feat(runner): support OpenClaw plugins across the ClawHub profile#15
Conversation
VACInc
changed the title
|
Rebased onto current |
clawsweeper
Bot
added
proof: sufficient
|
Codex review: needs maintainer review before merge. Reviewed July 17, 2026, 8:50 PM ET / July 18, 2026, 00:50 UTC. Summary Reproducibility: not applicable. as a bug reproduction. The PR supplies final-head terminal evidence that an explicit real OpenClaw plugin manifest resolves as Review metrics: 2 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Maintainer decision needed
Security Review detailsBest possible solution: Sponsor the explicit plugin-target contract, retain target-aware skips for scanners that do not support plugins, and land only after the code owner accepts the JSON5 parser dependency and compatibility commitment. Do we have a high-confidence way to reproduce the issue? Not applicable as a bug reproduction. The PR supplies final-head terminal evidence that an explicit real OpenClaw plugin manifest resolves as Is this the best way to solve the issue? Unclear until a maintainer accepts the public product boundary. Given that decision, the target-aware resolver and explicit scanner capability declaration are a focused, maintainable implementation path. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 1d3ca1a27e69. Label changesLabel changes:
Label justifications:
Evidence reviewedWhat I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
Review history (4 earlier review cycles)
|
|
Rebased onto Post-rebase review fixes: dual-layout explicit manifest handling, stable and timezone-independent plugin ZIP identity, and Socket plugin compatibility. Revalidated: |
clawsweeper
Bot
added
rating: 🦞 diamond lobster
Add a small target abstraction so explicit OpenClaw plugin directories are recognized, validated, scanned, and reported without being forced through SKILL.md assumptions, while preserving existing skill behavior and zero-target skill discovery. - resolveTarget/classifyLocalTarget classify a directory (or manifest file) holding openclaw.plugin.json as kind=plugin and record the stable manifest id; skills, single files, and missing paths keep the historical skill kind. A directory carrying both manifests is rejected as ambiguous, and an invalid plugin id fails the run before any scanner work. A manifest-file target is scanned as its surrounding plugin directory so scanners see the plugin code. - Plugin ids follow OpenClaw's install grammar, including @scope/name ids, and the manifest size cap matches the host runtime's 256 KiB limit. - Scanner adapters declare SupportsTargetKind; the built-in clawscan-static scanner analyzes plugin targets while skill-only scanners return an explicit skipped result. Requirement validation and Docker gating are target-aware, so scanners that can only skip never demand credentials or a sandbox. - Manifest reads never follow symlinks: classification lstats manifests and readPluginID opens O_NOFOLLOW with a same-file identity re-check, so a hostile target cannot point its manifest at a host file outside the target. - Plugins are never auto-discovered; zero-target discovery still scans only ./skills. Documented in CLI help, README, and docs/scanners.md. Adds registry, runner, and end-to-end CLI tests covering plugin classification, scoped ids, manifest-file targets, symlinked-manifest rejection, static-scanner completion over plugin code, credential-free skips, ambiguity, and no auto-discovery.
|
@clawsweeper re-review Rebased onto Addressed the JSON5 blocker plus closeout findings for exact lowercase IDs, complete dual-layout scans, symlink-safe discovery, filesystem-identity manifest selection, and VirusTotal target-kind consistency. Updated the body and docs for the current two-scanner built-in Revalidated: full tests, race tests, vet, docs, five target builds, focused real-plugin/static and JSON5 behavior, repo autoreview, and independent closeout review. |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
clawsweeper
Bot
added
rating: 🐚 platinum hermit
clawsweeper
Bot
added
the
status: 👀 ready for maintainer look
2 participants
Summary
clawhubscanners, SkillSpector and ClawScan Static, for plugins and providepackageReleasecontext to the bundled judge.skippedresult for plugin targets.plugin.zipartifacts for VirusTotal.Root Cause
Before this PR, target resolution recognized only skills and URLs. Scanner capability checks and artifact metadata had no plugin target kind, so OpenClaw plugin manifests were routed through skill assumptions.
The original PR head also decoded
openclaw.plugin.jsonwith strictencoding/json. ClawSweeper reproduced that comments, trailing commas, and unquoted keys accepted by OpenClaw failed before scanner dispatch. Inspection of OpenClaw's manifest loader confirmed a strict-JSON first pass with JSON5 fallback.During review, dual-layout packages exposed two related classification gaps: explicit
SKILL.mdnarrowed the scan to one file, and VirusTotal independently reclassified the enclosing directory from its contents. The final implementation carries resolved target kind and ID into scanner dispatch and recognizes explicit manifests by filesystem identity.Security / Trust Impact
Plugin contents remain untrusted. Manifest discovery does not follow symlinks; reads use
O_NOFOLLOW, a same-file check, and a 256 KiB cap. The exact lowercaseidkey is required and validated before it enters artifacts or ZIP metadata. A directory containing both manifests fails closed until the caller selects the intended manifest.VirusTotal can upload a deterministic archive when explicitly selected or included in a custom profile. Operators should not submit confidential packages to a public VirusTotal corpus.
Real behavior proof
Closest feasible host behavior on the final head:
The JSON5 test passed comments, trailing commas, unquoted and escaped keys, single quotes, BOM, Unicode whitespace and keys, and extended escapes.
A real first-party plugin from an OpenClaw checkout was then scanned with the final binary. The checkout prefix is redacted:
Observed result:
{ "target": {"kind":"plugin","id":"synology-chat"}, "status": "completed", "scanned": 25, "omitted": 0 }Current profile behavior was also checked with
go run ./cmd/clawscan profiles -v;clawhublists exactlyskillspectorandclawscan-static.Verification
go test -count=1 ./...go test -race -count=1 ./...go vet ./...make docs-site, built 6 pagesgit diff --checkgo mod tidy -diffWhat was not tested
Scope boundary
Plugins remain explicit targets and are not added to zero-target skill discovery. Benchmark behavior, release automation, and unrelated scanner behavior are unchanged.