fix: harden bundled plugin dependency release checks

Author: steipete

CHANGELOG.md

@@ -16,6 +16,7 @@ Docs: https://docs.openclaw.ai
 - Agents/failover: classify Z.ai vendor code `1311` as billing and `1113` as auth, including long wrapped `1311` payloads, so these errors stop falling through to generic failover handling. (#49552) Thanks @1bcMax.
 - npm packaging: mirror bundled Slack, Telegram, Discord, and Feishu channel runtime deps at the root and harden published-install verification so fresh installs fail fast on manifest drift instead of missing-module crashes. (#63065) Thanks @scoootscooob.
 - Agents/timeouts: make the LLM idle timeout inherit `agents.defaults.timeoutSeconds` when configured, disable the unconfigured idle watchdog for cron runs, and point idle-timeout errors at `agents.defaults.llm.idleTimeoutSeconds`. Thanks @drvoss.
+- npm packaging: derive required root runtime mirrors from bundled plugin manifests and built root chunks, then install packed release tarballs without the repo `node_modules` so release checks catch missing plugin deps before publish.
 
 ## 2026.4.8
 

extensions/amazon-bedrock/package.json

@@ -16,11 +16,6 @@
     },
     "extensions": [
       "./index.ts"
-    ],
-    "releaseChecks": {
-      "rootDependencyMirrorAllowlist": [
-        "@aws-sdk/client-bedrock"
-      ]
-    }
+    ]
   }
 }

extensions/discord/package.json

@@ -60,14 +60,6 @@
     "bundle": {
       "stageRuntimeDependencies": true
     },
-    "releaseChecks": {
-      "rootDependencyMirrorAllowlist": [
-        "@buape/carbon",
-        "@discordjs/opus",
-        "https-proxy-agent",
-        "opusscript"
-      ]
-    },
     "release": {
       "publishToClawHub": true,
       "publishToNpm": true

extensions/feishu/package.json

@@ -51,11 +51,6 @@
     "bundle": {
       "stageRuntimeDependencies": true
     },
-    "releaseChecks": {
-      "rootDependencyMirrorAllowlist": [
-        "@larksuiteoapi/node-sdk"
-      ]
-    },
     "release": {
       "publishToClawHub": true,
       "publishToNpm": true

extensions/matrix/package.json

@@ -47,13 +47,6 @@
       "defaultChoice": "npm",
       "minHostVersion": ">=2026.4.9",
       "allowInvalidConfigRecovery": true
-    },
-    "releaseChecks": {
-      "rootDependencyMirrorAllowlist": [
-        "@matrix-org/matrix-sdk-crypto-wasm",
-        "@matrix-org/matrix-sdk-crypto-nodejs",
-        "matrix-js-sdk"
-      ]
     }
   }
 }

extensions/slack/package.json

@@ -34,13 +34,6 @@
     },
     "bundle": {
       "stageRuntimeDependencies": true
-    },
-    "releaseChecks": {
-      "rootDependencyMirrorAllowlist": [
-        "@slack/bolt",
-        "@slack/web-api",
-        "https-proxy-agent"
-      ]
     }
   }
 }

extensions/telegram/package.json

@@ -39,13 +39,6 @@
     },
     "bundle": {
       "stageRuntimeDependencies": true
-    },
-    "releaseChecks": {
-      "rootDependencyMirrorAllowlist": [
-        "@grammyjs/runner",
-        "@grammyjs/transformer-throttler",
-        "grammy"
-      ]
     }
   }
 }

package.json

@@ -1311,11 +1311,14 @@
     "@aws-sdk/client-bedrock": "3.1024.0",
     "@aws-sdk/client-bedrock-runtime": "3.1024.0",
     "@aws-sdk/credential-provider-node": "3.972.29",
+    "@aws/bedrock-token-generator": "^1.1.0",
     "@buape/carbon": "0.14.0",
     "@clack/prompts": "^1.2.0",
+    "@google/genai": "^1.48.0",
     "@grammyjs/runner": "^2.0.3",
     "@grammyjs/transformer-throttler": "^1.2.1",
     "@homebridge/ciao": "^1.3.6",
+    "@lancedb/lancedb": "^0.27.2",
     "@larksuiteoapi/node-sdk": "^1.60.0",
     "@line/bot-sdk": "^11.0.0",
     "@lydell/node-pty": "1.2.0-beta.10",
@@ -1339,29 +1342,34 @@
     "express": "^5.2.1",
     "file-type": "22.0.0",
     "gaxios": "7.1.4",
+    "google-auth-library": "^10.6.2",
     "grammy": "^1.42.0",
     "hono": "4.12.10",
     "https-proxy-agent": "^9.0.0",
     "ipaddr.js": "^2.3.0",
+    "jimp": "^1.6.0",
     "jiti": "^2.6.1",
     "json5": "^2.2.3",
     "jszip": "^3.10.1",
     "linkedom": "^0.18.12",
     "long": "^5.3.2",
-    "markdown-it": "^14.1.1",
+    "markdown-it": "14.1.1",
     "matrix-js-sdk": "41.3.0-rc.0",
+    "mpg123-decoder": "^1.0.3",
     "node-edge-tts": "^1.2.10",
+    "openai": "^6.33.0",
     "opusscript": "^0.1.1",
     "osc-progress": "^0.3.0",
     "pdfjs-dist": "^5.6.205",
     "playwright-core": "1.59.1",
     "proxy-agent": "^8.0.0",
     "qrcode-terminal": "^0.12.0",
     "sharp": "^0.34.5",
+    "silk-wasm": "^3.7.1",
     "sqlite-vec": "0.1.9",
     "tar": "7.5.13",
     "tslog": "^4.10.2",
-    "undici": "^8.0.2",
+    "undici": "8.0.2",
     "uuid": "^13.0.0",
     "ws": "^8.20.0",
     "yaml": "^2.8.3",