Why does pnpm say "unsafe plugin manifest path" when installing OpenClaw?

pnpm validates that plugin manifests are stored inside its own global store directory. OpenClaw's postinstall step writes plugin metadata to a path outside that store, which pnpm blocks as a security measure.

Is it safe to use --unsafe-perm with pnpm?

Using --unsafe-perm runs postinstall scripts with elevated privileges and bypasses path validation. It is safe on a personal machine but should be avoided on shared or production servers. npm does not have this restriction by default.

Does OpenClaw officially support pnpm?

OpenClaw officially recommends npm for global installation. pnpm works in most cases but the manifest path check can interfere. Use npm -g for the most reliable install.

Fix pnpm Install: Unsafe Plugin Manifest Path

Jump to Fix

Fix 1: Use npm instead (recommended) Fix 2: Set pnpm global dir Fix 3: Use --unsafe-perm flag Verify installation

Running pnpm install -g openclaw can fail with an "unsafe plugin manifest path" error. This happens because pnpm's security model rejects plugin manifests written outside its own global store. Here are three ways to fix it.

 ERR_PNPM_UNSAFE_PATH  The plugin manifest path is not inside the pnpm store.
 The following path is unsafe: /Users/you/.openclaw/plugins/manifest.json

Next Step

Fix now, then reduce repeat incidents

If this issue keeps coming back, validate your setup in Doctor first, then harden your config.

Open Doctor Harden Config

Fix 1: Use npm Instead (Recommended)

OpenClaw officially recommends npm for global installation. npm does not have pnpm's manifest path restriction and works on all platforms without extra configuration.

Install OpenClaw with npm

# Uninstall any partial pnpm install first
pnpm remove -g openclaw 2>/dev/null || true

# Install with npm
npm install -g openclaw

# Verify
openclaw --version

Having both npm and pnpm installed is fine. OpenClaw uses npm for its own plugin management internally regardless of how it was installed.

Fix 2: Configure the pnpm Global Directory

If you prefer pnpm, you can point its global store to a standard location that satisfies the manifest path check:

Set pnpm global dir and reinstall

# Set global dir to a predictable path
pnpm config set global-dir "$HOME/.pnpm-global"
pnpm config set global-bin-dir "$HOME/.pnpm-global/bin"

# Add bin dir to PATH (add this to ~/.zshrc or ~/.bashrc)
export PATH="$HOME/.pnpm-global/bin:$PATH"

# Reload shell, then install
pnpm install -g openclaw

Fix 3: Allow with --unsafe-perm (Quick Fix)

The --unsafe-perm flag tells pnpm to skip the manifest path validation and run postinstall scripts without additional sandboxing. Use this only on personal machines.

Install with --unsafe-perm

pnpm install -g --unsafe-perm openclaw

Avoid --unsafe-perm on shared servers or CI environments. Use Fix 1 or Fix 2 in those contexts.

Verify the Installation

Verify OpenClaw install

openclaw --version
openclaw gateway status
npx clawkit-doctor@latest

Fix It Faster With Our Tools

Config Wizard

Generate a production-ready clawhub.json in 30 seconds.

Local Doctor

Diagnose Node.js, permissions, and config issues instantly.

Cost Simulator

Calculate your agent burn rate before you get surprised.

Skill Finder

Describe your use case and find the right Claude Code skill instantly.

Did this guide solve your problem?

Fix pnpm Install: Unsafe Plugin Manifest Path

Jump to Fix

Fix now, then reduce repeat incidents

Fix 1: Use npm Instead (Recommended)

Fix 2: Configure the pnpm Global Directory

Fix 3: Allow with --unsafe-perm (Quick Fix)

Verify the Installation

Installed but Gateway won't start?

npm Install Failed

Windows npm Install Errors

Gateway Runtime Errors

Skill Install in Docker

Fix It Faster With Our Tools

Config Wizard

Local Doctor

Cost Simulator

Skill Finder

Next: Make Your Agent Even Better