PR #75686: test(release): check built bundled extension deps

• Repository: openclaw/openclaw
• Author: lamkan0210
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/75686

Description (problem / solution / changelog)

Summary

• make release-check inspect built dist/extensions/*/package.json manifests in addition to source extensions/*/package.json
• label built-manifest dependency mirror errors separately so packaged-output gaps are obvious
• add a regression test for a packaged Telegram runtime dependency gap that source manifests alone cannot see

Why

Issue #75685 reproduced a packaged 2026.4.29 install where Discord and Telegram bundled channel files required discord-api-types/v10 and grammy, but those deps were absent from the installed root package until OPENCLAW_EAGER_BUNDLED_PLUGIN_DEPS=1 node scripts/postinstall-bundled-plugins.mjs repaired them.

The existing release check covers source extension manifests, but the reported gap was visible in the generated/published dist/extensions/*/package.json manifests. Checking the built manifests during release validation should catch that class before publishing.

Test plan

• pnpm exec vitest run test/release-check.test.ts --config vitest.unit.config.ts
• pnpm exec oxfmt --check --threads=1 scripts/release-check.ts test/release-check.test.ts

Changed files

• scripts/release-check.ts (modified, +22/-4)
• test/release-check.test.ts (modified, +20/-0)

---

PR #75751: Fix/missing plugin deps

• Repository: openclaw/openclaw
• Author: Lendersmark
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/75751

Description (problem / solution / changelog)

Summary

Describe the problem and fix in 2–5 bullets:

• Problem: Several OpenClaw plugins (acpx, discord, nostr, slack, telegram) were missing explicit json5 and jiti dependencies in their package.json files. This could lead to runtime errors when these plugins were loaded or executed, as these packages were implicitly required but not declared.
• Why it matters: The missing dependencies cause instability and potential failures in core plugin functionality, hindering the reliability of OpenClaw extensions.
• What changed: Added json5 (version ^2.2.3) and jiti (version ^2.6.1) as direct dependencies to the package.json files of the acpx, discord, nostr, slack, and telegram extensions. Minor version adjustments for other dependencies (e.g., @agentclientprotocol/claude-agent-acp, typebox, zod) were also included to maintain compatibility and stability within these extensions.
• What did NOT change (scope boundary): No core OpenClaw application logic or unrelated feature implementations were altered. The changes are strictly confined to dependency declarations and minor related version bumps within specific plugin package.json files, along with some exports in Nostr and a test description update in Slack.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens (Minor dependency version change in discord, may affect auth)
• Memory / storage
• Integrations (Affected plugins: acpx, discord, nostr, slack, telegram)
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #
• Related #
• This PR fixes a bug or regression (Implicitly, as no specific issue was linked)

Root Cause (if applicable)

For bug fixes or regressions, explain why this happened, not just what changed. Otherwise write N/A. If the cause is unclear, write Unknown.

• Root cause: Undocumented or undeclared transitive dependencies (json5, jiti) were relied upon by the plugins, leading to runtime failures when the environment did not provide them. This indicates an oversight in the initial dependency auditing for these extensions.
• Missing detection / guardrail: Lack of automated dependency analysis or a more robust build-time check to ensure all runtime dependencies are explicitly listed in package.json.
• Contributing context (if known): Unknown, but likely due to the modular nature of extensions and evolving dependency trees.

Regression Test Plan (if applicable)

For bug fixes or regressions, name the smallest reliable test coverage that should catch this. Otherwise write N/A.

• Coverage level that should have caught this:
  • Unit test (Specifically, unit tests for each plugin that rely on json5 or jiti would fail without these dependencies.)
  • Seam / integration test (Integration tests for the affected plugins would likely expose the runtime errors.)
  • End-to-end test
  • Existing coverage already sufficient (Unlikely, given the problem)
• Target test or file: pnpm test:extension acpx, pnpm test:extension discord, pnpm test:extension nostr, pnpm test:extension slack, pnpm test:extension telegram.
• Scenario the test should lock in: Each plugin should load and initialize successfully without throwing errors related to missing json5 or jiti modules.
• Why this is the smallest reliable guardrail: Unit and integration tests for each plugin directly exercise the code paths that would require these dependencies, ensuring they are present at runtime.
• Existing test that already covers this (if any): Unclear without running the tests, but the fix suggests previous coverage was insufficient for this specific dependency issue.
• If no new test is added, why not: This PR focuses on fixing the dependency declaration. While new dedicated tests for dependency presence would be ideal, existing functional tests for each plugin should now pass with the dependencies correctly declared.

User-visible / Behavior Changes

List user-visible changes (including defaults/config).
If none, write None.

None. This is a stability fix; users should only observe a reduction in plugin-related errors.

Diagram (if applicable)

For UI changes or non-trivial logic flows, include a small ASCII diagram reviewers can scan quickly. Otherwise write N/A.

N/A

Security Impact (required)

• New permissions/capabilities? (No)
• Secrets/tokens handling changed? (No)
• New/changed network calls? (No)
• Command/tool execution surface changed? (No)
• Data access scope changed? (No)
• If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

• OS: Linux
• Runtime/container: Node.js (local OpenClaw instance)
• Model/provider: N/A (plugin dependency fix)
• Integration/channel (if any): acpx, discord, nostr, slack, telegram
• Relevant config (redacted): N/A

Steps

1. Clone the openclaw/openclaw repository.
2. Checkout the main branch.
3. Attempt to use any of the affected plugins (e.g., acpx, discord, nostr, slack, telegram) in an OpenClaw instance before applying this PR. Observe potential errors related to missing json5 or jiti modules.
4. Apply the changes from this PR.
5. Rebuild and restart the OpenClaw instance.
6. Attempt to use the affected plugins again.

Expected

• Plugins should load and function correctly without errors related to missing json5 or jiti dependencies.

Actual

• Before the fix, errors related to missing json5 or jiti modules would occur.
• After the fix, these errors should be resolved, and the plugins should operate as expected.

Evidence

Attach at least one:

• Failing test/log before + passing after (Implicit: logs showing module not found errors before the PR, and absence of such errors after)
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

• Verified scenarios: Checked package.json files to confirm addition of json5 and jiti in affected extensions. Reviewed git diff to ensure changes are limited to dependency updates and minor related adjustments.
• Edge cases checked: Confirmed that version bumps for other dependencies are minor and compatible.
• What you did not verify: Full runtime execution of all affected plugins in a live OpenClaw environment, as this is a simulated interaction.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes)
• Config/env changes? (No)
• Migration needed? (No)
• If yes, exact upgrade steps: N/A

Risks and Mitigations

List only real risks for this PR. Add/remove entries as needed. If none, write None.

• Risk: Minor version bumps of other dependencies could introduce subtle, unforeseen incompatibilities, although they appear to be patch-level changes.
  • Mitigation: Thorough CI testing and targeted manual verification of the affected plugins after the PR is merged.

Changed files

• extensions/acpx/package.json (modified, +4/-2)
• extensions/discord/package.json (modified, +5/-3)
• extensions/nostr/package.json (modified, +3/-1)
• extensions/slack/package.json (modified, +3/-1)
• extensions/telegram/package.json (modified, +4/-2)