@openclaw/plugin-inspector 0.3.21 → 0.3.23

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 0.3.23 - 2026-08-30
+
+### Fixed
+
+- Mask source comments in spans so inspecting large bundled JavaScript stays within serverless memory limits while preserving source offsets and findings.
+
+## 0.3.22 - 2026-08-30
+
+### Fixed
+
+- Finish OpenClaw target archive extraction before cleanup so strict extraction errors cannot race unfinished filesystem writes.
+
+### Changed
+
+- Refresh Crabbox hydration tooling to pnpm 11.24.0 and pnpm/action-setup 6.0.10.
+- Update the code-scanning example to CodeQL's Node 24-based SARIF upload action.
+
 ## 0.3.21 - 2026-08-05
 
 ### Fixed

package/examples/github-actions-code-scanning.yml

@@ -20,7 +20,7 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npx @openclaw/plugin-inspector ci --no-openclaw --runtime --mock-sdk --allow-execute
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: reports/plugin-inspector.sarif

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/plugin-inspector",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "private": false,
   "description": "Offline compatibility inspector for OpenClaw plugins.",
   "type": "module",

package/src/inspector.js

@@ -727,38 +727,11 @@ function lineForOffset(text, offset) {
 }
 
 function stripComments(text) {
-  let result = "";
-  for (let index = 0; index < text.length; index += 1) {
-    const char = text[index];
-    const next = text[index + 1];
-    if (char === "/" && next === "*") {
-      result += "  ";
-      index += 2;
-      while (index < text.length && !(text[index] === "*" && text[index + 1] === "/")) {
-        result += blankCommentChar(text[index]);
-        index += 1;
-      }
-      if (index < text.length) {
-        result += "  ";
-        index += 1;
-      }
-    } else if (char === "/" && next === "/") {
-      result += "  ";
-      index += 2;
-      while (index < text.length && text[index] !== "\n" && text[index] !== "\r") {
-        result += " ";
-        index += 1;
-      }
-      index -= 1;
-    } else {
-      result += char;
-    }
-  }
-  return result;
-}
-
-function blankCommentChar(char) {
-  return char === "\n" || char === "\r" ? char : " ";
+  // Mask spans rather than building one string node per UTF-16 code unit.
+  // Keep offsets and CR/LF intact for findings, including unterminated comments.
+  return text.replace(/\/\*[\s\S]*?(?:\*\/|$)|\/\/[^\r\n]*/g, (comment) =>
+    comment.replace(/[^\r\n]+/g, (span) => " ".repeat(span.length)),
+  );
 }
 
 function sortDetails(details) {

package/src/openclaw-version.js

@@ -149,7 +149,9 @@ async function preparePackageArchive(resolvedTarget, options) {
   try {
     const archivePath = path.join(temporaryDir, "openclaw.tgz");
     await writeFile(archivePath, archive);
-    await extractTar({ cwd: temporaryDir, file: archivePath, strict: true });
+    // Async tar rejection can leave filesystem writes running. Finish extraction
+    // before finally removes its workspace, including when strict validation fails.
+    extractTar({ cwd: temporaryDir, file: archivePath, strict: true, sync: true });
     const packageDir = path.join(temporaryDir, "package");
     if (!(await isPreparedPackage(packageDir, resolvedTarget.version))) {
       throw new Error(`downloaded OpenClaw ${resolvedTarget.version} archive has unexpected package metadata`);