Plugin SDK impact

Use the current ClawHub inventory to inform the maintainer's compatibility decision. Static usage identifies dependencies; it does not prove execution or reliance on a particular behavior. Keep the approval and deprecation rules in the SDK boundary guide authoritative.

Investigate

1. Identify every affected public surface from source, including alternate SDK exports and runtime paths. Verify spelling against the definition and known callers; an incorrect key can return a convincing zero. Search bundled callers locally as well: the registry only covers published public plugins.

2. Query each canonical key using the bundled helper:

   node {baseDir}/scripts/query.mjs 'api-member:api.registerTool'

   For “updated within the last three months”, add --months 3. This means the latest eligible public release was uploaded within three calendar months of now, measured in UTC (month ends are clamped). Listing edits and rescans do not count as updates. The stored release date is its creation/upload time; public approval can happen later. --since 2026-07-16T12:00:00Z accepts an explicit cutoff. Report the exact inclusive cutoff from releaseWindow, not a guessed date. Both consumers and coverage use the same window on every page.

   The helper follows all usage and coverage pages, including empty intermediate pages. Counts and coverage include every result; items, gaps, and warnings contain bounded examples with omitted counts in output.omitted. Mixed references count in both runtime and type totals. For an investigation needing every consumer or gap, save --full output to a file and read it in sections:

   node {baseDir}/scripts/query.mjs 'api-member:api.registerTool' --full > sdk-usage.json

   --help documents local endpoint and traversal limits.

3. Inspect matched evidence against the proposed change. A method call may not use the behavior being changed. Type-only consumers still matter for type/export removal. Query related members separately; a module import does not prove use of every export. Repeated references in a plugin count as one consumer.
4. For a usage-count question, report the key, query time, exact release window (if requested), distinct plugins, and coverage gaps. For a proposed SDK change, also report matched evidence, local callers, and your compatibility recommendation. Finish change investigations with the maintainer's decision: preserve behavior, deprecate with migration, or proceed under existing policy. Never infer permission from the count.

Canonical keys

Keys describe SDK identities, not local aliases. api.runtime members normalize to runtime.*. The inventory includes supported and deprecated references; nonempty deprecationCodes selects entries associated with existing warnings. Per-plugin inspection is available at https://clawhub.ai/api/v1/sdk-usage/plugin?package=<encoded-name>; follow its nextCursor until null to obtain the full inventory.

Interpret the result

Coverage is tied to current release/artifact and analysis versions. Eligible reports have inputKind: "artifact"; a source-checkout benchmark cannot establish what a published package contains. An old scan timestamp alone does not make an immutable artifact stale. Evidence is sampled; each scan reports its evidence/unknown limits. Pages are live reads, not one snapshot: rerun if releases or visibility change during the investigation. The helper flags changes it observes but cannot establish a transaction-wide snapshot.

Do not dismiss a security issue just because no consumers were observed. Describe how usage evidence affects compatibility risk; security and SDK owners still decide the fix and any exception to the normal migration window.