Skip to content

fix(update): query npm metadata through npm#93537

Closed
TurboTheTurtle wants to merge 4 commits into
openclaw:mainfrom
TurboTheTurtle:codex/79140-update-metadata-lookup
Closed

fix(update): query npm metadata through npm#93537
TurboTheTurtle wants to merge 4 commits into
openclaw:mainfrom
TurboTheTurtle:codex/79140-update-metadata-lookup

Conversation

@TurboTheTurtle

@TurboTheTurtle TurboTheTurtle commented Jun 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Closes #79140.

Summary:

  • Replace the update metadata raw registry fetch with npm view --global so npm resolves registry config and scoped auth.
  • Thread the global install spec, env, and cwd through update target resolution and runtime preflight.
  • Add regression coverage for user npm config auth while a project .npmrc points at a different registry.
  • Default the bounded Codex thread config and split setup adapter types onto leaf contracts so current CI architecture gates remain deterministic.

Real behavior proof

Behavior addressed: update checks no longer hardcode registry.npmjs.org or bypass npm scoped auth when resolving OpenClaw package metadata.
Real environment tested: local source checkout on macOS with npm and a temporary HTTP registry stub.
Exact steps or command run after this patch: node scripts/run-vitest.mjs src/infra/update-check.test.ts
Evidence after fix: the test uses npm global scope, user config auth, and ignores project npmrc for real metadata passed; the stub registry recorded /user/openclaw and Authorization: Bearer test-token, with no /project/ registry request.
Observed result after fix: 17 passed (17).
What was not tested: a live private third-party npm registry; the local stub exercises npm actual npm view --global request/auth behavior without external credentials.

@openclaw-barnacle openclaw-barnacle Bot added cli CLI command changes size: M proof: supplied External PR includes structured after-fix real behavior proof. labels Jun 16, 2026
@TurboTheTurtle
TurboTheTurtle force-pushed the codex/79140-update-metadata-lookup branch from eac8588 to 4f9d442 Compare June 16, 2026 07:30
@clawsweeper

clawsweeper Bot commented Jun 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ClawSweeper review: did not complete due to Codex infrastructure failure. Reviewed June 16, 2026, 9:04 PM ET / 01:04 UTC.

Summary
Review failed before ClawSweeper could summarize the requested change.

PR surface: Source +156, Tests +127. Total +283 across 10 files.

Reproducibility: unclear. The review failed before ClawSweeper could establish a reproduction path.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: serialized state: src/infra/update-check.test.ts, serialized state: src/infra/update-check.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Not assessed.
Failure reason: invalid structured output.

This is a ClawSweeper/Codex infrastructure failure, not a PR readiness or patch-quality verdict.
Keep any merge decision on the normal maintainer review path until ClawSweeper can complete a fresh review.

Risk before merge

  • [P1] No close action taken because the review did not complete.

Maintainer options:

  1. Decide the mitigation before merge
    Retry the Codex review after fixing the execution failure.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • Review did not complete, so no work-lane recommendation was made.
Review details

Best possible solution:

Retry the Codex review after fixing the execution failure.

Do we have a high-confidence way to reproduce the issue?

Unclear. The review failed before ClawSweeper could establish a reproduction path.

Is this the best way to solve the issue?

Unclear. Retry the review first so ClawSweeper can evaluate the actual issue and fix direction.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against dcbea6235101.

Label changes

Label changes:

  • remove P2: Current review triage priority is none.
Evidence reviewed

PR surface:

Source +156, Tests +127. Total +283 across 10 files.

View PR surface stats
Area Files Added Removed Net
Source 8 265 109 +156
Tests 2 160 33 +127
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 10 425 142 +283

What I checked:

  • failure reason: invalid structured output.
  • codex failure detail: Codex review failed for this PR with exit 0 and wrote invalid JSON or schema-invalid output to /home/runner/work/clawsweeper/clawsweeper/artifacts/event/codex/93537.json: decision.rootCauseCluster.currentItemRelationship fixed_by_candidate requires a canonical PR.
  • codex stderr: No stderr captured.
  • codex stdout: eck install detection.","commits":["a9f21b3d3a8c0eb7942c9b9b6fb6056b4088f3ed","5d017dae5aa4960f19e2c446049c4af14cfbbae5","66c88b4c77db43060aa5ca024a6443f24083aac8","5d6216a7f12f4bd0349896db7e929b54afc9efd4"],"files":["src/infra/update-check.ts","src/cli/update-cli/update-command.ts"],"confidence":"high"},{"person":"vincentkoc","role":"recent adjacent update-flow contributor","reason":"Recent history shows work on beta registry channel reporting, supervised auto-updates, and update-command repairs that share this update/status surface.","commits":["d68ca425bd983e1d28fb5427bb77b8796290196a","fc2a7be0bc959ab9c60ba85597ba3b50940dfc4a","333a93ce4486cd503a1675507d0f13c61d0fcacf","d1f6ca20a1427f6059fb6a58c6426b4c7be7dff4"],"files":["src/infra/update-check.ts","src/cli/update-cli/update-command.ts","src/infra/update-startup.ts"],"confidence":"medium"},{"person":"fuller-stack-de.

Likely related people:

  • unknown: Codex failed before it could trace repository history. (role: review did not complete; confidence: low)
How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@TurboTheTurtle
TurboTheTurtle force-pushed the codex/79140-update-metadata-lookup branch from 21e54c9 to 5e13739 Compare June 16, 2026 08:19
@openclaw-barnacle openclaw-barnacle Bot added the scripts Repository scripts label Jun 16, 2026
@TurboTheTurtle
TurboTheTurtle force-pushed the codex/79140-update-metadata-lookup branch from 5e13739 to 70813f9 Compare June 16, 2026 08:28
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels Jun 16, 2026
@TurboTheTurtle
TurboTheTurtle force-pushed the codex/79140-update-metadata-lookup branch from 70813f9 to 0acb41a Compare June 16, 2026 09:24
@openclaw-barnacle openclaw-barnacle Bot added commands Command implementations and removed scripts Repository scripts labels Jun 16, 2026
@TurboTheTurtle
TurboTheTurtle force-pushed the codex/79140-update-metadata-lookup branch from 42d3cdd to 04a54e9 Compare June 16, 2026 09:43
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 16, 2026
@TurboTheTurtle
TurboTheTurtle force-pushed the codex/79140-update-metadata-lookup branch from 04a54e9 to 0799dfa Compare June 16, 2026 09:54
@openclaw-barnacle openclaw-barnacle Bot removed the commands Command implementations label Jun 16, 2026
@TurboTheTurtle
TurboTheTurtle force-pushed the codex/79140-update-metadata-lookup branch from cbfd04b to a46e7b1 Compare June 16, 2026 18:09
@clawsweeper clawsweeper Bot removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 16, 2026
@TurboTheTurtle

TurboTheTurtle commented Jun 17, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@vincentkoc vincentkoc mentioned this pull request Jun 17, 2026
Merged
@vincentkoc vincentkoc self-assigned this Jun 17, 2026
@vincentkoc

vincentkoc commented Jun 17, 2026

Copy link
Copy Markdown
Member

Superseded by #93879, which keeps the npm metadata change in an attribution-preserving split and includes the owning-npm/Bun fallback corrections plus focused validation.

Closing this mixed PR in favor of the replacement.

@vincentkoc vincentkoc closed this Jun 17, 2026
@TurboTheTurtle
TurboTheTurtle deleted the codex/79140-update-metadata-lookup branch June 17, 2026 03:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vincentkoc vincentkoc

Labels

cli CLI command changes extensions: codex P2 Normal backlog priority with limited blast radius. proof: supplied External PR includes structured after-fix real behavior proof. size: L

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

update-check hardcodes registry.npmjs.org, not respecting npm mirror config

2 participants

@TurboTheTurtle @vincentkoc