Skip to content

fix: reject plugin npm packages without manifests#99904

Closed
849261680 wants to merge 1 commit into
openclaw:mainfrom
849261680:fix/96878-official-web-search-plugin-install
Closed

fix: reject plugin npm packages without manifests#99904
849261680 wants to merge 1 commit into
openclaw:mainfrom
849261680:fix/96878-official-web-search-plugin-install

Conversation

@849261680

@849261680 849261680 commented Jul 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Closes #96878

AI-assisted with Codex.

What Problem This Solves

Fixes an issue where users trying to recover SearXNG or Tavily web_search after upgrade could be directed to official npm plugin packages that did not contain an OpenClaw plugin manifest, causing install validation to fail instead of restoring the provider.

Why This Change Was Made

The current live @openclaw/[email protected] and @openclaw/[email protected] packages now contain the expected manifests and install successfully. This change adds the missing release verifier gate so plugin npm packages without a root openclaw.plugin.json, including 0.0.0 reservation packages, fail plugin runtime verification before they can be treated as valid published plugin artifacts.

User Impact

Users get a working official npm recovery path for SearXNG and Tavily, and release managers get a direct guard against publishing or accepting plugin npm packages that would later fail with plugin id mismatch or hook-pack fallback errors.

Evidence

  • node scripts/run-vitest.mjs test/scripts/verify-plugin-npm-published-runtime.test.ts -- --reporter verbose
  • pnpm format:check scripts/verify-plugin-npm-published-runtime.mjs test/scripts/verify-plugin-npm-published-runtime.test.ts
  • ./node_modules/.bin/oxlint --tsconfig config/tsconfig/oxlint.scripts.json scripts/verify-plugin-npm-published-runtime.mjs
  • ./node_modules/.bin/oxlint test/scripts/verify-plugin-npm-published-runtime.test.ts
  • OPENCLAW_PLUGIN_NPM_VERIFY_ATTEMPTS=1 OPENCLAW_PLUGIN_NPM_README_VERIFY_ATTEMPTS=1 node scripts/verify-plugin-npm-published-runtime.mjs @openclaw/[email protected]
  • OPENCLAW_PLUGIN_NPM_VERIFY_ATTEMPTS=1 OPENCLAW_PLUGIN_NPM_README_VERIFY_ATTEMPTS=1 node scripts/verify-plugin-npm-published-runtime.mjs @openclaw/[email protected]
  • OPENCLAW_HOME=$(mktemp -d) pnpm openclaw plugins install npm:@openclaw/searxng-plugin
  • OPENCLAW_HOME=$(mktemp -d) pnpm openclaw plugins install npm:@openclaw/tavily-plugin
  • .agents/skills/autoreview/scripts/autoreview --mode branch --base upstream/main -> clean, no accepted/actionable findings

Redacted terminal proof:

$ node scripts/run-vitest.mjs test/scripts/verify-plugin-npm-published-runtime.test.ts -- --reporter verbose
✓ collectPluginNpmPublishedRuntimeErrors > flags plugin npm packages without an OpenClaw plugin manifest
✓ collectPluginNpmPublishedRuntimeErrors > flags reservation packages before they can pass plugin runtime verification
Test Files  1 passed (1)
Tests  24 passed (24)
[test] passed 1 Vitest shard in 57.82s

$ OPENCLAW_PLUGIN_NPM_VERIFY_ATTEMPTS=1 OPENCLAW_PLUGIN_NPM_README_VERIFY_ATTEMPTS=1 node scripts/verify-plugin-npm-published-runtime.mjs @openclaw/[email protected]
plugin-npm-published-runtime-check: @openclaw/[email protected] OK (8 files, 284 readme chars)
npm readme metadata for @openclaw/[email protected] was unavailable; verified README from published tarball instead.

$ OPENCLAW_PLUGIN_NPM_VERIFY_ATTEMPTS=1 OPENCLAW_PLUGIN_NPM_README_VERIFY_ATTEMPTS=1 node scripts/verify-plugin-npm-published-runtime.mjs @openclaw/[email protected]
plugin-npm-published-runtime-check: @openclaw/[email protected] OK (1395 files, 265 readme chars)
npm readme metadata for @openclaw/[email protected] was unavailable; verified README from published tarball instead.

$ OPENCLAW_HOME=$(mktemp -d) pnpm openclaw plugins install npm:@openclaw/searxng-plugin
Installing @openclaw/searxng-plugin into <tmp-home>/.openclaw/npm/projects/openclaw-searxng-plugin-<hash>...
Linked peerDependency "openclaw" -> <repo>
Plugin manifest id "searxng" differs from npm package name "@openclaw/searxng-plugin"; using manifest id as the config key.
Installed plugin: searxng
Restart the gateway to load plugins.

$ OPENCLAW_HOME=$(mktemp -d) pnpm openclaw plugins install npm:@openclaw/tavily-plugin
Installing @openclaw/tavily-plugin into <tmp-home>/.openclaw/npm/projects/openclaw-tavily-plugin-<hash>...
Linked peerDependency "openclaw" -> <repo>
Plugin manifest id "tavily" differs from npm package name "@openclaw/tavily-plugin"; using manifest id as the config key.
Installed plugin: tavily
Restart the gateway to load plugins.

@openclaw-barnacle openclaw-barnacle Bot added scripts Repository scripts size: S labels Jul 4, 2026
@clawsweeper

clawsweeper Bot commented Jul 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 4, 2026, 5:38 AM ET / 09:38 UTC.

Summary
Adds a published plugin npm verifier check that rejects packages missing root openclaw.plugin.json and updates the verifier tests to require manifests in valid package fixtures.

PR surface: Tests +39, Other +4. Total +43 across 2 files.

Reproducibility: yes. at source level. Current main lacks the published-package manifest gate, the installer/docs require native plugin manifests, and the linked issue contains concrete SearXNG/Tavily install failure output.

Review metrics: 1 noteworthy metric.

  • Release verifier gates: 1 added. The PR adds a new hard published-package validation gate, so maintainers should notice the intentional release automation behavior change before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #96878
Summary: This PR is a candidate fix for the canonical SearXNG/Tavily official npm plugin install regression; the externalization PR is related provenance rather than a replacement tracker.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

  • [P1] This intentionally makes plugin npm release verification fail for any future native plugin package that lacks root openclaw.plugin.json; maintainers should accept that stricter release gate before merge.

Maintainer options:

  1. Accept the stricter release gate (recommended)
    Treat root openclaw.plugin.json as mandatory for native plugin npm artifacts and allow future release jobs to fail manifestless packages.
  2. Audit publishable plugins first
    Run the package acceptance or all-publishable plugin verifier path before merge if maintainers want broader assurance that no intended publish target is manifestless.

Next step before merge

  • [P2] No automated code repair is identified; the remaining action is a maintainer review/merge decision for the stricter release verifier gate and linked P1 regression.

Security
Cleared: The diff strengthens an existing release verifier and tests without adding dependencies, permissions, secret handling, lockfile changes, or new code execution paths.

Review details

Best possible solution:

Land the manifest verifier gate as the release-safety fix while keeping the existing installer manifest/id contract and normal official plugin publication path unchanged.

Do we have a high-confidence way to reproduce the issue?

Yes at source level. Current main lacks the published-package manifest gate, the installer/docs require native plugin manifests, and the linked issue contains concrete SearXNG/Tavily install failure output.

Is this the best way to solve the issue?

Yes. The post-publish verifier is the narrowest durable layer because it blocks bad official npm plugin artifacts before they can be accepted as release outputs without duplicating installer policy or changing user config.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a0e604862470.

Label changes

Label changes:

  • add merge-risk: 🚨 automation: The diff changes release verification behavior so future plugin npm publish jobs fail when a package lacks a root OpenClaw manifest.
  • add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes redacted terminal output for the verifier test, live SearXNG/Tavily verifier runs, and isolated plugin install commands after the package fix.
  • add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes redacted terminal output for the verifier test, live SearXNG/Tavily verifier runs, and isolated plugin install commands after the package fix.
  • remove rating: 🦪 silver shellfish: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.
  • remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

  • P1: The PR targets a current upgrade regression that blocks official SearXNG/Tavily web_search plugin recovery for real users.
  • merge-risk: 🚨 automation: The diff changes release verification behavior so future plugin npm publish jobs fail when a package lacks a root OpenClaw manifest.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes redacted terminal output for the verifier test, live SearXNG/Tavily verifier runs, and isolated plugin install commands after the package fix.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes redacted terminal output for the verifier test, live SearXNG/Tavily verifier runs, and isolated plugin install commands after the package fix.
Evidence reviewed

PR surface:

Tests +39, Other +4. Total +43 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 1 48 9 +39
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 1 4 0 +4
Total 2 52 9 +43

What I checked:

Likely related people:

  • vincentkoc: Authored the merged externalization PR that moved SearXNG and Tavily to official external package metadata and recorded the empty reservation-package state behind the linked regression. (role: feature-history owner and recent release contributor; confidence: high; commits: f2eca9439189; files: scripts/lib/official-external-plugin-catalog.json, extensions/searxng/package.json, extensions/tavily/package.json)
  • Onur Solmaz: Authored the merged commit that introduced the plugin npm publish workflow and release helper surface adjacent to this verifier path. (role: original plugin npm workflow contributor; confidence: medium; commits: d41c9ad4cb71; files: .github/workflows/plugin-npm-release.yml, scripts/lib/plugin-npm-release.ts, scripts/plugin-npm-publish.sh)
  • Josh Avant: Authored a recent source-only official plugin install repair path near the CLI install flow that supplies expected plugin ids to the npm installer. (role: adjacent install-path contributor; confidence: medium; commits: 0240cc578c2c; files: src/cli/plugins-install-command.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (3 earlier review cycles)
  • reviewed 2026-07-04T09:16:08.417Z sha faceba2 :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-04T09:21:29.569Z sha faceba2 :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-04T09:29:31.084Z sha faceba2 :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P1 High-priority user-facing bug, regression, or broken workflow. labels Jul 4, 2026
@849261680

849261680 commented Jul 4, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 4, 2026
@steipete steipete self-assigned this Jul 5, 2026
This was referenced Jul 5, 2026
Closed
Closed
Merged
@steipete

steipete commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

Thank you — this fix landed through maintainer batch PR #100399 in commit b22c36f, with contributor credit and changelog thanks preserved. Closing this source PR as superseded.

@steipete steipete closed this Jul 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@steipete steipete

Labels

merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. P1 High-priority user-facing bug, regression, or broken workflow. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. scripts Repository scripts size: S status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: web_search providers, like searxng and tavily stopped working and the official plugins failed to install.

2 participants

@849261680 @steipete