Bug type
Behavior bug (incorrect output/state without crash)
Summary
When running openclaw plugins update --all, the CLI currently downloads the package, extracts it, runs the security audit, and reinstalls dependencies before checking the local version. It only reports that the plugin is "already at [version]" at the very end of the process.
This results in a highly inefficient update cycle, especially for users with multiple or heavy plugins.
Steps to reproduce
Install any plugin (e.g., qqbot at 1.5.3).
Run openclaw plugins update --all.
Observe the CLI behavior.
Expected behavior
OpenClaw should fetch the remote version number and compare it against the locally installed version first. If remote_version == local_version, the CLI should immediately skip the process and output something like Plugin is already up to date, bypassing the download, extraction, and security audit steps completely.
Actual behavior
The CLI blindly downloads the @latest tarball to a /tmp directory, extracts it, runs the entire security audit (triggering warnings again), and reinstalls dependencies, only to finally report: [plugin] already at [version].
OpenClaw version
2026.3.8
Operating system
ubuntu
Install method
No response
Logs, screenshots, and evidence
Impact and severity
No response
Additional information
No response
Bug type
Behavior bug (incorrect output/state without crash)
Summary
When running openclaw plugins update --all, the CLI currently downloads the package, extracts it, runs the security audit, and reinstalls dependencies before checking the local version. It only reports that the plugin is "already at [version]" at the very end of the process.
This results in a highly inefficient update cycle, especially for users with multiple or heavy plugins.
Steps to reproduce
Install any plugin (e.g., qqbot at 1.5.3).
Run openclaw plugins update --all.
Observe the CLI behavior.
Expected behavior
OpenClaw should fetch the remote version number and compare it against the locally installed version first. If remote_version == local_version, the CLI should immediately skip the process and output something like Plugin is already up to date, bypassing the download, extraction, and security audit steps completely.
Actual behavior
The CLI blindly downloads the @latest tarball to a /tmp directory, extracts it, runs the entire security audit (triggering warnings again), and reinstalls dependencies, only to finally report: [plugin] already at [version].
OpenClaw version
2026.3.8
Operating system
ubuntu
Install method
No response
Logs, screenshots, and evidence
Impact and severity
No response
Additional information
No response