Install fails on clean Node environments: transitive git+https dep (@whiskeysockets/baileys → libsignal)

[pleb-inaeem]

Summary

Installing OpenClaw on a Node environment without the git binary on PATH fails with npm error syscall spawn git / ENOENT. Root cause is a transitive dependency (@whiskeysockets/baileys → libsignal) that resolves via git+https://github.com/... rather than the npm registry. npm must shell out to git to clone that URL during dependency resolution, so the install aborts before reaching any lifecycle scripts.

Environment

• OS: Ubuntu 24.04 minimal (Lima VM, aarch64)
• Node: v22.22.2 (from NodeSource)
• npm: 10.9.7
• Install command: npm install -g openclaw@latest
• git: not installed (minimal VM)

What works

• OpenClaw 2026.4.2 — installed successfully about 3 days before this report. Either baileys wasn't pulled in yet, or its libsignal version range didn't hit the git URL.
• Any environment that already has git on PATH (most dev machines, default Dockerfile base images).

What fails

• OpenClaw 2026.4.14 and 2026.4.15 — both fail the same way on a clean VM without git.
• Fresh Lima VM that deliberately installs only ca-certificates curl gnupg nodejs (no git).

Exact error

+ npm install -g openclaw@latest
npm error code ENOENT
npm error syscall spawn git
npm error path git
npm error errno -2
npm error enoent An unknown git error occurred

Debug log excerpt

From /root/.npm/_logs/<timestamp>-debug-0.log:

silly fetch manifest libsignal@git+https://github.com/whiskeysockets/libsignal-node.git
silly placeDep node_modules/openclaw/node_modules/@whiskeysockets/baileys libsignal@ OK
  for: @whiskeysockets/baileys@7.0.0-rc.9
  want: git+https://github.com/whiskeysockets/libsignal-node.git
error syscall spawn git

Mitigations that did not help

1. --ignore-scripts — blocks lifecycle scripts, but not dependency resolution. npm still needs git to clone libsignal.
2. --legacy-peer-deps — peer dep flag, doesn't affect git spawn.

Workarounds (user side)

1. Install git in the environment. 20 MB package, expands runtime attack surface for VMs that won't otherwise use git.
2. Install git, run npm install, remove git. Keeps the final VM clean but adds steps to the provisioning pipeline.
3. Pre-build node_modules on a build machine and ship a tarball. Works but adds CI complexity.

Suggested fix

The root cause is upstream in baileys, but OpenClaw pulls it in by default so fixing it here has the biggest impact.

• Option A: Pin @whiskeysockets/baileys to a version whose libsignal dep points to an npm-registry package rather than a git URL.
• Option B: Make baileys an optionalDependency, or move WhatsApp support to a separate extension package that users opt into. Matches the pattern used for other channel adapters.
• Option C: Publish a libsignal shim on npm that re-exports the git-hosted version.

Reproduction

docker run --rm -it ubuntu:24.04 bash -c '
  apt-get update -qq
  apt-get install -y -qq ca-certificates curl gnupg
  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
  echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" > /etc/apt/sources.list.d/nodesource.list
  apt-get update -qq
  apt-get install -y -qq nodejs
  npm install -g openclaw@latest
'

Expected: clean install.
Actual: fails with spawn git ENOENT.

Impact

• Every minimal/hardened VM or container that installs OpenClaw needs git added and (if security-conscious) removed after install.
• Docs that say "install Node + OpenClaw" are incomplete — users following the minimal path hit this.
• Supply chain risk: git+https:// resolution fetches code directly from GitHub, bypassing npm registry signing and mirroring. A compromise of the whiskeysockets/libsignal-node GitHub repo affects every fresh OpenClaw install.

[xialonglee]

because @whiskeysockets/baileys were dependency by other module, not only whatsapp, so i think pin @whiskeysockets/baileys to change git+https to npm registry is the only way to solve it

[steipete]

Resolved on main.

Landed fix chain:

• fix(plugins): stop eager bundled plugin dep install #69334 stops eager bundled plugin dependency installs during the root postinstall path.
• fix(deps): remove extension-owned deps from root install #69335 removes extension-owned SDK/runtime dependencies from the root npm install path and keeps them in their owning extensions.
• fix(discord): avoid native opus install path #69339 removes the default Discord native @discordjs/opus install path, so the default Discord extension install no longer resolves @discordjs/node-pre-gyp / tar.

Verified after landing:

• Fresh root npm package-lock + npm audit --omit=dev from current tree reports 0 production vulnerabilities.
• Root npm install path no longer resolves @whiskeysockets/baileys / libsignal-node / vulnerable protobufjs, nor the Discord node-pre-gyp / tar path.
• Discord extension npm install path no longer resolves @discordjs/opus, @discordjs/node-pre-gyp, or tar.
• CI was green on all three PRs, including install smoke.

Closing as fixed on main. Remaining operational item: publish a release so openclaw@latest gets this fix; until then this is fixed on main, not yet in the latest npm release.