@openclaw/plugin-inspector 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 0.3.4 - 2026-04-29
+
+### Fixed
+
+- Separate executor-covered platform portability findings from residual findings so downstream structured runners can keep reports blocking only on unhandled risks.
+- Sanitize absolute target OpenClaw paths from generated report artifacts and JSON CLI output.
+- Normalize the dependency-install inspector finding title to use isolated-workspace wording.
+- Treat `openclaw` package dependencies as host-linked workspace inputs instead of isolated dependency-install blockers.
+
+## 0.3.3 - 2026-04-28
+
+### Fixed
+
+- Classify generated kitchen-sink public registrar coverage in synthetic probe plans so new API-surface fixtures do not fail as unknown execution profiles.
+
 ## 0.3.2 - 2026-04-28
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/plugin-inspector",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "private": false,
   "description": "Offline compatibility inspector for OpenClaw plugins.",
   "type": "module",

package/src/advanced.js

@@ -43,6 +43,7 @@ export {
 } from "./ci-outputs.js";
 export {
   buildContractProbes,
+  compatRecordForIssueCode,
   contractProbeRules,
   probePriority,
 } from "./contract-probes.js";
@@ -170,6 +171,7 @@ export {
   classifyCompatRecordCoverage,
   renderMarkdownReport,
   renderTextSummary,
+  sanitizeReportArtifact,
   writeCompatibilityReport,
   writeReport,
 } from "./report.js";

package/src/cli.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import {
   loadPluginConfig,
   renderTextSummary,
+  sanitizeReportArtifact,
   runPluginCheck,
 } from "./index.js";
 import {
@@ -90,7 +91,7 @@ async function runCheck(commandArgs) {
   });
 
   if (json) {
-    console.log(JSON.stringify(report, null, 2));
+    console.log(JSON.stringify(sanitizeReportArtifact(report), null, 2));
   } else {
     console.log(renderTextSummary(report, { artifacts: paths }));
   }

package/src/cold-import-readiness.js

@@ -3,6 +3,8 @@ import path from "node:path";
 import { renderPaddedMarkdownTable, writeJsonMarkdownArtifacts } from "./artifacts.js";
 import { slugForArtifact } from "./path-utils.js";
 
+const hostLinkedRuntimeDependencies = new Set(["openclaw"]);
+
 export function buildColdImportReadiness(options = {}) {
   const report = options.report;
   if (!report) {
@@ -182,7 +184,7 @@ function classifyEntrypointReadiness({ fixture, packageSummary, entrypoint, root
     ...(packageSummary.dependencies ?? []),
     ...(packageSummary.peerDependencies ?? []),
     ...(packageSummary.optionalDependencies ?? []),
-  ]);
+  ]).filter((dependency) => !hostLinkedRuntimeDependencies.has(dependency));
   if (entrypoint.exists && runtimeDependencies.length > 0) {
     blockers.push({
       code: "dependency-install-required",

package/src/compatibility-report.js

@@ -1,4 +1,5 @@
 import { renderPaddedMarkdownTable } from "./artifacts.js";
+import { sanitizeReportArtifact } from "./report-sanitizer.js";
 
 const defaultSeverityLabels = {
   P0: "P0",
@@ -8,6 +9,7 @@ const defaultSeverityLabels = {
 };
 
 export function renderCompatibilityMarkdownReport(report, options = {}) {
+  report = sanitizeReportArtifact(report, options);
   return [
     `# ${options.title ?? "OpenClaw Plugin Compatibility Report"}`,
     "",
@@ -127,6 +129,7 @@ export function renderCompatibilityMarkdownReport(report, options = {}) {
 }
 
 export function renderCompatibilityIssuesReport(report, options = {}) {
+  report = sanitizeReportArtifact(report, options);
   return [
     `# ${options.title ?? "OpenClaw Plugin Issue Findings"}`,
     "",

package/src/contract-probes.js

@@ -106,6 +106,20 @@ export const contractProbeRules = {
   },
 };
 
+const openClawOwnedProbeIssueCodes = new Set([
+  "before-tool-call-probe",
+  "channel-contract-probe",
+  "conversation-access-hook",
+  "registration-capture-gap",
+]);
+
+export function compatRecordForIssueCode(code) {
+  if (!openClawOwnedProbeIssueCodes.has(code)) {
+    return undefined;
+  }
+  return contractProbeRules[code]?.id;
+}
+
 export function buildContractProbes({ warnings = [], suggestions = [], fixtures = [] }) {
   const fixtureById = new Map(fixtures.map((fixture) => [fixture.id, fixture]));
   const probes = [];

package/src/fixture-summary.js

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
 import { readdir } from "node:fs/promises";
 import path from "node:path";
+import { compatRecordForIssueCode } from "./contract-probes.js";
 import { readJsonFile } from "./json-file.js";
 
 const conversationAccessHooks = new Set(["agent_end", "llm_input", "llm_output"]);
@@ -17,6 +18,7 @@ const channelRegistrations = new Set([
   "defineChannelPluginEntry",
   "registerChannel",
 ]);
+const hostLinkedRuntimeDependencies = new Set(["openclaw"]);
 
 export async function buildCompatibilityFixtureReport({ fixture, inspection, checkoutPath, sourceRoot, rootDir = process.cwd() }) {
   const pluginManifests = await readPluginManifests({ checkoutPath, sourceRoot, rootDir });
@@ -278,7 +280,7 @@ export function classifyPackageContracts({ fixture, inspection, fixtureReport })
     ...packageSummary.dependencies,
     ...packageSummary.peerDependencies,
     ...packageSummary.optionalDependencies,
-  ]);
+  ]).filter((dependency) => !hostLinkedRuntimeDependencies.has(dependency));
   if (packageSummary.openclaw?.entrypoints.length > 0 && runtimeDependencies.length > 0) {
     suggestions.push({
       fixture: fixture.id,
@@ -399,6 +401,7 @@ export function classifyCompatibilityFixture({ fixture, inspection, fixtureRepor
       level: "warning",
       message: "fixture observes raw model or conversation content and needs privacy-boundary contract probes",
       evidence: detailEvidence(conversationHookDetails),
+      compatRecord: compatRecordForIssueCode("conversation-access-hook"),
     });
     decisions.push({
       fixture: fixture.id,
@@ -459,6 +462,7 @@ export function classifyCompatibilityFixture({ fixture, inspection, fixtureRepor
       level: "suggestion",
       message: "future inspector capture API should record lifecycle, route, gateway, command, and interactive registrations",
       evidence: detailEvidence(captureGapRegistrationDetails),
+      compatRecord: compatRecordForIssueCode("registration-capture-gap"),
     });
     decisions.push({
       fixture: fixture.id,
@@ -477,6 +481,7 @@ export function classifyCompatibilityFixture({ fixture, inspection, fixtureRepor
       level: "suggestion",
       message: "add contract probes for before_tool_call terminal, block, and approval semantics",
       evidence: detailEvidence(hookDetails),
+      compatRecord: compatRecordForIssueCode("before-tool-call-probe"),
     });
     decisions.push({
       fixture: fixture.id,
@@ -500,6 +505,7 @@ export function classifyCompatibilityFixture({ fixture, inspection, fixtureRepor
       level: "suggestion",
       message: "add channel envelope, config-schema, and runtime metadata probes",
       evidence: detailEvidence(channelRegistrationDetails),
+      compatRecord: compatRecordForIssueCode("channel-contract-probe"),
     });
     decisions.push({
       fixture: fixture.id,

package/src/index.js

@@ -53,11 +53,13 @@ export const staticInspection = Object.freeze({
 export const reports = Object.freeze({
   renderMarkdown: reportApi.renderMarkdownReport,
   renderTextSummary: pluginApi.renderTextSummary,
+  sanitizeArtifact: reportApi.sanitizeReportArtifact,
   write: reportApi.writeReport,
   issueId: issuesApi.issueId,
   classifyIssueFinding: issuesApi.classifyIssueFinding,
   knownIssueCodes: issuesApi.knownIssueCodes,
   openClawTargetPathCandidates: openClawTargetApi.openClawTargetPathCandidates,
+  readOpenClawTargetSurface: openClawTargetApi.readOpenClawTargetSurface,
 });
 
 export const contracts = Object.freeze({
@@ -200,7 +202,7 @@ export {
 } from "./import-loop-profile.js";
 export { classifyIssueFinding, issueId, knownIssueCodes } from "./issues.js";
 export { inspectFixtureSet, inspectPlugin, inspectSourceText } from "./inspector.js";
-export { openClawTargetPathCandidates } from "./openclaw-target.js";
+export { openClawTargetPathCandidates, readOpenClawTargetSurface } from "./openclaw-target.js";
 export {
   buildProfileDiff,
   defaultProfileDiffOptions,
@@ -216,7 +218,7 @@ export {
   validateRefDiff,
   writeRefDiff,
 } from "./ref-diff.js";
-export { renderMarkdownReport, writeReport } from "./report.js";
+export { renderMarkdownReport, sanitizeReportArtifact, writeReport } from "./report.js";
 export {
   buildRuntimeProfile,
   defaultRuntimeProfileCommands,

package/src/issues.js

@@ -119,7 +119,7 @@ export const issueMetadataByCode = {
     severity: "P2",
     owner: "inspector",
     decision: "inspector-follow-up",
-    title: "cold import requires isolated dependency installation",
+    title: "cold import requires dependency installation in an isolated workspace",
   },
   "package-entrypoint-missing": {
     severity: "P1",

package/src/platform-probes.js

@@ -12,13 +12,11 @@ export function buildPlatformProbes(options = {}) {
   const entrypoints = plan.fixtures.flatMap((fixture) =>
     fixture.entrypoints.map((entrypoint) => summarizeEntrypoint(fixture.id, entrypoint)),
   );
-  const portabilityFindings = plan.fixtures.flatMap((fixture) =>
-    fixture.entrypoints.flatMap((entrypoint) =>
-      entrypoint.steps
-        .map((step) => summarizeStep(fixture.id, entrypoint, step))
-        .filter((finding) => finding.riskCodes.length > 0),
-    ),
+  const stepFindings = plan.fixtures.flatMap((fixture) =>
+    fixture.entrypoints.flatMap((entrypoint) => entrypoint.steps.map((step) => summarizeStep(fixture.id, entrypoint, step, options.stepCoverage))),
   );
+  const portabilityFindings = stepFindings.flatMap((finding) => (finding.residual ? [finding.residual] : []));
+  const coveredPortabilityFindings = stepFindings.flatMap((finding) => (finding.covered ? [finding.covered] : []));
 
   return {
     generatedAt: plan.generatedAt,
@@ -31,6 +29,7 @@ export function buildPlatformProbes(options = {}) {
       jitiAlternativeCount: entrypoints.filter((entrypoint) => entrypoint.loaderAlternatives.includes("jiti")).length,
       lazyImportProbeCount: entrypoints.filter((entrypoint) => entrypoint.capturePlanned && entrypoint.syntheticProbePlanned).length,
       portabilityFindingCount: portabilityFindings.length,
+      coveredPortabilityFindingCount: coveredPortabilityFindings.length,
       windowsRiskStepCount: portabilityFindings.filter((finding) => finding.platforms.includes("windows")).length,
       macosRiskStepCount: portabilityFindings.filter((finding) => finding.platforms.includes("macos")).length,
       linuxRiskStepCount: portabilityFindings.filter((finding) => finding.platforms.includes("linux")).length,
@@ -38,6 +37,7 @@ export function buildPlatformProbes(options = {}) {
     },
     entrypoints,
     portabilityFindings,
+    coveredPortabilityFindings,
     recommendations: buildRecommendations(portabilityFindings, entrypoints),
   };
 }
@@ -112,6 +112,19 @@ export function renderPlatformProbesMarkdown(report, options = {}) {
       ["Fixture", "Step", "Platforms", "Risks", "Mitigation"],
     ),
     "",
+    "## Covered Portability Findings",
+    "",
+    markdownTable(
+      (report.coveredPortabilityFindings ?? []).map((finding) => [
+        finding.fixture,
+        finding.kind,
+        finding.platforms.join(", ") || "-",
+        finding.riskCodes.join(", "),
+        finding.coverage,
+      ]),
+      ["Fixture", "Step", "Platforms", "Covered Risks", "Coverage"],
+    ),
+    "",
     "## Recommendations",
     "",
     markdownTable(
@@ -140,16 +153,48 @@ function summarizeEntrypoint(fixtureId, entrypoint) {
   };
 }
 
-function summarizeStep(fixtureId, entrypoint, step) {
+function summarizeStep(fixtureId, entrypoint, step, stepCoverage) {
   const riskCodes = stepRiskCodes(step);
-  return {
+  const coverage = normalizeStepCoverage(stepCoverage?.({ fixture: fixtureId, entrypoint, step, riskCodes }), riskCodes);
+  const residualRiskCodes = riskCodes.filter((code) => !coverage.riskCodes.includes(code));
+  const common = {
     fixture: fixtureId,
     entrypoint: entrypoint.id,
     kind: step.kind,
-    platforms: platformsForRiskCodes(riskCodes),
-    riskCodes,
     command: step.command,
-    mitigation: mitigationForRiskCodes(riskCodes),
+  };
+  return {
+    residual:
+      residualRiskCodes.length > 0
+        ? {
+            ...common,
+            coveredRiskCodes: coverage.riskCodes,
+            platforms: platformsForRiskCodes(residualRiskCodes),
+            riskCodes: residualRiskCodes,
+            mitigation: mitigationForRiskCodes(residualRiskCodes),
+          }
+        : null,
+    covered:
+      coverage.riskCodes.length > 0
+        ? {
+            ...common,
+            coverage: coverage.reason,
+            platforms: platformsForRiskCodes(coverage.riskCodes),
+            riskCodes: coverage.riskCodes,
+          }
+        : null,
+  };
+}
+
+function normalizeStepCoverage(coverage, riskCodes) {
+  if (!coverage) {
+    return { reason: "", riskCodes: [] };
+  }
+  const requested = coverage === true ? riskCodes : coverage.coveredRiskCodes ?? coverage.handledRiskCodes ?? coverage.riskCodes ?? coverage;
+  const covered = Array.isArray(requested) ? requested : [];
+  return {
+    reason: typeof coverage.reason === "string" && coverage.reason ? coverage.reason : "covered by isolated workspace executor",
+    riskCodes: covered.filter((code) => riskCodes.includes(code)).sort(),
   };
 }
 

package/src/report-sanitizer.js

@@ -0,0 +1,42 @@
+import path from "node:path";
+
+export function sanitizeReportArtifact(report, options = {}) {
+  const sensitivePaths = sensitiveOpenClawPaths(report);
+  if (sensitivePaths.length === 0) {
+    return report;
+  }
+  const placeholder = options.openclawPathPlaceholder ?? "<OPENCLAW_PATH>";
+  return sanitizeValue(report, sensitivePaths, placeholder);
+}
+
+function sensitiveOpenClawPaths(report) {
+  const targetOpenClaw = report?.targetOpenClaw;
+  return unique(
+    [targetOpenClaw?.configuredPath, ...(targetOpenClaw?.searchedPaths ?? [])]
+      .filter((value) => typeof value === "string" && isAbsolutePath(value))
+      .sort((left, right) => right.length - left.length),
+  );
+}
+
+function sanitizeValue(value, sensitivePaths, placeholder) {
+  if (typeof value === "string") {
+    return sensitivePaths.reduce((result, sensitivePath) => result.replaceAll(sensitivePath, placeholder), value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeValue(item, sensitivePaths, placeholder));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entryValue]) => [key, sanitizeValue(entryValue, sensitivePaths, placeholder)]),
+    );
+  }
+  return value;
+}
+
+function isAbsolutePath(value) {
+  return path.isAbsolute(value) || /^[A-Za-z]:[\\/]/u.test(value) || value.startsWith("\\\\");
+}
+
+function unique(values) {
+  return [...new Set(values)];
+}

package/src/report.js

@@ -4,6 +4,7 @@ import { renderCompatibilityIssuesReport, renderCompatibilityMarkdownReport } fr
 import { buildContractProbes } from "./contract-probes.js";
 import { classifyCompatibilityFixture } from "./fixture-summary.js";
 import { buildIssues, summarizeIssueClasses } from "./issues.js";
+import { sanitizeReportArtifact } from "./report-sanitizer.js";
 
 export function buildReport({ config, inspections, failures = [], generatedAt = "deterministic" }) {
   const inspectionById = new Map(inspections.map((inspection) => [inspection.id, inspection]));
@@ -233,12 +234,13 @@ export async function writeReport(report, options = {}) {
   const basename = options.basename ?? "plugin-inspector-report";
   const jsonPath = path.join(outDir, `${basename}.json`);
   const markdownPath = path.join(outDir, `${basename}.md`);
+  const artifactReport = sanitizeReportArtifact(report, options);
 
   return writeJsonMarkdownArtifacts({
     jsonPath,
     markdownPath,
-    json: report,
-    markdown: renderMarkdownReport(report),
+    json: artifactReport,
+    markdown: renderMarkdownReport(artifactReport),
     check: options.check,
   });
 }
@@ -249,6 +251,7 @@ export async function writeCompatibilityReport(report, options = {}) {
   const jsonPath = options.jsonPath ?? path.join(outDir, `${basename}.json`);
   const markdownPath = options.markdownPath ?? path.join(outDir, `${basename}.md`);
   const issuesPath = options.issuesPath ?? path.join(outDir, options.issuesBasename ?? "plugin-inspector-issues.md");
+  const artifactReport = sanitizeReportArtifact(report, options);
   const markdownOptions = compatibilityRenderOptions(options, {
     title: options.markdownTitle ?? options.title,
     ...options.markdownOptions,
@@ -260,14 +263,16 @@ export async function writeCompatibilityReport(report, options = {}) {
 
   return writeArtifacts(
     [
-      { name: "jsonPath", path: jsonPath, json: report },
-      { name: "markdownPath", path: markdownPath, markdown: renderCompatibilityMarkdownReport(report, markdownOptions) },
-      { name: "issuesPath", path: issuesPath, markdown: renderCompatibilityIssuesReport(report, issuesOptions) },
+      { name: "jsonPath", path: jsonPath, json: artifactReport },
+      { name: "markdownPath", path: markdownPath, markdown: renderCompatibilityMarkdownReport(artifactReport, markdownOptions) },
+      { name: "issuesPath", path: issuesPath, markdown: renderCompatibilityIssuesReport(artifactReport, issuesOptions) },
     ],
     { check: options.check },
   );
 }
 
+export { sanitizeReportArtifact };
+
 function compatibilityRenderOptions(options, overrides) {
   const renderOptions = {
     formatEvidence: options.formatEvidence,

package/src/synthetic-probes.js

@@ -16,19 +16,64 @@ export const syntheticRegistrationExecutionProfiles = {
     callableProperties: ["send", "sendMessage", "receive", "handleMessage"],
     option: "includeChannelRuntime",
   },
+  registerAgentHarness: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "agent harness factories are captured as registration metadata; agent runtime execution remains isolated opt-in",
+  },
+  registerAgentToolResultMiddleware: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "agent tool-result middleware is captured as registration metadata before tool-result pipeline execution",
+  },
+  registerAutoEnableProbe: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "auto-enable probes are captured as registration metadata before runtime activation checks",
+  },
   registerCli: {
     mode: "direct",
     callableProperties: ["handler", "run", "execute"],
   },
+  registerCliBackend: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "CLI backend descriptors are captured as registration metadata before backend process execution",
+  },
   registerCommand: {
     mode: "direct",
     callableProperties: ["handler", "run", "execute"],
   },
+  registerCodexAppServerExtensionFactory: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "Codex app server extension factories are captured as registration metadata before host UI execution",
+  },
+  registerCompactionProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "compaction providers are captured as registration metadata before compaction runtime execution",
+  },
+  registerConfigMigration: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "config migrations are captured as registration metadata before mutating stored plugin config",
+  },
   registerContextEngine: {
     mode: "metadata-only",
     callableProperties: [],
     reason: "context engine factories are captured as registration metadata; engine startup remains isolated opt-in",
   },
+  registerDetachedTaskRuntime: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "detached task runtimes are captured as registration metadata before async task execution",
+  },
+  registerGatewayDiscoveryService: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "gateway discovery services are captured as registration metadata before network discovery execution",
+  },
   registerGatewayMethod: {
     mode: "direct",
     callableProperties: ["handler", "run", "execute", "invoke"],
@@ -46,16 +91,91 @@ export const syntheticRegistrationExecutionProfiles = {
     callableProperties: [],
     reason: "legacy hook registrar is captured as metadata; hook handlers are probed through hook events",
   },
+  registerImageGenerationProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "image generation providers are captured as registration metadata before provider runtime execution",
+  },
   registerMemoryPromptSection: {
     mode: "metadata-only",
     callableProperties: [],
     reason: "memory prompt section renderers are captured as metadata before prompt-runtime execution",
   },
+  registerMediaUnderstandingProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "media understanding providers are captured as registration metadata before provider runtime execution",
+  },
+  registerMemoryCapability: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "memory capabilities are captured as registration metadata before memory runtime execution",
+  },
+  registerMemoryCorpusSupplement: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "memory corpus supplements are captured as registration metadata before memory runtime execution",
+  },
+  registerMemoryEmbeddingProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "memory embedding providers are captured as registration metadata before provider runtime execution",
+  },
+  registerMemoryFlushPlan: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "memory flush plans are captured as registration metadata before memory runtime execution",
+  },
   registerMemoryRuntime: {
     mode: "metadata-only",
     callableProperties: [],
     reason: "memory runtime factories are captured as metadata; external memory startup remains isolated opt-in",
   },
+  registerMemoryPromptSupplement: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "memory prompt supplements are captured as registration metadata before prompt-runtime execution",
+  },
+  registerMigrationProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "migration providers are captured as registration metadata before migration runtime execution",
+  },
+  registerMusicGenerationProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "music generation providers are captured as registration metadata before provider runtime execution",
+  },
+  registerNodeHostCommand: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "node host commands are captured as registration metadata before host process execution",
+  },
+  registerProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "provider descriptors are captured as registration metadata before provider runtime execution",
+  },
+  registerRealtimeTranscriptionProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "realtime transcription providers are captured as registration metadata before provider runtime execution",
+  },
+  registerRealtimeVoiceProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "realtime voice providers are captured as registration metadata before provider runtime execution",
+  },
+  registerReload: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "reload handlers are captured as registration metadata before runtime reload execution",
+  },
+  registerSecurityAuditCollector: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "security audit collectors are captured as registration metadata before filesystem or policy scans",
+  },
   registerService: {
     mode: "lifecycle-opt-in",
     callableProperties: ["start", "stop", "dispose"],
@@ -70,6 +190,26 @@ export const syntheticRegistrationExecutionProfiles = {
     mode: "direct",
     callableProperties: ["run", "handler", "execute"],
   },
+  registerTextTransforms: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "text transforms are captured as registration metadata before content mutation execution",
+  },
+  registerVideoGenerationProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "video generation providers are captured as registration metadata before provider runtime execution",
+  },
+  registerWebFetchProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "web fetch providers are captured as registration metadata before provider runtime execution",
+  },
+  registerWebSearchProvider: {
+    mode: "metadata-only",
+    callableProperties: [],
+    reason: "web search providers are captured as registration metadata before provider runtime execution",
+  },
 };
 
 export const defaultSyntheticHookEvents = {

package/src/workspace-plan.js

@@ -218,7 +218,7 @@ async function buildEntrypointPlan({ fixtureId, entrypoint, packageSummary, pack
   const packageManager = detectPackageManager(settings.rootDir, packageDir, packageJson);
   const lockfile = findNearestLockfile(settings.rootDir, packageDir);
   const buildScript = packageJson.scripts?.build;
-  const requiredCapabilities = requiredCapabilitiesFor(entrypoint);
+  const requiredCapabilities = requiredCapabilitiesFor(entrypoint, packageSummary);
   const loaderStrategy = loaderStrategyFor(entrypoint);
   const blockers = [...entrypoint.blockers];
   const workspacePath = posixJoin(settings.workspaceRoot, fixtureId);
@@ -342,7 +342,7 @@ function loaderStrategyFor(entrypoint) {
   };
 }
 
-function requiredCapabilitiesFor(entrypoint) {
+function requiredCapabilitiesFor(entrypoint, packageSummary = {}) {
   const capabilities = new Set();
   for (const blocker of entrypoint.blockers) {
     if (blocker.code === "dependency-install-required") {
@@ -361,7 +361,7 @@ function requiredCapabilitiesFor(entrypoint) {
       capabilities.add("side-effect-sandbox");
     }
   }
-  if (entrypoint.blockers.some((blocker) => /\bopenclaw\b/.test(blocker.evidence ?? ""))) {
+  if (hasHostLinkedOpenClawDependency(packageSummary)) {
     capabilities.add("target-openclaw-link");
   }
   capabilities.add("capture-shim");
@@ -369,6 +369,14 @@ function requiredCapabilitiesFor(entrypoint) {
   return [...capabilities].sort();
 }
 
+function hasHostLinkedOpenClawDependency(packageSummary) {
+  return [
+    ...(packageSummary.dependencies ?? []),
+    ...(packageSummary.peerDependencies ?? []),
+    ...(packageSummary.optionalDependencies ?? []),
+  ].includes("openclaw");
+}
+
 function detectPackageManager(rootDir, packageDir, packageJson) {
   const declared = typeof packageJson.packageManager === "string" ? packageJson.packageManager.split("@")[0] : null;
   if (declared) {