Pin official npm plugin install records#88585
Conversation
|
Codex review: needs maintainer review before merge. Reviewed June 3, 2026, 8:43 PM ET / 00:43 UTC. Summary PR surface: Source +292, Tests +692. Total +984 across 10 files. Reproducibility: yes. with high confidence from source and supplied CLI proof, though I did not run the CLI locally. Current main can persist bare official npm specs that the security audit reports as unpinned, and the PR proof shows the warning disappearing after exact records are written. Review metrics: 2 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Security Review detailsBest possible solution: Land this PR after a final mergeability and CI refresh, keeping the exact-spec record writer behavior rather than weakening the security audit to ignore managed official bare specs. Do we have a high-confidence way to reproduce the issue? Yes, with high confidence from source and supplied CLI proof, though I did not run the CLI locally. Current main can persist bare official npm specs that the security audit reports as unpinned, and the PR proof shows the warning disappearing after exact records are written. Is this the best way to solve the issue? Yes, this is the right layer: the managed record writers caused the warning, and fixing them preserves the audit for third-party moving specs. The weaker alternative would be audit-side special casing, which would hide an unpinned record instead of making the managed state exact. AGENTS.md: found and applied where relevant. Codex review notes: model gpt-5.5, reasoning high; reviewed against f6aa2c02d1c7. Label changesLabel changes:
Label justifications:
Evidence reviewedPR surface: Source +292, Tests +692. Total +984 across 10 files. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
|
Follow-up for the legacy state migration warning reported after testing PR head 47967b0 on OpenClaw 2026.5.31. Root cause: the migration compared legacy Added commit Verification:
|
|
Manual plugin update follow-up pushed in This addresses the ClawSweeper P1 concern about explicit manual plugin updates:
Verification:
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
# Conflicts: # src/agents/embedded-agent-runner/run/preemptive-compaction.ts # src/infra/channel-runtime-context.ts # src/infra/home-dir.ts # src/media/audio.ts
|
Land-ready proof for fb81858. Local proof:
Review:
CI:
Known proof gaps: no live npm registry install/update was run; behavior is covered by focused update/install regression tests and CI. |
# Conflicts: # src/plugins/installs.ts
|
Land-ready proof for ad54022. Local proof:
Review:
CI:
Known proof gaps: no live npm registry install/update was run; behavior is covered by focused update/install regression tests and CI. |
* fix(plugins): pin official npm install records * fix(infra): tolerate equivalent plugin install migrations * fix(plugins): preserve manual exact plugin pins * fix(infra): remove stale migration imports * chore: unblock ci guards * fix: preserve official sync integrity checks * fix: avoid prerelease integrity carryover * fix: preserve manual official npm specs * fix: preserve beta fallback integrity checks * fix: preserve trusted prerelease fallback integrity * fix: preserve prerelease-only integrity checks * fix: pin unchanged official npm records * fix: allow official compatible fallback updates * fix: preserve fallback integrity after prerelease resolution * fix: skip incompatible fallback integrity pins * fix: preserve pin-only install provenance * fix: check integrity when repairing missing official pins --------- Co-authored-by: Lilac <lilac@Lilacs-iMac.local> Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(plugins): pin official npm install records * fix(infra): tolerate equivalent plugin install migrations * fix(plugins): preserve manual exact plugin pins * fix(infra): remove stale migration imports * chore: unblock ci guards * fix: preserve official sync integrity checks * fix: avoid prerelease integrity carryover * fix: preserve manual official npm specs * fix: preserve beta fallback integrity checks * fix: preserve trusted prerelease fallback integrity * fix: preserve prerelease-only integrity checks * fix: pin unchanged official npm records * fix: allow official compatible fallback updates * fix: preserve fallback integrity after prerelease resolution * fix: skip incompatible fallback integrity pins * fix: preserve pin-only install provenance * fix: check integrity when repairing missing official pins --------- Co-authored-by: Lilac <lilac@Lilacs-iMac.local> Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(plugins): pin official npm install records * fix(infra): tolerate equivalent plugin install migrations * fix(plugins): preserve manual exact plugin pins * fix(infra): remove stale migration imports * chore: unblock ci guards * fix: preserve official sync integrity checks * fix: avoid prerelease integrity carryover * fix: preserve manual official npm specs * fix: preserve beta fallback integrity checks * fix: preserve trusted prerelease fallback integrity * fix: preserve prerelease-only integrity checks * fix: pin unchanged official npm records * fix: allow official compatible fallback updates * fix: preserve fallback integrity after prerelease resolution * fix: skip incompatible fallback integrity pins * fix: preserve pin-only install provenance * fix: check integrity when repairing missing official pins --------- Co-authored-by: Lilac <lilac@Lilacs-iMac.local> Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(plugins): pin official npm install records * fix(infra): tolerate equivalent plugin install migrations * fix(plugins): preserve manual exact plugin pins * fix(infra): remove stale migration imports * chore: unblock ci guards * fix: preserve official sync integrity checks * fix: avoid prerelease integrity carryover * fix: preserve manual official npm specs * fix: preserve beta fallback integrity checks * fix: preserve trusted prerelease fallback integrity * fix: preserve prerelease-only integrity checks * fix: pin unchanged official npm records * fix: allow official compatible fallback updates * fix: preserve fallback integrity after prerelease resolution * fix: skip incompatible fallback integrity pins * fix: preserve pin-only install provenance * fix: check integrity when repairing missing official pins --------- Co-authored-by: Lilac <lilac@Lilacs-iMac.local> Co-authored-by: Peter Steinberger <steipete@gmail.com>

Summary
resolvedSpecvalues into managed official plugin install records instead of rewriting them back to bare catalog specs after successful installs/updates.openclaw plugins updateresolve official plugins through the official catalog, so exact-pinned official records can still update.Real behavior proof
Behavior addressed:
openclaw update/ managed official plugin update paths can rewrite official npm plugin records such asacpx,codex, anddiscordback to bare specs like@openclaw/codex, causingopenclaw status --deepto reportWARN Plugin index includes unpinned npm specseven though the installed npm payload and lockfile are versioned.Real environment tested: reporter's macOS global install at
/opt/homebrew/bin/openclawwith Node v25.8.1. I applied this PR behavior as a local patch to the unpacked global package, then ran the official plugin update path foracpx,codex, anddiscord.Exact steps or command run after this patch:
/opt/homebrew/bin/openclaw plugins update acpx/opt/homebrew/bin/openclaw plugins update codex/opt/homebrew/bin/openclaw plugins update discord/opt/homebrew/bin/openclaw status --deepEvidence after fix:
Before applying the PR behavior,
openclaw status --deepshows the false-positive plugin warning for bare official npm specs:After the patched writer rewrote the official records to exact specs,
openclaw status --deepno longer reportsWARN Plugin index includes unpinned npm specs:Observed result after fix: the patched managed official plugin update path rewrote
~/.openclaw/plugins/installs.jsonto exact official specs@openclaw/acpx@2026.5.28,@openclaw/codex@2026.5.28, and@openclaw/discord@2026.5.28. The follow-upopenclaw status --deepsecurity audit summary changed from0 critical · 4 warn · 1 infowithWARN Plugin index includes unpinned npm specsto0 critical · 3 warn · 1 infowith that plugin warning gone.What was not tested: I did not publish a release package from this branch. The after screenshot comes from patching the reporter's existing global install in place to exercise the same managed official plugin writer paths before release.
Verification
node scripts/run-vitest.mjs src/plugins/installs.test.ts src/plugins/update.test.ts src/commands/doctor/shared/missing-configured-plugin-install.test.ts src/commands/onboarding-plugin-install.test.tsnode scripts/run-vitest.mjs src/commands/doctor-state-migrations.test.tsnode scripts/run-vitest.mjs src/plugins/installs.test.ts src/plugins/update.test.ts src/commands/doctor/shared/missing-configured-plugin-install.test.ts src/commands/onboarding-plugin-install.test.ts src/commands/doctor-state-migrations.test.tspnpm exec oxfmt --check --threads=1 src/infra/state-migrations.ts src/commands/doctor-state-migrations.test.tsnode scripts/run-oxlint.mjs src/infra/state-migrations.ts src/commands/doctor-state-migrations.test.tspnpm format:checkand scopednode scripts/run-oxlint.mjsfor the original install/update patch filesgit diff --check