Summary

Fixes the beta update/plugin install path where npm install in the shared OpenClaw npm root could prune peer dependencies used by existing plugins.

The concrete reported failure was a custom plugin depending on @lancedb/lancedb; LanceDB declares apache-arrow as a peer dependency, and a later beta plugin install/update could remove apache-arrow, causing the custom plugin to fail loading.

This change:

• discovers and preserves third-party peer dependencies in the managed npm root
• tracks only peer dependencies OpenClaw actually owns
• avoids marking existing root plugin dependencies as managed peers
• scans repaired/materialized peer packages instead of silently trusting them
• rolls back managed peer dependency mutations on failed installs
• bounds peer discovery traversal to avoid symlink/cycle/unbounded scan issues

Verification

Post-rebase sanity:

git diff --check origin/main..HEAD

Live CLI checks were run against the same four-commit patch stack before the final clean rebase:

• Built and installed a packed CLI from the patch stack: OpenClaw 2026.5.12-beta.1 (8aeb0b8).
• Installed an existing root plugin, then attempted a plugin whose peers included that existing root plugin plus a dangerous peer.
  • install failed with the expected security scan block
  • existing root plugin stayed installed/listed
  • existing root plugin was not marked as a managed peer
  • blocked plugin and dangerous peer were not left in dependencies, on disk, or managed metadata
• Installed a safe plugin with a missing peer.
  • missing peer was materialized
  • peer stayed tracked in managedPeerDependencies
• Ran real plugins update against a local registry moving latest from 1.0.0 to 1.0.1.
  • target updated to 1.0.1
  • managed peer stayed installed/tracked
• Reproduced the reported LanceDB shape live:
  • temp custom plugin depended on real @lancedb/[email protected]
  • OpenClaw installed/tracked [email protected]
  • installed real @openclaw/[email protected]
  • @lancedb/lancedb and apache-arrow both remained present
  • custom plugin and acpx both listed cleanly
  • no stale diagnostics from plugins list --json