Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

Installing a scoped plugin package through the ClawHub-first openclaw plugins install <package> flow can fail locally with ENOENT because the temporary archive path is built from the raw scoped package name.

Steps to reproduce

1. Install OpenClaw 2026.3.24.
2. Run:

openclaw plugins install @soimy/dingtalk

3. Observe an error like:

ENOENT: no such file or directory, open '/tmp/openclaw-clawhub-package-XXXXXX/@soimy/dingtalk.zip'

Expected behavior

OpenClaw should download the ClawHub archive and write it to a valid temporary file path for scoped package names such as @scope/name.

Actual behavior

OpenClaw resolves the package from ClawHub, then fails before extraction when it tries to open a temporary path that includes the scoped package slash as a directory separator.

OpenClaw version

2026.3.24

Operating system

macOS and Ubuntu 22.04

Install method

npm global

Model

N/A (plugin install path; no model request involved)

Provider / routing chain

N/A (plugin install path; no provider/model routing involved)

Additional provider/model setup details

N/A

Logs, screenshots, and evidence

openclaw plugins install @soimy/dingtalk
Resolving clawhub:@soimy/dingtalk…
ClawHub code-plugin @soimy/dingtalk@3.4.2 channel=community verification=source-linked
Compatibility: pluginApi=>=2026.3.14
ClawHub package "@soimy/dingtalk" is community; review source and verification before enabling.
ENOENT: no such file or directory, open '/var/folders/.../openclaw-clawhub-package-XXXXXX/@soimy/dingtalk.zip'

A second user reported the same failure on Ubuntu 22.04 with:

ENOENT: no such file or directory, open '/tmp/openclaw-clawhub-package-XXXXXX/@soimy/dingtalk.zip'

Current main still constructs the temporary archive path as:

const archivePath = path.join(tmpDir, `${params.name}.zip`);

in src/infra/clawhub.ts, which means a scoped package name like @soimy/dingtalk becomes <tmpDir>/@soimy/dingtalk.zip.

Impact and severity

Affected users/systems/channels: Users installing scoped ClawHub plugin packages through openclaw plugins install <package>
Severity: High (blocks installation)
Frequency: Observed on both macOS and Ubuntu 22.04 with the same install command
Consequence: New installs fail before extraction, so affected plugins cannot be installed from the documented ClawHub-first path

Additional information

This looks distinct from #55805. In this case, ClawHub package resolution succeeds and the failure happens later when OpenClaw builds the local archive path for a scoped package name.