chore: adopt plugin-inspector 0.3.25

[vincentkoc]

What Problem This Solves

Crabpot's default packaged inspector remained on 0.3.24, while its source pin lacked the completed 0.3.25 lifecycle, timeout, CommonJS capture, and Gateway validation repairs.

Why This Change Was Made

Pins both source and published-package modes to the verified 0.3.25 release, updates their existing test guards, and brings the two operational docs and changelog into agreement. No fixture, host, runtime logic, workflow, or report expectation changes.

Related release: openclaw/plugin-inspector#75

User Impact

Default package-mode smoke and pinned source consumers now use the released inspector repairs. Development overrides remain available; the docs explain how to keep source-mode and fresh-cache published-mode checks distinct.

Evidence

• Frozen follow-through head: 39d79acfe352aee270fb6186e1604d84a705e32f, based on Crabpot main 6219f185358ff03219bf2953c6b114ffaee9a78a. Five files, 19 additions and 16 deletions.
• Inspector source pin: 2e21b3b48aa06fea30b08202f4c6be13c1f3216a, annotated release https://github.com/openclaw/plugin-inspector/releases/tag/v0.3.25. Existing tag-push trusted-publishing workflow passed at that exact SHA: https://github.com/openclaw/plugin-inspector/actions/runs/34380426028.
• Registry gitHead, latest tag, integrity, signatures, and provenance verified. The provenance subject binds the package digest to the exact source SHA, release tag, workflow, and run. Fresh registry installation with scripts disabled passed all 19 public exports, root API and CLI checks, and byte comparison of all 59 package files against the release commit.
• Published tarball SHA-256: d29d54c51d729f2162473a242e1a0d00e0c5ba75eb5b2b67b2aa2aed40dc6151, identical to the reviewed candidate.
• Actual npm run plugin-inspector:smoke in default published mode passed all 59 unchanged fixtures with zero breakages. CRABPOT_PLUGIN_INSPECTOR_BIN, CRABPOT_PLUGIN_INSPECTOR_CLI, and CRABPOT_PLUGIN_INSPECTOR_DIR were unset; npm used a fresh cache and disabled lifecycle scripts.
• Source, installed candidate tarball, and published inventory reports match apart from timestamps. Source proof is bound to the landed release SHA by exact candidate/release tree equivalence and all 59 package-file comparisons.
• Additional published compatibility report against the unchanged pinned OpenClaw host 5570c5ffac86acb74979c7314da6f3364781985a also matches source/packed reports: 59 fixtures, zero fixture breakages, 384 findings including nine live/P0 findings. One published 0.3.24 baseline on those exact inputs confirms all 384 issues are unchanged. The host's re-exported compat registry remains a pre-existing parser limitation, not hidden by an expectation change.
• Acquisition preserved all 30 gitlink pins and the exact recorded versions of 27 npm fixtures, with scripts disabled, archive containment validation, and registry-derived metadata. Matrix and Mattermost retained native source-pack semantics from the pinned host. No external plugin code was imported or built.
• Strict release:crabpot --expected-ref 2e21b3b48aa06fea30b08202f4c6be13c1f3216a --expected-version 0.3.25 --published passed. This checklist does not execute smokes; the actual runs are recorded separately above.
• Final pin/CLI tests: 5 passed. Earlier focused report, cold-import, and synthetic consumer tests: 20 passed without expectation changes. Final five-file P2 review: scoped-clean. git diff --check passed.
• Exact-head Check passed on 39d79acfe352aee270fb6186e1604d84a705e32f: Linux, macOS, Windows, container, fixture-security scope check, and required Default Track (pinned OpenClaw) aggregate are green: https://github.com/openclaw/crabpot/actions/runs/34380916198. CodeQL passed at the same head: https://github.com/openclaw/crabpot/actions/runs/34380914227.

Fixture Impact

• Adds or updates fixture manifest entries
• Updates submodule pins
• Changes contract or smoke logic
• Docs only

Dependency source/package pins, matching test guards, and release documentation only. All fixture versions, configuration, and expectations remain unchanged.

Fixture Verification

• npm test
• node scripts/sync-fixtures.mjs --check
• node scripts/run-contract-smoke.mjs
• Strict fixture smoke, if submodules were materialized

The full materializing suite was not rerun locally for this pin/docs delta. Actual inspector source/packed/published inventory and pinned-host report checks and focused consumer tests are listed above. Native exact-head PR CI subsequently passed on all four required static lanes.

Notes

No external runtime services or credentials were used. Static report success is not a claim that the pinned host is free of compatibility findings or that external plugins executed successfully. Existing maintainer drafts and unrelated fixture-containment work are untouched. The source owner accepted the final five-file diff, publication binding, actual smokes, P2 review, and exact-head required CI, and granted the serial merge slot for this head. The separate advisory HEAD canary is not a required gate; its Windows report finalization was still running when merge clearance was granted.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 9, 2026, 1:10 PM ET / 17:10 UTC.

ClawSweeper review

What this changes

Updates Crabpot’s inspector source and npm package pins to 0.3.25, along with matching test guards and operational documentation.

Merge readiness

✅ Ready for maintainer review

The adoption remains necessary: neither current main nor the latest Crabpot release includes it. The focused patch and recorded compatibility checks support landing through the normal maintainer process; no blocking defect was found.

Priority: P2
Reviewed head: 39d79acfe352aee270fb6186e1604d84a705e32f

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused adoption with matching guards, verified release identity, and relevant recorded integration checks; no blocking correctness finding.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The recorded Crabpot smoke runs exercise the changed loader through real source and published-package entrypoints on 59 unchanged fixtures, with zero breakages and matching reports; the same-input older-package baseline supports upgrade compatibility.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The recorded Crabpot smoke runs exercise the changed loader through real source and published-package entrypoints on 59 unchanged fixtures, with zero breakages and matching reports; the same-input older-package baseline supports upgrade compatibility.
Evidence reviewed	6 items	Repository policy applied: Read the complete root AGENTS.md. No additional ancestor policies or maintainer-notes directory were found for the changed paths. The coordinated pins, test guards, and separately recorded source/package smokes follow the repository’s adoption policy; recorded unchanged report results explain why expectations were retained. Introduced change and implementation boundary: The verified base-to-head delta contains five files, with 19 additions and 16 deletions. The loader directly imports plugin-inspector’s public API and invokes its CLI, establishing the dependency contract relevant to this review. Fixture definitions, plugin source, workflows, and report expectations are unchanged. Adoption is absent from main and latest release: Current main still selects source 84ede904fd6e766a9fc4de002f39af87d90c1916 and package 0.3.24. Reading the loader at latest release v0.2.1 showed package 0.3.16. Neither already implements this adoption.
Findings	None	None.
Security	None	None.

How this fits together

Crabpot uses plugin-inspector to examine configured plugin fixtures and produce compatibility reports. Its loader selects source or published-package execution, while Crabpot retains fixture selection and reporting orchestration.

flowchart TD
  A[Configured plugin fixtures] --> B[Crabpot inspection commands]
  B --> C{Inspector selection}
  C --> D[Pinned source or development override]
  C --> E[Published npm package]
  D --> F[Inspect plugin contracts]
  E --> F
  F --> G[Compatibility reports and check status]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Fixture compatibility	59 fixtures; 0 breakages; 384 existing findings unchanged	Recorded same-input comparisons support adopting the release without masking findings or changing fixture expectations.

Technical review

Best possible solution:

Keep source and published inspector versions aligned while preserving fixture pins, report contracts, and explicit development overrides.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency adoption, and current main’s older pins are directly observable in source.

Is this the best way to solve the issue?

Yes: updating the existing loader constants and matching guards follows the established integration path, with recorded source/package parity checks supporting unchanged report expectations.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6219f185358f.

Labels

Label changes:

• add P2: This is a bounded dependency adoption bringing released inspector reliability repairs into Crabpot.
• add proof: sufficient: Contributor real behavior proof is sufficient. The recorded Crabpot smoke runs exercise the changed loader through real source and published-package entrypoints on 59 unchanged fixtures, with zero breakages and matching reports; the same-input older-package baseline supports upgrade compatibility.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The recorded Crabpot smoke runs exercise the changed loader through real source and published-package entrypoints on 59 unchanged fixtures, with zero breakages and matching reports; the same-input older-package baseline supports upgrade compatibility.

Label justifications:

• P2: This is a bounded dependency adoption bringing released inspector reliability repairs into Crabpot.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The recorded Crabpot smoke runs exercise the changed loader through real source and published-package entrypoints on 59 unchanged fixtures, with zero breakages and matching reports; the same-input older-package baseline supports upgrade compatibility.
• proof: sufficient: Contributor real behavior proof is sufficient. The recorded Crabpot smoke runs exercise the changed loader through real source and published-package entrypoints on 59 unchanged fixtures, with zero breakages and matching reports; the same-input older-package baseline supports upgrade compatibility.

Evidence

What I checked:

• Repository policy applied: Read the complete root AGENTS.md. No additional ancestor policies or maintainer-notes directory were found for the changed paths. The coordinated pins, test guards, and separately recorded source/package smokes follow the repository’s adoption policy; recorded unchanged report results explain why expectations were retained. (AGENTS.md:14, 39d79acfe352)
• Introduced change and implementation boundary: The verified base-to-head delta contains five files, with 19 additions and 16 deletions. The loader directly imports plugin-inspector’s public API and invokes its CLI, establishing the dependency contract relevant to this review. Fixture definitions, plugin source, workflows, and report expectations are unchanged. (scripts/plugin-inspector-source.mjs:7, 39d79acfe352)
• Adoption is absent from main and latest release: Current main still selects source 84ede904fd6e766a9fc4de002f39af87d90c1916 and package 0.3.24. Reading the loader at latest release v0.2.1 showed package 0.3.16. Neither already implements this adoption. (scripts/plugin-inspector-source.mjs:7, 6219f185358f)
• Published dependency identity and supply chain: GitHub confirms chore(release): prepare plugin-inspector 0.3.25 plugin-inspector#75 merged at the selected source SHA. Registry metadata independently reports version 0.3.25 with the same gitHead, signatures and provenance metadata. Release workflow 34380426028 succeeded at that SHA. Compared package and lockfile changes retain dependencies and engine requirements, with no added lifecycle hooks. (package.json:3, 2e21b3b48aa0)
• Recorded production-path adoption checks: The complete supplied PR body records actual source, installed-tarball, and default published-package smokes on 59 unchanged fixtures with zero breakages. Published mode used a fresh npm cache with inspector overrides unset. The same-input 0.3.24 baseline retained all 384 compatibility findings, and five pin/CLI tests plus 20 focused consumer tests passed without expectation changes. These are contributor-recorded results, not reviewer-executed tests. (39d79acfe352)
• Area history and related work: Available history shows sustained inspector integration work by Vincent Koc and recent pin/smoke work by Peter Steinberger. GitHub confirms fix: use repaired inspector and enforce smoke failures #294 merged the earlier adoption. Open chore(deps): refresh stable fixtures and repair telemetry audit #295 covers an older inspector plus fixture refresh, while fix: time out hung plugin-inspector spawnSync calls #288 addresses caller subprocess timeouts. Neither supersedes this release adoption. Exact historical line attribution could not be completed because required historical blobs were unavailable; no introduction claim is made. (scripts/plugin-inspector-source.mjs, 6219f185358f)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.