Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix fix: thread dangerouslyForceUnsafeInstall through installPluginFromArchive and npm archiveInstallParams [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#59171•Fetched 2026-04-08 02:27:49
View on GitHub
Comments
0
Participants
1
Timeline
3
Reactions
0
Author
aaronson2012aaronson2012
Participants
aaronson2012aaronson2012
Timeline (top)
cross-referenced ×2referenced ×1

In OpenClaw 2026.3.31, openclaw plugins install <spec> --dangerously-force-unsafe-install has no effect for installs that go through tarball/archive extraction (e.g. ClawHub and npm pack flows).

Root Cause

  • installPluginFromArchive calls pickPackageInstallCommonParams({ ... }) but omits dangerouslyForceUnsafeInstall from params, so the security scan always sees undefined and blocks on critical findings.
  • installPluginFromNpmSpec passes archiveInstallParams without dangerouslyForceUnsafeInstall.

Fix Action

Workaround

Install from an extracted directory with the flag (directory path forwards the option correctly).

(Reported from user environment; local patch applied to dist/install-DtMAYXp_.js confirms the fix.)

PR fix notes

PR #60140: fix: thread dangerouslyForceUnsafeInstall through plugins update command

Description (problem / solution / changelog)

Summary

Add --dangerously-force-unsafe-install flag to plugins update command and thread it through the entire update flow.

Currently, plugins update has no way to bypass the dangerous code scanner, causing all plugins using child_process to fail updating. This affects plugins that legitimately need process management: feishu, codex, clawarena, clawnetwork, etc.

Changes

3 files, 15 insertions:

  • src/cli/plugins-cli.ts: Add dangerouslyForceUnsafeInstall to PluginUpdateOptions type + add --dangerously-force-unsafe-install option to the update command definition
  • src/cli/plugins-update-command.ts: Accept the flag and pass it to updateNpmInstalledPlugins
  • src/plugins/update.ts: Add parameter to function signature, thread it to all 6 installPluginFrom* calls (npm/clawhub/marketplace × dryRun/actual)

Test plan

# Before: blocked
openclaw plugins update clawnetwork
# → Failed to update clawnetwork: Plugin "clawnetwork" installation blocked: dangerous code patterns detected

# After: works with flag
openclaw plugins update clawnetwork --dangerously-force-unsafe-install
# → Updated clawnetwork 0.1.3 → 0.1.4

Fixes #60138 Related: #59241 #59171 #59508 #59521 #40162

Changed files

  • src/cli/plugins-cli.ts (modified, +6/-0)
  • src/cli/plugins-update-command.ts (modified, +2/-1)
  • src/plugins/update.ts (modified, +7/-0)
RAW_BUFFERClick to expand / collapse

Summary

In OpenClaw 2026.3.31, openclaw plugins install <spec> --dangerously-force-unsafe-install has no effect for installs that go through tarball/archive extraction (e.g. ClawHub and npm pack flows).

Root cause

  • installPluginFromArchive calls pickPackageInstallCommonParams({ ... }) but omits dangerouslyForceUnsafeInstall from params, so the security scan always sees undefined and blocks on critical findings.
  • installPluginFromNpmSpec passes archiveInstallParams without dangerouslyForceUnsafeInstall.

Expected behavior

The CLI flag should bypass built-in dangerous-code blocking for those install paths (with warnings), consistent with directory installs.

Suggested fix

  1. In installPluginFromArchive, add dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall to the object passed to pickPackageInstallCommonParams.
  2. In installPluginFromNpmSpec, add the same field to archiveInstallParams.

Workaround

Install from an extracted directory with the flag (directory path forwards the option correctly).

(Reported from user environment; local patch applied to dist/install-DtMAYXp_.js confirms the fix.)

extent analysis

TL;DR

To fix the issue, update the installPluginFromArchive and installPluginFromNpmSpec functions to include the dangerouslyForceUnsafeInstall parameter.

Guidance

  • Review the installPluginFromArchive function and add dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall to the object passed to pickPackageInstallCommonParams.
  • Update the installPluginFromNpmSpec function to include dangerouslyForceUnsafeInstall in archiveInstallParams.
  • Verify the fix by testing the openclaw plugins install <spec> --dangerously-force-unsafe-install command with tarball/archive extraction installs.
  • As a temporary workaround, install plugins from an extracted directory using the --dangerously-force-unsafe-install flag.

Example

// In installPluginFromArchive
const commonParams = pickPackageInstallCommonParams({
  ...params,
  dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall
});

// In installPluginFromNpmSpec
const archiveInstallParams = {
  ...params,
  dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall
};

Notes

The suggested fix assumes that the dangerouslyForceUnsafeInstall parameter is correctly handled by the underlying security scan logic. Additional testing may be necessary to ensure the fix works as expected.

Recommendation

Apply the suggested fix to update the installPluginFromArchive and installPluginFromNpmSpec functions, as it directly addresses the root cause of the issue and provides a consistent installation experience.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

The CLI flag should bypass built-in dangerous-code blocking for those install paths (with warnings), consistent with directory installs.

#configuration error#environment variable#network issue#logging issue#authentication issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix fix: thread dangerouslyForceUnsafeInstall through installPluginFromArchive and npm archiveInstallParams [1 pull requests, 1 participants]