Add Third-Party Package Compatibility Test

[kriptoburak]

Summary

• Add a generic Third-Party Package Compatibility Test for any public npm package that unpacks to an OpenClaw plugin or skill.
• Use PACKAGE="@scope/package@version" as the configurable default and keep TweetClaw only as a commented example.
• Repair 21 relative links broken when the validation document moved under docs/internal/.
• Restrict test discovery to actual test files and fix 5 existing ESLint defects.

Maintainer feedback addressed

1. Disclosure: I maintain TweetClaw and Xquik. ClawGuard is independent of Xquik, and this contribution does not imply ClawGuard endorsement.
2. Rename Smoke Test to Third-Party Package Compatibility Test.
3. Use a generic package value and retain TweetClaw only as a replaceable example.
4. Keep npm pack output visible.
5. Restore the public archive or local ClawHub install wording.
6. State that a successful scan proves scanner compatibility only, not package safety or endorsement.

Current upstream reconciliation

• Rebuilt the complete change from current main commit bd3e655.
• Reduced the branch from 8 commits to exactly 1 SSH-signed commit.
• Preserved every requested correction and independent repository fix.

Validation

• 538 tests passed, 0 failed.
• ESLint passed.
• Coverage passed: 79.61% statements and lines, 70.39% branches, and 87.95% functions.
• All 21 relative links resolve.
• The documented package command completed with TweetClaw 1.6.37.
• The branch is current and mergeable.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[denial-web]

Thanks for the contribution. The workflow is useful, but I do not want to merge this as-is because ClawGuard docs should avoid implying endorsement of a third-party package.

Please update the PR to:

1. Confirm whether you are affiliated with @xquik/tweetclaw.
2. Rename “Smoke Test” to “Third-Party Package Compatibility Test” or similar, because --fail-on none only proves the scanner runs.
3. Make the package configurable, e.g. PACKAGE="@scope/package@version", instead of making @xquik/tweetclaw the official target.
4. Remove --silent from npm pack so failures are visible.
5. Restore “public archive” in the remaining gaps bullet unless there is a specific reason to remove it.
6. Keep the disclaimer that ClawGuard does not prove the third-party package is safe and does not endorse it.

Once those are addressed, I’m happy to review again.

[kriptoburak]

Thanks for the clear review. I am affiliated with TweetClaw/Xquik and maintain the @xquik/tweetclaw package.

I pushed 16eca51 with the requested changes:

• renamed the section to "Third-Party Package Compatibility Test"
• made the package configurable with PACKAGE="@xquik/tweetclaw@1.6.31"
• removed --silent from npm pack
• restored the "public archive or local ClawHub install" gap
• kept the disclaimer that this is compatibility evidence only and not package safety or endorsement

Validation:

• git diff --check
• changed-line sensitive string scan
• changed-line dash scan
• npm view @xquik/tweetclaw version --json
• package compatibility command from the docs with @xquik/tweetclaw@1.6.31
• npm test (165 passed)

[kriptoburak]

Rebased this PR onto the current main branch after the validation docs moved under docs/internal. The package compatibility section now lives in docs/internal/REAL_WORLD_VALIDATION.md and keeps the configurable PACKAGE example plus the non-endorsement disclaimer.

Validation on the updated branch:

• git diff --check
• npm test (469 passed)
• npm run lint

[kriptoburak]

Thanks for the review. I am affiliated with @xquik/tweetclaw and maintain the package, so I revised the section to avoid any implied ClawGuard endorsement.

Changes pushed in 72bb535:

• Renamed the section to Third-Party Package Compatibility Test.
• Made PACKAGE configurable with @scope/package@version as the default placeholder.
• Kept TweetClaw only as a commented, replaceable example value.
• Kept npm pack visible and did not use --silent.
• Restored the public archive wording in Remaining Real-World Gaps.
• Kept the disclaimer that the scan is compatibility evidence only and does not prove package safety or endorsement.

[kriptoburak]

All 6 requested changes remain live in signed commit 1e4cd14.

I rebuilt the complete change from current main and reduced the branch from 8 commits to exactly 1. The package example is generic, TweetClaw is only a commented replaceable example, npm pack remains visible, public-archive wording is restored, and the compatibility-only non-endorsement disclaimer remains explicit.

The independent repairs fix 21 moved-document links, constrain test discovery to test files, and clear 5 existing ESLint defects. Fresh validation passed with 538 tests, ESLint, coverage, link integrity, the real package scan command, and git diff --check. The branch is current and mergeable for re-review.