🐛 [Bug] Gateway crashing on plugin initialization due to empty dependencies in isolated package.json (npm v11 / Node v25)

📌 Description

When initializing plugins, OpenClaw creates an isolated package.json for staging bundled runtime dependencies. However, it currently creates a package.json without a dependencies field:

{
  "name": "openclaw-runtime-deps-install",
  "private": true
}

When running with the latest Node v25.6.1 and npm v11, npm's arborist dedupe algorithm fails when parsing dependency trees without explicit versions, throwing a TypeError: Invalid Version: error.
This causes all plugins (telegram, browser, anthropic, etc.) to fail their dependency installation, resulting in a continuous gateway crash/restart loop.

🛠️ Root Cause

In /dist/bundled-runtime-deps-BdEAdjwi.js (or the corresponding source file), the package.json is hardcoded to omit dependencies, and the specs are passed directly via npm CLI arguments. In newer npm versions, building the ideal-tree in an empty package root with CLI specs causes version parsing to crash during deduping.

✅ Proposed Solution (Code Snippet)

Instead of an empty package, parse params.missingSpecs and populate the dependencies field in the generated package.json.

Before:

if (isolatedExecutionRoot) {
  fs.writeFileSync(path.join(installExecutionRoot, "package.json"),
    `${JSON.stringify({name:"openclaw-runtime-deps-install",private:true},null,2)}\n`, "utf8");
}

After:

if (isolatedExecutionRoot) {
  const __deps = {};
  for (const __s of params.missingSpecs) {
    const __i = __s.startsWith("@") ? __s.lastIndexOf("@") : __s.indexOf("@");
    if (__i > 0) __deps[__s.slice(0, __i)] = __s.slice(__i+1);
  }
  fs.writeFileSync(path.join(installExecutionRoot, "package.json"),
    `${JSON.stringify({name:"openclaw-runtime-deps-install",private:true,dependencies:__deps},null,2)}\n`,
    "utf8");
}

💻 Environment

• OS: macOS (Apple Silicon)
• Node: v25.6.1
• npm: v11.x
• OpenClaw version: 2026.4.24

By injecting the specs into the package.json, npm resolves the ideal-tree cleanly without raising the Invalid Version exception. I've tested this patch locally and it completely resolves the crash loop.