sf plugins install <tarball-url> overwrites last plugin entry instead of creating new one

[scolladon]

Description

When running sf plugins install <tarball-url> (installing a plugin from a GitHub release tarball URL), the command overwrites the last entry in ~/.local/share/sf/package.json's oclif.plugins array instead of creating a new entry with the correct package name.

The npm package files are installed correctly in node_modules/, but the oclif plugin registry entry retains the previous plugin's name, so the installed plugin is never recognized by sf.

Steps to reproduce

1. Have an sf CLI installation with existing user plugins
2. Run: sf plugins install https://github.com/scolladon/sfdx-git-delta/releases/download/dev-pr-1266/sfdx-git-delta-dev-pr-1266.tgz
3. Check ~/.local/share/sf/package.json

Expected behavior

A new entry should be added to oclif.plugins:

{
  "name": "sfdx-git-delta",
  "type": "user",
  "url": "https://github.com/scolladon/sfdx-git-delta/releases/download/dev-pr-1266/sfdx-git-delta-dev-pr-1266.tgz"
}

Actual behavior

The last existing entry in oclif.plugins is overwritten with the URL but retains the old plugin's name:

{
  "name": "@j-schreiber/sf-cli-security-audit",  // <-- wrong name, was the last entry before install
  "type": "user",
  "url": "https://github.com/scolladon/sfdx-git-delta/releases/download/dev-pr-1266/sfdx-git-delta-dev-pr-1266.tgz"
}

The actual package files (sfdx-git-delta) ARE correctly installed in node_modules/, but sf doesn't recognize the plugin because the registry name is wrong.

Notes

• This does NOT happen in CI with a fresh sf CLI installation (no pre-existing user plugins) — the first entry is created correctly.
• Reproduced with @salesforce/cli@2.128.5, @oclif/plugin-plugins@5.4.58, Node v22.21.1, macOS arm64.
• Tested multiple times — consistently overwrites the last entry regardless of which plugin it is.

[jfeingold35]

@scolladon , are you sure the URL is right? When I run that command, I get an error about the package name not being valid.

[scolladon]

Hi @jfeingold35 !
Yes the url does not exist anymore. I build that for a PR and then removed it after merging the PR...

I can generate a new one if you need

[jfeingold35]

@scolladon , yes, please do.

[scolladon]

Here it is !

sf plugins install https://github.com/scolladon/sfdx-git-delta/releases/download/dev-pr-1270/sfdx-git-delta-dev-pr-1270.tgz

[jfeingold35]

@scolladon , thanks. That downloads, and I'm able to reproduce the bug. I'll get it logged and prioritized appropriately on our backlog.

[jfeingold35]

Logged as W-21915680

[jfeingold35]

@scolladon , I'm struggling to reliably reproduce this with other plugins, so since we know we can reproduce it with yours, could you create a branch release and then keep it available for a while, so I can use it to debug?
EDIT: Never mind, I've got it easily reproducible. I'll try to get this fixed ASAP and I'll provide updates as and when they become available.