HCL 8701a224f8 fix(plugins): distinguish missing entry file from security violation ...

resolvePackageEntrySource() treats all openBoundaryFileSync failures
as path-escape security violations. When an extension entry file is
simply missing (ENOENT, reason="path"), the gateway emits "extension
entry escapes package directory" and aborts — crashing in a loop.

Root cause: src/plugins/discovery.ts:478 checks !opened.ok but never
inspects opened.reason. SafeOpenSyncResult already distinguishes
"path" (ENOENT) from "validation" (actual path escape).

Fix: only push the security diagnostic when opened.reason is
"validation". For "path" or "io" failures, return null to skip the
entry silently — a missing file is not a security violation.

Closes #52445

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: HCL <chenglunhu@gmail.com>

2026-03-22 16:13:54 -07:00

..

contracts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

runtime

perf: lazy-load plugin runtime heavy surfaces

2026-03-22 22:33:07 +00:00

test-helpers

fix: resolve current ci regressions

2026-03-14 00:51:12 +00:00

build-smoke-entry.ts

CI: add built plugin singleton smoke (#48710)

2026-03-17 15:17:41 -05:00

bundle-claude-inspect.test.ts

Tests: update Claude bundle integration test for agents, output styles, and LSP

2026-03-18 00:12:24 -07:00

bundle-commands.test.ts

feat(plugins): register claude bundle commands natively

2026-03-21 08:14:48 -07:00

bundle-commands.ts

feat(plugins): register claude bundle commands natively

2026-03-21 08:14:48 -07:00

bundle-lsp.ts

Plugins: add LSP server loader and surface in inspect reports

2026-03-18 00:12:24 -07:00

bundle-manifest.test.ts

Plugins: merge agent and output-style dirs into Claude bundle skills

2026-03-18 00:12:24 -07:00

bundle-manifest.ts

Plugins: merge agent and output-style dirs into Claude bundle skills

2026-03-18 00:12:24 -07:00

bundle-mcp.test-support.ts

fix(ci): stabilize bundle hooks and mcp path seams

2026-03-19 14:26:52 -07:00

bundle-mcp.test.ts

fix(plugins): stabilize bundle MCP path assertions

2026-03-20 01:11:58 +00:00

bundle-mcp.ts

fix(ci): stabilize bundle hooks and mcp path seams

2026-03-19 14:26:52 -07:00

bundled-compat.ts

refactor(plugins): share bundled compat transforms

2026-03-16 02:11:18 +00:00

bundled-dir.test.ts

test: remove thread-unsafe cwd mutations

2026-03-22 11:47:28 -07:00

bundled-dir.ts

refactor: move bundled extension deps to plugin packages

2026-03-19 00:04:50 +00:00

bundled-plugin-metadata.generated.ts

perf: generate bundled plugin metadata for cold startup

2026-03-22 21:28:16 +00:00

bundled-plugin-metadata.test.ts

perf: generate bundled plugin metadata for cold startup

2026-03-22 21:28:16 +00:00

bundled-plugin-metadata.ts

perf: generate bundled plugin metadata for cold startup

2026-03-22 21:28:16 +00:00

bundled-plugin-naming.test.ts

ACP: fully rename acpx plugin (#52404)

2026-03-22 19:33:31 +01:00

bundled-provider-auth-env-vars.generated.ts

feat: add Tavily as a bundled web search plugin with search and extract tools (#49200)

2026-03-20 01:06:26 -04:00

bundled-provider-auth-env-vars.test.ts

feat: add Tavily as a bundled web search plugin with search and extract tools (#49200)

2026-03-20 01:06:26 -04:00

bundled-provider-auth-env-vars.ts

Plugins: generate bundled auth env metadata

2026-03-18 10:53:48 -07:00

bundled-runtime-deps.test.ts

refactor: install heavy plugins on demand

2026-03-19 03:37:30 +00:00

bundled-sources.test.ts

Plugins: fix env-aware root resolution and caching (#44046)

2026-03-12 15:31:31 +00:00

bundled-sources.ts

Plugins: fix env-aware root resolution and caching (#44046)

2026-03-12 15:31:31 +00:00

bundled-web-search-ids.ts

fix: trim config validation startup imports (#51574)

2026-03-21 09:31:39 -04:00

bundled-web-search.test.ts

fix: trim config validation startup imports (#51574)

2026-03-21 09:31:39 -04:00

bundled-web-search.ts

fix: trim config validation startup imports (#51574)

2026-03-21 09:31:39 -04:00

captured-registration.ts

feat(plugins): add image generation capability

2026-03-16 22:58:55 -07:00

channel-plugin-ids.test.ts

fix(gateway): follow up startup import reviews (#52337)

2026-03-22 08:48:53 -07:00

channel-plugin-ids.ts

fix(gateway): trim startup plugin imports (#52326)

2026-03-22 08:43:54 -07:00

clawhub.test.ts

refactor(cli): use typed clawhub fallback decisions

2026-03-22 12:02:52 -07:00

clawhub.ts

refactor(cli): use typed clawhub fallback decisions

2026-03-22 12:02:52 -07:00

cli.test.ts

Plugins: fix env-aware root resolution and caching (#44046)

2026-03-12 15:31:31 +00:00

cli.ts

Plugins: fix env-aware root resolution and caching (#44046)

2026-03-12 15:31:31 +00:00

command-registration.ts

refactor: split plugin command registration startup path

2026-03-22 21:28:16 +00:00

command-registry-state.ts

perf: reduce plugin runtime startup overhead

2026-03-22 16:34:09 +00:00

commands.test.ts

test: trim plugin-heavy unit test imports

2026-03-20 18:35:39 +00:00

commands.ts

refactor: split plugin command registration startup path

2026-03-22 21:28:16 +00:00

config-schema.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

config-state.test.ts

feat: add bundled Chutes extension (#49136)

2026-03-17 09:35:21 -07:00

config-state.ts

refactor(web-search): share provider clients and config helpers

2026-03-20 09:30:34 -07:00

conversation-binding.test.ts

test: remove stale plugin registry helper

2026-03-22 23:07:32 +00:00

conversation-binding.ts

refactor: simplify plugin runtime singletons

2026-03-22 18:09:45 +00:00

copy-bundled-plugin-metadata.test.ts

fix: stabilize docker live test lanes

2026-03-22 20:07:27 +00:00

discovery.test.ts

Session management improvements and dashboard API (#50101)

2026-03-19 12:12:30 +09:00

discovery.ts

fix(plugins): distinguish missing entry file from security violation

2026-03-22 16:13:54 -07:00

enable.test.ts

refactor(google): merge gemini auth into google plugin

2026-03-16 01:19:32 +00:00

enable.ts

fix: sync built-in channel enablement across config paths

2026-02-23 19:40:42 +00:00

hook-runner-global.test.ts

plugins: harden global hook runner state (#40184)

2026-03-09 11:20:33 -07:00

hook-runner-global.ts

refactor: simplify plugin runtime singletons

2026-03-22 18:09:45 +00:00

hooks.before-agent-start.test.ts

refactor: dedupe cli config cron and install flows

2026-03-02 19:57:33 +00:00

hooks.model-override-wiring.test.ts

add prependSystemContext and appendSystemContext to before_prompt_build (fixes #35131) (#35177)

2026-03-05 13:06:59 -05:00

hooks.phase-hooks.test.ts

add prependSystemContext and appendSystemContext to before_prompt_build (fixes #35131) (#35177)

2026-03-05 13:06:59 -05:00

hooks.test-helpers.ts

feat(plugins): add image generation capability

2026-03-16 22:58:55 -07:00

hooks.ts

refactor(plugins): share claiming hook loop

2026-03-17 06:24:01 +00:00

http-path.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

http-registry.test.ts

perf: reduce runtime and test startup overhead

2026-03-21 20:18:16 +00:00

http-registry.ts

fix(gateway): pin plugin webhook route registry (#47902)

2026-03-15 21:53:05 -07:00

http-route-overlap.ts

fix(gateway): harden plugin HTTP route auth

2026-03-07 19:55:06 +00:00

install-min-host-version-guardrails.test.ts

build: bump version to 2026.3.22

2026-03-22 11:58:33 -07:00

install-security-scan.runtime.ts

perf: reduce plugin runtime startup overhead

2026-03-22 16:34:09 +00:00

install-security-scan.ts

perf: reduce plugin runtime startup overhead

2026-03-22 16:34:09 +00:00

install.runtime.ts

perf: lazy-load plugin install runtime helpers

2026-03-22 21:52:42 +00:00

install.test.ts

build: bump version to 2026.3.22

2026-03-22 11:58:33 -07:00

install.ts

perf: lazy-load plugin install runtime helpers

2026-03-22 21:52:42 +00:00

installs.test.ts

refactor(channels): dedupe hook and monitor execution paths

2026-02-22 21:19:09 +00:00

installs.ts

refactor: dedupe cli config cron and install flows

2026-03-02 19:57:33 +00:00

interactive-dispatch-adapters.ts

refactor: split plugin interactive dispatch adapters

2026-03-16 05:53:35 +00:00

interactive.test.ts

Fix Discord /codex_resume picker expiration (#51260)

2026-03-21 12:59:21 -04:00

interactive.ts

refactor: simplify plugin runtime singletons

2026-03-22 18:09:45 +00:00

loader.git-path-regression.test.ts

refactor: consolidate plugin sdk surface

2026-03-20 19:24:10 +00:00

loader.test.ts

fix(test): repair main CI drift

2026-03-22 22:12:43 +00:00

loader.ts

perf: reduce plugin runtime startup overhead

2026-03-22 16:34:09 +00:00

logger.test.ts

refactor(plugins): reuse plugin loader logger adapter

2026-02-18 23:48:32 +00:00

logger.ts

refactor(plugins): reuse plugin loader logger adapter

2026-02-18 23:48:32 +00:00

manifest-registry.test.ts

build: bump version to 2026.3.22

2026-03-22 11:58:33 -07:00

manifest-registry.ts

perf: generate bundled plugin metadata for cold startup

2026-03-22 21:28:16 +00:00

manifest.ts

fix(plugins): enforce minimum host versions for installable plugins (#52094)

2026-03-22 09:12:08 -07:00

marketplace.test.ts

fix(ci): resolve Claude marketplace shortcuts from OS home

2026-03-19 09:38:42 -07:00

marketplace.ts

fix(ci): resolve Claude marketplace shortcuts from OS home

2026-03-19 09:38:42 -07:00

min-host-version.test.ts

build: bump version to 2026.3.22

2026-03-22 11:58:33 -07:00

min-host-version.ts

fix(plugins): enforce minimum host versions for installable plugins (#52094)

2026-03-22 09:12:08 -07:00

path-safety.ts

fix(windows): normalize namespaced path containment checks

2026-02-26 18:49:48 +00:00

pi-package-graph.test.ts

test: guard pi package graph alignment

2026-03-19 13:50:26 -05:00

provider-api-key-auth.runtime.ts

refactor: consolidate lazy runtime surfaces

2026-03-17 00:59:20 -07:00

provider-api-key-auth.ts

refactor: consolidate lazy runtime surfaces

2026-03-17 00:59:20 -07:00

provider-auth-choice-helpers.ts

refactor: move provider auth-choice helpers into plugins

2026-03-16 22:40:33 -07:00

provider-auth-choice-preference.ts

refactor: move provider auth-choice helpers into plugins

2026-03-16 22:40:33 -07:00

provider-auth-choice.runtime.ts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

provider-auth-choice.ts

refactor: fix rebase fallout in plugin auth seams

2026-03-16 22:51:46 -07:00

provider-auth-choices.test.ts

fix(onboarding): hide image-only auth providers

2026-03-21 07:42:42 -07:00

provider-auth-choices.ts

fix(onboarding): hide image-only auth providers

2026-03-21 07:42:42 -07:00

provider-auth-helpers.ts

perf(core): trim provider and inbound startup imports (#51927)

2026-03-21 16:20:42 -07:00

provider-auth-input.ts

fix(test): recycle unit-fast CI batches (#51884)

2026-03-21 14:56:29 -07:00

provider-auth-mode.ts

perf: reduce runtime and test startup overhead

2026-03-21 20:18:16 +00:00

provider-auth-ref.ts

perf: reduce runtime and test startup overhead

2026-03-21 20:18:16 +00:00

provider-auth-storage.ts

refactor: add shared provider auth modules

2026-03-16 21:21:17 -07:00

provider-auth-token.ts

refactor: isolate provider sdk auth and model helpers

2026-03-16 21:47:28 -07:00

provider-auth-types.ts

refactor: isolate provider sdk auth and model helpers

2026-03-16 21:47:28 -07:00

provider-catalog-metadata.ts

Models: add native GPT-5.4 mini and nano support (#49289)

2026-03-17 16:21:39 -07:00

provider-catalog.test.ts

feat: add bundled Chutes extension (#49136)

2026-03-17 09:35:21 -07:00

provider-catalog.ts

refactor(providers): share paired api-key catalogs

2026-03-17 04:10:36 +00:00

provider-discovery.test.ts

feat: add bundled Chutes extension (#49136)

2026-03-17 09:35:21 -07:00

provider-discovery.ts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

provider-model-allowlist.ts

refactor: isolate provider sdk auth and model helpers

2026-03-16 21:47:28 -07:00

provider-model-defaults.ts

fix: compaction safeguard summary budget (#27727)

2026-03-21 09:27:51 -07:00

provider-model-definitions.ts

test: fix gate after main drift

2026-03-22 23:00:02 +00:00

provider-model-helpers.test.ts

refactor(providers): share template model cloning

2026-03-17 05:17:51 +00:00

provider-model-helpers.ts

refactor(providers): share template model cloning

2026-03-17 05:17:51 +00:00

provider-model-primary.ts

refactor: isolate provider sdk auth and model helpers

2026-03-16 21:47:28 -07:00

provider-oauth-flow.ts

refactor: isolate provider sdk auth and model helpers

2026-03-16 21:47:28 -07:00

provider-ollama-setup.ts

fix(ollama): don't auto-pull glm-4.7-flash during Local mode onboarding

2026-03-18 18:02:44 -07:00

provider-onboarding-config.ts

refactor: unify plugin sdk primitives

2026-03-18 23:58:56 +00:00

provider-openai-codex-oauth-tls.ts

refactor: isolate provider sdk auth and model helpers

2026-03-16 21:47:28 -07:00

provider-openai-codex-oauth.ts

fix(auth): support remote Codex OAuth manual input (#51631)

2026-03-21 19:40:54 +05:30

provider-runtime.runtime.ts

refactor(plugins): move auth profile hooks into providers

2026-03-15 22:23:55 -07:00

provider-runtime.test-support.ts

Models: add native GPT-5.4 mini and nano support (#49289)

2026-03-17 16:21:39 -07:00

provider-runtime.test.ts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

provider-runtime.ts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

provider-self-hosted-setup.ts

refactor: move plugin sdk setup helpers out of commands

2026-03-16 22:11:56 -07:00

provider-thinking.ts

perf(inbound): trim reply startup imports (#51988)

2026-03-21 20:49:41 -07:00

provider-validation.test.ts

refactor(plugins): simplify provider auth choice metadata

2026-03-15 23:01:12 -07:00

provider-validation.ts

fix(onboarding): hide image-only auth providers

2026-03-21 07:42:42 -07:00

provider-vllm-setup.ts

refactor: move plugin sdk setup helpers out of commands

2026-03-16 22:11:56 -07:00

provider-wizard.test.ts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

provider-wizard.ts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

provider-zai-endpoint.ts

refactor: shrink plugin sdk public surface

2026-03-18 23:31:08 +00:00

providers.runtime.ts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

providers.test.ts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

providers.ts

perf: split provider metadata from runtime loading

2026-03-22 21:52:42 +00:00

registry-empty.ts

perf(test): decouple plugin runtime bootstrap

2026-03-18 11:30:34 +05:30

registry.ts

refactor: split plugin command registration startup path

2026-03-22 21:28:16 +00:00

roots.ts

Plugins: fix env-aware root resolution and caching (#44046)

2026-03-12 15:31:31 +00:00

runtime.test.ts

fix(ci): reset deep test runtime state

2026-03-19 14:23:32 -07:00

runtime.ts

refactor: simplify plugin runtime singletons

2026-03-22 18:09:45 +00:00

schema-validator.test.ts

CLI: dedupe config validate errors and expose allowed values

2026-03-02 20:05:12 -05:00

schema-validator.ts

CLI: dedupe config validate errors and expose allowed values

2026-03-02 20:05:12 -05:00

sdk-alias.test.ts

test: remove thread-unsafe cwd mutations

2026-03-22 11:47:28 -07:00

sdk-alias.ts

perf: reduce plugin and memory startup overhead

2026-03-22 02:11:43 +00:00

services.test.ts

test: stabilize gate regressions

2026-03-18 15:36:32 +00:00

services.ts

Plugins: broaden plugin surface for Codex App Server (#45318)

2026-03-15 16:06:11 -07:00

setup-binary.ts

refactor: move plugin sdk setup helpers out of commands

2026-03-16 22:11:56 -07:00

setup-browser.ts

refactor: move plugin sdk setup helpers out of commands

2026-03-16 22:11:56 -07:00

signal-cli-install.ts

refactor: move plugin sdk setup helpers out of commands

2026-03-16 22:11:56 -07:00

slots.test.ts

refactor(agents): dedupe plugin hooks and test helpers

2026-02-22 07:44:57 +00:00

slots.ts

feature(context): extend plugin system to support custom context management (#22201)

2026-03-06 05:31:59 -08:00

source-display.test.ts

test: harden path resolution test helpers

2026-03-22 22:47:58 +00:00

source-display.ts

Plugins: fix env-aware root resolution and caching (#44046)

2026-03-12 15:31:31 +00:00

stage-bundled-plugin-runtime.test.ts

refactor: move bundled extension deps to plugin packages

2026-03-19 00:04:50 +00:00

status.test.ts

refactor: replace "seam" terminology across codebase

2026-03-18 00:20:15 -07:00

status.ts

Plugins: add LSP server loader and surface in inspect reports

2026-03-18 00:12:24 -07:00

toggle-config.ts

fix: sync built-in channel enablement across config paths

2026-02-23 19:40:42 +00:00

tools.optional.test.ts

fix: stabilize full gate

2026-03-17 07:06:25 +00:00

tools.ts

fix(plugins): late-binding subagent runtime for non-gateway load paths (#46648)

2026-03-16 14:27:54 -07:00

types.ts

docs(plugin-sdk): document public SDK surface

2026-03-22 08:50:48 -07:00

uninstall.test.ts

refactor(test): dedupe repeated fixture setup helpers

2026-02-22 20:04:51 +00:00

uninstall.ts

CLI: add plugins uninstall command (#5985) (openclaw#6141) thanks @JustasMonkev

2026-02-12 20:11:26 -06:00

update.test.ts

feat: add native clawhub install flows

2026-03-22 17:03:49 +00:00

update.ts

refactor(cli): extract hook pack update flow

2026-03-22 12:02:52 -07:00

voice-call.plugin.test.ts

refactor: dedupe bundled plugin entrypoints

2026-03-17 00:14:12 -07:00

web-search-providers.runtime.test.ts

Fix configure cache ownership for plugin resolvers (#52018)

2026-03-21 23:41:45 -05:00

web-search-providers.runtime.ts

Fix configure cache ownership for plugin resolvers (#52018)

2026-03-21 23:41:45 -05:00

web-search-providers.shared.ts

refactor(web-search): share provider clients and config helpers

2026-03-20 09:30:34 -07:00

web-search-providers.test.ts

fix(web-search): split runtime provider resolution

2026-03-20 00:06:12 -07:00

web-search-providers.ts

fix(web-search): split runtime provider resolution

2026-03-20 00:06:12 -07:00

wired-hooks-after-tool-call.e2e.test.ts

refactor(core): extract shared dedup helpers

2026-03-07 10:41:05 +00:00

wired-hooks-compaction.test.ts

fix(hooks): pass sessionFile and sessionKey in after_compaction hook (#40781)

2026-03-17 08:30:37 -07:00

wired-hooks-gateway.test.ts

refactor(test): share plugin hook registry helper

2026-02-15 14:44:15 +00:00

wired-hooks-inbound-claim.test.ts

Plugins: broaden plugin surface for Codex App Server (#45318)

2026-03-15 16:06:11 -07:00

wired-hooks-llm.test.ts

refactor(agent): dedupe harness and command workflows

2026-02-16 14:59:30 +00:00

wired-hooks-message.test.ts

refactor(test): share plugin hook registry helper

2026-02-15 14:44:15 +00:00

wired-hooks-session.test.ts

Plugins: add sessionKey to session lifecycle hooks

2026-03-03 01:48:46 +00:00

wired-hooks-subagent.test.ts

refactor(agents): dedupe plugin hooks and test helpers

2026-02-22 07:44:57 +00:00