Skip to content

Check ClawHub trust before plugin and skill installs#81364

Merged
jesse-merhi merged 1 commit into
mainfrom
jesse/clawhub-install-trust-remake
Jun 26, 2026
Merged

Check ClawHub trust before plugin and skill installs#81364
jesse-merhi merged 1 commit into
mainfrom
jesse/clawhub-install-trust-remake

Conversation

@jesse-merhi

@jesse-merhi jesse-merhi commented May 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

OpenClaw now checks ClawHub trust before installing or updating community plugins and skills, and blocks malicious or ClawHub-blocked releases before download. Suspicious community releases require explicit acknowledgement.

Official ClawHub publishers and bundled OpenClaw sources bypass ClawHub risk prompts and built-in install friction. That covers official ClawHub plugins, ClawHub skills whose publisher metadata includes owner.official: true (the NVIDIA fixture proves this path), and bundled OpenClaw plugins/skills such as openclaw/kitchen-sink and peekaboo. Operator-owned security.installPolicy still runs for these sources so local admin allow/block policy is preserved.

What Changed

Surface Changed behavior
Community ClawHub plugins Install/update reads ClawHub security and moderation state before download. Malicious or quarantined releases block; suspicious releases require acknowledgement.
Community ClawHub skills The same gate applies to archive-backed skill install/update, including owner-qualified refs.
Official ClawHub plugins channel: "official" / isOfficial: true sources install/update without ClawHub risk prompts, dependency-denylist scans, or before-install hooks. Operator security.installPolicy still runs.
Official ClawHub skill publishers owner.official: true, owner.channel: "official", owner.isOfficial: true, skill.channel: "official", or skill.isOfficial: true marks the default ClawHub skill source as official. The gateway skills.detail schema now preserves those fields for clients.
Bundled OpenClaw plugin/skill sources First-party bundled sources bypass trust prompts, dependency-denylist scans, and before-install hooks. Operator security.installPolicy still runs.
Chat/control flows Gateway protocol carries structured ClawHub trust errors so chat/control surfaces can distinguish blocked/suspicious installs from generic failures.
Docs Plugin, skill, update, and ClawHub CLI docs describe the community trust gate, acknowledgement flag, and official/bundled bypass.

Behavior Matrix

Source / release state Install Update Operator policy / built-in friction
Community malicious or quarantined plugin/skill Blocks before download. Blocks the latest release before replacing the installed version. ClawHub block wins before local install surfaces.
Community suspicious plugin/skill Requires interactive acknowledgement or --acknowledge-clawhub-risk. Same acknowledgement gate before update. Operator policy and built-in install checks run after acknowledgement.
Community clean plugin/skill Installs normally. Updates normally. Operator policy and built-in install checks run normally.
Official ClawHub plugin Installs without trust prompt. Updates without trust prompt. Operator security.installPolicy still runs; dependency-denylist and before-install hook friction is bypassed.
Official ClawHub skill publisher Installs without trust prompt when official publisher metadata is present. Updates without trust prompt when official publisher metadata is present. Operator security.installPolicy still runs; dependency-denylist and before-install hook friction is bypassed.
Bundled OpenClaw plugin/skill Uses first-party source path. Managed by bundled/product source path. Operator security.installPolicy still runs; dependency-denylist and before-install hook friction is bypassed.

Proof

Behavioral proof at PR head 491b6d1d525fdad51f5d2d5d1eb52c64fbf8825c:

  • Community malicious plugin and skill fixtures return blocked ClawHub trust metadata; install exits non-zero before archive download, and update refuses to replace the installed version.
  • Community suspicious plugin and skill fixtures require acknowledgement; without acknowledgement the command exits non-zero, and with --acknowledge-clawhub-risk the same release installs or updates.
  • Official ClawHub plugin fixtures use channel: "official" / isOfficial: true; install succeeds with no ClawHub warning, while operator policy remains callable and built-in denylist/hook friction is skipped.
  • Official ClawHub skill fixture uses NVIDIA-shaped metadata: owner: { handle: "nvidia", displayName: "NVIDIA", official: true } for tao-setup-nvidia-gpu-host; the test asserts ClawHub security verdicts are not fetched and the install source is recorded as { kind: "clawhub", authority: "official", mutable: false, network: true }.
  • The same official-skill logic is publisher-metadata based, not handle-hardcoded, so Peter Steinberger and OpenClaw skill publishers use the same path once ClawHub returns the official publisher field.
  • Bundled openclaw/kitchen-sink plugin and bundled peekaboo skill fixtures assert operator install policy is still called once, while dependency-denylist and before-install hook surfaces are not called.
  • SkillsDetailResultSchema now accepts the official skill/publisher metadata fields, so schema-validating gateway clients can receive the same trust signal that the install/update path consumes.
  • Owner-qualified skill trust fallback treats /verify Skill Card-only failures such as card.missing as non-security metadata when the security status is clean, so clean owner-qualified skills do not require risk acknowledgement only because a generated Skill Card is missing.
  • Owner-qualified skill trust fallback preserves missing exact-release versions unless the clean card.missing compatibility path is accepted, so --acknowledge-clawhub-risk cannot turn a missing exact-release verdict into an install.
  • Official and bundled bypasses preserve operator security.installPolicy while bypassing only ClawHub risk prompts and built-in dependency/hook friction.

Production ClawHub rollout note:

  • Live production skill detail responses sampled earlier identified Peter/NVIDIA owners but did not yet expose owner.official. This OpenClaw PR consumes and preserves the field; ClawHub must expose it on skill detail/search responses for live official skill publishers to bypass friction in production.

Screenshots

These GitHub-hosted terminal screenshots are visual proof for the CLI prompt and block/acknowledgement states. The local proof generator was rerun at current PR head and regenerated the same 16-scenario transcript set; the images below remain the reviewer-visible screenshots for those states.

Screenshot group Claim proved Crop choice
Plugin installs Malicious blocks, suspicious acknowledgement gate, clean community install, and official/source-linked plugin install. Element crop of terminal panel.
Skill installs Same trust gate for archive-backed skills, including owner-qualified labels and official/source-linked skill metadata. Element crop of terminal panel.
Plugin updates Malicious latest release blocks download, suspicious latest release requires acknowledgement, and installed plugin remains unchanged when blocked. Element crop of terminal panel.
Skill updates Same malicious/suspicious update behavior for archive-backed skills. Element crop of terminal panel.
Plugin install screenshots

Plugin malicious release blocked before download

plugin-malicious

Plugin suspicious release blocked without acknowledgement

plugin-suspicious-no-ack

Plugin suspicious release succeeds with acknowledgement

plugin-suspicious-ack

Plugin community clean install succeeds

plugin-community-clean

Plugin official/source-linked clean install succeeds

plugin-official-clean
Skill install screenshots

Skill malicious release blocked before download

skill-malicious

Skill suspicious release blocked without acknowledgement

skill-suspicious-no-ack

Skill suspicious release succeeds with acknowledgement

skill-suspicious-ack

Skill community clean install succeeds

skill-community-clean

Skill official/source-linked clean install succeeds

skill-official-clean
Plugin update screenshots

Plugin update blocks malicious latest release

plugin-update-malicious

Plugin update blocks suspicious latest release without acknowledgement

plugin-update-suspicious-no-ack

Plugin update allows suspicious latest release with acknowledgement

plugin-update-suspicious-ack
Skill update screenshots

Skill update blocks malicious latest release

skill-update-malicious

Skill update blocks suspicious latest release without acknowledgement

skill-update-suspicious-no-ack

Skill update allows suspicious latest release with acknowledgement

skill-update-suspicious-ack

Verification

Reviewer-checkable behavior:

  • The local proof generator passed at the latest PR head and regenerated the 16-scenario plugin/skill trust command transcript.
  • GitHub attachment upload previously produced the 16 PR-visible user-attachments screenshots through the normal PR comment attachment UI. The local transcript/screenshot generator was rerun at the current head; the visible terminal states remain the same for the screenshot-covered scenarios.

Latest-head automated checks:

  • node .artifacts/clawhub-install-trust/run-proof.cjs passed at PR head 491b6d1d525fdad51f5d2d5d1eb52c64fbf8825c and regenerated the 16-scenario plugin/skill trust command transcript.
  • node scripts/run-vitest.mjs src/plugins/install-security-scan.runtime.test.ts src/plugins/clawhub.test.ts src/skills/lifecycle/clawhub.test.ts packages/gateway-protocol/src/schema/agents-models-skills.test.ts passed: 170 tests across 2 shards. This is the final official/bundled bypass proof for bundled OpenClaw plugin/skill sources, official ClawHub plugins, NVIDIA-shaped official ClawHub skill publishers, and the gateway metadata schema.
  • node scripts/run-vitest.mjs src/cli/update-cli.test.ts src/cli/clawhub-risk-acknowledgement.test.ts src/cli/skills-cli.commands.test.ts src/cli/plugins-cli.install.test.ts src/cli/plugins-cli.update.test.ts src/commands/onboarding-plugin-install.test.ts passed after conflict resolution: 446 tests across 2 shards.
  • node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo passed.
  • node scripts/run-oxlint-shards.mjs --threads=8 passed after the channel response type cleanup.
  • git diff --check HEAD passed.
  • The proof-pack net-diff script passed at PR head 491b6d1d525fdad51f5d2d5d1eb52c64fbf8825c; current base is origin/main 81e53202f25f.

Earlier broader proof on this PR branch (before the rebase replay; latest-head focused proof above covers the conflict-touched and official/bundled install-bypass surfaces):

  • node scripts/run-vitest.mjs src/plugins/install-security-scan.runtime.test.ts passed: 6 tests.
  • node scripts/run-vitest.mjs packages/gateway-protocol/src/schema/agents-models-skills.test.ts src/gateway/server-methods/skills.search-detail.test.ts src/gateway/server-methods/skills.clawhub.test.ts src/cli/plugins-cli.install.test.ts src/plugins/install-security-scan.runtime.test.ts src/plugins/clawhub.test.ts src/skills/lifecycle/clawhub.test.ts ui/src/ui/controllers/skills.test.ts ui/src/ui/views/skills.test.ts passed: 373 tests across 5 shards.
  • node scripts/run-vitest.mjs src/cli/clawhub-risk-acknowledgement.test.ts src/cli/plugins-cli.update.test.ts src/cli/skills-cli.commands.test.ts src/cli/update-cli.test.ts src/commands/doctor/shared/missing-configured-plugin-install.test.ts src/commands/onboarding-plugin-install.test.ts src/plugins/update.test.ts src/cli/update-cli/post-core-plugin-convergence.test.ts src/commands/codex-runtime-plugin-install.test.ts passed: 497 tests across 4 shards.
  • node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.test.src.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/test-src.tsbuildinfo passed.
  • pnpm docs:list passed after the docs scope update.
  • pnpm docs:check-mdx passed: 680 files.
  • pnpm docs:check-links passed: 4,561 internal links, 0 broken links.
  • pnpm format:docs:check passed: 665 files.

Not run:

  • Full pnpm check and Crabbox/Testbox were not rerun in this checkout.
  • A live production NVIDIA/Peter/OpenClaw skill bypass cannot be proven until ClawHub production includes owner.official on skill metadata responses.

Copilot AI review requested due to automatic review settings May 13, 2026 09:38
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation cli CLI command changes commands Command implementations size: L maintainer Maintainer-authored PR labels May 13, 2026
Copilot AI reviewed May 13, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR reintroduces the ClawHub exact-release trust check in the plugin install/update pipeline, ensuring ClawHub security data is consulted before any ClawHub download and that risky releases require explicit acknowledgement (interactive or via --acknowledge-clawhub-risk), while preserving the existing local dangerous-code scanner behavior.

Changes:

  • Add a typed ClawHub package security/trust response parser and wire fetchClawHubPackageSecurity() into installPluginFromClawHub() as a fail-closed trust gate.
  • Thread risk-acknowledgement options (acknowledgeClawHubRisk / onClawHubRisk) through plugin update/sync flows and expose --acknowledge-clawhub-risk on plugins install, plugins update, and openclaw update.
  • Update tests and docs to cover the new trust/acknowledgement behavior and CLI surface area.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
src/plugins/update.ts Forwards ClawHub risk acknowledgement options through plugin update/sync calls into ClawHub installs.
src/plugins/update.test.ts Adds coverage asserting acknowledgement options are forwarded in dry-run and live update paths.
src/plugins/clawhub.ts Introduces trust fetching + risk classification + acknowledgement gate before ClawHub downloads.
src/plugins/clawhub.test.ts Adds tests for risky vs stale/pending trust behavior and fail-closed security fetch failures.
src/infra/clawhub.ts Reworks security response types and adds runtime parsing/validation for the security endpoint payload.
src/infra/clawhub.test.ts Updates security endpoint tests and adds malformed-response rejection coverage.
src/commands/onboarding-plugin-install.ts Adds an interactive onboarding prompt handler for ClawHub risk acknowledgements.
src/commands/onboarding-plugin-install.test.ts Verifies onboarding passes an onClawHubRisk function into ClawHub install calls.
src/commands/doctor/shared/missing-configured-plugin-install.ts Captures and propagates ClawHub trust warnings into doctor repair warnings output.
src/cli/update-cli/update-command.ts Adds interactive/non-interactive handling and plumbing for risk acknowledgement during post-update plugin work.
src/cli/update-cli/shared.ts Extends update command options with acknowledgeClawHubRisk.
src/cli/update-cli.ts Adds --acknowledge-clawhub-risk option wiring to the update CLI and normalizes commander option casing.
src/cli/update-cli.test.ts Adds tests asserting acknowledgement flag forwarding and propagation into resume/spawn flows.
src/cli/plugins-update-command.ts Wires CLI flag into plugin update runner via shared ClawHub risk acknowledgement option resolver.
src/cli/plugins-install-command.ts Wires CLI flag into explicit ClawHub installs via shared acknowledgement option resolver.
src/cli/plugins-cli.update.test.ts Adds a test verifying plugins update --acknowledge-clawhub-risk forwards into update logic.
src/cli/plugins-cli.ts Adds --acknowledge-clawhub-risk to plugins install/update subcommands and normalizes commander casing.
src/cli/plugins-cli.install.test.ts Adds a test verifying plugins install ... --acknowledge-clawhub-risk forwards into ClawHub install.
src/cli/clawhub-risk-acknowledgement.ts New shared helper to decide whether to prompt vs require explicit acknowledgement for CLI flows.
docs/tools/plugin.md Documents --acknowledge-clawhub-risk for plugins install/update and clarifies semantics.
docs/cli/update.md Documents --acknowledge-clawhub-risk for post-update ClawHub plugin sync.
docs/cli/plugins.md Documents --acknowledge-clawhub-risk for installs/updates with explanatory accordion sections.
CHANGELOG.md Adds a changelog entry describing the restored ClawHub trust check and new acknowledgement flag.

Comment thread src/plugins/clawhub.ts Outdated
Comment thread src/cli/clawhub-risk-acknowledgement.ts Outdated
Comment thread src/cli/update-cli/update-command.ts
@clawsweeper

clawsweeper Bot commented May 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 26, 2026, 4:19 AM ET / 08:19 UTC.

Summary
Adds ClawHub trust checks and risk acknowledgement for plugin and skill install/update paths, plus official/bundled bypass handling, Gateway/UI error surfacing, persisted trust metadata, docs, and tests.

PR surface: Source +2726, Tests +4591, Docs +46, Other +21. Total +7384 across 74 files.

Reproducibility: not applicable. this is a security policy/feature PR, not a current-main bug report. The PR supplies terminal screenshot proof for the new blocked and acknowledged CLI paths, and those screenshots were inspected.

Review metrics: 3 noteworthy metrics.

  • Persistent Trust Fields: 8 added. Install records now preserve ClawHub trust state, so stale-record and upgrade behavior need maintainer attention before merge.
  • Acknowledgement Surfaces: 1 CLI flag family, 1 Gateway parameter family, 1 UI retry path added. Risk acknowledgement becomes a user-visible and client-visible contract rather than only internal installer logic.
  • Trusted-Source Bypass Classes: 3 authority groups bypass built-in friction. Official ClawHub/git/npm, OpenClaw bundled/managed, and trusted source-linked installs can skip dependency and hook friction while retaining operator policy.

Stored data model
Persistent data-model change detected: migration/backfill/repair: docs/cli/update.md, migration/backfill/repair: src/cli/update-cli/post-core-plugin-convergence.test.ts, migration/backfill/repair: src/commands/codex-runtime-plugin-install.test.ts, migration/backfill/repair: src/commands/doctor/repair-sequencing.test.ts, migration/backfill/repair: src/commands/doctor/shared/missing-configured-plugin-install.test.ts, migration/backfill/repair: src/commands/doctor/shared/missing-configured-plugin-install.ts, and 10 more. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: canonical
Canonical: #81364
Summary: This PR is the active current landing candidate for ClawHub install trust checks after an earlier plugin-focused implementation was merged and reverted.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Get maintainer acceptance for fail-closed trust behavior, trusted-source bypass semantics, and production official-owner metadata rollout.
  • Confirm the final rollout plan for persisted trust metadata and Gateway/UI acknowledgement clients.

Risk before merge

  • [P1] The fail-closed ClawHub trust gate can stop plugin/skill install, update, onboarding, doctor repair, Gateway, and UI flows when trust verdicts are unavailable, blocked, or require acknowledgement.
  • [P1] Official and bundled sources bypass dependency-denylist and before-install hook friction while preserving operator installPolicy, which intentionally changes the local install security boundary.
  • [P1] The official skill bypass depends on production ClawHub returning trustworthy official-owner metadata; live NVIDIA-shaped skill detail still did not expose those fields during this review.
  • [P1] Persisted trust metadata plus new CLI/Gateway/UI acknowledgement inputs add upgrade and client-contract surface that green CI does not settle by itself.

Maintainer options:

  1. Require rollout sign-off before merge (recommended)
    Record maintainer acceptance for the fail-closed trust gate, official/bundled bypass semantics, production official metadata requirement, and persisted/client-contract surface before landing.
  2. Land as an intentional security policy change
    Maintainers may accept the compatibility and security-boundary changes as the desired default if the production ClawHub metadata rollout is coordinated.
  3. Narrow the first landing
    If the policy is not ready, split out the community blocked/suspicious trust gate and defer official/bundled bypasses or persisted/client expansion to a follow-up.

Next step before merge

  • [P2] Protected maintainer and security-sensitive PR; the remaining action is explicit maintainer policy/security acceptance, not conservative cleanup closure or an automated repair.

Security
Needs attention: No narrow exploit finding was found, but the diff intentionally changes install security boundaries and needs maintainer acceptance before merge.

Review details

Best possible solution:

Land this only after maintainers explicitly accept the fail-closed rollout, trusted-source bypass semantics, production ClawHub metadata contract, and persisted/client-contract upgrade behavior.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a security policy/feature PR, not a current-main bug report. The PR supplies terminal screenshot proof for the new blocked and acknowledged CLI paths, and those screenshots were inspected.

Is this the best way to solve the issue?

Unclear until maintainer sign-off: the shared trust helper is a maintainable implementation shape, but the best rollout depends on owner acceptance of fail-closed behavior, trusted-source bypasses, and production ClawHub metadata support.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9a735bea03f6.

Label changes

Label changes:

  • add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
  • remove rating: 🧂 unranked krab: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.
  • remove merge-risk: 🚨 message-delivery: Current PR review merge-risk labels are merge-risk: 🚨 compatibility, merge-risk: 🚨 security-boundary.

Label justifications:

  • P1: The PR changes security-sensitive plugin/skill install and update behavior that can block real user workflows and alter install security boundaries.
  • merge-risk: 🚨 compatibility: Fail-closed trust checks, persisted trust fields, and new CLI/Gateway/UI acknowledgement inputs can affect existing install, update, repair, and client workflows.
  • merge-risk: 🚨 security-boundary: The diff intentionally allows official/bundled trusted sources to bypass dependency-denylist and before-install hook friction.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (screenshot): The PR body contains latest-head proof commands and GitHub-hosted terminal screenshots; inspected screenshots show blocked malicious plugin install and acknowledged suspicious skill install behavior.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body contains latest-head proof commands and GitHub-hosted terminal screenshots; inspected screenshots show blocked malicious plugin install and acknowledged suspicious skill install behavior.
  • proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The PR body contains latest-head proof commands and GitHub-hosted terminal screenshots; inspected screenshots show blocked malicious plugin install and acknowledged suspicious skill install behavior.
Evidence reviewed

PR surface:

Source +2726, Tests +4591, Docs +46, Other +21. Total +7384 across 74 files.

View PR surface stats
Area Files Added Removed Net
Source 44 2968 242 +2726
Tests 25 4689 98 +4591
Docs 4 46 0 +46
Config 0 0 0 0
Generated 0 0 0 0
Other 1 21 0 +21
Total 74 7724 340 +7384

Security concerns:

  • [medium] Trusted-source bypass changes install security boundary — src/plugins/install-security-scan.runtime.ts:832
    Official ClawHub/git/npm and OpenClaw bundled/managed sources can bypass dependency-denylist and before-install hook friction; operator installPolicy still runs, but this is a deliberate local security-boundary change.
    Confidence: 0.86
  • [low] Official skill bypass depends on ClawHub metadata rollout — src/skills/lifecycle/clawhub.ts:253
    The bypass trusts official owner/skill metadata from default ClawHub responses, but the live NVIDIA-shaped detail response did not yet expose the official fields needed for that path.
    Confidence: 0.78

What I checked:

  • Protected live PR state: Live PR metadata shows author jesse-merhi, label maintainer, mergeable CLEAN/MERGEABLE state, and security/compatibility merge-risk labels on head 491b6d1. (491b6d1d525f)
  • Latest-head CI/proof checks: gh pr checks reports latest-head CI, lint, docs, security high, dependency, and real behavior proof checks passing; skipped checks are scope skips, not current failures. (491b6d1d525f)
  • Plugin trust gate: The PR skips the ClawHub trust lookup for default official packages, otherwise calls ensureClawHubPackageTrustAcknowledged before plugin download. (src/plugins/clawhub.ts:1229, 491b6d1d525f)
  • Skill trust gate: The skill installer runs the shared ClawHub trust acknowledgement path for archive-backed installs and skips it when the source is detected as official. (src/skills/lifecycle/clawhub.ts:1276, 491b6d1d525f)
  • Trusted-source friction bypass: shouldBypassOpenClawInstallFriction allows official ClawHub/git/npm and OpenClaw bundled/managed sources to bypass dependency-denylist and before-install hook friction while still running operator install policy. (src/plugins/install-security-scan.runtime.ts:832, 491b6d1d525f)
  • Persistent trust metadata: The install record type and zod schema add eight persisted ClawHub trust fields, making this an upgrade/config-contract surface rather than only runtime validation. (src/config/types.installs.ts:19, 491b6d1d525f)

Likely related people:

  • jesse-merhi: Authored the earlier merged ClawHub install-trust PR and its revert, and is carrying the current remake with the same install-trust scope. (role: feature owner; confidence: high; commits: 87eb450047a9, 6c92324c5fb2, 491b6d1d525f; files: src/plugins/clawhub.ts, src/infra/clawhub-install-trust.ts, src/skills/lifecycle/clawhub.ts)
  • 张贵萍: The shallow/grafted checkout attributes the current central plugin, install-security-scan, and Gateway schema baselines to commit 56baf9d; useful as a low-confidence routing signal only because deeper history is not available locally. (role: current-main baseline contributor; confidence: low; commits: 56baf9d07963; files: src/plugins/clawhub.ts, src/plugins/install-security-scan.runtime.ts, packages/gateway-protocol/src/schema/agents-models-skills.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@openclaw-barnacle openclaw-barnacle Bot added size: XL scripts Repository scripts and removed size: L labels May 13, 2026
@jesse-merhi
jesse-merhi force-pushed the jesse/clawhub-install-trust-remake branch 8 times, most recently from 2f49add to 0a50497 Compare May 13, 2026 14:33
@openclaw-barnacle openclaw-barnacle Bot added the gateway Gateway runtime label May 13, 2026
@jesse-merhi
jesse-merhi force-pushed the jesse/clawhub-install-trust-remake branch 2 times, most recently from a12424f to 72eeb99 Compare May 13, 2026 17:29
@openclaw-barnacle openclaw-barnacle Bot added the channel: matrix Channel integration: matrix label May 13, 2026
@jesse-merhi
jesse-merhi force-pushed the jesse/clawhub-install-trust-remake branch from 9176df8 to 51bb24b Compare May 14, 2026 11:19
@openclaw-barnacle openclaw-barnacle Bot removed the gateway Gateway runtime label May 14, 2026
@jesse-merhi
jesse-merhi force-pushed the jesse/clawhub-install-trust-remake branch 4 times, most recently from 395d20d to 0412c78 Compare May 14, 2026 14:03
@jesse-merhi
jesse-merhi force-pushed the jesse/clawhub-install-trust-remake branch 3 times, most recently from 2d15333 to f47d460 Compare May 16, 2026 22:45
@openclaw-barnacle openclaw-barnacle Bot removed the channel: matrix Channel integration: matrix label May 16, 2026
@clawsweeper clawsweeper Bot added the P1 High-priority user-facing bug, regression, or broken workflow. label May 16, 2026
@jesse-merhi
jesse-merhi force-pushed the jesse/clawhub-install-trust-remake branch 2 times, most recently from 19e4880 to 288b308 Compare May 17, 2026 00:01
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 14, 2026
@jesse-merhi
jesse-merhi force-pushed the jesse/clawhub-install-trust-remake branch from 288b308 to d04764c Compare June 20, 2026 15:13
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels Jun 20, 2026
This was referenced Jun 25, 2026
Open
Open
Open
@jesse-merhi

jesse-merhi commented Jun 26, 2026

Copy link
Copy Markdown
Member Author

@clawsweeper review

@clawsweeper

clawsweeper Bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@jesse-merhi

jesse-merhi commented Jun 26, 2026

Copy link
Copy Markdown
Member Author

Merged via squash.

This was referenced Jul 8, 2026
Open
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

@jesse-merhi jesse-merhi

Labels

app: web-ui App: web-ui cli CLI command changes commands Command implementations docs Improvements or additions to documentation gateway Gateway runtime maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P1 High-priority user-facing bug, regression, or broken workflow. proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. scripts Repository scripts size: XL status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jesse-merhi