fix(update): preserve scoped package roots

kevinslin · kevinslin · commit 3c34c5af20f8 · 2026-07-03T22:52:23.000-07:00
diff --git a/src/cli/update-cli/update-command.ts b/src/cli/update-cli/update-command.ts
@@ -3584,6 +3584,7 @@ async function updateCommandInternal(opts: UpdateCommandOptions): Promise<void>
   let packageInstallEnv: NodeJS.ProcessEnv | undefined;
   let packageInstallCwd: string | undefined;
   let packageInstallTarget: ResolvedGlobalInstallTarget | undefined;
+  let installedPackageName = DEFAULT_PACKAGE_NAME;
   let packageAlreadyCurrent = false;
   let managedServiceRootRedirect: ManagedServiceRootRedirect | null = null;
   // Resolved independently of the root redirect so it covers the common case
@@ -3641,6 +3642,7 @@ async function updateCommandInternal(opts: UpdateCommandOptions): Promise<void>
     packageInstallEnv = await createGlobalInstallEnv();
     packageInstallCwd = tryResolveInvocationCwd();
     if (updateInstallKind === "package") {
+      installedPackageName = (await readPackageName(root)) ?? DEFAULT_PACKAGE_NAME;
       const manager = await resolveGlobalManager({
         root,
         installKind,
@@ -3653,18 +3655,17 @@ async function updateCommandInternal(opts: UpdateCommandOptions): Promise<void>
         pkgRoot: root,
         honorPackageRoot:
           managedServiceRootRedirect !== null || managedServiceNodeRunner !== undefined,
+        packageName: installedPackageName,
       });
     }
     const npmMetadataCommand =
       packageInstallTarget?.manager === "npm" ? packageInstallTarget.command : undefined;
     currentVersion = switchToPackage ? null : await readPackageVersion(root);
     if (channel === "extended-stable") {
-      const packageName =
-        (await readPackageName(packageInstallTarget?.packageRoot ?? root)) ?? DEFAULT_PACKAGE_NAME;
       const extendedStable = await resolveExtendedStablePackage({
         installKind: updateInstallKind,
         timeoutMs,
-        packageName,
+        packageName: installedPackageName,
       });
       if (extendedStable.status === "failed") {
         await reportPreMutationUpdateFailure({
diff --git a/src/infra/update-global.test.ts b/src/infra/update-global.test.ts
@@ -133,6 +133,28 @@ describe("update global helpers", () => {
     );
   });
 
+  it("resolves scoped package paths from the package manager global root", async () => {
+    const globalRoot = path.join("tmp", "npm-root");
+    const runCommand: CommandRunner = async () => ({
+      stdout: `${globalRoot}\n`,
+      stderr: "",
+      code: 0,
+    });
+
+    await expect(
+      resolveGlobalInstallTarget({
+        manager: "npm",
+        runCommand,
+        timeoutMs: 1000,
+        packageName: "@kevins8/openclaw",
+      }),
+    ).resolves.toMatchObject({
+      manager: "npm",
+      globalRoot,
+      packageRoot: path.join(globalRoot, "@kevins8", "openclaw"),
+    });
+  });
+
   it("maps main and explicit install specs for global installs", () => {
     expect(resolveGlobalInstallSpec({ packageName: "openclaw", tag: "main" })).toBe(
       OPENCLAW_MAIN_PACKAGE_SPEC,
diff --git a/src/infra/update-global.ts b/src/infra/update-global.ts
@@ -599,6 +599,22 @@ function inferGlobalRootFromPackageRoot(pkgRoot?: string | null): string | null
   return path.basename(globalRoot) === "node_modules" ? globalRoot : null;
 }
 
+function resolvePackageRootFromGlobalRoot(params: {
+  globalRoot: string;
+  packageName?: string;
+}): string {
+  const packageName = params.packageName?.trim() || PRIMARY_PACKAGE_NAME;
+  const parts = packageName.split("/");
+  const hasSafeSegments =
+    parts.length > 0 &&
+    parts.length <= 2 &&
+    parts.every(
+      (part) => part.length > 0 && part !== "." && part !== ".." && !part.includes("\\"),
+    ) &&
+    (parts.length === 1 || parts[0]?.startsWith("@"));
+  return path.join(params.globalRoot, ...(hasSafeSegments ? parts : [PRIMARY_PACKAGE_NAME]));
+}
+
 function isDirectNpmNodeModulesRoot(globalRoot: string | null): boolean {
   return (
     globalRoot !== null &&
@@ -753,6 +769,7 @@ export async function resolveGlobalInstallTarget(params: {
   timeoutMs: number;
   pkgRoot?: string | null;
   honorPackageRoot?: boolean;
+  packageName?: string;
 }): Promise<ResolvedGlobalInstallTarget> {
   const honoredPackageRootGlobalRoot = params.honorPackageRoot
     ? inferGlobalRootFromPackageRoot(params.pkgRoot)
@@ -787,7 +804,12 @@ export async function resolveGlobalInstallTarget(params: {
   return {
     ...command,
     globalRoot: targetGlobalRoot,
-    packageRoot: targetGlobalRoot ? path.join(targetGlobalRoot, PRIMARY_PACKAGE_NAME) : null,
+    packageRoot: targetGlobalRoot
+      ? resolvePackageRootFromGlobalRoot({
+          globalRoot: targetGlobalRoot,
+          packageName: params.packageName,
+        })
+      : null,
     ...(honoredPackageRootGlobalRoot &&
     targetGlobalRoot === honoredPackageRootGlobalRoot &&
     honoredDirectNpmRoot
diff --git a/src/infra/update-runner.ts b/src/infra/update-runner.ts
@@ -1681,13 +1681,14 @@ export async function runGatewayUpdate(opts: UpdateRunnerOptions = {}): Promise<
         durationMs: Date.now() - startedAt,
       };
     }
+    const packageName = (await readPackageName(pkgRoot)) ?? DEFAULT_PACKAGE_NAME;
     const installTarget = await resolveGlobalInstallTarget({
       manager: globalManager,
       runCommand,
       timeoutMs,
       pkgRoot,
+      packageName,
     });
-    const packageName = (await readPackageName(pkgRoot)) ?? DEFAULT_PACKAGE_NAME;
     await cleanupGlobalRenameDirs({
       globalRoot: path.dirname(pkgRoot),
       packageName,
