Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

openclaw plugins update <name> --dryrun reports the plugin is up to date even when npm view <pkg> dist-tags.latest shows a newer version has been published. Reproduced on two independent plugins across two calendar days, two npm scopes, and two version-numbering schemes.

Steps to reproduce

Case 1 (reproduced 2026-06-10)

1. Install OpenClaw 2026.6.5 with @tencent-weixin/[email protected] already installed.
2. Confirm the npm registry has a newer version:

   $ npm view @tencent-weixin/openclaw-weixin dist-tags
   { latest: '2.4.4' }
   # 2.4.4 released 2026-05-22, 19 days prior

3. Run the dry-run update check:

   $ openclaw plugins update openclaw-weixin --dryrun

4. Observe the tool output: openclaw-weixin is up to date (2.4.3).

Case 2 (reproduced 2026-06-11)

1. Install OpenClaw 2026.6.5 with @openclaw/[email protected] already installed.
2. Confirm the npm registry has a newer version:

   $ npm view @openclaw/feishu dist-tags
   { latest: '2026.6.5' }
   # 2026.6.5 released 2026-06-09, 2 days prior

3. Run the dry-run update check:

   $ openclaw plugins update feishu --dryrun

4. Observe the tool output: feishu is up to date (2026.6.1).

Expected behavior

openclaw plugins update <name> --dryrun compares the installed plugin version against npm view <pkg> dist-tags.latest and reports an available update when latest > installed.

Reference behavior: the main program openclaw update --tag already follows this pattern — openclaw update status reads npm view openclaw dist-tags to detect newer versions and the resulting release tag drives the upgrade.

Actual behavior

The tool prints <name> is up to date (installed). No comparison against npm dist-tags.latest appears to occur; in both reproduced cases, npm view <pkg> dist-tags confirmed a newer version was available on the registry that the tool did not flag.

OpenClaw version

v2026.6.5 (5181e4f)

Operating system

WSL2 Ubuntu 24.04 LTS (kernel 6.6.87.2-microsoft-standard-WSL2)

Install method

npm global install of openclaw v2026.6.5

Model

N/A — bug is reproducible from the openclaw plugins update CLI without any agent or model running

Provider / routing chain

N/A — bug is in the plugin manager CLI; no LLM, embedding, or agent routing path is involved in the affected code path

Additional provider/model setup details

None. The plugin manager is invoked directly via the OpenClaw CLI.

Logs, screenshots, and evidence

Direct CLI captures from reproduction.

### Case 1 (2026-06-10)


$ openclaw plugins list | grep weixin
@tencent-weixin/openclaw-weixin  2.4.3  (installed)

$ npm view @tencent-weixin/openclaw-weixin dist-tags
{ latest: '2.4.4' }

$ openclaw plugins update openclaw-weixin --dryrun
openclaw-weixin is up to date (2.4.3).


### Case 2 (2026-06-11)


$ openclaw plugins list | grep feishu
@openclaw/feishu  2026.6.1  (installed)

$ npm view @openclaw/feishu dist-tags
{ latest: '2026.6.5' }

$ openclaw plugins update feishu --dryrun
feishu is up to date (2026.6.1).


### Registry note

`npm view` was run against `https://registry.npmmirror.com` (the registry configured in `~/.npmrc` for this environment), so the false negative reproduces against a mirrored registry, not only the public `registry.npmjs.org`.

Impact and severity

• Affected users / systems / channels: All OpenClaw users running openclaw plugins update on installed plugins. Confirmed on at least two plugins from two different publishers (@tencent-weixin/openclaw-weixin, @openclaw/feishu), spanning two calendar days, two npm scopes (@tencent-weixin/, @openclaw/), and two version-numbering schemes (semver 2.4.x and date-based 2026.6.x).
• Severity: High. The tool's stated purpose is to surface available updates; a false negative causes users to silently miss security and behavior fixes.
  • Case 1 (openclaw-weixin 2.4.4) included a fix(monitor): plumb abortSignal into long-poll so channel stop honors gateway budget (the release notes for @tencent-weixin/[email protected]).
  • Case 2 (feishu 2026.6.5) included the P1 fix fix(feishu): preserve streaming card content (PR fix(feishu): preserve streaming card content #90181 in this repository). Under that bug, the Feishu streaming card was being overwritten with the latest text delta only, causing user-visible truncation of streamed output.
• Frequency: 2/2 of the plugins I checked with --dryrun in the last two days reported a false negative. This is not yet a systematic sample.
• Consequence: Users who trust openclaw plugins update --dryrun to plan upgrades will silently miss important fixes. The only available workaround requires the user to know to query npm view <pkg> dist-tags themselves and to use the lower-level openclaw plugins install <full-pkg-name>@<version> --force command, which is not mentioned in openclaw plugins update --help.

Additional information

Cross-references

• PR fix(feishu): preserve streaming card content #90181 (the P1 feishu fix the tool failed to surface in Case 2): fix(feishu): preserve streaming card content #90181
• The 2.4.4 release of @tencent-weixin/openclaw-weixin (the fix the tool failed to surface in Case 1): https://www.npmjs.com/package/@tencent-weixin/openclaw-weixin/v/2.4.4

Possible root cause [Speculation, unconfirmed]

The most likely root cause is that the installed package.json pins the exact version (e.g. "2.4.3", "2026.6.1") rather than a semver range, and the plugin manager's update check compares the on-disk version to itself instead of looking up dist-tags.latest from the npm registry. This is a hypothesis; I have not read the plugin manager source to confirm it.

Temporary workaround (observed effective)

openclaw plugins install <full-pkg-name>@<version> --force
openclaw gateway restart

# Examples:
# openclaw plugins install @openclaw/[email protected] --force
# openclaw plugins install @tencent-weixin/[email protected] --force

Scoped packages must be referenced by their full npm name (e.g. @tencent-weixin/openclaw-weixin, not openclaw-weixin); using the short plugin ID on scoped packages is rejected by plugins install.

Regression window for Case 2

• 2026-06-03 19:21 UTC: @openclaw/[email protected] published (contains the streaming card bug)
• 2026-06-04 07:57 UTC: PR fix(feishu): preserve streaming card content #90181 merged to main on this repository
• 2026-06-09 18:06 UTC: @openclaw/[email protected] published (contains the fix)
• 2026-06-11 21:00 (Asia/Shanghai): I manually upgraded to 2026.6.5 after reproducing the issue and confirming the fix

Total window where users installed 2026.6.1 were exposed to the bug: ~5 days.