taodeng/olp
1
0
Fork 0
mirror of https://github.com/dtzp555-max/olp.git synced 2026-07-21 21:15:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix+docs+release(v0.4.4): D78 — olp-connect stale strings + CDN-safe README URL + pre-publish audit (#49)

Browse Source 
* fix+docs+release(v0.4.4): D78 — olp-connect stale strings + README CDN-safe tag URL + repo public-flip pre-audit

Patch release on top of v0.4.3. Three small issues caught when running
olp-connect for real on MacBook (D77 client-install verification):

## G11: repo visibility flip

Repo dtzp555-max/olp flipped PRIVATE -> PUBLIC during this session.
Closes the original G11 finding (anonymous curl can't fetch raw URL from
private repos). Pre-publish audit (per cc-rules pre-publish-audit.md
checklist):
- Identity scrub: 0 hits — no taodeng, no 老大, no /Users/.../ paths,
  no personal hostnames, no personal emails, no real LAN IPs (only RFC
  documentation placeholders 192.168.1.10 + 10.0.0.5)
- Credential scrub: gitleaks 'no leaks found' — all olp_ matches are
  placeholder (olp_XXXX...) or test fixtures (olp_not-a-real-key-...)
- Git history: maintainer accepted Option A (GitHub-account email already
  verified-public on profile; flip exposes nothing new)

## G11 mitigation: README curl URL CDN-cache-safe

GitHub raw CDN serves a stale 404 for /main/<file> for ~5-15min after a
private->public visibility flip (negative-cache TTL). Tag-pinned URLs
bypass this because the tag ref was never queried while private.

D78 makes README's primary olp-connect curl URL tag-pinned:
  bash <(curl -fsSL .../v0.4.4/bin/olp-connect) <ip>
with /main/ listed as alternative for trusted-head users.

## G12: detect_openclaw claimed plugin not shipped

bin/olp-connect's OpenClaw detection block said "The OpenClaw OLP plugin
(D71-D73) is NOT YET SHIPPED" — but D71-D73 shipped olp-plugin/ at
v0.4.0. Replaces stale text with real install instructions:

  git clone https://github.com/dtzp555-max/olp.git /tmp/olp-repo
  openclaw plugins install /tmp/olp-repo/olp-plugin
  # or symlink: ln -sf .../olp-plugin ~/.openclaw/extensions/olp

Points at docs/integrations/openclaw.md for the full setup with
dedicated bot apiKey + restart-gateway notes.

## G13: olp-connect self-version hardcoded literal

Pre-D78 the script declared OLP_CONNECT_VERSION="0.4.0-phase4" as a
hardcoded literal that nobody updated through v0.4.1 / v0.4.2 / v0.4.3.
D78 derives the version at runtime from sibling package.json via
python3. When invoked from a checked-out repo, version resolves to the
actual value; when curl-piped (no on-disk package.json next to script),
falls back to "unknown".

  bash bin/olp-connect --version  # -> olp-connect 0.4.4 (automatic)

## Test count

717 (v0.4.3) -> 720 (v0.4.4). +3 D78 regression tests in Suite 36:
- 36v: pins absence of NOT YET SHIPPED text + presence of real install path
- 36w: pins runtime version derivation from package.json
- 36x: pins README tag-pinned URL recommendation

## Authority

- D77 MacBook client-install verification session (2026-05-26)
- ~/.cc-rules/docs/guides/pre-publish-audit.md (the checklist that
  preceded the visibility flip)
- Process learning: every README that includes a `curl raw-URL | bash`
  install pattern should pin to a release tag (not /main/) for CDN-
  cache resilience.

## Out of D78 scope (deferred)

- F6 (doctor client-side limitation) — Phase 5 ADR amendment
- D75 reviewer P2-1 (ADR 0004 per-hop schema) + P2-2 (defensive type
  assert) — non-blocking
- scripts/migrate-from-ocp.mjs — Phase 7

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix: D78 reviewer P2 fold-in — _resolve_version defensive guards (require /bin suffix + env-var path passthrough + nounset default)

---------

Co-authored-by: dtzp555 <dtzp555@gmail.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
dtzp555-max
2026-05-26 14:21:20 +10:00
committed by GitHub
co-authored by taodeng Claude Opus 4.7
parent 6605b7b14a
commit 704d4fc8a0
5 changed files with 120 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/olp-connect
+47 -8
View File
@@ -29,7 +29,35 @@
set -euo pipefail
OLP_CONNECT_VERSION="0.4.0-phase4"
# D78 (G13): derive version from package.json instead of hardcoding (was
# stuck at "0.4.0-phase4" through v0.4.1/v0.4.2/v0.4.3 because no one
# updated it). Look up package.json next to the script if available;
# fall back to "unknown" when running curl-piped (no on-disk package.json).
_resolve_version() {
local script_dir pkg
# When curl-piped (`curl ... | bash`), BASH_SOURCE[0] is empty → dirname
# yields "." → script_dir resolves to cwd. D78 reviewer P2-1 hardening:
# require the suffix-strip to actually fire (script_dir ENDED with /bin),
# otherwise we'd happily pick up an unrelated package.json from whatever
# directory the user happens to be in when piping. Belt-and-braces.
# ${BASH_SOURCE[0]:-} default-empty guards against `set -u` nounset error
# when invoked via `curl ... | bash` (no source file → BASH_SOURCE unset).
script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]:-}")" &>/dev/null && pwd)"
if [[ "$script_dir" != */bin ]]; then
echo "unknown"
return
fi
pkg="${script_dir%/bin}/package.json"
# D78 reviewer P2-2: pass $pkg via env var instead of -c interpolation
# so paths with apostrophes / shell metacharacters can't break the
# python invocation. Canonical layout is safe; this is defense-in-depth.
if [[ -f "$pkg" ]] && command -v python3 >/dev/null 2>&1; then
OLP_PKG_PATH="$pkg" python3 -c 'import json,os;print(json.load(open(os.environ["OLP_PKG_PATH"])).get("version","unknown"))' 2>/dev/null || echo "unknown"
else
echo "unknown"
fi
}
OLP_CONNECT_VERSION="$(_resolve_version)"
show_version() {
echo "olp-connect $OLP_CONNECT_VERSION"
@@ -246,17 +274,28 @@ detect_aider() {
fi
}
# Detect OpenClaw. Per Phase 4 D71-D73 (NOT in this PR), olp will ship
# olp-plugin/ for OpenClaw with full Telegram/Discord /olp slash commands.
# Until that ships, we just announce detection and link.
# Detect OpenClaw. Phase 4 D71-D73 shipped olp-plugin/ as the OpenClaw
# gateway plugin for /olp Telegram + Discord slash commands. Point users
# at the install path.
detect_openclaw() {
if command -v openclaw &>/dev/null || [[ -f "$HOME/.openclaw/openclaw.json" ]]; then
log_info ""
log_info "Detected: OpenClaw"
log_info " The OpenClaw OLP plugin (D71-D73) is NOT YET SHIPPED."
log_info " When it ships, install with: openclaw plugin install olp"
log_info " For now, you can manually point OpenClaw at OLP via the OPENAI_BASE_URL"
log_info " env var (already written to your shell rc above)."
log_info " OLP ships an OpenClaw gateway plugin for /olp Telegram + Discord"
log_info " slash commands (status / usage / cache / models / providers /"
log_info " chain show / health / doctor). Read-only by design — no chat-side"
log_info " mutations."
log_info ""
log_info " Install the plugin (one-time, on the host running OpenClaw):"
log_info " git clone https://github.com/dtzp555-max/olp.git /tmp/olp-repo"
log_info " openclaw plugins install /tmp/olp-repo/olp-plugin"
log_info " # OR symlink: ln -sf /tmp/olp-repo/olp-plugin ~/.openclaw/extensions/olp"
log_info ""
log_info " Then edit ~/.openclaw/openclaw.json to set the plugin apiKey to a"
log_info " dedicated OLP key (NOT your owner key — create one via olp-keys"
log_info " keygen --name <bot-name>). Restart OpenClaw gateway."
log_info ""
log_info " See docs/integrations/openclaw.md for full instructions."
fi
}