fix(plugins): preserve bundled capability manifest contracts by yfge · Pull Request #81312 · openclaw/openclaw

yfge · 2026-05-13T05:54:45Z

Background

bundled capability runtime rebuilt plugin records without carrying manifest.contracts forward
that drops contracts.tools (and other declared contract metadata) for bundled capability plugins like Feishu/Lark
downstream contract-based tooling sees the plugin as if it declared no tool contracts

Changes

pass manifest.contracts into createCapabilityPluginRecord(...)
persist the contracts on the synthesized bundled capability plugin record
initialize contract-backed provider id lists from the manifest data, matching normal plugin record creation
add a regression test that verifies bundled capability runtime keeps manifest contracts for memory-core

Verification

pnpm test src/plugins/bundled-capability-runtime.test.ts
pnpm exec oxfmt --check --threads=1 src/plugins/bundled-capability-runtime.ts src/plugins/bundled-capability-runtime.test.ts
node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.core.json src/plugins/bundled-capability-runtime.ts src/plugins/bundled-capability-runtime.test.ts
pnpm build

Impact

restores bundled capability manifest contract metadata for Feishu/Lark and other bundled capability plugins
keeps contract-driven tool/provider resolution aligned with the main plugin loader path

Fixes #77982

Real behavior proof

Behavior or issue addressed: bundled capability runtime preserves manifest.contracts on synthesized bundled capability plugin records instead of dropping them during registry loading.
Real environment tested: local OpenClaw source checkout on macOS with the real bundled-capability runtime loader path, using the PR branch code against the repository's actual plugin manifests.
Exact steps or command run after this patch: ran the focused runtime/registry proof on the PR branch by loading the bundled capability registry and printing the synthesized memory-core / feishu records after runtime initialization.
Evidence after fix:

$ ./node_modules/.bin/vitest run src/plugins/bundled-capability-runtime.test.ts
✓ unit-fast ../../src/plugins/bundled-capability-runtime.test.ts (2 tests)
  ✓ preserves manifest contracts for bundled capability plugins

Test Files  1 passed (1)
Tests       2 passed (2)

$ pnpm exec tsx -e 'loadBundledCapabilityRuntimeRegistry(...)'
{
  "memoryCore": {
    "contracts": {
      "memoryEmbeddingProviders": ["local"],
      "tools": ["memory_get", "memory_search"]
    },
    "memoryEmbeddingProviderIds": ["local", "local"]
  },
  "feishu": {
    "contracts": {
      "tools": [
        "feishu_app_scopes",
        "feishu_bitable_create_app",
        "feishu_bitable_create_field",
        "feishu_bitable_create_record",
        "feishu_bitable_get_meta",
        "feishu_bitable_get_record",
        "feishu_bitable_list_fields",
        "feishu_bitable_list_records",
        "feishu_bitable_update_record",
        "feishu_chat",
        "feishu_doc",
        "feishu_drive",
        "feishu_perm",
        "feishu_wiki"
      ]
    },
    "toolNames": []
  }
}

Observed result after fix: the synthesized bundled capability records keep manifest.contracts for both memory-core and feishu after registry loading, which is the runtime behavior this bug was dropping before the patch.
What was not tested: no live Feishu/Lark message send flow; this proof covers the real bundled-capability runtime load path and emitted runtime records rather than downstream API traffic.

clawsweeper · 2026-05-13T05:58:25Z

Codex review: needs maintainer review before merge. Reviewed July 3, 2026, 11:48 PM ET / 03:48 UTC.

Summary
The PR preserves manifest contracts on synthesized bundled capability plugin records, seeds/deduplicates contract-backed provider id lists, and adds regression coverage for bundled capability loading.

PR surface: Source +51, Tests +20. Total +71 across 3 files.

Reproducibility: yes. source-level: current main creates bundled capability PluginRecords without contracts and then validates captured tools against record.contracts, while affected bundled manifests declare contracts.tools.

Review metrics: 1 noteworthy metric.

Bundled record contract hydration: 1 contracts field preserved; 13 provider-id arrays seeded/deduped. This quantifies the compatibility-sensitive runtime record surface that changes before bundled plugins register captured capabilities.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #77982
Summary: This PR is the active focused candidate fix for the canonical bundled capability manifest-contract propagation bug; the earlier attempt is closed unmerged and the broader maintainer PR overlaps but is draft/conflicting.

Members:

canonical: [BUG] openclaw-lark plugin: contracts.tools not propagated through createCapabilityPluginRecord #77982 - The issue reports the same bundled capability contracts.tools propagation failure and this PR uses closing syntax for it.
superseded: Fix bundled capability contract propagation #78012 - The earlier PR targeted the same contract propagation fix but is closed unmerged after being superseded by this active focused PR.
partial_overlap: fix(plugins): isolate bundled capability capture fields #90068 - The broader hardening PR also carries manifest contracts into bundled records, but it is draft and conflicting, so it is not a safe replacement target yet.
adjacent_distinct: [Bug]: feishu_wiki tools silently redirected to empty exec() in main session, works in sub-agent #95011 - The closed Feishu wiki report concerns Feishu tool availability symptoms on an older version, but available context does not prove the exact same bundled manifest-contract failure.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Refresh or explain the failed checks-node-core-tooling check.
Choose sequencing with the overlapping broader hardening PR.

Risk before merge

[P1] Merging intentionally changes bundled PluginRecord contract and provider-id projection semantics consumed by plugin discovery and tool/provider registration.
[P1] The current PR head still has a failed checks-node-core-tooling check, so merge needs a green rerun or a clear unrelated-failure confirmation.
[P1] The broader hardening PR overlaps the same bundled manifest-contract propagation but is draft and conflicting, so maintainers should choose sequencing rather than accidentally split or duplicate the fix.

Maintainer options:

Refresh checks, then land focused fix (recommended)
Rerun or clear the failed current-head tooling check, accept the bundled PluginRecord parity change, and land this focused fix before rebasing broader hardening.
Fold into broader hardening only deliberately
Pause or close this PR only if maintainers make fix(plugins): isolate bundled capability capture fields #90068 canonical and preserve this PR's contract propagation plus regression coverage there.

Next step before merge

[P2] Manual review remains because the patch is code-correct but needs maintainer compatibility acceptance, current-head check refresh, and sequencing with the overlapping draft PR.

Security
Cleared: No concrete security or supply-chain regression was found; the diff changes in-memory plugin runtime record projection and tests without new dependencies, workflows, secrets, downloads, or package resolution.

Review details

Best possible solution:

Land this focused manifest-contract propagation after maintainer compatibility acceptance and green or explained current-head checks, or explicitly fold the same fix and regression coverage into the broader hardening PR before closing this PR.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level: current main creates bundled capability PluginRecords without contracts and then validates captured tools against record.contracts, while affected bundled manifests declare contracts.tools.

Is this the best way to solve the issue?

Yes, with a sequencing caveat: preserving manifest.contracts on the synthesized bundled PluginRecord is the narrow manifest-first fix and aligns the bundled runtime with the normal loader record path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9d68f877ac3e.

Label changes

Label justifications:

P1: The PR fixes a high-impact bundled plugin tool-registration failure that can block manifest-declared Feishu/Lark-style tools.
merge-risk: 🚨 compatibility: The diff changes bundled PluginRecord contract and provider-id projection semantics consumed by plugin discovery and tool/provider registration.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix bundled registry live output for memory-core and Feishu plus focused test output, directly exercising the runtime-record behavior changed by this patch.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix bundled registry live output for memory-core and Feishu plus focused test output, directly exercising the runtime-record behavior changed by this patch.

Evidence reviewed

PR surface:

Source +51, Tests +20. Total +71 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	89	38	+51
Tests	2	21	1	+20
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	110	39	+71

What I checked:

Root policy read: Root AGENTS.md was read fully; its plugin compatibility, manifest-first, and whole-surface review guidance affected this review. (AGENTS.md:1, 9d68f877ac3e)
Scoped plugin policy read: The scoped plugin guide requires manifest-first behavior and loader alignment with manifest contracts, which directly applies to this bundled runtime change. (src/plugins/AGENTS.md:1, 9d68f877ac3e)
Current main omits bundled contracts: Current main creates bundled capability PluginRecords without a contracts parameter or contracts field. (src/plugins/bundled-capability-runtime.ts:133, 9d68f877ac3e)
Current main validates against missing contracts: The bundled runtime validates captured tools against record.contracts, so omitted manifest contracts make declared tools look undeclared. (src/plugins/bundled-capability-runtime.ts:511, 9d68f877ac3e)
Normal loader preserves contracts: The normal plugin record path accepts PluginManifestContracts, seeds contract-backed provider id fields, and stores contracts on PluginRecord. (src/plugins/loader-records.ts:32, 9d68f877ac3e)
Affected Feishu manifest declares tools: The bundled Feishu/Lark manifest declares contracts.tools including feishu_chat, feishu_doc, feishu_drive, and feishu_wiki. (extensions/feishu/openclaw.plugin.json:9, 9d68f877ac3e)

Likely related people:

steipete: Prior commits derive bundled contracts from extension manifests and stabilize bundled capability contract loading, which is the same manifest-first runtime surface. (role: feature-history contributor; confidence: high; commits: ba7804df50d4, 71a3ad153ad1; files: src/plugins/bundled-capability-runtime.ts)
shakkernerd: Commit 7641783 added contracts.tools enforcement in the bundled runtime and normal registry, making missing bundled record contracts user-visible. (role: introduced related contract enforcement; confidence: high; commits: 7641783d6b0e; files: src/plugins/bundled-capability-runtime.ts, src/plugins/registry.ts, src/plugins/tool-contracts.ts)
dutifulbob: Commit ae4806e touched loader-record contract projection while adding embedding provider contracts, adjacent to the provider-id parity this PR changes. (role: adjacent contract surface contributor; confidence: medium; commits: ae4806ed9adf; files: src/plugins/loader-records.ts, src/plugins/loader-records.test.ts, src/plugins/bundled-capability-runtime.ts)
doodlewind: Commit 2267d58 replaced the Feishu/Lark plugin surface whose manifest-declared tools are affected by the bundled contract propagation bug. (role: affected plugin feature-history contributor; confidence: medium; commits: 2267d58afcc7; files: extensions/feishu/openclaw.plugin.json, extensions/feishu/index.ts, extensions/feishu/src)
vincentkoc: The open broader hardening PR also carries manifest contracts into bundled records, making this person relevant for sequencing this focused fix with adjacent work. (role: overlapping broader fix owner; confidence: medium; commits: 81be743a5eef; files: src/plugins/bundled-capability-runtime.ts, src/plugins/bundled-capability-runtime.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper · 2026-05-13T06:26:15Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/25848305082
Updated: 2026-05-14T07:47:52.307Z

clawsweeper · 2026-05-15T02:23:02Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26801661466
Updated: 2026-06-02T06:08:10.950Z

openclaw-barnacle · 2026-06-02T05:07:18Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

clawsweeper · 2026-06-15T05:31:50Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27526116963
Updated: 2026-06-15T05:41:11.658Z

Fixes openclaw#77982

openclaw-barnacle · 2026-07-19T04:30:32Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

clawsweeper · 2026-07-19T15:47:25Z

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(plugins): preserve bundled capability manifest contracts This is item 1/1 in the current shard. Shard 16/20.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

openclaw-barnacle Bot added size: XS triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 13, 2026

This comment was marked as spam.

Sign in to view

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 13, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 14, 2026

This was referenced May 14, 2026

[BUG] openclaw-lark plugin: contracts.tools not propagated through createCapabilityPluginRecord #77982

Open

Fix bundled capability contract propagation #78012

Closed

openclaw-barnacle Bot added size: S and removed size: XS labels May 15, 2026

This comment was marked as spam.

Sign in to view

openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Jun 2, 2026

openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Jun 15, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 15, 2026

vincentkoc force-pushed the fix/issue-77982 branch from 5da98c7 to 2585661 Compare June 16, 2026 21:36

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 16, 2026

clawsweeper Bot removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 16, 2026

yfge added 2 commits June 17, 2026 16:41

fix: preserve bundled capability manifest contracts

1a0af8a

Fixes openclaw#77982

test: refresh bundled capability contract assertion

f97f9d2

vincentkoc force-pushed the fix/issue-77982 branch from 2585661 to f97f9d2 Compare June 17, 2026 16:47

This was referenced Jun 19, 2026

fix(plugins): isolate bundled capability capture fields #90068

Closed

[Bug]: feishu_wiki tools silently redirected to empty exec() in main session, works in sub-agent #95011

Closed

openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Jul 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(plugins): preserve bundled capability manifest contracts#81312

fix(plugins): preserve bundled capability manifest contracts#81312
yfge wants to merge 2 commits into
openclaw:mainfrom
yfge:fix/issue-77982

yfge commented May 13, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 13, 2026 •

edited

Loading

Uh oh!

This comment was marked as spam.

clawsweeper Bot commented May 13, 2026 •

edited

Loading

Uh oh!

This comment was marked as spam.

This comment was marked as spam.

clawsweeper Bot commented May 15, 2026 •

edited

Loading

Uh oh!

openclaw-barnacle Bot commented Jun 2, 2026

Uh oh!

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

openclaw-barnacle Bot commented Jul 19, 2026

Uh oh!

clawsweeper Bot commented Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

yfge commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Background

Changes

Verification

Impact

Real behavior proof

Uh oh!

clawsweeper Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as spam.

clawsweeper Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as spam.

This comment was marked as spam.

clawsweeper Bot commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openclaw-barnacle Bot commented Jun 2, 2026

Uh oh!

clawsweeper Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openclaw-barnacle Bot commented Jul 19, 2026

Uh oh!

clawsweeper Bot commented Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

yfge commented May 13, 2026 •

edited

Loading

clawsweeper Bot commented May 13, 2026 •

edited

Loading

clawsweeper Bot commented May 13, 2026 •

edited

Loading

clawsweeper Bot commented May 15, 2026 •

edited

Loading

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading