Skip to content

fix(cli): sync official plugins during update --all#96831

Merged
velvet-shark merged 1 commit into
mainfrom
maintainer/plugins-update-all-official-sync
Jun 25, 2026
Merged

fix(cli): sync official plugins during update --all#96831
velvet-shark merged 1 commit into
mainfrom
maintainer/plugins-update-all-official-sync

Conversation

@velvet-shark

@velvet-shark velvet-shark commented Jun 25, 2026

Copy link
Copy Markdown
Member

Closes #94083
Supersedes #94084
Related: #94225, #95541, #84256, #83337

What Problem This Solves

This is a maintainer landing copy of #94084 by @ooiuuii, applied cleanly on current origin/main so the diff stays small and reviewable. The commit author is preserved as ooiuuii <[email protected]>.

Operators using openclaw plugins update --all after a core upgrade could leave trusted official OpenClaw plugins pinned to stale exact beta install records. The gateway/doctor drift checks could still report official plugin version drift, so the bulk maintenance command did not reliably converge the official plugin set.

Why This Change Was Made

plugins update --all now opts into the existing official catalog sync path, matching the post-core update recovery behavior users expect from a bulk maintenance command. The implementation passes the configured update channel through a new official-only channel parameter, so beta-channel context is available when a trusted official catalog override is selected without rewriting ordinary third-party tracked npm or ClawHub specs.

Targeted openclaw plugins update <id> remains unchanged: recorded exact versions and explicit tags stay pinned unless the operator passes a new package spec.

Cluster handling:

User Impact

Operators can use openclaw plugins update --all after core upgrades to reconcile trusted official OpenClaw plugins with the current official catalog target. Users who intentionally pin a specific plugin through targeted updates keep that behavior, and third-party plugins are not silently moved to beta-channel selectors just because update.channel is beta.

Evidence

Original PR-head CLI proof from #94084 covered:

Scenario: bulk official sync for a trusted official exact beta record
command: node openclaw.mjs plugins update --all
result: Updated acpx: 2026.6.10-beta.2 -> 2026.6.10.

Scenario: targeted update keeps the exact beta pin
command: node openclaw.mjs plugins update acpx
result: acpx already at 2026.6.10-beta.2.

Scenario: third-party npm spec is not rewritten by beta channel context
command: node openclaw.mjs plugins update --all
result: lossless-claw is up to date (0.9.0).

Maintainer-copy validation on this branch:

pnpm docs:list
node scripts/run-vitest.mjs src/plugins/update.test.ts src/cli/plugins-cli.update.test.ts
node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.core.json src/cli/plugins-update-command.ts src/cli/plugins-cli.update.test.ts src/plugins/update.ts src/plugins/update.test.ts
git diff --check

Results: docs listing completed, focused Vitest passed (28 CLI tests and 98 plugin tests), oxlint passed, and git diff --check passed.

@velvet-shark velvet-shark mentioned this pull request Jun 25, 2026
Closed
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation cli CLI command changes size: S maintainer Maintainer-authored PR labels Jun 25, 2026
@velvet-shark velvet-shark mentioned this pull request Jun 25, 2026
Closed
@clawsweeper

clawsweeper Bot commented Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 25, 2026, 12:52 PM ET / 16:52 UTC.

Summary
The PR makes bulk openclaw plugins update --all opt trusted official plugin records into official catalog sync while keeping targeted plugin updates pinned, with docs and regression tests.

PR surface: Source +9, Tests +68, Docs +11. Total +88 across 6 files.

Reproducibility: yes. Current main and v2026.6.10 route standalone plugins update --all to the updater without official-sync/channel context, and the PR body supplies terminal proof for the fixed branch path.

Review metrics: 1 noteworthy metric.

  • Bulk updater policy arguments: 2 added for --all, 0 for targeted updates. The new official-sync and official-channel arguments are the compatibility-sensitive behavior change maintainers should notice before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #94083
Summary: This PR is the active maintainer landing candidate for the canonical narrow issue about trusted official beta plugin pins surviving plugins update --all.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

  • [P1] Merging intentionally changes plugins update --all semantics so trusted official exact install records can reconcile to the official catalog target instead of staying pinned.
  • [P1] This PR fixes only the trusted-official bulk maintenance path; broader direct package-manager upgrade drift, third-party latest detection, and general exact-pin policy remain in separate related items.

Maintainer options:

  1. Accept Bulk Official Convergence (recommended)
    Merge with the explicit policy that bulk maintenance may reconcile trusted official exact records to the current official catalog while targeted updates remain pinned.
  2. Pause For Broader Pin Policy
    Pause this PR if maintainers want direct package-manager drift, third-party latest behavior, and general exact-pin semantics settled before changing the trusted-official subset.

Next step before merge

  • [P2] Protected maintainer PR with compatibility-sensitive CLI semantics needs maintainer landing judgment, not cleanup closure or automated repair.

Security
Cleared: No concrete security or supply-chain concern found; the diff is limited to plugin update routing, docs, and focused tests without dependency, workflow, lockfile, secret, or new third-party execution changes.

Review details

Best possible solution:

Land the narrow trusted-official bulk-sync behavior after maintainer compatibility acceptance, keep targeted exact/tagged updates pinned, and leave broader plugin drift policy to the linked issues.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main and v2026.6.10 route standalone plugins update --all to the updater without official-sync/channel context, and the PR body supplies terminal proof for the fixed branch path.

Is this the best way to solve the issue?

Yes, if maintainers accept the compatibility boundary. Reusing the existing official-sync updater contract only for bulk --all is the narrow maintainable fix, while targeted exact/tagged updates remain pinned.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 19707cce1d73.

Label changes

Label changes:

  • add P1: The PR targets a real post-upgrade recovery bug where trusted official plugins can remain stale and leave users with plugin/core version drift.
  • add merge-risk: 🚨 compatibility: Merging changes plugins update --all so trusted official exact install records can be rewritten to the current official catalog target.

Label justifications:

  • P1: The PR targets a real post-upgrade recovery bug where trusted official plugins can remain stale and leave users with plugin/core version drift.
  • merge-risk: 🚨 compatibility: Merging changes plugins update --all so trusted official exact install records can be rewritten to the current official catalog target.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal after-fix CLI proof for bulk official convergence, targeted pin preservation, and third-party non-regression, plus maintainer-copy validation commands.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal after-fix CLI proof for bulk official convergence, targeted pin preservation, and third-party non-regression, plus maintainer-copy validation commands.
Evidence reviewed

PR surface:

Source +9, Tests +68, Docs +11. Total +88 across 6 files.

View PR surface stats
Area Files Added Removed Net
Source 2 12 3 +9
Tests 2 74 6 +68
Docs 2 12 1 +11
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 6 98 10 +88

What I checked:

  • Protected live PR state: Live GitHub data shows the PR is open, author association is MEMBER, the maintainer label is present, and the head is bea1084689e1736d30c2ad2460f3a8b3345ce7bb. (bea1084689e1)
  • Current main lacks standalone bulk official sync: On current main, runPluginUpdateCommand calls updateNpmInstalledPlugins without syncOfficialPluginInstalls or official update-channel context. (src/cli/plugins-update-command.ts:258, 19707cce1d73)
  • Latest release lacks the standalone bulk sync: Tag v2026.6.10 points to aa69b12d0086b631b139c1435c9621a5783e3a40 and has the same updater call shape without official-sync arguments. (src/cli/plugins-update-command.ts:258, aa69b12d0086)
  • Sibling host-update path already uses official sync: The core update path passes updateChannel: params.channel and syncOfficialPluginInstalls: true, so this PR reuses an existing updater contract for bulk maintenance. (src/cli/update-cli/update-command.ts:1880, 19707cce1d73)
  • PR scopes CLI behavior to bulk update: The PR head passes officialPluginUpdateChannel and syncOfficialPluginInstalls only when params.opts.all is true, leaving targeted updates on the existing pinned-spec path. (src/cli/plugins-update-command.ts:264, bea1084689e1)
  • PR bounds official channel context: The PR head substitutes the official sync channel only when an official npm or ClawHub override exists; ordinary records keep the existing update-channel behavior. (src/plugins/update.ts:1346, bea1084689e1)

Likely related people:

  • vincentkoc: Authored and merged the official plugin install sync path reused by this PR in fix(plugins): sync official plugin installs during update #78065 and recently merged adjacent plugin drift guidance work. (role: feature-history contributor; confidence: high; commits: 2014c2327b20, 305fe8c2b6ca, a4e85430a5a4; files: src/plugins/update.ts, src/cli/update-cli/update-command.ts, src/plugins/plugin-version-drift.ts)
  • steipete: Git history shows earlier plugin update tracking, update-channel behavior, and plugin install/update command extraction in this surface. (role: feature-history contributor; confidence: high; commits: 99fc0fbac1ef, 5920ea838d51, 49b7000a814f; files: src/plugins/update.ts, src/cli/plugins-update-command.ts, docs/cli/plugins.md)
  • zhuisDEV: Authored the merged official npm pinning work that preserved manual exact plugin pins, which is the compatibility boundary this PR keeps for targeted updates. (role: adjacent exact-pin contributor; confidence: high; commits: 7b5f75eb98f4, e0773e18de66; files: src/plugins/update.ts, src/plugins/update.test.ts)
  • ooiuuii: Authored the original superseded implementation and the merged per-plugin drift repair-command fix in the same plugin/core drift recovery area. (role: recent adjacent contributor; confidence: medium; commits: bea1084689e1, 2ea0e8807a78, dc0e91df36f6; files: src/cli/plugins-update-command.ts, src/plugins/update.ts, src/plugins/plugin-version-drift.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@velvet-shark velvet-shark self-assigned this Jun 25, 2026
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P1 High-priority user-facing bug, regression, or broken workflow. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jun 25, 2026
@velvet-shark
velvet-shark merged commit 0247eab into main Jun 25, 2026
162 of 172 checks passed
@velvet-shark
velvet-shark deleted the maintainer/plugins-update-all-official-sync branch June 25, 2026 18:13
@velvet-shark

velvet-shark commented Jun 25, 2026

Copy link
Copy Markdown
Member Author

Merged via squash.

@clawsweeper clawsweeper Bot mentioned this pull request Jun 25, 2026
Merged
@github-actions github-actions Bot mentioned this pull request Jun 25, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 26, 2026
@velvet-shark @ooiuuii
fix(cli): sync official plugins during update all (openclaw#96831)
5e9c9d5 
Co-authored-by: ooiuuii <[email protected]>
This was referenced Jun 26, 2026
Merged
Open
Closed
Merged
QiuYuang pushed a commit to QiuYuang/openclaw that referenced this pull request Jul 1, 2026
@velvet-shark @ooiuuii @QiuYuang
fix(cli): sync official plugins during update all (openclaw#96831)
a9493a1 
Co-authored-by: ooiuuii <[email protected]>
@clawsweeper clawsweeper Bot mentioned this pull request Jul 4, 2026
Closed
wheakerd pushed a commit to wheakerd/clawdbot that referenced this pull request Jul 15, 2026
@velvet-shark @ooiuuii @RomneyDa
fix(cli): sync official plugins during update all (openclaw#96831)
23f1f13 
Co-authored-by: ooiuuii <[email protected]>
(cherry picked from commit 0247eab)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@velvet-shark velvet-shark

Labels

cli CLI command changes docs Improvements or additions to documentation maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P1 High-priority user-facing bug, regression, or broken workflow. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. size: S status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

plugins update --all leaves exact beta official plugins pinned after stable upgrade

2 participants

@velvet-shark @ooiuuii