openclaw - 💡(How to fix) Fix Bundled runtime dependency staging should create an isolated package root before npm install [1 comments, 2 participants]

Summary

OpenClaw's bundled runtime dependency staging can run npm install from a staging directory that has no root package.json. npm then walks upward, finds an unrelated parent package.json, and installs that project’s dependencies instead of an isolated minimal runtime dependency set.

In one local incident, npm walked up to an unrelated parent package.json, pulled unrelated dependencies, and starved the OpenClaw gateway during startup/runtime dependency preparation.

Observed behaviour

A bundled runtime dependency install was started from a directory without a local package.json. npm resolved package context from a parent directory outside the OpenClaw runtime staging area.

Result:

• unrelated parent dependencies were installed/pulled
• gateway startup/resources were badly impacted
• the chat surface appeared stuck until the dependency staging issue was patched and gateway restarted

Expected behaviour

Runtime dependency staging should be hermetic. It should never rely on npm walking upward to discover a parent package root.

The staging directory should contain its own minimal package.json before any npm install / dependency install command is run, or npm should be invoked in a way that cannot inherit an unrelated parent project.

Why this matters

This can be triggered by local directory layout and is hard to diagnose because the visible symptom looks like a model/runtime wedge rather than an npm package-root leak. It also makes OpenClaw behaviour non-deterministic across hosts depending on what happens to exist in parent directories.

Local mitigation tested

A local runtime patch creates/uses an isolated package root in the runtime staging directory before dependency installation. Runtime deps were then preinstalled into that staging directory. After gateway restart, startup improved and openclaw health --json returned live/ready.

Suggested fix

Before dependency installation, ensure the staging directory has an explicit minimal package root, for example:

{
  "private": true,
  "type": "module"
}

Then run npm with cwd set to that staging directory and avoid any upward package-root resolution. A startup/debug log line showing the resolved install root would also make this easier to diagnose.

Environment

• OpenClaw installed via package manager
• Host OS: macOS arm64