fix: Address review findings in OpenClaw converter

- Fix P1: Replace incomplete string escaping in generateEntryPoint with
  JSON.stringify() to prevent code injection via command names/descriptions
  with backslashes, newlines, or other special characters
- Fix P1: Remove hardcoded 'compound-engineering' output path; resolve
  from plugin.manifest.name via new openclawHome + pluginName params
- Fix P2: Add --openclaw-home CLI flag (default: ~/.openclaw/extensions)
  consistent with --codex-home and --pi-home patterns
- Fix P2: Emit typed `const skills: Record<string, string> = {}` in
  generated TypeScript to prevent downstream type errors
- Fix P3: Add lookbehind guards to rewritePaths() matching kiro pattern
- Fix P3: Extract duplicated disableModelInvocation filter to variable
- Fix P3: Build manifest skills list before constructing manifest object
  (no post-construction mutation)
- Export ClaudeToOpenClawOptions type alias for interface clarity
- Add openclaw-converter.test.ts with 13 tests covering all scenarios

Co-Authored-By: Claude <noreply@anthropic.com>

src/commands/install.ts

@@ -42,6 +42,11 @@ export default defineCommand({
       alias: "pi-home",
       description: "Write Pi output to this Pi root (ex: ~/.pi/agent or ./.pi)",
     },
+    openclawHome: {
+      type: "string",
+      alias: "openclaw-home",
+      description: "Write OpenClaw output to this extensions root (ex: ~/.openclaw/extensions)",
+    },
     also: {
       type: "string",
       description: "Comma-separated extra targets to generate (ex: codex)",
@@ -84,6 +89,7 @@ export default defineCommand({
       const outputRoot = resolveOutputRoot(args.output)
       const codexHome = resolveTargetHome(args.codexHome, path.join(os.homedir(), ".codex"))
       const piHome = resolveTargetHome(args.piHome, path.join(os.homedir(), ".pi", "agent"))
+      const openclawHome = resolveTargetHome(args.openclawHome, path.join(os.homedir(), ".openclaw", "extensions"))
 
       const options = {
         agentMode: String(args.agentMode) === "primary" ? "primary" : "subagent",
@@ -96,7 +102,7 @@ export default defineCommand({
         throw new Error(`Target ${targetName} did not return a bundle.`)
       }
       const hasExplicitOutput = Boolean(args.output && String(args.output).trim())
-      const primaryOutputRoot = resolveTargetOutputRoot(targetName, outputRoot, codexHome, piHome, hasExplicitOutput)
+      const primaryOutputRoot = resolveTargetOutputRoot(targetName, outputRoot, codexHome, piHome, openclawHome, plugin.manifest.name, hasExplicitOutput)
       await target.write(primaryOutputRoot, bundle)
       console.log(`Installed ${plugin.manifest.name} to ${primaryOutputRoot}`)
 
@@ -117,7 +123,7 @@ export default defineCommand({
           console.warn(`Skipping ${extra}: no output returned.`)
           continue
         }
-        const extraRoot = resolveTargetOutputRoot(extra, path.join(outputRoot, extra), codexHome, piHome, hasExplicitOutput)
+        const extraRoot = resolveTargetOutputRoot(extra, path.join(outputRoot, extra), codexHome, piHome, openclawHome, plugin.manifest.name, hasExplicitOutput)
         await handler.write(extraRoot, extraBundle)
         console.log(`Installed ${plugin.manifest.name} to ${extraRoot}`)
       }
@@ -174,6 +180,8 @@ function resolveTargetOutputRoot(
   outputRoot: string,
   codexHome: string,
   piHome: string,
+  openclawHome: string,
+  pluginName: string,
   hasExplicitOutput: boolean,
 ): string {
   if (targetName === "codex") return codexHome
@@ -196,7 +204,7 @@ function resolveTargetOutputRoot(
     return path.join(base, ".kiro")
   }
   if (targetName === "openclaw") {
-    return path.join(os.homedir(), ".openclaw", "extensions", "compound-engineering")
+    return path.join(openclawHome, pluginName)
   }
   return outputRoot
 }

src/converters/claude-to-openclaw.ts

@@ -13,21 +13,17 @@ import type {
 } from "../types/openclaw"
 import type { ClaudeToOpenCodeOptions } from "./claude-to-opencode"
 
+export type ClaudeToOpenClawOptions = ClaudeToOpenCodeOptions
+
 export function convertClaudeToOpenClaw(
   plugin: ClaudePlugin,
-  _options: ClaudeToOpenCodeOptions,
+  _options: ClaudeToOpenClawOptions,
 ): OpenClawBundle {
-  const manifest = buildManifest(plugin)
-  const packageJson = buildPackageJson(plugin)
+  const enabledCommands = plugin.commands.filter((cmd) => !cmd.disableModelInvocation)
 
   const agentSkills = plugin.agents.map(convertAgentToSkill)
-  const commandSkills = plugin.commands
-    .filter((cmd) => !cmd.disableModelInvocation)
-    .map(convertCommandToSkill)
-
-  const commands = plugin.commands
-    .filter((cmd) => !cmd.disableModelInvocation)
-    .map(convertCommand)
+  const commandSkills = enabledCommands.map(convertCommandToSkill)
+  const commands = enabledCommands.map(convertCommand)
 
   const skills: OpenClawSkillFile[] = [...agentSkills, ...commandSkills]
 
@@ -36,13 +32,15 @@ export function convertClaudeToOpenClaw(
     name: skill.name,
   }))
 
-  // Add original skill names to manifest.skills
   const allSkillDirs = [
     ...agentSkills.map((s) => s.dir),
     ...commandSkills.map((s) => s.dir),
     ...plugin.skills.map((s) => s.name),
   ]
-  manifest.skills = allSkillDirs.map((dir) => `skills/${dir}`)
+
+  const manifest = buildManifest(plugin, allSkillDirs)
+
+  const packageJson = buildPackageJson(plugin)
 
   const openclawConfig = plugin.mcpServers
     ? buildOpenClawConfig(plugin.mcpServers)
@@ -61,11 +59,12 @@ export function convertClaudeToOpenClaw(
   }
 }
 
-function buildManifest(plugin: ClaudePlugin): OpenClawPluginManifest {
+function buildManifest(plugin: ClaudePlugin, skillDirs: string[]): OpenClawPluginManifest {
   return {
     id: plugin.manifest.name,
     name: formatDisplayName(plugin.manifest.name),
     kind: "tool",
+    skills: skillDirs.map((dir) => `skills/${dir}`),
   }
 }
 
@@ -170,15 +169,17 @@ function buildOpenClawConfig(
 function generateEntryPoint(commands: OpenClawCommandRegistration[]): string {
   const commandRegistrations = commands
     .map((cmd) => {
-      const escapedName = cmd.name.replace(/"/g, '\\"')
-      const escapedDesc = (cmd.description ?? "").replace(/"/g, '\\"')
+      // JSON.stringify produces a fully-escaped string literal safe for JS/TS source embedding
+      const safeName = JSON.stringify(cmd.name)
+      const safeDesc = JSON.stringify(cmd.description ?? "")
+      const safeNotFound = JSON.stringify(`Command ${cmd.name} not found. Check skills directory.`)
       return `  api.registerCommand({
-    name: "${escapedName}",
-    description: "${escapedDesc}",
+    name: ${safeName},
+    description: ${safeDesc},
     acceptsArgs: ${cmd.acceptsArgs},
     requireAuth: false,
     handler: (ctx) => ({
-      text: skills["${escapedName}"] ?? "Command ${escapedName} not found. Check skills directory.",
+      text: skills[${safeName}] ?? ${safeNotFound},
     }),
   });`
     })
@@ -193,7 +194,7 @@ import { fileURLToPath } from "url";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 // Pre-load skill bodies for command responses
-const skills = {};
+const skills: Record<string, string> = {};
 
 async function loadSkills() {
   const skillsDir = path.join(__dirname, "skills");
@@ -226,8 +227,8 @@ ${commandRegistrations}
 
 function rewritePaths(body: string): string {
   return body
-    .replace(/~\/\.claude\//g, "~/.openclaw/")
-    .replace(/\.claude\//g, ".openclaw/")
+    .replace(/(?<=^|\s|["'`])~\/\.claude\//gm, "~/.openclaw/")
+    .replace(/(?<=^|\s|["'`])\.claude\//gm, ".openclaw/")
     .replace(/\.claude-plugin\//g, "openclaw-plugin/")
 }