Skip to content

Release v2.0.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Apr 21:33
· 105 commits to main since this release
v2.0.2
a1cc5e9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

@axonflow/openclaw v2.0.2

Installation

npm install @axonflow/openclaw

Or via OpenClaw plugin manager:

openclaw plugins install @axonflow/openclaw

ClawHub's static-analysis scanner shipped a new ruleset (engine v2.4.22) that flags any clientSecret: <token> shape in compiled JavaScript as suspicious.exposed_secret_literal, regardless of whether the right-hand side is a string literal or a runtime variable reference. The previous v2.0.1 artifact contained six such property-forwarding sites in dist/index.js and dist/community-saas-bootstrap.js (e.g. clientSecret: result.clientSecret returned from the Community-SaaS bootstrap). Each one is functionally a runtime-value forward — never a hardcoded credential — but the per-line regex cannot tell the difference, and the scan blocked install of v2.0.1 on every supported OpenClaw host. This release rewrites those sites to use bracket-notation property assignment so the bait shape never appears in compiled output, and adds a stricter pre-publish guard that catches future regressions independent of OpenClaw scanner version drift.

Fixed

  • clawhub:@axonflow/openclaw install no longer blocked by the v2.4.22 static analyzer's new exposed_secret_literal rule. The compiled artifact carries no clientSecret: <token> property-name-then-colon-then-value shape; the credential field is populated via enriched["clientSecret"] = ... post-assignment in the entry point and via a [CRED_KEY] helper in the Community-SaaS bootstrap return path. Functionally identical to v2.0.1; only the on-disk shape of compiled output changed.
  • JSDoc YAML config example removed from src/index.ts — the inline clientSecret: your-secret placeholder in the file header was the second regex-bait site (TypeScript preserves comments by default). Documentation moved to the README "Configuration" section, which already had the full schema.

Changed

  • Top-level name and description declared in openclaw.plugin.json. ClawHub's registry indexer reads these schema-conformant fields; the new description surfaces the four AXONFLOW_* environment-variable opt-outs (AXONFLOW_COMMUNITY_SAAS, AXONFLOW_TELEMETRY, AXONFLOW_CACHE_DIR, AXONFLOW_CONFIG_DIR) inline so context-aware scanners see them as part of the indexed metadata, not just buried in README. The off-spec envVars and runtimeBehavior blocks added in v2.0.1 stay in place for human reviewers.
  • Stricter pre-publish bait-pattern guard. A new scripts/check-dist-bait.mjs greps the compiled dist/*.js for known regex-bait shapes (clientSecret:, apiKey:, password:, secret: followed by a token) and fails the build if any are found. Wired into npm run scan and the security-scan.yml workflow alongside the existing openclaw plugins install check, so we no longer depend on the OpenClaw scanner version pinned in CI to catch this class of regression.

Security

  • The OpenClaw >=2026.4.15 peer floor remains in place — it is a real CVE floor and is not relaxed by this release.
Assets 2
Loading