Three Common Pitfalls When Installing a Plugin Into OpenClaw's Agent Gateway

·1 views

A developer documented three distinct failures encountered while integrating a custom plugin into OpenClaw, an MIT-licensed npm-distributed agent runtime built by steipete and vincentkoc. The first issue arose because OpenClaw's plugin loader refused to load code from WSL's DrvFs mount, which exposes Windows filesystem paths as world-writable (mode 777), a deliberate security measure requiring the plugin to be moved to a native ext4 filesystem with restricted permissions. The second problem was that a loose TypeScript file registered via config could be discovered but would never activate at gateway startup without a proper manifest declaring 'activation: { onStartup: true }', a distinction the CLI surfaces through separate commands. The third failure occurred during installation, when OpenClaw's '--link' install command immediately calls the plugin's register function, exposing a malformed hook matcher argument — an object shape instead of the required array of tool names — as a hard runtime error. Each issue reflected a sensible enforcement by OpenClaw rather than a bug, and resolving all three required using the framework's official scaffold command and reading its generated manifest structure carefully.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Design Secure Server-Rendered Login Sessions for EdTech Apps

A software developer has outlined a structured approach to handling authentication in server-rendered educational applications, emphasizing that session creation, verification, refresh, and logout should each be treated as distinct state transitions. The design recommends issuing a short-lived session cookie only after a phone verification code is confirmed, with the server maintaining full control over the session lifecycle and audit trail. A key concern addressed is account recovery in school settings, where a learner may lose their phone while a parent, teacher, or administrator still needs safe access to recover the account. The browser receives only an opaque HttpOnly cookie, keeping the underlying session store — whether SQL, Redis, or another service — invisible to the client. The article also provides a Python transport adapter that centralizes endpoint logic and ensures the application, not the auth provider, determines when each session transition is permitted.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Security Teams Must Shift From Gut Instinct to Metrics-Driven Decisions

Security programs have long relied on intuition rather than measurable outcomes, but growing attack surfaces and tighter budgets are forcing a change in approach. Metrics-driven security means defining success numerically before deploying controls, tracking the same data consistently over time, and actually letting those numbers drive program decisions. Common pitfalls include measuring activity instead of outcomes, using vanity metrics, and tracking too many numbers without clear ownership. Key areas worth monitoring include mean time to detect and respond to incidents, vulnerability patching speed, privileged account MFA coverage, and phishing simulation trends. Organizations are advised to select a small set of metrics aligned to their specific threat model and business priorities rather than adopting a one-size-fits-all list.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Founder Grows SaaS Product Buildside to 130 Users in Two Weeks via Public Building

Entrepreneur Uriel Bitton shared how he grew his SaaS product Buildside to 130 users within just two weeks of launch. His primary growth strategy centered on building in public, openly documenting his development journey on social media. The approach attracted an early user base without relying on traditional paid marketing. Bitton published his experience on DEV Community in early September, tagging it under topics including SaaS, founder journeys, and social media growth. His story highlights how transparency and community engagement can serve as effective tools for early-stage startup traction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Measure Your Team's Code Review Limits Before AI Pull Requests Overwhelm Them

Researcher Margaret-Anne Storey recently introduced the concept of 'cognitive debt' — the gradual erosion of shared understanding about how a system works — during a DORA community session. A software developer writing on DEV Community argues this debt is quietly accumulating in teams that review AI-generated pull requests at scale, without realising their review process has become ineffective. The author warns that standard delivery metrics like merge rate and time-to-approve can appear healthy even as review quality collapses, masking real risk behind green dashboards. Drawing a parallel to mutation testing in software quality assurance, they propose seeding review queues with known-defective 'canary' pull requests to measure how reliably reviewers catch real problems. They recommend starting with one canary per twenty pull requests, tracked over four-week windows, to establish a statistically meaningful detection rate before cognitive debt causes a serious incident.

0 comments Read more at DEV Community