Walkthrough

The PR updates messaging plugin installation logic to enforce explicit, version-pinned npm installs for external channels. Plugin install specs are now formatted with an npm: prefix, and the --pin argument is explicitly passed during installation. Tests are updated to match the new spec format and validate pinning behavior.

Changes

Messaging Plugin Install Pinning

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#4340: WeChat E2E test assertions verify that the resulting plugin install metadata is pinned from npm, so test expectations are coupled to the same npm: spec and pinning behavior.

Suggested labels

Integration: OpenClaw, fix, dependencies

Suggested reviewers

• jyaunches
• cv

Poem

🐰 With npm: prefix and --pin so true,
External plugins now know what to do,
No drifting versions or pins left unclear,
Bundled stability reigns here!

❌ Failed checks (1 warning)

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

🛠️ Needs attention

• None.

🔎 Worth checking

• Source-of-truth review needed: Build-time OpenClaw messaging plugin installation: The advisor marked localized patch analysis as needs_followup.
  • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Evidence: scripts/openclaw-build-messaging-plugins.py changes the install spec and flag; test/openclaw-build-messaging-plugins.test.ts asserts the new argv against fake openclaw binaries.
• Real OpenClaw install contract for npm: specs is unverified (scripts/openclaw-build-messaging-plugins.py:141): This PR changes a build-time supply-chain control from bare @openclaw package specs to npm:@openclaw/<plugin>@<OPENCLAW_VERSION> plus --pin. The package names are allowlisted and subprocess invocation is argv-based, which is good, but the changed behavior depends on how the real OpenClaw CLI parses, resolves, and records npm: plugin specs. The updated tests use fake openclaw binaries that assert NemoClaw passed the desired argv; they do not prove that the real installer accepts this form or that --pin records the exact runtime-compatible plugin version.
  • Recommendation: Add or identify a targeted runtime/contract validation for `openclaw plugins install npm:@openclaw/<plugin>@<version> --pin` that confirms the real OpenClaw CLI installs/records the exact requested plugin version, or document/link the OpenClaw CLI contract in the script/tests so this supply-chain assumption is reviewable.
  • Evidence: scripts/openclaw-build-messaging-plugins.py now calls `run_command(["openclaw", "plugins", "install", spec, "--pin"])`; test/openclaw-build-messaging-plugins.test.ts uses fake openclaw scripts that only check argv such as `args[2] !== "npm:@openclaw/discord@2026.5.22"` and `args[3] !== "--pin"`.

🌱 Nice ideas

• None.

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• messaging-providers-e2e (high): Best existing end-to-end coverage for this change: builds/onboards an OpenClaw sandbox with token-backed messaging channels and validates provider attachment, placeholder rewrite, sanitized credentials, OpenClaw channel/plugin activation, and WhatsApp QR-only policy/config behavior. This directly exercises the build-time messaging plugin installer changed in this PR.

Optional E2E

• ubuntu-repo-cloud-openclaw-discord (medium): Typed scenario coverage for the OpenClaw Discord onboarding path; useful if maintainers want an additional scenario-registry validation of external plugin activation beyond the broader messaging-providers job.
• ubuntu-repo-cloud-openclaw-slack (medium): Typed scenario coverage for the OpenClaw Slack onboarding path; useful adjacent confidence for the npm: install spec and --pin behavior on another external messaging package.
• openclaw-discord-pairing-e2e (high): Hermetic Discord pairing flow that depends on a working Discord OpenClaw plugin install and shared OpenClaw state; good regression confidence if the install CLI syntax is suspected to affect runtime plugin state.
• openclaw-slack-pairing-e2e (high): Hermetic Slack Socket Mode pairing flow that depends on a working Slack OpenClaw plugin install; useful adjacent validation for the same external plugin install path.

New E2E recommendations

• None.

Dispatch hint

• Workflow: nightly-e2e.yaml
• jobs input: messaging-providers-e2e

E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required scenario E2E

• ubuntu-repo-cloud-openclaw-discord: Changed OpenClaw messaging plugin build/install helper; Discord is an external OpenClaw messaging plugin path affected by npm: spec formatting and --pin install behavior.
  • Dispatch: gh workflow run e2e-scenarios.yaml --ref <pr-head-ref> --field scenarios=ubuntu-repo-cloud-openclaw-discord
• ubuntu-repo-cloud-openclaw-slack: Changed OpenClaw messaging plugin build/install helper; Slack is an external OpenClaw messaging plugin path affected by npm: spec formatting and --pin install behavior.
  • Dispatch: gh workflow run e2e-scenarios.yaml --ref <pr-head-ref> --field scenarios=ubuntu-repo-cloud-openclaw-slack

Optional scenario E2E

• None.

Relevant changed files

• scripts/openclaw-build-messaging-plugins.py