From 7d7e0e7bdb8f4e7418d32d327f2e298346f09fbb Mon Sep 17 00:00:00 2001
From: dtzp555 <dtzp555@gmail.com>
Date: Mon, 16 Mar 2026 13:51:19 +1000
Subject: [PATCH] v2.1.0: fix provenance warnings, clean install experience

Add package.json with openclaw plugin metadata, configure plugins.allow
in post-install.sh, and add source field to plugin manifest. Fresh
installs now load without trust/provenance warnings in gateway logs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 CHANGELOG.md            | 20 ++++++++++++++++++++
 README.md               |  6 ++++--
 openclaw.plugin.json    |  3 ++-
 package.json            | 19 +++++++++++++++++++
 scripts/post-install.sh | 11 ++++++++---
 5 files changed, 53 insertions(+), 6 deletions(-)
 create mode 100644 package.json

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e063149..60a58f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## v2.1.0 — 2026-03-16
+
+### Summary
+Clean install experience: eliminates gateway provenance warnings for fresh installations.
+
+### Added
+- `package.json` — proper npm-style metadata with `openclaw.type: "plugin"` provenance field
+- `plugins.allow` auto-configuration in `post-install.sh` — registers plugin in OpenClaw trust list
+
+### Changed
+- `post-install.sh` now copies `package.json` to extensions directory
+- `openclaw.plugin.json` now includes `source` field pointing to GitHub repo
+- README updated with `plugins.allow` documentation and install step
+
+### Fixed
+- "plugins.allow is empty; discovered non-bundled plugins may auto-load" warning
+- "loaded without install/load-path provenance; treat as untracked local code" warning
+
+---
+
 ## v2.0.0 — 2026-03-15
 
 ### Summary
diff --git a/README.md b/README.md
index 0d4f718..371955f 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # memory-continuity
 
-**Current release:** `v2.0.0`
+**Current release:** `v2.1.0`
 
 OpenClaw **lifecycle plugin** for short-term working continuity. Preserves structured in-flight work state across `/new`, reset, gateway restarts, model fallback, and context compaction.
 
@@ -60,7 +60,8 @@ bash scripts/post-install.sh
 The installer will:
 1. Copy the plugin to `~/.openclaw/extensions/memory-continuity/`
 2. Add the plugin entry to `~/.openclaw/openclaw.json`
-3. Restart the gateway
+3. Add `memory-continuity` to `plugins.allow` (trust list — eliminates provenance warnings)
+4. Restart the gateway
 
 No npm install, no API keys, no external database.
 
@@ -85,6 +86,7 @@ The plugin works with zero configuration. Optional settings in `openclaw.json`:
 ```json
 {
   "plugins": {
+    "allow": ["memory-continuity"],
     "entries": {
       "memory-continuity": {
         "enabled": true,
diff --git a/openclaw.plugin.json b/openclaw.plugin.json
index 9ff6ad9..ed59fe9 100644
--- a/openclaw.plugin.json
+++ b/openclaw.plugin.json
@@ -2,7 +2,8 @@
   "id": "memory-continuity",
   "name": "Memory Continuity",
   "description": "Preserves working state across /new, reset, compaction, and gateway restarts via a simple markdown checkpoint file.",
-  "version": "2.0.0",
+  "version": "2.1.0",
+  "source": "https://github.com/dtzp555-max/memory-continuity",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..18d2ed7
--- /dev/null
+++ b/package.json
@@ -0,0 +1,19 @@
+{
+  "name": "memory-continuity",
+  "version": "2.1.0",
+  "description": "Zero-dependency memory continuity for OpenClaw — plain markdown, lifecycle hooks, no vector DB.",
+  "main": "index.js",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dtzp555-max/memory-continuity.git"
+  },
+  "keywords": ["openclaw", "plugin", "memory", "continuity"],
+  "author": "dtzp555-max",
+  "license": "MIT",
+  "openclaw": {
+    "type": "plugin",
+    "id": "memory-continuity",
+    "pluginManifest": "openclaw.plugin.json"
+  }
+}
diff --git a/scripts/post-install.sh b/scripts/post-install.sh
index a1401a5..e826878 100755
--- a/scripts/post-install.sh
+++ b/scripts/post-install.sh
@@ -37,7 +37,7 @@ fi
 
 # Copy essential plugin files (not the entire repo)
 mkdir -p "$PLUGIN_DIR"
-for f in index.js openclaw.plugin.json SKILL.md; do
+for f in index.js openclaw.plugin.json package.json SKILL.md; do
   if [[ -f "$REPO_DIR/$f" ]]; then
     cp "$REPO_DIR/$f" "$PLUGIN_DIR/"
   fi
@@ -64,7 +64,7 @@ else:
 " 2>/dev/null; then
     echo "  Plugin entry already exists in config"
   else
-    # Add the plugin entry
+    # Add the plugin entry and plugins.allow trust list
     python3 -c "
 import json
 path = '$CONFIG_FILE'
@@ -72,6 +72,11 @@ with open(path) as f:
     data = json.load(f)
 if 'plugins' not in data:
     data['plugins'] = {}
+# Add to plugins.allow so OpenClaw trusts this plugin (no provenance warning)
+allow_list = data['plugins'].get('allow', [])
+if 'memory-continuity' not in allow_list:
+    allow_list.append('memory-continuity')
+    data['plugins']['allow'] = allow_list
 if 'entries' not in data['plugins']:
     data['plugins']['entries'] = {}
 data['plugins']['entries']['memory-continuity'] = {
@@ -87,7 +92,7 @@ data['plugins']['entries']['memory-continuity'] = {
 }
 with open(path, 'w') as f:
     json.dump(data, f, indent=2)
-print('  Added plugin entry to config')
+print('  Added plugin entry and trust config')
 " 2>/dev/null || echo "  WARNING: Could not update config automatically. Add manually."
   fi
 fi