fix: align OpenClaw plugin metadata

[vincentkoc]

Summary

• remove unsupported top-level OpenClaw manifest fields
• declare openclaw.compat.pluginApi / gateway compatibility metadata

Why

This PR comes from an OpenClaw core maintainer compatibility pass across Crabpot's visible plugin fixtures. The goal is to improve the overall OpenClaw plugin experience by helping widely used plugins clear high-signal Crabpot/plugin-inspector findings before they become install, ClawHub, or compatibility problems.

Relevant projects:

• OpenClaw: https://github.com/openclaw/openclaw
• Crabpot compatibility reports: https://github.com/openclaw/crabpot
• plugin-inspector: https://github.com/openclaw/plugin-inspector

Crabpot findings

Discovered in Crabpot at openclaw/crabpot@3b5131e345404e551ab09f6af686462fa8095ef2:

• manifest-unknown-fields: https://github.com/openclaw/crabpot/blob/3b5131e345404e551ab09f6af686462fa8095ef2/reports/crabpot-report.md#L1202-L1208
• package-plugin-api-compat-missing: https://github.com/openclaw/crabpot/blob/3b5131e345404e551ab09f6af686462fa8095ef2/reports/crabpot-report.md#L1209-L1214

Maintainer test instructions

You can verify this package with plugin-inspector from this repo:

npx @openclaw/plugin-inspector check --plugin-root . --openclaw /path/to/openclaw --json

For a local plugin-inspector checkout, use:

node /path/to/plugin-inspector/src/cli.js check --plugin-root . --openclaw /path/to/openclaw --json

Local validation

• JSON parse check for touched package/manifest files
• node /Users/vincentkoc/GIT/_Perso/plugin-inspector/src/cli.js check --plugin-root . --openclaw /Users/vincentkoc/GIT/_Perso/openclaw --json
• Local plugin-inspector result: pass, 0 plugin-owned residues after this patch

Remaining findings

Any remaining findings after this patch are owned by OpenClaw core or plugin-inspector capture/runtime coverage, not this plugin package metadata.

[meng93]

I read the full PR and compared it against main. Verdict first, then a P0/P1/P2 punch list.

PR Overview

• Author: vincentkoc (cross-repo fork; branch codex/openclaw-metadata, likely AI-generated)
• The real code change is ~10 lines (openclaw.plugin.json + package.json); the remaining ~2030 lines are three generated inspector reports under reports/
• PR is based on 0.8.20; main is already at 0.8.21-beta.0 — stale, needs rebase
• The inspector report itself says: P0=0, Live issues=0, Compat gaps=0. The lone P1 is an inspector-gap (the tool can't statically capture it — not a real defect)

Bottom line: don't merge as-is. The "fix" framing is contradicted by the report's own data. Some changes are genuinely useful, others should be dropped — please split before merging.

---

P0 (must fix before merging)

1. Report files leak the contributor's local filesystem path
   reports/plugin-inspector-report.json:284, :286, :1909 and other lines hardcode /Users/vincentkoc/GIT/_Perso/openclaw as a "deterministic" field. That's both a PII leak and a reproducibility hole — nobody else (and no CI) can regenerate this report identically.

2. 2030+ lines of inspector reports should not be checked in
   reports/plugin-inspector-issues.md, reports/plugin-inspector-report.md, reports/plugin-inspector-report.json are one-shot tool output. They will go stale the moment the upstream inspector or OpenClaw bumps a version. They belong in CI artifacts or an external repo, not in the plugin source tree. If they must be kept locally, add reports/ to .gitignore.

3. Removing author from openclaw.plugin.json needs an authoritative source
   The PR justifies removing "author": "DingTalk Real Team" as "unsupported top-level OpenClaw manifest fields", but cites only a third-party Crabpot report — no link to the OpenClaw manifest schema or doc. Dropping branding/attribution must be backed by evidence that the field is actually rejected or causes install / ClawHub failures; most validators silently ignore unknown fields, so leaving it in is harmless.

---

P1 (should fix before merging)

4. build.openclawVersion: "2026.4.9" duplicates peerDependencies.openclaw: ">=2026.4.9"
   The new openclaw.build.openclawVersion (package.json:139) hardcodes a single pinned value that says the same thing as the existing peerDependency range, with stricter framing. The two will drift on the next OpenClaw bump. Either drop it or derive it from peerDependencies.

5. compat.pluginApi / compat.minGatewayVersion values need to be justified
   package.json:135-138 reuses >=2026.4.9 without evidence the plugin actually requires anything that landed in 2026.4.9. Once written, these fields gate install-time version eligibility on ClawHub — wrong values either lock out older OpenClaw users or over-promise compatibility. Derive the lower bound from the plugin SDK surface this code actually calls, and document the reasoning in the PR.

6. Removing main: "index.ts" from openclaw.plugin.json needs runtime confirmation
   package.json's main is ./dist/index.mjs — different field, different layer. The PR drops the manifest-level main but keeps the package.json one. Before merging, grep the OpenClaw manifest-loader code to confirm manifest.main truly isn't consumed any longer; otherwise this is a silent behavior change.

7. PR is behind main — rebase required
   PR tree still has version: "0.8.20"; main is on 0.8.21-beta.0 (#595). Rebase before merging or risk reverting release metadata.

---

P2 (nice to have)

8. fix: is the wrong commit type
   The inspector reports 0 P0 / 0 live issues. This is metadata normalization plus new compat declarations. Semantically it's chore: or refactor(manifest):, not fix:.

9. Drop the pure-formatting skills change
   openclaw.plugin.json:14-17 reflows ["./skills"] to multi-line — pure prettier noise, unrelated to the PR's purpose. Splitting it into its own PR keeps this diff legible.

10. The remaining legacy-root-sdk-import deprecation isn't addressed
    The report's P2 finding legacy-root-sdk-import (10 sites importing the openclaw/plugin-sdk root barrel: index.ts:17, src/channel.ts:5, etc.) is the real plugin-side debt. This PR only ships metadata, leaving that debt for next round. If the maintainer fixes it here, the PR genuinely "improves the OpenClaw plugin experience"; otherwise we'll see a follow-up doing this same dance.

11. External contributor warrants dual-side review
    codex/... branch name + boilerplate phrasing in the report ("deterministic", "contract probe backlog") + cross-repo PR + first appearance from this contributor — metadata changes look harmless on the surface, but compat.pluginApi actually drives installer decisions. Recommend one DingTalk-side and one OpenClaw-side maintainer both sign off before merge.

---

Suggested landing path

Split into three PRs:

• ① Keep compat.pluginApi / minGatewayVersion only, with values derived from real API surface usage — merge this
• ② author / main / formatting removals, with a link to the OpenClaw manifest schema — merge separately
• ③ Move reports to CI artifacts (or drop them entirely) and add reports/ to .gitignore

Thanks for the contribution — happy to re-review once these are addressed.

[meng93]

补充一条中文说明，方便国内同学快速对齐：

感谢 @vincentkoc 的贡献，这边对照 main 看完后有几个合并前需要先处理的问题，烦请确认下：

1. reports/plugin-inspector-report.json 等三份报告里硬编码了贡献者本机绝对路径 /Users/vincentkoc/GIT/_Perso/openclaw（见 :284、:286、:1909 等多处），既泄露个人路径也无法在我方 CI 上复现 "deterministic" 结果。这类报告属于工具一次性产物，建议不要入库，移到 CI artifact，并在 .gitignore 里加上 reports/。
2. 删除 openclaw.plugin.json 顶层的 author 和 main 这一步，能否直接给出 OpenClaw 主仓 manifest schema 的链接作为依据？目前 PR 描述只引用了第三方 Crabpot 报告，删除品牌归属字段需要更硬的证据；多数 schema 校验器会忽略未知字段，留着应当无害。
3. package.json 新增的 openclaw.compat.pluginApi: ">=2026.4.9" 与 openclaw.build.openclawVersion: "2026.4.9" 和已有的 peerDependencies.openclaw 重复，且取值没给推导依据。这两个字段会影响 ClawHub 装机的版本下界判定，麻烦按本插件实际用到的 SDK 调用面来确定真实下界，避免误伤老版本 OpenClaw 用户。
4. PR 基线还是 0.8.20，main 已经到 0.8.21-beta.0（release: v0.8.21-beta.0 (community validation) #595），合并前请 rebase，避免 release 元数据被回退。
5. 报告中那条 P2 legacy-root-sdk-import（index.ts:17 等 10 处使用 openclaw/plugin-sdk 根 barrel）才是真正"插件侧能修"的兼容债，本 PR 没动；如果方便顺手在本 PR 里也处理掉，整体收益会更大，否则建议另开一个 PR 跟进。

建议把当前 PR 拆成 3 个：① 仅保留 compat.* 字段（带推导依据）；② 删除 author / main / 格式化（带 schema 链接）；③ 报告文件移除并加 .gitignore。这样每个 PR 都能独立 review、独立回滚，风险最低。再次感谢贡献 🙏