@openclaw/plugin-inspector 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.2.0 - 2026-04-27
+
+### Added
+
+- Add package.json `pluginInspector` config discovery for plugin-root checks.
+- Add `plugin-inspector config` for resolved plugin-root config summaries.
+- Add author-facing `plugin-inspector inspect` plugin-root flow.
+- Add CI-native SARIF and JUnit outputs; `plugin-inspector ci` writes them by default.
+
+### Changed
+
+- Make generated CI workflows use one `plugin-inspector ci --no-openclaw --runtime --mock-sdk` command.
+- Harden runtime capture for string handler registrations, parse-capable config schema helpers, and provider auth/catalog SDK mocks.
+
 ## 0.1.3 - 2026-04-27
 
 ### Added

package/README.md

@@ -35,17 +35,39 @@ npx plugin-inspector check
 
 ```bash
 npx @openclaw/plugin-inspector check
+npx @openclaw/plugin-inspector inspect
+npx @openclaw/plugin-inspector ci --no-openclaw
+npx @openclaw/plugin-inspector config
 npx @openclaw/plugin-inspector check --plugin-root ./plugins/weather
 npx @openclaw/plugin-inspector init --ci --package-manager pnpm
 ```
 
-`check` reads the current directory as one plugin unless `--plugin-root` is set.
-It writes:
+`check` and `inspect` read the current directory as one plugin unless
+`--plugin-root` is set. `inspect` is the friendly author-facing alias; `check`
+is kept for scripts. Both write:
 
 - `reports/plugin-inspector-report.json`
 - `reports/plugin-inspector-report.md`
 - `reports/plugin-inspector-issues.md`
 
+Use CI-native outputs when you want annotations or test-summary ingestion:
+
+```bash
+plugin-inspector inspect --no-openclaw --sarif --junit
+```
+
+That also writes:
+
+- `reports/plugin-inspector.sarif`
+- `reports/plugin-inspector.junit.xml`
+
+`config` prints the resolved plugin root, fixture id, seams, and capture
+settings before CI runs:
+
+```bash
+plugin-inspector config --json
+```
+
 Use `--no-openclaw` when CI should not compare against a local OpenClaw
 checkout:
 
@@ -53,8 +75,9 @@ checkout:
 plugin-inspector check --no-openclaw
 ```
 
-Use `plugin-inspector.config.json` when CI needs stable fixture metadata,
-expected seams, or runtime capture defaults:
+Use either `plugin-inspector.config.json` or a `package.json`
+`pluginInspector` block when CI needs stable fixture metadata, expected seams,
+or runtime capture defaults:
 
 ```json
 {
@@ -83,9 +106,32 @@ Then run:
 plugin-inspector check --config plugin-inspector.config.json
 ```
 
+For a single plugin package, the same config can live in `package.json`:
+
+```json
+{
+  "scripts": {
+    "plugin:check": "plugin-inspector inspect --no-openclaw"
+  },
+  "pluginInspector": {
+    "version": 1,
+    "plugin": {
+      "id": "weather",
+      "priority": "high",
+      "seams": ["dynamic-tool"],
+      "sourceRoot": "src"
+    },
+    "capture": {
+      "mockSdk": true
+    }
+  }
+}
+```
+
 `init --ci` writes this shape for you, plus
 `.github/workflows/plugin-inspector.yml`. Copy-ready examples also live in
 `examples/plugin-inspector.config.json` and
+`examples/package-json-plugin-inspector.json` and
 `examples/github-actions-plugin-inspector.yml`.
 
 ## Runtime Capture
@@ -121,8 +167,8 @@ Minimal package scripts:
 ```json
 {
   "scripts": {
-    "plugin:check": "plugin-inspector check --no-openclaw",
-    "plugin:check:runtime": "PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 plugin-inspector check --no-openclaw --runtime --mock-sdk"
+    "plugin:check": "plugin-inspector inspect --no-openclaw",
+    "plugin:ci": "PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 plugin-inspector ci --no-openclaw --runtime --mock-sdk"
   }
 }
 ```
@@ -147,8 +193,7 @@ jobs:
           node-version: 24
           cache: npm
       - run: npm ci
-      - run: npx @openclaw/plugin-inspector check --no-openclaw
-      - run: PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 npx @openclaw/plugin-inspector check --no-openclaw --runtime --mock-sdk
+      - run: PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 npx @openclaw/plugin-inspector ci --no-openclaw --runtime --mock-sdk
       - uses: actions/upload-artifact@v5
         if: always()
         with:
@@ -156,6 +201,9 @@ jobs:
           path: reports/plugin-inspector-*
 ```
 
+`ci` writes the normal report, CI summary, SARIF, and JUnit files by default.
+Pass `--no-sarif` or `--no-junit` only if your CI surface cannot consume them.
+
 ## Fixture Suites
 
 Fixture-set configs are still supported for crabpot-style compatibility suites:

package/examples/github-actions-plugin-inspector.yml

@@ -15,8 +15,7 @@ jobs:
           node-version: 24
           cache: npm
       - run: npm ci
-      - run: npx @openclaw/plugin-inspector check --no-openclaw
-      - run: PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 npx @openclaw/plugin-inspector check --no-openclaw --runtime --mock-sdk
+      - run: PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 npx @openclaw/plugin-inspector ci --no-openclaw --runtime --mock-sdk
       - uses: actions/upload-artifact@v5
         if: always()
         with:

package/examples/package-json-plugin-inspector.json

@@ -0,0 +1,21 @@
+{
+  "scripts": {
+    "plugin:check": "plugin-inspector inspect --no-openclaw",
+    "plugin:ci": "PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 plugin-inspector ci --no-openclaw --runtime --mock-sdk"
+  },
+  "pluginInspector": {
+    "version": 1,
+    "plugin": {
+      "id": "weather",
+      "priority": "high",
+      "seams": ["dynamic-tool"],
+      "sourceRoot": "src",
+      "expect": {
+        "registrations": ["registerTool"]
+      }
+    },
+    "capture": {
+      "mockSdk": true
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/plugin-inspector",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "private": false,
   "description": "Offline compatibility inspector for OpenClaw plugins.",
   "type": "module",

package/src/advanced.js

@@ -33,6 +33,14 @@ export {
   renderCiSummaryMarkdown,
   writeCiSummary,
 } from "./ci-summary.js";
+export {
+  buildSarifReport,
+  defaultJunitPath,
+  defaultSarifPath,
+  renderJunitXml,
+  reportFindings,
+  writeCiOutputArtifacts,
+} from "./ci-outputs.js";
 export {
   buildContractProbes,
   contractProbeRules,
@@ -122,6 +130,7 @@ export {
   loadPluginRootConfig,
   normalizeInspectorConfig,
   normalizePluginRootConfig,
+  packageJsonConfigKeys,
   packageId,
   validateInspectorConfig,
 } from "./config.js";

package/src/api.js

@@ -4,6 +4,7 @@ import { loadInspectorConfig, loadPluginRootConfig } from "./config.js";
 import { writePluginInspectorInit } from "./init.js";
 import { captureEntrypoint } from "./inspector.js";
 import { renderTextSummary, writeCompatibilityReport } from "./report.js";
+import { writeCiOutputArtifacts } from "./ci-outputs.js";
 import { buildRuntimeCaptureReport, writeRuntimeCaptureReport } from "./runtime-capture-report.js";
 import { inspectCompatibilityFixtureSet, inspectFixtureSet } from "./inspector.js";
 
@@ -88,4 +89,4 @@ export async function setupPluginInspector(options = {}) {
   return writePluginInspectorInit(options);
 }
 
-export { createCaptureApi, renderTextSummary };
+export { createCaptureApi, renderTextSummary, writeCiOutputArtifacts };

package/src/capture-api.js

@@ -223,6 +223,7 @@ function createStoreContext() {
 
 function registrationObject(args, defaults) {
   const first = args[0];
+  const callable = firstCallable(args);
   if (first && typeof first === "object") {
     return {
       ...defaults,
@@ -232,13 +233,29 @@ function registrationObject(args, defaults) {
     };
   }
   if (typeof first === "string") {
-    return {
+    return withCallableDefaults({
       ...defaults,
       name: first,
       id: defaults.id,
-    };
+    }, callable);
   }
-  return { ...defaults };
+  return withCallableDefaults({ ...defaults }, callable);
+}
+
+function firstCallable(args) {
+  return args.find((arg) => typeof arg === "function");
+}
+
+function withCallableDefaults(value, callable) {
+  if (!callable) {
+    return value;
+  }
+  return {
+    ...value,
+    handler: typeof value.handler === "function" ? value.handler : callable,
+    run: typeof value.run === "function" ? value.run : callable,
+    execute: typeof value.execute === "function" ? value.execute : callable,
+  };
 }
 
 function summarizeArguments(args) {

package/src/ci-outputs.js

@@ -0,0 +1,235 @@
+import path from "node:path";
+import { writeArtifacts } from "./artifacts.js";
+
+export const defaultSarifPath = "plugin-inspector.sarif";
+export const defaultJunitPath = "plugin-inspector.junit.xml";
+
+export async function writeCiOutputArtifacts(report, options = {}) {
+  const outDir = path.resolve(options.cwd ?? process.cwd(), options.outDir ?? "reports");
+  const artifacts = [];
+
+  if (options.sarifPath) {
+    artifacts.push({
+      name: "sarifPath",
+      path: path.resolve(outDir, options.sarifPath),
+      json: buildSarifReport(report),
+    });
+  }
+
+  if (options.junitPath) {
+    artifacts.push({
+      name: "junitPath",
+      path: path.resolve(outDir, options.junitPath),
+      content: renderJunitXml(report),
+    });
+  }
+
+  if (artifacts.length === 0) {
+    return {};
+  }
+
+  return writeArtifacts(artifacts, { check: options.check });
+}
+
+export function buildSarifReport(report) {
+  const findings = reportFindings(report);
+  const rules = [...new Map(findings.map((finding) => [finding.code, sarifRule(finding)])).values()];
+  const fixtureById = new Map((report.fixtures ?? []).map((fixture) => [fixture.id, fixture]));
+
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "plugin-inspector",
+            informationUri: "https://github.com/openclaw/plugin-inspector",
+            rules,
+          },
+        },
+        results: findings.map((finding) => sarifResult(finding, fixtureById)),
+      },
+    ],
+  };
+}
+
+export function renderJunitXml(report) {
+  const findings = reportFindings(report);
+  const testcases = findings.length > 0 ? findings.map(junitFindingTestcase) : [junitPassingTestcase(report)];
+  const failures = findings.filter(isBlockingFinding).length;
+  const tests = testcases.length;
+
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    `<testsuite name="plugin-inspector" tests="${tests}" failures="${failures}" errors="0" skipped="0">`,
+    ...testcases,
+    "</testsuite>",
+    "",
+  ].join("\n");
+}
+
+export function reportFindings(report) {
+  const findings = new Map();
+  for (const finding of [...(report.breakages ?? []), ...(report.warnings ?? []), ...(report.suggestions ?? [])]) {
+    findings.set(findingKey(finding), finding);
+  }
+  for (const issue of report.issues ?? []) {
+    const finding = issueToFinding(issue);
+    findings.set(findingKey(finding), {
+      ...findings.get(findingKey(finding)),
+      ...finding,
+    });
+  }
+  return [...findings.values()];
+}
+
+function issueToFinding(issue) {
+  return {
+    fixture: issue.fixture,
+    code: issue.code,
+    level: issue.status === "blocking" ? "breakage" : "warning",
+    message: issue.title,
+    evidence: issue.evidence ?? [],
+    severity: issue.severity,
+    issueClass: issue.issueClass,
+  };
+}
+
+function findingKey(finding) {
+  return [
+    finding.fixture ?? "",
+    finding.code ?? "",
+    ...normalizeEvidence(finding.evidence),
+  ].join("\n");
+}
+
+function sarifRule(finding) {
+  return {
+    id: finding.code,
+    shortDescription: {
+      text: finding.code,
+    },
+    fullDescription: {
+      text: finding.message ?? finding.code,
+    },
+    defaultConfiguration: {
+      level: sarifLevel(finding),
+    },
+  };
+}
+
+function sarifResult(finding, fixtureById) {
+  return {
+    ruleId: finding.code,
+    level: sarifLevel(finding),
+    message: {
+      text: finding.message ?? finding.code,
+    },
+    locations: [sarifLocation(finding, fixtureById)],
+    properties: {
+      fixture: finding.fixture,
+      severity: finding.severity ?? finding.level,
+      issueClass: finding.issueClass,
+      evidence: normalizeEvidence(finding.evidence),
+    },
+  };
+}
+
+function sarifLocation(finding, fixtureById) {
+  const parsed = parseEvidenceLocation(normalizeEvidence(finding.evidence)[0]);
+  const fixture = fixtureById.get(finding.fixture);
+  const uri = parsed?.uri ?? fixture?.path ?? ".";
+  return {
+    physicalLocation: {
+      artifactLocation: {
+        uri: normalizeUri(uri),
+      },
+      region: {
+        startLine: parsed?.line ?? 1,
+      },
+    },
+  };
+}
+
+function parseEvidenceLocation(evidence) {
+  if (!evidence) {
+    return null;
+  }
+
+  const ref = evidence.includes(" @ ") ? evidence.split(" @ ").pop() : evidence;
+  const match = /^(?<uri>.+?):(?<line>\d+)(?::\d+)?$/.exec(ref);
+  if (!match?.groups?.uri) {
+    return null;
+  }
+  return {
+    uri: match.groups.uri,
+    line: Number(match.groups.line),
+  };
+}
+
+function junitFindingTestcase(finding) {
+  const classname = `plugin-inspector.${xmlName(finding.fixture ?? "unknown")}`;
+  const name = `${finding.level ?? "finding"}:${finding.code}`;
+  const output = normalizeEvidence(finding.evidence).join("\n");
+  if (!isBlockingFinding(finding)) {
+    return [
+      `  <testcase classname="${escapeXml(classname)}" name="${escapeXml(name)}">`,
+      output ? `    <system-out>${escapeXml(output)}</system-out>` : "",
+      "  </testcase>",
+    ]
+      .filter(Boolean)
+      .join("\n");
+  }
+
+  return [
+    `  <testcase classname="${escapeXml(classname)}" name="${escapeXml(name)}">`,
+    `    <failure message="${escapeXml(finding.message ?? finding.code)}">${escapeXml(output || finding.message || finding.code)}</failure>`,
+    "  </testcase>",
+  ].join("\n");
+}
+
+function junitPassingTestcase(report) {
+  return `  <testcase classname="plugin-inspector" name="status:${escapeXml(report.status ?? "pass")}"/>`;
+}
+
+function isBlockingFinding(finding) {
+  return finding.level === "breakage" || finding.status === "blocking" || finding.severity === "P0";
+}
+
+function sarifLevel(finding) {
+  if (isBlockingFinding(finding) || finding.severity === "P1") {
+    return "error";
+  }
+  if (finding.level === "warning" || finding.severity === "P2") {
+    return "warning";
+  }
+  return "note";
+}
+
+function normalizeEvidence(evidence) {
+  if (Array.isArray(evidence)) {
+    return evidence.map(String);
+  }
+  if (evidence == null) {
+    return [];
+  }
+  return [String(evidence)];
+}
+
+function normalizeUri(uri) {
+  return String(uri).replaceAll(path.sep, "/");
+}
+
+function xmlName(value) {
+  return String(value).replace(/[^a-zA-Z0-9_.-]/g, "_");
+}
+
+function escapeXml(value) {
+  return String(value)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}

package/src/cli.js

@@ -1,15 +1,19 @@
 #!/usr/bin/env node
 import path from "node:path";
 import {
+  loadPluginConfig,
   renderTextSummary,
   runPluginCheck,
 } from "./index.js";
 import {
   buildCiSummary,
   captureEntrypoint,
+  defaultJunitPath,
+  defaultSarifPath,
   inspectCompatibilityFixtureSet,
   inspectFixtureSet,
   loadInspectorConfig,
+  writeCiOutputArtifacts,
   writeCiSummary,
   writeCompatibilityReport,
   writePluginInspectorInit,
@@ -28,8 +32,14 @@ try {
     await runCheck(commandArgs);
   } else if (command === "init") {
     await runInit(commandArgs);
+  } else if (command === "config") {
+    await runConfig(commandArgs);
   } else if (command === "inspect" || command === "report") {
-    await runReport(command, commandArgs);
+    if (command === "inspect" && !commandArgs.includes("--config")) {
+      await runCheck(commandArgs);
+    } else {
+      await runReport(command, commandArgs);
+    }
   } else if (command === "ci") {
     await runCi(commandArgs);
   } else if (command === "capture") {
@@ -42,6 +52,18 @@ try {
   process.exitCode = 1;
 }
 
+async function runConfig(commandArgs) {
+  const configPath = readFlag(commandArgs, "--config");
+  const pluginRoot = readFlag(commandArgs, "--plugin-root") ?? readFlag(commandArgs, "--root");
+  const config = await loadPluginConfig({ configPath, pluginRoot });
+
+  if (commandArgs.includes("--json")) {
+    console.log(JSON.stringify(config, null, 2));
+  } else {
+    console.log(renderConfigTextSummary(config));
+  }
+}
+
 async function runCheck(commandArgs) {
   const configPath = readFlag(commandArgs, "--config");
   const pluginRoot = readFlag(commandArgs, "--plugin-root") ?? readFlag(commandArgs, "--root");
@@ -50,7 +72,13 @@ async function runCheck(commandArgs) {
   const json = commandArgs.includes("--json");
   const capture = readRuntimeFlag(commandArgs);
   const mockSdk = readMockSdkFlag(commandArgs);
-  const { report } = await runPluginCheck({ configPath, pluginRoot, outDir, openclawPath, capture, mockSdk });
+  const ciOutputs = readCiOutputFlags(commandArgs);
+  const { report, paths } = await runPluginCheck({ configPath, pluginRoot, outDir, openclawPath, capture, mockSdk });
+  await writeCiOutputArtifacts(report, {
+    ...ciOutputs,
+    cwd: path.dirname(paths.jsonPath),
+    outDir: ".",
+  });
 
   if (json) {
     console.log(JSON.stringify(report, null, 2));
@@ -87,9 +115,15 @@ async function runReport(command, commandArgs) {
   const outDir = readFlag(commandArgs, "--out") ?? "reports";
   const check = commandArgs.includes("--check") || command === "ci";
   const json = commandArgs.includes("--json");
+  const ciOutputs = readCiOutputFlags(commandArgs);
   const config = await loadInspectorConfig(configPath);
   const report = await inspectFixtureSet(config);
-  await writeReport(report, { outDir });
+  const paths = await writeReport(report, { outDir });
+  await writeCiOutputArtifacts(report, {
+    ...ciOutputs,
+    cwd: path.dirname(paths.jsonPath),
+    outDir: ".",
+  });
 
   if (json) {
     console.log(JSON.stringify(report, null, 2));
@@ -108,8 +142,13 @@ async function runCi(commandArgs) {
   const outDir = readFlag(commandArgs, "--out") ?? "reports";
   const openclawPath = commandArgs.includes("--no-openclaw") ? false : readFlag(commandArgs, "--openclaw");
   const json = commandArgs.includes("--json");
+  const capture = readRuntimeFlag(commandArgs);
+  const mockSdk = readMockSdkFlag(commandArgs);
+  const ciOutputs = readCiOutputFlags(commandArgs, { defaultEnabled: true });
   const { report, reportDir } = await runCiCompatibilityReport({
+    capture,
     configPath,
+    mockSdk,
     openclawPath,
     outDir,
     pluginRoot,
@@ -128,6 +167,11 @@ async function runCi(commandArgs) {
     jsonPath: path.join(reportDir, "plugin-inspector-ci-summary.json"),
     markdownPath: path.join(reportDir, "plugin-inspector-ci-summary.md"),
   });
+  await writeCiOutputArtifacts(report, {
+    ...ciOutputs,
+    cwd: reportDir,
+    outDir: ".",
+  });
 
   if (json) {
     console.log(JSON.stringify(summary, null, 2));
@@ -140,7 +184,7 @@ async function runCi(commandArgs) {
   }
 }
 
-async function runCiCompatibilityReport({ configPath, openclawPath, outDir, pluginRoot }) {
+async function runCiCompatibilityReport({ capture, configPath, mockSdk, openclawPath, outDir, pluginRoot }) {
   if (configPath) {
     const config = await loadInspectorConfig(configPath, { cwd: pluginRoot });
     const report = await inspectCompatibilityFixtureSet(config, { openclawPath });
@@ -151,7 +195,7 @@ async function runCiCompatibilityReport({ configPath, openclawPath, outDir, plug
     };
   }
 
-  const { report } = await runPluginCheck({ pluginRoot, outDir, openclawPath });
+  const { report } = await runPluginCheck({ pluginRoot, outDir, openclawPath, capture, mockSdk });
   return {
     report,
     reportDir: path.resolve(pluginRoot ?? process.cwd(), outDir),
@@ -187,6 +231,26 @@ function readFlag(commandArgs, name) {
   return commandArgs[index + 1] ?? null;
 }
 
+function readOptionalPathFlag(commandArgs, name, defaultPath) {
+  const index = commandArgs.indexOf(name);
+  if (index === -1) {
+    return null;
+  }
+  const value = commandArgs[index + 1];
+  return value && !value.startsWith("-") ? value : defaultPath;
+}
+
+function readCiOutputFlags(commandArgs, options = {}) {
+  return {
+    sarifPath: commandArgs.includes("--no-sarif")
+      ? null
+      : (readOptionalPathFlag(commandArgs, "--sarif", defaultSarifPath) ?? (options.defaultEnabled ? defaultSarifPath : null)),
+    junitPath: commandArgs.includes("--no-junit")
+      ? null
+      : (readOptionalPathFlag(commandArgs, "--junit", defaultJunitPath) ?? (options.defaultEnabled ? defaultJunitPath : null)),
+  };
+}
+
 function readRuntimeFlag(commandArgs) {
   if (commandArgs.includes("--runtime") || commandArgs.includes("--capture")) {
     return true;
@@ -226,19 +290,34 @@ function renderCiTextSummary(summary) {
   ].join("\n");
 }
 
+function renderConfigTextSummary(config) {
+  const fixture = config.fixtures[0];
+  return [
+    `Plugin: ${fixture.id}`,
+    `Root: ${config.rootDir}`,
+    `Config: ${config.configPath ?? "auto"}`,
+    `Priority: ${fixture.priority}`,
+    `Seams: ${fixture.seams.join(", ")}`,
+    `Runtime capture: ${config.capture?.runtime === true ? "on" : "off"}`,
+    `Mock SDK: ${config.capture?.mockSdk === false ? "off" : "on"}`,
+  ].join("\n");
+}
+
 function printHelp() {
   console.log(`plugin-inspector
 
 Usage:
   plugin-inspector
   plugin-inspector check [--plugin-root <path>] [--config <path>] [--out <dir>] [--openclaw <path>] [--no-openclaw] [--runtime] [--mock-sdk|--real-sdk] [--json]
+  plugin-inspector config [--plugin-root <path>] [--config <path>] [--json]
   plugin-inspector init [--plugin-root <path>] [--config <path>] [--ci] [--package-manager npm|pnpm|yarn|bun] [--force]
   plugin-inspector report --config <path> [--out <dir>] [--check] [--json]
-  plugin-inspector inspect --config <path> [--out <dir>] [--check] [--json]
-  plugin-inspector ci [--plugin-root <path>] [--config <path>] [--out <dir>] [--openclaw <path>] [--no-openclaw] [--json]
+  plugin-inspector inspect [--plugin-root <path>] [--config <path>] [--out <dir>] [--check] [--json] [--sarif [path]] [--junit [path]]
+  plugin-inspector ci [--plugin-root <path>] [--config <path>] [--out <dir>] [--openclaw <path>] [--no-openclaw] [--runtime] [--mock-sdk|--real-sdk] [--json] [--no-sarif] [--no-junit]
   PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 plugin-inspector capture <entrypoint> [--mock-sdk|--real-sdk] [--plugin-root <path>] [--output <path>]
 
 Default check runs from the current plugin root and writes reports/ unless --out is set.
+CI writes SARIF and JUnit artifacts by default; check/inspect can write them with --sarif and --junit.
 Runtime capture is opt-in because it imports plugin code; use --runtime with PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1.
 `);
 }

package/src/config.js

@@ -4,6 +4,7 @@ import path from "node:path";
 
 export const npmPackagePayloadDir = ".crabpot-package";
 export const defaultPluginRootConfigFiles = ["plugin-inspector.config.json", ".plugin-inspector.json"];
+export const packageJsonConfigKeys = ["pluginInspector", "plugin-inspector"];
 
 export async function loadInspectorConfig(configPath, options = {}) {
   if (!configPath) {
@@ -24,16 +25,23 @@ export async function loadInspectorConfig(configPath, options = {}) {
 export async function loadPluginRootConfig(configPath = null, options = {}) {
   const rootDir = path.resolve(options.cwd ?? process.cwd());
   const resolvedPath = configPath ? path.resolve(rootDir, configPath) : findPluginRootConfigPath(rootDir);
-  if (!resolvedPath && !existsSync(path.join(rootDir, "package.json")) && !existsSync(path.join(rootDir, "openclaw.plugin.json"))) {
+  const packageJsonPath = path.join(rootDir, "package.json");
+  const packageJson = await readJsonIfExists(packageJsonPath);
+  const packageConfig = packageJsonConfig(packageJson);
+
+  if (!resolvedPath && !packageJson && !existsSync(path.join(rootDir, "openclaw.plugin.json"))) {
     throw new Error("run from a plugin root with package.json/openclaw.plugin.json, or pass --config");
   }
-  const config = resolvedPath ? JSON.parse(await readFile(resolvedPath, "utf8")) : { version: 1 };
+
+  const config = resolvedPath
+    ? JSON.parse(await readFile(resolvedPath, "utf8"))
+    : (packageConfig.config ?? { version: 1 });
   const normalizedConfig = await normalizePluginRootConfig(config, { rootDir });
   validateInspectorConfig(normalizedConfig);
   return {
     ...normalizedConfig,
     rootDir,
-    configPath: resolvedPath,
+    configPath: resolvedPath ?? packageConfig.configPath,
   };
 }
 
@@ -164,6 +172,25 @@ function findPluginRootConfigPath(rootDir) {
   return defaultPluginRootConfigFiles.map((file) => path.join(rootDir, file)).find(existsSync) ?? null;
 }
 
+function packageJsonConfig(packageJson) {
+  if (!packageJson) {
+    return { config: null, configPath: null };
+  }
+  for (const key of packageJsonConfigKeys) {
+    if (packageJson[key] === undefined) {
+      continue;
+    }
+    if (!packageJson[key] || typeof packageJson[key] !== "object" || Array.isArray(packageJson[key])) {
+      throw new Error(`package.json ${key} must be an object`);
+    }
+    return {
+      config: packageJson[key],
+      configPath: `package.json#${key}`,
+    };
+  }
+  return { config: null, configPath: null };
+}
+
 async function readJsonIfExists(filePath) {
   if (!existsSync(filePath)) {
     return null;

package/src/index.js

@@ -7,5 +7,6 @@ export {
   renderTextSummary,
   runPluginCheck,
   setupPluginInspector,
+  writeCiOutputArtifacts,
   writePluginReports,
 } from "./api.js";

package/src/init.js

@@ -79,8 +79,7 @@ jobs:
           node-version: 24
           cache: ${setup.cache}
 ${setup.corepack ? "      - run: corepack enable\n" : ""}      - run: ${setup.install}
-      - run: ${setup.exec} @openclaw/plugin-inspector check --no-openclaw
-      - run: PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 ${setup.exec} @openclaw/plugin-inspector check --no-openclaw --runtime --mock-sdk
+      - run: PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 ${setup.exec} @openclaw/plugin-inspector ci --no-openclaw --runtime --mock-sdk
       - uses: actions/upload-artifact@v5
         if: always()
         with:

package/src/sdk-mock.js

@@ -718,6 +718,37 @@ function mockSdkSource() {
   return typeof entry === "function" ? { register: entry } : entry;
 }
 
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function parseWithSchema(schema, value) {
+  return schema && typeof schema.parse === "function" ? schema.parse(value) : value;
+}
+
+function createConfigSchema(schema = {}) {
+  if (schema && typeof schema.parse === "function") {
+    return schema;
+  }
+  const shape = isPlainObject(schema?.shape) ? schema.shape : isPlainObject(schema?.properties) ? schema.properties : schema;
+  return {
+    ...schema,
+    parse(value = {}) {
+      if (!isPlainObject(shape)) {
+        return isPlainObject(value) ? value : {};
+      }
+      const source = isPlainObject(value) ? value : {};
+      const output = { ...source };
+      for (const [key, fieldSchema] of Object.entries(shape)) {
+        if (Object.prototype.hasOwnProperty.call(source, key)) {
+          output[key] = parseWithSchema(fieldSchema, source[key]);
+        }
+      }
+      return output;
+    },
+  };
+}
+
 export function definePluginEntry(entry) {
   return normalizeEntry(entry);
 }
@@ -759,13 +790,13 @@ export function defineSingleProviderPluginEntry(options) {
 }
 
 export function buildPluginConfigSchema(schema = {}) {
-  return schema;
+  return createConfigSchema(schema);
 }
 
-export const emptyPluginConfigSchema = { type: "object", properties: {}, additionalProperties: false };
+export const emptyPluginConfigSchema = createConfigSchema({ type: "object", properties: {}, additionalProperties: false });
 
 export function buildChannelConfigSchema(schema = {}) {
-  return schema;
+  return createConfigSchema(schema);
 }
 
 export const emptyChannelConfigSchema = emptyPluginConfigSchema;
@@ -951,14 +982,28 @@ export function createAuthRateLimiter() {
 }
 
 export function createProviderApiKeyAuthMethod(options = {}) {
-  return { type: "apiKey", ...options };
+  return {
+    id: options.id ?? "apiKey",
+    type: "apiKey",
+    ...options,
+    async resolve(ctx = {}) {
+      return ctx.apiKey ?? ctx.key ?? ctx.token ?? null;
+    },
+  };
 }
 
 export function buildSingleProviderApiKeyCatalog(options = {}) {
+  const auth = options.auth ?? createProviderApiKeyAuthMethod(options.authOptions);
   return {
+    auth,
     order: "simple",
     async run(ctx) {
-      return { provider: await options.buildProvider?.(ctx) };
+      const provider = (await options.buildProvider?.(ctx)) ?? options.provider ?? { id: options.id ?? "provider", auth };
+      return {
+        provider,
+        providers: [provider],
+        models: (await options.buildModels?.(ctx)) ?? options.models ?? [],
+      };
     },
   };
 }

package/src/synthetic-probes.js

@@ -13,7 +13,7 @@ export const syntheticRegistrationExecutionProfiles = {
   },
   registerChannel: {
     mode: "channel-opt-in",
-    callableProperties: ["send", "receive"],
+    callableProperties: ["send", "sendMessage", "receive", "handleMessage"],
     option: "includeChannelRuntime",
   },
   registerCli: {
@@ -31,7 +31,7 @@ export const syntheticRegistrationExecutionProfiles = {
   },
   registerGatewayMethod: {
     mode: "direct",
-    callableProperties: ["handler", "run", "execute"],
+    callableProperties: ["handler", "run", "execute", "invoke"],
   },
   registerHttpRoute: {
     mode: "direct",
@@ -58,12 +58,12 @@ export const syntheticRegistrationExecutionProfiles = {
   },
   registerService: {
     mode: "lifecycle-opt-in",
-    callableProperties: ["start", "stop"],
+    callableProperties: ["start", "stop", "dispose"],
     option: "includeLifecycle",
   },
   registerSpeechProvider: {
     mode: "provider-opt-in",
-    callableProperties: ["speak", "synthesize"],
+    callableProperties: ["speak", "synthesize", "tts"],
     option: "includeProviderCapabilities",
   },
   registerTool: {
@@ -452,7 +452,8 @@ async function runRegistrationProbes(entry, retainedEntry, captureIndex, options
     return [metadataOnlyResult(entry, captureIndex, profile.reason)];
   }
 
-  const descriptor = retainedEntry.arguments?.[0] ?? retainedEntry.returnValue;
+  const descriptor =
+    retainedEntry.arguments?.find((value) => value && typeof value === "object") ?? retainedEntry.returnValue;
   if (!descriptor || typeof descriptor !== "object") {
     return [blockedResult(entry, captureIndex, "captured registration has no object descriptor")];
   }