Greptile Summary

This PR hardens ClawHub plugin publishing and install by fixing scoped package name handling in archive downloads, consolidating temp-file cleanup behind a cleanup() callback, and introducing a canonical @openclaw/plugin-package-contract workspace package for external plugin metadata validation.

• Scoped package fix: downloadClawHubPackageArchive and downloadClawHubSkillArchive now use createTempDownloadTarget, which calls sanitizeTempFileName (via path.basename) instead of safeDirName. Scoped names like @myorg/plugin resolve safely to plugin.zip inside a unique mkdtemp-isolated directory.
• Cleanup consolidation: Both src/plugins/clawhub.ts and src/agents/skills-clawhub.ts replace their two-step fs.rm(file) + fs.rm(dir) finally blocks with a single archive.cleanup() call. Semantically equivalent and centrally tested.
• Contract package: packages/plugin-package-contract exports correct null-safe validation helpers with proper fallback chains (install.minHostVersion → compat.minGatewayVersion, package version → build.openclawVersion).
• temp-path.ts consolidation: Reduced to a re-export barrel of temp-download.ts, removing ~80 lines of duplication.
• Docs regression tests: clawhub-plugin-docs.test.ts locks canonical snippet files against the contract validator and guards against bare clawhub publish references drifting back into plugin docs.

Confidence Score: 5/5

Safe to merge — all changes are well-scoped refactors with matching test coverage and no regressions in the changed paths.

No P0 or P1 issues found. The scoped-package filename fix is correct (path.basename strips the scope, unique mkdtemp dir prevents collisions). Cleanup delegation is semantically equivalent to the previous two-step rm. The contract package logic is null-safe and fully tested. Docs regression tests anchor the snippets to the validator.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix: harden clawhub plugin publishing an..." | Re-trigger Greptile}

🤖 We're reviewing this PR with Aisle

We're running a security check on the changes in this PR now. This usually takes a few minutes. ⌛
We'll post the results here as soon as they're ready.

Progress:

• Analysis
• Finalization

Latest run failed. Keeping previous successful results. Trace ID: 019d3af3668dcb7ba822ad287bcda4b6.

_{Last updated on: 2026-03-30T09:47:26Z}