[Angnuo (angnuoli)]

Summary

• Restore the canonical resolved tarball URL for the existing [email protected] entry in desktop/package-lock.json.
• Keep every package version, integrity value, manifest and script-security policy unchanged. The entire patch is one added line.

Root cause

@microsoft/[email protected] requests jschardet using the latest tag. The desktop lock entry had a version and integrity but no tarball resolution. With npm 11.19.1, the tag edge was re-resolved to 4.0.0, causing npm ci to reject the locked 3.1.4 version. Restoring the tarball resolution lets npm retain the existing locked dependency, as the renderer lock already does.

Validation

• Reproduced the exact baseline [email protected] does not satisfy [email protected] error from current main.
• Normal desktop npm ci passed with a fresh project cache, including the root postinstall that installs renderer dependencies. The desktop lock remained byte-for-byte unchanged during installation.
• Verified the canonical npm tarball resolution works with the configured Microsoft registry mirror.
• SARIF embedded-content regression passed with ASCII, UTF-8 and UTF-16LE fixtures and the installed [email protected].
• Structural comparison confirms no dependency versions or integrity values changed. Prettier and git diff --check passed.
• Separate normal renderer npm ci passed: 392 packages installed.
• Renderer Vitest: 54 files passed, 797 tests passed, 2 skipped.
• Weixin runtime Node tests: 8 passed.
• Desktop TypeScript plus renderer production build passed.
• Renderer lint passed with 0 errors and 106 existing warnings.

Existing baseline failures / limits

• The actual desktop ESLint SARIF command successfully generated a parseable SARIF 2.1.0 report, but lint exits 1 with 2 source errors and 60 warnings. The two error-bearing files are byte-for-byte identical to main: desktop/src/chat-attachments.ts:105 (no-control-regex) and desktop/src/openclaw-upgrade-recovery.ts:236 (@typescript-eslint/no-unused-vars, unused readJsonObject). These unrelated source errors are not changed by this lockfile repair.
• GitHub PR Build is queued, not reported as passing. CLA passed when checked. No branch protection or required check is bypassed.
• Electron-dependent desktop Vitest and Windows installer packaging were not run for this one-line lockfile repair.

Environment: Node 24.22.1 / npm 11.19.1 on Windows. The existing npm allowScripts policy still warns and skips unapproved dependency lifecycle scripts (including Electron); it was not weakened. Successful dependency installation does not claim that Windows installer packaging or Electron runtime installation has been verified.