Best possible solution:

Port only any still-needed active-host repair onto the current per-plugin npm project topology, and keep unchanged npm updates on the skip path unless maintainers explicitly approve and prove a separate maintenance mode.

Do we have a high-confidence way to reproduce the issue?

Partly. The active-host failure has PR-body Testbox live-output proof, and the PR-introduced unchanged-update behavior change is source-reproducible from the diff against current main; I did not run fresh commands in this read-only review.

Is this the best way to solve the issue?

No. Active-host repair is a plausible mitigation, but this branch is not the best merge shape because it is conflicting and bundles an update-semantics compatibility change with the repair.

Full review comments:

• [P1] Keep unchanged npm updates on the skip path — src/plugins/update.ts:1250-1267
  This turns the unchanged-artifact fast path into a live npm installer call. Current main skips reinstall when metadata says the artifact is unchanged; running installer/update work here can make already up-to-date plugins fail on network, integrity, rollback, or config reconciliation without a real update, so keep the skip path or split this into an explicitly approved compatibility change with upgrade proof.
  Confidence: 0.95

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f0f5da0e3941.

Label justifications:

• P2: The PR targets a bounded managed npm plugin install reliability issue with compatibility concerns, not an emergency runtime outage.
• merge-risk: 🚨 compatibility: The diff changes established unchanged npm update behavior and must be reconciled with current per-plugin install topology.
• merge-risk: 🚨 availability: Failed host repair or added installer work can block plugin installs or updates and affect runtime dependency availability.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦪 silver shellfish and patch quality is 🧂 unranked krab.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body gives useful Testbox live-output proof for active-host dependency survival, but not for the added unchanged-update installer behavior on a refreshed, non-conflicting head. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

PR surface:

Source +308, Tests +467. Total +775 across 6 files.

What I checked:

• Root policy applied: Root AGENTS.md was read fully; it requires deep PR review and treats plugin install/update compatibility changes as merge risk. (AGENTS.md:1, f0f5da0e3941)
• Scoped plugin policy applied: The scoped plugin guide was read fully and confirms plugin install/update behavior is owned under the plugin control plane with compatibility-sensitive boundaries. (src/plugins/AGENTS.md:1, f0f5da0e3941)
• Live PR state: Live GitHub metadata shows the PR is open, assigned to vincentkoc, labeled maintainer, and has mergeable=CONFLICTING / mergeStateStatus=DIRTY. (1e609cfb695c)
• PR active-host repair path: The PR head adds repairManagedNpmRootActiveHostPackage, which repairs missing active host dependencies by running a global openclaw@<version> npm install under the managed prefix. (src/infra/npm-managed-root.ts:950, 1e609cfb695c)
• PR unchanged-update change: The PR head calls installNpmSpecForUpdate inside the unchanged npm-artifact branch, so an already up-to-date npm plugin can now run installer/update work before returning unchanged. (src/plugins/update.ts:1250, 1e609cfb695c)
• Current unchanged-update behavior: Current main keeps the unchanged path as a metadata/probe decision that pushes an unchanged outcome without running installNpmSpecForUpdate in that branch. (src/plugins/update.ts:1831, f0f5da0e3941)

Likely related people:

• vincentkoc: They are the current assignee, authored the second PR commit that changes update semantics, and have recent current-main work in plugin update/install paths. (role: recent area contributor and assignee; confidence: high; commits: 1e609cfb695c, 767e8280ac7c, 97ce204d972c; files: src/plugins/update.ts, src/plugins/install.ts, src/infra/npm-managed-root.ts)
• steipete: They authored and merged the current per-plugin npm install isolation PR that this stale branch must be reconciled with. (role: topology introducer and adjacent owner; confidence: high; commits: ea682182d05a, 5dc50b8a3f80, 463e9f270434; files: src/plugins/install.ts, src/plugins/install-paths.ts, src/plugins/npm-project-roots.ts)
• zhuisDEV: They authored the merged official npm plugin install-record work adjacent to the update-record behavior this PR changes. (role: adjacent update contributor; confidence: medium; commits: 7b5f75eb98f4; files: src/plugins/update.ts, src/plugins/update.test.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Hatchability:

• Merged PRs are hatchable.
• Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
• Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

About:

• Eggs appear after real-behavior proof passes. They are collectible flavor only.
• Review momentum changes the shell state: follow-up work warms it, re-review makes it wobble, and a clean final review lets it hatch.
• The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
• Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.