feat: publish plugins with extended-stable releases by kevinslin · Pull Request #100448 · openclaw/openclaw

kevinslin · 2026-07-05T19:50:08Z

What Problem This Solves

Extended-stable core releases could not publish and verify the matching official plugin set as one npm-only release. Operators also lacked a safe retry path for stale plugin tags, while clients following default official plugin intent could resolve a moving latest package instead of the exact installed core version.

Why This Change Was Made

This reuses the existing all-publishable plugin workflow with one closed extended-stable tag override, publishes and verifies plugins before core, and binds core publication to a successful plugin run on the same branch and SHA. New tags are assigned atomically by OIDC trusted publication; token-authenticated post-publication tag mutation remains outside the source repo. At runtime, one shared resolver maps eligible official bare/latest intent to the exact core version while preserving explicit pins, third-party packages, and non-npm sources.

User Impact

Release operators can publish every npm plugin in lockstep with each .33+ extended-stable core release without moving regular latest or beta selectors. Users installing or updating on extended-stable receive official default-tracking plugins at the exact core version; ordinary stable releases and intentionally pinned plugins keep their existing behavior.

Evidence

Local Verdaccio selector matrix passed with core plus Slack, Discord, Codex, and Matrix fixtures:
- new line: extended-stable=2099.4.33, latest=2099.5.1;
- extended-stable patch: every package moved to 2099.4.34, latest remained 2099.5.1;
- newer regular stable: every latest moved to 2099.5.2, every extended-stable remained 2099.4.34.
Release workflow/publish-plan coverage: 142 tests passed across 6 files.
Plugin install/update/doctor/onboarding coverage: 446 tests passed across 6 files.
Review regression: 147 plugin update tests passed, including plugins update --all preserving moving extended-stable intent after an official ClawHub-to-npm fallback.
Credential-boundary regression: workflow validation and 68 focused release tests passed; the extended-stable source workflow exposes no npm token and contains no npm dist-tag add mutation.
Documentation validation: 5,707 internal links checked with 0 broken; glossary check passed.
Workflow validation, zizmor, interpolation checks, and git diff --check passed.

Manual verification:

New extended-stable line publishes core and all representative plugins.
Extended-stable patch leaves regular stable selectors unchanged.
Newer regular stable leaves extended-stable selectors unchanged.
Partial-run reuse, complete exact-package/tag readback, and exact-head core gating are covered by workflow contract tests.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 957f7366eb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

clawsweeper · 2026-07-05T19:56:53Z

Codex review: needs maintainer review before merge. Reviewed July 5, 2026, 6:10 PM ET / 22:10 UTC.

Summary
The branch adds an extended-stable path for publishing all npm-publishable official plugins, verifies that plugin run before core publication, and updates runtime plugin install/update resolution to map eligible official default npm intent to the exact core version.

PR surface: Source +88, Tests +815, Docs +61, Config +125, Other +88. Total +1177 across 31 files.

Reproducibility: not applicable. this is a release feature PR rather than a bug report. The behavioral claim is source-verifiable and backed by the PR body's local Verdaccio selector matrix plus focused workflow/runtime tests.

Review metrics: 1 noteworthy metric.

Release workflow inputs: 2 added. The PR adds npm_dist_tag to Plugin NPM Release and plugin_npm_run_id to OpenClaw NPM Release, changing release-operator dispatch contracts before merge.

Stored data model
Persistent data-model change detected: migration/backfill/repair: src/commands/doctor/shared/missing-configured-plugin-install.test.ts, migration/backfill/repair: src/commands/doctor/shared/missing-configured-plugin-install.ts, serialized state: test/scripts/plugin-npm-publish.test.ts, unknown-data-model-change: src/commands/doctor/shared/missing-configured-plugin-install.test.ts, unknown-data-model-change: src/commands/doctor/shared/missing-configured-plugin-install.ts, vector/embedding metadata: .github/workflows/openclaw-npm-release.yml, and 1 more. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Have a release owner choose the extended-stable plugin boundary against the overlapping open proposals before merge.

Risk before merge

[P1] The PR changes npm release workflows, dispatch inputs, run identity checks, and registry readback behavior, so production release-operator safety still needs release-owner acceptance even with green CI and local Verdaccio proof.
[P1] The all-plugin exact-core policy overlaps with open extended-stable plugin-release proposals that use covered-candidate or monthly snapshot boundaries, so maintainers need to choose one compatibility model before landing.

Maintainer options:

Land after release-owner approval (recommended)
If release owners accept the all-plugin exact-core policy, merge after exact-head checks because the prior runtime and credential-boundary blockers are addressed.
Pause for snapshot replacement
If the monthly snapshot or covered-plugin boundary is preferred, pause or close this PR once the chosen replacement is viable and linked.
Request one more release dry-run
If maintainers want more release-automation assurance, require an exact-head protected-environment or equivalent registry readback dry-run before merge.

Next step before merge

[P2] A release owner should choose the extended-stable plugin policy and accept the release-automation risk; there is no remaining narrow mechanical blocker for ClawSweeper to repair.

Maintainer decision needed

Question: Should extended-stable plugin releases publish every npm-publishable official plugin at the exact core version for each .33+ release, or should this wait behind the narrower covered-candidate/monthly-snapshot policy from the overlapping open PRs?
Rationale: The patch is now technically clean from this review, but it selects a release compatibility policy and changes protected release automation, which requires maintainer intent rather than another mechanical repair.
Likely owner: openclaw/openclaw-release-managers — The release-manager owner boundary owns the core npm release workflow and release docs that this PR changes, while the decision is about release policy rather than a code-only repair.
Options:
- Approve all-plugin exact-core (recommended): Use this PR's lockstep all-publishable plugin model after exact-head checks because it directly solves the moving-latest plugin problem with the simplest runtime rule.
- Use covered or snapshot policy: Pause or supersede this PR if release owners prefer the covered-plugin candidate flow or monthly snapshot boundary from the overlapping proposals.
- Keep core-only extended-stable: Defer plugin publication and runtime convergence if maintainers want extended-stable core releases to remain package-only for now.

Security
Cleared: No concrete security or supply-chain regression was found; the extended-stable path keeps npm token mutation out of this source workflow and relies on trusted publishing plus exact run verification.

Review details

Best possible solution:

Land one release-owner-approved extended-stable plugin policy that preserves official default install intent, keeps explicit pins and third-party installs untouched, and keeps npm tag mutation outside token-authenticated source-repo code.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a release feature PR rather than a bug report. The behavioral claim is source-verifiable and backed by the PR body's local Verdaccio selector matrix plus focused workflow/runtime tests.

Is this the best way to solve the issue?

Yes, conditionally: the implementation is a maintainable shared resolver and workflow-gated release path if maintainers choose the all-plugin exact-core policy. The unresolved question is policy fit versus the overlapping covered/snapshot proposals, not a line-level defect.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ff440393da6a.

Label changes

Label changes:

add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix real behavior proof from a local Verdaccio selector matrix for core plus representative plugins, with release workflow, runtime, credential-boundary, and docs validation output.
remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P2: This is a normal-priority release/plugin improvement with limited blast radius to extended-stable release operators and users on that channel.
merge-risk: 🚨 compatibility: The PR changes how official plugin install records and default/latest intent resolve for extended-stable upgrades, which can affect future plugin compatibility behavior.
merge-risk: 🚨 automation: The PR changes protected npm release workflows, dispatch inputs, run identity verification, and registry readback sequencing that CI cannot fully prove in production.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix real behavior proof from a local Verdaccio selector matrix for core plus representative plugins, with release workflow, runtime, credential-boundary, and docs validation output.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix real behavior proof from a local Verdaccio selector matrix for core plus representative plugins, with release workflow, runtime, credential-boundary, and docs validation output.

Evidence reviewed

PR surface:

Source +88, Tests +815, Docs +61, Config +125, Other +88. Total +1177 across 31 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	6	117	29	+88
Tests	12	829	14	+815
Docs	5	85	24	+61
Config	2	128	3	+125
Generated	0	0	0	0
Other	6	99	11	+88
Total	31	1258	81	+1177

What I checked:

Root policy read: Root AGENTS.md and scoped docs/scripts/plugins/test AGENTS.md files were read and applied; release workflow, plugin install/update, docs, and test guidance are relevant to this review. (AGENTS.md:1, ff440393da6a)
Current main lacks the requested behavior: Current main still maps post-core extended-stable plugin convergence to the stable channel, so the central requested plugin lockstep behavior is not already implemented on main. (src/cli/update-cli/update-command.ts:1958, ff440393da6a)
PR resolver preserves official default intent: At the PR head, the shared resolver maps only official bare/latest npm intent on extended-stable to the exact core version while preserving explicit pins, third-party packages, and non-npm specs. (src/plugins/install-channel-specs.ts:44, 76e965edac8e)
Prior fallback finding is fixed: The PR head now passes the effective official update channel into ClawHub-to-npm fallback resolution and uses that same effective channel when deciding whether to pin the fallback record. (src/plugins/update.ts:1536, 76e965edac8e)
Fallback regression coverage exists: The PR adds focused coverage for official ClawHub installs and bridge fallbacks resolving to exact-core npm specs on extended-stable while preserving the moving record intent. (src/plugins/update.test.ts:3865, 76e965edac8e)
Release workflow credential boundary checked: The plugin publish workflow blanks npm token secrets for extended-stable, keeps trusted publishing with id-token, and the workflow contract test asserts no post-publication npm dist-tag mutation in this source repo. (.github/workflows/plugin-npm-release.yml:339, 76e965edac8e)

Likely related people:

kevinslin: kevinslin authored and merged the recent extended-stable core update and monthly npm extended-stable publication PRs, and this PR continues that same release/plugin policy area. (role: recent extended-stable release contributor; confidence: high; commits: d2146223205e, ba7b5db74c91, 76e965edac8e; files: src/cli/update-cli/update-command.ts, src/plugins/update.ts, .github/workflows/plugin-npm-release.yml)
osolmaz: The initial Plugin NPM Release workflow traces to the merged plugin npm publish workflow PR, making osolmaz relevant for the release automation surface even though the newer extended-stable policy is separate. (role: introduced plugin npm workflow; confidence: medium; commits: d41c9ad4cb71; files: .github/workflows/plugin-npm-release.yml, scripts/lib/plugin-npm-release.ts)
openclaw/openclaw-release-managers: CODEOWNERS assigns the core npm release workflow and release docs to the release-manager owner boundary, which is the affected policy surface for this PR. (role: release workflow owner boundary; confidence: medium; files: .github/workflows/openclaw-npm-release.yml, docs/reference/RELEASING.md)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

reviewed 2026-07-05T20:01:03.016Z sha 957f736 :: needs changes before merge. :: [P2] Preserve intent on official ClawHub fallback

kevinslin · 2026-07-05T21:33:14Z

@clawsweeper re-review

The official ClawHub-to-npm fallback now uses the effective official update channel when deciding whether to preserve moving install intent. Commit 13c51a8 adds the plugins update --all regression path; 147 focused plugin update tests pass, and current-head CI is green.

clawsweeper · 2026-07-05T21:33:17Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

kevinslin · 2026-07-05T21:59:54Z

@clawsweeper re-review

Current head 76e965e addresses both prior findings: the ClawHub fallback preserves effective extended-stable intent, and the source workflow no longer performs token-authenticated npm dist-tag mutation. All review threads are resolved, 147 runtime tests and 68 focused release tests pass, workflow validation passes, and current-head CI is green.

clawsweeper · 2026-07-05T21:59:57Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

kevinslin · 2026-07-05T23:14:43Z

Live fork OIDC publication proof

A fork-only canary based on this PR head (76e965e) exercised the real plugin-npm-release.yml trusted-publisher path without changing the production branch:

Run: https://github.com/kevinslin/openclaw/actions/runs/28758023880
Fork-only adapter commit: 96d5e0b
Package: @kevins8/[email protected]
Publish log: NPM_TOKEN empty; Publish auth: GitHub OIDC trusted publishing
Command: npm publish --access public --tag extended-stable --provenance
Mirror tags: none
npm emitted a signed GitHub Actions provenance statement
Complete workflow registry readback passed
Authoritative dist-tag readback after publication: extended-stable=2099.1.33, while the bootstrap package's latest remained 0.0.0-bootstrap.0
Package attestations report SLSA provenance and repository kevinslin/openclaw

The workflow selected only the fork-owned canary package; it did not target or mutate any upstream @openclaw package. This proves the OIDC/tag/provenance path used by the PR while keeping the fork-only package retargeting outside the upstream change.

kevinslin · 2026-07-05T23:15:36Z

Release-owner policy decision

Approve the all-plugin exact-core policy implemented by this PR: every npm-publishable official plugin is published at the extended-stable core version, eligible official default/latest intent resolves to that exact core version, and explicit pins plus third-party/non-npm sources remain unchanged. This is the selected Milestone 25.11 model and supersedes the earlier covered-plugin/monthly-snapshot implementation proposals.

The current head is mergeable with green CI, resolved review threads, local Verdaccio publication/install/update proof, and the live fork OIDC/provenance proof in the preceding comment.

* feat(release): publish plugins on extended-stable * feat(plugins): align extended-stable with core * docs: explain extended-stable plugin alignment * fix(release): make plugin convergence recoverable * fix(plugins): preserve extended-stable fallback intent * fix(release): keep plugin tag mutation credential-isolated

* feat(release): publish plugins on extended-stable * feat(plugins): align extended-stable with core * docs: explain extended-stable plugin alignment * fix(release): make plugin convergence recoverable * fix(plugins): preserve extended-stable fallback intent * fix(release): keep plugin tag mutation credential-isolated (cherry picked from commit 9d2d517)

kevinslin added 4 commits July 5, 2026 11:44

feat(release): publish plugins on extended-stable

13eec8c

feat(plugins): align extended-stable with core

f822c97

docs: explain extended-stable plugin alignment

bed1b1e

fix(release): make plugin convergence recoverable

957f736

kevinslin requested a review from a team as a code owner July 5, 2026 19:50

openclaw-barnacle Bot added docs Improvements or additions to documentation cli CLI command changes scripts Repository scripts commands Command implementations size: XL maintainer Maintainer-authored PR labels Jul 5, 2026

chatgpt-codex-connector Bot reviewed Jul 5, 2026

View reviewed changes

Comment thread src/plugins/update.ts Outdated

fix(plugins): preserve extended-stable fallback intent

13c51a8

kevinlin-openai reviewed Jul 5, 2026

View reviewed changes

Comment thread .github/workflows/plugin-npm-release.yml Outdated

fix(release): keep plugin tag mutation credential-isolated

76e965e

kevinslin merged commit 9d2d517 into openclaw:main Jul 5, 2026
123 of 130 checks passed

kevinslin deleted the dev/kevinlin/lockstep-extended-stable-plugins branch July 5, 2026 23:17

This was referenced Jul 6, 2026

Add read-only extended-stable npm closeout #100504

Open

feat(release): add extended-stable npm closeout #100508

Open

fix(agent-core): resolve tool-name mismatches for Claude Code alias calls #99208

Open

kevinslin mentioned this pull request Jul 7, 2026

feat(release): preflight all extended-stable npm packages #101757

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: publish plugins with extended-stable releases#100448

feat: publish plugins with extended-stable releases#100448
kevinslin merged 6 commits into
openclaw:mainfrom
kevinslin:dev/kevinlin/lockstep-extended-stable-plugins

kevinslin commented Jul 5, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

Uh oh!

kevinslin commented Jul 5, 2026

Uh oh!

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

kevinslin commented Jul 5, 2026

Uh oh!

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

Uh oh!

kevinslin commented Jul 5, 2026 •

edited

Loading

Uh oh!

kevinslin commented Jul 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

kevinslin commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

clawsweeper Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kevinslin commented Jul 5, 2026

Uh oh!

clawsweeper Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kevinslin commented Jul 5, 2026

Uh oh!

clawsweeper Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kevinslin commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Live fork OIDC publication proof

Uh oh!

kevinslin commented Jul 5, 2026

Release-owner policy decision

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kevinslin commented Jul 5, 2026 •

edited

Loading

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

kevinslin commented Jul 5, 2026 •

edited

Loading