negodiy/openclaw
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Infra: require explicit opt-in for prerelease npm installs (#38117)

Browse Source 
* Infra: tighten npm registry spec parsing

* Infra: block implicit prerelease npm installs

* Plugins: cover prerelease install policy

* Infra: add npm registry spec tests

* Hooks: cover prerelease install policy

* Docs: clarify plugin guide version policy

* Docs: clarify plugin install version policy

* Docs: clarify hooks install version policy

* Docs: clarify hook pack version policy
This commit is contained in:
Vincent Koc
2026-03-06 11:13:30 -05:00
committed by GitHub
parent a274ef929f
commit f392b81e95
9 changed files with 337 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/tools/plugin.md
View File

@@ -31,8 +31,12 @@ openclaw plugins list
openclaw plugins install @openclaw/voice-call
```
Npm specs are **registry-only** (package name + optional version/tag). Git/URL/file
specs are rejected.
Npm specs are **registry-only** (package name + optional **exact version** or
**dist-tag**). Git/URL/file specs and semver ranges are rejected.
Bare specs and `@latest` stay on the stable track. If npm resolves either of
those to a prerelease, OpenClaw stops and asks you to opt in explicitly with a
prerelease tag such as `@beta`/`@rc` or an exact prerelease version.
3. Restart the Gateway, then configure under `plugins.entries.<id>.config`.