fix(plugin-sdk): remove relative extension boundary escapes by vincentkoc · Pull Request #51939 · openclaw/openclaw

vincentkoc · 2026-03-22T00:00:21Z

Summary

Problem: bundled extension runtime-api.ts barrels and one BlueBubbles helper import still used relative paths that escaped their own package roots, and the relative-outside-package boundary check tolerated the existing violations via a checked-in baseline.
Why it matters: the rule only detected drift instead of enforcing the policy, so repo code could keep shipping known boundary escapes.
What changed: added the missing public openclaw/plugin-sdk/* subpaths, rewired the violating extension imports to those public seams, and changed relative-outside-package to hard-fail on any violation.
What did NOT change (scope boundary): no channel behavior, runtime semantics, or non-boundary refactors beyond the public plugin-sdk export surface needed to remove the escapes.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #
Related #

User-visible / Behavior Changes

Bundled extensions now consume plugin SDK seams through public openclaw/plugin-sdk/* subpaths instead of relative escapes. The relative-outside-package rule now fails immediately on any future violation.

Security Impact (required)

New permissions/capabilities? (No)
Secrets/tokens handling changed? (No)
New/changed network calls? (No)
Command/tool execution surface changed? (No)
Data access scope changed? (No)
If any Yes, explain risk + mitigation:

Repro + Verification

Environment

OS: macOS
Runtime/container: Node 22, pnpm 10
Model/provider: n/a
Integration/channel (if any): bundled extension plugin-sdk surfaces
Relevant config (redacted): none

Steps

Run pnpm lint:extensions:no-relative-outside-package on main and inspect the non-empty inventory.
Replace each relative escape with a public openclaw/plugin-sdk/* import and export the missing subpaths.
Re-run the boundary lint, targeted tests, and pnpm build.

Expected

relative-outside-package reports no violations and fails if any reappear.
Public plugin-sdk exports stay in sync with the package export map and build artifacts.

Actual

Local validation is green with the violations removed.

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios: ran pnpm lint:extensions:no-relative-outside-package, pnpm lint:plugins:plugin-sdk-subpaths-exported, pnpm test -- test/extension-plugin-sdk-boundary.test.ts src/plugin-sdk/runtime-api-guardrails.test.ts src/plugin-sdk/subpaths.test.ts, and pnpm build.
Edge cases checked: confirmed BlueBubbles now imports the shared iMessage parsing helpers through openclaw/plugin-sdk/imessage-core; confirmed the boundary script no longer accepts a non-empty relative-outside-package baseline.
What you did not verify: broader end-to-end channel runtime behavior beyond the contract/build gates above.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

Backward compatible? (Yes)
Config/env changes? (No)
Migration needed? (No)
If yes, exact upgrade steps:

Failure Recovery (if this breaks)

How to disable/revert this change quickly: revert commit ad5d80862a.
Files/config to restore: package.json, scripts/lib/plugin-sdk-entrypoints.json, and the touched extension runtime-api.ts / targets.ts files.
Known bad symptoms reviewers should watch for: missing plugin-sdk subpath resolution at runtime, or guardrail test failures if a runtime-api barrel drifts from the curated export list.

Risks and Mitigations

Risk: expanding the public plugin-sdk surface exposes more subpaths than before.
- Mitigation: the new entries are existing curated source files only, covered by plugin-sdk:check-exports, subpaths.test.ts, and the targeted boundary/runtime-api tests.

AI-assisted: Yes. Tested locally.

openclaw-barnacle · 2026-03-22T00:00:41Z

Closing this PR because it looks dirty (too many unrelated or unexpected changes). This usually happens when a branch picks up unrelated commits or a merge went sideways. Please recreate the PR from a clean branch.

openclaw-barnacle · 2026-03-22T00:00:41Z

Closing this PR because it looks dirty (too many unrelated or unexpected changes). This usually happens when a branch picks up unrelated commits or a merge went sideways. Please recreate the PR from a clean branch.

openclaw-barnacle · 2026-03-22T00:00:41Z

Closing this PR because it looks dirty (too many unrelated or unexpected changes). This usually happens when a branch picks up unrelated commits or a merge went sideways. Please recreate the PR from a clean branch.

openclaw-barnacle · 2026-03-22T00:00:41Z

Closing this PR because it looks dirty (too many unrelated or unexpected changes). This usually happens when a branch picks up unrelated commits or a merge went sideways. Please recreate the PR from a clean branch.

openclaw-barnacle · 2026-03-22T00:00:41Z

Closing this PR because it looks dirty (too many unrelated or unexpected changes). This usually happens when a branch picks up unrelated commits or a merge went sideways. Please recreate the PR from a clean branch.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 181db5b147

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

extensions/line/runtime-api.ts

extensions/googlechat/runtime-api.ts

openclaw-barnacle · 2026-03-22T00:54:53Z

Closing this PR because it looks dirty (too many unrelated or unexpected changes). This usually happens when a branch picks up unrelated commits or a merge went sideways. Please recreate the PR from a clean branch.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 50c0130e01

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-22T01:04:02Z

extensions/bluebubbles/package.json

+  "peerDependenciesMeta": {
+    "openclaw": {
+      "optional": true


Make the new OpenClaw peer dependency mandatory

In the plugin install path we unpack the plugin and run npm install --omit=dev inside that isolated directory (src/infra/install-package-dir.ts:188-199). Because the new openclaw peer is marked optional here, npm accepts the install without checking/materializing the host package, so users on older OpenClaw releases can still install or update these plugins and only discover the break later when the new openclaw/plugin-sdk/* imports from their runtime barrels cannot be resolved. The same peerDependenciesMeta.openclaw.optional stanza was added to the other updated public plugin manifests in this commit, so the compatibility gate is still ineffective.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-03-22T01:04:02Z

extensions/twitch/runtime-api.ts

 // Keep this barrel thin and aligned with the local extension surface.

-export * from "../../src/plugin-sdk/twitch.js";
+export * from "openclaw/plugin-sdk/twitch";


Add a minimum host-version gate for Twitch

extensions/twitch/runtime-api.ts now depends on the brand-new openclaw/plugin-sdk/twitch export, but extensions/twitch/package.json still has no peerDependencies.openclaw floor. Twitch is installable from npm today — the docs explicitly tell users to run openclaw plugins install @openclaw/twitch (docs/channels/twitch.md:16-20), and catalog resolution falls back to the package name when openclaw.install.npmSpec is absent (src/channels/plugins/catalog.ts:187-195) — so hosts older than this commit can accept the package and then fail at load time because their loader never aliases that new subpath.

Useful? React with 👍 / 👎.

aisle-research-bot · 2026-03-22T01:26:44Z

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

#	Severity	Title
1	🔵 Low	Symlink-following write enables arbitrary file overwrite when sanitizing bundled extension package.json

1. 🔵 Symlink-following write enables arbitrary file overwrite when sanitizing bundled extension package.json

Property	Value
Severity	Low
CWE	CWE-59
Location	`scripts/stage-bundled-plugin-runtime-deps.mjs:80-82`

Description

sanitizeBundledManifestForRuntimeInstall(pluginDir) rewrites ${pluginDir}/package.json before running npm install.

Because the code writes the manifest using fs.writeFileSync() without verifying that package.json is a regular file (not a symlink/hardlink), an attacker who can influence the contents of dist/extensions/<plugin>/ (or any caller-provided repoRoot) can cause arbitrary file overwrite by making package.json a symlink to a sensitive path.

Input: pluginDir comes from scanning dist/extensions/* (or from a custom repoRoot passed into stageBundledPluginRuntimeDeps())
Attack primitive: create dist/extensions/<id>/package.json as a symlink to an arbitrary target (e.g., ~/.ssh/config, CI secrets files, etc.)
Sink: fs.writeFileSync(manifestPath, ...) follows the symlink and overwrites the target when changed === true

Vulnerable code:

function writeJson(filePath, value) {
  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
}
...
if (changed) {
  writeJson(manifestPath, packageJson);
}

This is a classic symlink attack risk in build/staging scripts when operating on potentially untrusted directories/artifacts.

Recommendation

Harden writes to package.json to reject symlinks (and ideally avoid TOCTOU).

At minimum, fail closed if the manifest is not a regular file:

import fs from "node:fs";
import path from "node:path";

function safeWriteJson(manifestPath, value, pluginDir) {
  // Ensure the resolved path stays within the plugin directory
  const realPluginDir = fs.realpathSync(pluginDir);
  const realManifestDir = fs.realpathSync(path.dirname(manifestPath));
  if (realManifestDir !== realPluginDir) {
    throw new Error(`Refusing to write manifest outside pluginDir: ${manifestPath}`);
  }

  const st = fs.lstatSync(manifestPath);
  if (st.isSymbolicLink() || !st.isFile()) {
    throw new Error(`Refusing to write non-regular manifest file: ${manifestPath}`);
  }

  fs.writeFileSync(manifestPath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
}

For stronger protection on platforms that support it, open the file with O_NOFOLLOW (fs.constants.O_NOFOLLOW) and write via the returned fd, or write to a temp file and rename() it into place after verifying the destination is not a symlink.

Analyzed PR: #51939 at commit 50c0130

_{Last updated on: 2026-03-22T01:47:09Z}

…#51939) * fix(plugin-sdk): remove relative extension boundary escapes * Gate new plugin-sdk subpaths on host version * Add changelog entry for openclaw#51939 * Fix local staging for plugin-sdk host version gate * Raise host floor for line and googlechat plugins --------- Co-authored-by: Tak Hoffman <[email protected]>

…#51939) * fix(plugin-sdk): remove relative extension boundary escapes * Gate new plugin-sdk subpaths on host version * Add changelog entry for openclaw#51939 * Fix local staging for plugin-sdk host version gate * Raise host floor for line and googlechat plugins --------- Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit 2b4c3c2) # Conflicts: # scripts/stage-bundled-plugin-runtime-deps.mjs

…#51939) * fix(plugin-sdk): remove relative extension boundary escapes * Gate new plugin-sdk subpaths on host version * Add changelog entry for openclaw#51939 * Fix local staging for plugin-sdk host version gate * Raise host floor for line and googlechat plugins --------- Co-authored-by: Tak Hoffman <[email protected]>

vincentkoc self-assigned this Mar 22, 2026

openclaw-barnacle bot added size: M maintainer Maintainer-authored PR labels Mar 22, 2026

Takhoffman force-pushed the test/relative-outside-package-guard branch from 89973a6 to a3e9bb0 Compare March 22, 2026 00:44

vincentkoc and others added 3 commits March 21, 2026 19:45

fix(plugin-sdk): remove relative extension boundary escapes

ae318ae

Gate new plugin-sdk subpaths on host version

898074c

Add changelog entry for #51939

181db5b

Takhoffman force-pushed the test/relative-outside-package-guard branch from a3e9bb0 to 181db5b Compare March 22, 2026 00:45

chatgpt-codex-connector bot reviewed Mar 22, 2026

View reviewed changes

extensions/line/runtime-api.ts Show resolved Hide resolved

extensions/googlechat/runtime-api.ts Show resolved Hide resolved

Fix local staging for plugin-sdk host version gate

64ab840

openclaw-barnacle bot added size: L and removed size: M labels Mar 22, 2026

openclaw-barnacle bot closed this Mar 22, 2026

Takhoffman reopened this Mar 22, 2026

Raise host floor for line and googlechat plugins

50c0130

Takhoffman merged commit 2b4c3c2 into main Mar 22, 2026
58 checks passed

Takhoffman deleted the test/relative-outside-package-guard branch March 22, 2026 01:03

chatgpt-codex-connector bot reviewed Mar 22, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 22, 2026

📡 Upstream Digest — 2026-03-22 01:25 UTC curtismercier/openclaw-mods#327

Open

vincentkoc mentioned this pull request Mar 22, 2026

fix(plugins): require host floor for new sdk subpaths #51982

Closed

20 tasks

github-actions bot mentioned this pull request Mar 22, 2026

🦞 Bản tin hàng ngày hệ sinh thái OpenClaw 2026-03-22 compasify/agents-radar#71

Open

wonderchook mentioned this pull request Mar 22, 2026

fix(slack): resolve cross-boundary imports breaking Docker runtime #51836

Closed

4 tasks

alexey-pelykh mentioned this pull request Mar 23, 2026

Cherry-pick (blocked): BlueBubbles adapter (13 commits) remoteclaw/remoteclaw#1925

Open

Uh oh!

Conversation

vincentkoc commented Mar 22, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Uh oh!

openclaw-barnacle bot commented Mar 22, 2026

Uh oh!

openclaw-barnacle bot commented Mar 22, 2026

Uh oh!

openclaw-barnacle bot commented Mar 22, 2026

Uh oh!

openclaw-barnacle bot commented Mar 22, 2026

Uh oh!

openclaw-barnacle bot commented Mar 22, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

openclaw-barnacle bot commented Mar 22, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 22, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Mar 22, 2026

Choose a reason for hiding this comment

Uh oh!

aisle-research-bot bot commented Mar 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Aisle Security Analysis

1. 🔵 Symlink-following write enables arbitrary file overwrite when sanitizing bundled extension package.json

Description

Recommendation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aisle-research-bot bot commented Mar 22, 2026 •

edited

Loading