that depend on newer openclaw/plugin-sdk/* subpaths. The mechanism is clean and consistent: a new min-host-version.ts module encapsulates all parsing and checking logic behind a discriminated-union result type, and both the install path (installPluginFromPackageDir) and the manifest-loading path (loadPluginManifestRegistry) enforce the constraint early.

Key highlights:

• Three distinct failure kinds (invalid, unknown_host_version, incompatible) give callers precise error messaging and allow the registry to emit warn rather than error when the host version is simply unknown (dev builds).
• vi.unstubAllEnvs() added to install.test.ts beforeEach prevents env stubs from bleeding across test cases.
• The hasNpmSpec guard in bundled-extension-manifest.ts correctly allows irc, twitch, and voice-call to declare minHostVersion without an npmSpec.
• The install-min-host-version-guardrails.test.ts file provides a regression safety net that reads real manifests from disk, ensuring the version floor is never silently dropped.

Confidence Score: 5/5

• PR is safe to merge; all install and manifest-load paths are correctly gated with good test coverage.
• The core logic is correct and well-tested across all entry points. The two remaining observations (an unreachable defensive branch in checkMinHostVersion and an unused exported constant MIN_HOST_VERSION_PREFIX) are non-blocking style issues that do not affect correctness or safety. The prior concern about unknown host versions is addressed with a distinct unknown_host_version kind and a warn-level diagnostic in the registry.
• No files require special attention.

This is a comment left during a code review.
Path: src/plugins/min-host-version.ts
Line: 74-77

Comment:
**Unreachable dead code branch**

`parseSemver(requirement.minimumLabel)` is guaranteed to succeed here because `parseMinHostVersionRequirement` already validates it at line 36–38 before returning a non-null `requirement`. The error branch at line 75–77 can never be reached. Consider removing it to avoid giving the impression this is a realistic fallback:

```suggestion
  const minimumSemver = parseSemver(requirement.minimumLabel);
  if (!isAtLeast(currentSemver, minimumSemver!)) {
```

Or, if you want to keep the defensive check, add a comment explaining why it is there even though the value was pre-validated.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/plugins/min-host-version.ts
Line: 3

Comment:
**Exported constant is never consumed**

`MIN_HOST_VERSION_PREFIX` is declared and exported but is not imported or used anywhere in the codebase. If it is not part of the public API surface, removing it avoids dead exports and removes any confusion about whether callers should rely on it.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into fix/plugin-min-..." | Re-trigger Greptile}

Closing this PR because it looks dirty (too many unrelated or unexpected changes). This usually happens when a branch picks up unrelated commits or a merge went sideways. Please recreate the PR from a clean branch.

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

1. 🔵 minHostVersion guardrails bypass when PluginCandidate lacks packageManifest

Description

loadPluginManifestRegistry enforces openclaw.install.minHostVersion using candidate.packageManifest, but some discovery paths create candidates without populating packageManifest.

As a result, a plugin that does have package.json metadata (including openclaw.install.minHostVersion) can still be loaded on an incompatible host when it is discovered/declared as a file-based plugin candidate (e.g., config loadPaths pointing directly to an entry file, or directories containing loose plugin entry files). In those cases candidate.packageManifest is undefined, checkMinHostVersion returns { ok: true }, and the plugin is not version-gated.

Impact:

• Defeats the intended compatibility/guardrail enforcement.
• Can lead to loading plugins on unsupported hosts, potentially causing runtime crashes (DoS) or undefined behavior.

Vulnerable code:

const minHostVersionCheck = checkMinHostVersion({
  currentVersion: currentHostVersion,
  minHostVersion: candidate.packageManifest?.install?.minHostVersion,
});

Why this is reachable:

• In discoverFromPath, when the configured path is a file, addCandidate is called without reading/parsing a sibling package.json, so packageManifest remains unset.
• In discoverInDirectory, when a plugin is discovered as a file entry, addCandidate is also called without a package manifest.

Recommendation

Ensure minHostVersion is derived from a trusted on-disk package.json whenever one exists for the candidate, instead of relying solely on candidate.packageManifest.

Options:

1. Harden registry loading: if candidate.packageManifest is missing, attempt to read ${candidate.packageDir ?? candidate.rootDir}/package.json safely and extract openclaw.install.minHostVersion.

2. Harden discovery: when creating file-based candidates, read/parse package.json from the file’s directory (if present) and populate candidate.packageManifest.

Example (option 1 — registry-side fallback):

import fs from "node:fs";
import path from "node:path";
import { getPackageManifestMetadata, type PackageManifest } from "./manifest.js";

function tryLoadPackageMetadata(dir: string): OpenClawPackageManifest | undefined {
  const p = path.join(dir, "package.json");
  if (!fs.existsSync(p)) return undefined;
  const raw = JSON.parse(fs.readFileSync(p, "utf-8")) as PackageManifest;
  return getPackageManifestMetadata(raw);
}

const packageMeta = candidate.packageManifest ?? tryLoadPackageMetadata(candidate.packageDir ?? candidate.rootDir);
const minHostVersionCheck = checkMinHostVersion({
  currentVersion: currentHostVersion,
  minHostVersion: packageMeta?.install?.minHostVersion,
});

Also consider treating an unreadable/invalid package.json as a diagnostic and possibly not silently skipping guardrails when the file exists but can’t be parsed.

Analyzed PR: #52094 at commit b434dda

_{Last updated on: 2026-03-22T16:36:48Z}