Summary

OpenClaw's npm-shrinkwrap.json pins path-to-regexp to ^8.x globally. Express 4.x requires path-to-regexp@~0.1.x. Plugins built on Express 4.x must individually declare "overrides": {"path-to-regexp": "~0.1.12"} in their own package.json to avoid a startup crash. If that override is missing, express.Router() throws SyntaxError at load and all HTTP routes in the plugin fail.

The root cause is that OpenClaw core has no central override covering plugins. Prior fixes patched individual plugins (symptoms), not the mechanism.

Reproduction steps

1. Install OpenClaw 2026.6.9 (npm global).
2. Install any Express 4.x-based plugin that does not include "overrides": {"path-to-regexp": "~0.1.12"} in its package.json.
3. Start the plugin's HTTP server.
4. Observe: SyntaxError: Invalid regular expression: /^\/(?:([^\/]+?))\/?\/?/u

Adding the overrides block to the plugin's package.json and reinstalling resolves the crash.

Expected behavior

OpenClaw core ensures plugins built on Express 4.x receive a compatible path-to-regexp version without requiring each plugin author to manually add overrides.

Actual behavior

Every Express 4.x plugin must independently declare its own path-to-regexp override. The failure mode is silent on install and only manifests at runtime when routes are first accessed.

Proposed fix / approach

Option A (preferred): Add a top-level overrides.path-to-regexp entry in OpenClaw's core npm-shrinkwrap.json or package.json that resolves Express 4.x's ~0.1.x range for the entire install tree. This removes the per-plugin requirement entirely.

Option B: Add a plugin validator that detects Express 4.x dependencies and emits a clear error pointing to the required override if it is absent.

The current per-plugin workaround is the community-documented fallback, not a fix.

Context

• OpenClaw: 2026.6.9
• Node: v24.14.1
• OS: Linux (WSL2, Ubuntu)
• Affected plugin example: @askjo/[email protected]
• The nested-override mechanism works correctly when present; this is a packaging oversight.