fix: repair configured plugin installs by steipete · Pull Request #76129 · openclaw/openclaw

steipete · 2026-05-02T15:19:07Z

No description provided.

steipete · 2026-05-02T15:19:13Z

clawsweeper · 2026-05-02T15:20:32Z

Codex review: passed.

Summary
The PR adds a 2026.5.2 doctor repair pass for actively used configured downloadable plugins, prefers ClawHub with npm fallback, records installed plugin state, extends upgrade-survivor coverage, and updates docs/changelog.

Reproducibility: yes. Static inspection of current main and the PR head gives a high-confidence reproduction path: current main lacks the release-stamped configured-plugin install pass, while the PR tests the new repair-only path, success stamping, and warning behavior.

Next step before merge
No repair job is needed; the remaining action is normal exact-head automerge gating after this clean review.

Security
Cleared: Cleared: the latest head gates package installation behind doctor repair mode and reuses existing ClawHub/npm installer and integrity/record paths.

Review details

Best possible solution:

Land the scoped release repair after exact-head automerge gates pass, keeping package installation limited to explicit doctor repair/update paths and preserving the upgrade-survivor coverage.

Do we have a high-confidence way to reproduce the issue?

Yes. Static inspection of current main and the PR head gives a high-confidence reproduction path: current main lacks the release-stamped configured-plugin install pass, while the PR tests the new repair-only path, success stamping, and warning behavior.

Is this the best way to solve the issue?

Yes. The latest head uses existing doctor repair, ClawHub/npm installer, installed-index, and upgrade-survivor seams instead of adding startup/load-time migrations, which is the narrow maintainable direction for this release repair.

What I checked:

Current-main baseline: Current main only runs the existing missing configured plugin install repair from the doctor repair sequence, so the PR is adding a narrower release-stamped pass rather than duplicating a health check that already exists. (src/commands/doctor/repair-sequencing.ts:63, 4532e5d85803)
Repair-mode guard: The latest PR head returns before loading or running the release install step unless doctor is in repair mode, addressing the prior unprompted-install security finding. (src/flows/doctor-health-contributions.ts:278, d3519ce42ce1)
Release pass behavior: The new release helper gates on current/touched version, collects configured channel/plugin/provider signals, calls the existing repair installer, and only marks the release pass touched when there are no warnings. (src/commands/doctor/shared/release-configured-plugin-installs.ts:218, d3519ce42ce1)
Installer path: The install repair prefers ClawHub, falls back to npm only on not-found/version-not-found, and persists install records through the existing installed-plugin index writer. (src/commands/doctor/shared/missing-configured-plugin-install.ts:159, d3519ce42ce1)
Prior fixture finding repaired: The upgrade-survivor ClawHub request assertion now returns early unless the script owns the local fixture, matching the fixture startup override behavior. (scripts/e2e/lib/upgrade-survivor/run.sh:333, d3519ce42ce1)
Exact-head checks: The unauthenticated GitHub check-runs API reports the relevant exact-head checks completed successfully, including check, check-docs, check-prod-types, check-test-types, check-lint, check-dependencies, security-fast, and plugin-trust-boundary. (d3519ce42ce1)

Likely related people:

vincentkoc: Recently changed the missing configured plugin install repair and ClawHub install metadata that this PR extends. (role: recent maintainer; confidence: high; commits: c7b5302acf58, 16e3316beb60; files: src/commands/doctor/shared/missing-configured-plugin-install.ts, src/channels/plugins/catalog.ts)
steipete: Recent history on the doctor health/config flow and plugin dependency handling makes this the closest owner for the release-pass placement and doctor repair boundary. (role: recent maintainer; confidence: high; commits: eceb382c01b7, ed8f50f240a8, 803b7ab8085d; files: src/flows/doctor-health-contributions.ts, src/commands/doctor-config-flow.ts, src/commands/doctor/repair-sequencing.ts)
gumadeiras: Prior merged doctor setup/discovery and lazy doctor plugin-path work is adjacent to the config-flow and repair sequencing surfaces touched here. (role: adjacent owner; confidence: medium; commits: a197b544fec6, 66add9fcd96a; files: src/commands/doctor-config-flow.ts, src/commands/doctor/repair-sequencing.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 4532e5d85803.

clawsweeper · 2026-05-02T15:23:43Z

🦞🦞
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=d3519ce42ce196d37d971de9b2c5e7cb4a3629c0)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-05-02T15:49:53Z
Merge commit: b63d098e8cee

What merged:

The PR adds a 2026.5.2 doctor repair pass for actively used configured downloadable plugins, prefers ClawHub ... pm fallback, records installed plugin state, extends upgrade-survivor coverage, and updates docs/changelog.
Reproducibility: yes. Static inspection of current main and the PR head gives a high-confidence reproduction ... d-plugin install pass, while the PR tests the new repair-only path, success stamping, and warning behavior.

Fixups included:

Included follow-up commit: test: cover configured plugin install update path
Included follow-up commit: test: isolate channel option metadata cache
Included follow-up commit: fix: keep configured plugin repair scoped

The automerge loop is complete.

Automerge progress:

2026-05-02 15:19:13 UTC review queued [`487565be6fc0`](https://github.com/openclaw/openclaw/commit/487565be6fc018e1944b8513aee3ebbc1ed1ef87) (queued)
2026-05-02 15:23:42 UTC repair queued [`487565be6fc0`](https://github.com/openclaw/openclaw/commit/487565be6fc018e1944b8513aee3ebbc1ed1ef87) (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/25255199528
2026-05-02 15:24:58 UTC review queued [`4f765e0d67ce`](https://github.com/openclaw/openclaw/commit/4f765e0d67ce547a2db1507bac8b5317073ce353) (queued)
2026-05-02 15:28:30 UTC review requested repair [`4f765e0d67ce`](https://github.com/openclaw/openclaw/commit/4f765e0d67ce547a2db1507bac8b5317073ce353) (structured ClawSweeper marker: fix-required (finding=security-review sha=4f765e...)
2026-05-02 15:19:13 UTC review queued [`4f765e0d67ce`](https://github.com/openclaw/openclaw/commit/4f765e0d67ce547a2db1507bac8b5317073ce353) (queued)
2026-05-02 15:37:28 UTC review requested repair [`d7811616133b`](https://github.com/openclaw/openclaw/commit/d7811616133b0b774e95de6842324a0c88014962) (structured ClawSweeper marker: fix-required (finding=security-review sha=d78116...)
2026-05-02 15:40:34 UTC repair completed (no branch change) in 14m 20s Run: https://github.com/openclaw/clawsweeper/actions/runs/25255199528 source PR branch changed while the repair worker was preparing its push; requeue against the latest head
2026-05-02 15:45:32 UTC review queued [`d3519ce42ce1`](https://github.com/openclaw/openclaw/commit/d3519ce42ce196d37d971de9b2c5e7cb4a3629c0) (queued)
2026-05-02 15:49:41 UTC review passed [`d3519ce42ce1`](https://github.com/openclaw/openclaw/commit/d3519ce42ce196d37d971de9b2c5e7cb4a3629c0) (structured ClawSweeper verdict: pass (sha=d3519ce42ce196d37d971de9b2c5e7cb4a362...)
2026-05-02 15:49:55 UTC merged [`d3519ce42ce1`](https://github.com/openclaw/openclaw/commit/d3519ce42ce196d37d971de9b2c5e7cb4a3629c0) (merged by ClawSweeper automerge)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 487565be6f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-02T15:24:21Z

+  local requests_file="$ARTIFACT_ROOT/clawhub-not-found-requests.jsonl"
+  if ! grep -q '/api/v1/packages/%40openclaw%2Fmatrix' "$requests_file" 2>/dev/null; then


Skip fixture log assertion when ClawHub URL is overridden

This assertion always reads clawhub-not-found-requests.jsonl, but start_configured_plugin_installs_clawhub_fixture intentionally returns early when OPENCLAW_CLAWHUB_URL/CLAWHUB_URL is pre-set, so that file is never created in override environments. The configured-plugin-installs scenario will then fail even if doctor correctly attempted ClawHub against the external URL. Guard this check behind the same fixture condition (or assert via another signal) to avoid false failures.

Useful? React with 👍 / 👎.

steipete · 2026-05-02T15:24:58Z

@clawsweeper automerge

steipete · 2026-05-02T15:33:48Z

@clawsweeper automerge

steipete · 2026-05-02T15:44:37Z

@clawsweeper automerge

Summary: - The PR adds a 2026.5.2 doctor repair pass for actively used configured downloadable plugins, prefers ClawHub ... pm fallback, records installed plugin state, extends upgrade-survivor coverage, and updates docs/changelog. - Reproducibility: yes. Static inspection of current main and the PR head gives a high-confidence reproduction ... d-plugin install pass, while the PR tests the new repair-only path, success stamping, and warning behavior. ClawSweeper fixups: - Included follow-up commit: test: cover configured plugin install update path - Included follow-up commit: test: isolate channel option metadata cache - Included follow-up commit: fix: keep configured plugin repair scoped Validation: - ClawSweeper review passed for head d3519ce. - Required merge gates passed before the squash merge. Prepared head SHA: d3519ce Review: openclaw#76129 (comment) Co-authored-by: Peter Steinberger <steipete@gmail.com>

Summary: - The PR adds a 2026.5.2 doctor repair pass for actively used configured downloadable plugins, prefers ClawHub ... pm fallback, records installed plugin state, extends upgrade-survivor coverage, and updates docs/changelog. - Reproducibility: yes. Static inspection of current main and the PR head gives a high-confidence reproduction ... d-plugin install pass, while the PR tests the new repair-only path, success stamping, and warning behavior. ClawSweeper fixups: - Included follow-up commit: test: cover configured plugin install update path - Included follow-up commit: test: isolate channel option metadata cache - Included follow-up commit: fix: keep configured plugin repair scoped Validation: - ClawSweeper review passed for head d3519ce42ce196d37d971de9b2c5e7cb4a3629c0. - Required merge gates passed before the squash merge. Prepared head SHA: d3519ce42ce196d37d971de9b2c5e7cb4a3629c0 Review: openclaw/openclaw#76129 (comment) Co-authored-by: Peter Steinberger <steipete@gmail.com>

Summary: - The PR adds a 2026.5.2 doctor repair pass for actively used configured downloadable plugins, prefers ClawHub ... pm fallback, records installed plugin state, extends upgrade-survivor coverage, and updates docs/changelog. - Reproducibility: yes. Static inspection of current main and the PR head gives a high-confidence reproduction ... d-plugin install pass, while the PR tests the new repair-only path, success stamping, and warning behavior. ClawSweeper fixups: - Included follow-up commit: test: cover configured plugin install update path - Included follow-up commit: test: isolate channel option metadata cache - Included follow-up commit: fix: keep configured plugin repair scoped Validation: - ClawSweeper review passed for head d3519ce. - Required merge gates passed before the squash merge. Prepared head SHA: d3519ce Review: openclaw#76129 (comment) Co-authored-by: Peter Steinberger <steipete@gmail.com>

openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime scripts Repository scripts commands Command implementations docker Docker and sandbox tooling size: XL maintainer Maintainer-authored PR labels May 2, 2026

clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label May 2, 2026

chatgpt-codex-connector Bot reviewed May 2, 2026

View reviewed changes

openclaw-barnacle Bot added the cli CLI command changes label May 2, 2026

steipete force-pushed the codex/doctor-configured-plugin-installs branch from 4f765e0 to d781161 Compare May 2, 2026 15:33

steipete added 4 commits May 2, 2026 16:44

fix: repair configured plugin installs

9987c35

test: cover configured plugin install update path

cbe9cf8

test: isolate channel option metadata cache

1885f05

fix: keep configured plugin repair scoped

d3519ce

steipete force-pushed the codex/doctor-configured-plugin-installs branch from d781161 to d3519ce Compare May 2, 2026 15:44

clawsweeper Bot merged commit b63d098 into main May 2, 2026
87 checks passed

clawsweeper Bot deleted the codex/doctor-configured-plugin-installs branch May 2, 2026 15:49

github-actions Bot mentioned this pull request May 2, 2026

📡 Upstream Digest — 2026-05-02 16:37 UTC curtismercier/openclaw-mods#747

Open

steipete mentioned this pull request May 3, 2026

[5.2] Upgrade path broken for users with externalized plugins in config: install location mismatch, doctor --fix unreachable, downgrade blocked by meta.lastTouchedVersion #76586

Closed

clawsweeper Bot mentioned this pull request May 4, 2026

fix(doctor): repair allow-only official plugins #77573

Merged

26 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: repair configured plugin installs#76129

fix: repair configured plugin installs#76129
clawsweeper[bot] merged 4 commits into
mainfrom
codex/doctor-configured-plugin-installs

steipete commented May 2, 2026

Uh oh!

steipete commented May 2, 2026

Uh oh!

clawsweeper Bot commented May 2, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 2, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 2, 2026

Uh oh!

steipete commented May 2, 2026

Uh oh!

steipete commented May 2, 2026

Uh oh!

steipete commented May 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		local requests_file="$ARTIFACT_ROOT/clawhub-not-found-requests.jsonl"
		if ! grep -q '/api/v1/packages/%40openclaw%2Fmatrix' "$requests_file" 2>/dev/null; then

Uh oh!

Conversation

steipete commented May 2, 2026

Uh oh!

steipete commented May 2, 2026

Uh oh!

clawsweeper Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 2, 2026

Choose a reason for hiding this comment

Uh oh!

steipete commented May 2, 2026

Uh oh!

steipete commented May 2, 2026

Uh oh!

steipete commented May 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented May 2, 2026 •

edited

Loading

clawsweeper Bot commented May 2, 2026 •

edited

Loading