Release sources

Choose npm or a release manifest.

The source layer is isolated from command behavior, so teams can keep using npm today and move to signed release manifests when they need stricter distribution control.

Npm source

The default source reads npm metadata, installs exact versions, and maps stable to the latest dist-tag when npm does not publish a separate stable tag.

Release manifest source

Set OCVM_SOURCE=release and OCVM_RELEASE_MANIFEST_URL to fetch a manifest from controlled infrastructure.

{
  "versions": [
    {
      "version": "2026.3.28",
      "tags": ["stable"],
      "url": "https://releases.example.com/openclaw-2026.3.28.tgz",
      "executableSha256": "..."
    }
  ]
}

When a manifest entry includes sha256 or executableSha256, ocvm verifies the staged executable before activation.