fix(cli): sync official plugins during update --all by ooiuuii · Pull Request #94084 · openclaw/openclaw

ooiuuii · 2026-06-17T09:52:49Z

What Problem This Solves

Fixes an issue where operators using openclaw plugins update --all for post-upgrade maintenance could leave trusted official OpenClaw plugins pinned to stale exact beta install records after the core moved to a stable release. The gateway/doctor drift checks could still report official plugin version drift, so the bulk maintenance command did not reliably converge the official plugin set.

A live Windows upgrade from 2026.6.10-beta.2 to 2026.6.10 reproduced the operational shape: core upgraded cleanly, doctor --repair reported active official plugin drift for brave, discord, qqbot, and whatsapp, and targeted plugins update <id> preserved the beta pins. Current upstream/main already has the narrower per-plugin exact-spec repair hint from #95541; this PR keeps the separate bulk update --all convergence behavior scoped to trusted official plugin records.

Why This Change Was Made

plugins update --all now opts into the existing official catalog sync path, matching the post-core update recovery behavior users expect from a bulk maintenance command. The implementation passes the configured update channel through a new official-only channel parameter, so beta-channel context is available when a trusted official catalog override is selected without rewriting ordinary third-party tracked npm or ClawHub specs.

Targeted openclaw plugins update <id> remains unchanged: recorded exact versions and explicit tags stay pinned unless the operator passes a new package spec. The docs now call out this bulk-vs-targeted boundary, and the tests cover both the official sync routing and the third-party non-regression.

User Impact

Operators can use openclaw plugins update --all after core upgrades to reconcile trusted official OpenClaw plugins with the current official catalog target. Users who intentionally pin a specific plugin through targeted updates keep that behavior, and third-party plugins are not silently moved to beta-channel selectors just because update.channel is beta.

Evidence

Live upgrade evidence from the Windows OpenClaw install:

npm latest: openclaw 2026.6.10
before: OpenClaw 2026.6.10-beta.2
upgrade: npm install -g [email protected]
post-upgrade: OpenClaw 2026.6.10 (aa69b12)
doctor/config validate: exit 0 / exit 0
doctor drift before manual plugin repair: brave, discord, qqbot, whatsapp at 2026.6.10-beta.2 -> expected 2026.6.10
targeted plugins update <id>: exited 0 but preserved recorded beta pins
manual exact official package install: @openclaw/[email protected], @openclaw/[email protected], @openclaw/[email protected], @openclaw/[email protected]
post-repair doctor/config validate: exit 0 / exit 0
Gateway routes: 127.0.0.1:18889, 100.126.177.112:18898, :18912, :18913 returned 200
bounded youyou-cli smoke: OpenClaw 2026.6.10 (aa69b12), gateway healthy, tool execution working

PR-head CLI proof from isolated Windows state, using this branch's built source launcher (node openclaw.mjs --version -> OpenClaw 2026.6.10 (c620265)):

Scenario: bulk official sync for a trusted official exact beta record
before install record: acpx spec=@openclaw/[email protected], resolvedVersion=2026.6.10-beta.2
command: node openclaw.mjs plugins update --all
exit: 0
terminal output: Updated acpx: 2026.6.10-beta.2 -> 2026.6.10.
after install record: spec=@openclaw/[email protected], resolvedSpec=@openclaw/[email protected], resolvedVersion=2026.6.10

Scenario: targeted update keeps the exact beta pin
before install record: acpx spec=@openclaw/[email protected], resolvedVersion=2026.6.10-beta.2
command: node openclaw.mjs plugins update acpx
exit: 0
terminal output: acpx already at 2026.6.10-beta.2.
after install record: spec=@openclaw/[email protected], resolvedSpec=@openclaw/[email protected], resolvedVersion=2026.6.10-beta.2

Scenario: third-party npm spec is not rewritten by beta channel context
config: update.channel=beta; local registry served @example/[email protected]
before install record: lossless-claw spec=@example/lossless-claw, resolvedVersion=0.9.0
command: node openclaw.mjs plugins update --all
exit: 0
terminal output: lossless-claw is up to date (0.9.0).
after install record: spec=@example/lossless-claw, resolvedSpec=@example/[email protected], resolvedVersion=0.9.0

Focused and regression checks on this PR branch:

node scripts/run-vitest.mjs src/cli/plugins-cli.update.test.ts --testNamePattern="syncs official catalog specs with beta channel context"
node scripts/run-vitest.mjs src/plugins/update.test.ts --testNamePattern="does not apply official beta-channel sync to third-party npm specs"
node scripts/run-vitest.mjs src/plugins/update.test.ts
node scripts/run-vitest.mjs src/cli/plugins-cli.update.test.ts
node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.core.json src/cli/plugins-update-command.ts src/cli/plugins-cli.update.test.ts src/plugins/update.ts src/plugins/update.test.ts
git diff --check
python .agents\skills\autoreview\scripts\autoreview --mode branch --base upstream/main --prompt "Review PR 94084 after rebase and follow-up fix. Current upstream/main already prints exact plugin package update commands for drift; this branch changes plugins update --all bulk official sync, adds a separate officialPluginUpdateChannel so third-party tracked specs are not sent to beta, and includes Windows-safe test helper adjustments."

Results: focused tests passed, src/plugins/update.test.ts passed (98 passed), src/cli/plugins-cli.update.test.ts passed (28 passed), oxlint passed, git diff --check passed, and autoreview reported autoreview clean: no accepted/actionable findings reported.

What was not tested: the production gateway was not modified with a packaged PR tarball; the after-fix proof above ran the changed PR-head CLI path in isolated Windows state so the live service was not touched.

clawsweeper · 2026-06-17T11:05:59Z

Codex review: needs maintainer review before merge. Reviewed June 25, 2026, 12:29 PM ET / 16:29 UTC.

Summary
The PR makes openclaw plugins update --all sync trusted official plugin install records through the official catalog, carries official-only update-channel context, preserves targeted exact pins, and updates docs/tests for that boundary.

PR surface: Source +9, Tests +68, Docs +11. Total +88 across 6 files.

Reproducibility: yes. Current main and v2026.6.10 route standalone plugins update --all to the updater without official-sync/channel context, and the PR body supplies terminal proof for the fixed branch path.

Review metrics: 1 noteworthy metric.

Bulk updater policy arguments: 2 added for --all, 0 for targeted updates. The new official-sync and official-channel arguments are the compatibility-sensitive behavior change maintainers need to evaluate before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #94083
Summary: This PR is the active candidate fix for the narrow trusted-official beta plugin pinning issue; related items cover broader plugin/core drift or exact-pin policy and should remain separate.

Members:

canonical: plugins update --all leaves exact beta official plugins pinned after stable upgrade #94083 - The issue describes the same stale trusted official beta plugin record behavior and GitHub lists this PR as its closing pull request.
superseded: fix(plugins): pass syncOfficialPluginInstalls when update --all is used (fixes #94083) #94225 - The closed unmerged PR attempted the same basic sync flag but lacks this PR's official-only channel refinement and docs/test coverage.
partial_overlap: [Bug]: openclaw plugins update --all downgrades manually-updated npm plugins to their originally-recorded install version #84256 - This issue tracks broader plugins update --all exact-spec downgrade and third-party/latest policy beyond the trusted-official stale beta case.
partial_overlap: Plugin/core version drift after upgrade causes silent channel failure #83337 - This issue tracks broader plugin/core version drift after upgrades, while this PR covers one bulk-update recovery path.
partial_overlap: [Bug]: Core upgrade via npm does not sync external plugins — plugins update command also fails to detect drift #94641 - The closed report preserves additional plugin/core drift evidence and references the narrower bulk-update recovery gap.
1 more in the report.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

[P1] Merging intentionally changes plugins update --all semantics so trusted official exact install records can reconcile to the official catalog target instead of staying pinned.
[P1] This PR fixes only the trusted-official bulk maintenance path; broader direct package-manager upgrade drift, third-party latest detection, and general exact-pin policy remain in separate related items.

Maintainer options:

Accept Bulk Official Convergence (recommended)
Merge with the explicit policy that bulk maintenance may reconcile trusted official exact records to the current official catalog while targeted updates remain pinned.
Pause For Broader Pin Policy
Pause the PR if maintainers want direct-upgrade drift handling, third-party latest checks, and exact-pin semantics settled before changing the trusted-official subset.

Next step before merge

[P2] Maintainer review should decide the compatibility-sensitive bulk exact-pin policy; no concrete contributor-facing code repair is pending.

Security
Cleared: No concrete security or supply-chain concern found; the diff is limited to plugin update routing, docs, and focused tests with no dependency, workflow, lockfile, secret, or new execution surface.

Review details

Best possible solution:

Land the narrow trusted-official bulk-sync behavior after maintainer acceptance, keep targeted exact/tagged updates pinned, and leave broader plugin drift policy to the linked issues.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main and v2026.6.10 route standalone plugins update --all to the updater without official-sync/channel context, and the PR body supplies terminal proof for the fixed branch path.

Is this the best way to solve the issue?

Yes, if maintainers accept the compatibility boundary. Reusing the existing official-sync updater contract only for bulk --all is the narrow maintainable fix, while targeted exact/tagged updates remain pinned.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 19707cce1d73.

Label changes

Label justifications:

P1: The PR targets a real post-upgrade recovery bug where trusted official plugins can remain stale and leave users with plugin/core version drift.
merge-risk: 🚨 compatibility: Merging changes plugins update --all so trusted official exact install records can be rewritten to the current official catalog target.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal proof from a Windows source checkout showing bulk official exact-beta convergence plus targeted-update and third-party non-regressions.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal proof from a Windows source checkout showing bulk official exact-beta convergence plus targeted-update and third-party non-regressions.

Evidence reviewed

PR surface:

Source +9, Tests +68, Docs +11. Total +88 across 6 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	12	3	+9
Tests	2	74	6	+68
Docs	2	12	1	+11
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	6	98	10	+88

What I checked:

Current main lacks standalone bulk official sync: runPluginUpdateCommand calls updateNpmInstalledPlugins with selected ids, overrides, dry-run state, and integrity handling, but not syncOfficialPluginInstalls or official update-channel context. (src/cli/plugins-update-command.ts:258, 19707cce1d73)
Latest release lacks the standalone bulk sync: Tag v2026.6.10 has the same updater call shape without official-sync arguments, so the shipped release still has the narrow gap this PR targets. (src/cli/plugins-update-command.ts:258, aa69b12d0086)
Sibling core update path already uses official sync: The supervised core update path passes updateChannel and syncOfficialPluginInstalls: true, which supports reusing the existing updater contract for the bulk maintenance path. (src/cli/update-cli/update-command.ts:1880, 19707cce1d73)
PR scopes CLI behavior to bulk update: The PR head passes officialPluginUpdateChannel and syncOfficialPluginInstalls only when params.opts.all is true, leaving targeted updates on the existing pinned-spec path. (src/cli/plugins-update-command.ts:264, c6202657b382)
Official channel context is bounded to official overrides: The PR head adds officialPluginUpdateChannel and substitutes that channel only when an official npm or ClawHub override exists; ordinary records keep the existing update-channel path. (src/plugins/update.ts:1318, c6202657b382)
Docs describe the new bulk-vs-targeted boundary: The PR docs state that bulk plugins update --all may sync trusted official records while targeted updates keep exact or tagged specs untouched. Public docs: docs/plugins/manage-plugins.md. (docs/plugins/manage-plugins.md:113, c6202657b382)

Likely related people:

vincentkoc: Authored and merged the official plugin install sync path reused by this PR in merged pull request fix(plugins): sync official plugin installs during update #78065. (role: feature-history contributor; confidence: high; commits: 2014c2327b20; files: src/plugins/update.ts, src/cli/update-cli/update-command.ts)
steipete: Authored earlier plugin update tracking, update-channel behavior, and plugin install/update command extraction in the same owner surface; also merged the exact-pin PR. (role: feature-history contributor; confidence: high; commits: 99fc0fbac1ef, 5920ea838d51, 7b5f75eb98f4; files: src/plugins/update.ts, src/cli/plugins-update-command.ts, docs/cli/plugins.md)
zhuisDEV: Authored merged official npm pinning work that preserved manual exact plugin pins, which is the compatibility boundary this PR keeps for targeted updates. (role: adjacent exact-pin contributor; confidence: high; commits: 7b5f75eb98f4; files: src/plugins/update.ts, src/plugins/update.test.ts)
ooiuuii: Authored the merged per-plugin drift repair-command fix for the same plugin/core drift recovery area, beyond authoring this open PR. (role: recent adjacent contributor; confidence: medium; commits: 2ea0e8807a78; files: src/plugins/plugin-version-drift.ts, src/commands/doctor-workspace-status.ts, src/cli/daemon-cli/status.print.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

ooiuuii · 2026-06-18T00:19:53Z

@clawsweeper re-review

clawsweeper · 2026-06-18T00:19:55Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27728336971
Updated: 2026-06-18T00:51:43.924Z

ooiuuii · 2026-06-18T02:17:44Z

@clawsweeper re-review

clawsweeper · 2026-06-18T02:17:47Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27732418114
Updated: 2026-06-18T03:10:45.078Z

xuwei-xy · 2026-06-18T15:29:48Z

I think the fix would involve adjusting ui. Would that work for your use case?

ooiuuii · 2026-06-24T16:50:22Z

@clawsweeper re-review

clawsweeper · 2026-06-24T16:50:25Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

velvet-shark · 2026-06-25T16:40:56Z

Closing this as superseded by the clean maintainer landing copy in #96831.

Why: this PR was the canonical implementation for #94083, but the branch fell behind main and syncing it pulled in a large unrelated diff. #96831 applies this PR's small patch directly onto current main so the landing diff stays reviewable (+98/-10, 6 files) without mutating this contributor branch again.

Attribution is preserved: #96831's commit author is @ooiuuii using the GitHub noreply address from this PR, and the PR body links back here as the original canonical contributor work.

Thank you, @ooiuuii — the fix and proof from this PR are what #96831 is landing.

ooiuuii force-pushed the fix/plugins-update-sync-official-all branch 2 times, most recently from 863219a to 2b80a40 Compare June 17, 2026 10:44

ooiuuii force-pushed the fix/plugins-update-sync-official-all branch from 2b80a40 to 4154129 Compare June 18, 2026 02:15

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 18, 2026

clawsweeper Bot mentioned this pull request Jun 18, 2026

fix(plugins): pass syncOfficialPluginInstalls when update --all is used (fixes #94083) #94225

Closed

velvet-shark self-assigned this Jun 25, 2026

velvet-shark requested a review from a team as a code owner June 25, 2026 15:59

velvet-shark mentioned this pull request Jun 25, 2026

fix(cli): sync official plugins during update --all #96831

Merged

clawsweeper Bot mentioned this pull request Jun 27, 2026

fix: clarify pinned plugin dry-run updates #97282

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(cli): sync official plugins during update --all#94084

fix(cli): sync official plugins during update --all#94084
ooiuuii wants to merge 3 commits into
openclaw:mainfrom
ooiuuii:fix/plugins-update-sync-official-all

ooiuuii commented Jun 17, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

ooiuuii commented Jun 18, 2026

Uh oh!

clawsweeper Bot commented Jun 18, 2026 •

edited

Loading

Uh oh!

ooiuuii commented Jun 18, 2026

Uh oh!

clawsweeper Bot commented Jun 18, 2026 •

edited

Loading

Uh oh!

xuwei-xy commented Jun 18, 2026

Uh oh!

ooiuuii commented Jun 24, 2026

Uh oh!

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

velvet-shark commented Jun 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

ooiuuii commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ooiuuii commented Jun 18, 2026

Uh oh!

clawsweeper Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ooiuuii commented Jun 18, 2026

Uh oh!

clawsweeper Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

xuwei-xy commented Jun 18, 2026

Uh oh!

ooiuuii commented Jun 24, 2026

Uh oh!

clawsweeper Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

velvet-shark commented Jun 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ooiuuii commented Jun 17, 2026 •

edited

Loading

clawsweeper Bot commented Jun 17, 2026 •

edited

Loading

clawsweeper Bot commented Jun 18, 2026 •

edited

Loading

clawsweeper Bot commented Jun 18, 2026 •

edited

Loading

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading