fix: accept mixed source/dist bundled roots by arkyu2077 · Pull Request #93119 · openclaw/openclaw

arkyu2077 · 2026-06-15T01:55:28Z

Summary

treat source-checkout bundled source roots under the same package checkout as valid persisted bundled roots
keep the stale-source guard for bundled roots outside the active checkout
add a regression test covering mixed built/source bundled entries in one source checkout

Testing

pnpm vitest run src/plugins/plugin-registry-snapshot.test.ts
pnpm vitest run src/plugins/plugin-registry.test.ts -t "bundled roots"

clawsweeper · 2026-06-15T01:57:20Z

Codex review: needs real behavior proof before merge. Reviewed June 14, 2026, 10:02 PM ET / 02:02 UTC.

Summary
The PR changes persisted plugin registry validation to accept mixed source-checkout bundled source and dist roots, and adds a regression test for that mixed-root case.

PR surface: Source +22, Tests +58. Total +80 across 2 files.

Reproducibility: yes. The linked issue and current source path show that a source checkout can persist bundled plugin roots under both dist/extensions and extensions, then current validation rejects source-root entries outside the single resolved bundled root.

Review metrics: 1 noteworthy metric.

Persisted Root Validation: 1 validation rule broadened. The PR changes when saved bundled plugin registries are reused versus rebuilt, which matters for source-checkout upgrade behavior.

Stored data model
Persistent data-model change detected: serialized state: src/plugins/plugin-registry-snapshot.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦪 silver shellfish
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add a regression test for an older persisted source-root bundled record when the matching dist bundled peer exists.
[P1] Add redacted CLI output from a source checkout showing openclaw plugins registry --refresh followed by openclaw plugins list --json without the stale-source diagnostic.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body lists unit commands but no after-fix real source-checkout CLI proof; add redacted terminal output or logs showing refresh followed by list without the stale-source diagnostic, then update the PR body to trigger re-review or ask a maintainer for @clawsweeper re-review.

Risk before merge

[P1] The same-checkout source-root allowance changes persisted bundled registry reuse during upgrades; without a per-plugin built-peer check, an old source-root record can remain accepted after a dist peer exists.

Maintainer options:

Narrow Source-Root Acceptance (recommended)
Before merge, restrict the new legacy-root allowance so a persisted source-root bundled plugin is accepted only when the matching active dist/runtime bundled peer is absent or intentionally overlaid.
Accept Broader Source Reuse
Maintainers can intentionally accept that older same-checkout source-root records may remain persisted after builds, but that should be an explicit compatibility choice with tests documenting the tradeoff.

Next step before merge

[P1] Contributor action is needed to narrow the validation change and provide real CLI proof; do not queue repair while the external PR proof gate is missing.

Security
Cleared: The diff only changes local plugin registry path validation and tests; it does not add dependencies, workflow permissions, credential handling, downloads, or package execution hooks.

Review findings

[P1] Reject built-peer source records — src/plugins/plugin-registry-snapshot.ts:343-344

Review details

Best possible solution:

Accept same-checkout source-root bundled records only for source-only bundled plugins or intentional overlays, and continue rebuilding stale records that conflict with the current built-artifact preference.

Do we have a high-confidence way to reproduce the issue?

Yes. The linked issue and current source path show that a source checkout can persist bundled plugin roots under both dist/extensions and extensions, then current validation rejects source-root entries outside the single resolved bundled root.

Is this the best way to solve the issue?

No. The direction is right, but this implementation is broader than the current discovery invariant because it accepts every source-checkout legacy root instead of only source-only bundled records that the current discovery path can produce.

Full review comments:

[P1] Reject built-peer source records — src/plugins/plugin-registry-snapshot.ts:343-344
This adds the whole source-checkout extensions root to the accepted persisted bundled roots. That also accepts an older persisted bundled record like extensions/codex after dist/extensions/codex exists, even though current source-checkout discovery skips source children that have a built peer and bundled-dir.ts explicitly prefers the built tree. In that upgrade state the saved registry can keep using source/TS paths instead of falling back to the derived built-root registry, so please gate the legacy-root allowance per plugin or add a stale check for source-root records with an active built peer.
Confidence: 0.86

Overall correctness: patch is incorrect
Overall confidence: 0.86

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 44e6caff5401.

Label changes

Label changes:

add P2: The PR targets a normal-priority plugin registry CLI bug with limited blast radius: listing still works, but the recommended refresh does not clear the stale warning.
add merge-risk: 🚨 compatibility: The PR changes persisted bundled-root validation, which controls whether existing saved plugin registries are reused or rebuilt during source-checkout upgrades.
add merge-risk: 🚨 availability: Accepting stale bundled source-root records can leave bundled runtime paths on TypeScript sources even when built JavaScript artifacts exist, and bundled runtime loading rejects non-JavaScript module paths.
add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists unit commands but no after-fix real source-checkout CLI proof; add redacted terminal output or logs showing refresh followed by list without the stale-source diagnostic, then update the PR body to trigger re-review or ask a maintainer for @clawsweeper re-review.

Label justifications:

P2: The PR targets a normal-priority plugin registry CLI bug with limited blast radius: listing still works, but the recommended refresh does not clear the stale warning.
merge-risk: 🚨 compatibility: The PR changes persisted bundled-root validation, which controls whether existing saved plugin registries are reused or rebuilt during source-checkout upgrades.
merge-risk: 🚨 availability: Accepting stale bundled source-root records can leave bundled runtime paths on TypeScript sources even when built JavaScript artifacts exist, and bundled runtime loading rejects non-JavaScript module paths.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists unit commands but no after-fix real source-checkout CLI proof; add redacted terminal output or logs showing refresh followed by list without the stale-source diagnostic, then update the PR body to trigger re-review or ask a maintainer for @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +22, Tests +58. Total +80 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	23	1	+22
Tests	1	58	0	+58
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	81	1	+80

What I checked:

PR head root allowance: The PR adds the entire same-checkout legacy extensions root to the accepted bundled-root set once it looks like a source checkout. (src/plugins/plugin-registry-snapshot.ts:340, 1a6dd2807477)
PR regression coverage: The new test covers a valid mixed registry where codex is under dist/extensions and source-only whatsapp is under extensions, but it does not cover an older source-root record for a plugin that now has a built peer. (src/plugins/plugin-registry-snapshot.test.ts:780, 1a6dd2807477)
Current built-root preference: Current main prefers dist/extensions in source checkouts when a usable built tree exists, falling back to source only when built/runtime trees are unavailable. (src/plugins/bundled-dir.ts:166, 44e6caff5401)
Current source-only discovery rule: Discovery scans the source checkout extensions root with skipDirectories from the active bundled root, so normal current discovery only adds source-root bundled records for source-only children. (src/plugins/discovery.ts:1556, 44e6caff5401)
Runtime impact of retained source paths: Status reports copy plugin.source and plugin.rootDir from the selected snapshot, and the runtime boundary rejects non-JavaScript bundled module paths, making stale bundled TypeScript source paths availability-sensitive if they reach runtime loading. (src/plugins/runtime/runtime-plugin-boundary.ts:139, 44e6caff5401)
History and owner provenance: Current blame and GitHub path history tie the affected registry/root-discovery code to recent work by Vincent Koc, Peter Steinberger, and adjacent plugin metadata contributors. (src/plugins/plugin-registry-snapshot.ts:323, 44e6caff5401)

Likely related people:

vincentkoc: Current blame on the stale-root check, source-checkout discovery, and bundled-dir source checkout selection points to Vincent Koc in the checked-out history. (role: recent area contributor; confidence: medium; commits: fc6d448138fc; files: src/plugins/plugin-registry-snapshot.ts, src/plugins/bundled-dir.ts, src/plugins/discovery.ts)
steipete: GitHub path history shows repeated recent plugin registry, bundled-dir, and bundled path alias work by Peter Steinberger. (role: adjacent registry contributor; confidence: medium; commits: 5443baa8527e, bd83f8a844d8, 540c70d166e2; files: src/plugins/plugin-registry-snapshot.ts, src/plugins/bundled-dir.ts, src/plugins/bundled-load-path-aliases.ts)
RomneyDa: Recent history on plugin-registry-snapshot.ts includes metadata snapshot and discovery threading work that affects persisted-versus-derived registry behavior. (role: adjacent performance contributor; confidence: low; commits: 8ccb11cbfca7; files: src/plugins/plugin-registry-snapshot.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

vincentkoc · 2026-06-15T06:00:32Z

land-ready maintainer repair completed on 06f620729a70eb4652a9e26b6f27c4abb7a6f2ff.

what changed:

validates persisted bundled roots per plugin instead of rejecting valid mixed source/dist installs globally
preserves an active bind-mounted source overlay even when its built peer exists
computes source overlay mounts once per snapshot validation rather than once per plugin

verification:

node scripts/run-vitest.mjs src/plugins/plugin-registry-snapshot.test.ts src/plugins/discovery.test.ts src/plugins/plugin-registry.test.ts — 120 passed
git diff --check — passed
fresh local autoreview — clean
CI: https://github.com/openclaw/openclaw/actions/runs/27526952303 — all related checks passed

known proof gap / unrelated failure:

Testbox-through-Crabbox was unavailable because blacksmith is missing; Azure Crabbox was also blocked by expired Azure CLI auth.
CI check-prod-types fails on latest main at extensions/telegram/src/rich-message.ts:300 (markdown unused). This PR does not touch Telegram or that base failure.

* fix: accept mixed source/dist bundled roots fixes openclaw#87730 * fix(plugins): validate mixed bundled roots per plugin * fix(plugins): preserve active source overlays --------- Co-authored-by: Jasmine Zhang <[email protected]> Co-authored-by: Vincent Koc <[email protected]>

openclaw-barnacle Bot added size: S triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 15, 2026

clawsweeper Bot mentioned this pull request Jun 15, 2026

[Bug]: 2026.5.27 Refresh still says stale #87730

Closed

vincentkoc self-assigned this Jun 15, 2026

Jasmine Zhang and others added 3 commits June 15, 2026 13:50

fix: accept mixed source/dist bundled roots fixes openclaw#87730

70cfef2

fix(plugins): validate mixed bundled roots per plugin

df55cda

fix(plugins): preserve active source overlays

06f6207

vincentkoc force-pushed the pr-factory-87730 branch from 1a6dd28 to 06f6207 Compare June 15, 2026 05:55

vincentkoc added the proof: override Maintainer override for the external PR real behavior proof gate. label Jun 15, 2026

vincentkoc merged commit bcb016a into openclaw:main Jun 15, 2026
165 of 167 checks passed

openclaw-barnacle Bot removed the triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. label Jun 15, 2026

Haderach-Ram mentioned this pull request Jun 15, 2026

Ecosystem Digest — 2026-06-15 Haderach-Ram/openclaw-radar#46

Closed

clawsweeper Bot mentioned this pull request Jun 15, 2026

fix(plugins): accept bundled plugins in source overlay root for --refresh compatibility #87828

Closed

github-actions Bot mentioned this pull request Jun 15, 2026

📡 Upstream Digest — 2026-06-15 09:53 UTC curtismercier/openclaw-mods#1082

Open

clawsweeper Bot mentioned this pull request Jun 15, 2026

[AI-assisted] Add session history family lookup #90239

Open

clawsweeper Bot mentioned this pull request Jun 23, 2026

Gateway 'plugins.slots.memory: plugin not found' for an extensions/ plugin present in plugins list — 2026.6.9 regression #96046

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: accept mixed source/dist bundled roots#93119

fix: accept mixed source/dist bundled roots#93119
vincentkoc merged 3 commits into
openclaw:mainfrom
arkyu2077:pr-factory-87730

arkyu2077 commented Jun 15, 2026

Uh oh!

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

vincentkoc commented Jun 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

arkyu2077 commented Jun 15, 2026

Summary

Testing

Uh oh!

clawsweeper Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vincentkoc commented Jun 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading