pnpm v9+ defaults blockExoticSubdeps=true, which rejects
@whiskeysockets/libsignal-node — a tarball-URL subdep of
@whiskeysockets/baileys. This silently breaks the WhatsApp channel and
silences all inbound agent replies on fresh installs.
Add @whiskeysockets/libsignal-node to onlyBuiltDependencies in both
package.json and pnpm-workspace.yaml — the same exemption already used
for @whiskeysockets/baileys itself.
Fixes#76539.
Summary:
- The PR adds an internal Tree-sitter-backed shell command explainer under `src/infra`, parser runtime/tests, dependency/build-policy updates, an index export, and a changelog entry.
- Reproducibility: not applicable. this is a feature PR rather than a bug report. For the prior PR blocker, source inspection shows byte-to-string span conversion and focused Unicode span coverage on the exact head.
Automerge notes:
- Ran the ClawSweeper repair loop before final review.
- Included post-review commit in the final squash: Repair shell command explainer automerge blockers
- Included post-review commit in the final squash: fix(clawsweeper): address review for automerge-openclaw-openclaw-7500…
Validation:
- ClawSweeper review passed for head 47577579e9.
- Required merge gates passed before the squash merge.
Prepared head SHA: 47577579e9
Review: https://github.com/openclaw/openclaw/pull/75004#issuecomment-4351322592
Co-authored-by: Jesse Merhi <jessejmerhi@gmail.com>
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
Simplify plugin installation and runtime loading around package-manager-owned dependencies, with Jiti reserved for local/TS fallback paths.
Also scans npm plugin install roots so hoisted transitive dependencies are covered by dependency denylist and node_modules symlink checks.
* fix(agents): extract abortable from runEmbeddedAttempt to release captured run scope on hung provider abort (#74182)
* test(agents): drop synthetic WeakRef retention test for abortable
* feat(scripts): add embedded-run-abort-leak harness for runtime closure-leak validation
* feat(scripts): add production mode to leak harness importing real abortable
* docs(changelog): add #74182 fix entry for embedded-run abort closure release
