Vincent Koc 2a22eb68aa fix(plugins): require provenance for official npm trust ...

Require OpenClaw-owned install provenance before granting official npm plugin scanner trust. Direct npm package names now scan normally; catalog, onboarding, and doctor paths pass explicit provenance.\n\nValidation:\n- pnpm test:serial src/plugins/install.npm-spec.test.ts src/cli/plugins-cli.install.test.ts src/commands/onboarding-plugin-install.test.ts src/commands/doctor/shared/missing-configured-plugin-install.test.ts src/channels/plugins/contracts/channel-catalog.contract.test.ts src/commands/auth-choice.apply.plugin-provider.test.ts\n- pnpm test:serial src/plugins/install.test.ts src/plugins/provider-auth-choices.test.ts src/plugins/provider-install-catalog.test.ts src/commands/channel-setup/plugin-install.test.ts\n- pnpm exec oxfmt --check --threads=1 ...\n- node scripts/run-oxlint.mjs ...\n- Crabbox cbx_6157440c9bbe / run_cbd813956eed: pnpm check:changed passed\n\nThanks @fede-kamel and @vincentkoc.

2026-05-02 23:30:45 -07:00

..

allowlists

refactor: hide allowlist helper

2026-05-02 07:12:25 +01:00

plugins

fix(plugins): require provenance for official npm trust

2026-05-02 23:30:45 -07:00

transport

…

turn

fix(channels): suppress observe-only prepared dispatch

2026-04-29 22:05:28 -07:00

account-inspection.ts

refactor: share channel account inspection

2026-04-20 13:50:12 +01:00

account-snapshot-fields.test.ts

fix(gateway): preserve runtime-backed health state (#72417)

2026-04-27 11:04:59 -07:00

account-snapshot-fields.ts

fix(gateway): preserve runtime-backed health state (#72417)

2026-04-27 11:04:59 -07:00

account-summary.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

ack-reactions.test.ts

fix(whatsapp): remove ack reactions after replies

2026-04-26 05:36:14 +01:00

ack-reactions.ts

fix(whatsapp): remove ack reactions after replies

2026-04-26 05:36:14 +01:00

AGENTS.md

Docs: capture test performance guardrails

2026-04-18 16:09:27 -04:00

allow-from.test.ts

…

allow-from.ts

fix: align open DM allowlist policy (#74112)

2026-04-29 06:52:12 +01:00

allowlist-match.test.ts

…

allowlist-match.ts

refactor: dedupe channel lowercase helpers

2026-04-07 11:18:18 +01:00

bundled-channel-catalog-read.fail-soft.test.ts

fix: tolerate bundled channel catalog discovery failures

2026-05-02 03:34:17 +01:00

bundled-channel-catalog-read.test.ts

fix: stabilize current CI tests

2026-05-02 03:39:19 +01:00

bundled-channel-catalog-read.ts

perf: cache startup package metadata

2026-05-02 16:11:05 +01:00

channel-config.test.ts

…

channel-config.ts

refactor: dedupe channel lowercase helpers

2026-04-07 11:18:18 +01:00

channels-misc.test.ts

chore: remove unused internal entrypoints

2026-04-29 11:35:34 +01:00

chat-meta-shared.ts

refactor: share channel manifest metadata mapping

2026-04-20 13:44:41 +01:00

chat-meta.ts

…

chat-type.ts

refactor: dedupe lowercase string helpers

2026-04-07 10:37:39 +01:00

CLAUDE.md

…

command-gating.test.ts

…

command-gating.ts

…

config-presence.test.ts

test: remove stale config presence mock import

2026-05-02 03:34:17 +01:00

config-presence.ts

fix: stabilize channel configured probes

2026-05-02 03:34:17 +01:00

conversation-binding-context.test.ts

fix: normalize focused binding conversation ids

2026-04-10 19:40:18 -05:00

conversation-binding-context.ts

refactor: trim channel resolution type exports

2026-05-02 00:46:07 +01:00

conversation-label.test.ts

refactor: generalize conversation id labels

2026-04-22 06:11:49 +01:00

conversation-label.ts

refactor: generalize conversation id labels

2026-04-22 06:11:49 +01:00

conversation-resolution.test.ts

refactor(plugin-sdk): publish route helpers

2026-04-28 01:13:01 +01:00

conversation-resolution.ts

refactor: trim channel resolution type exports

2026-05-02 00:46:07 +01:00

draft-preview-finalizer.test.ts

fix: centralize draft preview finalization

2026-04-22 02:32:55 +01:00

draft-preview-finalizer.ts

fix: centralize draft preview finalization

2026-04-22 02:32:55 +01:00

draft-stream-controls.test.ts

fix: centralize draft preview finalization

2026-04-22 02:32:55 +01:00

draft-stream-controls.ts

fix: centralize draft preview finalization

2026-04-22 02:32:55 +01:00

draft-stream-loop.ts

…

ids.test.ts

refactor: simplify plugin dependency handling

2026-05-01 21:32:22 +01:00

ids.ts

perf(channels): read bundled channel metadata directly

2026-04-13 17:43:36 +01:00

inbound-debounce-policy.test.ts

…

inbound-debounce-policy.ts

refactor: dedupe channel helper readers

2026-04-07 06:42:34 +01:00

location.test.ts

fix: harden WhatsApp structured object prompts

2026-04-23 18:03:16 +01:00

location.ts

fix: harden WhatsApp structured object prompts

2026-04-23 18:03:16 +01:00

logging.ts

…

mention-gating.test.ts

refactor: centralize inbound mention policy

2026-04-07 07:51:00 +01:00

mention-gating.ts

refactor: centralize inbound mention policy

2026-04-07 07:51:00 +01:00

model-overrides.test.ts

perf(test): avoid bundled channel fallback in model override tests

2026-04-22 07:01:19 +01:00

model-overrides.ts

perf(test): avoid bundled channel fallback in model override tests

2026-04-22 07:01:19 +01:00

native-command-session-targets.test.ts

…

native-command-session-targets.ts

refactor: dedupe channel lowercase helpers

2026-04-07 11:18:18 +01:00

read-only-account-inspect.ts

perf: speed up security audit test imports

2026-04-16 21:54:13 +01:00

registry-normalize.ts

refactor: remove unused dead code

2026-05-01 07:33:11 +01:00

registry.helpers.test.ts

fix(build): repair rebase export surfaces

2026-04-11 13:49:03 +01:00

registry.ts

refactor: trim channel registry exports

2026-05-02 01:39:38 +01:00

reply-prefix.ts

fix(cycles): split reply payload and option contracts

2026-04-11 22:24:55 +01:00

run-state-machine.test.ts

…

run-state-machine.ts

refactor: trim channel registry exports

2026-05-02 01:39:38 +01:00

sender-identity.ts

refactor: dedupe channel helper readers

2026-04-07 06:42:34 +01:00

sender-label.test.ts

…

sender-label.ts

refactor: dedupe helper string aliases

2026-04-07 09:44:53 +01:00

session-envelope.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

session-meta.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

session.test.ts

fix(sessions): avoid guarded route-only entries

2026-04-27 21:11:12 +01:00

session.ts

refactor(channels): add shared turn kernel

2026-04-29 23:16:16 +01:00

session.types.ts

refactor(channels): add shared turn kernel

2026-04-29 23:16:16 +01:00

status-reactions.slack-lifecycle.test.ts

fix(channels): clear stale terminal status reactions

2026-05-01 22:36:31 +01:00

status-reactions.test.ts

fix(channels): clear stale terminal status reactions

2026-05-01 22:36:31 +01:00

status-reactions.ts

fix(channels): clear stale terminal status reactions

2026-05-01 22:36:31 +01:00

targets.test.ts

…

targets.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

thread-binding-id.test.ts

…

thread-binding-id.ts

refactor: dedupe channel helper readers

2026-04-07 06:42:34 +01:00

thread-bindings-messages.ts

refactor: dedupe channel helper readers

2026-04-07 06:42:34 +01:00

thread-bindings-policy.test.ts

feat: simplify thread-bound session spawning

2026-05-02 06:58:07 +01:00

thread-bindings-policy.ts

feat: simplify thread-bound session spawning

2026-05-02 06:58:07 +01:00

typing-lifecycle.ts

refactor: trim startup channel type exports

2026-05-02 00:52:41 +01:00

typing-start-guard.test.ts

…

typing-start-guard.ts

refactor: trim startup channel type exports

2026-05-02 00:52:41 +01:00

typing.test.ts

fix(channels): keep typing indicators off reply critical path

2026-05-01 08:33:02 +05:30

typing.ts

fix(channels): keep typing indicators off reply critical path

2026-05-01 08:33:02 +05:30