Revert "Check ClawHub trust before plugin installs"#81363
Merged
Conversation
This reverts commit 87eb450.
openclaw-barnacle
Bot
added
docs
Contributor
There was a problem hiding this comment.
Pull request overview
This PR reverts the previously introduced ClawHub exact-release trust/acknowledgement gate during plugin install/update flows (PR #81307), removing the associated CLI flags, plumbing, tests, and documentation references.
Changes:
- Removes ClawHub “risk acknowledgement” API surface (
acknowledgeClawHubRisk/onClawHubRisk) from plugin update/sync/install flows. - Removes
--acknowledge-clawhub-riskfromopenclaw updateandopenclaw plugins install/update, plus related prompting helper code and tests. - Updates ClawHub security endpoint typings/tests and deletes the runtime parsing/validation logic that was added for the trust-gating feature.
Reviewed changes
Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/plugins/update.ts | Stops forwarding ClawHub risk-ack options into ClawHub-based plugin updates/sync. |
| src/plugins/update.test.ts | Removes tests asserting risk-ack option forwarding. |
| src/plugins/clawhub.ts | Removes trust fetch + acknowledgement gate and related error codes/types. |
| src/plugins/clawhub.test.ts | Removes mocks/tests covering trust-gating behaviors and security fetch expectations. |
| src/infra/clawhub.ts | Reworks ClawHubPackageSecurityResponse typing and makes fetchClawHubPackageSecurity a direct typed JSON fetch. |
| src/infra/clawhub.test.ts | Updates tests to match the new security response shape; removes malformed-response rejection test. |
| src/commands/onboarding-plugin-install.ts | Removes onboarding prompt hook for ClawHub risk acknowledgements. |
| src/commands/onboarding-plugin-install.test.ts | Removes assertion that onboarding passes an onClawHubRisk function. |
| src/commands/doctor/shared/missing-configured-plugin-install.ts | Removes capturing/returning ClawHub install warnings from doctor-driven installs. |
| src/cli/update-cli/update-command.ts | Removes post-update plugin workflow risk-ack prompting/forwarding and resume flag carry-over. |
| src/cli/update-cli/shared.ts | Drops acknowledgeClawHubRisk from update command option typing. |
| src/cli/update-cli.ts | Removes the --acknowledge-clawhub-risk option and normalization logic from the update CLI. |
| src/cli/update-cli.test.ts | Removes tests around forwarding/carrying the risk-ack flag. |
| src/cli/plugins-update-command.ts | Stops resolving/forwarding ClawHub risk-ack CLI options to plugin updates. |
| src/cli/plugins-install-command.ts | Stops accepting/forwarding ClawHub risk-ack CLI options to plugin installs. |
| src/cli/plugins-cli.update.test.ts | Removes test verifying --acknowledge-clawhub-risk is forwarded to plugin update. |
| src/cli/plugins-cli.ts | Removes --acknowledge-clawhub-risk from plugins CLI install/update commands. |
| src/cli/plugins-cli.install.test.ts | Removes test verifying --acknowledge-clawhub-risk is forwarded to ClawHub installs. |
| src/cli/clawhub-risk-acknowledgement.ts | Deletes the shared helper that implemented interactive risk acknowledgement prompting. |
| docs/tools/plugin.md | Removes documentation describing the trust check and --acknowledge-clawhub-risk. |
| docs/cli/update.md | Removes --acknowledge-clawhub-risk from update CLI docs. |
| docs/cli/plugins.md | Removes --acknowledge-clawhub-risk sections and examples from plugins CLI docs. |
| CHANGELOG.md | Removes the changelog entry for the reverted trust/ack feature. |
Comment on lines
507
to
544
| @@ -527,9 +526,6 @@ async function installCandidate(params: { | |||
| extensionsDir, | |||
| expectedPluginId: candidate.pluginId, | |||
| mode: "install", | |||
| logger: { | |||
| warn: (message) => warnings.push(message), | |||
| }, | |||
| }); | |||
| if (clawhubResult.ok) { | |||
| const pluginId = clawhubResult.pluginId; | |||
| @@ -544,15 +540,14 @@ async function installCandidate(params: { | |||
| }, | |||
| }, | |||
| changes: [`Installed missing configured plugin "${pluginId}" from ${clawhubInstallSpec}.`], | |||
| warnings, | |||
| warnings: [], | |||
| }; | |||
l3ocifer
pushed a commit
to l3ocifer/frack-openclaw
that referenced
this pull request
May 13, 2026
…penclaw#81363) This reverts commit 87eb450.
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
May 24, 2026
…penclaw#81363) This reverts commit ab2e7a1.
jameslcowan
pushed a commit
to jameslcowan/openclaw
that referenced
this pull request
Jun 2, 2026
…penclaw#81363) This reverts commit c454bf2.
sablehead
pushed a commit
to sablehead/openclaw
that referenced
this pull request
Jun 10, 2026
…penclaw#81363) This reverts commit 98ffb04.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverts #81307 - agent went rogue :/