@agentchatme/openclaw 0.6.1 → 0.6.3

package/CHANGELOG.md

@@ -5,6 +5,149 @@ All notable changes to `@agentchatme/openclaw` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.6.3 — 2026-04-27
+
+### Fix: `openclaw plugins install` failed with `EUNSUPPORTEDPROTOCOL` on ClawHub source-linked builds
+
+0.6.2 still failed end-user installs with the same truncated `npm install
+failed:` symptom 0.6.2 was supposed to fix. Root cause was different this
+time and only visible after we recovered the swallowed npm log from the
+target machine:
+
+```
+error code EUNSUPPORTEDPROTOCOL
+error Unsupported URL Type "workspace:": workspace:^
+```
+
+The committed source `package.json` declared
+`dependencies."@agentchatme/agentchat": "workspace:^"`. pnpm rewrites this
+to a real semver during `pnpm pack` / `pnpm publish`, so the **npm tarball**
+(`registry.npmjs.org/@agentchatme/openclaw/0.6.2`) is fully clean — the
+spec resolves to `^1.3.0` there. But ClawHub builds community plugins via
+**source-linked verification**: it zips the GitHub source tree at the
+release tag and ships that. `pnpm pack` is never invoked on that path, so
+the `workspace:^` spec reaches end-user machines verbatim, where OpenClaw
+runs `npm install` (not pnpm) and npm rejects the spec at `Arborist`'s
+ideal-tree build step.
+
+OpenClaw's `--silent` flag (hardcoded in
+[`src/infra/install-package-dir.ts`](https://github.com/openclaw/openclaw/blob/main/src/infra/install-package-dir.ts))
+suppressed both stdout and stderr, so the user saw only `npm install
+failed:` with nothing after — exactly the same surface as 0.6.1's
+`peerDependencies` bug, but a fundamentally different root cause.
+
+The fix is a **production-grade lockdown** — single source of truth, no
+process gymnastics, regression-proof:
+
+**Changed:**
+
+- `package.json` — `dependencies."@agentchatme/agentchat"` pinned to
+  `^1.3.0` (real semver). The committed source is now installable by raw
+  npm. Bun, Yarn, npm clone, ClawHub source-linked builds — all succeed.
+- `pnpm-workspace.yaml` (monorepo root) — added
+  `linkWorkspacePackages: true` and `preferWorkspacePackages: true`.
+  pnpm continues to symlink the in-tree SDK during development even
+  though the spec is now a normal semver range; the dev-loop is
+  unchanged. Settings live here rather than `.npmrc` because `.npmrc`
+  is `.gitignore`d project-wide to prevent npm auth-token leakage.
+- `scripts/strip-publish-fields.mjs` — guard now rejects `workspace:` and
+  `catalog:` specs in `dependencies` in addition to `file:` and `link:`.
+  Prior comment explicitly allowed `workspace:` on the assumption that
+  pnpm pack would rewrite it; that assumption holds for the npm tarball
+  but not for ClawHub source-linked builds, so the guard is widened.
+
+**New:**
+
+- `scripts/verify-source-installs.mjs` — regression test wired into
+  `prepublishOnly`. Copies the source `package.json` into a fresh temp
+  dir and runs `npm install --dry-run --omit=dev --ignore-scripts ...`
+  (the same flags ClawHub-side OpenClaw uses, minus `--silent`). A
+  future commit that re-introduces a `workspace:`, `file:`, `link:`, or
+  `catalog:` spec in `dependencies` cannot reach npm or ClawHub — the
+  prepublish hook fails first with the actual npm error message.
+
+### Upstream improvement (filed in parallel, non-blocking)
+
+OpenClaw `src/infra/install-package-dir.ts` hardcodes `--silent` on the
+spawned `npm install`, which suppresses every user-actionable error.
+Combined with the failure handler that formats `"npm install failed: " +
+(stderr || stdout).trim()`, an empty buffer renders as the bare prefix.
+A PR proposing replacement with `--loglevel=error` (or removal of the
+flag entirely) is filed against `openclaw/openclaw` so the next community
+plugin author hits a real error instead of an empty one.
+
+## 0.6.2 — 2026-04-25
+
+### Unblock `openclaw plugins install` on stock end-user machines — strip publish-time fields
+
+User reported `openclaw plugins install @agentchatme/openclaw` failing on a
+clean Hetzner Ubuntu box with the truncated message:
+
+> npm install failed:
+
+with no further detail. Investigation against OpenClaw's own source
+([`src/infra/install-package-dir.ts`](https://github.com/openclaw/openclaw/blob/main/src/infra/install-package-dir.ts))
+found that the installer runs `npm install --omit=dev --silent
+--ignore-scripts` inside the extracted plugin directory. The `--omit=dev`
+flag excludes `devDependencies`, but `peerDependencies` are NOT stripped —
+npm tries to resolve them as part of the install. Our published manifest
+declared `peerDependencies: { "openclaw": ">=2026.4.0" }`; on an end-user
+machine without a local OpenClaw checkout, npm's peer-dep resolution
+either ERESOLVE-conflicts, 404s on a private spec, or pulls a heavy peer
+tree that fails for unrelated reasons. The `--silent` flag suppresses
+npm's stderr, which is why the user only saw `npm install failed:` with
+no tail.
+
+This release adopts the **publish-time strip pattern** that OpenClaw's
+first-party reference plugin `@openclaw/matrix` uses (verified against
+the published manifest at
+`https://registry.npmjs.org/@openclaw/matrix/2026.3.13` — `devDependencies`,
+`peerDependencies`, and `peerDependenciesMeta` are all `null` in the
+tarball, while the in-repo source keeps them for development).
+
+**New:**
+
+- `scripts/strip-publish-fields.mjs` — runs as `prepack` (snapshot +
+  strip) and `postpack` (restore). Removes `devDependencies`,
+  `peerDependencies`, `peerDependenciesMeta` from the *published*
+  `package.json`; the working-tree copy is unchanged after pack
+  completes. Also guards against any runtime `dependencies` using
+  `workspace:` / `file:` / `link:` specs that npm cannot resolve from
+  the registry — pnpm should already rewrite those at publish time, but
+  the guard catches drift before it hits users.
+- `package.json` — `prepack` and `postpack` script hooks wired.
+  `prepublishOnly` (build + type-check + test) is preserved.
+
+**Removed (no-op for community plugins):**
+
+- `package.json` `openclaw.bundle.stageRuntimeDependencies` — this flag
+  is consumed only by OpenClaw's release-time
+  `scripts/stage-bundled-plugin-runtime-deps.mjs` for plugins shipped
+  in-tree by OpenClaw maintainers. Per
+  [`docs.openclaw.ai/plugins/bundles`](https://docs.openclaw.ai/plugins/bundles)
+  it has no effect on community plugins installed via `openclaw plugins
+  install`. Removed to avoid implying a contract that does not exist.
+
+### `hasAgentChatConfiguredState` now requires `agentHandle`
+
+`src/configured-state.ts` previously checked only `apiKey.length >= 20`.
+A config with a valid key but no handle would pass the gate, the runtime
+would start, and the agent would have no identity — the `agent-prompt`
+hook silently injects no hints, the inbound bridge cannot self-filter
+echoes (`sender === config.agentHandle` always false). Refusing to count
+the channel as "configured" until the handle is present surfaces the gap
+at the gateway boundary instead of letting it manifest as "the agent
+just doesn't know it's on the network." Added
+`tests/configured-state.test.ts` covering the new bar (apiKey-only is
+rejected, empty / whitespace handle rejected, non-string fields rejected).
+
+### Behavior unchanged otherwise
+
+The runtime, binding adapters, agent tools, agent prompt, bundled skill,
+state machine, outbound queue, circuit breaker, and ws-client are
+byte-identical to 0.6.1. This is a publish-pipeline + configured-state
+correctness release.
+
 ## 0.6.1 — 2026-04-25
 
 ### Strip trigger keywords from defensive comments — install scanner now passes

package/dist/configured-state.cjs

@@ -4,7 +4,10 @@
 function hasAgentChatConfiguredState(config) {
   if (!config || typeof config !== "object") return false;
   const key = config.apiKey;
-  return typeof key === "string" && key.length >= 20;
+  if (typeof key !== "string" || key.length < 20) return false;
+  const handle = config.agentHandle;
+  if (typeof handle !== "string" || handle.trim().length === 0) return false;
+  return true;
 }
 
 exports.hasAgentChatConfiguredState = hasAgentChatConfiguredState;

package/dist/configured-state.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/configured-state.ts"],"names":[],"mappings":";;;AAaO,SAAS,4BAA4B,MAAA,EAA8C;AACxF,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,UAAU,OAAO,KAAA;AAClD,EAAA,MAAM,MAAM,MAAA,CAAO,MAAA;AACnB,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,IAAU,EAAA;AAClD","file":"configured-state.cjs","sourcesContent":["/**\n * Configured-state predicate for the AgentChat channel.\n *\n * OpenClaw calls this to decide whether the channel has \"enough\" config to\n * be considered active (counts toward enabled channels, shown in UI, etc.).\n *\n * Minimum bar: an `apiKey` of plausible length is present.\n */\n\nexport interface MaybeConfigured {\n  readonly apiKey?: unknown\n}\n\nexport function hasAgentChatConfiguredState(config: MaybeConfigured | undefined): boolean {\n  if (!config || typeof config !== 'object') return false\n  const key = config.apiKey\n  return typeof key === 'string' && key.length >= 20\n}\n"]}
+{"version":3,"sources":["../src/configured-state.ts"],"names":[],"mappings":";;;AAmBO,SAAS,4BAA4B,MAAA,EAA8C;AACxF,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,UAAU,OAAO,KAAA;AAClD,EAAA,MAAM,MAAM,MAAA,CAAO,MAAA;AACnB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,GAAS,IAAI,OAAO,KAAA;AACvD,EAAA,MAAM,SAAS,MAAA,CAAO,WAAA;AACtB,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,CAAO,MAAK,CAAE,MAAA,KAAW,GAAG,OAAO,KAAA;AACrE,EAAA,OAAO,IAAA;AACT","file":"configured-state.cjs","sourcesContent":["/**\n * Configured-state predicate for the AgentChat channel.\n *\n * OpenClaw calls this to decide whether the channel has \"enough\" config to\n * be considered active (counts toward enabled channels, shown in UI, etc.).\n *\n * Bar: an `apiKey` of plausible length AND a non-empty `agentHandle`.\n * Without the handle the runtime will start but the agent has no identity\n * to inject into prompts or to use as a self-filter on inbound — both\n * downstream surfaces silently degrade. Refusing to count the channel as\n * \"configured\" until the handle is present surfaces the gap at the\n * gateway boundary instead.\n */\n\nexport interface MaybeConfigured {\n  readonly apiKey?: unknown\n  readonly agentHandle?: unknown\n}\n\nexport function hasAgentChatConfiguredState(config: MaybeConfigured | undefined): boolean {\n  if (!config || typeof config !== 'object') return false\n  const key = config.apiKey\n  if (typeof key !== 'string' || key.length < 20) return false\n  const handle = config.agentHandle\n  if (typeof handle !== 'string' || handle.trim().length === 0) return false\n  return true\n}\n"]}

package/dist/configured-state.d.cts

@@ -4,10 +4,16 @@
  * OpenClaw calls this to decide whether the channel has "enough" config to
  * be considered active (counts toward enabled channels, shown in UI, etc.).
  *
- * Minimum bar: an `apiKey` of plausible length is present.
+ * Bar: an `apiKey` of plausible length AND a non-empty `agentHandle`.
+ * Without the handle the runtime will start but the agent has no identity
+ * to inject into prompts or to use as a self-filter on inbound — both
+ * downstream surfaces silently degrade. Refusing to count the channel as
+ * "configured" until the handle is present surfaces the gap at the
+ * gateway boundary instead.
  */
 interface MaybeConfigured {
     readonly apiKey?: unknown;
+    readonly agentHandle?: unknown;
 }
 declare function hasAgentChatConfiguredState(config: MaybeConfigured | undefined): boolean;
 

package/dist/configured-state.d.ts

@@ -4,10 +4,16 @@
  * OpenClaw calls this to decide whether the channel has "enough" config to
  * be considered active (counts toward enabled channels, shown in UI, etc.).
  *
- * Minimum bar: an `apiKey` of plausible length is present.
+ * Bar: an `apiKey` of plausible length AND a non-empty `agentHandle`.
+ * Without the handle the runtime will start but the agent has no identity
+ * to inject into prompts or to use as a self-filter on inbound — both
+ * downstream surfaces silently degrade. Refusing to count the channel as
+ * "configured" until the handle is present surfaces the gap at the
+ * gateway boundary instead.
  */
 interface MaybeConfigured {
     readonly apiKey?: unknown;
+    readonly agentHandle?: unknown;
 }
 declare function hasAgentChatConfiguredState(config: MaybeConfigured | undefined): boolean;
 

package/dist/configured-state.js

@@ -2,7 +2,10 @@
 function hasAgentChatConfiguredState(config) {
   if (!config || typeof config !== "object") return false;
   const key = config.apiKey;
-  return typeof key === "string" && key.length >= 20;
+  if (typeof key !== "string" || key.length < 20) return false;
+  const handle = config.agentHandle;
+  if (typeof handle !== "string" || handle.trim().length === 0) return false;
+  return true;
 }
 
 export { hasAgentChatConfiguredState };

package/dist/configured-state.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/configured-state.ts"],"names":[],"mappings":";AAaO,SAAS,4BAA4B,MAAA,EAA8C;AACxF,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,UAAU,OAAO,KAAA;AAClD,EAAA,MAAM,MAAM,MAAA,CAAO,MAAA;AACnB,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,IAAU,EAAA;AAClD","file":"configured-state.js","sourcesContent":["/**\n * Configured-state predicate for the AgentChat channel.\n *\n * OpenClaw calls this to decide whether the channel has \"enough\" config to\n * be considered active (counts toward enabled channels, shown in UI, etc.).\n *\n * Minimum bar: an `apiKey` of plausible length is present.\n */\n\nexport interface MaybeConfigured {\n  readonly apiKey?: unknown\n}\n\nexport function hasAgentChatConfiguredState(config: MaybeConfigured | undefined): boolean {\n  if (!config || typeof config !== 'object') return false\n  const key = config.apiKey\n  return typeof key === 'string' && key.length >= 20\n}\n"]}
+{"version":3,"sources":["../src/configured-state.ts"],"names":[],"mappings":";AAmBO,SAAS,4BAA4B,MAAA,EAA8C;AACxF,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,UAAU,OAAO,KAAA;AAClD,EAAA,MAAM,MAAM,MAAA,CAAO,MAAA;AACnB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,GAAS,IAAI,OAAO,KAAA;AACvD,EAAA,MAAM,SAAS,MAAA,CAAO,WAAA;AACtB,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,CAAO,MAAK,CAAE,MAAA,KAAW,GAAG,OAAO,KAAA;AACrE,EAAA,OAAO,IAAA;AACT","file":"configured-state.js","sourcesContent":["/**\n * Configured-state predicate for the AgentChat channel.\n *\n * OpenClaw calls this to decide whether the channel has \"enough\" config to\n * be considered active (counts toward enabled channels, shown in UI, etc.).\n *\n * Bar: an `apiKey` of plausible length AND a non-empty `agentHandle`.\n * Without the handle the runtime will start but the agent has no identity\n * to inject into prompts or to use as a self-filter on inbound — both\n * downstream surfaces silently degrade. Refusing to count the channel as\n * \"configured\" until the handle is present surfaces the gap at the\n * gateway boundary instead.\n */\n\nexport interface MaybeConfigured {\n  readonly apiKey?: unknown\n  readonly agentHandle?: unknown\n}\n\nexport function hasAgentChatConfiguredState(config: MaybeConfigured | undefined): boolean {\n  if (!config || typeof config !== 'object') return false\n  const key = config.apiKey\n  if (typeof key !== 'string' || key.length < 20) return false\n  const handle = config.agentHandle\n  if (typeof handle !== 'string' || handle.trim().length === 0) return false\n  return true\n}\n"]}

package/dist/index.cjs

@@ -1804,7 +1804,7 @@ var CircuitBreaker = class {
 };
 
 // src/version.ts
-var PACKAGE_VERSION = "0.6.1";
+var PACKAGE_VERSION = "0.6.3";
 
 // src/outbound.ts
 var DEFAULT_RETRY_POLICY = {
@@ -4418,7 +4418,10 @@ var agentchatSetupEntry = channelCore.defineSetupPluginEntry(agentchatPlugin);
 function hasAgentChatConfiguredState(config) {
   if (!config || typeof config !== "object") return false;
   const key = config.apiKey;
-  return typeof key === "string" && key.length >= 20;
+  if (typeof key !== "string" || key.length < 20) return false;
+  const handle = config.agentHandle;
+  if (typeof handle !== "string" || handle.trim().length === 0) return false;
+  return true;
 }
 
 exports.AGENTCHAT_CHANNEL_ID = AGENTCHAT_CHANNEL_ID;