chore(catalog): bump Weixin plugin to 2.4.6

[lin-hongkuan]

What Problem This Solves

Fixes #96791. The official external channel catalog still pinned @tencent-weixin/openclaw-weixin to 2.4.3, so installs and upgrade reconciliation would keep users on the older Weixin plugin even though the package has published 2.4.6.

Why This Change Was Made

The catalog entry is the source used by OpenClaw's official external channel install flow. Updating npmSpec, expectedIntegrity, and the catalog minHostVersion keeps the install metadata aligned with the published npm package so host compatibility checks do not accept a package version that declares a newer floor.

User Impact

Users installing or reconciling the official Weixin channel plugin get @tencent-weixin/openclaw-weixin@2.4.6 with its matching integrity and host floor instead of being forced back to 2.4.3 or seeing catalog/package compatibility drift.

Evidence

Head commit: 3f163c4666a0c13adefeebe85b9cfe371afc5b69.

Verified npm metadata with npm view @tencent-weixin/openclaw-weixin@2.4.6 version dist.integrity openclaw.install.minHostVersion peerDependencies.openclaw --json:

{
  "version": "2.4.6",
  "dist.integrity": "sha512-qw9k3PLTiMWGNjjsknHgcTManH1w4j+Ji1ArWIaYLKCq3aFRsVwcqnPi127bvOoVMJGW4dbyJ8NECEMgoO+iRw==",
  "openclaw.install.minHostVersion": ">=2026.5.12",
  "peerDependencies.openclaw": ">=2026.5.12"
}

Verified the repo's official catalog loader and install-plan trust path with pnpm exec tsx -e '<listChannelPluginCatalogEntries + resolveOfficialExternalNpmPackageTrust proof>'. The proof confirmed:

{
  "proof": "official catalog install path resolves Weixin 2.4.6 with npm trust metadata",
  "npmSpec": "@tencent-weixin/openclaw-weixin@2.4.6",
  "minHostVersion": ">=2026.5.12",
  "expectedIntegrity": "sha512-qw9k3PLTiMWGNjjsknHgcTManH1w4j+Ji1ArWIaYLKCq3aFRsVwcqnPi127bvOoVMJGW4dbyJ8NECEMgoO+iRw==",
  "trustedSourceLinkedOfficialInstall": true,
  "warnings": []
}

Verified the real isolated install path with pnpm openclaw plugins install openclaw-weixin against a clean proof root. The installer selected and installed the exact package:

Installing @tencent-weixin/openclaw-weixin@2.4.6 into <proof-root>/state/npm/projects/tencent-weixin-openclaw-weixin-7783ac86ba...
Installed plugin: openclaw-weixin

The generated package lock in the isolated proof root confirmed the resolved tarball and integrity:

{
  "version": "2.4.6",
  "resolved": "https://registry.npmjs.org/@tencent-weixin/openclaw-weixin/-/openclaw-weixin-2.4.6.tgz",
  "integrity": "sha512-qw9k3PLTiMWGNjjsknHgcTManH1w4j+Ji1ArWIaYLKCq3aFRsVwcqnPi127bvOoVMJGW4dbyJ8NECEMgoO+iRw=="
}

Validation:

• node scripts/run-vitest.mjs run src/plugins/official-external-plugin-catalog.test.ts test/official-channel-catalog.test.ts test/release-check.test.ts passed.
• pnpm tsgo:core passed.
• git diff --check origin/main...HEAD passed.

[clawsweeper]

Codex review: found issues before merge. Reviewed June 26, 2026, 8:07 PM ET / 00:07 UTC.

Summary
The branch updates scripts/lib/official-external-channel-catalog.json so the official Weixin channel catalog installs @tencent-weixin/openclaw-weixin@2.4.6 with matching integrity and a >=2026.5.12 host floor.

PR surface: Other 0. Total 0 across 1 file.

Reproducibility: yes. source-level: current main and v2026.6.10 still pin the Weixin official catalog entry to 2.4.3, while PR head targets published package 2.4.6 with matching npm metadata. I did not run a full packaged core-upgrade reconciliation scenario in this read-only review.

Review metrics: 1 noteworthy metric.

• Official catalog install metadata: 3 fields changed. The package target, integrity pin, and host floor are trusted by install and official-sync paths before loading the external Weixin plugin.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #96791
Summary: This PR is the live candidate fix for the open official Weixin catalog pin issue; the same-version sibling PR is closed and weaker, while startup and update reports remain adjacent but distinct.

Members:

• canonical: Update official-external-plugin-catalog: bump @tencent-weixin/openclaw-weixin to 2.4.6 #96791 - The PR body uses closing syntax for this open issue, and the issue reports the same official Weixin catalog pin and reconciliation problem.
• superseded: fix: bump @tencent-weixin/openclaw-weixin to 2.4.6 in catalog #96807 - The closed sibling proposed the same 2.4.6 bump but lacked this PR's host-floor alignment and proof.
• partial_overlap: openclaw-weixin plugin v2.4.4 + OpenClaw 2026.6.1: Channel shows OFF / not configured, startAccount never called #91129 - The open Weixin startup report affects confidence in choosing a Weixin release target, but it is not the same catalog-pin problem.
• partial_overlap: [Bug]: plugins update --dryrun reports "up to date" while npm dist-tags.latest is newer #92183 - The plugin update dry-run issue overlaps with plugin update/version policy, while this PR only updates one official catalog target.
• partial_overlap: fix(weixin): startAccount preserves session routing #93686 - The merged startup/session routing PR provides adjacent Weixin startup context but does not implement this catalog bump.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Update or split the WeChat compatibility docs if 2.4.6 remains the accepted target.
• Get maintainer or Weixin-owner acceptance that 2.4.6 is the official trusted target.

Risk before merge

• [P1] Merging changes trusted official install and reconciliation metadata for Weixin, so existing official installs can move from 2.4.3 to 2.4.6 and require OpenClaw >=2026.5.12.
• [P1] The public WeChat compatibility docs still advertise the 2.x/latest plugin line as compatible with OpenClaw >=2026.3.22, which would be stale after this PR lands unchanged.
• [P1] The supplied proof covers catalog selection and lockfile integrity, but not live Weixin 2.4.6 startup or a packaged core-upgrade reconciliation scenario; openclaw-weixin plugin v2.4.4 + OpenClaw 2026.6.1: Channel shows OFF / not configured, startAccount never called #91129 remains adjacent startup context.

Maintainer options:

1. Accept 2.4.6 And Align Docs (recommended)
   A maintainer or Weixin owner can accept the new trusted artifact and host floor, then update the WeChat compatibility docs before merge.
2. Require Startup Or Upgrade Proof
   Hold the PR until someone demonstrates Weixin 2.4.6 starting through the Gateway or a packaged core-upgrade reconciliation path.
3. Wait For Another Weixin Release
   If 2.4.6 is not the desired official target, keep the catalog pinned and pause or close this PR until a verified newer package is available.

Next step before merge

• [P2] Manual review is needed because the selected official Weixin target and the docs/compatibility contract require maintainer acceptance before merge.

Security
Cleared: No concrete security or supply-chain regression was found in the metadata-only diff; npm registry metadata matches the proposed integrity and shows no install lifecycle hook.

Review findings

• [P2] Update the WeChat compatibility docs — scripts/lib/official-external-channel-catalog.json:120

Review details

Best possible solution:

Land the catalog bump only after maintainers accept 2.4.6 as the official target and the WeChat compatibility docs match the accepted host floor.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level: current main and v2026.6.10 still pin the Weixin official catalog entry to 2.4.3, while PR head targets published package 2.4.6 with matching npm metadata. I did not run a full packaged core-upgrade reconciliation scenario in this read-only review.

Is this the best way to solve the issue?

Yes for the code boundary: the official external channel catalog is the narrow place to update the trusted package target, integrity, and host floor. It is not merge-complete until maintainers accept that target and the compatibility docs match the new floor.

Full review comments:

• [P2] Update the WeChat compatibility docs — scripts/lib/official-external-channel-catalog.json:120
  This raises the official Weixin catalog floor to >=2026.5.12, but docs/channels/wechat.md still tells users the 2.x/latest line works on >=2026.3.22. After this lands, users on older 2.x-compatible hosts would follow stale compatibility guidance, so please update or split that table with the accepted 2.4.6 floor.
  Confidence: 0.88

Overall correctness: patch is incorrect
Overall confidence: 0.87

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ff35f3bb2cd6.

Label changes

Label justifications:

• P2: This is a bounded official plugin catalog update with real install and upgrade impact but limited surface area.
• merge-risk: 🚨 compatibility: The diff can move trusted official Weixin installs and upgrade reconciliation from 2.4.3 to a new external artifact with a higher host floor.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (terminal): The PR body includes terminal proof from a clean proof root showing the official catalog install path selecting Weixin 2.4.6 and a lockfile with the matching tarball and integrity.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal proof from a clean proof root showing the official catalog install path selecting Weixin 2.4.6 and a lockfile with the matching tarball and integrity.

Evidence reviewed

PR surface:

Other 0. Total 0 across 1 file.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	0	0	0	0
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	1	3	3	0
Total	1	3	3	0

What I checked:

• Repository policy read: Root AGENTS.md was read fully and applied because it treats plugin catalog/default/upgrade surfaces as compatibility-sensitive review areas. (AGENTS.md:25, ff35f3bb2cd6)
• Scoped scripts policy read: scripts/AGENTS.md was read fully; the touched catalog source is under the scripts tooling scope. (scripts/AGENTS.md:1, ff35f3bb2cd6)
• Current main catalog baseline: Current main still pins the official external Weixin catalog entry to 2.4.3 with the old integrity and >=2026.3.22 host floor. (scripts/lib/official-external-channel-catalog.json:117, ff35f3bb2cd6)
• PR head catalog change: The PR diff changes Weixin npmSpec, expectedIntegrity, and minHostVersion to the 2.4.6 package metadata. (scripts/lib/official-external-channel-catalog.json:117, 4e6b5af416c3)
• Latest release baseline: The latest release tag v2026.6.10 still ships the Weixin 2.4.3 catalog pin, so this PR is not redundant with shipped behavior. (scripts/lib/official-external-channel-catalog.json:117, aa69b12d0086)
• Dependency metadata check: Registry metadata for @tencent-weixin/openclaw-weixin@2.4.6 reports the same integrity as the PR, openclaw.install.minHostVersion: >=2026.5.12, peerDependencies.openclaw: >=2026.5.12, and no install-time lifecycle hook.

Likely related people:

• scotthuang: Authored the merged PR that moved the official Weixin catalog target and integrity to the current 2.4.3 pin. (role: recent Weixin catalog contributor; confidence: high; commits: c35634c7298b; files: scripts/lib/official-external-channel-catalog.json)
• pumpkinxing1: Authored the merged install-records/channel catalog work that added official external Weixin catalog metadata to this source path. (role: introduced catalog/install metadata behavior; confidence: high; commits: 5fae1c32b5f8; files: scripts/lib/official-external-channel-catalog.json, src/plugins/channel-catalog-registry.ts)
• vincentkoc: Authored official plugin install sync behavior that makes catalog targets affect post-core upgrade reconciliation, and is currently assigned on this PR. (role: official plugin sync contributor; confidence: high; commits: 2014c2327b20; files: src/plugins/update.ts, src/cli/update-cli/update-command.ts)
• zhuisDEV: Authored merged official npm install record pinning work in the update/install surface where exact pins and official sync interact. (role: adjacent exact-pin/update contributor; confidence: medium; commits: 7b5f75eb98f4; files: src/plugins/update.ts, src/plugins/update.test.ts, src/cli/plugins-cli.update.test.ts)
• velvet-shark: Authored the recent update-all official sync change that makes trusted official catalog targets consequential for bulk plugin reconciliation. (role: recent adjacent sync contributor; confidence: medium; commits: 0247eab77335; files: src/plugins/update.ts, src/cli/plugins-cli.update.test.ts, docs/cli/plugins.md)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[lin-hongkuan]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[lin-hongkuan]

@clawsweeper re-review

[vincentkoc]

Merged via squash.

• Prepared head SHA: 4e6b5af416c305ae7684dc3246acf80dc1f1cbce
• Landed commit: 12ea61a08dbc97a6b54aad0a59c3d20fd4d0b728