fix(update): fail closed on preserved plugin metadata miss

luoyanglang · luoyanglang · commit 88b1b9f7d3bd · 2026-05-27T15:10:21.000Z
diff --git a/src/plugins/install.npm-spec.test.ts b/src/plugins/install.npm-spec.test.ts
@@ -178,6 +178,7 @@ type MockNpmPackage = {
   skipLockfileEntry?: boolean;
   packArchivePath?: string;
   packTarballName?: string;
+  viewFailure?: string;
 };
 
 function writeNpmRootPackageLock(params: {
@@ -303,6 +304,16 @@ function mockNpmViewAndInstallMany(packages: MockNpmPackage[]) {
       }
       const viewPackage = viewPackagesByArgv.get(argvKey);
       if (viewPackage) {
+        if (viewPackage.viewFailure) {
+          return {
+            code: 1,
+            stdout: "",
+            stderr: viewPackage.viewFailure,
+            signal: null,
+            killed: false,
+            termination: "exit" as const,
+          };
+        }
         return successfulSpawn(
           JSON.stringify({
             name: viewPackage.packageName,
@@ -754,6 +765,75 @@ describe("installPluginFromNpmSpec", () => {
     expect(manifest.dependencies?.[packageName]).toBe("0.11.2");
   });
 
+  it("fails closed when preserved newer managed dependency metadata cannot be resolved", async () => {
+    const npmRoot = path.join(suiteTempRootTracker.makeTempDir(), "npm");
+    const packageName = "@martian-engineering/lossless-claw";
+    fs.mkdirSync(npmRoot, { recursive: true });
+    fs.writeFileSync(
+      path.join(npmRoot, "package.json"),
+      `${JSON.stringify(
+        {
+          private: true,
+          dependencies: {
+            [packageName]: "0.11.2",
+          },
+        },
+        null,
+        2,
+      )}\n`,
+      "utf8",
+    );
+    writeInstalledNpmPlugin({
+      npmRoot,
+      packageName,
+      version: "0.11.2",
+      pluginId: "lossless-claw",
+    });
+    mockNpmViewAndInstallMany([
+      {
+        spec: `${packageName}@0.10.0`,
+        packageName,
+        version: "0.10.0",
+        pluginId: "lossless-claw",
+        integrity: "sha512-old",
+        shasum: "oldshasum",
+        npmRoot,
+      },
+      {
+        spec: `${packageName}@0.11.2`,
+        packageName,
+        version: "0.11.2",
+        pluginId: "lossless-claw",
+        npmRoot,
+        viewFailure: "npm ERR! registry unavailable",
+      },
+    ]);
+
+    const result = await installPluginFromNpmSpec({
+      spec: `${packageName}@0.10.0`,
+      npmDir: npmRoot,
+      mode: "update",
+      logger: { info: () => {}, warn: () => {} },
+    });
+
+    expect(result.ok).toBe(false);
+    if (result.ok) {
+      return;
+    }
+    expect(result.error).toContain(
+      `Failed to resolve npm metadata for preserved newer managed dependency ${packageName}@0.11.2`,
+    );
+    expect(result.error).toContain("npm view failed: npm ERR! registry unavailable");
+    const installCalls = runCommandWithTimeoutMock.mock.calls.filter((call) =>
+      isManagedNpmInstallCommand(call[0]),
+    );
+    expect(installCalls).toHaveLength(0);
+    const manifest = JSON.parse(
+      await fs.promises.readFile(path.join(npmRoot, "package.json"), "utf8"),
+    ) as { dependencies?: Record<string, string> };
+    expect(manifest.dependencies?.[packageName]).toBe("0.11.2");
+  });
+
   it("rejects npm installs when the installed artifact drifts from verified metadata", async () => {
     const npmRoot = path.join(suiteTempRootTracker.makeTempDir(), "npm");
     mockNpmViewAndInstall({
diff --git a/src/plugins/install.ts b/src/plugins/install.ts
@@ -496,11 +496,19 @@ async function resolveReusableNewerManagedDependency(params: {
   requestedResolution: NpmSpecResolution;
   mode: "install" | "update";
   timeoutMs: number;
-}): Promise<{
-  dependencySpec: string;
-  installed: ManagedNpmRootInstalledDependency | null;
-  resolution: NpmSpecResolution;
-} | null> {
+}): Promise<
+  | {
+      ok: true;
+      dependencySpec: string;
+      installed: ManagedNpmRootInstalledDependency | null;
+      resolution: NpmSpecResolution;
+    }
+  | {
+      ok: false;
+      error: string;
+    }
+  | null
+> {
   const requestedVersion = params.requestedResolution.version;
   if (params.mode !== "update" || !requestedVersion) {
     return null;
@@ -530,32 +538,29 @@ async function resolveReusableNewerManagedDependency(params: {
     return null;
   }
   const preservedSpec = `${params.packageName}@${dependencySpec}`;
-  let preservedResolution: NpmSpecResolution = {
-    name: params.requestedResolution.name ?? params.packageName,
-    version: dependencySpec,
-    resolvedSpec: preservedSpec,
-  };
-  if (installed?.version === dependencySpec) {
-    if (installed.integrity) {
-      preservedResolution = {
-        ...preservedResolution,
-        integrity: installed.integrity,
-      };
-    }
+  let preservedResolution: NpmSpecResolution;
+  if (installed?.version === dependencySpec && installed.integrity) {
+    preservedResolution = {
+      name: params.requestedResolution.name ?? params.packageName,
+      version: dependencySpec,
+      resolvedSpec: preservedSpec,
+      integrity: installed.integrity,
+    };
   } else {
     const metadataResult = await resolveNpmSpecMetadata({
       spec: preservedSpec,
       timeoutMs: params.timeoutMs,
     });
-    preservedResolution = metadataResult.ok
-      ? metadataResult.metadata
-      : {
-          name: params.requestedResolution.name ?? params.packageName,
-          version: dependencySpec,
-          resolvedSpec: preservedSpec,
-        };
+    if (!metadataResult.ok) {
+      return {
+        ok: false,
+        error: `Failed to resolve npm metadata for preserved newer managed dependency ${preservedSpec}: ${metadataResult.error}`,
+      };
+    }
+    preservedResolution = metadataResult.metadata;
   }
   return {
+    ok: true,
     dependencySpec,
     installed,
     resolution: {
@@ -711,12 +716,16 @@ async function installPluginFromManagedNpmRoot(
     mode: effectiveMode,
     timeoutMs,
   });
+  if (reusableNewerDependency && !reusableNewerDependency.ok) {
+    return { ok: false, error: reusableNewerDependency.error };
+  }
   const expectedNpmResolution = reusableNewerDependency?.resolution ?? params.npmResolution;
   const managedDependencySpec = reusableNewerDependency?.dependencySpec ?? params.dependencySpec;
   const installedNewerDependency = reusableNewerDependency?.installed;
   if (
     reusableNewerDependency &&
-    installedNewerDependency?.version === reusableNewerDependency.dependencySpec
+    installedNewerDependency?.version === reusableNewerDependency.dependencySpec &&
+    installedNewerDependency.integrity
   ) {
     logger.warn?.(
       `Keeping newer installed ${params.packageName}@${installedNewerDependency.version} instead of downgrading to ${params.npmResolution.version}.`,
