- Plugins/update: move ClawHub-preferred externalized plugin installs back to ClawHub after an earlier npm fallback once the ClawHub package becomes available. Thanks @vincentkoc.

- Plugins/update: clean stale bundled load paths for already-externalized pinned npm and ClawHub plugin installs, so release-channel sync does not leave removed bundled paths ahead of the installed external package. Thanks @vincentkoc.

- Plugins/update: repair stale managed npm-root `openclaw` peer packages before plugin installs, so beta-channel official plugin updates are not downgraded by old core package-lock state. Thanks @vincentkoc.

- Plugins/install: run managed npm-root install, rollback, repair, and uninstall mutations with legacy peer resolution so removing one plugin cannot rehydrate a stale registry `openclaw` package into the shared root. Thanks @vincentkoc.

- Plugins/install: reassert managed npm plugin `openclaw` peer links after shared-root npm installs, updates, and uninstalls, so mutating one plugin does not leave previously installed SDK-using plugins unable to resolve `openclaw/plugin-sdk/*`.

- Plugins/update: make package upgrades swap pnpm/npm-prefix installs cleanly, keep legacy plugin install runtime chunks working, and on the beta channel fall back default-line npm plugins to default/latest when plugin beta releases are missing or fail install validation. Thanks @vincentkoc and @joshavant.

- Plugins/active-memory: skip session-store channel entries that contain `:` when resolving the recall subagent's channel, so QQ c2c agent IDs (e.g. `c2c:10D4F7C2…`) and other scoped conversation IDs do not reach bundled-plugin `dirName` validation and crash the recall run. The same guard already applied to explicit `channelId` params (#76704); this extends it to store-derived channels. (#77396) Thanks @hclsys.

"npm",

"uninstall",

"--loglevel=error",

"--legacy-peer-deps",

"--ignore-scripts",

"--no-audit",

"--no-fund",

],

expect.objectContaining({

cwd: npmRoot,

env: expect.objectContaining({

npm_config_legacy_peer_deps: "true",

}),

}),

);

"npm",

"uninstall",

"--loglevel=error",

"--legacy-peer-deps",

"--ignore-scripts",

"--no-audit",

"--no-fund",

"npm",

"prune",

"--loglevel=error",

"--legacy-peer-deps",

"--ignore-scripts",

"--no-audit",

"--no-fund",

const result = await command(npmArgs, {

cwd: params.npmRoot,

timeoutMs: Math.max(params.timeoutMs ?? 300_000, 300_000),

env: createSafeNpmInstallEnv(process.env, { packageLock: true, quiet: true }),

env: createSafeNpmInstallEnv(process.env, {

legacyPeerDeps: true,

packageLock: true,

quiet: true,

}),

});

if (result.code !== 0) {

params.logger?.warn?.(

createSafeNpmInstallArgs({

omitDev: true,

ignoreWorkspaces: true,

legacyPeerDeps: true,

loglevel: "error",

noAudit: true,

noFund: true,

"install",

"--omit=dev",

"--loglevel=error",

"--legacy-peer-deps",

"--ignore-scripts",

"--workspaces=false",

"--no-audit",

type SafeNpmInstallArgsOptions = {

ignoreWorkspaces?: boolean;

legacyPeerDeps?: boolean;

loglevel?: "error" | "silent";

noAudit?: boolean;

noFund?: boolean;

"install",

...(options.omitDev ? ["--omit=dev"] : []),

...(options.loglevel ? [`--loglevel=${options.loglevel}`] : []),

...(options.legacyPeerDeps ? ["--legacy-peer-deps"] : []),

"--ignore-scripts",

...(options.ignoreWorkspaces ? ["--workspaces=false"] : []),

...(options.noAudit ? ["--no-audit"] : []),

"install",

"--omit=dev",

"--loglevel=error",

"--legacy-peer-deps",

"--ignore-scripts",

"--no-audit",

"--no-fund",

};

}

if (argv[0] === "npm" && argv[1] === "uninstall") {

if (!argv.includes("--legacy-peer-deps")) {

fs.mkdirSync(path.join(npmRoot, "node_modules", "openclaw"), { recursive: true });

}

return successfulSpawn("");

}

throw new Error(`unexpected command: ${argv.join(" ")}`);

dependencies: {},

});

expect(fs.lstatSync(peerLink).isSymbolicLink()).toBe(true);

await expect(

fs.promises.access(path.join(npmRoot, "node_modules", "openclaw")),

).rejects.toThrow();

});

it("rolls back installed npm package debris when security scan blocks the plugin", async () => {

"npm",

"uninstall",

"--loglevel=error",

"--legacy-peer-deps",

"--ignore-scripts",

"--no-audit",

"--no-fund",

{

cwd: params.npmRoot,

timeoutMs: Math.max(params.timeoutMs, 300_000),

env: createSafeNpmInstallEnv(process.env, { packageLock: true, quiet: true }),

env: createSafeNpmInstallEnv(process.env, {

legacyPeerDeps: true,

packageLock: true,

quiet: true,

}),

},

);

} catch (error) {

...createSafeNpmInstallArgs({

omitDev: true,

loglevel: "error",

legacyPeerDeps: true,

noAudit: true,

noFund: true,

}),

{

cwd: npmRoot,

timeoutMs: Math.max(timeoutMs, 300_000),

env: createSafeNpmInstallEnv(process.env, { packageLock: true, quiet: true }),

env: createSafeNpmInstallEnv(process.env, {

legacyPeerDeps: true,

packageLock: true,

quiet: true,

}),

},

);

if (install.code !== 0) {

"npm",

"uninstall",

"--loglevel=error",

"--legacy-peer-deps",

"--ignore-scripts",

"--no-audit",

"--no-fund",

timeoutMs: 300_000,

env: expect.objectContaining({

NPM_CONFIG_IGNORE_SCRIPTS: "true",

npm_config_legacy_peer_deps: "true",

npm_config_package_lock: "true",

}),

}),

)}\n`,

);

await fs.symlink(tempDir, peerLink, "junction");

runCommandWithTimeoutMock.mockImplementationOnce(async () => {

runCommandWithTimeoutMock.mockImplementationOnce(async (argv: string[]) => {

await fs.rm(peerLink, { recursive: true, force: true });

if (!argv.includes("--legacy-peer-deps")) {

await fs.mkdir(path.join(npmRoot, "node_modules", "openclaw"), { recursive: true });

}

return {

code: 0,

stdout: "",

expect(applied).toEqual({ directoryRemoved: true, warnings: [] });

await expect(fs.access(removedPluginDir)).rejects.toThrow();

await expect(fs.access(path.join(npmRoot, "node_modules", "openclaw"))).rejects.toThrow();

await expect(fs.lstat(peerLink).then((stat) => stat.isSymbolicLink())).resolves.toBe(true);

});

"npm",

"uninstall",

"--loglevel=error",

"--legacy-peer-deps",

"--ignore-scripts",

"--no-audit",

"--no-fund",

{

cwd: removal.cleanup.npmRoot,

timeoutMs: 300_000,

env: createSafeNpmInstallEnv(process.env, { packageLock: true, quiet: true }),

env: createSafeNpmInstallEnv(process.env, {

legacyPeerDeps: true,

packageLock: true,

quiet: true,

}),

},

);

if (uninstall.code !== 0) {