fix: clarify pinned plugin dry-run updates by yungchentang · Pull Request #97282 · openclaw/openclaw

yungchentang · 2026-06-27T16:58:25Z

What Problem This Solves

Fixes an issue where users running openclaw plugins update <id> --dry-run on an exact pinned npm plugin would only see an up to date result, even when the registry default line had a newer release available.

Why This Change Was Made

Exact pinned plugin-id updates still stay pinned, preserving the existing sticky-pin contract. The dry-run path now adds a best-effort registry default-line check for exact pinned npm installs and, when a newer default is resolvable, reports the pin plus an explicit @latest package update command instead of silently implying there is no newer registry default.

The exact-version comparison now normalizes accepted leading-v exact selectors such as @[email protected], so those supported pins receive the same default-line advisory as @[email protected].

User Impact

Operators can keep reproducible exact pins while still seeing when a newer registry default release exists during dry-run planning. Users who want to leave the pin get clear confirmation that the install is pinned; users who want to follow the default line get a command that avoids plugin-id/package-name ambiguity.

Evidence

node scripts/run-vitest.mjs src/plugins/update.test.ts --testNamePattern "reports newer registry default releases" (1 file passed; 2 tests passed, covering @acme/[email protected] and @acme/[email protected])
node_modules/.bin/oxfmt --check src/plugins/update.ts src/plugins/update.test.ts
git diff --check
.agents/skills/autoreview/scripts/autoreview --mode local (clean: no accepted/actionable findings; overall patch correct)

Live after-fix CLI proof:

Installed npm:@openclaw/[email protected] into an isolated redacted proof state.
Ran node scripts/run-node.mjs plugins update voice-call --dry-run against that installed exact pin.
Dry-run output reported: voice-call is pinned to @openclaw/[email protected] (installed 2026.6.9); registry default resolves to 2026.6.10. Pass \openclaw plugins update @openclaw/voice-call@latest` to follow the registry default line.`
Post dry-run SQLite record check showed the tracked install remained pinned to @openclaw/[email protected], with resolved version 2026.6.9.

clawsweeper · 2026-06-27T16:59:24Z

Codex review: needs maintainer review before merge. Reviewed June 27, 2026, 1:53 PM ET / 17:53 UTC.

Summary
The PR adds a dry-run-only registry default-line advisory for exact-pinned npm plugin updates, plus regression coverage for leading-v exact specs and CLI docs wording.

PR surface: Source +64, Tests +56, Docs +2. Total +122 across 3 files.

Reproducibility: yes. Current main and v2026.6.10 send recorded exact npm specs through the dry-run probe and report is up to date when the probe resolves to the installed version; the linked issue also includes concrete CLI captures.

Review metrics: 1 noteworthy metric.

Dry-run registry lookup: 1 added. The PR adds one best-effort npm view metadata lookup to a user-visible dry-run planning path, so the live proof matters even though the path stays read-only.

Stored data model
Persistent data-model change detected: vector/embedding metadata: src/plugins/update.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #92183
Summary: This PR is the active candidate fix for the canonical exact-pinned npm plugin dry-run false-negative issue; earlier and adjacent plugin-update PRs do not replace it.

Members:

canonical: [Bug]: plugins update --dryrun reports "up to date" while npm dist-tags.latest is newer #92183 - The PR body uses closing syntax for the open issue that describes the same targeted exact-pinned npm dry-run false negative.
superseded: fix(plugins): strip exact-version pin from install spec during dry-run update check (#92183) #92660 - That earlier unmerged PR targeted the same issue by stripping exact pins, while this PR preserves sticky pins and adds an advisory instead.
partial_overlap: fix(cli): sync official plugins during update --all #94084 - That PR discussed targeted exact pins but focused on bulk official update --all convergence, not targeted dry-run default-line reporting.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

No ClawSweeper repair lane is needed because the prior code finding is fixed and the remaining action is normal maintainer/check review.

Security
Cleared: The diff uses the existing script-free npm metadata helper for a dry-run lookup and does not change dependencies, lockfiles, workflows, permissions, secrets handling, or live install write behavior.

Review details

Best possible solution:

Land this PR after normal maintainer and check gates if maintainers accept the advisory wording; it preserves sticky exact pins while surfacing newer registry default-line releases during dry-run planning.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main and v2026.6.10 send recorded exact npm specs through the dry-run probe and report is up to date when the probe resolves to the installed version; the linked issue also includes concrete CLI captures.

Is this the best way to solve the issue?

Yes. The PR fixes the dry-run outcome boundary without stripping or floating the recorded exact pin, and the rejected alternative of probing the default line by changing the install spec would conflict with the documented sticky-pin contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 1bdde6695030.

Label changes

Label justifications:

P2: This is a bounded plugin-manager CLI bug-fix PR for missed update discovery, with proof and tests but limited blast radius.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The updated PR body/comment supplies redacted terminal commands and output showing the exact-pinned install, the dry-run advisory, and a SQLite record check proving the pin stayed unchanged.
proof: sufficient: Contributor real behavior proof is sufficient. The updated PR body/comment supplies redacted terminal commands and output showing the exact-pinned install, the dry-run advisory, and a SQLite record check proving the pin stayed unchanged.

Evidence reviewed

PR surface:

Source +64, Tests +56, Docs +2. Total +122 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	66	2	+64
Tests	1	56	0	+56
Docs	1	2	0	+2
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	124	2	+122

What I checked:

AGENTS policy applied: Root AGENTS.md plus scoped src/plugins/AGENTS.md and docs/AGENTS.md were read fully; their plugin boundary, docs, proof, and best-fix review guidance shaped this review. (AGENTS.md:1, 1bdde6695030)
Current main still has the old dry-run result: Current main computes unchanged from the resolved probe version and emits is up to date without checking the package default line when an exact pinned npm spec resolves to the installed version. (src/plugins/update.ts:1947, 1bdde6695030)
Latest release still has the old dry-run result: Tag v2026.6.10 contains the same dry-run unchanged branch and is up to date message, so the proposed fix is not already shipped. (src/plugins/update.ts:1837, aa69b12d0086)
PR head implements the dry-run advisory at the right boundary: The PR only asks for the default-line metadata check after an unchanged npm dry-run with no explicit spec override or official sync override, preserving targeted exact-pin behavior. (src/plugins/update.ts:1998, 4e0f8a387083)
PR head normalizes accepted exact selector spelling: The helper normalizes exact selector values before comparison, and the parser contract already accepts optional leading v exact semver selectors. (src/plugins/update.ts:916, 4e0f8a387083)
Regression test covers the prior edge case: The added table test covers both @acme/[email protected] and @acme/[email protected], verifies the original exact spec is still probed, and expects the default-line advisory message. (src/plugins/update.test.ts:2463, 4e0f8a387083)

Likely related people:

vincentkoc: Current blame and recent plugin-update recovery history touch the dry-run update path and sticky targeted-update docs now under review. (role: recent area contributor; confidence: high; commits: ff1837429300, 767e8280ac7c, 428d1761b43e; files: src/plugins/update.ts, src/plugins/update.test.ts, docs/cli/plugins.md)
huntharo: The versioned plugin update support commit added the recorded spec/update behavior and related docs/tests that exact pinned dry-runs build on. (role: introduced versioned update behavior; confidence: high; commits: 401ffb59f538; files: src/plugins/update.ts, src/plugins/update.test.ts, docs/cli/plugins.md)
steipete: History shows substantial plugin update, update-channel, ClawHub, and CLI extraction work in the same owner surface. (role: feature-history contributor; confidence: medium; commits: 99fc0fbac1ef, 91b2800241c1, 54ec14262b84; files: src/plugins/update.ts, src/cli/plugins-update-command.ts, docs/cli/plugins.md)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

yungchentang · 2026-06-27T17:50:55Z

Addressed the leading-v exact-pin edge case and added focused regression coverage.

Live CLI proof, redacted local paths:

OPENCLAW_STATE_DIR=<proof-state>/state \
OPENCLAW_CONFIG_PATH=<proof-state>/openclaw.json \
OPENCLAW_WORKSPACE_DIR=<proof-state>/workspace \
COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
node scripts/run-node.mjs plugins install npm:@openclaw/[email protected]

Output snippet:

Installing @openclaw/[email protected] into <proof-state>/state/npm/projects/openclaw-voice-call-...
Linked peerDependency "openclaw" -> <worktree>
Installed plugin: voice-call
Restart the gateway to load plugins.

Then:

OPENCLAW_STATE_DIR=<proof-state>/state \
OPENCLAW_CONFIG_PATH=<proof-state>/openclaw.json \
OPENCLAW_WORKSPACE_DIR=<proof-state>/workspace \
COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
node scripts/run-node.mjs plugins update voice-call --dry-run

Output snippet:

voice-call is pinned to @openclaw/[email protected] (installed 2026.6.9); registry default resolves to 2026.6.10. Pass `openclaw plugins update @openclaw/voice-call@latest` to follow the registry default line.

DB record check after the dry run, showing the exact pin remained unchanged:

sqlite3 <proof-state>/state/state/openclaw.sqlite \
  "select json_extract(install_records_json, '$.\"voice-call\".spec'), json_extract(install_records_json, '$.\"voice-call\".resolvedVersion'), json_extract(install_records_json, '$.\"voice-call\".resolvedSpec'), json_extract(install_records_json, '$.\"voice-call\".version') from installed_plugin_index;"

Output:

@openclaw/[email protected]|2026.6.9|@openclaw/[email protected]|2026.6.9

Focused checks run:

node scripts/run-vitest.mjs src/plugins/update.test.ts --testNamePattern "reports newer registry default releases"
node_modules/.bin/oxfmt --check src/plugins/update.ts src/plugins/update.test.ts
git diff --check
.agents/skills/autoreview/scripts/autoreview --mode local

Results:

Test Files  1 passed (1)
Tests  2 passed | 106 skipped (108)

All matched files use the correct format.

git diff --check: passed

autoreview clean: no accepted/actionable findings reported
overall: patch is correct (0.86)

@clawsweeper re-review

clawsweeper · 2026-06-27T17:50:57Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

* fix: clarify pinned plugin dry-run updates * fix(plugins): normalize pinned npm dry-run versions

* fix: clarify pinned plugin dry-run updates * fix(plugins): normalize pinned npm dry-run versions (cherry picked from commit f3bcee8)

fix: clarify pinned plugin dry-run updates

2aa1c0d

openclaw-barnacle Bot added docs Improvements or additions to documentation size: S labels Jun 27, 2026

fix(plugins): normalize pinned npm dry-run versions

4e0f8a3

vincentkoc merged commit f3bcee8 into openclaw:main Jun 28, 2026
124 of 132 checks passed

github-actions Bot mentioned this pull request Jun 28, 2026

📡 Upstream Digest — 2026-06-28 20:53 UTC curtismercier/openclaw-mods#1169

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 29, 2026

fix: clarify pinned plugin dry-run updates (openclaw#97282)

2b2f452

* fix: clarify pinned plugin dry-run updates * fix(plugins): normalize pinned npm dry-run versions

QiuYuang pushed a commit to QiuYuang/openclaw that referenced this pull request Jul 1, 2026

fix: clarify pinned plugin dry-run updates (openclaw#97282)

c9d3e27

* fix: clarify pinned plugin dry-run updates * fix(plugins): normalize pinned npm dry-run versions

chenyangjun-xy pushed a commit to chenyangjun-xy/openclaw that referenced this pull request Jul 1, 2026

fix: clarify pinned plugin dry-run updates (openclaw#97282)

117ffcb

* fix: clarify pinned plugin dry-run updates * fix(plugins): normalize pinned npm dry-run versions

chenyangjun-xy pushed a commit to chenyangjun-xy/openclaw that referenced this pull request Jul 3, 2026

fix: clarify pinned plugin dry-run updates (openclaw#97282)

ddfa380

* fix: clarify pinned plugin dry-run updates * fix(plugins): normalize pinned npm dry-run versions

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: clarify pinned plugin dry-run updates#97282

fix: clarify pinned plugin dry-run updates#97282
vincentkoc merged 2 commits into
openclaw:mainfrom
yungchentang:codex/fix-plugin-dryrun-latest

yungchentang commented Jun 27, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

yungchentang commented Jun 27, 2026

Uh oh!

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

yungchentang commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yungchentang commented Jun 27, 2026

Uh oh!

clawsweeper Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

yungchentang commented Jun 27, 2026 •

edited

Loading

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading