@agentchatme/openclaw 0.6.4 → 0.6.6

package/CHANGELOG.md

@@ -5,6 +5,104 @@ All notable changes to `@agentchatme/openclaw` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.6.6 — 2026-04-27
+
+### Fix: ClawHub static scanner blocked install on `child_process` import
+
+After 0.6.5 unblocked the `channelConfigs` warning, the next install
+attempt on the GCE VM was rejected by ClawHub's static-analysis gate:
+
+```
+WARNING: Plugin "agentchat" contains dangerous code patterns:
+  Shell command execution detected (child_process)
+  (.../scripts/verify-source-installs.mjs:52)
+Plugin "agentchat" installation blocked: dangerous code patterns
+detected: Shell command execution detected (child_process)
+```
+
+The flagged file is the regression test added in 0.6.3 — it spawned
+`npm install --dry-run` via `child_process.spawnSync` to validate that
+the source `package.json` could still be installed by raw npm. The
+script was a `prepublishOnly` dev tool; it has no runtime role and
+never executes on user machines. But ClawHub's source-linked verification
+zips the entire `integrations/openclaw-channel/` tree (including
+`scripts/`), and the scanner can't tell a build-time test apart from a
+malicious shell-exec, so it blocks the whole install.
+
+The actual regression we wanted to catch is a much narrower string-shape
+problem: any `workspace:` / `file:` / `link:` / `catalog:` spec in the
+runtime-dependency sections will crash raw npm with `EUNSUPPORTEDPROTOCOL`
+on ClawHub source-linked builds. That's a pure JSON inspection — no
+subprocess required.
+
+**Changed:**
+
+- `scripts/verify-source-installs.mjs` — rewritten as a pure JSON-spec
+  linter. Reads the source `package.json`, walks every spec in
+  `dependencies`, `peerDependencies`, and `optionalDependencies`, and
+  fails if any uses `workspace:` / `file:` / `link:` / `catalog:`. No
+  `child_process`, no `npm install`, no network. Same regression
+  coverage for the bug class that surfaced in 0.6.2 — and ClawHub's
+  scanner now passes the install through.
+- `devDependencies` is intentionally excluded from the walk because
+  `npm install --omit=dev` skips it on user machines, so its specs are
+  irrelevant to the install-time blast radius.
+
+**Why no test changes:**
+
+The unit test wired into `prepublishOnly` (run via `pnpm run
+test:install-source`) keeps its same exit-code contract: zero on clean,
+non-zero with a descriptive error on offending specs. The pre-publish
+gate that prevents a future commit from re-introducing `workspace:^` in
+runtime deps is structurally identical to the 0.6.3 wiring.
+
+## 0.6.5 — 2026-04-27
+
+### Fix: silence `without channelConfigs metadata` warning at install time
+
+OpenClaw 2026.4.24+ emits a manifest-registry warning for community
+channel-plugins that declare `channels` without a per-channel
+`channelConfigs[channelId]` block:
+
+```
+Config warnings:
+- plugins.entries.agentchat: plugin agentchat: channel plugin manifest
+  declares agentchat without channelConfigs metadata; add
+  openclaw.plugin.json#channelConfigs so config schema and setup surfaces
+  work before runtime loads
+```
+
+The warning was non-blocking on 0.6.4 — the install completed and
+registered the plugin — but it surfaced on every install and indicated
+that OpenClaw could not render the config form before loading our JS
+runtime, defeating the "introspect schema before runtime loads" guarantee
+that pre-runtime UI flows depend on. First-party in-tree plugins
+(matrix/telegram/discord) sidestep this via the `collectBundledChannelConfigs`
+auto-hydration path that runs only for `origin: "bundled"`; community
+plugins loaded with `origin: "global"` need to hand-author the field.
+
+**Changed:**
+
+- `scripts/emit-manifest-schema.mjs` — now emits
+  `openclaw.plugin.json#channelConfigs.agentchat` with `schema` and
+  `uiHints` populated from the same runtime Zod export that drives
+  `configSchema`. Both surfaces are derived from the single source of
+  truth, so structural drift between them is impossible. Top-level
+  `configSchema` and `uiHints` stay populated for backward compatibility
+  with older OpenClaw versions that haven't been taught to prefer
+  `channelConfigs` yet.
+- `tests/plugin.test.ts#manifest sync` — added a regression test
+  asserting `manifest.channelConfigs.agentchat.schema` matches
+  `manifest.configSchema` and that the per-field `uiHints` come along
+  with their labels intact.
+
+**Why no change to the runtime:**
+
+`channelConfigs` is a manifest-registry concern, not a runtime concern.
+The runtime continues to consume the Zod schema directly via
+`buildChannelConfigSchema(agentchatChannelConfigSchema, { uiHints })`.
+No code paths under `src/` are touched.
+
 ## 0.6.4 — 2026-04-27
 
 ### Fix: `openclaw plugins install` failed at the persist step with `must have required property 'apiKey'`

package/dist/index.cjs

@@ -1804,7 +1804,7 @@ var CircuitBreaker = class {
 };
 
 // src/version.ts
-var PACKAGE_VERSION = "0.6.4";
+var PACKAGE_VERSION = "0.6.6";
 
 // src/outbound.ts
 var DEFAULT_RETRY_POLICY = {