chore(deps): bump plugins/hyperspell from 5918737 to 37421e6

[dependabot]

Bumps plugins/hyperspell from 5918737 to 37421e6.

Commits

• 37421e6 chore: release 0.14.2
• eb4279c fix: stop dream/scaffolding pollution + repair trace-exclude filter (#36)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs changes before merge. Reviewed June 22, 2026, 5:36 AM ET / 09:36 UTC.

Summary
The PR updates the plugins/hyperspell submodule gitlink from 5918737d3f1dcc8eb40ee15c075c5b0e5d2d7088 to 37421e684cf34b967c8230d939c094ec364f16fa.

Reproducibility: not applicable. this is a Dependabot submodule bump, not a reported runtime bug. The source check is the gitlink/report consistency review rather than a user reproduction path.

Review metrics: 3 noteworthy metrics.

• Crabpot diff scope: 1 modified gitlink. The repository diff is narrowly limited to the Hyperspell submodule pin.
• Hidden upstream delta: 2 commits, 15 upstream files. The gitlink hides a real Hyperspell release change rather than a metadata-only SHA update.
• Generated reports on branch: 0 report files changed. The branch has not yet committed the expected Crabpot report refresh for the new upstream package version.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🌊 off-meta tidepool
Patch quality: 🦐 gold shrimp
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Regenerate and commit Crabpot README/reports for the Hyperspell 0.14.2 pin.

Risk before merge

• [P1] Merging only the gitlink would leave committed Crabpot compatibility reports and dashboard data stale for the Hyperspell 0.14.2 fixture pin.
• [P1] The upstream plugin delta changes memory sync/search filtering behavior; static and isolated fixture checks are green, but that does not replace the required committed report refresh.

Maintainer options:

1. Regenerate Crabpot reports (recommended)
   Run the existing Dependabot report-refresh path or equivalent report generation and commit README/reports so Hyperspell 0.14.2 is reflected before merge.
2. Accept temporary stale reports
   Maintainers could intentionally merge only the gitlink if they plan to refresh reports immediately after merge, accepting a short-lived stale dashboard.
3. Wait for Dependabot refresh
   Leave this PR open or recreate it if the canceled Dependabot Auto Merge run should own the generated report commit.

Next step before merge

• [P2] Queue a narrow report-refresh repair because the current branch only changes the gitlink and the normal Dependabot Auto Merge report-refresh run was cancelled.

Security
Cleared: No concrete security or supply-chain regression was found in the Crabpot diff; it is a pinned submodule update and the upstream compare adds filtering/config code and tests without new dependencies or workflow changes.

Review findings

• [P2] Refresh the Hyperspell reports with the new pin — plugins/hyperspell:1

Review details

Best possible solution:

Keep the submodule pin update, regenerate and commit the Crabpot reports and README for Hyperspell 0.14.2 through the existing Dependabot refresh path, then merge once checks remain green.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a Dependabot submodule bump, not a reported runtime bug. The source check is the gitlink/report consistency review rather than a user reproduction path.

Is this the best way to solve the issue?

No as currently posted: the gitlink bump is the right mechanism, but the branch should also carry regenerated Crabpot reports/README or a rerun of the Dependabot refresh path before merge.

Full review comments:

• [P2] Refresh the Hyperspell reports with the new pin — plugins/hyperspell:1
  This gitlink now targets upstream Hyperspell 0.14.2, but the committed Crabpot reports still record @hyperspell/openclaw-hyperspell as 0.14.1. AGENTS.md expects fixture source/package-version changes to move with generated report expectations, so merging only this gitlink would leave the dashboard/report baseline stale.
  Confidence: 0.87

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d900ac9412fc.

Label changes

Label changes:

• add P3: This is a low-risk dependency fixture update, but it needs generated report refresh before normal merge.
• add merge-risk: 🚨 other: Merging the current branch as-is could leave Crabpot's committed compatibility report baseline stale for the new Hyperspell fixture pin.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This is a Dependabot bot dependency PR, so the external contributor real-behavior proof gate is not applicable.

Label justifications:

• P3: This is a low-risk dependency fixture update, but it needs generated report refresh before normal merge.
• merge-risk: 🚨 other: Merging the current branch as-is could leave Crabpot's committed compatibility report baseline stale for the new Hyperspell fixture pin.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This is a Dependabot bot dependency PR, so the external contributor real-behavior proof gate is not applicable.

Evidence reviewed

Acceptance criteria:

• [P1] npm test.
• [P1] node scripts/sync-fixtures.mjs --check.
• [P1] node scripts/run-contract-smoke.mjs --strict --openclaw ./openclaw.
• [P1] node scripts/check-ci-policy.mjs.

What I checked:

• Repository policy: AGENTS.md was read fully; its fixture/submodule and generated-report guidance makes the missing report refresh relevant for this dependency pin update. (AGENTS.md:5, d900ac9412fc)
• Current main pin: Current main still pins plugins/hyperspell to 5918737d3f1dcc8eb40ee15c075c5b0e5d2d7088, so the requested bump is not already implemented. (plugins/hyperspell:1, d900ac9412fc)
• PR diff: The PR head commit changes exactly one file, replacing the Hyperspell gitlink with 37421e684cf34b967c8230d939c094ec364f16fa. (plugins/hyperspell:1, 5fd687daa74b)
• Upstream release delta: The upstream compare is two commits ahead and includes the 0.14.2 release plus memory sync/search filtering fixes and tests. (37421e684cf3)
• Committed report mismatch: The committed Crabpot report still records @hyperspell/openclaw-hyperspell as version 0.14.1, which is stale for the target 0.14.2 pin. (reports/crabpot-report.json:4032, d900ac9412fc)
• Report-refresh workflow: The Dependabot workflow is designed to refresh compatibility reports and commit README/report changes after fixture pin updates. (.github/workflows/dependabot-auto-merge.yml:98, d900ac9412fc)

Likely related people:

• Dithilli: This GitHub login authored the upstream Hyperspell fix commit and the 0.14.2 release commit targeted by the submodule bump. (role: upstream plugin author; confidence: high; commits: eb4279c45750, 37421e684cf3; files: config.ts, sync/markdown.ts, tools/search.ts)
• vincentkoc: Recent Crabpot history shows focused work on fixture security, generated-surface checks, and fixture materialization paths that are adjacent to Dependabot fixture updates. (role: recent area contributor; confidence: medium; commits: d900ac9412fc, bd6cf245145b, 919a4d3164bc; files: scripts/check-generated-surface-fixture.mjs, scripts/sync-fixtures.mjs, scripts/plugin-inspector-source.mjs)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.