mirror of https://github.com/openclaw/openclaw.git synced 2026-08-03 19:41:33 +00:00

Files

Peter Steinberger f6131a4fbf build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks (#114006 )

* build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks

npm 12 removed shrinkwrap (command + tarball/root loading). Delete all 82
committed npm-shrinkwrap.json files and stop publishing lockfiles; keep
pnpm-lock.yaml as the single reviewed dependency boundary. The generator
becomes scripts/generate-npm-package-lock.mjs and feeds plugin bundling via
a transient package-lock.json + npm ci (works on npm 11 and 12). Tarball
validation treats the published 2026.7.2 beta train as a shrinkwrap
transition; self-update npm detection now uses install topology instead of
the shipped shrinkwrap.

* fix(deps): repair lint, deadcode, and test-type lanes for the npm 12 migration

- sort integrity comparisons with an explicit comparator (oxlint)
- keep resolveBunGlobalNodeModules module-local (knip unused-export gate)
- model npm pack --json as npm<=11 array / npm 12 name-keyed object
- default calver destructuring in the tarball test fixture

2026-07-26 01:29:55 -04:00

src

refactor(schemas): use TypeBox native enums

2026-07-14 04:25:58 -07:00

index.ts

…

openclaw.plugin.json

…

package.json

chore(deps): refresh repository dependencies (#112453 )

2026-07-23 16:17:13 +00:00

README.md

…

runtime-api.ts

…

SKILL.md

…

tsconfig.json

…

README.md

Lobster (plugin)

Adds the lobster agent tool as an optional plugin tool.

Install

openclaw plugins install @openclaw/lobster

Restart the Gateway after installing or updating the plugin.

What this is

Lobster is a standalone workflow shell (typed JSON-first pipelines + approvals/resume).
This plugin integrates Lobster with OpenClaw without core changes.

Enable

Because this tool can trigger side effects (via workflows), it is registered with optional: true.

Enable it in an agent allowlist:

{
  "agents": {
    "list": [
      {
        "id": "main",
        "tools": {
          "allow": [
            "lobster" // plugin id (enables all tools from this plugin)
          ]
        }
      }
    ]
  }
}

Using `openclaw.invoke` (Lobster → OpenClaw tools)

Some Lobster pipelines may include a openclaw.invoke step to call back into OpenClaw tools/plugins (for example: gog for Google Workspace, gh for GitHub, message.send, etc.).

For this to work, the OpenClaw Gateway must expose the tool bridge endpoint and the target tool must be allowed by policy:

OpenClaw provides an HTTP endpoint: POST /tools/invoke.
The request is gated by gateway auth (e.g. Authorization: Bearer … when token auth is enabled).
The invoked tool is gated by tool policy (global + per-agent + provider + group policy). If the tool is not allowed, OpenClaw returns 404 Tool not available.

Allowlisting recommended

To avoid letting workflows call arbitrary tools, set a tight allowlist on the agent that will be used by openclaw.invoke.

Example (allow only a small set of tools):

{
  "agents": {
    "list": [
      {
        "id": "main",
        "tools": {
          "allow": ["lobster", "web_fetch", "web_search", "gog", "gh"],
          "deny": ["gateway"],
        },
      },
    ],
  },
}

Notes:

If tools.allow is omitted or empty, it behaves like "allow everything (except denied)". For a real allowlist, set a non-empty allow.
Tool names depend on which plugins you have installed/enabled.

Security

Runs Lobster in process via the published @clawdbot/lobster/core runtime.
Does not manage OAuth/tokens.
Uses timeouts, stdout caps, and strict JSON envelope parsing.

Docs

https://docs.openclaw.ai/tools/lobster

Package

Plugin id: lobster
Tool: lobster
Package: @openclaw/lobster
Minimum OpenClaw host: 2026.4.25

README.md

Lobster (plugin)

Install

What this is

Enable

Using openclaw.invoke (Lobster → OpenClaw tools)

Allowlisting recommended

Security

Docs

Package

Using `openclaw.invoke` (Lobster → OpenClaw tools)