fix(plugins): force dependency installs local

This commit is contained in:
Peter Steinberger
2026-04-25 22:46:41 +01:00
parent 1dfa52d071
commit cbe5515b70
9 changed files with 121 additions and 23 deletions

View File

@@ -109,7 +109,8 @@ visibility and per-hook enablement, not package installation.
Npm specs are **registry-only** (package name + optional **exact version** or
**dist-tag**). Git/URL/file specs and semver ranges are rejected. Dependency
installs run with `--ignore-scripts` for safety.
installs run project-local with `--ignore-scripts` for safety, even when your
shell has global npm install settings.
Bare specs and `@latest` stay on the stable track. If npm resolves either of
those to a prerelease, OpenClaw stops and asks you to opt in explicitly with a