fix: include pnpm 11 bins in gateway PATH by shbernal · Pull Request #85238 · openclaw/openclaw

shbernal · 2026-05-22T05:27:37Z

Summary

include pnpm 11's PNPM_HOME/bin layout in managed gateway service PATH generation
keep pnpm 10-style PNPM_HOME paths for compatibility
add npm-global and package-manager env bin fallbacks to runtime PATH bootstrap while keeping user-writable paths after trusted system dirs

Real behavior proof

Behavior or issue addressed: Gateway-managed PATH generation missed pnpm 11 global shim directories, so gateway-side skill requirement checks could report clawhub as missing even though pnpm installed it under PNPM_HOME/bin.

Real environment tested: Linux user-level OpenClaw gateway setup on Santiago's machine, OpenClaw service installed under systemd user units, pnpm 11.1.0 with global bin at /home/shb/.local/share/pnpm/bin.

Exact steps or command run after this patch: Ran the patched OpenClaw source in /home/shb/Worktrees/openclaw/pnpm11-service-path with tsx to call the real service PATH builder and runtime PATH bootstrap against the live machine paths, after confirming the currently installed service PATH and pnpm global bin location.

Evidence after fix: Terminal output from the real local setup:

pnpm version: 11.1.0
pnpm global bin: /home/shb/.local/share/pnpm/bin
installed service PATH: /usr/bin:/home/shb/.local/share/pnpm:/home/shb/.local/bin:/home/shb/.npm-global/bin:/home/shb/bin:/home/shb/.nix-profile/bin:/usr/local/bin:/bin
after fix service PATH contains pnpm 11 bin: yes
/home/shb/.local/bin:/home/shb/.npm-global/bin:/home/shb/bin:/home/shb/.nix-profile/bin:/home/shb/.local/share/pnpm/bin:/home/shb/.local/share/pnpm:/usr/local/bin:/usr/bin:/bin
after fix bootstrap PATH contains pnpm 11 bin: yes
/usr/bin:/bin:/usr/local/bin:/home/shb/.local/share/mise/shims:/home/shb/.local/bin:/home/shb/.local/share/pnpm/bin:/home/shb/.local/share/pnpm:/home/shb/.yarn/bin

Observed result after fix: The patched generated gateway service PATH and runtime bootstrap PATH both include /home/shb/.local/share/pnpm/bin, while the currently installed service PATH did not.

What was not tested: No known gaps.

Test plan

pnpm test src/daemon/service-env.test.ts src/infra/path-env.test.ts
git diff --check

clawsweeper · 2026-05-22T05:29:23Z

Codex review: needs maintainer review before merge. Reviewed July 7, 2026, 1:47 AM ET / 05:47 UTC.

Summary
The PR adds pnpm 11, npm-global, and package-manager env PATH candidates to gateway service/runtime PATH construction, with workspace dotenv/path-root hardening and focused tests.

PR surface: Source +93, Tests +186. Total +279 across 6 files.

Reproducibility: yes. Source inspection maps the visible Skills missing-binary state to gateway-side PATH probing, and current main plus v2026.6.11 omit the pnpm 11 bin paths shown in the PR's live terminal proof.

Review metrics: 3 noteworthy metrics.

Package-manager PATH candidates: 4 service candidates and 6 runtime candidates added. These are the behavioral additions that make pnpm 11 and npm-global CLIs visible to gateway-side skill checks.
Workspace dotenv PATH roots: 2 blocked. PNPM_HOME and NPM_CONFIG_PREFIX become runtime PATH inputs, so workspace dotenv overrides need explicit path-hijack protection.
Generated service PATH order: 1 precedence changed. Managed service user/package-manager directories now follow trusted system dirs, an accepted but upgrade-visible hardening choice.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #80206
Summary: The linked issue is the canonical false missing-binary report; this PR is the active fix candidate, while the earlier npm-global PR is closed unmerged and the macOS daemon PATH issue is a broader partial overlap.

Members:

canonical: [Bug]: Skills UI shows "Missing requirements" for clawhub and mcporter despite both binaries being installed and functional #80206 - The PR body uses closing syntax for the Skills UI missing-binary report, and the issue comments identify the same gateway PATH failure mode.
superseded: [codex] Fix npm-installed skill CLI PATH detection #80233 - The earlier closed-unmerged PR targeted npm-installed skill CLI PATH detection for the same issue, but this PR now owns the active implementation path.
adjacent_distinct: fix(daemon): preserve explicit systemd unit during refresh #87556 - The merged PR changed the same daemon service environment area for explicit systemd unit preservation, but it fixed a different service-refresh root cause.
partial_overlap: macOS: Gateway daemon PATH excludes user bin dirs (nix, bun, local, etc.) #97992 - The macOS daemon PATH report concerns broader user-bin inclusion and preserved service env behavior; this PR only partially overlaps through pnpm bin candidates.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] The branch is reported behind the current base, so the final merge should still use exact-head gates to verify the effective merged diff before landing.

Maintainer options:

Decide the mitigation before merge
Land this PATH-builder fix or an equivalent current-main refresh after exact-head gates, preserving the maintainer-accepted system-before-user service PATH ordering and closing the linked issue only after merge.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

No ClawSweeper repair job is needed because this active PR already contains the focused fix and has no concrete automated repair blocker.

Security
Cleared: The diff adds no dependencies, workflows, downloads, or secret handling, and it hardens workspace-controlled package-manager PATH inputs before using them.

Review details

Best possible solution:

Land this PATH-builder fix or an equivalent current-main refresh after exact-head gates, preserving the maintainer-accepted system-before-user service PATH ordering and closing the linked issue only after merge.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection maps the visible Skills missing-binary state to gateway-side PATH probing, and current main plus v2026.6.11 omit the pnpm 11 bin paths shown in the PR's live terminal proof.

Is this the best way to solve the issue?

Yes. The fix belongs in the shared gateway service/runtime PATH builders rather than Control UI rendering or skill-specific workarounds, and it preserves legacy pnpm paths while adding workspace-env hardening.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 094c0d421faf.

Label changes

Label justifications:

P2: This is a normal-priority gateway Skills readiness regression with a focused PATH construction fix and limited blast radius.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal output from a real Linux user-level systemd gateway setup showing patched service/runtime PATHs include the pnpm 11 bin directory, with later pnpm 11.9.0 corroboration in discussion.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal output from a real Linux user-level systemd gateway setup showing patched service/runtime PATHs include the pnpm 11 bin directory, with later pnpm 11.9.0 corroboration in discussion.

Evidence reviewed

PR surface:

Source +93, Tests +186. Total +279 across 6 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	3	96	3	+93
Tests	3	191	5	+186
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	6	287	8	+279

What I checked:

Repository policy read: Root AGENTS.md was read fully; its gateway/config compatibility and whole-surface PR review guidance applies, and no scoped AGENTS.md owns src/daemon or src/infra. (AGENTS.md:24, 094c0d421faf)
Current main service PATH gap: Current main adds PNPM_HOME directly and npm prefix bin candidates, but does not add PNPM_HOME/bin or the pnpm 11 default ~/.local/share/pnpm/bin in managed service PATH candidates. (src/daemon/service-env.ts:196, 094c0d421faf)
Current main runtime PATH gap: Current main runtime PATH bootstrap appends ~/.local/share/pnpm and macOS Library/pnpm, but not the pnpm 11 bin child or npm-global fallback added by this PR. (src/infra/path-env.ts:139, 094c0d421faf)
Latest release gap: v2026.6.11 still has the same service/runtime PATH gap: service-env has PNPM_HOME and ~/.local/share/pnpm but not the bin child, and path-env appends legacy pnpm homes without pnpm 11 bin directories. (src/daemon/service-env.ts:196, e085fa1a3ffd)
PR head service PATH fix: The PR head adds PNPM_HOME/bin plus Linux and macOS pnpm 11 default bin paths while retaining the legacy PNPM_HOME and pnpm home entries. (src/daemon/service-env.ts:197, 16cfff03540a)
PR head runtime PATH fix: The PR head normalizes package-manager roots, rejects workspace-derived roots, and appends PNPM_HOME/bin, npm prefix bin, npm-global bin, and pnpm 11 default bin candidates after trusted system directories. (src/infra/path-env.ts:79, 16cfff03540a)

Likely related people:

vincentkoc: The live PR is assigned to vincentkoc, who authored the latest package-manager PATH hardening commits and posted the maintainer decision accepting the service PATH precedence tradeoff. (role: assigned reviewer and recent branch hardening contributor; confidence: high; commits: d823cb61960a, 16cfff03540a; files: src/infra/path-env.ts, src/infra/dotenv.ts, src/infra/path-env.test.ts)
TurboTheTurtle: Authored the merged explicit-systemd-unit preservation PR that touched the same daemon service environment surface and was called out by the conflict discussion. (role: recent adjacent contributor; confidence: medium; commits: 3fea2196923b; files: src/daemon/service-env.ts, src/daemon/service-env.test.ts, src/daemon/service.ts)
pgondhi987: Authored the merged workspace PATH injection hardening that shaped the same service-env trust boundary this PR extends for package-manager roots. (role: adjacent security-hardening contributor; confidence: medium; commits: 230f7122dd5c; files: src/daemon/service-env.ts, src/commands/daemon-install-helpers.ts)
jerome-benoit: Authored the merged Nix Home Manager PATH support PR, another user-bin discovery fix in the same service-env path. (role: adjacent service PATH feature contributor; confidence: medium; commits: b8b270d5b89b; files: src/daemon/service-env.ts, src/daemon/service-env.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (10 earlier review cycles; latest 8 shown)

reviewed 2026-07-06T22:10:22.212Z sha 0a5629a :: needs maintainer review before merge. :: none
reviewed 2026-07-06T22:26:28.366Z sha abd4e90 :: needs maintainer review before merge. :: none
reviewed 2026-07-06T23:36:29.256Z sha abd4e90 :: needs maintainer review before merge. :: none
reviewed 2026-07-07T01:02:49.799Z sha 7ec7004 :: needs maintainer review before merge. :: none
reviewed 2026-07-07T01:14:45.866Z sha 7ec7004 :: needs maintainer review before merge. :: none
reviewed 2026-07-07T01:41:30.301Z sha d823cb6 :: needs maintainer review before merge. :: none
reviewed 2026-07-07T02:07:53.619Z sha d823cb6 :: needs maintainer review before merge. :: none
reviewed 2026-07-07T05:37:00.760Z sha 16cfff0 :: needs maintainer review before merge. :: none

clawsweeper · 2026-05-22T05:39:28Z

ClawSweeper PR egg

✨ Hatched: 🥚 common Clockwork Diff Drake

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: sniffs out flaky tests.
Image traits: location proof lagoon; accessory review stamp; palette violet, aqua, and starlight; mood focused; pose curling around a status light; shell soft speckled shell; lighting calm overcast light; background smooth stones and checkmarks.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Clockwork Diff Drake in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

vincentkoc · 2026-07-07T00:57:19Z

No description provided.

vincentkoc · 2026-07-07T01:48:12Z

Maintainer decision: accepting the system-before-user managed service PATH precedence. This is intentional hardening; the pnpm and npm user paths remain present, and Clownfish must still verify the current-main effective diff through the exact merge gate before landing.

openclaw-barnacle · 2026-07-07T04:43:25Z

This assigned pull request has been automatically marked as stale after being open for 27 days.
Please add updates or it will be closed.

vincentkoc · 2026-07-07T05:30:52Z

@clawsweeper re-review

clawsweeper · 2026-07-07T05:30:55Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

* fix: include pnpm 11 bins in gateway PATH * fix: include pnpm 11 bins in gateway PATH * fix(security): reject workspace package-manager PATH roots * fix(infra): preserve package paths from root cwd --------- Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com> Co-authored-by: Vincent Koc <[email protected]> Co-authored-by: Vincent Koc <[email protected]>

openclaw-barnacle Bot added gateway Gateway runtime size: S labels May 22, 2026

shbernal mentioned this pull request May 22, 2026

[Bug]: Skills UI shows "Missing requirements" for clawhub and mcporter despite both binaries being installed and functional #80206

Closed

openclaw-barnacle Bot added the triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. label May 22, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 22, 2026

This comment was marked as spam.

Sign in to view

This comment has been minimized.

Sign in to view

vincentkoc force-pushed the tung/pnpm11-service-path branch from 4761f32 to cc21e30 Compare July 6, 2026 21:51

vincentkoc self-assigned this Jul 6, 2026

openclaw-barnacle Bot added size: M and removed size: S labels Jul 6, 2026

clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels Jul 6, 2026

vincentkoc removed the merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. label Jul 6, 2026

clawsweeper Bot mentioned this pull request Jul 6, 2026

fix(preflight): pin and stabilize exact merge jobs openclaw/clownfish#270

Merged

vincentkoc mentioned this pull request Jul 7, 2026

chore(queue): refresh exact merge heads openclaw/clownfish#274

Merged

shbernal and others added 3 commits July 6, 2026 18:21

fix: include pnpm 11 bins in gateway PATH

a75c539

fix: include pnpm 11 bins in gateway PATH

dc361f5

fix(security): reject workspace package-manager PATH roots

d823cb6

vincentkoc force-pushed the tung/pnpm11-service-path branch from 7ec7004 to d823cb6 Compare July 7, 2026 01:21

clawsweeper Bot added the merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. label Jul 7, 2026

vincentkoc removed the merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. label Jul 7, 2026

clawsweeper Bot mentioned this pull request Jul 7, 2026

macOS: Gateway daemon PATH excludes user bin dirs (nix, bun, local, etc.) #97992

Open

openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Jul 7, 2026

fix(infra): preserve package paths from root cwd

16cfff0

Merge branch 'main' into tung/pnpm11-service-path

a9b1539

vincentkoc merged commit 80bb0cd into openclaw:main Jul 7, 2026
40 checks passed

github-actions Bot mentioned this pull request Jul 7, 2026

📡 Upstream Digest — 2026-07-07 07:31 UTC curtismercier/openclaw-mods#1228

Open

kostrse mentioned this pull request Jul 14, 2026

openclaw update misidentifies pnpm 11 global installations as npm #107746

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: include pnpm 11 bins in gateway PATH#85238

fix: include pnpm 11 bins in gateway PATH#85238
vincentkoc merged 5 commits into
openclaw:mainfrom
shbernal:tung/pnpm11-service-path

shbernal commented May 22, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 22, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 22, 2026

Uh oh!

This comment was marked as spam.

This comment has been minimized.

vincentkoc commented Jul 7, 2026

Uh oh!

vincentkoc commented Jul 7, 2026

Uh oh!

openclaw-barnacle Bot commented Jul 7, 2026

Uh oh!

vincentkoc commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

shbernal commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof

Test plan

Uh oh!

clawsweeper Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 22, 2026

Hatch command

Uh oh!

This comment was marked as spam.

This comment has been minimized.

vincentkoc commented Jul 7, 2026

Uh oh!

vincentkoc commented Jul 7, 2026

Uh oh!

openclaw-barnacle Bot commented Jul 7, 2026

Uh oh!

vincentkoc commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

shbernal commented May 22, 2026 •

edited

Loading

clawsweeper Bot commented May 22, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading