fix(plugins): prefer bundled plugin ids over bare npm specs

This commit is contained in:
Peter Steinberger
2026-03-02 20:46:28 +00:00
parent bfb6c6290f
commit ad12d1fbce
4 changed files with 97 additions and 60 deletions

View File

@@ -48,6 +48,10 @@ Security note: treat plugin installs like running code. Prefer pinned versions.
Npm specs are **registry-only** (package name + optional version/tag). Git/URL/file
specs are rejected. Dependency installs run with `--ignore-scripts` for safety.
If a bare install spec matches a bundled plugin id (for example `diffs`), OpenClaw
installs the bundled plugin directly. To install an npm package with the same
name, use an explicit scoped spec (for example `@scope/diffs`).
Supported archives: `.zip`, `.tgz`, `.tar.gz`, `.tar`.
Use `--link` to avoid copying a local directory (adds to `plugins.load.paths`):