openclaw - 💡(How to fix) Fix Gateway repeatedly triggers npm install into HOME/node_modules due to leftover package.json in home directory, causing startup loop and pollution [2 comments, 2 participants]

Describe the bug After upgrading Openclaw, the gateway process enters a restart loop. Each time it starts, it triggers a massive npm install command (installing @anthropic-ai/sdk, @aws-sdk/*, express, playwright-core, etc.) directly into $HOME/node_modules. This floods the home directory with node modules, makes the gateway unstable, and creates a spinning CPU/disk cycle.

To Reproduce

1. Have a package.json file present in $HOME (created unintentionally by a prior npm init or tool).
2. Install/upgrade Openclaw and try to run openclaw gateway from the home directory (cd ~ && openclaw gateway).
3. Observe that the gateway spawns an npm install process that targets ~/node_modules.
4. The installation fails/conflicts, the gateway exits, and the shell (or user) restarts it, triggering the same install again.
5. Process repeats; ~/node_modules is continuously populated.

Expected behavior

• Plugin runtime dependencies should be installed in a dedicated cache directory (e.g., ~/.openclaw/plugin-runtime-deps) and never pollute the user home directory or the current working directory.
• The gateway should not treat the user home directory as a valid npm project, even if a package.json happens to exist there.
• If an installation fails, the gateway should report a clear error and not silently restart.

Environment

• OS: macOS (also likely reproducible on Linux)
• Openclaw version: 2026.4.24 (upgraded from previous)
• Node.js version: v22.22.0 (via nvm)
• npm version: 10.9.4
• Shell: zsh
• Presence of ~/package.json: yes

Screenshots / Logs

21:57:02 [channels] failed to load bundled channel feishu: npm error code ENOTEMPTY
npm error syscall rename
npm error path /Users/lr/node_modules/hono
npm error dest /Users/lr/node_modules/.hono-XAvmAQXm
npm error errno -66
npm error ENOTEMPTY: directory not empty, rename ...

ps aux | grep \"npm install\"
npm install @anthropic-ai/[email protected] @anthropic-ai/vertex-sdk@^0.16.0 ... (very long list)

Possible root cause

• OpenClaw plugin dependency installation uses npm install without explicitly setting a --prefix or working directory, so npm inherits the current working directory.
• If the gateway is started from $HOME and a package.json exists there, npm treats $HOME as a project root and installs everything into $HOME/node_modules.
• When installation conflicts occur (e.g., ENOTEMPTY), the gateway fails, prompting a restart, which re-triggers the same installation, forming an endless loop.

Workaround

1. Kill all OpenClaw processes: pkill -9 -f openclaw-gateway pkill -9 -f openclaw
2. Remove the unintended package.json: rm ~/package.json
3. Remove contaminated directories: rm -rf ~/node_modules ~/.openclaw/plugin-runtime-deps
4. Always start the gateway from a dedicated runtime directory, not $HOME: mkdir -p ~/.openclaw/runtime cd ~/.openclaw/runtime openclaw gateway

Suggested fixes

1. Enforce a dedicated plugin dependency directory - all npm install calls should use an absolute path (e.g., $HOME/.openclaw/plugin-runtime-deps) via --prefix, and never rely on cwd.
2. Add startup checks - warn or refuse to start if cwd equals $HOME, or if a package.json exists in cwd that does not belong to OpenClaw.
3. Avoid restart loops on dependency failure - if plugin installation fails, surface the error and stop instead of continuously retrying.
4. Keep the gateway working directory separate from user home - either internally chdir to a safe location or clearly document that gateway must not be launched from $HOME.

Additional context This issue was discovered after upgrading; earlier versions may not have installed such a large set of dependencies at runtime, or the user home directory did not previously contain an unrelated package.json. Many users may inadvertently have a package.json in their home from various tutorials or experiments, so this could be a common footgun.