fix(update): fail closed on managed plugin pin conflicts by luoyanglang · Pull Request #87304 · openclaw/openclaw

luoyanglang · 2026-05-27T13:51:18Z

openclaw update could silently downgrade a user-pinned managed plugin direct dependency. After the maintainer policy note, this PR now implements the conflict/fail-closed behavior instead of preserving the newer pin automatically.

Fixes #85184.

Affected surface

src/plugins/install.ts
- installPluginFromManagedNpmRoot
- managed npm update-mode conflict handling
src/infra/npm-managed-root.ts
- upsertManagedNpmRootDependency
- release-managed dependency spec writing
Tests:
- src/plugins/install.npm-spec.test.ts
- src/infra/npm-managed-root.test.ts

Scope

Release-managed plugin versions remain authoritative for the managed npm root write path.
In explicit update mode, if the managed npm project already has a newer direct dependency pin than the release-managed target, the update fails closed instead of downgrading or silently preserving it.
The conflict is detected before npm install, including the case where the package payload is missing and resolveEffectiveInstallMode() would otherwise fall back from update to install.
The error names the package, current package.json pin, release target, and the operator choices: use release-managed version, keep the user pin explicitly, or abort.
Existing install mode, equal versions, older managed versions, peer repair, and unrelated dependency updates keep the existing behavior.

Real behavior proof

Behavior or issue addressed: An update-mode managed npm plugin install now refuses to automatically choose between a user-pinned newer direct dependency and the release-managed target.
Real environment tested: macOS local development machine, current PR head 5f1d39b844b2dbcc03ebbe84bca6ba8599347d82, real OpenClaw source imported with node --import tsx, real npm metadata lookup for @martian-engineering/lossless-claw@0.11.2, temporary managed npm root outside the repository.
Exact steps or command run after this patch: Create a temporary managed npm project with package.json pinning @martian-engineering/lossless-claw to 0.11.3; run installPluginFromNpmSpec(..., { spec: "@martian-engineering/lossless-claw@0.11.2", mode: "update" }); verify the result fails closed, the package.json pin remains 0.11.3, and no npm install artifacts are created. This refresh uses 0.11.2/0.11.3 because the older proof spec 0.10.0 is now rejected earlier by the current runtime plugin API compatibility check, before this managed-root policy branch.
Evidence after fix:

{
  "proof": "openclaw-pr87304-managed-root-policy",
  "head": "5f1d39b844b2dbcc03ebbe84bca6ba8599347d82",
  "packageName": "@martian-engineering/lossless-claw",
  "requestedUpdateSpec": "@martian-engineering/lossless-claw@0.11.2",
  "existingPackageJsonPin": "0.11.3",
  "result": {
    "ok": false,
    "error": "Managed plugin dependency conflict for @martian-engineering/lossless-claw: current package.json pin is 0.11.3 but OpenClaw release target is 0.11.2. Non-interactive update is refusing to choose automatically. Use the release-managed version, keep the user pin explicitly, or abort."
  },
  "finalPackageJsonPin": "0.11.3",
  "npmInstallArtifacts": {
    "packageLockExists": false,
    "nodeModulesExists": false
  },
  "npmInstallRan": false,
  "tempRootKind": "mktemp /tmp/openclaw-pr87304-policy-proof-*"
}

Local validation after the current-main merge conflict resolution:

$ node scripts/run-vitest.mjs run --config test/vitest/vitest.plugins.config.ts src/plugins/install.npm-spec.test.ts
Test Files  1 passed (1)
Tests  56 passed (56)

$ node scripts/run-vitest.mjs run --config test/vitest/vitest.infra.config.ts src/infra/npm-managed-root.test.ts
Test Files  1 passed (1)
Tests  19 passed (19)

$ ./node_modules/.bin/oxfmt --check src/plugins/install.ts src/plugins/install.npm-spec.test.ts src/infra/npm-managed-root.ts src/infra/npm-managed-root.test.ts
All matched files use the correct format.

$ git diff --check
(exit 0)

$ node scripts/check-no-conflict-markers.mjs
(exit 0)

$ gitleaks protect --staged --redact
no leaks found

Observed result after fix: The update returns an actionable conflict error, leaves the user pin unchanged, and does not run npm install.
What was not tested: I did not implement an interactive chooser in this patch. The current install boundary is non-interactive, so this PR establishes the fail-closed behavior and error shape that an interactive update flow can later use.

Coverage note

This remains the open PR for #85184. Codegraph-reported overlap with #86122, #87477, and #87573 is in the shared plugin install/update functions; the policy behavior above should remain the compatibility point for those edits.

clawsweeper · 2026-05-27T13:55:13Z

Codex review: needs maintainer review before merge. Reviewed June 5, 2026, 5:52 AM ET / 09:52 UTC.

Summary
The PR makes managed npm plugin updates fail closed when update mode sees a newer direct package.json dependency pin than the release-managed target, with regression coverage for real and dry-run update paths.

PR surface: Source +48, Tests +436. Total +484 across 4 files.

Reproducibility: yes. from source inspection: current main writes the requested managed dependency spec during update without a preceding newer-pin conflict check, and the PR body includes after-fix real behavior proof for the same shape. I did not run a live update scenario because this review is read-only.

Review metrics: 1 noteworthy metric.

Fail-closed policy branches: 1 added. The new branch changes managed npm update behavior before dry-run/install mutation, so maintainers should notice the compatibility impact before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] Merging this intentionally changes non-interactive update behavior from silently rewriting a newer managed direct dependency pin to failing closed, so existing automation may stop and require operator choice.
[P1] The current PR does not add an interactive chooser or explicit keep-pin command; it establishes the failure policy and error shape for a later flow.

Maintainer options:

Accept fail-closed update policy (recommended)
Land this after maintainer acknowledgement that stopping non-interactive updates on newer direct managed pins is the desired operator-facing behavior.
Require an explicit override path first
Ask for an override or interactive path before merge if maintainers do not want existing unattended update jobs to fail closed without a built-in next step.
Pause for canonical update policy
Pause this PR if the intended behavior is still to preserve newer user pins automatically rather than making release-managed targets authoritative by default.

Next step before merge

[P2] The remaining action is maintainer acceptance of the compatibility-sensitive update policy, not a narrow automated repair.

Security
Cleared: The diff adds a pre-install conflict check and tests without changing dependency sources, lockfiles, lifecycle script policy, permissions, or secret handling.

Review details

Best possible solution:

Land the fail-closed guard if maintainers accept that non-interactive updates must stop on newer managed direct pins, and treat any interactive chooser or explicit override path as a separate follow-up.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main writes the requested managed dependency spec during update without a preceding newer-pin conflict check, and the PR body includes after-fix real behavior proof for the same shape. I did not run a live update scenario because this review is read-only.

Is this the best way to solve the issue?

Yes, if the maintainer policy is fail-closed: the check sits in the shared managed npm install path before dry-run and install mutation, which is the narrow owner boundary for this bug. The alternative is an explicit chooser or override path, but that is a product decision rather than a necessary repair in this PR.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 1a3ce7c2a8da.

Label changes

Label justifications:

P1: The linked behavior can silently downgrade a managed plugin dependency during openclaw update, affecting real update workflows and plugin fixes.
merge-risk: 🚨 compatibility: The PR changes existing update behavior from rewriting a direct dependency pin to returning a conflict error, which can stop current non-interactive update flows.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body supplies after-fix terminal-style proof from a real temporary managed npm root with real npm metadata, showing the conflict error, preserved pin, and no install artifacts.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body supplies after-fix terminal-style proof from a real temporary managed npm root with real npm metadata, showing the conflict error, preserved pin, and no install artifacts.

Evidence reviewed

PR surface:

Source +48, Tests +436. Total +484 across 4 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	48	0	+48
Tests	2	439	3	+436
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	4	487	3	+484

What I checked:

Current main lacks the conflict guard: A current-main search found no resolveManagedNpmDependencyUpdateConflict, readManagedNpmRootDependencySpec, or managed dependency conflict error, so the central behavior is not already implemented on main. (src/plugins/install.ts, 1a3ce7c2a8da)
Current overwrite path: Current main resolves the managed npm project and reaches policy/dry-run/install without checking an existing direct dependency pin; the dependency write path then writes the requested dependency spec into package.json. (src/plugins/install.ts:1113, 1a3ce7c2a8da)
Dependency write contract: upsertManagedNpmRootDependency merges existing dependencies and overwrites the target package with the requested dependency spec, which is the source-level path that can rewrite a newer direct pin today. (src/infra/npm-managed-root.ts:251, 1a3ce7c2a8da)
PR conflict check: The PR adds resolveManagedNpmDependencyUpdateConflict, reads the existing package.json dependency spec, compares it with the requested resolved version, and returns an actionable failure before dry-run or install proceeds. (src/plugins/install.ts:1026, 5f1d39b844b2)
Update caller coverage: updateNpmInstalledPlugins calls npm plugin installs with mode: "update" in both dry-run and real update paths, so the new guard is on the relevant openclaw update plugin-sync route. (src/plugins/update.ts:1558, 1a3ce7c2a8da)
Regression tests: The PR adds focused tests for newer direct pins, dry-run parity, missing installed package payloads, lockfile/node_modules disagreement, and replacement-metadata ordering. (src/plugins/install.npm-spec.test.ts:878, 5f1d39b844b2)

Likely related people:

steipete: Peter Steinberger is the dominant recent contributor to the plugin install/update files, and current-main blame for the managed npm install/write path points to commit 82710b4. (role: feature owner and recent area contributor; confidence: high; commits: 82710b4f1f10, 54ec14262b84, 5dc50b8a3f80; files: src/plugins/install.ts, src/plugins/update.ts, src/infra/npm-managed-root.ts)
vincentkoc: Vincent Koc authored the latest release baseline commit that touched src/plugins/install.ts, src/plugins/update.ts, and src/infra/npm-managed-root.ts, which are the same release-managed plugin-sync surfaces this PR changes. (role: recent release/plugin baseline contributor; confidence: medium; commits: 2e08f0f4221f, 3ce5a8366a67; files: src/plugins/install.ts, src/plugins/update.ts, src/infra/npm-managed-root.ts)
rohitjavvadi: Rohit authored the recently merged package plugin API compatibility PR that touched src/plugins/install.ts and is listed as overlapping the same install/update surface in the provided PR context. (role: recent adjacent contributor; confidence: medium; commits: 376b03f8eaba; files: src/plugins/install.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper · 2026-05-27T13:59:22Z

ClawSweeper PR egg

✨ Hatched: 🥚 common Clockwork Signal Puff

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: hums during re-review.
Image traits: location merge queue dock; accessory release bell; palette rose quartz and slate; mood curious; pose stepping out of a freshly hatched shell; shell woven fiber shell; lighting subtle sparkle highlights; background subtle branch markers.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Clockwork Signal Puff in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

luoyanglang · 2026-05-27T14:31:27Z

Addressed the ClawSweeper P2 finding in head 965efbc. The preserved-newer-pin path now re-resolves metadata for the preserved spec when lockfile metadata is missing, so version/integrity/shasum stay aligned instead of carrying stale 0.10.0 metadata into a 0.11.2 install target.

Added regression coverage for an existing 0.11.2 managed root pin with missing lockfile metadata, plus current-head mutating managed npm root proof using real npm registry versions for @martian-engineering/lossless-claw 0.10.0 -> 0.11.2. The PR body now includes the redacted proof output.

Local validation passed:

node scripts/run-vitest.mjs run --config test/vitest/vitest.infra.config.ts src/infra/npm-managed-root.test.ts
node scripts/run-vitest.mjs run --config test/vitest/vitest.plugins.config.ts src/plugins/install.npm-spec.test.ts
pnpm exec oxfmt --check src/plugins/install.ts src/plugins/install.npm-spec.test.ts src/infra/npm-managed-root.ts src/infra/npm-managed-root.test.ts
pnpm lint --threads=8
node scripts/check-changed.mjs --base origin/main
git diff --check origin/main..HEAD && git diff --check
node scripts/check-no-conflict-markers.mjs
gitleaks protect --staged --redact

@clawsweeper re-review

clawsweeper · 2026-05-27T14:31:31Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Superseded
Detail: A newer re-review for this item started before this run finished, so GitHub cancelled this older run. Check the latest ClawSweeper run for the current result.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26517792483
Updated: 2026-05-27T14:36:35.393Z

luoyanglang · 2026-05-27T14:36:10Z

Updated the Real behavior proof section with the required structured fields (behavior, environment, steps, evidence, observedResult, notTested) while preserving the source-level and mutating managed npm root evidence. @clawsweeper re-review

clawsweeper · 2026-05-27T14:36:14Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

luoyanglang · 2026-05-27T14:38:56Z

Adjusted the Real behavior proof to match scripts/github/real-behavior-proof-policy.mjs exactly: one Real behavior proof section with recognized field lines (Behavior or issue addressed, Real environment tested, Exact steps or command run after this patch, Evidence after fix, Observed result after fix, What was not tested). @clawsweeper re-review

clawsweeper · 2026-05-27T14:39:00Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

luoyanglang · 2026-05-27T15:13:22Z

Addressed the latest P2 finding in head 88b1b9f. The preserved-newer-pin path now fails closed if preserved-version npm metadata cannot be resolved, and it only reuses an installed preserved dependency directly when lock metadata includes integrity; otherwise it uses the normal npm install + integrity verification path. Added a regression covering metadata lookup failure with zero npm install calls, reran focused tests, check-changed, and current-head mutating managed npm root proof. @clawsweeper re-review

clawsweeper · 2026-05-27T15:13:26Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

luoyanglang · 2026-05-27T15:21:16Z

Rebased onto current origin/main (20eab65) and refreshed the current-head managed npm root proof for head 5bfdb85. Targeted plugin and infra tests still pass. One CI guard is currently failing on the upstream shrinkwrap baseline (lru-cache@11.5.1 absent from pnpm-lock.yaml), which reproduces locally via node scripts/generate-npm-shrinkwrap.mjs --all --check and is unrelated to this PR's files. @clawsweeper re-review

clawsweeper · 2026-05-27T15:21:20Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

luoyanglang · 2026-05-30T16:54:34Z

Addressed the ClawSweeper P2 dry-run parity finding in head 796a4623d7a1.

Change summary:

installPluginFromManagedNpmRoot now checks managed npm dependency pin conflicts before the dry-run success return, so plugins update --dry-run and real non-interactive update share the same fail-closed policy.
Added a regression that first failed on the previous head: update + dryRun + existing 0.11.2 direct pin + release target 0.10.0 now returns the managed dependency conflict and leaves package.json unchanged without running npm install.

Verification:

RED before fix: node scripts/run-vitest.mjs run --config test/vitest/vitest.plugins.config.ts src/plugins/install.npm-spec.test.ts -t "fails closed during dry-run when update finds a newer user-pinned managed dependency" failed with expected true to be false.
GREEN after fix: same targeted test passed.
node scripts/run-vitest.mjs run --config test/vitest/vitest.plugins.config.ts src/plugins/install.npm-spec.test.ts passed: 46 tests.
node scripts/run-vitest.mjs src/plugins/update.test.ts passed: 79 tests.
node scripts/run-vitest.mjs run --config test/vitest/vitest.infra.config.ts src/infra/npm-managed-root.test.ts passed: 19 tests.
./node_modules/.bin/oxfmt --check src/plugins/install.ts src/plugins/install.npm-spec.test.ts src/plugins/update.test.ts passed.
git diff --check, git diff --check origin/main..HEAD, and node scripts/check-no-conflict-markers.mjs passed.
gitleaks protect --staged --redact passed before commit.

@clawsweeper re-review

clawsweeper · 2026-05-30T16:54:37Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26689574260
Updated: 2026-05-30T17:00:36.739Z

luoyanglang · 2026-06-03T10:04:11Z

@clawsweeper re-review

Rebased this PR onto current origin/main (7cee0bca0b) and resolved the current merge conflict.

New head: c3a909dd79.

Conflict/CI notes:

kept the latest upstream server-startup.test.ts mock typing; the older local test-typing compatibility commits are now already covered by main and dropped during rebase;
patch scope remains the managed npm fail-closed conflict policy for update-mode dependency pins;
the previous checks-node-core-runtime-infra-file-safety red check was a 900s no-output Vitest termination, not an assertion failure. The equivalent local file-safety slice completed quickly on this head.

Local validation passed:

node scripts/test-projects.mjs src/plugins/install.npm-spec.test.ts src/plugins/update.test.ts src/gateway/server-startup.test.ts
# gateway shard: 1 file / 5 tests passed
# plugins shard: 2 files / 137 tests passed

node scripts/test-projects.mjs src/infra/npm-managed-root.test.ts
# 1 file / 19 tests passed

OPENCLAW_VITEST_MAX_WORKERS=2 node scripts/run-vitest.mjs run --config test/vitest/vitest.infra.config.ts src/infra/boundary-file-read.test.ts src/infra/boundary-path.test.ts src/infra/hardlink-guards.test.ts src/infra/replace-file.test.ts src/infra/resolve-system-bin.test.ts src/infra/safe-package-install.test.ts src/infra/stable-node-path.test.ts src/infra/watch-node.test.ts
# Test Files 4 passed; Tests 43 passed

node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo
node scripts/run-oxlint-shards.mjs --threads=8
node_modules/.bin/oxfmt --check src/plugins/install.npm-spec.test.ts src/plugins/update.test.ts src/infra/npm-managed-root.test.ts src/gateway/server-startup.test.ts src/plugins/install.ts
git diff --check origin/main..HEAD
node scripts/check-no-conflict-markers.mjs src/plugins/install.npm-spec.test.ts src/plugins/update.test.ts src/infra/npm-managed-root.test.ts src/gateway/server-startup.test.ts src/plugins/install.ts
gitleaks detect --redact --log-opts origin/main..HEAD

clawsweeper · 2026-06-03T10:04:14Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26979596683
Updated: 2026-06-04T21:13:15.604Z

luoyanglang · 2026-06-04T20:57:26Z

@clawsweeper re-review

Refreshed the Real behavior proof for current head c3a909dd791b5b0c2c0d2170b511ff6a16d75b7c.

Proof rerun summary:

Real npm metadata lookup for @martian-engineering/lossless-claw@0.11.2.
Temporary managed npm root pre-pinned @martian-engineering/lossless-claw to 0.11.3.
installPluginFromNpmSpec(..., mode: "update") failed closed with the managed dependency conflict.
The package.json pin stayed 0.11.3; no package-lock.json or node_modules was created.

Validation rerun on this head:

node scripts/run-vitest.mjs run --config test/vitest/vitest.plugins.config.ts src/plugins/install.npm-spec.test.ts (56 passed)
node scripts/run-vitest.mjs run --config test/vitest/vitest.infra.config.ts src/infra/npm-managed-root.test.ts (19 passed)
./node_modules/.bin/oxfmt --check src/plugins/install.ts src/plugins/install.npm-spec.test.ts src/infra/npm-managed-root.ts src/infra/npm-managed-root.test.ts
git diff --check origin/main..HEAD
node scripts/check-no-conflict-markers.mjs
gitleaks detect --redact --log-opts origin/main..HEAD

clawsweeper · 2026-06-04T20:57:29Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26979180268
Updated: 2026-06-04T21:06:09.996Z

luoyanglang · 2026-06-05T09:30:46Z

@clawsweeper re-review

Resolved the current origin/main merge conflict by merging current main into this PR.

New head: 5f1d39b844b2dbcc03ebbe84bca6ba8599347d82.

Conflict resolution summary:

Kept this PR's managed dependency update-conflict check before dryRun.
Kept current main's npm install policy preflight before dryRun.
The combined order is now availability check -> managed dependency conflict check -> policy preflight -> dry-run/install path.

Refreshed real behavior proof for the new head:

Real npm metadata lookup for @martian-engineering/lossless-claw@0.11.2.
Temporary managed npm root pre-pinned @martian-engineering/lossless-claw to 0.11.3.
installPluginFromNpmSpec(..., mode: "update") failed closed with the managed dependency conflict.
The package.json pin stayed 0.11.3; no package-lock.json or node_modules was created.

Validation on the new head:

node scripts/run-vitest.mjs run --config test/vitest/vitest.plugins.config.ts src/plugins/install.npm-spec.test.ts (56 passed)
node scripts/run-vitest.mjs run --config test/vitest/vitest.infra.config.ts src/infra/npm-managed-root.test.ts (19 passed)
./node_modules/.bin/oxfmt --check src/plugins/install.ts src/plugins/install.npm-spec.test.ts src/infra/npm-managed-root.ts src/infra/npm-managed-root.test.ts
git diff --check
node scripts/check-no-conflict-markers.mjs
gitleaks protect --staged --redact

clawsweeper · 2026-06-05T09:30:50Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27007696904
Updated: 2026-06-05T09:53:11.618Z

openclaw-barnacle Bot added size: M triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 27, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 27, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 27, 2026

luoyanglang force-pushed the wolf/update-preserve-newer-plugin-pins branch from 88b1b9f to 5bfdb85 Compare May 27, 2026 15:20

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 27, 2026

openclaw-barnacle Bot removed the size: M label May 27, 2026

openclaw-barnacle Bot added size: L and removed size: M labels May 30, 2026

luoyanglang force-pushed the wolf/update-preserve-newer-plugin-pins branch from 796a462 to cb7aa70 Compare June 1, 2026 09:44

openclaw-barnacle Bot added size: M and removed size: L labels Jun 1, 2026

luoyanglang force-pushed the wolf/update-preserve-newer-plugin-pins branch from cb7aa70 to 562a86c Compare June 1, 2026 09:58

openclaw-barnacle Bot added gateway Gateway runtime and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. labels Jun 1, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 1, 2026

fix(update): fail closed on managed plugin pin conflicts

c3a909d

luoyanglang force-pushed the wolf/update-preserve-newer-plugin-pins branch from f7f4fd5 to c3a909d Compare June 3, 2026 10:03

openclaw-barnacle Bot removed the gateway Gateway runtime label Jun 3, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 3, 2026

Merge origin/main into managed plugin pin policy PR

5f1d39b

Uh oh!

Conversation

luoyanglang commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Affected surface

Scope

Real behavior proof

Coverage note

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hatch command

Uh oh!

luoyanglang commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luoyanglang commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026

Uh oh!

luoyanglang commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026

Uh oh!

luoyanglang commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026

Uh oh!

luoyanglang commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026

Uh oh!

luoyanglang commented May 30, 2026

Uh oh!

clawsweeper Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luoyanglang commented Jun 3, 2026

Uh oh!

clawsweeper Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luoyanglang commented Jun 4, 2026

Uh oh!

clawsweeper Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luoyanglang commented Jun 5, 2026

Uh oh!

clawsweeper Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

luoyanglang commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented May 30, 2026 •

edited

Loading

clawsweeper Bot commented Jun 3, 2026 •

edited

Loading

clawsweeper Bot commented Jun 4, 2026 •

edited

Loading

clawsweeper Bot commented Jun 5, 2026 •

edited

Loading