Skip to content

fix(plugins): prevent openclaw update from silently downgrading managed deps#85305

Closed
alkor2000 wants to merge 4 commits into
openclaw:mainfrom
alkor2000:fix-85184-managed-npm-no-silent-downgrade
Closed

fix(plugins): prevent openclaw update from silently downgrading managed deps#85305
alkor2000 wants to merge 4 commits into
openclaw:mainfrom
alkor2000:fix-85184-managed-npm-no-silent-downgrade

Conversation

@alkor2000

@alkor2000 alkor2000 commented May 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Fixes #85184. Prevents openclaw update from silently downgrading a newer already-installed managed direct dependency, and verifies the preserved version through the full install path so the intentional skip does not trigger a rollback.

What changed

  • Add a narrow downgrade guard in installPluginFromManagedNpmRoot: during update, if the incoming version is older than the version already recorded in the managed npm root, keep the installed version instead of overwriting it.
  • Verify the post-install result against the preserved version (not the older incoming resolution) when the guard fires, so the kept dependency is not misread as a failed install and rolled back.
  • Scope is intentionally narrow: only the unambiguous downgrade case during update. Non-downgrade pin rewrites and the broader respect-all-pins policy are left to maintainer decision.

Real behavior proof

Behavior or issue addressed: openclaw update re-synced externalized bundled-plugin direct dependencies through installPluginFromManagedNpmRoot, which overwrote the managed npm root dependency and could silently downgrade a newer pinned/installed version. An earlier guard alone was insufficient: the post-install verification still compared the on-disk version against the older incoming resolution, so a preserved newer dependency was rolled back. This change guards the downgrade and aligns the verification with the preserved version.

Real environment tested: Linux (Ubuntu 24.04, WSL2), Node.js 24.14.0, current PR head. Exercised the full installPluginFromNpmSpec update path with vitest, plus focused unit tests for the predicate.

Exact steps or command run after this patch: ran the plugin install/update test suite under the real runtime via vitest.

Evidence after fix: stdout from the test run against the real runtime:

$ node scripts/run-vitest.mjs src/plugins/install.test.ts
  install.test.ts (120 tests)
  shouldPreserveManagedDependencyAgainstDowngrade
    + preserves a newer installed dependency when update would downgrade it
    + catches patch-level downgrades / allows upgrade / allows same version / etc.
  installPluginFromNpmSpec downgrade guard (integration)
    + preserves a newer installed managed dependency without rollback during update
    + allows a normal upgrade to rewrite the managed dependency (no false preserve)
  Test Files  1 passed (1)
  Tests  120 passed (120)

$ node scripts/run-vitest.mjs src/plugins/update.test.ts src/infra/npm-managed-root.test.ts src/cli/update-cli.test.ts
  Test Files  3 passed (3)
  Tests  211 passed (211)

Observed result after fix: The integration test drives the full installPluginFromNpmSpec update path. With an installed 0.11.2 and an update resolving 0.10.0, the run completes successfully (no rollback) and the managed package.json keeps 0.11.2. A normal upgrade (installed 0.11.0, update 0.11.2) still rewrites to the newer version. All managed-root and update-cli acceptance suites pass unchanged.

What was not tested: A live mutating openclaw update --tag against a real registry was not run; the install/update path is exercised end to end with vitest using the real runtime and a mocked npm transport, matching the source-level reproduction in the issue.

Follow-up: addressed ClawSweeper [P1]/[P2] (commit 9758a00)

[P1] Fresh-install crash — ENOENT-safe lockfile read

readManagedNpmRootInstalledDependency read package-lock.json with the strict
readJson, which throws on a missing file. The downgrade guard calls it before
npm install creates the lockfile, so a fresh managed root (no lockfile yet)
threw instead of returning null, crashing a fresh plugin install. Fixed by using
readJsonIfExists — already used a few lines above in the same file for the same
lockfile — so a missing lockfile yields null (no installed dependency).

Real environment tested: Linux (Ubuntu 24.04, WSL2), Node.js 24.14.0, PR head 9758a00.

Command: node scripts/run-vitest.mjs run src/infra/npm-managed-root.test.ts -t "fresh managed root"

Before (strict readJson, the pre-fix state): the fresh-root reader test fails — the reader throws on the absent lockfile:
× returns null for a fresh managed root without a package-lock.json
AssertionError: promise rejected "JsonFileReadError: Failed to read JSON fi…" instead of resolving
Caused by: JsonFileReadError: Failed to read JSON file: /tmp/openclaw-npm-managed-root-XXXX/package-lock.json
❯ readManagedNpmRootInstalledDependency src/infra/npm-managed-root.ts:1005
Caused by: Error: File not found: .../package-lock.json
Serialized Error: { code: 'ENOENT' }
Tests 1 failed | 18 skipped (19)

After (readJsonIfExists, this PR):
✓ returns null for a fresh managed root without a package-lock.json
Tests 1 passed | 18 skipped (19)

[P2] Preserved resolution no longer leaks stale downgrade-target metadata

When the guard preserved a newer installed dependency, expectedNpmResolution
spread the older incoming resolution and only overwrote version/integrity,
leaving stale resolvedSpec/shasum/resolvedAt from the rejected downgrade
target, which then persisted into install records. Fixed by constructing a clean
resolution carrying only the kept version's name/version/integrity.

Command: node scripts/run-vitest.mjs run src/plugins/install.test.ts -t "preserves a newer installed managed dependency without rollback"

Before (spread incoming, the pre-fix state): the integration test fails — the
rejected downgrade target's shasum: "abc" leaks into the preserved resolution:
× preserves a newer installed managed dependency without rollback during update (#85184)
AssertionError: expected 'abc' to be undefined
793| expect(result.npmResolution?.shasum).toBeUndefined();
Tests 1 failed | 120 skipped (121)

After (clean construction, this PR):
✓ preserves a newer installed managed dependency without rollback during update (#85184)
Tests 1 passed | 120 skipped (121)

Full suites (PR head 9758a00)

$ node scripts/run-vitest.mjs run src/plugins/install.test.ts src/infra/npm-managed-root.test.ts
Test Files 2 passed (2)
Tests 140 passed (140)

What was not tested: A live mutating openclaw update --tag against a real
registry was not run (offline environment). The fresh-install crash and the
stale-metadata leak are both reproduced and verified as focused before/after
unit/integration tests against the real runtime, matching the source-level
findings.

@openclaw-barnacle openclaw-barnacle Bot added size: S proof: supplied External PR includes structured after-fix real behavior proof. labels May 22, 2026
@clawsweeper

clawsweeper Bot commented May 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed May 27, 2026, 4:54 AM ET / 08:54 UTC.

Summary
The PR adds a managed npm downgrade guard during openclaw update, returns preserved dependency metadata, and adds install/managed-root regression tests.

PR surface: Source +77, Tests +201. Total +278 across 4 files.

Reproducibility: yes. at source level: current main unconditionally upserts the managed dependency spec before npm install, and the linked report gives a concrete update path where that rewrites a newer installed direct dependency to an older bundled version. I did not run a mutating live update in this read-only review.

Review metrics: 1 noteworthy metric.

  • Managed update policy: 1 update-path dependency policy changed. The PR changes how managed direct dependencies are reconciled during update, which matters for upgrades even though it adds no new config key.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Add redacted live openclaw update --tag or packaged update proof that shows the newer managed dependency remains installed without rollback.
  • Refresh the branch or rerun checks so check-prod-types and build-artifacts are green or clearly unrelated.

Proof guidance:
Needs real behavior proof before merge: The PR body provides terminal Vitest output, but it uses mocked npm transport and explicitly says no live mutating openclaw update --tag was run; before merge, add redacted terminal/log/recording proof from a real update path, then update the PR body to trigger re-review or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

  • The PR changes managed npm update reconciliation, so maintainers should explicitly accept that a target release may preserve a newer installed managed dependency instead of restoring the release's bundled version.
  • The submitted proof is still mock-only for the actual user flow; there is no redacted terminal/log/recording proof from a live openclaw update --tag or packaged update lane against a real registry.
  • The PR head currently has failing check-prod-types and build-artifacts checks, so merge needs a check refresh or maintainer confirmation that the failures are unrelated.

Maintainer options:

  1. Require live update proof (recommended)
    Ask for redacted terminal output, logs, or a recording from a real openclaw update --tag or packaged update lane that starts with a newer managed dependency and proves it is preserved without rollback.
  2. Accept focused test proof
    Maintainers can intentionally accept the mocked full install-path tests as enough for this narrow guard, while owning the missing live registry coverage.
  3. Refresh checks before landing
    Rebase or rerun the branch so check-prod-types and build-artifacts are green or clearly unrelated before merge.

Next step before merge
Code repair findings appear addressed; remaining action is contributor or maintainer live-update proof plus check refresh, which is not a safe automated repair task.

Security
Cleared: No concrete security or supply-chain regression was found; the diff changes existing managed npm install logic and tests without adding dependencies, lockfiles, workflows, permissions, or secret handling.

Review details

Best possible solution:

Land the narrow downgrade guard after live update proof and clean required checks, leaving the broader respect-all-pins policy to a separate maintainer decision.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: current main unconditionally upserts the managed dependency spec before npm install, and the linked report gives a concrete update path where that rewrites a newer installed direct dependency to an older bundled version. I did not run a mutating live update in this read-only review.

Is this the best way to solve the issue?

Yes for the narrow no-silent-downgrade case: the PR guards only comparable update downgrades, verifies against the preserved version, and returns matching metadata. The remaining gap is proof, not a different code shape; broader pin-respect policy should stay separate.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 527b7c2eed2f.

Label changes

Label justifications:

  • P1: This fixes a user-facing update bug that can silently rewrite managed dependency pins and downgrade installed plugin code.
  • merge-risk: 🚨 compatibility: Merging changes the compatibility-sensitive managed dependency outcome during openclaw update by preserving newer installed versions instead of always applying the bundled target.
  • merge-risk: 🚨 availability: The touched install/update path can roll back or leave plugins unavailable if the preserved-version path is wrong in a real update environment.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides terminal Vitest output, but it uses mocked npm transport and explicitly says no live mutating openclaw update --tag was run; before merge, add redacted terminal/log/recording proof from a real update path, then update the PR body to trigger re-review or ask a maintainer to comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +77, Tests +201. Total +278 across 4 files.

View PR surface stats
Area Files Added Removed Net
Source 2 90 13 +77
Tests 2 201 0 +201
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 4 291 13 +278

What I checked:

  • Repository policy read and applied: The full root AGENTS.md and scoped src/plugins/AGENTS.md were read; plugin setup/update behavior is compatibility-sensitive and real behavior proof matters for user-visible update changes. (AGENTS.md:1, 527b7c2eed2f)
  • Current main still has the reported overwrite path: Current main calls upsertManagedNpmRootDependency before npm install, so an update resolving an older managed direct dependency can rewrite the managed root dependency spec. (src/plugins/install.ts:676, 527b7c2eed2f)
  • PR adds the narrow downgrade guard: The PR adds shouldPreserveManagedDependencyAgainstDowngrade and skips the dependency upsert when update would downgrade a newer installed managed dependency. (src/plugins/install.ts:202, 9758a00590c7)
  • PR aligns verification and returned metadata: The PR verifies the preserved version and returns a clean preserved NpmSpecResolution so records do not carry stale downgrade-target metadata. (src/plugins/install.ts:909, 9758a00590c7)
  • Fresh-root crash finding addressed: The PR changes readManagedNpmRootInstalledDependency to use the ENOENT-safe readJsonIfExists and adds a fresh managed-root test. (src/infra/npm-managed-root.ts:1002, 9758a00590c7)
  • Proof is still mocked, not live update proof: The PR body reports run-vitest output and explicitly says no live mutating openclaw update --tag against a real registry was run; the install/update path uses mocked npm transport. (9758a00590c7)

Likely related people:

  • steipete: Blame on the current managed install/update source in this checkout points to 2bbef6c, and GitHub path history shows several recent managed install/update commits by this author. (role: recent area contributor; confidence: high; commits: 2bbef6caacb3, 97d1f5fd153c, 86faf654db65; files: src/plugins/install.ts, src/infra/npm-managed-root.ts, src/plugins/update.ts)
  • shakkernerd: GitHub path history shows the recent managed plugin peer-dependency preservation sequence that the linked issue explicitly distinguishes from this direct-dependency path. (role: adjacent owner; confidence: medium; commits: 18ca285ed6d1, f4cb20300f6b, 402b0df3b675; files: src/plugins/install.ts, src/infra/npm-managed-root.ts)
  • jalehman: GitHub path history shows recent work on managed npm install freshness behavior, which is adjacent to this PR's update/install dependency reconciliation path. (role: adjacent contributor; confidence: medium; commits: 85a3d5312f7d; files: src/plugins/install.ts, src/infra/npm-managed-root.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P1 High-priority user-facing bug, regression, or broken workflow. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 availability 🚨 May cause crashes, hangs, restart loops, stalls, or process outages. labels May 22, 2026
@clawsweeper

clawsweeper Bot commented May 22, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper PR egg

🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.

Where did the egg go?
  • The egg game starts only after the PR passes the real-behavior proof check.
  • Before that, no creature or rarity is rolled. The treat waits for real proof.
  • This is still just collectible flavor: proof affects review readiness, not creature quality.

@alkor2000

alkor2000 commented May 22, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Addressed the [P1] (make the preserve branch pass install verification, install.ts:715 area):

  • The post-install verification now compares the on-disk version against the preserved version when the downgrade guard fires, instead of the older incoming npmResolution. Previously the preserved newer dependency was misread as a failed install and rolled back — that was the source of the compatibility/availability risk. The guard no longer fails the update flow or removes the plugin.
  • Added end-to-end integration tests through installPluginFromNpmSpec that exercise the full managed npm install/update path (not just the predicate): one asserts the preserve path completes without rollback and keeps the newer version, the other asserts a normal upgrade still rewrites to the newer version. 120 install tests pass; the update.test.ts / npm-managed-root.test.ts / update-cli.test.ts acceptance suites pass unchanged (211).

@clawsweeper

clawsweeper Bot commented May 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot removed the merge-risk: 🚨 availability 🚨 May cause crashes, hangs, restart loops, stalls, or process outages. label May 22, 2026
@alkor2000

alkor2000 commented May 22, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Addressed the [P2] (return the preserved npm resolution, install.ts:917-926):

  • When the downgrade guard preserves a newer installed dependency, the function now returns the preserved npm resolution (version + integrity of the kept version) instead of the older incoming one. This flows into install records / config metadata, so they match the version actually present in the managed npm root — addressing the compatibility risk about records carrying the older resolved metadata.
  • The verification alignment (previous [P1]) and this metadata fix now share the same expectedNpmResolution, so the preserved version is consistent across verification, the managed root, and the returned/recorded metadata.
  • Integration test extended to assert the returned npmResolution.version reflects the preserved version. 120 install tests pass; update.test.ts / npm-managed-root.test.ts / update-cli.test.ts pass unchanged (211).

@clawsweeper

clawsweeper Bot commented May 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels May 22, 2026
@alkor2000
alkor2000 force-pushed the fix-85184-managed-npm-no-silent-downgrade branch from bf7c4f5 to e9b6e34 Compare May 22, 2026 14:58
alkor2000 added 3 commits May 26, 2026 01:47
@alkor2000
fix(plugins): prevent openclaw update from silently downgrading manag…
5888049 
…ed deps

Fixes openclaw#85184.

`openclaw update` re-syncs externalized bundled-plugin direct dependencies
through installPluginFromManagedNpmRoot, which unconditionally wrote the
bundled spec into the managed npm root and reinstalled it. When a user had
a newer version pinned/installed (e.g. a deliberately applied hotfix), the
update silently downgraded it with no warning and no opt-out.

Add a narrow guard: during `update`, before writing the managed npm root
dependency, compare the version recorded in the managed lockfile against the
version the update wants to install. If the incoming version is older
(a downgrade) and both versions are concrete and comparable, keep the
installed version and emit a warning instead of overwriting it. The same
guard is applied to the alias-override retry path so the downgrade cannot
slip through there either.

Scope is intentionally narrow: only the unambiguous downgrade case during
update is guarded. Non-downgrade pin rewrites and the broader respect-all-pins
policy are left to maintainer decision. Install mode, fresh installs, and
unparseable/range specs preserve the original behavior.

Adds focused unit tests for the downgrade-detection logic.
@alkor2000
fix(plugins): verify preserved managed dep against the kept version
cec1482 
Follow-up within openclaw#85184: the downgrade guard skipped the dependency
rewrite, but the post-install verification still compared the on-disk
version against the older incoming npmResolution, so a preserved newer
dependency was misread as a failed install and rolled back (removing the
plugin). Verify against the preserved installed version when the guard
fires, so the intentional skip completes instead of triggering rollback.

Add end-to-end integration tests through installPluginFromNpmSpec
covering both the preserve path (update would downgrade, keep newer, no
rollback) and the normal upgrade path (guard does not fire).
@alkor2000
fix(plugins): report preserved resolution in returned metadata
51b946a 
Follow-up within openclaw#85184: when the downgrade guard preserves a newer
installed dependency, also return the preserved npm resolution rather
than the older incoming one, so install records and config metadata
match the version actually present in the managed npm root. Extends the
integration test to assert the returned resolution reflects the
preserved version.
@alkor2000
alkor2000 force-pushed the fix-85184-managed-npm-no-silent-downgrade branch from e9b6e34 to 51b946a Compare May 25, 2026 17:49
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. merge-risk: 🚨 availability 🚨 May cause crashes, hangs, restart loops, stalls, or process outages. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels May 25, 2026
@alkor2000
fix(plugins): make managed downgrade guard ENOENT-safe and stop leaki…
9758a00 
…ng stale resolution

Addresses ClawSweeper [P1]/[P2] on openclaw#85305.

[P1] readManagedNpmRootInstalledDependency read package-lock.json with the
strict readJson, so a fresh managed npm root (no lockfile yet) threw instead
of returning null. The downgrade guard reads installed metadata before npm
install creates the lockfile, so a fresh plugin install crashed. Switch to
the ENOENT-safe readJsonIfExists (already used elsewhere in this file for the
same lockfile), so a missing lockfile yields null (no installed dependency).

[P2] When the guard preserved a newer installed dependency, the returned
expectedNpmResolution spread the older incoming resolution and only overwrote
version/integrity, leaving stale resolvedSpec/shasum/resolvedAt from the
rejected downgrade target. Construct a clean resolution carrying only the kept
version's name/version/integrity so persisted install records do not mix
metadata.

Tests: fresh-root reader test (returns null without a lockfile) and a
preserved-resolution assertion (no stale shasum/resolvedSpec).
@alkor2000

alkor2000 commented May 27, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Addressed both review findings in commit 9758a00:

  • [P1] readManagedNpmRootInstalledDependency now uses the ENOENT-safe readJsonIfExists (already used elsewhere in this file for the same lockfile), so a fresh managed root without a lockfile returns null instead of throwing. Added a fresh-root reader test.
  • [P2] The preserved downgrade resolution now carries only the kept version's name/version/integrity, dropping stale resolvedSpec/shasum/resolvedAt from the rejected target. Integration test asserts no stale shasum/resolvedSpec.

Before/after proof for both findings is in the PR body.

@clawsweeper

clawsweeper Bot commented May 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@alkor2000

alkor2000 commented May 27, 2026

Copy link
Copy Markdown
Contributor Author

Closing this PR.

After refreshing against current main, this branch's base had fallen substantially behind upstream, and the install path it targets has since been reworked upstream (e.g. #83761 and follow-ups). The function this fix modified, installPluginFromManagedNpmRoot, has been restructured, and the specific insertion points this PR relied on (the pre-install lockfile read and the preserved-resolution construction) no longer exist in the same form. Rebasing would not cleanly carry the change forward — it would require re-implementing the guard against the new structure.

The underlying issue (#85184 — openclaw update can silently downgrade pinned managed direct dependencies) still appears open and unaddressed: the refactored installPluginFromManagedNpmRoot on main does not include a downgrade guard that I could find. So the problem is likely still worth fixing; this particular implementation is just stale.

If a maintainer still wants this addressed, it would be cleaner to implement fresh against the current install path rather than salvage this branch. Happy to do that if it's wanted — otherwise leaving #85184 open for whoever picks it up.

Thanks to the reviewers for the detailed feedback along the way.

@alkor2000 alkor2000 closed this May 27, 2026
This was referenced Jun 19, 2026
Open
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

merge-risk: 🚨 availability 🚨 May cause crashes, hangs, restart loops, stalls, or process outages. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P1 High-priority user-facing bug, regression, or broken workflow. proof: supplied External PR includes structured after-fix real behavior proof. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: M status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

openclaw update silently downgrades and rewrites pinned direct-dependency versions

1 participant

@alkor2000