openclaw - 💡(How to fix) Fix [Bug]: @vector-im/matrix-bot-sdk missing from dependencies in all 2026.5.x releases (Matrix bridge crash-loops on install)

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Across all published 2026.5.x releases (2026.5.22, .24, .26, .27 latest, 2026.5.28-beta.1), @vector-im/matrix-bot-sdk is missing from the package's declared dependencies, causing the Matrix bridge to crash-loop on a clean npm install -g.

Steps to reproduce

1. mkdir openclaw-sandbox && cd openclaw-sandbox && npm init -y
2. npm install [email protected]
3. Verify the SDK is absent:
   • ls node_modules/openclaw/node_modules/@vector-im → not found
   • ls node_modules/@vector-im → not found
4. (Optional, no install) confirm via the registry:
   • npm view [email protected] dependencies --json | grep -i matrix
   • Returns no matrix-bot-sdk; only ./plugin-sdk/matrix (in-tree path under exports, not a runtime dep)
5. Compare against last known good:
   • npm view [email protected] dependencies --json | grep -i matrix
   • Returns matrix-js-sdk: 41.3.0 and @matrix-org/matrix-sdk-crypto-wasm: 18.0.0

Expected behavior

@vector-im/matrix-bot-sdk (or whichever SDK the 2026.5.x Matrix bridge imports at runtime) resolves from node_modules after a clean global install, so the Matrix bridge starts without MODULE_NOT_FOUND. In 2026.4.14 the corresponding SDKs (matrix-js-sdk and @matrix-org/matrix-sdk-crypto-wasm) are declared and resolve cleanly.

Actual behavior

@vector-im/matrix-bot-sdk is absent from every 2026.5.x release's dependencies, bundledDependencies, peerDependencies, and optionalDependencies. Sandbox install of 2026.5.22 on 2026-05-28 confirmed both node_modules/openclaw/node_modules/@vector-im and node_modules/@vector-im are not created. Same shape verified statically via npm view for 2026.5.22, 2026.5.24, 2026.5.26, 2026.5.27, and 2026.5.28-beta.1.

OpenClaw version

2026.5.27 (current latest); also reproduced on 2026.5.22, 2026.5.24, 2026.5.26, 2026.5.28-beta.1

Operating system

Windows 11 Pro 10.0.26200

Install method

npm global (npm install -g openclaw@<version>); also verified statically via npm view against the published registry tarballs

Model

N/A — packaging-time bug, occurs before any model is invoked

Provider / routing chain

N/A — packaging-time bug, occurs before any request is dispatched

Additional provider/model setup details

No response

Logs, screenshots, and evidence

$ npm view [email protected] dependencies --json | grep -i matrix
(no matrix-bot-sdk — full --json output contains only "./plugin-sdk/matrix" under "exports", which is an in-tree path, not a runtime dep)

$ npm view [email protected] dependencies --json | grep -i matrix
  "matrix-js-sdk": "41.3.0",
  "@matrix-org/matrix-sdk-crypto-wasm": "18.0.0"

$ npm view [email protected] bundledDependencies bundleDependencies peerDependencies optionalDependencies
{ 'sqlite-vec': '0.1.9' }
(only optionalDependencies has an entry; no matrix-bot-sdk in any of the four fields)

Sandbox install (2026-05-28, 2026.5.22 tarball, fresh npm project):
$ Test-Path "$sandbox\node_modules\openclaw\node_modules\@vector-im\matrix-bot-sdk"  # False
$ Test-Path "$sandbox\node_modules\@vector-im\matrix-bot-sdk"                          # False

Impact and severity

Affected: anyone running a fresh npm install -g [email protected] who relies on the Matrix bridge. Severity: high — Matrix bridge crash-loops on first boot; install reports success, failure only surfaces at runtime. Frequency: 5/5 published 2026.5.x versions tested (2026.5.22, 2026.5.24, 2026.5.26, 2026.5.27, 2026.5.28-beta.1). Consequence: forces users on 2026.4.14 to stay pinned, or to manually npm install @vector-im/matrix-bot-sdk into the global openclaw dir — brittle and undocumented.

Additional information

Last known good: 2026.4.14 (declares [email protected] + @matrix-org/[email protected]). First known bad in this regression window: 2026.5.22 (also affects 2026.5.24, 2026.5.26, 2026.5.27 latest, 2026.5.28-beta.1 beta).

Looks like the same packaging-omission class as #54760 (WASM crypto deps missing from dist). Likely candidates:

1. @vector-im/matrix-bot-sdk is listed only in devDependencies of the source repo and the publish pipeline assumes it'll be bundled but doesn't copy it.
2. A pnpm workspace symlink in source doesn't get rewritten into a runtime dep on publish.
3. A bundledDependencies entry was removed/forgotten in a 2026.5.x packaging refactor.

Suggested fix: add @vector-im/matrix-bot-sdk to dependencies (or bundledDependencies) for the next 2026.5.x patch release, and gate publishing on an install-time smoke check that the SDK is resolvable from the dist.

Related: #28370, #36501, #41431, #54760, #61787 — same packaging-omission class across prior versions. #87307 — different bug, same affected version line.