Summary

The bundled official-external-plugin-catalog hard-pins @tencent-weixin/[email protected] as the only installable version, but npm has 2.4.4, 2.4.5, and 2.4.6 already published. End users cannot upgrade to a newer version even with openclaw plugins install @tencent-weixin/[email protected] --pin --force because the next OpenClaw core upgrade reconciles the plugin back to the catalog's hardcoded 2.4.3.

Environment

• OpenClaw: 2026.6.10
• Plugin: @tencent-weixin/openclaw-weixin
• Catalog version hash: 8c34cdb09cafb86085670587c70060bf8187fc19eed9fabf245cc2539bb21516
• OS: Linux x86_64

Evidence

The catalog hard-codes the version in two locations:

1. /usr/lib/node_modules/openclaw/dist/official-external-plugin-catalog-*.js

{
  "name": "@tencent-weixin/openclaw-weixin",
  "openclaw": {
    "install": {
      "npmSpec": "@tencent-weixin/[email protected]",
      "expectedIntegrity": "sha512-dPQbidUNWigC6V10vGW4i+GLH09x+6zUhafZRjuxkJ9GDu8o62WBsnUTojp4KqUH756hz+t2v9khiCRSi0dBDw==",
      "minHostVersion": ">=2026.3.22"
    }
  }
}

2. /usr/lib/node_modules/openclaw/dist/channel-catalog.json — same npmSpec.

Reproduction Steps

1. Install OpenClaw 2026.6.10 — openclaw plugins list shows openclaw-weixin at 2.4.3.
2. Run openclaw plugins install @tencent-weixin/[email protected] --pin --force.
3. openclaw plugins list now shows 2.4.6 ✅
4. Upgrade OpenClaw core to the next release and restart.
5. openclaw plugins list shows 2.4.3 again ❌ — the catalog reconciliation during core upgrade silently overwrote the user pin.

After step 5, inspecting the SQLite installed_plugin_index.install_records_json shows:

• spec: "@tencent-weixin/[email protected]" (overwritten)
• packageInstall.npm.spec: "@tencent-weixin/openclaw-weixin" (floating)
• packageInstall.pinState: "floating-without-integrity"
• warnings: ["npm-spec-floating", "npm-spec-missing-integrity"]

Impact

• Users cannot reliably get newer Weixin plugin versions.
• The packageInstall.pinState warning suggests the user pin is intentionally treated as a soft hint rather than a hard constraint by the reconciler.
• plugins update --dryrun reports "up to date" even when npm dist-tags.latest is newer (see [Bug]: plugins update --dryrun reports "up to date" while npm dist-tags.latest is newer #92183 for a closely related report).

Related Issues

• [Bug]: plugins update --dryrun reports "up to date" while npm dist-tags.latest is newer #92183 — plugins update --dryrun reports up-to-date while npm latest is newer.
• openclaw-weixin plugin v2.4.4 + OpenClaw 2026.6.1: Channel shows OFF / not configured, startAccount never called #91129 — openclaw-weixin 2.4.4 + OpenClaw 2026.6.1 has startAccount not called / channel shows OFF. This may explain why the catalog is pinned to 2.4.3 (avoiding the v2.4.4 regression). If that issue is still open, then the right fix is to either (a) ship a fixed v2.4.7 from the Tencent Weixin team and bump the catalog, or (b) document why the catalog intentionally lags npm.

Suggested Resolution

1. Short term: bump npmSpec to @tencent-weixin/[email protected] in both catalog files, with a matching expectedIntegrity for the new release. This unblocks users who want the latest.
2. Medium term: if openclaw-weixin plugin v2.4.4 + OpenClaw 2026.6.1: Channel shows OFF / not configured, startAccount never called #91129 shows 2.4.4+ has a real regression, coordinate with the Tencent Weixin team to ship a fixed release and bump the catalog in lockstep.
3. Long term: consider allowing the user pin to actually take precedence over the catalog npmSpec, or at minimum emit a clearer warning at upgrade time so users know their pin will be reverted.

Why this matters

External plugin pinning is a documented user workflow (--pin --force). When the catalog silently overrides it during core upgrades, the flag becomes misleading and trust in the upgrade path is reduced.