PR #70462: fix(plugin-sdk): symlink openclaw peerDependencies after plugin install

• Repository: openclaw/openclaw
• Author: anishesg
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/70462

Description (problem / solution / changelog)

Summary

• Plugins that declare openclaw as a peerDependency fail at runtime with Cannot find package 'openclaw' because npm never materialises peerDependencies automatically during npm install --omit=dev.
• The root cause is in src/plugins/install.ts: installPluginFromPackageDir only inspects manifest.dependencies when deciding whether to run npm install (hasDeps) and has no post-install logic to satisfy peerDependencies.
• Added linkOpenClawPeerDependencies — a post-install step that reads the plugin's peerDependencies, finds the host openclaw package root via resolveOpenClawPackageRootSync, and symlinks the matching package into the plugin's node_modules/.
• Updated hasDeps to be true when peerDependencies is non-empty so that npm install still runs (and therefore the staged directory is prepared) even for plugins with no regular dependencies.
• Extended the PackageManifest local type to include peerDependencies?: Record<string, string> so the field is read from the plugin's package.json.

Change Type

• Bug fix

Scope

• Integrations

Linked Issue/PR

Closes #70436

• This PR fixes a bug or regression

Root Cause

Between plugin versions (e.g. dingtalk-connector v0.8.16 → v0.8.18) openclaw was moved from dependencies to peerDependencies. npm does not install peerDependencies in production installs, and the global openclaw directory is not on the plugin's Node.js module resolution path, so the plugin's bundled runtime cannot import openclaw at startup.

Regression Test Plan

Unit: the linkOpenClawPeerDependencies function is pure async logic operating on fs — an existing test fixture in src/infra/install-package-dir.test.ts (which already mocks fs) is the smallest seam to extend. The function is also exercised end-to-end whenever openclaw plugins install is run with a plugin whose package.json declares openclaw in peerDependencies.

User-visible / Behavior Changes

After openclaw plugins install, a symlink <plugin>/node_modules/openclaw → <host-root> is created when the plugin declares openclaw as a peerDependency. No behavior change for plugins that do not declare the peerDependency.

Diagram

N/A

Security Impact

• No new permissions
• No secrets handling
• No new network calls
• No new command execution
• Data access scope: symlink creation is scoped to the plugin's own node_modules/ subdirectory within the extensions dir

Repro + Verification

Environment: macOS arm64, Node 20, openclaw 2026.4.21 (global npm install)

Steps:

1. openclaw plugins install @dingtalk-real-ai/dingtalk-connector
2. Start a DingTalk channel
3. Before fix: Cannot find package 'openclaw' imported from .../runtime-CAQ2GHj-.mjs
4. After fix: plugin starts successfully; node_modules/openclaw symlink is present in the plugin directory

Evidence

Error from issue: Cannot find package 'openclaw' imported from /Users/zhouxia/.openclaw/extensions/dingtalk-connector/dist/runtime-CAQ2GHj-.mjs

After fix, the plugin directory contains node_modules/openclaw -> /opt/homebrew/lib/node_modules/openclaw.

Human Verification

Verified: logic paths for missing peerDependencies field (empty object fallback), missing host root (warn + continue), idempotent re-install (rm before symlink), and plugins with no openclaw peerDependency (early return). Did not verify Windows junction semantics end-to-end on a live Windows machine.

Review Conversations

• I have replied to or resolved all bot review conversations

Fixes #70436 Closes #54428

Changed files

• src/plugins/install.test.ts (modified, +104/-0)
• src/plugins/install.ts (modified, +85/-4)