alt Hacker NewsThat's really cool.
But wouldn't have been quicker and simpler to add ".bun/" to the pattern of authorized paths the same way it presumably works for ".npm/"?
Replies
skeledrew • yesterday at 6:09 PM
Seems to have been addressed in the article:
> Starting around OpenClaw 2026.2.26, the project tightened plugin manifest validation. Manifests outside expected trust boundaries are now rejected as unsafe. On my Jetson, Bun’s global install layout (~/.bun/install/global/node_modules/...) tripped those checks for every single plugin
It didn’t survive OpenClaw upgrades unfortunately, it ended up killing my OpenClaw gateway when I asked it to self upgrade. Bun is marked as an experimental package manager and the recommended way to run OpenClaw gateway is node so I wanted to do it properly. I would have liked Bun to be supported property. I’d raise a PR against the repo but looking at the 4.5K open PRs, it doesn’t give me much hope about it ever getting merged.