Changelog

All notable changes to the OpenClaw QVeris plugin are documented here.

The format follows Keep a Changelog; versions are date-based (YYYY.M.D).

Unreleased #

The release workflow now waits for the exact public npm Registry artifact after publishing, verifies its version, downloaded integrity, source commit, runtime metadata, and concrete compiled tools, then installs it through the official OpenClaw plugin manager in isolated state before creating the GitHub Release. Publishing and verification run as separate jobs so a failed post-publish check can be retried without attempting to republish an immutable npm version.

Declared all three runtime tools in contracts.tools, restoring tool registration on OpenClaw >=2026.6.11. The manifest now also declares explicit startup activation, API-key availability signals, and replay safety for read-only Discover/Inspect while keeping paid Call replay-unsafe. (#272)
Added source, compiled-factory, packed-package provenance, and minimum/extended/latest OpenClaw compatibility checks so public tool names, credential gating, and manifest/runtime registration cannot drift silently.

Aligned the full-toolkit development and CI Node.js pin with the 22.22.3 minimum required by the tested OpenClaw 2026.7.1-2 development dependency. The published plugin's existing runtime compatibility floor is unchanged.

Endpoint selection now uses config.baseUrl, then QVERIS_BASE_URL, then the built-in default. API keys and the deprecated region setting never reroute requests; unsafe endpoint overrides are rejected. (#206)
Raised the supported host to OpenClaw >=2026.6.11 and Node.js >=22.19.0, matching the plugin API used by the current code. The full-toolkit development requirement is now Node.js >=22.22.2; plugin CI and builds use Node.js 22. (#210)
Pinned the tested OpenClaw host and plugin SDK metadata to 2026.6.11, and aligned the peer, plugin API, and installer compatibility floors. (#210)
Upgraded the Vitest, coverage, Vite, and esbuild development toolchain to audited releases. Published runtime dependencies are unchanged. (#211)

Declared the public repository metadata required for npm to verify the package's signed provenance bundle.
Builds now use the locked local esbuild dependency instead of downloading a build tool through npx; CI verifies the package can build in npm offline mode. (#210)
Corrected the local source installation path in the README. (#210)
The package is now installable and testable standalone: the openclaw dev dependency used the workspace:* protocol (a leftover from the OpenClaw monorepo) which made npm install fail; it now targets the published package. The three vitest suites (63 tests) and tsc --noEmit are wired into npm test / npm run typecheck and run in CI. (#152)

why_recommended and expected_cost from discover results are projected to the model, so capability selection can weigh relevance and cost. (#104)