fix: capture compiled CommonJS plugins with SDK mocks

[vincentkoc]

What Problem This Solves

Fixes an issue where users capturing or synthetically probing compiled CommonJS plugins would get missing SDK modules instead of their actual registrations and handler results. Static inspection also missed literal SDK require() references.

Why This Change Was Made

Use feature-detected synchronous resolution hooks alongside the existing asynchronous loader. This keeps CommonJS source and native loading unchanged while routing SDK requirements to generated mocks, including lazy requirements in retained handlers. Hooks remain scoped to their capture and become inactive after completion.

The same literal-require scanner feeds mock generation and source references, excluding comments and quoted examples. Builtins, relative modules, traversal rejection, and import-versus-registration failure classes remain covered.

User Impact

• Destructured, namespace, and compiled inline CommonJS SDK calls now work through capture API, CLI, and synthetic probes without installing OpenClaw.
• CommonJS mocking needs module.registerHooks() (Node.js 22.15+). Older runtimes return actionable upgrade guidance for this capability. The package engine remains >=22; existing ESM/TypeScript and plain CommonJS capture are not gated.
• No dependency, version, release, host-runtime, or unrelated child-output changes.

Evidence

• Red: source and packed baseline CommonJS capture API/CLI/synthetic failed with missing SDK modules; source references were absent. A separate Node 22.14 regression reproduced SDK-looking comments/strings incorrectly gating plain CommonJS before the lexical correction.
• Head: 401d48d3889690c4726af61cfabe2c977c7a07a9, integrating landed PR fix: time out hung capture and profile child processes #59 at f5e66bb6fb3b6168186a9b9fba45ad2a18a0c5a1. Conflicts required only the runner import union and release-note placement. Owned-child limits, complete JSON flush, file artifacts, and loader try/finally cleanup are preserved.
• Full integrated local proof at 401d48d: npm run check on Node 24.19.0, 332 tests plus package-content validation, including capture timeout/output/profile and CJS suites. Integrated Node 22.14 focused matrix: 20 passed, two unsupported CJS runtime cases skipped.
• Retained full packed matrix at 853e5588, using public package exports and the installed CLI: 22/22 focused checks on Node 22.15.0 and 24.19.0; 20 passed and two CJS-only controls skipped on 22.14.0. Explicit capability failures and existing ESM/TS/plain-CJS behavior passed. These unchanged boundaries carry forward after the narrow namespace-escaping correction.
• Retained namespace-escaping proof at 586862b: all nine changed capture API/CLI/synthetic cases passed on both Node 22.15.0 and 24.19.0. Final 401d48d archive: normal offline installation and compiled CommonJS capture API/CLI/synthetic cases passed on Node 22.15.0. No real OpenClaw package is installed.
• Packed cases include all three CommonJS forms, lazy SDK requirements, handler results, strict directives/hashbangs, builtin/relative preservation, capture isolation, traversal rejection, source references, phase classification, ESM/TS siblings, symlinked roots, and executable template interpolation without template-text false positives.
• Final archive integrity: sha512-mI3rkQ7929BqigutpeYf914EhqqEbnMUGTkqsBS/P+6kRR579+UZoAK+WUtshkkT0x3WevRE27CjZYS/5Uwh0w==. All 59 installed package files match the final source tree.
• Fresh P2 identified two issues: symlinked root ownership and requirements inside template interpolation. Both were reproduced, corrected narrowly, and passed focused and packed regressions. The original findings are retained; no unresolved accepted finding remains.
• Source and mechanical integration are reviewed; prior P2 carries forward under maintainer clearance. Exact-head CI at 401d48d is green: Node 22, both CodeQL analyses, aggregate CodeQL, and dispatch passed; optional [code]smith was skipped. The earlier CodeQL escaping finding was fixed in 586862b and remains resolved. Final maintainer clearance is granted for the exact head; live identity, rules, reviews, and mergeability were revalidated before squash landing.
• Landed by matched-head squash on September 9, 2026 at 15:34:50 UTC: 3ecd6a53d5c174aa5640074d424022ee625b477e. Remote main contains the merge; its tree 5171f6802e0c9eb7857f62ce167197d9547b19cd is identical to reviewed head 401d48d3889690c4726af61cfabe2c977c7a07a9. No admin bypass or release was used.

Crabpot integration followthrough is assigned to release integration, not repeated in this unit. No package version change or release.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.