mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-23 02:11:11 +00:00
a6a0716486
User-facing name is now OpenClaw (the system speaks); internal code name is system-agent. Gateway methods crestodian.* -> openclaw.chat/openclaw.setup.*, agent tool -> openclaw, reserved agent ids openclaw + retired crestodian. openclaw setup routes: onboarding flags -> onboard, -m/--yes -> system agent, bare configured interactive -> OpenClaw chat, unconfigured -> onboarding. Hidden crestodian CLI and /crestodian TUI aliases kept; docs moved to docs/cli/openclaw.md with redirect stub. macOS/Android strings in lockstep. Refs #107237
20 lines
907 B
TypeScript
20 lines
907 B
TypeScript
import { isOpenClawTrustedPluginInstallSpec } from "../plugins/install-provenance.js";
|
|
|
|
export function validateSystemAgentPluginInstallSpec(spec: string): string | null {
|
|
const trimmed = spec.trim();
|
|
if (!trimmed) {
|
|
return "Plugin install spec is required.";
|
|
}
|
|
if (/\s/.test(trimmed)) {
|
|
return "OpenClaw plugin install accepts one npm or ClawHub package spec.";
|
|
}
|
|
if (/^(?:\.{1,2}\/|\/|~\/|file:|git(?:\+ssh|\+https)?:|https?:)/i.test(trimmed)) {
|
|
// OpenClaw does not install local paths or URLs; those can execute arbitrary package code.
|
|
return "OpenClaw plugin install accepts npm or ClawHub package specs only.";
|
|
}
|
|
if (!isOpenClawTrustedPluginInstallSpec(trimmed)) {
|
|
return "OpenClaw installs only ClawHub, bundled, or official-catalog plugins. Use `openclaw plugins install <spec>` in a trusted shell to review an arbitrary executable source.";
|
|
}
|
|
return null;
|
|
}
|