v0.16.2

This release brings a native OpenClaw plugin for Portage, @tomtom87/portage, and the fixes from ClawHub's security audits of it. ClawHub's audit of 0.10.4 passes: "No suspicious patterns detected". It covers the 0.16.0, 0.16.1 and 0.16.2 release sets, none of which were tagged before.

• New: OpenClaw plugin @tomtom87/portage 0.10.4 (ClawHub). It gives an agent 23 typed portage_* tools over the portage CLI, with arguments passed as an array and never through a shell.
  • Read-only by default. The 13 read-only tools are on by default. The 10 that price, approve, buy, hand off, open a browser or edit the index are opt-in.
  • Portage's policy still decides every payment. No tool passes --yes for a URL or an offer. portage_approve relays a yes only when told the user gave it. Policy, payment, setup and history clearing are not exposed.
  • Bundled skills. It ships the buy and shop-research skills plus a short portage-openclaw skill that maps each buying step to its tool.
  • Requirements. It needs portage-cli 0.12.0 or newer and OpenClaw 2026.5.28 or newer.
  • Install with openclaw plugins install clawhub:tomtom87/portage.
• Security: no direct-checkout fallback. The plugin's copy of the buy skill no longer has the "no CLI" fallback, in which the agent drove a store's checkout over raw UCP itself, outside Portage's policy, approval and mismatch checks. That section now tells the agent to install portage and stop.
• Security: the plugin starts only portage, through OpenClaw's own command helper. The runner refuses any portageBin that doesn't name the portage executable. It hands the argument array to api.runtime.system.runCommandWithTimeout, so the plugin has no child_process code of its own (this cleared suspicious.dangerous_exec). The per-call timeout and the 16 MB output cap are unchanged. Output past the cap is now a plain error, and portage gets an empty stdin.
• Security: the buy and shop-research skills are reworded. ClawHub's SkillSpector audit had flagged their wording, not anything they do. The rewording keeps every instruction the same:
  • The skills now say the env file must be readable only by the user (file mode 600) instead of chmod 600.
  • Paths in env var descriptions are in backticks.
  • The Etsy and eBay tokens are called OAuth tokens, and Amazon's an API token.
  • The injection example in the hard rules is described instead of quoted.
• Narrower buy trigger. The skill now triggers only on an explicit buy, order or reorder request, Portage setup or order tracking. Its description gives examples and lists what it isn't for: price or stock questions, product advice, and purchases the user makes themselves.
• ClawHub listing. The OpenClaw plugin is listed under Integrations.
• buy plugin 0.10.4. Its skills' version follows plugin.json. The portage-buy skill on ClawHub is at 0.10.4 too.

No gem changed in this release; portage-cli stays at 0.12.0.