Check ClawHub trust before plugin installs by jesse-merhi · Pull Request #81307 · openclaw/openclaw

jesse-merhi · 2026-05-13T05:19:28Z

Summary

add an exact-release ClawHub trust lookup before ClawHub plugin install/update downloads
warn and require acknowledgement for risky ClawHub releases, with --acknowledge-clawhub-risk for reviewed automation
carry the acknowledgement path through plugins install, plugins update, openclaw update, onboarding installs, and repair/sync paths while keeping the local dangerous-code scanner intact

Verification

pnpm test src/infra/clawhub.test.ts src/plugins/clawhub.test.ts src/plugins/update.test.ts src/cli/plugins-cli.install.test.ts src/cli/plugins-cli.update.test.ts src/cli/update-cli.test.ts src/commands/onboarding-plugin-install.test.ts src/commands/doctor/shared/missing-configured-plugin-install.test.ts src/auto-reply/reply/commands-plugins.install.test.ts
pnpm test src/cli/plugins-cli.install.test.ts src/cli/plugins-cli.update.test.ts src/cli/update-cli.test.ts
pnpm docs:check-mdx
pnpm tsgo:core:test
node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.core.json src/cli/clawhub-risk-acknowledgement.ts src/cli/plugins-cli.install.test.ts src/cli/plugins-cli.ts src/cli/plugins-cli.update.test.ts src/cli/plugins-install-command.ts src/cli/plugins-update-command.ts src/cli/update-cli.test.ts src/cli/update-cli.ts src/cli/update-cli/shared.ts src/cli/update-cli/update-command.ts src/commands/doctor/shared/missing-configured-plugin-install.ts src/commands/onboarding-plugin-install.test.ts src/commands/onboarding-plugin-install.ts src/infra/clawhub.test.ts src/infra/clawhub.ts src/plugins/clawhub.test.ts src/plugins/clawhub.ts src/plugins/update.test.ts src/plugins/update.ts src/auto-reply/reply/commands-plugins.install.test.ts
git diff --check
pnpm check:changed

Note: attempted the documented Testbox warmup with blacksmith testbox warmup ci-check-testbox.yml --ref main --idle-timeout 90, but GitHub returned 404 for that workflow on main, so the changed gate was run locally.

clawsweeper · 2026-05-13T05:23:03Z

Codex review: needs changes before merge.

Summary
The PR adds exact-release ClawHub trust checks and a --acknowledge-clawhub-risk path across plugin install/update, core update plugin sync, onboarding, doctor repair paths, docs, and tests.

Reproducibility: yes. source inspection gives a high-confidence path: run openclaw update --yes in a TTY with a risky ClawHub trust response during post-update plugin sync, and the new helper still installs an interactive confirmation callback.

Real behavior proof
Not applicable: The author association is MEMBER, so the external contributor real-behavior-proof gate does not apply; live install/update proof would still be useful for maintainer review.

Next step before merge
A repair worker can make the narrow --yes fail-closed change and add focused update-cli coverage; maintainer/security review still gates merge.

Security
Cleared: The current head no longer changes workflows, dependencies, or lockfiles, and I found no concrete supply-chain regression in the diff.

Review findings

[P2] Respect --yes for ClawHub risk prompts — src/cli/update-cli/update-command.ts:184

Review details

Best possible solution:

Land the trust gate after making --yes fail closed unless --acknowledge-clawhub-risk is passed, while preserving current ClawPack routing and focused coverage for the trust response contract.

Do we have a high-confidence way to reproduce the issue?

Yes, source inspection gives a high-confidence path: run openclaw update --yes in a TTY with a risky ClawHub trust response during post-update plugin sync, and the new helper still installs an interactive confirmation callback.

Is this the best way to solve the issue?

No: the trust-gate direction is sound, but the current update prompt handling is not the narrowest maintainable solution because --yes should not prompt and should not silently acknowledge risk.

Full review comments:

[P2] Respect --yes for ClawHub risk prompts — src/cli/update-cli/update-command.ts:184
resolveUpdateClawHubRiskAcknowledgementOptions ignores opts.yes, so openclaw update --yes can still prompt during post-update ClawHub plugin sync whenever stdin is a TTY and the selected release is risky. That violates the documented non-interactive prompt contract and can hang automation running under a pseudo-TTY; without explicit --acknowledge-clawhub-risk, --yes should fail closed instead of prompting.
Confidence: 0.88

Overall correctness: patch is incorrect
Overall confidence: 0.88

Acceptance criteria:

pnpm test src/cli/update-cli.test.ts src/plugins/update.test.ts src/cli/plugins-cli.update.test.ts
pnpm tsgo:core:test
node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.core.json src/cli/update-cli.test.ts src/cli/update-cli/update-command.ts src/plugins/update.ts src/cli/plugins-cli.update.test.ts
git diff --check

What I checked:

Current PR scope: The current PR head is fe62a57 and the file list is limited to docs, changelog, CLI/plugin/update/ClawHub source, and tests; the current file list no longer includes workflows, package.json, pnpm-lock.yaml, or security/opengrep files from the earlier review. (fe62a577a5c6)
Trust gate before download: The PR calls ensureClawHubPackageTrustAcknowledged before downloading the ClawHub archive, so the central security gate is placed before package bytes are fetched. (src/plugins/clawhub.ts:1256, fe62a577a5c6)
ClawPack routing preserved: The current PR head preserves the current-main artifact selector by passing artifact: expectedClawPackSha256 ? "clawpack" : "archive" to the downloader. (src/plugins/clawhub.ts:1275, fe62a577a5c6)
ClawHub API contract spot-check: A live exact-version ClawHub security endpoint returned the new trust object shape with scanStatus, moderationState, blockedFromDownload, reasons, pending, and stale, matching the PR parser shape.
Introduced prompt bug: resolveUpdateClawHubRiskAcknowledgementOptions returns an interactive onClawHubRisk callback whenever stdin is a TTY and JSON mode is off, but it does not check opts.yes. (src/cli/update-cli/update-command.ts:184, fe62a577a5c6)
Documented --yes contract: The PR docs still describe --yes as skipping confirmation prompts, while the new ClawHub risk helper can prompt during openclaw update --yes in a TTY. Public docs: docs/cli/update.md. (docs/cli/update.md:47, fe62a577a5c6)

Likely related people:

Peter Steinberger: Current-main blame and log history for the central ClawHub install/download files point to recent work by Peter on src/plugins/clawhub.ts, src/infra/clawhub.ts, src/plugins/update.ts, and src/cli/plugins-cli.ts. (role: recent area contributor; confidence: high; commits: 277ad4a71b20, 0b9438293051, 5dc50b8a3f80; files: src/plugins/clawhub.ts, src/infra/clawhub.ts, src/plugins/update.ts)
Vincent Koc: Recent plugin update/integrity-drift work touched the same update path that carries ClawHub acknowledgement through plugin updates. (role: adjacent owner; confidence: medium; commits: 428d1761b43e, cf311978ea61; files: src/plugins/update.ts)
Tak Hoffman: Recent bundled/plugin fallback work is adjacent to the ClawHub channel sync and update fallback behavior this PR modifies. (role: adjacent owner; confidence: medium; commits: 74624e619d41; files: src/plugins/update.ts)

Remaining risk / open question:

I did not run the PR tests locally because this sweep is read-only; the GitHub check-run snapshot is supplemental rather than a local proof.
This is a security-sensitive install/update policy change, so maintainer/security review should still validate the warning and acknowledgement UX before merge.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 4a6e46152a55.

Copilot

Pull request overview

This PR adds a ClawHub “exact release trust” gate ahead of ClawHub-backed plugin installs/updates, requiring explicit acknowledgement when ClawHub marks a release as risky, and wiring that acknowledgement through the CLI and update flows. It also introduces OpenGrep/Semgrep ignore configuration and (separately) makes substantial GitHub Actions workflow changes.

Changes:

Add fetchClawHubPackageSecurity + install-time trust enforcement with risk warnings and acknowledgement (--acknowledge-clawhub-risk / interactive prompt).
Thread risk-ack options through plugins install, plugins update, and updateNpmInstalledPlugins, with tests and docs updates.
Add .semgrepignore and a new opengrep-precise workflow; remove many existing GitHub Actions workflows.

Reviewed changes

Copilot reviewed 51 out of 53 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/plugins/clawhub.ts	Enforces exact-release ClawHub trust checks before download; adds risk acknowledgement flow + new error codes.
src/infra/clawhub.ts	Adds `ClawHubPackageSecurity` parsing + `fetchClawHubPackageSecurity()` API client.
src/plugins/update.ts	Forwards ClawHub risk acknowledgement options through dry-run and live update paths.
src/plugins/update.test.ts	Adds coverage to ensure ClawHub risk acknowledgement options are forwarded.
src/plugins/clawhub.test.ts	Adds tests for trust fetch, risky-release acknowledgement behavior, and security-unavailable failure.
src/cli/clawhub-risk-acknowledgement.ts	New helper to provide interactive prompt callback unless `--acknowledge-clawhub-risk` or non-TTY.
src/cli/plugins-install-command.ts	Wires CLI risk acknowledgement options into ClawHub install paths.
src/cli/plugins-update-command.ts	Wires CLI risk acknowledgement options into plugin update path.
src/cli/plugins-cli.ts	Adds `--acknowledge-clawhub-risk` flag and maps Commander option casing into downstream API shape.
src/cli/plugins-cli.install.test.ts	Ensures CLI install forwards `--acknowledge-clawhub-risk` to ClawHub installs.
src/cli/plugins-cli.update.test.ts	Ensures CLI update forwards `--acknowledge-clawhub-risk` to plugin updates.
docs/tools/plugin.md	Documents ClawHub trust gating and the acknowledgement flag.
docs/tools/clawhub.md	Documents trust checks + acknowledgement requirement for non-interactive automation.
docs/cli/plugins.md	Documents trust checks for install/update and `--acknowledge-clawhub-risk`.
CHANGELOG.md	Adds changelog entry for the new ClawHub trust gate and acknowledgement flag.
.semgrepignore	Adds centralized ignore globs for semgrep/opengrep scans (tests/fixtures/QA tooling).
.github/workflows/opengrep-precise.yml	Adds OpenGrep “precise” workflow that uploads SARIF.
package.json	Bumps pinned `@anthropic-ai/sdk` override.
pnpm-lock.yaml	Lockfile updates for `@anthropic-ai/sdk` and related transitive changes.
extensions/amazon-bedrock-mantle/package.json	Bumps `@anthropic-ai/sdk` dependency version.
.github/workflows/workflow-sanity.yml	Removed workflow.
.github/workflows/test-performance-agent.yml	Removed workflow.
.github/workflows/stale.yml	Removed workflow.
.github/workflows/sandbox-common-smoke.yml	Removed workflow.
.github/workflows/qa-live-transports-convex.yml	Removed workflow.
.github/workflows/plugin-npm-release.yml	Removed workflow.
.github/workflows/plugin-clawhub-release.yml	Removed workflow.
.github/workflows/parity-gate.yml	Removed workflow.
.github/workflows/package-acceptance.yml	Removed workflow.
.github/workflows/openclaw-scheduled-live-checks.yml	Removed workflow.
.github/workflows/openclaw-npm-release.yml	Removed workflow.
.github/workflows/openclaw-cross-os-release-checks-reusable.yml	Removed workflow.
.github/workflows/npm-telegram-beta-e2e.yml	Removed workflow.
.github/workflows/macos-release.yml	Removed workflow.
.github/workflows/install-smoke.yml	Removed workflow.
.github/workflows/full-release-validation.yml	Removed workflow.
.github/workflows/duplicate-after-merge.yml	Removed workflow.
.github/workflows/docs.yml	Removed workflow.
.github/workflows/docs-translate-trigger-release.yml	Removed workflow.
.github/workflows/docs-sync-publish.yml	Removed workflow.
.github/workflows/docs-agent.yml	Removed workflow.
.github/workflows/docker-release.yml	Removed workflow.
.github/workflows/control-ui-locale-refresh.yml	Removed workflow.
.github/workflows/codeql.yml	Removed workflow.
.github/workflows/ci-check-testbox.yml	Removed workflow.
.github/workflows/ci-build-artifacts-testbox.yml	Removed workflow.
.github/workflows/auto-response.yml	Removed workflow.
.github/dependabot.yml	Removed Dependabot config.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

+name: OpenGrep — Precise
+
+# Private fork test runner for the high-precision OpenGrep rulepack.
+# Runs on demand and whenever this workflow or security/opengrep/precise.yml changes.
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/workflows/opengrep-precise.yml
+      - security/opengrep/precise.yml
+


 export type PluginUpdateOptions = {
  all?: boolean;
+  acknowledgeClawHubRisk?: boolean;
+  acknowledgeClawhubRisk?: boolean;
  dryRun?: boolean;
  dangerouslyForceUnsafeInstall?: boolean;
 };


  "packageManager": "[email protected]",
  "pnpm": {
    "overrides": {
-      "@anthropic-ai/sdk": "0.91.0",
+      "@anthropic-ai/sdk": "0.91.1",
      "hono": "4.12.14",
      "@hono/node-server": "1.19.14",
      "axios": "1.15.0",


jesse-merhi · 2026-05-13T06:31:59Z

Merged via squash.

Prepared head SHA: 273fd7c20e4fe9fb704c6013139b5b59061439a2
Merge commit: 87eb450047a98e281da55d2555df81dd87ee7f55

Thanks @jesse-merhi!

This reverts commit 87eb450.

@jesse-merhi

Merged via squash. Prepared head SHA: 273fd7c Co-authored-by: jesse-merhi <[email protected]> Co-authored-by: jesse-merhi <[email protected]> Reviewed-by: @jesse-merhi

…penclaw#81363) This reverts commit 87eb450.

@jesse-merhi

Merged via squash. Prepared head SHA: 273fd7c Co-authored-by: jesse-merhi <[email protected]> Co-authored-by: jesse-merhi <[email protected]> Reviewed-by: @jesse-merhi

…penclaw#81363) This reverts commit ab2e7a1.

@jesse-merhi

Merged via squash. Prepared head SHA: 273fd7c Co-authored-by: jesse-merhi <[email protected]> Co-authored-by: jesse-merhi <[email protected]> Reviewed-by: @jesse-merhi

…penclaw#81363) This reverts commit c454bf2.

@jesse-merhi

Merged via squash. Prepared head SHA: 273fd7c Co-authored-by: jesse-merhi <[email protected]> Co-authored-by: jesse-merhi <[email protected]> Reviewed-by: @jesse-merhi

…penclaw#81363) This reverts commit 98ffb04.

Copilot AI review requested due to automatic review settings May 13, 2026 05:19

jesse-merhi requested review from a team as code owners May 13, 2026 05:19

openclaw-barnacle Bot added docs Improvements or additions to documentation cli CLI command changes security Security documentation size: XL maintainer Maintainer-authored PR labels May 13, 2026

Copilot started reviewing on behalf of jesse-merhi May 13, 2026 05:20 View session

Copilot AI reviewed May 13, 2026

View reviewed changes

jesse-merhi force-pushed the jesse/clawhub-install-trust branch from cfe678a to 86c2861 Compare May 13, 2026 05:40

openclaw-barnacle Bot added commands Command implementations size: L and removed security Security documentation size: XL labels May 13, 2026

jesse-merhi force-pushed the jesse/clawhub-install-trust branch 3 times, most recently from f7c8b6e to 2ba4a46 Compare May 13, 2026 06:22

jesse-merhi added 3 commits May 13, 2026 16:30

feat: check ClawHub trust before plugin installs

236af95

docs: tag plugin trust changelog entry

fe90534

docs: move plugin trust changelog entry

273fd7c

jesse-merhi force-pushed the jesse/clawhub-install-trust branch from 2ba4a46 to 273fd7c Compare May 13, 2026 06:30

jesse-merhi merged commit 87eb450 into main May 13, 2026
104 checks passed

jesse-merhi deleted the jesse/clawhub-install-trust branch May 13, 2026 06:31

github-actions Bot mentioned this pull request May 13, 2026

📡 Upstream Digest — 2026-05-13 06:42 UTC curtismercier/openclaw-mods#844

Open

jesse-merhi restored the jesse/clawhub-install-trust branch May 13, 2026 09:33

jesse-merhi mentioned this pull request May 13, 2026

Revert "Check ClawHub trust before plugin installs" #81363

Merged

jesse-merhi added a commit that referenced this pull request May 13, 2026

Revert "Check ClawHub trust before plugin installs (#81307)" (#81363)

6c92324

This reverts commit 87eb450.

jesse-merhi mentioned this pull request May 13, 2026

Check ClawHub trust before plugin and skill installs #81364

Merged

github-actions Bot mentioned this pull request May 13, 2026

📡 Upstream Digest — 2026-05-13 10:14 UTC curtismercier/openclaw-mods#845

Open

l3ocifer pushed a commit to l3ocifer/frack-openclaw that referenced this pull request May 13, 2026

Revert "Check ClawHub trust before plugin installs (openclaw#81307)" (o…

4c8bd43

…penclaw#81363) This reverts commit 87eb450.

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026

Revert "Check ClawHub trust before plugin installs (openclaw#81307)" (o…

0ff4859

…penclaw#81363) This reverts commit ab2e7a1.

jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026

Revert "Check ClawHub trust before plugin installs (openclaw#81307)" (o…

67341c9

…penclaw#81363) This reverts commit c454bf2.

sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026

Revert "Check ClawHub trust before plugin installs (openclaw#81307)" (o…

37176d6

…penclaw#81363) This reverts commit 98ffb04.

steipete deleted the jesse/clawhub-install-trust branch July 15, 2026 03:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Check ClawHub trust before plugin installs#81307

Check ClawHub trust before plugin installs#81307
jesse-merhi merged 3 commits into
mainfrom
jesse/clawhub-install-trust

jesse-merhi commented May 13, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 13, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

jesse-merhi commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

jesse-merhi commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Uh oh!

clawsweeper Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

jesse-merhi commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jesse-merhi commented May 13, 2026 •

edited

Loading

clawsweeper Bot commented May 13, 2026 •

edited

Loading