@openclaw/plugin-inspector 0.1.3 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 0.3.0 - 2026-04-27
+
+### Added
+
+- Add `--allow-execute` as a cross-platform runtime capture opt-in flag.
+- Add `plugin-inspector init --dry-run` for setup previews.
+- Add `plugin-inspector init --json` for machine-readable setup summaries.
+- Add `plugin-inspector init --scripts` for `plugin:check` and `plugin:ci` package scripts.
+- Add public fixture-set report helpers and synthetic probe suite helpers for Crabpot and downstream compatibility suites.
+- Add a Crabpot follow-through release checklist for source refs, package pins, and smoke commands.
+
+### Changed
+
+- Make generated runtime CI commands use `--allow-execute` instead of shell-specific inline environment syntax.
+- Make `plugin-inspector init --ci` detect `packageManager` and common lockfiles before generating CI install/run commands.
+- Make `plugin-inspector init` output repo-relative file paths and preflight generated files before writing.
+- Make `plugin-inspector init` infer `sourceRoot: "src"` from package export maps like `"./src/index.js"`.
+- Improve CLI failure summaries with report artifact paths and top blocking findings.
+- Harden mock SDK capture by keeping generated loader fixtures available until subprocess exit.
+
+## 0.2.0 - 2026-04-27
+
+### Added
+
+- Add package.json `pluginInspector` config discovery for plugin-root checks.
+- Add `plugin-inspector config` for resolved plugin-root config summaries.
+- Add author-facing `plugin-inspector inspect` plugin-root flow.
+- Add CI-native SARIF and JUnit outputs; `plugin-inspector ci` writes them by default.
+
+### Changed
+
+- Make generated CI workflows use one `plugin-inspector ci --no-openclaw --runtime --mock-sdk` command.
+- Harden runtime capture for string handler registrations, parse-capable config schema helpers, and provider auth/catalog SDK mocks.
+
 ## 0.1.3 - 2026-04-27
 
 ### Added

package/README.md

@@ -24,6 +24,11 @@ Add a local config and GitHub Actions workflow:
 npx @openclaw/plugin-inspector init --ci
 ```
 
+`init --ci` detects `packageManager` and common lockfiles. Pass
+`--package-manager pnpm`, `npm`, `yarn`, or `bun` when you want to override it.
+Add `--scripts` to write `plugin:check` and `plugin:ci` package scripts.
+Use `--dry-run` to preview the files first.
+
 Or install it as a dev dependency:
 
 ```bash
@@ -35,17 +40,41 @@ npx plugin-inspector check
 
 ```bash
 npx @openclaw/plugin-inspector check
+npx @openclaw/plugin-inspector inspect
+npx @openclaw/plugin-inspector ci --no-openclaw
+npx @openclaw/plugin-inspector config
 npx @openclaw/plugin-inspector check --plugin-root ./plugins/weather
 npx @openclaw/plugin-inspector init --ci --package-manager pnpm
+npx @openclaw/plugin-inspector init --ci --scripts --dry-run
+npx @openclaw/plugin-inspector init --ci --scripts --dry-run --json
 ```
 
-`check` reads the current directory as one plugin unless `--plugin-root` is set.
-It writes:
+`check` and `inspect` read the current directory as one plugin unless
+`--plugin-root` is set. `inspect` is the friendly author-facing alias; `check`
+is kept for scripts. Both write:
 
 - `reports/plugin-inspector-report.json`
 - `reports/plugin-inspector-report.md`
 - `reports/plugin-inspector-issues.md`
 
+Use CI-native outputs when you want annotations or test-summary ingestion:
+
+```bash
+plugin-inspector inspect --no-openclaw --sarif --junit
+```
+
+That also writes:
+
+- `reports/plugin-inspector.sarif`
+- `reports/plugin-inspector.junit.xml`
+
+`config` prints the resolved plugin root, fixture id, seams, and capture
+settings before CI runs:
+
+```bash
+plugin-inspector config --json
+```
+
 Use `--no-openclaw` when CI should not compare against a local OpenClaw
 checkout:
 
@@ -53,8 +82,9 @@ checkout:
 plugin-inspector check --no-openclaw
 ```
 
-Use `plugin-inspector.config.json` when CI needs stable fixture metadata,
-expected seams, or runtime capture defaults:
+Use either `plugin-inspector.config.json` or a `package.json`
+`pluginInspector` block when CI needs stable fixture metadata, expected seams,
+or runtime capture defaults:
 
 ```json
 {
@@ -83,10 +113,34 @@ Then run:
 plugin-inspector check --config plugin-inspector.config.json
 ```
 
+For a single plugin package, the same config can live in `package.json`:
+
+```json
+{
+  "scripts": {
+    "plugin:check": "plugin-inspector inspect --no-openclaw"
+  },
+  "pluginInspector": {
+    "version": 1,
+    "plugin": {
+      "id": "weather",
+      "priority": "high",
+      "seams": ["dynamic-tool"],
+      "sourceRoot": "src"
+    },
+    "capture": {
+      "mockSdk": true
+    }
+  }
+}
+```
+
 `init --ci` writes this shape for you, plus
 `.github/workflows/plugin-inspector.yml`. Copy-ready examples also live in
 `examples/plugin-inspector.config.json` and
-`examples/github-actions-plugin-inspector.yml`.
+`examples/package-json-plugin-inspector.json` and
+`examples/github-actions-plugin-inspector.yml`. SARIF/JUnit CI consumption
+examples live alongside them.
 
 ## Runtime Capture
 
@@ -95,9 +149,13 @@ the registrations made during `register(api)`. It is opt-in because it executes
 plugin code:
 
 ```bash
-PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 npx @openclaw/plugin-inspector check --runtime --mock-sdk
+npx @openclaw/plugin-inspector check --runtime --mock-sdk --allow-execute
 ```
 
+`--allow-execute` is the explicit guard for modes that import plugin code. The
+older `PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1` environment guard still works for
+custom harnesses.
+
 By default, runtime capture uses a generated mock for `openclaw/plugin-sdk` and
 common external packages so plugin code can load in clean CI without OpenClaw
 installed. Use `--real-sdk` only when the plugin workspace already has real SDK
@@ -111,7 +169,7 @@ Runtime capture writes:
 You can also capture one entrypoint directly:
 
 ```bash
-PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 plugin-inspector capture ./dist/index.js --mock-sdk
+plugin-inspector capture ./dist/index.js --mock-sdk --allow-execute
 ```
 
 ## CI
@@ -121,8 +179,8 @@ Minimal package scripts:
 ```json
 {
   "scripts": {
-    "plugin:check": "plugin-inspector check --no-openclaw",
-    "plugin:check:runtime": "PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 plugin-inspector check --no-openclaw --runtime --mock-sdk"
+    "plugin:check": "plugin-inspector inspect --no-openclaw",
+    "plugin:ci": "plugin-inspector ci --no-openclaw --runtime --mock-sdk --allow-execute"
   }
 }
 ```
@@ -147,8 +205,7 @@ jobs:
           node-version: 24
           cache: npm
       - run: npm ci
-      - run: npx @openclaw/plugin-inspector check --no-openclaw
-      - run: PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 npx @openclaw/plugin-inspector check --no-openclaw --runtime --mock-sdk
+      - run: npx @openclaw/plugin-inspector ci --no-openclaw --runtime --mock-sdk --allow-execute
       - uses: actions/upload-artifact@v5
         if: always()
         with:
@@ -156,6 +213,18 @@ jobs:
           path: reports/plugin-inspector-*
 ```
 
+`ci` writes the normal report, CI summary, SARIF, and JUnit files by default.
+Pass `--no-sarif` or `--no-junit` only if your CI surface cannot consume them.
+
+For GitHub code scanning, use
+`examples/github-actions-code-scanning.yml`; it uploads
+`reports/plugin-inspector.sarif` through CodeQL's SARIF upload action.
+
+For CI test-summary UIs, point JUnit ingestion at
+`reports/plugin-inspector.junit.xml`. Copy-ready GitLab and CircleCI examples
+live in `examples/gitlab-ci-plugin-inspector.yml` and
+`examples/circleci-plugin-inspector.yml`.
+
 ## Fixture Suites
 
 Fixture-set configs are still supported for crabpot-style compatibility suites:

package/examples/circleci-plugin-inspector.yml

@@ -0,0 +1,19 @@
+version: 2.1
+
+jobs:
+  plugin-inspector:
+    docker:
+      - image: cimg/node:24.0
+    steps:
+      - checkout
+      - run: npm ci
+      - run: npx @openclaw/plugin-inspector ci --no-openclaw --runtime --mock-sdk --allow-execute
+      - store_test_results:
+          path: reports
+      - store_artifacts:
+          path: reports
+
+workflows:
+  plugin-inspector:
+    jobs:
+      - plugin-inspector

package/examples/github-actions-code-scanning.yml

@@ -0,0 +1,31 @@
+name: plugin-inspector
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npx @openclaw/plugin-inspector ci --no-openclaw --runtime --mock-sdk --allow-execute
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: reports/plugin-inspector.sarif
+      - uses: actions/upload-artifact@v5
+        if: always()
+        with:
+          name: plugin-inspector-reports
+          path: reports/plugin-inspector-*

package/examples/github-actions-plugin-inspector.yml

@@ -15,8 +15,7 @@ jobs:
           node-version: 24
           cache: npm
       - run: npm ci
-      - run: npx @openclaw/plugin-inspector check --no-openclaw
-      - run: PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 npx @openclaw/plugin-inspector check --no-openclaw --runtime --mock-sdk
+      - run: npx @openclaw/plugin-inspector ci --no-openclaw --runtime --mock-sdk --allow-execute
       - uses: actions/upload-artifact@v5
         if: always()
         with:

package/examples/gitlab-ci-plugin-inspector.yml

@@ -0,0 +1,11 @@
+plugin_inspector:
+  image: node:24
+  script:
+    - npm ci
+    - npx @openclaw/plugin-inspector ci --no-openclaw --runtime --mock-sdk --allow-execute
+  artifacts:
+    when: always
+    paths:
+      - reports/plugin-inspector-*
+    reports:
+      junit: reports/plugin-inspector.junit.xml

package/examples/package-json-plugin-inspector.json

@@ -0,0 +1,21 @@
+{
+  "scripts": {
+    "plugin:check": "plugin-inspector inspect --no-openclaw",
+    "plugin:ci": "plugin-inspector ci --no-openclaw --runtime --mock-sdk --allow-execute"
+  },
+  "pluginInspector": {
+    "version": 1,
+    "plugin": {
+      "id": "weather",
+      "priority": "high",
+      "seams": ["dynamic-tool"],
+      "sourceRoot": "src",
+      "expect": {
+        "registrations": ["registerTool"]
+      }
+    },
+    "capture": {
+      "mockSdk": true
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/plugin-inspector",
-  "version": "0.1.3",
+  "version": "0.3.0",
   "private": false,
   "description": "Offline compatibility inspector for OpenClaw plugins.",
   "type": "module",
@@ -36,6 +36,8 @@
     "./ref-diff": "./src/ref-diff.js",
     "./runtime-capture-report": "./src/runtime-capture-report.js",
     "./runtime-profile": "./src/runtime-profile.js",
+    "./synthetic-probe-suite": "./src/synthetic-probe-suite.js",
+    "./synthetic-probes": "./src/synthetic-probes.js",
     "./workspace-plan": "./src/workspace-plan.js"
   },
   "files": [
@@ -47,6 +49,7 @@
   ],
   "scripts": {
     "check": "npm test && npm pack --dry-run",
+    "release:crabpot": "node scripts/check-crabpot-followthrough.mjs",
     "release:local": "npm run check",
     "test": "node --test test/*.test.js"
   },

package/src/advanced.js

@@ -33,6 +33,14 @@ export {
   renderCiSummaryMarkdown,
   writeCiSummary,
 } from "./ci-summary.js";
+export {
+  buildSarifReport,
+  defaultJunitPath,
+  defaultSarifPath,
+  renderJunitXml,
+  reportFindings,
+  writeCiOutputArtifacts,
+} from "./ci-outputs.js";
 export {
   buildContractProbes,
   contractProbeRules,
@@ -122,13 +130,16 @@ export {
   loadPluginRootConfig,
   normalizeInspectorConfig,
   normalizePluginRootConfig,
+  packageJsonConfigKeys,
   packageId,
   validateInspectorConfig,
 } from "./config.js";
 export {
   buildPluginInspectorConfig,
+  defaultInitPackageScripts,
   defaultInitConfigPath,
   defaultInitWorkflowPath,
+  detectPackageManager,
   renderGithubActionsWorkflow,
   writePluginInspectorInit,
 } from "./init.js";
@@ -187,6 +198,7 @@ export {
   validateSyntheticProbePlan,
   writeSyntheticProbePlan,
 } from "./synthetic-probes.js";
+export { buildSyntheticProbePlanFromReport } from "./synthetic-probe-suite.js";
 export {
   buildWorkspacePlan,
   defaultWorkspacePlanOptions,
@@ -194,3 +206,10 @@ export {
   validateWorkspacePlan,
   writeWorkspacePlan,
 } from "./workspace-plan.js";
+export {
+  inspectCompatibilityFixtureSetConfig,
+  renderFixtureSetIssuesReport,
+  renderFixtureSetMarkdownReport,
+  runFixtureSetReport,
+  writeFixtureSetReports,
+} from "./api.js";

package/src/api.js

@@ -1,9 +1,11 @@
 import path from "node:path";
 import { createCaptureApi } from "./capture-api.js";
 import { loadInspectorConfig, loadPluginRootConfig } from "./config.js";
+import { renderCompatibilityIssuesReport, renderCompatibilityMarkdownReport } from "./compatibility-report.js";
 import { writePluginInspectorInit } from "./init.js";
 import { captureEntrypoint } from "./inspector.js";
 import { renderTextSummary, writeCompatibilityReport } from "./report.js";
+import { writeCiOutputArtifacts } from "./ci-outputs.js";
 import { buildRuntimeCaptureReport, writeRuntimeCaptureReport } from "./runtime-capture-report.js";
 import { inspectCompatibilityFixtureSet, inspectFixtureSet } from "./inspector.js";
 
@@ -34,6 +36,15 @@ export async function inspectFixtureSetConfig(options = {}) {
   return inspectFixtureSet(config, { generatedAt: options.generatedAt });
 }
 
+export async function inspectCompatibilityFixtureSetConfig(options = {}) {
+  const config = await loadFixtureSetConfig(options);
+  return inspectCompatibilityFixtureSet(config, {
+    generatedAt: options.generatedAt,
+    openclawPath: options.openclawPath,
+    targetOpenClaw: options.targetOpenClaw,
+  });
+}
+
 export async function writePluginReports(report, options = {}) {
   return writeCompatibilityReport(report, {
     basename: options.basename,
@@ -44,6 +55,38 @@ export async function writePluginReports(report, options = {}) {
   });
 }
 
+export async function writeFixtureSetReports(report, options = {}) {
+  return writeCompatibilityReport(report, {
+    basename: options.basename,
+    check: options.check,
+    cwd: options.cwd,
+    formatEvidence: options.formatEvidence,
+    issuesBasename: options.issuesBasename,
+    issuesPath: options.issuesPath,
+    issuesTitle: options.issuesTitle,
+    jsonPath: options.jsonPath,
+    markdownPath: options.markdownPath,
+    markdownTitle: options.markdownTitle,
+    outDir: options.outDir,
+    severityLabels: options.severityLabels,
+    title: options.title,
+  });
+}
+
+export function renderFixtureSetMarkdownReport(report, options = {}) {
+  return renderCompatibilityMarkdownReport(report, options);
+}
+
+export function renderFixtureSetIssuesReport(report, options = {}) {
+  return renderCompatibilityIssuesReport(report, options);
+}
+
+export async function runFixtureSetReport(options = {}) {
+  const report = await inspectCompatibilityFixtureSetConfig(options);
+  const paths = options.write === false ? null : await writeFixtureSetReports(report, options);
+  return { report, paths };
+}
+
 export async function runPluginCheck(options = {}) {
   const outDir = options.outDir ?? "reports";
   const config = await loadPluginConfig(options);
@@ -54,8 +97,8 @@ export async function runPluginCheck(options = {}) {
   const mockSdk = options.mockSdk ?? config.capture?.mockSdk ?? true;
 
   if (capture === true) {
-    if (process.env.PLUGIN_INSPECTOR_EXECUTE_ISOLATED !== "1") {
-      throw new Error("runtime capture imports plugin code; rerun with PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 in an isolated workspace");
+    if (!executionAllowed(options)) {
+      throw new Error("runtime capture imports plugin code; rerun with PLUGIN_INSPECTOR_EXECUTE_ISOLATED=1 or --allow-execute in an isolated workspace");
     }
     const runtimeCapture = await buildRuntimeCaptureReport({
       mockSdk,
@@ -88,4 +131,18 @@ export async function setupPluginInspector(options = {}) {
   return writePluginInspectorInit(options);
 }
 
-export { createCaptureApi, renderTextSummary };
+export { createCaptureApi, renderTextSummary, writeCiOutputArtifacts };
+
+function executionAllowed(options) {
+  return options.allowExecution === true || process.env.PLUGIN_INSPECTOR_EXECUTE_ISOLATED === "1";
+}
+
+async function loadFixtureSetConfig(options) {
+  if (options.config) {
+    return {
+      ...options.config,
+      rootDir: options.config.rootDir ?? options.rootDir ?? options.cwd ?? process.cwd(),
+    };
+  }
+  return loadInspectorConfig(options.configPath, { cwd: options.cwd ?? options.rootDir });
+}

package/src/capture-api.js

@@ -1,6 +1,6 @@
 export const defaultCaptureApiRegistrarProfiles = {
   registerChannel: {
-    returnValue: ({ args }) => registrationObject(args, { id: "channel" }),
+    returnValue: ({ args }) => channelRegistrationObject(args),
   },
   registerCli: {
     returnValue: ({ args }) => registrationObject(args, { name: "cli" }),
@@ -12,7 +12,7 @@ export const defaultCaptureApiRegistrarProfiles = {
     returnValue: ({ args }) => registrationObject(args, { id: "context-engine" }),
   },
   registerGatewayMethod: {
-    returnValue: ({ args }) => registrationObject(args, { name: "gateway.method" }),
+    returnValue: ({ args }) => gatewayMethodRegistrationObject(args),
   },
   registerHook: {
     returnValue: ({ api }) => api,
@@ -37,9 +37,10 @@ export const defaultCaptureApiRegistrarProfiles = {
   },
   registerService: {
     returnValue: ({ args }) => ({
-      ...registrationObject(args, { name: "service" }),
+      ...registrationObject(args, { id: "service", name: "service" }),
       start: async () => undefined,
       stop: async () => undefined,
+      dispose: async () => undefined,
     }),
   },
   registerSpeechProvider: {
@@ -125,6 +126,7 @@ export function createCaptureApi(options = {}) {
 
 export function createCaptureContext(options = {}) {
   return {
+    registrationMode: options.registrationMode ?? "full",
     config: options.config ?? {},
     logger: options.logger ?? console,
     pluginConfig: options.pluginConfig ?? {},
@@ -142,6 +144,12 @@ export function createCaptureContext(options = {}) {
     },
     gateway: options.gateway ?? {
       baseUrl: "http://127.0.0.1:0",
+      async call(method, params) {
+        return { ok: true, method, params };
+      },
+      respond(ok, result, error) {
+        return { ok, result, ...(error ? { error } : {}) };
+      },
       registerRoute(route) {
         return {
           ...route,
@@ -223,6 +231,7 @@ function createStoreContext() {
 
 function registrationObject(args, defaults) {
   const first = args[0];
+  const callable = firstCallable(args);
   if (first && typeof first === "object") {
     return {
       ...defaults,
@@ -232,13 +241,59 @@ function registrationObject(args, defaults) {
     };
   }
   if (typeof first === "string") {
-    return {
+    return withCallableDefaults({
       ...defaults,
       name: first,
       id: defaults.id,
+    }, callable);
+  }
+  return withCallableDefaults({ ...defaults }, callable);
+}
+
+function channelRegistrationObject(args) {
+  const first = args[0];
+  const registration = registrationObject(args, { id: "channel" });
+  if (first?.plugin && typeof first.plugin === "object") {
+    return {
+      ...registration,
+      id: objectId(first.plugin) ?? registration.id,
+      plugin: first.plugin,
     };
   }
-  return { ...defaults };
+  return registration;
+}
+
+function gatewayMethodRegistrationObject(args) {
+  const [method, handler, options] = args;
+  const registration = registrationObject(args, { name: "gateway.method" });
+  if (typeof method !== "string") {
+    return registration;
+  }
+  return {
+    ...registration,
+    name: method,
+    method,
+    handler: typeof handler === "function" ? handler : registration.handler,
+    run: typeof handler === "function" ? handler : registration.run,
+    execute: typeof handler === "function" ? handler : registration.execute,
+    scope: options?.scope ?? registration.scope,
+  };
+}
+
+function firstCallable(args) {
+  return args.find((arg) => typeof arg === "function");
+}
+
+function withCallableDefaults(value, callable) {
+  if (!callable) {
+    return value;
+  }
+  return {
+    ...value,
+    handler: typeof value.handler === "function" ? value.handler : callable,
+    run: typeof value.run === "function" ? value.run : callable,
+    execute: typeof value.execute === "function" ? value.execute : callable,
+  };
 }
 
 function summarizeArguments(args) {