v2026.4.27: plugin-runtime-deps tarball is missing the chokidar dependency, breaking all CLI subcommands at first import

Summary

After a fresh install of [email protected], the gateway boots and runs cleanly, but every CLI subcommand that hits the plugin manager (e.g. openclaw memory promote) fails immediately with ERR_MODULE_NOT_FOUND: Cannot find package 'chokidar'. The bundled manager-jzSMQjEt.js inside the v4.27 runtime-deps tree imports chokidar at top level, but the runtime-deps package.json does not declare it. Workaround is a one-liner (npm install chokidar inside the runtime-deps dir); proper fix is to add chokidar to the runtime-deps' dependencies block upstream.

The gateway is unaffected — it preloads its own dependency tree at startup before any CLI subcommand is run, so the import resolves through a different code path. Only the CLI surface is broken, but that surface includes operator-facing commands like openclaw memory promote, openclaw doctor (partially), and likely anything else that uses the plugin manager directly.

Environment

• OpenClaw: 2026.4.27 (cbc2ba0), installed via sudo npm install -g [email protected] (in-place upgrade from 2026.4.24).
• Node: 22.22.2.
• OS: Ubuntu 24.04.4 LTS, Linux 6.8.0-106-generic.
• Plugins enabled: memory-core, memory-wiki, telegram plus stock defaults.
• Single-user host install; no rootless / podman / non-default Node config.

Steps to reproduce

1. From any prior openclaw@<x> install (or fresh box), run sudo npm install -g [email protected].
2. Wait for the post-install plugin-runtime-deps cache to land at ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.27-<hash>/.
3. Run any CLI subcommand that walks the plugin manager:

   openclaw memory promote --json

4. Observe the error.

Expected behavior

openclaw memory promote --json returns ranked candidates as JSON (or { "candidates": [], "audit": {…} } if there are none).

Actual behavior

[openclaw] Failed to start CLI: Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'chokidar' imported from /home/openclaw/.openclaw/plugin-runtime-deps/openclaw-2026.4.27-4eca5026e977/dist/manager-jzSMQjEt.js
Did you mean to import "chokidar/index.js"?
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:314:9)
    at packageResolve (node:internal/modules/esm/resolve:768:81)
    at moduleResolve (node:internal/modules/esm/resolve:855:18)
    at defaultResolve (node:internal/modules/esm/resolve:985:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:731:20)
    at ModuleLoader.resolve (node:internal/modules/esm/loader:708:38)
    at ModuleLoader.getModuleJobForImport (node:internal/modules/esm/loader:310:38)
    at ModuleJob._link (node:internal/modules/esm/module_job:182:49)

CLI exits with non-zero status before printing any JSON.

Diagnostic evidence

The runtime-deps package.json declares 35 dependencies; chokidar is not among them.

$ cat ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.27-*/package.json \
    | jq '{ name, deps_count: (.dependencies | length), chokidar: (.dependencies.chokidar // "NOT LISTED") }'
{
  "name": "openclaw-runtime-deps-install",
  "deps_count": 35,
  "chokidar": "NOT LISTED"
}

The bundled module that imports chokidar:

$ grep -E "from\s+['\"]chokidar['\"]|require\(['\"]chokidar['\"]" \
    ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.27-*/dist/manager-*.js

(Match expected on a from "chokidar" import line — this is what the resolver fails on at runtime.)

The gateway side, which preloads its own deps before serving any request, is unaffected: openclaw doctor, openclaw sandbox explain, openclaw cron list, and the WebSocket agent dispatch all work fine. Only commands that go through manager-*.js from the CLI entrypoint blow up.

Workaround

One-liner inside the runtime-deps dir:

cd ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.27-*/
npm install chokidar

After this, openclaw memory promote --json (and any other affected CLI subcommand) returns clean JSON immediately. No gateway restart required.

The workaround is not durable: every future openclaw@<x> upgrade replaces the runtime-deps dir, and openclaw doctor --fix may also regenerate it. Re-apply after each.

Suggested fix

Add chokidar (matching the version range used by the bundled file — likely the same as the gateway's bundled chokidar) to the dependencies block of the openclaw-runtime-deps-install package whose package.json lives at ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.27-<hash>/package.json. Whatever script generates that package.json upstream needs to include chokidar in the deps list — likely a missed entry when manager-*.js was refactored to import it directly.

Severity

Medium-high. Doesn't crash the gateway and doesn't lose data, but silently breaks every CLI subcommand that uses the plugin manager — which includes openclaw memory promote (the canonical way an operator manually drives the dreaming pipeline outside of the nightly cron), and likely a long tail of other operator commands. Anyone upgrading to v4.27 hits this on first CLI invocation. Workaround is one line, so this is not "high" — but it's the kind of regression that erodes trust in the upgrade flow and should ship a fix in v4.27.x or v4.28.