openclaw - 💡(How to fix) Fix openclaw configure: Matrix dependency install destroys global npm prefix [2 comments, 2 participants]

Summary

Running openclaw configure and choosing the Matrix channel destroys the user's entire npm-global directory. The Matrix dependency installer spawns npm install matrix-js-sdk @matrix-org/matrix-sdk-crypto-nodejs @matrix-org/matrix-sdk-crypto-wasm without -g and with cwd set to the npm prefix's lib/ directory. On any system where that directory has no package.json (the default layout for npm config set prefix users), npm 11+ treats the prefix as a fresh project, writes a new lockfile containing only the Matrix packages, and prunes every other globally installed package — including openclaw itself and any other global CLI the user had installed.

The CLI then misreports the outcome as Error: Matrix dependency install failed. even though npm itself exited 0. Looks like openclaw's post-install verification fails because openclaw no longer exists on disk to verify against.

Environment

• openclaw 2026.5.7 (commit eeef486)
• npm 11.12.1
• node 25.9.0
• Linux (Debian-based LXC)
• npm prefix: ~/.npm-global (npm config set prefix ~/.npm-global)
• No package.json at ~/.npm-global/lib/ (standard for user-prefix layouts)

Steps to reproduce

1. Configure a user-local npm prefix and install at least one other global alongside openclaw, e.g.:

   npm config set prefix ~/.npm-global
   npm install -g openclaw @anthropic-ai/claude-code

2. Run openclaw configure.
3. Select Channels → Configure/link → Matrix (plugin).
4. Accept the prompt to install Matrix dependencies.

Expected

Matrix SDKs are installed alongside other globals. Existing global packages — including openclaw itself — remain intact.

Actual

• ~/.npm-global/lib/package-lock.json is created from scratch with only matrix-js-sdk, @matrix-org/matrix-sdk-crypto-nodejs, and @matrix-org/matrix-sdk-crypto-wasm in the dependency tree.
• ~/.npm-global/lib/node_modules/ is pruned to only those packages.
• openclaw, @anthropic-ai/claude-code, and any other previously globally-installed package are deleted from disk.
• Their bin symlinks (~/.npm-global/bin/openclaw, ~/.npm-global/bin/claude, …) become dangling.
• CLI output is:

  matrix: installing dependencies via npm (/home/<user>/.npm-global/lib/node_modules)…
  Error: Matrix dependency install failed.

  This message is misleading — npm itself succeeded with exit 0; the failure is openclaw's own post-install verification finding it no longer exists.

Likely root cause

The Matrix dependency installer spawns npm with cwd set to a path inside the global prefix (<prefix>/lib/ or <prefix>/lib/node_modules/) and without -g. With no existing package.json at that cwd, npm 11 creates a new project there and prunes node_modules to match the new lockfile.

Suggested fix

Either:

1. Pass -g to the spawned npm install, so npm's standard global resolution applies; or
2. Install plugin dependencies into a properly isolated location under ~/.openclaw/plugins/ (or wherever openclaw plugins live), so plugin deps don't share a namespace with the user's other globals at all. This is more invasive but avoids future foot-guns of the same shape.

Option 2 is probably the right long-term answer — a CLI tool generally shouldn't be writing into the user's npm install -g namespace at all.

Severity

High. Silent destruction of unrelated globally-installed packages on the standard Linux user-prefix layout. Recovery requires the user to know what was previously installed and reinstall each manually. The misleading error message actively impedes root-cause diagnosis.