fix: preserve pin-only install provenance

steipete · steipete · commit 36048e8d8768 · 2026-06-04T01:32:01.000+01:00
diff --git a/src/plugins/update.test.ts b/src/plugins/update.test.ts
@@ -142,6 +142,8 @@ function createNpmInstallConfig(params: {
   resolvedName?: string;
   resolvedSpec?: string;
   resolvedVersion?: string;
+  installedAt?: string;
+  resolvedAt?: string;
 }) {
   return {
     plugins: {
@@ -155,6 +157,8 @@ function createNpmInstallConfig(params: {
           ...(params.resolvedName ? { resolvedName: params.resolvedName } : {}),
           ...(params.resolvedSpec ? { resolvedSpec: params.resolvedSpec } : {}),
           ...(params.resolvedVersion ? { resolvedVersion: params.resolvedVersion } : {}),
+          ...(params.installedAt ? { installedAt: params.installedAt } : {}),
+          ...(params.resolvedAt ? { resolvedAt: params.resolvedAt } : {}),
         },
       },
     },
@@ -656,6 +660,8 @@ describe("updateNpmInstalledPlugins", () => {
         resolvedSpec: "@openclaw/acpx@2026.5.2",
         resolvedVersion: "2026.5.2",
         integrity: "sha512-old",
+        installedAt: "2026-05-01T00:00:00.000Z",
+        resolvedAt: "2026-05-01T00:00:01.000Z",
       }),
       pluginIds: ["acpx"],
       syncOfficialPluginInstalls: true,
@@ -664,6 +670,8 @@ describe("updateNpmInstalledPlugins", () => {
     expect(result.changed).toBe(true);
     expect(result.outcomes[0]?.status).toBe("unchanged");
     expect(result.config.plugins?.installs?.acpx?.spec).toBe("@openclaw/acpx@2026.5.2");
+    expect(result.config.plugins?.installs?.acpx?.installedAt).toBe("2026-05-01T00:00:00.000Z");
+    expect(result.config.plugins?.installs?.acpx?.resolvedAt).toBe("2026-05-01T00:00:01.000Z");
     expect(npmInstallCall()).toBeUndefined();
   });
 
diff --git a/src/plugins/update.ts b/src/plugins/update.ts
@@ -1499,14 +1499,26 @@ export async function updateNpmInstalledPlugins(params: {
               pinResolvedRegistrySpec: true,
             });
             if (nextRecordSpec !== record.spec) {
-              next = recordPluginInstall(next, {
-                pluginId,
-                source: "npm",
-                spec: nextRecordSpec,
-                installPath,
-                version: currentVersion,
-                ...buildNpmResolutionInstallFields(metadataResult.metadata),
-              });
+              const resolutionFields = buildNpmResolutionInstallFields(metadataResult.metadata);
+              next = {
+                ...next,
+                plugins: {
+                  ...next.plugins,
+                  installs: {
+                    ...next.plugins?.installs,
+                    [pluginId]: {
+                      ...record,
+                      spec: nextRecordSpec,
+                      resolvedName: resolutionFields.resolvedName ?? record.resolvedName,
+                      resolvedVersion: resolutionFields.resolvedVersion ?? record.resolvedVersion,
+                      resolvedSpec: resolutionFields.resolvedSpec ?? record.resolvedSpec,
+                      integrity: resolutionFields.integrity ?? record.integrity,
+                      shasum: resolutionFields.shasum ?? record.shasum,
+                      resolvedAt: resolutionFields.resolvedAt ?? record.resolvedAt,
+                    },
+                  },
+                },
+              };
               changed = true;
             }
           }
