@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/cli/lib/__tests__/inspect-plugin.test.ts

@@ -41,11 +41,18 @@ function manifestWith(name: string, ref: string): unknown {
 }
 
 /**
- * Build a `fetch` that serves the marketplace manifest. `marketplace:
- * undefined` answers 404 (empty catalog); `fail: true` rejects with a network
- * error. Anything else surfaces a 500 so test bugs are loud.
+ * Build a `fetch` that serves the marketplace manifest and the GitHub commit
+ * API. `marketplace: undefined` answers 404 (empty catalog); `fail: true`
+ * rejects the marketplace request with a network error. `remoteCommitDate`
+ * seeds the committer date the GitHub commit endpoint returns (its absence
+ * 404s, so the remote timestamp degrades to `null`). Anything else surfaces a
+ * 500 so test bugs are loud.
  */
-function makeFetch(opts: { marketplace?: unknown; fail?: boolean }): FetchLike {
+function makeFetch(opts: {
+  marketplace?: unknown;
+  fail?: boolean;
+  remoteCommitDate?: string;
+}): FetchLike {
   return (async (input: RequestInfo | URL) => {
     const url = typeof input === "string" ? input : input.toString();
     if (url.includes("marketplace.json")) {
@@ -55,6 +62,17 @@ function makeFetch(opts: { marketplace?: unknown; fail?: boolean }): FetchLike {
       }
       return new Response(JSON.stringify(opts.marketplace), { status: 200 });
     }
+    if (url.includes("api.github.com") && url.includes("/commits/")) {
+      if (opts.remoteCommitDate === undefined) {
+        return new Response("not found", { status: 404 });
+      }
+      return new Response(
+        JSON.stringify({
+          commit: { committer: { date: opts.remoteCommitDate } },
+        }),
+        { status: 200 },
+      );
+    }
     return new Response("unexpected url: " + url, { status: 500 });
   }) as FetchLike;
 }
@@ -65,7 +83,11 @@ function installPlugin(
   name: string,
   opts: {
     version?: string;
-    sidecar?: { commit?: string | null; ref?: string } | null;
+    sidecar?: {
+      commit?: string | null;
+      ref?: string;
+      committedAt?: string;
+    } | null;
     /** Embed a content fingerprint of the materialized tree in the sidecar. */
     fingerprint?: boolean;
   } = {},
@@ -99,6 +121,7 @@ function installPlugin(
           ref: sidecar.ref ?? sidecar.commit ?? SHA_A,
         },
         commit: sidecar.commit ?? undefined,
+        committedAt: sidecar.committedAt,
         installedAt: "2026-06-10T12:00:00.000Z",
         fingerprint,
       }),
@@ -139,6 +162,47 @@ describe("inspectPlugin", () => {
     expect(result.remote?.license).toBe("MIT");
   });
 
+  test("surfaces commit timestamps as the human-readable version on both sides", async () => {
+    // GIVEN an installed copy with a recorded commit timestamp and a
+    // marketplace whose pinned commit GitHub dates a few days later
+    installPlugin(workspace, "level-up", {
+      sidecar: { commit: SHA_A, committedAt: "2026-06-01T12:34:56.000Z" },
+    });
+    const fetch = makeFetch({
+      marketplace: manifestWith("level-up", SHA_B),
+      remoteCommitDate: "2026-06-05T08:12:24.000Z",
+    });
+
+    // WHEN it is inspected
+    const result = await inspectPlugin(
+      { name: "level-up" },
+      { fetch, workspacePluginsDir: workspace },
+    );
+
+    // THEN the installed timestamp comes from the sidecar and the remote one
+    // is resolved from GitHub — both as ISO-8601 UTC strings
+    expect(result.local?.committedAt).toBe("2026-06-01T12:34:56.000Z");
+    expect(result.remote?.committedAt).toBe("2026-06-05T08:12:24.000Z");
+  });
+
+  test("leaves the remote timestamp null when the commit date cannot be fetched", async () => {
+    // GIVEN a marketplace entry but a GitHub commit endpoint that 404s
+    installPlugin(workspace, "level-up", { sidecar: { commit: SHA_A } });
+    const fetch = makeFetch({ marketplace: manifestWith("level-up", SHA_B) });
+
+    // WHEN it is inspected
+    const result = await inspectPlugin(
+      { name: "level-up" },
+      { fetch, workspacePluginsDir: workspace },
+    );
+
+    // THEN the SHA is still reported while the timestamp degrades to null
+    expect(result.remote?.commit).toBe(SHA_B);
+    expect(result.remote?.committedAt).toBeNull();
+    // AND an older install without a recorded commit date reports null too
+    expect(result.local?.committedAt).toBeNull();
+  });
+
   test("reports update-available when the marketplace pin has advanced", async () => {
     // GIVEN an installed plugin whose commit differs from the marketplace pin
     installPlugin(workspace, "level-up", { sidecar: { commit: SHA_A } });

package/src/cli/lib/__tests__/install-from-github.test.ts

@@ -146,6 +146,8 @@ function makeContentsFetch(opts: {
 function fakeGitRunner(opts: {
   tree: Record<string, string | null>;
   commit?: string;
+  /** UNIX committer seconds reported by `git show -s --format=%ct HEAD`. */
+  committedAtSeconds?: number;
   calls?: string[][];
   fetchError?: Error;
 }): GitRunner {
@@ -170,6 +172,13 @@ function fakeGitRunner(opts: {
       }
       case "rev-parse":
         return { stdout: `${commit}\n` };
+      case "show":
+        return {
+          stdout:
+            opts.committedAtSeconds === undefined
+              ? ""
+              : `${opts.committedAtSeconds}\n`,
+        };
       default:
         return { stdout: "" };
     }
@@ -338,6 +347,10 @@ describe("installPlugin — marketplace resolution", () => {
         ".claude-plugin/plugin.json": "{}",
       },
       commit: "63a91ecadbf4c4719a4602a5abb00883f9966034",
+      // 2026-06-05T08:12:24Z as UNIX seconds, so the install captures it.
+      committedAtSeconds: Math.floor(
+        Date.parse("2026-06-05T08:12:24.000Z") / 1000,
+      ),
       calls,
     });
 
@@ -354,6 +367,8 @@ describe("installPlugin — marketplace resolution", () => {
     expect(result.target).toBe(target);
     expect(result.ref).toBe("63a91ecadbf4c4719a4602a5abb00883f9966034");
     expect(result.commit).toBe("63a91ecadbf4c4719a4602a5abb00883f9966034");
+    // AND the commit's committer date is captured as an ISO-8601 UTC string
+    expect(result.committedAt).toBe("2026-06-05T08:12:24.000Z");
     expect(result.fileCount).toBe(3);
     expect(readFileSync(join(target, "package.json"), "utf-8")).toBe(
       '{"name":"caveman"}',

package/src/cli/lib/__tests__/upgrade-plugin.test.ts

@@ -61,6 +61,7 @@ function manifestWith(name: string, ref: string): unknown {
 function makeFetch(opts: {
   manifest?: unknown;
   manifestStatus?: number;
+  remoteCommitDate?: string;
 }): FetchLike {
   return (async (input: RequestInfo | URL) => {
     const url = typeof input === "string" ? input : input.toString();
@@ -75,6 +76,19 @@ function makeFetch(opts: {
       }
       return new Response(JSON.stringify(opts.manifest), { status: 200 });
     }
+    // The remote commit date `inspect` resolves to surface the human-readable
+    // "to" timestamp; absent it 404s and the timestamp degrades to null.
+    if (url.includes("api.github.com") && url.includes("/commits/")) {
+      if (opts.remoteCommitDate === undefined) {
+        return new Response("not found", { status: 404 });
+      }
+      return new Response(
+        JSON.stringify({
+          commit: { committer: { date: opts.remoteCommitDate } },
+        }),
+        { status: 200 },
+      );
+    }
     // No adapter stub: the Contents API listing for plugins/<name> is empty.
     if (url.startsWith(CONTENTS)) {
       return new Response("not found", { status: 404 });
@@ -83,10 +97,17 @@ function makeFetch(opts: {
   }) as FetchLike;
 }
 
-/** A fake clone that materializes one file and reports `commit` at HEAD. */
-function fakeGitRunner(commit: string, calls?: string[][]): GitRunner {
+/**
+ * A fake clone that materializes one file and reports `commit` at HEAD. When
+ * `committedAtSeconds` is given, `git show -s --format=%ct HEAD` reports that
+ * UNIX committer time, mirroring how install captures the commit timestamp.
+ */
+function fakeGitRunner(
+  commit: string,
+  opts: { calls?: string[][]; committedAtSeconds?: number } = {},
+): GitRunner {
   return async (args, { cwd }) => {
-    calls?.push([...args]);
+    opts.calls?.push([...args]);
     switch (args[0]) {
       case "fetch": {
         mkdirSync(join(cwd, ".git"), { recursive: true });
@@ -96,6 +117,13 @@ function fakeGitRunner(commit: string, calls?: string[][]): GitRunner {
       }
       case "rev-parse":
         return { stdout: `${commit}\n` };
+      case "show":
+        return {
+          stdout:
+            opts.committedAtSeconds === undefined
+              ? ""
+              : `${opts.committedAtSeconds}\n`,
+        };
       default:
         return { stdout: "" };
     }
@@ -111,7 +139,7 @@ const unusedGitRunner: GitRunner = async (args) => {
 function installCopy(
   pluginsDir: string,
   name: string,
-  sidecar: { commit: string } | null,
+  sidecar: { commit: string; committedAt?: string } | null,
 ): void {
   const dir = join(pluginsDir, name);
   mkdirSync(dir, { recursive: true });
@@ -132,6 +160,7 @@ function installCopy(
           ref: sidecar.commit,
         },
         commit: sidecar.commit,
+        committedAt: sidecar.committedAt,
         installedAt: "2026-06-10T12:00:00.000Z",
       }),
     );
@@ -181,6 +210,54 @@ describe("upgradePlugin", () => {
     expect(sidecarCommit(pluginsDir, "level-up")).toBe(SHA_B);
   });
 
+  test("threads commit timestamps through the move as the human-readable version", async () => {
+    // GIVEN an installed copy with a recorded commit timestamp
+    installCopy(pluginsDir, "level-up", {
+      commit: SHA_A,
+      committedAt: "2026-06-01T12:34:56.000Z",
+    });
+    // AND the marketplace pins a newer commit whose date the clone reports
+    const fetch = makeFetch({ manifest: manifestWith("level-up", SHA_B) });
+    // 2026-06-05T08:12:24Z expressed as UNIX seconds for `git show %ct`.
+    const runGit = fakeGitRunner(SHA_B, {
+      committedAtSeconds: Math.floor(
+        Date.parse("2026-06-05T08:12:24.000Z") / 1000,
+      ),
+    });
+
+    // WHEN the plugin is upgraded
+    const result = await upgradePlugin(
+      { name: "level-up" },
+      { fetch, runGit, workspacePluginsDir: pluginsDir },
+    );
+
+    // THEN both ends of the move carry their commit timestamps
+    expect(result.fromTimestamp).toBe("2026-06-01T12:34:56.000Z");
+    expect(result.toTimestamp).toBe("2026-06-05T08:12:24.000Z");
+  });
+
+  test("a dry run resolves the target timestamp from the marketplace pin", async () => {
+    // GIVEN an installed copy and a marketplace pin whose commit GitHub dates
+    installCopy(pluginsDir, "level-up", {
+      commit: SHA_A,
+      committedAt: "2026-06-01T12:34:56.000Z",
+    });
+    const fetch = makeFetch({
+      manifest: manifestWith("level-up", SHA_B),
+      remoteCommitDate: "2026-06-05T08:12:24.000Z",
+    });
+
+    // WHEN a dry-run upgrade is performed (git must never run)
+    const result = await upgradePlugin(
+      { name: "level-up", dryRun: true },
+      { fetch, runGit: unusedGitRunner, workspacePluginsDir: pluginsDir },
+    );
+
+    // THEN the preview shows the timestamp move resolved without a clone
+    expect(result.fromTimestamp).toBe("2026-06-01T12:34:56.000Z");
+    expect(result.toTimestamp).toBe("2026-06-05T08:12:24.000Z");
+  });
+
   test("is a no-op when the installed commit already equals the pin", async () => {
     // GIVEN an installed copy already pinned to SHA_A
     installCopy(pluginsDir, "level-up", { commit: SHA_A });

package/src/cli/lib/inspect-plugin.ts

@@ -70,6 +70,13 @@ export interface PluginLocalInfo {
   readonly target: string;
   /** Resolved commit the copy was installed at; `null` when no provenance was recorded. */
   readonly commit: string | null;
+  /**
+   * ISO-8601 committer timestamp of {@link PluginLocalInfo.commit} (UTC), the
+   * human-readable version `plugins inspect` shows. `null` for older installs
+   * written before commit timestamps were recorded. Distinct from
+   * {@link PluginLocalInfo.installedAt} (when this machine ran the install).
+   */
+  readonly committedAt: string | null;
   /** `package.json` `version`, when present. */
   readonly version: string | null;
   /** `package.json` `description`, when present. */
@@ -96,6 +103,12 @@ export interface PluginRemoteInfo {
   readonly path: string;
   /** Pinned commit SHA the marketplace currently resolves installs to. */
   readonly commit: string;
+  /**
+   * ISO-8601 committer timestamp of {@link PluginRemoteInfo.commit} (UTC),
+   * resolved from GitHub. `null` when the commit metadata could not be fetched
+   * (network / rate-limit); the SHA is still reported.
+   */
+  readonly committedAt: string | null;
   readonly description: string | null;
   readonly homepage: string | null;
   readonly license: string | null;
@@ -167,6 +180,7 @@ function readLocal(
   return {
     target: entry.target,
     commit,
+    committedAt: manifest?.committedAt ?? null,
     version: entry.packageJson?.version ?? null,
     description: entry.packageJson?.description ?? null,
     installedAt: manifest?.installedAt || null,
@@ -179,11 +193,13 @@ function readLocal(
 function readRemote(
   entry: MarketplaceEntry,
   marketplaceRef: string,
+  committedAt: string | null,
 ): PluginRemoteInfo {
   return {
     repo: entry.source.repo,
     path: entry.source.path ?? "",
     commit: entry.source.ref,
+    committedAt,
     description: entry.description ?? null,
     homepage: entry.homepage ?? null,
     license: entry.license ?? null,
@@ -192,6 +208,44 @@ function readRemote(
   };
 }
 
+/**
+ * Resolve the committer date of a pinned commit from GitHub, normalized to a
+ * UTC ISO-8601 string so it is directly comparable with the install-time
+ * {@link PluginLocalInfo.committedAt}.
+ *
+ * Best-effort: any failure (network, rate-limit, unexpected shape) yields
+ * `null` so inspection still reports the remote pin's SHA without its date,
+ * mirroring how the local side degrades to `unknown` when no date was recorded.
+ */
+async function fetchCommitDate(
+  repo: string,
+  sha: string,
+  fetch: FetchLike,
+): Promise<string | null> {
+  const url = `https://api.github.com/repos/${repo}/commits/${encodeURIComponent(sha)}`;
+  try {
+    const res = await fetch(url, {
+      headers: {
+        Accept: "application/vnd.github+json",
+        "User-Agent": "vellum-assistant-cli",
+      },
+    });
+    if (!res.ok) return null;
+    const json: unknown = JSON.parse(await res.text());
+    if (typeof json !== "object" || json === null) return null;
+    const commit = (json as Record<string, unknown>).commit;
+    if (typeof commit !== "object" || commit === null) return null;
+    const committer = (commit as Record<string, unknown>).committer;
+    if (typeof committer !== "object" || committer === null) return null;
+    const date = (committer as Record<string, unknown>).date;
+    if (typeof date !== "string") return null;
+    const ms = Date.parse(date);
+    return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Resolve the local-vs-remote inspection for a single plugin.
  *
@@ -221,7 +275,14 @@ export async function inspectPlugin(
       { ref: marketplaceRef },
     );
     const match = entries.find((e) => e.name === name);
-    if (match) remote = readRemote(match, marketplaceRef);
+    if (match) {
+      const committedAt = await fetchCommitDate(
+        match.source.repo,
+        match.source.ref,
+        deps.fetch,
+      );
+      remote = readRemote(match, marketplaceRef, committedAt);
+    }
   } catch (err) {
     remoteError = err instanceof Error ? err.message : String(err);
   }

package/src/cli/lib/install-from-github.ts

@@ -135,6 +135,11 @@ export interface InstallPluginResult {
   readonly ref: string;
   /** Resolved commit SHA the external source was cloned at; null when it could not be read. */
   readonly commit: string | null;
+  /**
+   * ISO-8601 committer timestamp of {@link InstallPluginResult.commit} (UTC);
+   * null when the commit or its date could not be read.
+   */
+  readonly committedAt: string | null;
 }
 
 /** Plugin name failed sanitization. */
@@ -369,6 +374,7 @@ export async function installPlugin(
 
   let fileCount: number;
   let commit: string | null = null;
+  let committedAt: string | null = null;
   try {
     const cloned = await copyExternalViaGit(
       source,
@@ -377,6 +383,7 @@ export async function installPlugin(
     );
     fileCount = cloned.fileCount;
     commit = cloned.commit;
+    committedAt = cloned.committedAt;
     // An external clone is often a foreign-ecosystem plugin (e.g. a Claude
     // Code plugin) that the Vellum loader can't run as-is. When we curate an
     // adapter stub for it, overlay the stub and run its transform so the
@@ -411,6 +418,7 @@ export async function installPlugin(
     source,
     ref,
     commit,
+    committedAt,
     fingerprint,
     contentHash,
   });
@@ -426,7 +434,7 @@ export async function installPlugin(
   }
   renameSync(stagingDir, target);
 
-  return { name, target, fileCount, ref, commit };
+  return { name, target, fileCount, ref, commit, committedAt };
 }
 
 /** Cap on any single git invocation; a shallow fetch is well under this. */
@@ -497,6 +505,16 @@ export interface InstallMeta {
   readonly source: InstallMetaSource;
   /** Resolved commit SHA the source was cloned at; `null` when it could not be read at install time. */
   readonly commit: string | null;
+  /**
+   * ISO-8601 committer timestamp of {@link InstallMeta.commit}, in UTC
+   * (e.g. `2026-06-01T12:34:56.000Z`). This is a property of the commit
+   * itself, distinct from {@link InstallMeta.installedAt} (when the local
+   * machine ran the install). `null` for older installs written before commit
+   * timestamps were recorded, or when the date could not be read. Reserved for
+   * the human-readable "version" surfaced by `plugins inspect`; the optional
+   * {@link InstallMeta.version} field stays free for future tag/semver support.
+   */
+  readonly committedAt?: string | null;
   /**
    * Per-file content digest of the materialized tree, captured at install
    * time. `null` for older installs written before fingerprinting; callers
@@ -525,7 +543,11 @@ async function copyExternalViaGit(
   source: PluginFetchSource,
   destDir: string,
   runGit: GitRunner,
-): Promise<{ fileCount: number; commit: string | null }> {
+): Promise<{
+  fileCount: number;
+  commit: string | null;
+  committedAt: string | null;
+}> {
   const cloneDir = `${destDir}.gitclone`;
   rmSync(cloneDir, { recursive: true, force: true });
   mkdirSync(cloneDir, { recursive: true });
@@ -543,7 +565,8 @@ async function copyExternalViaGit(
       // A missing repo/ref (or a private one we can't reach) is a hard
       // not-found, surfaced as zero files. Anything else — network loss, a
       // transient GitHub outage — is retryable, so map it to a 503.
-      if (isGitRefNotFound(err)) return { fileCount: 0, commit: null };
+      if (isGitRefNotFound(err))
+        return { fileCount: 0, commit: null, committedAt: null };
       throw new PluginSourceUnavailableError(
         `git clone failed for ${sourceLabel(source)} @ ${source.ref}: ${subprocessErrorText(err)}`,
         503,
@@ -553,6 +576,7 @@ async function copyExternalViaGit(
     await runGit(["checkout", "--quiet", "FETCH_HEAD"], { cwd: cloneDir });
 
     let commit: string | null = null;
+    let committedAt: string | null = null;
     try {
       const { stdout } = await runGit(["rev-parse", "HEAD"], { cwd: cloneDir });
       commit = stdout.trim() || null;
@@ -560,6 +584,24 @@ async function copyExternalViaGit(
       // Provenance is best-effort; a missing commit must not fail the install.
       commit = null;
     }
+    if (commit) {
+      // The committer date (`%ct`, UNIX seconds) is the version timestamp
+      // `plugins inspect` shows. Normalize to a UTC ISO-8601 string so installs
+      // made in different local timezones remain directly comparable.
+      try {
+        const { stdout } = await runGit(
+          ["show", "-s", "--format=%ct", "HEAD"],
+          { cwd: cloneDir },
+        );
+        const seconds = Number.parseInt(stdout.trim(), 10);
+        if (Number.isFinite(seconds)) {
+          committedAt = new Date(seconds * 1000).toISOString();
+        }
+      } catch {
+        // Best-effort: a missing date must not fail the install.
+        committedAt = null;
+      }
+    }
 
     // Defense in depth: external marketplace refs are full commit SHAs (the
     // manifest schema rejects mutable tags/branches), so the checked-out
@@ -577,11 +619,11 @@ async function copyExternalViaGit(
       ? join(cloneDir, source.rootPath)
       : cloneDir;
     if (!existsSync(srcRoot) || !statSync(srcRoot).isDirectory()) {
-      return { fileCount: 0, commit };
+      return { fileCount: 0, commit, committedAt };
     }
 
     const fileCount = copyTreeSkippingGit(srcRoot, destDir);
-    return { fileCount, commit };
+    return { fileCount, commit, committedAt };
   } finally {
     rmSync(cloneDir, { recursive: true, force: true });
   }
@@ -948,6 +990,8 @@ interface WriteInstallMetaParams {
   readonly source: PluginFetchSource;
   readonly ref: string;
   readonly commit: string | null;
+  /** ISO-8601 committer timestamp of {@link WriteInstallMetaParams.commit} (UTC); null when unknown. */
+  readonly committedAt: string | null;
   readonly fingerprint: Fingerprint;
   readonly contentHash: string;
 }
@@ -985,6 +1029,7 @@ function writeInstallMeta(
     source,
     ref,
     commit,
+    committedAt,
     fingerprint,
     contentHash,
   }: WriteInstallMetaParams,
@@ -1004,6 +1049,7 @@ function writeInstallMeta(
       ref,
     },
     commit,
+    committedAt,
     fingerprint,
   };
   writeFileSync(
@@ -1072,6 +1118,7 @@ export function readInstallMeta(pluginDir: string): InstallMeta | null {
       ref: source.ref,
     },
     commit: typeof obj.commit === "string" ? obj.commit : null,
+    committedAt: typeof obj.committedAt === "string" ? obj.committedAt : null,
     fingerprint: parseFingerprint(obj.fingerprint),
   };
 }

package/src/cli/lib/upgrade-plugin.ts

@@ -81,8 +81,18 @@ export interface PluginUpgradeResult {
   readonly outcome: PluginUpgradeOutcome;
   /** Installed commit before the upgrade; `null` when no provenance was recorded. */
   readonly fromCommit: string | null;
+  /**
+   * ISO-8601 committer timestamp (UTC) of {@link PluginUpgradeResult.fromCommit},
+   * the human-readable version moved from; `null` when it was not recorded.
+   */
+  readonly fromTimestamp: string | null;
   /** Marketplace-pinned commit the install was (or would be) moved to. */
   readonly toCommit: string;
+  /**
+   * ISO-8601 committer timestamp (UTC) of {@link PluginUpgradeResult.toCommit},
+   * the human-readable version moved to; `null` when it could not be resolved.
+   */
+  readonly toTimestamp: string | null;
   /** Absolute path to the installed plugin directory. */
   readonly target: string;
   /** Files materialized by the upgrade; `null` for a no-op or dry run. */
@@ -173,7 +183,9 @@ export async function upgradePlugin(
   }
 
   const fromCommit = local.commit;
+  const fromTimestamp = local.committedAt;
   const toCommit = remote.commit;
+  const toTimestamp = remote.committedAt;
   const provenanceWasUnknown = inspection.status === "unknown-provenance";
 
   if (inspection.status === "up-to-date") {
@@ -181,7 +193,9 @@ export async function upgradePlugin(
       name,
       outcome: "already-up-to-date",
       fromCommit,
+      fromTimestamp,
       toCommit,
+      toTimestamp,
       target: local.target,
       fileCount: null,
       dryRun,
@@ -194,7 +208,9 @@ export async function upgradePlugin(
       name,
       outcome: "would-upgrade",
       fromCommit,
+      fromTimestamp,
       toCommit,
+      toTimestamp,
       target: local.target,
       fileCount: null,
       dryRun: true,
@@ -216,7 +232,9 @@ export async function upgradePlugin(
     name,
     outcome: "upgraded",
     fromCommit,
+    fromTimestamp,
     toCommit: result.commit ?? toCommit,
+    toTimestamp: result.committedAt ?? toTimestamp,
     target: result.target,
     fileCount: result.fileCount,
     dryRun: false,

package/src/config/__tests__/workflows-schema.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, test } from "bun:test";
+
+import { AssistantConfigSchema } from "../schema.js";
+import { WorkflowsConfigSchema } from "../schemas/workflows.js";
+
+describe("WorkflowsConfigSchema", () => {
+  test("empty object parses to full defaults", () => {
+    const parsed = WorkflowsConfigSchema.parse({});
+    expect(parsed).toEqual({
+      maxAgentsPerRun: 500,
+      maxConcurrentLeaves: 6,
+      maxConcurrentRuns: 3,
+      journalRetentionDays: 30,
+    });
+  });
+
+  test("custom values round-trip", () => {
+    const parsed = WorkflowsConfigSchema.parse({
+      maxAgentsPerRun: 100,
+      maxConcurrentLeaves: 12,
+      maxConcurrentRuns: 1,
+      journalRetentionDays: 7,
+    });
+    expect(parsed).toEqual({
+      maxAgentsPerRun: 100,
+      maxConcurrentLeaves: 12,
+      maxConcurrentRuns: 1,
+      journalRetentionDays: 7,
+    });
+  });
+
+  test("rejects non-positive and non-integer values", () => {
+    expect(
+      WorkflowsConfigSchema.safeParse({ maxAgentsPerRun: 0 }).success,
+    ).toBe(false);
+    expect(
+      WorkflowsConfigSchema.safeParse({ maxConcurrentLeaves: -1 }).success,
+    ).toBe(false);
+    expect(
+      WorkflowsConfigSchema.safeParse({ journalRetentionDays: 1.5 }).success,
+    ).toBe(false);
+  });
+
+  test("root config resolves workflow defaults when section is absent", () => {
+    const config = AssistantConfigSchema.parse({});
+    expect(config.workflows.maxAgentsPerRun).toBe(500);
+    expect(config.workflows.maxConcurrentLeaves).toBe(6);
+    expect(config.workflows.maxConcurrentRuns).toBe(3);
+    expect(config.workflows.journalRetentionDays).toBe(30);
+  });
+
+  test("root config applies workflow overrides", () => {
+    const config = AssistantConfigSchema.parse({
+      workflows: { maxConcurrentLeaves: 10 },
+    });
+    expect(config.workflows.maxConcurrentLeaves).toBe(10);
+    // Unspecified leaves still fall back to defaults.
+    expect(config.workflows.maxAgentsPerRun).toBe(500);
+  });
+});