Description

postinstall-bundled-plugins.mjs fails silently when the container image lacks an SSH client (openssh-client). Some transitive dependencies use git+ssh:// URLs (e.g., whiskeysockets/libsignal-node). When SSH is unavailable, the postinstall catches the error and continues, leaving critical runtime dependencies like @buape/carbon, @slack/web-api, etc. missing.

The gateway then crashes at runtime with Cannot find module '@buape/carbon' on every HTTP request.

Repro

# In a container without openssh-client
npm install -g openclaw@latest
cd /usr/local/lib/node_modules/openclaw
npm ls @buape/carbon  # reports empty
openclaw gateway --port 18789  # crashes

Root cause

The postinstall script uses npm to install missing deps, but some transitive deps reference SSH URLs. Without SSH, npm fails. The error is caught (non-fatal by design in runBundledPluginPostinstall) and the gateway starts without these packages.

Workaround

Install git, ca-certificates, and rewrite SSH URLs to HTTPS before npm install -g openclaw:

RUN apt-get install -y git ca-certificates && \
    git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" && \
    npm install -g openclaw@latest

Suggestion

Either vendor these deps in the published package, use HTTPS URLs instead of SSH, or make the postinstall error more visible (e.g., log a warning that persists to gateway startup).

Related: #62749