@agentchatme/openclaw 0.6.5 → 0.6.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +51 -0
- package/dist/index.cjs +1 -1
- package/dist/index.cjs.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/setup-entry.cjs +1 -1
- package/dist/setup-entry.cjs.map +1 -1
- package/dist/setup-entry.js +1 -1
- package/dist/setup-entry.js.map +1 -1
- package/openclaw.plugin.json +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,57 @@ All notable changes to `@agentchatme/openclaw` are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
|
|
6
6
|
this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## 0.6.6 — 2026-04-27
|
|
9
|
+
|
|
10
|
+
### Fix: ClawHub static scanner blocked install on `child_process` import
|
|
11
|
+
|
|
12
|
+
After 0.6.5 unblocked the `channelConfigs` warning, the next install
|
|
13
|
+
attempt on the GCE VM was rejected by ClawHub's static-analysis gate:
|
|
14
|
+
|
|
15
|
+
```
|
|
16
|
+
WARNING: Plugin "agentchat" contains dangerous code patterns:
|
|
17
|
+
Shell command execution detected (child_process)
|
|
18
|
+
(.../scripts/verify-source-installs.mjs:52)
|
|
19
|
+
Plugin "agentchat" installation blocked: dangerous code patterns
|
|
20
|
+
detected: Shell command execution detected (child_process)
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
The flagged file is the regression test added in 0.6.3 — it spawned
|
|
24
|
+
`npm install --dry-run` via `child_process.spawnSync` to validate that
|
|
25
|
+
the source `package.json` could still be installed by raw npm. The
|
|
26
|
+
script was a `prepublishOnly` dev tool; it has no runtime role and
|
|
27
|
+
never executes on user machines. But ClawHub's source-linked verification
|
|
28
|
+
zips the entire `integrations/openclaw-channel/` tree (including
|
|
29
|
+
`scripts/`), and the scanner can't tell a build-time test apart from a
|
|
30
|
+
malicious shell-exec, so it blocks the whole install.
|
|
31
|
+
|
|
32
|
+
The actual regression we wanted to catch is a much narrower string-shape
|
|
33
|
+
problem: any `workspace:` / `file:` / `link:` / `catalog:` spec in the
|
|
34
|
+
runtime-dependency sections will crash raw npm with `EUNSUPPORTEDPROTOCOL`
|
|
35
|
+
on ClawHub source-linked builds. That's a pure JSON inspection — no
|
|
36
|
+
subprocess required.
|
|
37
|
+
|
|
38
|
+
**Changed:**
|
|
39
|
+
|
|
40
|
+
- `scripts/verify-source-installs.mjs` — rewritten as a pure JSON-spec
|
|
41
|
+
linter. Reads the source `package.json`, walks every spec in
|
|
42
|
+
`dependencies`, `peerDependencies`, and `optionalDependencies`, and
|
|
43
|
+
fails if any uses `workspace:` / `file:` / `link:` / `catalog:`. No
|
|
44
|
+
`child_process`, no `npm install`, no network. Same regression
|
|
45
|
+
coverage for the bug class that surfaced in 0.6.2 — and ClawHub's
|
|
46
|
+
scanner now passes the install through.
|
|
47
|
+
- `devDependencies` is intentionally excluded from the walk because
|
|
48
|
+
`npm install --omit=dev` skips it on user machines, so its specs are
|
|
49
|
+
irrelevant to the install-time blast radius.
|
|
50
|
+
|
|
51
|
+
**Why no test changes:**
|
|
52
|
+
|
|
53
|
+
The unit test wired into `prepublishOnly` (run via `pnpm run
|
|
54
|
+
test:install-source`) keeps its same exit-code contract: zero on clean,
|
|
55
|
+
non-zero with a descriptive error on offending specs. The pre-publish
|
|
56
|
+
gate that prevents a future commit from re-introducing `workspace:^` in
|
|
57
|
+
runtime deps is structurally identical to the 0.6.3 wiring.
|
|
58
|
+
|
|
8
59
|
## 0.6.5 — 2026-04-27
|
|
9
60
|
|
|
10
61
|
### Fix: silence `without channelConfigs metadata` warning at install time
|