feat: import reviewed plugin bundles through publication gates

[Patrick-Erichsen]

Imports a reviewed plugin batch through the ordinary ClawHub CLI and prepublication worker. The importer preserves licensed source bytes and attribution, normalizes the selected bundle format, omits unsupported capabilities, and binds approval to the exact upload inventory after filesystem handling and ignore rules.

First releases remain outside public catalog discovery until checks complete; publishers retain pending-review dashboard access. A request may require prepublication checks even when the deployment-wide staging rollout is disabled. This slice handles initial batch imports; immutable repeat synchronization is the next stack layer.

Validation passed: ci:static, ci:unit (6,535 tests), ci:types-build, ci:packages, ci:e2e-http, focused regressions, and clean autoreview. The real local ClawHub acceptance run proves company/registry selection, duplicate/license/scan withholding, preserved downloaded files, and direct openclaw plugins install clawhub:<name>@<version> installs in a disposable OCM environment running OpenClaw 2026.9.3. Scanner verdicts are controlled fixtures through the real worker protocol; this is not a live ClawScan provider certification.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Sep 9, 2026 4:08am UTC

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 9, 2026, 12:10 AM ET / 04:10 UTC (Revision 3).

ClawSweeper review

What this changes

Adds an operator command that prepares reviewed plugin bundles, verifies their upload bytes, and publishes them through ClawHub’s existing security checks.

Merge readiness

⛔ Blocked before merge - 11 items remain

Keep open: this remains distinct, useful work absent from current main, and the collaborator-authored PR is protected from automatic closure. All three prior findings remain supported; the newer recovery authorization checks do not cover ordinary imported releases.

Priority: P2
Reviewed head: af8f8033bce8633493a4e7acc0e14ee5949deb22

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	Useful implementation and local acceptance evidence remain outweighed by the unresolved authorization defect and two concrete bundle compatibility failures.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: Authority-chain proof required: show an allowed ordinary organization import becoming public and a pending import remaining unavailable after publisher membership is revoked. The body and related local Convex/browser artifacts support publication and scan withholding, but neither covers this final-effect revocation case; unrelated proof remains exempt for this collaborator. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦪 silver shellfish (2/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Authority-chain proof required: show an allowed ordinary organization import becoming public and a pending import remaining unavailable after publisher membership is revoked. The body and related local Convex/browser artifacts support publication and scan withholding, but neither covers this final-effect revocation case; unrelated proof remains exempt for this collaborator. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	9 items	Policy and introduced scope: Read the complete root AGENTS.md and applicable ClawHub maintainer/Convex guidance. No additional ancestor AGENTS.md applies to the changed paths, and no maintainer-notes directory exists. The verified merge-base-to-head delta contains 19 files. Current main and release necessity: Current main only enters staging through options.stagePrePublicationChecks and contains no company-plugin importer directory. The latest supplied release also contains no scripts/company-plugins directory. No merged fixing PR was established. Ordinary staged publication retains stale authority: The new request flag introduces staging with global staging disabled. Admission checks organization membership in insertReleaseInternal, but the finalizer reaches publishPendingReleaseInternal, whose current-authority checks apply only to manual recovery or trusted-publish v2. Ordinary user imports have neither binding. Worker completion checks target existence, not membership.
Findings	3 actionable findings	[P1] Recheck publisher membership before making staged imports public [P2] Reconcile retained package metadata with the new publication name [P2] Preserve Agent-format detection when preparing the artifact
Security	Needs attention	Revoked organization member can complete queued publication: Admission authorizes the user, but ordinary staged finalization does not revalidate that authority before making the release publicly downloadable; recovery-specific checks do not protect this path.

How this fits together

ClawHub’s importer converts curated upstream files into downloadable plugin packages. It submits them through the CLI and staged publication worker, which controls when releases enter the public catalog.

flowchart TD
  A[Curated sources] --> B[License and capability inventory]
  B --> C[Prepared bundle and review digest]
  C --> D[CLI upload verification]
  D --> E[Private pending release]
  E --> F[Security checks and authorization]
  F --> G[Public catalog and downloads]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Authority-chain proof required: show an allowed ordinary organization import becoming public and a pending import remaining unavailable after publisher membership is revoked. The body and related local Convex/browser artifacts support publication and scan withholding, but neither covers this final-effect revocation case; unrelated proof remains exempt for this collaborator. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Recheck publisher membership before making staged imports public (P1) - With global staging disabled, this new flag queues ordinary user imports for later publication. If the organization removes that user while checks run, finalization still calls publishPendingReleaseInternal without rechecking membership: its authorization branches only cover manual recovery and trusted-publish v2. The release therefore becomes public under an organization the actor can no longer publish for. Revalidate the recorded actor and current publisher authority atomically before promotion. This prior finding remains unresolved.
• Reconcile retained package metadata with the new publication name (P2) - A selected bundle containing an upstream package.json retains those bytes, but preparation publishes it as @publisher/integration-job. publishPackageImpl applies ensurePluginNameMatchesPackage to bundle packages too, so an ordinary upstream name causes rejection before staging. Reconcile the declared package name as an explicit reviewed transformation, with coverage for bundles that contain package metadata. This prior finding remains unresolved.
• Preserve Agent-format detection when preparing the artifact (P2) - For source.format === "agent", this unconditionally adds openclaw.plugin.json beside the portable plugin.json. OpenClaw 2026.9.3 checks the native marker before the Agent marker and returns native detection, so the installed artifact no longer uses the selected Agent loader and its skills/MCP configuration. Preserve Agent detection through a supported publication representation, or reject that format until it can be represented correctly. This prior finding remains unresolved.
• Resolve security concern: Revoked organization member can complete queued publication - Admission authorizes the user, but ordinary staged finalization does not revalidate that authority before making the release publicly downloadable; recovery-specific checks do not protect this path.
• Resolve merge risk (P1) - Queued ordinary imports can become public after the submitting user loses organization publishing permission.
• Resolve merge risk (P1) - The acceptance fixture covers Cursor bundles without package.json; retained package metadata and Agent-format installation remain incompatible with the proposed transformation.
• Complete next step (P2) - Resolve the three findings, document the import invariants in specs, and provide allowed/revoked-member publication evidence with private information redacted.
• Improve patch quality - Repair the three findings and add focused publication and Agent-install regression coverage.
• Improve patch quality - Provide redacted final-effect evidence for allowed publication and membership revocation before catalog/download exposure; update the PR body for automatic re-review, or ask a maintainer to comment @clawsweeper re-review.
• Improve patch quality - Record reviewed-byte, format-conversion, and current-authority invariants in specs as requested in the previous review.

Findings

• [P1] Recheck publisher membership before making staged imports public — convex/packages.ts:9051-9053
• [P2] Reconcile retained package metadata with the new publication name — scripts/company-plugins/prepare.ts:131-132
• [P2] Preserve Agent-format detection when preparing the artifact — scripts/company-plugins/prepare.ts:89-94
• [high] Revoked organization member can complete queued publication — convex/packages.ts:9053

Agent review details

Security

Needs attention: The new staged user-import path can retain organization publishing authority after membership revocation.

Review metrics

Metric	Value	Why it matters
Patch size	+1025/-8 across 19 files	This spans importer tooling, CLI upload handling, backend publication, and validation.
Production and test delta	Production +443/-7; tests +546/-0; generated schema +36/-1	Production growth has a stated initial-import purpose, with separate unit and local acceptance coverage.

Merge-risk options

Maintainer options:

1. Repair promotion and artifact compatibility (recommended)
   Revalidate ordinary user authority in the publication transaction and resolve both artifact-format defects before demonstrating the corrected publication and install paths.

Technical review

Best possible solution:

Keep the existing publication pipeline, enforce current organization authority at promotion, and produce reviewed artifacts whose metadata and detected format match the intended installation.

Do we have a high-confidence way to reproduce the issue?

Yes, the findings have concrete source-backed triggers: revoke membership during pending checks, import a bundle with its upstream package.json name, or prepare an Agent bundle. This read-only review did not execute those scenarios.

Is this the best way to solve the issue?

No, the patch is not yet complete: reusing the existing publisher is the right layer, but its final authorization boundary and the generated artifact identities must be corrected instead of bypassing validation or introducing another publisher.

Full review comments:

• [P1] Recheck publisher membership before making staged imports public — convex/packages.ts:9051-9053
  With global staging disabled, this new flag queues ordinary user imports for later publication. If the organization removes that user while checks run, finalization still calls publishPendingReleaseInternal without rechecking membership: its authorization branches only cover manual recovery and trusted-publish v2. The release therefore becomes public under an organization the actor can no longer publish for. Revalidate the recorded actor and current publisher authority atomically before promotion. This prior finding remains unresolved.
  Confidence: 0.98
• [P2] Reconcile retained package metadata with the new publication name — scripts/company-plugins/prepare.ts:131-132
  A selected bundle containing an upstream package.json retains those bytes, but preparation publishes it as @publisher/integration-job. publishPackageImpl applies ensurePluginNameMatchesPackage to bundle packages too, so an ordinary upstream name causes rejection before staging. Reconcile the declared package name as an explicit reviewed transformation, with coverage for bundles that contain package metadata. This prior finding remains unresolved.
  Confidence: 0.99
• [P2] Preserve Agent-format detection when preparing the artifact — scripts/company-plugins/prepare.ts:89-94
  For source.format === "agent", this unconditionally adds openclaw.plugin.json beside the portable plugin.json. OpenClaw 2026.9.3 checks the native marker before the Agent marker and returns native detection, so the installed artifact no longer uses the selected Agent loader and its skills/MCP configuration. Preserve Agent detection through a supported publication representation, or reject that format until it can be represented correctly. This prior finding remains unresolved.
  Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 39ff7db30c2e.

Labels

Label changes:

• add P2: This is a bounded new operator workflow with concrete merge blockers, rather than an established urgent production incident.
• add merge-risk: 🚨 compatibility: Artifact preparation can retain a conflicting package name and shadow Agent-format detection in the supported runtime.
• add merge-risk: 🚨 security-boundary: The newly available staged import path can promote an organization release after its publisher’s membership is revoked.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Authority-chain proof required: show an allowed ordinary organization import becoming public and a pending import remaining unavailable after publisher membership is revoked. The body and related local Convex/browser artifacts support publication and scan withholding, but neither covers this final-effect revocation case; unrelated proof remains exempt for this collaborator. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a bounded new operator workflow with concrete merge blockers, rather than an established urgent production incident.
• merge-risk: 🚨 security-boundary: The newly available staged import path can promote an organization release after its publisher’s membership is revoked.
• merge-risk: 🚨 compatibility: Artifact preparation can retain a conflicting package name and shadow Agent-format detection in the supported runtime.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Authority-chain proof required: show an allowed ordinary organization import becoming public and a pending import remaining unavailable after publisher membership is revoked. The body and related local Convex/browser artifacts support publication and scan withholding, but neither covers this final-effect revocation case; unrelated proof remains exempt for this collaborator. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [high] Revoked organization member can complete queued publication — convex/packages.ts:9053
  Admission authorizes the user, but ordinary staged finalization does not revalidate that authority before making the release publicly downloadable; recovery-specific checks do not protect this path.
  Confidence: 0.98

What I checked:

• Policy and introduced scope: Read the complete root AGENTS.md and applicable ClawHub maintainer/Convex guidance. No additional ancestor AGENTS.md applies to the changed paths, and no maintainer-notes directory exists. The verified merge-base-to-head delta contains 19 files. (AGENTS.md:1, af8f8033bce8)
• Current main and release necessity: Current main only enters staging through options.stagePrePublicationChecks and contains no company-plugin importer directory. The latest supplied release also contains no scripts/company-plugins directory. No merged fixing PR was established. (convex/packages.ts:9037, 39ff7db30c2e)
• Ordinary staged publication retains stale authority: The new request flag introduces staging with global staging disabled. Admission checks organization membership in insertReleaseInternal, but the finalizer reaches publishPendingReleaseInternal, whose current-authority checks apply only to manual recovery or trusted-publish v2. Ordinary user imports have neither binding. Worker completion checks target existence, not membership. (convex/packages.ts:9053, af8f8033bce8)
• Retained package metadata conflicts with renamed publication: Preparation copies package.json unchanged while selecting a new publisher-qualified package name. Publication calls ensurePluginNameMatchesPackage for every non-Claw package containing package.json; that helper rejects a different declared name. (scripts/company-plugins/prepare.ts:132, af8f8033bce8)
• Affirmative OpenClaw dependency contract: Preparation explicitly relies on OpenClaw marker detection, the capability classifier names OpenClaw 2026.9.3 as its oracle, and the acceptance test invokes that runtime’s plugin installer. This establishes an OpenClaw runtime dependency, not a dependency on a separate Codex implementation. (scripts/company-plugins/prepare.ts:74, af8f8033bce8)
• Agent detection is shadowed by the generated native marker: OpenClaw v2026.9.3 resolves openclaw.plugin.json before the portable Agent plugin.json marker, returning native-format detection at lines 538–539. The release tag was resolved to the recorded source commit. (src/plugins/bundle-manifest.ts:538, 1391f7cd2d40)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-09T02:47:39.962Z sha 4c7a282 :: needs real behavior proof before merge. :: [P1] Recheck publisher membership before making staged imports public | [P2] Reconcile retained package metadata with the new publication name | [P2] Preserve Agent-format detection when preparing the artifact
• reviewed 2026-09-09T03:06:35.962Z sha f969a2d :: needs real behavior proof before merge. :: [P1] Recheck publisher membership before making staged imports public | [P2] Reconcile retained package metadata with the new publication name | [P2] Preserve Agent-format detection when preparing the artifact