Skip to content

fix: bump @tencent-weixin/openclaw-weixin to 2.4.6 in catalog#96807

Closed
zhibudao333 wants to merge 1 commit into
openclaw:mainfrom
zhibudao333:fix/96791-weixin-plugin-bump
Closed

fix: bump @tencent-weixin/openclaw-weixin to 2.4.6 in catalog#96807
zhibudao333 wants to merge 1 commit into
openclaw:mainfrom
zhibudao333:fix/96791-weixin-plugin-bump

Conversation

@zhibudao333

@zhibudao333 zhibudao333 commented Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Closes #96791

Summary

This PR updates the official-external-channel-catalog to bump @tencent-weixin/openclaw-weixin from version 2.4.3 to 2.4.6.

Changes

Impact

Users can now install and use the latest Weixin plugin version (2.4.6) without manual workarounds. The catalog reconciliation during core upgrades will no longer revert user pins to the outdated 2.4.3 version.

@zhibudao333
fix: bump @tencent-weixin/openclaw-weixin to 2.4.6 in catalog
3d9d52a 
Update official-external-channel-catalog.json to use version 2.4.6
with the correct integrity hash for the Weixin plugin.

Closes openclaw#96791
@openclaw-barnacle openclaw-barnacle Bot added scripts Repository scripts size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jun 25, 2026
@clawsweeper

clawsweeper Bot commented Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed June 25, 2026, 10:41 AM ET / 14:41 UTC.

Summary
The PR updates the official external Weixin channel catalog npm spec and integrity from @tencent-weixin/[email protected] to @tencent-weixin/[email protected].

PR surface: Other 0. Total 0 across 1 file.

Reproducibility: yes. Source and npm metadata reproduce the review finding: this PR targets 2.4.6, whose package metadata requires OpenClaw >=2026.5.12, while the catalog entry still says >=2026.3.22.

Review metrics: 1 noteworthy metric.

  • Official catalog install metadata: 2 fields changed, 1 compatibility field left stale. The PR changes the package target and integrity but not the host floor that setup and install metadata expose before the package loads.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #96791
Summary: This PR is a candidate fix for the official Weixin catalog pin issue; a sibling PR proposes the same bump but is not a safe canonical replacement because it has the same proof and host-floor blockers.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦐 gold shrimp
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Update minHostVersion to match the 2.4.6 package contract.
  • [P1] Add redacted terminal output or logs showing the official catalog install or reconcile path selects 2.4.6.
  • If 2.4.6 is not the safe Weixin target, coordinate a verified safe release target before bumping the catalog.

Proof guidance:

  • [P1] Needs real behavior proof before merge: The PR body describes metadata changes but includes no attached or inspectable redacted terminal output, logs, screenshots, recordings, or artifacts showing after-fix catalog install or reconcile behavior. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

  • [P1] Merging as-is changes the default official Weixin plugin artifact while leaving catalog compatibility metadata below the package's own host-version contract.
  • [P1] The safety of using 2.4.6 as the official target is not proven with real catalog install, reconcile, or Weixin startup output, and the related Weixin startup report remains open as context.
  • [P1] CI and metadata checks can confirm the hash, but they do not prove the user-visible official external plugin upgrade path after this bump.

Maintainer options:

  1. Align Metadata Before Merge (recommended)
    Update the Weixin catalog minHostVersion to match the 2.4.6 package contract, then keep the version and integrity bump otherwise scoped.
  2. Accept Lower Floor Explicitly
    Maintainers could keep the older catalog floor only if they have owner proof that 2.4.6 intentionally supports hosts below the package-declared >=2026.5.12 contract.
  3. Pause For Weixin Validation
    If the open Weixin startup report is still a blocker for 2.4.6, pause this PR until a verified safe Weixin release target is identified.

Next step before merge

  • [P1] Manual review is needed because the code repair is narrow, but missing contributor real behavior proof and the selected Weixin release safety cannot be resolved by an automated repair marker.

Security
Cleared: No concrete security or supply-chain regression found: the npm integrity matches 2.4.6, dependencies are unchanged from 2.4.3, and reviewed package metadata has no install-time lifecycle hook.

Review findings

  • [P2] Align the catalog host floor with 2.4.6 — scripts/lib/official-external-channel-catalog.json:120
Review details

Best possible solution:

Align the catalog version, integrity, and host floor with the selected Weixin package, then add redacted real catalog install or post-core reconcile proof before merge.

Do we have a high-confidence way to reproduce the issue?

Yes. Source and npm metadata reproduce the review finding: this PR targets 2.4.6, whose package metadata requires OpenClaw >=2026.5.12, while the catalog entry still says >=2026.3.22.

Is this the best way to solve the issue?

No, not yet. The version and integrity bump is in the right owner surface, but the catalog compatibility metadata must move with the package contract and the PR needs real behavior proof before it is the best fix.

Full review comments:

  • [P2] Align the catalog host floor with 2.4.6 — scripts/lib/official-external-channel-catalog.json:120
    The 2.4.6 package metadata raises both openclaw.install.minHostVersion and peerDependencies.openclaw to >=2026.5.12, but the catalog still advertises >=2026.3.22. Since this catalog metadata is used by setup and install surfaces before the package is loaded, the bump should move the host floor with the artifact so older hosts are not offered a package the package itself declares incompatible.
    Confidence: 0.89

Overall correctness: patch is incorrect
Overall confidence: 0.87

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2e6e17f7c502.

Label changes

Label changes:

  • add P2: This is a bounded official external plugin catalog update with user-visible plugin upgrade impact and a clear compatibility metadata finding.
  • add merge-risk: 🚨 compatibility: The diff can move trusted official Weixin installs to a new artifact while leaving compatibility metadata inconsistent with that artifact.
  • add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
  • add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body describes metadata changes but includes no attached or inspectable redacted terminal output, logs, screenshots, recordings, or artifacts showing after-fix catalog install or reconcile behavior. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

  • P2: This is a bounded official external plugin catalog update with user-visible plugin upgrade impact and a clear compatibility metadata finding.
  • merge-risk: 🚨 compatibility: The diff can move trusted official Weixin installs to a new artifact while leaving compatibility metadata inconsistent with that artifact.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body describes metadata changes but includes no attached or inspectable redacted terminal output, logs, screenshots, recordings, or artifacts showing after-fix catalog install or reconcile behavior. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Other 0. Total 0 across 1 file.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 0 0 0 0
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 1 2 2 0
Total 1 2 2 0

What I checked:

  • PR diff scope: The live PR changes only the Weixin npmSpec and expectedIntegrity fields and leaves minHostVersion unchanged at >=2026.3.22. (scripts/lib/official-external-channel-catalog.json:117, 3d9d52a25443)
  • Current main catalog baseline: Current main still pins the official external Weixin catalog entry to @tencent-weixin/[email protected] with the matching 2.4.3 integrity and minHostVersion >=2026.3.22. (scripts/lib/official-external-channel-catalog.json:117, 2e6e17f7c502)
  • Npm package metadata: Registry metadata confirms 2.4.6 is latest and the PR integrity matches that package, but 2.4.6 declares openclaw.install.minHostVersion and peerDependencies.openclaw as >=2026.5.12.
  • Tarball package inspection: The 2.4.6 tarball package.json confirms the >=2026.5.12 host floor, unchanged runtime dependency set versus 2.4.3, and no install-time lifecycle script such as preinstall/install/postinstall.
  • Catalog compatibility contract: OpenClaw docs state openclaw.install.minHostVersion is enforced during install and manifest registry loading for non-bundled plugin sources. Public docs: docs/plugins/manifest.md. (docs/plugins/manifest.md:1290, 2e6e17f7c502)
  • Install enforcement code: Package install compatibility checks read package metadata openclaw.install.minHostVersion and reject incompatible hosts with an upgrade error. (src/plugins/install.ts:201, 2e6e17f7c502)

Likely related people:

  • scotthuang: Authored the merged PR that updated the official Weixin catalog target and integrity to the current 2.4.3 pin. (role: recent Weixin catalog contributor; confidence: high; commits: c35634c7298b; files: scripts/lib/official-external-channel-catalog.json)
  • pumpkinxing1: Authored the merged install-records/channel catalog PR that added the original official external Weixin catalog entry and pinned install metadata. (role: introduced behavior; confidence: high; commits: 5fae1c32b5f8; files: scripts/lib/official-external-channel-catalog.json, src/plugins/channel-catalog-registry.ts)
  • vincentkoc: Authored the merged post-core official plugin install sync behavior that can reconcile trusted official records to catalog targets during updates. (role: official plugin sync contributor; confidence: high; commits: 2014c2327b20; files: src/cli/update-cli/update-command.ts, src/plugins/update.ts, src/plugins/update.test.ts)
  • zhuisDEV: Authored the merged official npm install-record pinning work in the updater surface where exact pins and official sync interact. (role: adjacent exact-pin contributor; confidence: medium; commits: 7b5f75eb98f4; files: src/plugins/update.ts, src/plugins/update.test.ts, src/cli/plugins-cli.update.test.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jun 25, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jun 25, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. scripts Repository scripts size: XS status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Update official-external-plugin-catalog: bump @tencent-weixin/openclaw-weixin to 2.4.6

1 participant

@zhibudao333