$ show openclaw/plugin-inspector
Plugin Inspector is a CLI tool and library for offline static and runtime analysis of OpenClaw plugins. It validates plugin structure, SDK imports, hook registrations, and manifest contracts without requiring a live OpenClaw host. The tool generates rich compatibility reports in JSON, Markdown, SARIF, and JUnit formats, integrates with CI pipelines (GitHub Actions, GitLab, CircleCI), and supports batch analysis across plugin corpora. Its architecture is modular: a core inspection engine (src/inspector.js) performs static analysis using AST parsing (acorn, eslint-scope) and regex-based detection; an optional runtime capture subsystem (src/capture-api.js, src/synthetic-probes.js) executes plugin entrypoints with a dynamically generated mock SDK (src/sdk-mock.js) to verify registration behavior and hook handling. The tool also includes a CI policy engine, workspace planning, platform probes, and profiling/diffing utilities. While tightly coupled to OpenClaw internals, the codebase demonstrates strong engineering practices with extensive test coverage, reusable components, and a well-defined public API surface.
The LLM identified 5 files worth highlighting for reuse:
Provides atomic JSON file writing with symlink resolution and temp-file fallback. The writeJsonFile function writes to a temporary file, then renames atomically, ensuring no partial writes. It also resolves symlinks to prevent overwriting linked files. This pattern is reusable in any Node.js project requiring safe, crash-consistent file output.
Implements a path jail (resolveJailedPluginPath) that prevents directory traversal attacks by normalizing paths and rejecting any that escape the plugin root. Also includes isWithinPluginRoot, path normalization, and slugging utilities. This is a self-contained security pattern applicable to any tool that processes user-supplied file paths.
Manages child process execution with configurable timeouts, output capping, and RSS/CPU sampling via ps on POSIX. Uses owned process groups for clean termination and AbortController for cancellation. The runProfiledProcess function is a reusable pattern for any Node.js tool that needs to run external processes with resource limits and profiling.
Generates a complete mock openclaw/plugin-sdk package programmatically, including subpath exports, lazy proxy modules, and a custom Node.js module loader hook (installMockSdkLoader) that intercepts imports, strips TypeScript types, and resolves extensionless paths. This pattern is reusable for offline execution and testing of any plugin SDK without network access.
Performs static analysis of JavaScript/TypeScript source to collect import() and require() specifiers using acorn and eslint-scope for AST traversal and scope tracking. Handles dynamic imports, CommonJS require, and aliased bindings. This is a reusable dependency extraction pattern applicable to any code analysis tool.