Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

The runtime-deps mirror manifest at ~/.openclaw/plugin-runtime-deps/openclaw-<version>/.openclaw-runtime-deps.json is missing 9 packages that the dist code does import x from 'pkg' for. They never get installed into the mirror, so when a dist code path that imports them is exercised, Node fails resolution: Cannot find package 'X' imported from ~/.openclaw/plugin-runtime-deps/openclaw-.../dist/....

This is a follow-up to #71420 — that fix shipped (and 2026.4.26 added chokidar to the manifest, fixing the qmd-manager symptom we hit), but the manifest still does not match the actual set of bare-imports in dist.

Steps to reproduce

cd ~/.npm-global/lib/node_modules/openclaw/dist
grep -rh '^import .* from "[^./n]' *.js | grep -oE 'from "[^"]+"' | sort -u
# compare each top-level package against .specs[] of:
# ~/.openclaw/plugin-runtime-deps/openclaw-<ver>/.openclaw-runtime-deps.json

On 2026.4.26 the following packages are imported by dist but absent from the manifest:

• @agentclientprotocol/sdk
• croner
• dotenv
• jiti
• json5
• jszip
• markdown-it
• tar
• web-push

All 9 are listed as direct dependencies in the openclaw npm package.json (so they exist at ~/.npm-global/lib/node_modules/openclaw/node_modules/<pkg>), but the mirror tree under ~/.openclaw/plugin-runtime-deps/.../node_modules/ does not get them — Node only walks up from the importing file's location, and the npm-global tree isn't on that path, so resolution fails.

Concrete prior failure (now fixed for chokidar specifically):

Cannot find package 'chokidar' imported from ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.25-.../dist/qmd-manager-FuXCtSYP.js

The 9 above will surface the same error class when their code paths run.

Expected behavior

Every package the dist code imports as a bare specifier should be present in the mirror, either by being listed in .openclaw-runtime-deps.json (so the runtime installer adds it) or by being installed alongside the manifest specs.

Actual behavior

The manifest is hand-curated and drifts behind dist's actual imports. After updating from 2026.4.25 → 2026.4.26 a fresh 2026.4.26-... mirror dir is created and 9 packages remain absent.

OpenClaw version

2026.4.26 (be8c246)

Operating system

Linux 6.8.0-110-generic

Install method

npm global

Model

anthropic/claude-opus-4-7

Provider / routing chain

openclaw -> anthropic

Additional provider/model setup details

Not provider-specific. Reproducible from a vanilla npm-global install of 2026.4.26 against a fresh mirror dir.

Logs, screenshots, and evidence

Original failure on 2026.4.25 (chokidar branch, since fixed):

[memory] qmd memory unavailable; falling back to builtin: Cannot find package 'chokidar' imported from ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.25-.../dist/qmd-manager-FuXCtSYP.js
[gateway] qmd memory startup initialization failed for agent "main": Cannot find package 'chokidar' imported from ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.25-.../dist/manager-...js

Manual workaround that resolved the live incident (replicate per missing package):

cd ~/.openclaw/plugin-runtime-deps/openclaw-<version>
xargs -a /tmp/all-specs.txt npm install --no-save
# where /tmp/all-specs.txt is the manifest specs PLUS the 9 missing packages
# at versions read from the npm-global package.json

Impact and severity

Affected: any user on 2026.4.26 (and likely earlier) whose plugin/code path exercises one of the 9 imports (e.g. cron scheduling → croner, push notifications → web-push, archive/backup → tar, dotenv-driven config → dotenv).
Severity: variable — module-not-found at first reach; in our case it cascaded into a gateway restart loop because the failing module was on the qmd-memory startup path.
Frequency: every fresh install / version upgrade until the manifest catches up.
Consequence: feature failure or, for hot-path imports, gateway-level outage.

Additional information

Suggested fix: derive the manifest from a static analysis of dist bare-imports during the build pipeline, so the two cannot drift. Sketch:

grep -rh '^import .* from "[^./n]' dist/*.js \
  | grep -oE 'from "[^"]+"' \
  | sed -E 's|from "(@[^/]+/[^/]+).*"|\1|; s|from "([^/"]+).*"|\1|' \
  | sort -u

…then resolve each to a version from the openclaw package.json's dependencies and write them to .openclaw-runtime-deps.json at build time.