openclaw - 💡(How to fix) Fix install.sh still fails under npm min-release-age because freshness bypass emits --before [1 pull requests]

Summary

The hosted installer still fails when the user's npm config contains min-release-age, even after the npm freshness fixes in #82641 / #83761.

The installer detects npm's computed before value and then invokes npm with --before=<now>, but npm still sees min-release-age from the npmrc file and exits before config resolution:

Exit prior to config file resolving
cause
--min-release-age cannot be provided when using --before

Environment

• OpenClaw installer: curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
• Installer selected: [email protected]
• OS: macOS arm64
• Node: v26.0.0
• npm: 11.12.1
• Install shape: global npm install
• npm config: release-age quarantine enabled via npmrc

Actual behavior

The hosted installer runs a command shaped like:

env -u NPM_CONFIG_BEFORE -u npm_config_before -u NPM_CONFIG_MIN_RELEASE_AGE -u npm_config_min_release_age -u npm_config_min-release-age \
  SHARP_IGNORE_GLOBAL_LIBVIPS=1 \
  npm --loglevel error --silent --no-fund --no-audit \
  --before=2026-05-21T00:20:45.000Z \
  install -g openclaw@latest

npm exits with:

Exit prior to config file resolving
cause
--min-release-age cannot be provided when using --before

Expected behavior

OpenClaw-managed installer npm calls should bypass npm freshness quarantine without emitting a mutually-exclusive npm config combination.

For npmrc files containing min-release-age, the installer should not convert the computed before value into a --before=<now> CLI argument. It should use a bypass that does not conflict with the original npmrc policy, or otherwise isolate/override npm config in a way npm accepts.

Source inspection

Current hosted installer, current main, and v2026.5.19 all have the same shell logic:

min_release_age="$(env -u NPM_CONFIG_BEFORE -u npm_config_before npm config get min-release-age 2>/dev/null || true)"
if [[ -z "$min_release_age" || "$min_release_age" == "null" || "$min_release_age" == "undefined" ]]; then
    before_value="$(env -u NPM_CONFIG_MIN_RELEASE_AGE -u npm_config_min_release_age -u npm_config_min-release-age npm config get before 2>/dev/null || true)"
    if [[ -n "$before_value" && "$before_value" != "null" && "$before_value" != "undefined" ]]; then
        freshness_flag="--before=$(date -u '+%Y-%m-%dT%H:%M:%S.000Z')"
    fi
fi

With npm 11.12.1, npm config get min-release-age can return null while npm config get before returns a computed cutoff from the raw min-release-age npmrc setting. That makes the installer choose --before, but npm still rejects the invocation because the underlying npmrc still contains min-release-age.

The TypeScript helper in src/infra/npm-install-env.ts already avoids this class by scanning raw npmrc files for min-release-age before choosing the bypass mode. The shell installer scripts appear not to have the equivalent raw npmrc detection.

Isolated reproduction

cat > /tmp/openclaw-npmrc-freshness-test <<'EOF'
min-release-age=7
EOF

npm --userconfig=/tmp/openclaw-npmrc-freshness-test config get min-release-age
# null

npm --userconfig=/tmp/openclaw-npmrc-freshness-test config get before
# computed date

npm --userconfig=/tmp/openclaw-npmrc-freshness-test \
  --before=2026-05-21T00:20:45.000Z \
  config get before
# Exit prior to config file resolving
# cause
# --min-release-age cannot be provided when using --before

Related

• #82630
• #82641
• #83761
• npm docs say before and min-release-age are mutually exclusive.