fix(plugins): make managed downgrade guard ENOENT-safe and stop leaking stale resolution

alkor2000 · alkor2000 · commit 9758a00590c7 · 2026-05-27T16:42:33.000+08:00
Addresses ClawSweeper [P1]/[P2] on #85305. [P1] readManagedNpmRootInstalledDependency read package-lock.json with the strict readJson, so a fresh managed npm root (no lockfile yet) threw instead of returning null. The downgrade guard reads installed metadata before npm install creates the lockfile, so a fresh plugin install crashed. Switch to the ENOENT-safe readJsonIfExists (already used elsewhere in this file for the same lockfile), so a missing lockfile yields null (no installed dependency). [P2] When the guard preserved a newer installed dependency, the returned expectedNpmResolution spread the older incoming resolution and only overwrote version/integrity, leaving stale resolvedSpec/shasum/resolvedAt from the rejected downgrade target. Construct a clean resolution carrying only the kept version's name/version/integrity so persisted install records do not mix metadata. Tests: fresh-root reader test (returns null without a lockfile) and a preserved-resolution assertion (no stale shasum/resolvedSpec).
diff --git a/src/infra/npm-managed-root.test.ts b/src/infra/npm-managed-root.test.ts
@@ -373,6 +373,21 @@ describe("managed npm root", () => {
     });
   });
 
+  it("returns null for a fresh managed root without a package-lock.json", async () => {
+    // #85184 P1: the downgrade guard reads installed dependency metadata before
+    // npm install creates package-lock.json. A fresh managed root has no
+    // lockfile yet, so the reader must return null instead of throwing -
+    // otherwise a fresh plugin install crashes before npm can create the
+    // lockfile (regression caught by the downgrade guard's pre-install read).
+    const npmRoot = await makeTempRoot();
+    await expect(
+      readManagedNpmRootInstalledDependency({
+        npmRoot,
+        packageName: "@openclaw/discord",
+      }),
+    ).resolves.toBeNull();
+  });
+
   it("syncs managed peer dependencies from npm's resolved lockfile plan", async () => {
     const npmRoot = await makeTempRoot();
     await fs.writeFile(
diff --git a/src/infra/npm-managed-root.ts b/src/infra/npm-managed-root.ts
@@ -1002,7 +1002,10 @@ export async function readManagedNpmRootInstalledDependency(params: {
   packageName: string;
 }): Promise<ManagedNpmRootInstalledDependency | null> {
   const lockPath = path.join(params.npmRoot, "package-lock.json");
-  const parsed = await readJson<unknown>(lockPath);
+  // A fresh managed npm root has no package-lock.json yet (npm install creates
+  // it). Use the ENOENT-safe reader so a missing lockfile yields null (no
+  // installed dependency) instead of throwing and breaking fresh installs.
+  const parsed = await readJsonIfExists<unknown>(lockPath);
   if (!isRecord(parsed) || !isRecord(parsed.packages)) {
     return null;
   }
diff --git a/src/plugins/install.test.ts b/src/plugins/install.test.ts
@@ -786,6 +786,13 @@ describe("installPluginFromNpmSpec downgrade guard (#85184 integration)", () =>
     // downstream install records/config match the managed npm root.
     if (result.ok) {
       expect(result.npmResolution?.version).toBe("0.11.2");
+      // P2: the preserved resolution must not carry stale metadata from the
+      // rejected downgrade target (incoming 0.10.0 reported shasum "abc" and a
+      // 0.10.0 integrity). Only kept-version fields should survive, so install
+      // records do not mix the kept version with the downgrade target's hashes.
+      expect(result.npmResolution?.shasum).toBeUndefined();
+      expect(result.npmResolution?.resolvedSpec).toBeUndefined();
+      expect(result.npmResolution?.integrity).not.toBe("sha512-0.10.0");
     }
   });
 
diff --git a/src/plugins/install.ts b/src/plugins/install.ts
@@ -916,12 +916,15 @@ async function installPluginFromManagedNpmRoot(
   // install and trigger a rollback that would remove the plugin.
   const expectedNpmResolution: NpmSpecResolution =
     preserveAgainstDowngrade && installedDependency?.version
-      ? {
-          ...params.npmResolution,
+      ? // Describe the preserved (kept) dependency, not the older incoming
+        // resolution. Only carry fields we can attribute to the kept version
+        // (name/version/integrity from the managed root); leave incoming-only
+        // fields (resolvedSpec/shasum/resolvedAt) unset so persisted install
+        // records do not mix stale metadata from the rejected downgrade target.
+        {
+          name: params.npmResolution.name ?? params.packageName,
           version: installedDependency.version,
-          ...(installedDependency.integrity
-            ? { integrity: installedDependency.integrity }
-            : { integrity: undefined }),
+          integrity: installedDependency.integrity,
         }
       : params.npmResolution;
   const resolutionMismatch = resolveInstalledNpmResolutionMismatch({
