From a9dbb6bc620673d00f97097fe25a9f259cb50d42 Mon Sep 17 00:00:00 2001 From: "openclaw-docs-sync[bot]" Date: Sat, 2 May 2026 00:38:01 +0000 Subject: [PATCH] chore(sync): mirror docs from openclaw/openclaw@5c447f53d71e9ecc3ae98683bf837386afa284c7 --- .openclaw-sync/source.json | 4 ++-- docs/cli/plugins.md | 2 +- docs/tools/clawhub.md | 6 +++++- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json index 48a88af55..56d80f631 100644 --- a/.openclaw-sync/source.json +++ b/.openclaw-sync/source.json @@ -1,5 +1,5 @@ { "repository": "openclaw/openclaw", - "sha": "2be441062d7bb6d9ba5b58ea12f5ea3df2880696", - "syncedAt": "2026-05-01T23:56:33.239Z" + "sha": "5c447f53d71e9ecc3ae98683bf837386afa284c7", + "syncedAt": "2026-05-02T00:36:17.424Z" } diff --git a/docs/cli/plugins.md b/docs/cli/plugins.md index e3be5bb98..3dc42428f 100644 --- a/docs/cli/plugins.md +++ b/docs/cli/plugins.md @@ -164,7 +164,7 @@ openclaw plugins install npm:openclaw-codex-app-server openclaw plugins install npm:@scope/plugin-name@1.0.1 ``` -OpenClaw downloads the package archive from ClawHub, checks the advertised plugin API / minimum gateway compatibility, then installs it through the normal archive path. Recorded installs keep their ClawHub source metadata for later updates. +OpenClaw checks the advertised plugin API / minimum gateway compatibility before install. When the selected ClawHub version publishes a ClawPack artifact, OpenClaw downloads the versioned ClawPack, verifies the ClawHub digest header and the artifact digest, then installs it through the normal archive path. Older ClawHub versions without ClawPack metadata still install through the legacy package archive verification path. Recorded installs keep their ClawHub source metadata and ClawPack digest facts for later updates. Unversioned ClawHub installs keep an unversioned recorded spec so `openclaw plugins update` can follow newer ClawHub releases; explicit version or tag selectors such as `clawhub:pkg@1.2.3` and `clawhub:pkg@beta` remain pinned to that selector. #### Marketplace shorthand diff --git a/docs/tools/clawhub.md b/docs/tools/clawhub.md index 543ea2a33..6e5f1a68c 100644 --- a/docs/tools/clawhub.md +++ b/docs/tools/clawhub.md @@ -80,7 +80,11 @@ Site: [clawhub.ai](https://clawhub.ai) Plugin installs validate advertised `pluginApi` and `minGatewayVersion` compatibility before archive install runs, so incompatible hosts fail closed early instead of partially installing - the package. + the package. When a package version publishes a ClawPack artifact, + OpenClaw prefers that artifact, verifies the ClawHub digest header and + downloaded bytes, and records the ClawPack digest metadata for later + updates. Older package versions without ClawPack metadata still use the + legacy package archive verification path.