liuyu/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-06-06 05:51:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: publish explicit plugin bundled dependencies

Browse Source
This commit is contained in:
Peter Steinberger
2026-05-21 21:55:50 +01:00
parent 3784270670
commit 976da39038
10 changed files with 174 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/gateway/security/index.md
View File

@@ -59,8 +59,8 @@ OpenClaw source checkouts use `pnpm-lock.yaml`. The published `openclaw` npm
package and OpenClaw-owned npm plugin packages include `npm-shrinkwrap.json`,
npm's publishable dependency lockfile, so package installs use the reviewed
transitive dependency graph from the release instead of resolving a fresh graph
at install time. OpenClaw-owned npm plugin packages also publish with
`bundleDependencies`, so their runtime dependency files are carried in the
at install time. OpenClaw-owned npm plugin packages also publish with explicit
`bundledDependencies`, so their runtime dependency files are carried in the
plugin tarball instead of depending only on install-time resolution.
This is a supply-chain hardening measure:

13
docs/plugins/dependency-resolution.md
View File

@@ -74,12 +74,13 @@ policy, and writes `extensions/<id>/npm-shrinkwrap.json` for each
OpenClaw does not require it for community packages, but npm will respect it
when present.
OpenClaw-owned npm plugin packages also publish with `bundleDependencies`. The
npm publish path overlays `bundleDependencies: true`, removes dev-only
workspace metadata from the published package manifest, runs a script-free npm
install for package-local runtime dependencies, then packs or publishes the
plugin tarball with those dependency files included. The root `openclaw`
package does not bundle its full dependency tree.
OpenClaw-owned npm plugin packages also publish with explicit
`bundledDependencies`. The npm publish path overlays the runtime dependency
name list, removes dev-only workspace metadata from the published package
manifest, runs a script-free npm install for package-local runtime
dependencies, then packs or publishes the plugin tarball with those dependency
files included. The root `openclaw` package does not bundle its full dependency
tree.
Plugins that import `openclaw/plugin-sdk/*` declare `openclaw` as a peer
dependency. OpenClaw does not let npm install a separate registry copy of the

78
extensions/amazon-bedrock-mantle/npm-shrinkwrap.json generated
View File

@@ -635,12 +635,12 @@
"license": "MIT"
},
"node_modules/@smithy/config-resolver": {
"version": "4.5.3",
"resolved": "https://registry.npmjs.org/@smithy/config-resolver/-/config-resolver-4.5.3.tgz",
"integrity": "sha512-TpS6Am5zSEtx3ow7VynThEL7UwRM06zZZcmFaP6Ij9hqKPfsFhTYCLcgU7gjFjw9QAI2kzwXrfS7InH8BivJTA==",
"version": "4.5.4",
"resolved": "https://registry.npmjs.org/@smithy/config-resolver/-/config-resolver-4.5.4.tgz",
"integrity": "sha512-jqADOFCkuSqluoEPjxWTFQ/6Xfsmt4Xi3IelA+c+4WdavqCijGGfWi873VqfIZeSFvaBpYeH+PKHC3POE98KlQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"tslib": "^2.6.2"
},
"engines": {
@@ -648,9 +648,9 @@
}
},
"node_modules/@smithy/core": {
"version": "3.24.3",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.3.tgz",
"integrity": "sha512-Ep/7tPamGY8mgESE3LyLKtxJyy6U52WWAqr/3wial47Sj4u3PiIF73AOGI27UyLy9duTkhZbgzodOfLV4TduZg==",
"version": "3.24.4",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.4.tgz",
"integrity": "sha512-3UNRKEyQyAgVgM0LGlerCLm+ChZWZ1GPfde+jBEW6bm6bSBGU1p0EbblaUV3unbhwvidjLA5Zs3sOs7mnZwvAw==",
"license": "Apache-2.0",
"dependencies": {
"@aws-crypto/crc32": "5.2.0",
@@ -662,12 +662,12 @@
}
},
"node_modules/@smithy/credential-provider-imds": {
"version": "4.3.3",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.3.tgz",
"integrity": "sha512-I2Bti0DKFo2IJyN28ijCsx51BAumEYR4/1yZ1FXyBygy9MqbnMqCev4JPth/MbpRfBSRAX35hITSnAdJRo1u5w==",
"version": "4.3.4",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.4.tgz",
"integrity": "sha512-vKW0MEFRU4Y3MkVZUkpJm+g9qyPGLCXhc0YLggUdSdBB4g7IaSSsCE75P9rBXyWHrXY1UYSQUl8/DwsTR7QciA==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -676,12 +676,12 @@
}
},
"node_modules/@smithy/fetch-http-handler": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.3.tgz",
"integrity": "sha512-F+DRf8IJazRJgYog2A/yJK7eYVc0rqTlRzO+5ZxjJd4WkZoKz0IJRncf7G6t1pdVT3kryJcwuTFhN1c5m6N47A==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.4.tgz",
"integrity": "sha512-qM7AUKI4G6d7lNgaZD3lA1tWSolh5r6gcixfTZAPstVURfjIbvreVTPz+994M0yC3HbX4YYhDRgr31Xy3XwWOQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -690,12 +690,12 @@
}
},
"node_modules/@smithy/hash-node": {
"version": "4.3.3",
"resolved": "https://registry.npmjs.org/@smithy/hash-node/-/hash-node-4.3.3.tgz",
"integrity": "sha512-tSUA38sM7kzMoLhqQ2aCGTwLXovjurz3jjG+a0sxqD4qT/4FhQr/wxMdhCumT70giM+axC1pPjimAHLlEQCfzw==",
"version": "4.3.4",
"resolved": "https://registry.npmjs.org/@smithy/hash-node/-/hash-node-4.3.4.tgz",
"integrity": "sha512-LfXN/tUjjmUkEaMWto96a3Xetk7u4WMruzFop7mtsIYY2njTvTQm/zsok9KpwztzOL3WSBfv+hikxkJhArv8xQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"tslib": "^2.6.2"
},
"engines": {
@@ -703,12 +703,12 @@
}
},
"node_modules/@smithy/invalid-dependency": {
"version": "4.3.3",
"resolved": "https://registry.npmjs.org/@smithy/invalid-dependency/-/invalid-dependency-4.3.3.tgz",
"integrity": "sha512-wUWowbCm7DGczl6bfLI6wGGtoxwN5Pon8DhF0Q8AA4NvgLwYfLo3h2DWI7sHr33lLcEsyTLQKeUeTHydqSfQ5Q==",
"version": "4.3.4",
"resolved": "https://registry.npmjs.org/@smithy/invalid-dependency/-/invalid-dependency-4.3.4.tgz",
"integrity": "sha512-lByqayJi0EC8wAysIA93QwN4C1ofppNk5YXt8QS4Zo2AVHxGWspkwvYGP/5WLO4jsdHDsEc+KAdmqJBP9eN46g==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"tslib": "^2.6.2"
},
"engines": {
@@ -728,12 +728,12 @@
}
},
"node_modules/@smithy/node-config-provider": {
"version": "4.4.3",
"resolved": "https://registry.npmjs.org/@smithy/node-config-provider/-/node-config-provider-4.4.3.tgz",
"integrity": "sha512-vDtz5OuytrjP4o9GtAOz1JloN003p94utJIQeO0WAjorhpafFFjpbDOrP6btPoCN3UxaU/U84OIEt5dM7ZRRLA==",
"version": "4.4.4",
"resolved": "https://registry.npmjs.org/@smithy/node-config-provider/-/node-config-provider-4.4.4.tgz",
"integrity": "sha512-mD/K1A5WrTZh6I23x1ScYo3K7/+Ujvp/zvLtaZT+xkDeXksWAQ/fKp60SudeUHUHQe/3Q3rgnfedJDqnxSKdpA==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"tslib": "^2.6.2"
},
"engines": {
@@ -741,12 +741,12 @@
}
},
"node_modules/@smithy/node-http-handler": {
"version": "4.7.3",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.3.tgz",
"integrity": "sha512-/jPhevcTFPMVl6KNjbaI47iOg1zxC7IsnX4PQDGVZKMFceOXtB8IEYaB7a9VvkP/3oC60WzTeKocvSI7vLT0vA==",
"version": "4.7.4",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.4.tgz",
"integrity": "sha512-HIeF+1vrDGzPkkv39Hj2vlHSXHY3p958jd/8ZnePIY6+ZOsQX8coyEUKO5yQu4r0bQIVsbpotVIrXXwyycMStQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -755,12 +755,12 @@
}
},
"node_modules/@smithy/protocol-http": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/protocol-http/-/protocol-http-5.4.3.tgz",
"integrity": "sha512-P16TBD/d8ZcD9MHQ0ubQ9BbOYSd5HZKbHOLsyFWxKk2oBEoghbRFPfGOoqToZX1yrfLITXRylL16EyPP4IzLPg==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/protocol-http/-/protocol-http-5.4.4.tgz",
"integrity": "sha512-5VdJYIYsVt2GT+i0fp5gvWoJNrdFEFN16TrpNnAZHngYC/xgk5yni6O/qV3WlIpJjeLC8RfwoQiNTljCdbNXgw==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"tslib": "^2.6.2"
},
"engines": {
@@ -768,12 +768,12 @@
}
},
"node_modules/@smithy/signature-v4": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.3.tgz",
"integrity": "sha512-53+75QuPl6DL+ct6vVEB51FDO5oulXr20TPV46VvJZg76lIlXNWfxi8j+G2V/t0I2qxCBOa3vX/8bmjrpFVo9g==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.4.tgz",
"integrity": "sha512-e5UtkMvsatzBfbeBZjEOt0k0Z3BEsjTFL/n6fdO5vtBLe67tdy0dX7xw2DU7uZ3acwoHyeCqpU2Fzb7pxwHb6Q==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},

38
extensions/amazon-bedrock/npm-shrinkwrap.json generated
View File

@@ -561,9 +561,9 @@
"license": "MIT"
},
"node_modules/@smithy/core": {
"version": "3.24.3",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.3.tgz",
"integrity": "sha512-Ep/7tPamGY8mgESE3LyLKtxJyy6U52WWAqr/3wial47Sj4u3PiIF73AOGI27UyLy9duTkhZbgzodOfLV4TduZg==",
"version": "3.24.4",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.4.tgz",
"integrity": "sha512-3UNRKEyQyAgVgM0LGlerCLm+ChZWZ1GPfde+jBEW6bm6bSBGU1p0EbblaUV3unbhwvidjLA5Zs3sOs7mnZwvAw==",
"license": "Apache-2.0",
"dependencies": {
"@aws-crypto/crc32": "5.2.0",
@@ -575,12 +575,12 @@
}
},
"node_modules/@smithy/credential-provider-imds": {
"version": "4.3.3",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.3.tgz",
"integrity": "sha512-I2Bti0DKFo2IJyN28ijCsx51BAumEYR4/1yZ1FXyBygy9MqbnMqCev4JPth/MbpRfBSRAX35hITSnAdJRo1u5w==",
"version": "4.3.4",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.4.tgz",
"integrity": "sha512-vKW0MEFRU4Y3MkVZUkpJm+g9qyPGLCXhc0YLggUdSdBB4g7IaSSsCE75P9rBXyWHrXY1UYSQUl8/DwsTR7QciA==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -589,12 +589,12 @@
}
},
"node_modules/@smithy/fetch-http-handler": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.3.tgz",
"integrity": "sha512-F+DRf8IJazRJgYog2A/yJK7eYVc0rqTlRzO+5ZxjJd4WkZoKz0IJRncf7G6t1pdVT3kryJcwuTFhN1c5m6N47A==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.4.tgz",
"integrity": "sha512-qM7AUKI4G6d7lNgaZD3lA1tWSolh5r6gcixfTZAPstVURfjIbvreVTPz+994M0yC3HbX4YYhDRgr31Xy3XwWOQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -615,12 +615,12 @@
}
},
"node_modules/@smithy/node-http-handler": {
"version": "4.7.3",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.3.tgz",
"integrity": "sha512-/jPhevcTFPMVl6KNjbaI47iOg1zxC7IsnX4PQDGVZKMFceOXtB8IEYaB7a9VvkP/3oC60WzTeKocvSI7vLT0vA==",
"version": "4.7.4",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.4.tgz",
"integrity": "sha512-HIeF+1vrDGzPkkv39Hj2vlHSXHY3p958jd/8ZnePIY6+ZOsQX8coyEUKO5yQu4r0bQIVsbpotVIrXXwyycMStQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -642,12 +642,12 @@
}
},
"node_modules/@smithy/signature-v4": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.3.tgz",
"integrity": "sha512-53+75QuPl6DL+ct6vVEB51FDO5oulXr20TPV46VvJZg76lIlXNWfxi8j+G2V/t0I2qxCBOa3vX/8bmjrpFVo9g==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.4.tgz",
"integrity": "sha512-e5UtkMvsatzBfbeBZjEOt0k0Z3BEsjTFL/n6fdO5vtBLe67tdy0dX7xw2DU7uZ3acwoHyeCqpU2Fzb7pxwHb6Q==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},

38
extensions/anthropic-vertex/npm-shrinkwrap.json generated
View File

@@ -634,9 +634,9 @@
"license": "MIT"
},
"node_modules/@smithy/core": {
"version": "3.24.3",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.3.tgz",
"integrity": "sha512-Ep/7tPamGY8mgESE3LyLKtxJyy6U52WWAqr/3wial47Sj4u3PiIF73AOGI27UyLy9duTkhZbgzodOfLV4TduZg==",
"version": "3.24.4",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.4.tgz",
"integrity": "sha512-3UNRKEyQyAgVgM0LGlerCLm+ChZWZ1GPfde+jBEW6bm6bSBGU1p0EbblaUV3unbhwvidjLA5Zs3sOs7mnZwvAw==",
"license": "Apache-2.0",
"dependencies": {
"@aws-crypto/crc32": "5.2.0",
@@ -648,12 +648,12 @@
}
},
"node_modules/@smithy/credential-provider-imds": {
"version": "4.3.3",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.3.tgz",
"integrity": "sha512-I2Bti0DKFo2IJyN28ijCsx51BAumEYR4/1yZ1FXyBygy9MqbnMqCev4JPth/MbpRfBSRAX35hITSnAdJRo1u5w==",
"version": "4.3.4",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.4.tgz",
"integrity": "sha512-vKW0MEFRU4Y3MkVZUkpJm+g9qyPGLCXhc0YLggUdSdBB4g7IaSSsCE75P9rBXyWHrXY1UYSQUl8/DwsTR7QciA==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -662,12 +662,12 @@
}
},
"node_modules/@smithy/fetch-http-handler": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.3.tgz",
"integrity": "sha512-F+DRf8IJazRJgYog2A/yJK7eYVc0rqTlRzO+5ZxjJd4WkZoKz0IJRncf7G6t1pdVT3kryJcwuTFhN1c5m6N47A==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.4.tgz",
"integrity": "sha512-qM7AUKI4G6d7lNgaZD3lA1tWSolh5r6gcixfTZAPstVURfjIbvreVTPz+994M0yC3HbX4YYhDRgr31Xy3XwWOQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -688,12 +688,12 @@
}
},
"node_modules/@smithy/node-http-handler": {
"version": "4.7.3",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.3.tgz",
"integrity": "sha512-/jPhevcTFPMVl6KNjbaI47iOg1zxC7IsnX4PQDGVZKMFceOXtB8IEYaB7a9VvkP/3oC60WzTeKocvSI7vLT0vA==",
"version": "4.7.4",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.4.tgz",
"integrity": "sha512-HIeF+1vrDGzPkkv39Hj2vlHSXHY3p958jd/8ZnePIY6+ZOsQX8coyEUKO5yQu4r0bQIVsbpotVIrXXwyycMStQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -702,12 +702,12 @@
}
},
"node_modules/@smithy/signature-v4": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.3.tgz",
"integrity": "sha512-53+75QuPl6DL+ct6vVEB51FDO5oulXr20TPV46VvJZg76lIlXNWfxi8j+G2V/t0I2qxCBOa3vX/8bmjrpFVo9g==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.4.tgz",
"integrity": "sha512-e5UtkMvsatzBfbeBZjEOt0k0Z3BEsjTFL/n6fdO5vtBLe67tdy0dX7xw2DU7uZ3acwoHyeCqpU2Fzb7pxwHb6Q==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},

38
extensions/codex/npm-shrinkwrap.json generated
View File

@@ -926,9 +926,9 @@
"license": "Apache-2.0"
},
"node_modules/@smithy/core": {
"version": "3.24.3",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.3.tgz",
"integrity": "sha512-Ep/7tPamGY8mgESE3LyLKtxJyy6U52WWAqr/3wial47Sj4u3PiIF73AOGI27UyLy9duTkhZbgzodOfLV4TduZg==",
"version": "3.24.4",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.4.tgz",
"integrity": "sha512-3UNRKEyQyAgVgM0LGlerCLm+ChZWZ1GPfde+jBEW6bm6bSBGU1p0EbblaUV3unbhwvidjLA5Zs3sOs7mnZwvAw==",
"license": "Apache-2.0",
"dependencies": {
"@aws-crypto/crc32": "5.2.0",
@@ -940,12 +940,12 @@
}
},
"node_modules/@smithy/credential-provider-imds": {
"version": "4.3.3",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.3.tgz",
"integrity": "sha512-I2Bti0DKFo2IJyN28ijCsx51BAumEYR4/1yZ1FXyBygy9MqbnMqCev4JPth/MbpRfBSRAX35hITSnAdJRo1u5w==",
"version": "4.3.4",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.4.tgz",
"integrity": "sha512-vKW0MEFRU4Y3MkVZUkpJm+g9qyPGLCXhc0YLggUdSdBB4g7IaSSsCE75P9rBXyWHrXY1UYSQUl8/DwsTR7QciA==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -954,12 +954,12 @@
}
},
"node_modules/@smithy/fetch-http-handler": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.3.tgz",
"integrity": "sha512-F+DRf8IJazRJgYog2A/yJK7eYVc0rqTlRzO+5ZxjJd4WkZoKz0IJRncf7G6t1pdVT3kryJcwuTFhN1c5m6N47A==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.4.tgz",
"integrity": "sha512-qM7AUKI4G6d7lNgaZD3lA1tWSolh5r6gcixfTZAPstVURfjIbvreVTPz+994M0yC3HbX4YYhDRgr31Xy3XwWOQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -980,12 +980,12 @@
}
},
"node_modules/@smithy/node-http-handler": {
"version": "4.7.3",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.3.tgz",
"integrity": "sha512-/jPhevcTFPMVl6KNjbaI47iOg1zxC7IsnX4PQDGVZKMFceOXtB8IEYaB7a9VvkP/3oC60WzTeKocvSI7vLT0vA==",
"version": "4.7.4",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.4.tgz",
"integrity": "sha512-HIeF+1vrDGzPkkv39Hj2vlHSXHY3p958jd/8ZnePIY6+ZOsQX8coyEUKO5yQu4r0bQIVsbpotVIrXXwyycMStQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -994,12 +994,12 @@
}
},
"node_modules/@smithy/signature-v4": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.3.tgz",
"integrity": "sha512-53+75QuPl6DL+ct6vVEB51FDO5oulXr20TPV46VvJZg76lIlXNWfxi8j+G2V/t0I2qxCBOa3vX/8bmjrpFVo9g==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.4.tgz",
"integrity": "sha512-e5UtkMvsatzBfbeBZjEOt0k0Z3BEsjTFL/n6fdO5vtBLe67tdy0dX7xw2DU7uZ3acwoHyeCqpU2Fzb7pxwHb6Q==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},

38
extensions/tlon/npm-shrinkwrap.json generated
View File

@@ -550,9 +550,9 @@
"license": "MIT"
},
"node_modules/@smithy/core": {
"version": "3.24.3",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.3.tgz",
"integrity": "sha512-Ep/7tPamGY8mgESE3LyLKtxJyy6U52WWAqr/3wial47Sj4u3PiIF73AOGI27UyLy9duTkhZbgzodOfLV4TduZg==",
"version": "3.24.4",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.4.tgz",
"integrity": "sha512-3UNRKEyQyAgVgM0LGlerCLm+ChZWZ1GPfde+jBEW6bm6bSBGU1p0EbblaUV3unbhwvidjLA5Zs3sOs7mnZwvAw==",
"license": "Apache-2.0",
"dependencies": {
"@aws-crypto/crc32": "5.2.0",
@@ -564,12 +564,12 @@
}
},
"node_modules/@smithy/credential-provider-imds": {
"version": "4.3.3",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.3.tgz",
"integrity": "sha512-I2Bti0DKFo2IJyN28ijCsx51BAumEYR4/1yZ1FXyBygy9MqbnMqCev4JPth/MbpRfBSRAX35hITSnAdJRo1u5w==",
"version": "4.3.4",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.4.tgz",
"integrity": "sha512-vKW0MEFRU4Y3MkVZUkpJm+g9qyPGLCXhc0YLggUdSdBB4g7IaSSsCE75P9rBXyWHrXY1UYSQUl8/DwsTR7QciA==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -578,12 +578,12 @@
}
},
"node_modules/@smithy/fetch-http-handler": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.3.tgz",
"integrity": "sha512-F+DRf8IJazRJgYog2A/yJK7eYVc0rqTlRzO+5ZxjJd4WkZoKz0IJRncf7G6t1pdVT3kryJcwuTFhN1c5m6N47A==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.4.tgz",
"integrity": "sha512-qM7AUKI4G6d7lNgaZD3lA1tWSolh5r6gcixfTZAPstVURfjIbvreVTPz+994M0yC3HbX4YYhDRgr31Xy3XwWOQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -604,12 +604,12 @@
}
},
"node_modules/@smithy/node-http-handler": {
"version": "4.7.3",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.3.tgz",
"integrity": "sha512-/jPhevcTFPMVl6KNjbaI47iOg1zxC7IsnX4PQDGVZKMFceOXtB8IEYaB7a9VvkP/3oC60WzTeKocvSI7vLT0vA==",
"version": "4.7.4",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.4.tgz",
"integrity": "sha512-HIeF+1vrDGzPkkv39Hj2vlHSXHY3p958jd/8ZnePIY6+ZOsQX8coyEUKO5yQu4r0bQIVsbpotVIrXXwyycMStQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -618,12 +618,12 @@
}
},
"node_modules/@smithy/signature-v4": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.3.tgz",
"integrity": "sha512-53+75QuPl6DL+ct6vVEB51FDO5oulXr20TPV46VvJZg76lIlXNWfxi8j+G2V/t0I2qxCBOa3vX/8bmjrpFVo9g==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.4.tgz",
"integrity": "sha512-e5UtkMvsatzBfbeBZjEOt0k0Z3BEsjTFL/n6fdO5vtBLe67tdy0dX7xw2DU7uZ3acwoHyeCqpU2Fzb7pxwHb6Q==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},

38
npm-shrinkwrap.json generated
View File

@@ -1983,9 +1983,9 @@
"license": "Apache-2.0"
},
"node_modules/@smithy/core": {
"version": "3.24.3",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.3.tgz",
"integrity": "sha512-Ep/7tPamGY8mgESE3LyLKtxJyy6U52WWAqr/3wial47Sj4u3PiIF73AOGI27UyLy9duTkhZbgzodOfLV4TduZg==",
"version": "3.24.4",
"resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.4.tgz",
"integrity": "sha512-3UNRKEyQyAgVgM0LGlerCLm+ChZWZ1GPfde+jBEW6bm6bSBGU1p0EbblaUV3unbhwvidjLA5Zs3sOs7mnZwvAw==",
"license": "Apache-2.0",
"dependencies": {
"@aws-crypto/crc32": "5.2.0",
@@ -1997,12 +1997,12 @@
}
},
"node_modules/@smithy/credential-provider-imds": {
"version": "4.3.3",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.3.tgz",
"integrity": "sha512-I2Bti0DKFo2IJyN28ijCsx51BAumEYR4/1yZ1FXyBygy9MqbnMqCev4JPth/MbpRfBSRAX35hITSnAdJRo1u5w==",
"version": "4.3.4",
"resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.4.tgz",
"integrity": "sha512-vKW0MEFRU4Y3MkVZUkpJm+g9qyPGLCXhc0YLggUdSdBB4g7IaSSsCE75P9rBXyWHrXY1UYSQUl8/DwsTR7QciA==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -2011,12 +2011,12 @@
}
},
"node_modules/@smithy/fetch-http-handler": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.3.tgz",
"integrity": "sha512-F+DRf8IJazRJgYog2A/yJK7eYVc0rqTlRzO+5ZxjJd4WkZoKz0IJRncf7G6t1pdVT3kryJcwuTFhN1c5m6N47A==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.4.tgz",
"integrity": "sha512-qM7AUKI4G6d7lNgaZD3lA1tWSolh5r6gcixfTZAPstVURfjIbvreVTPz+994M0yC3HbX4YYhDRgr31Xy3XwWOQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -2037,12 +2037,12 @@
}
},
"node_modules/@smithy/node-http-handler": {
"version": "4.7.3",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.3.tgz",
"integrity": "sha512-/jPhevcTFPMVl6KNjbaI47iOg1zxC7IsnX4PQDGVZKMFceOXtB8IEYaB7a9VvkP/3oC60WzTeKocvSI7vLT0vA==",
"version": "4.7.4",
"resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.4.tgz",
"integrity": "sha512-HIeF+1vrDGzPkkv39Hj2vlHSXHY3p958jd/8ZnePIY6+ZOsQX8coyEUKO5yQu4r0bQIVsbpotVIrXXwyycMStQ==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},
@@ -2051,12 +2051,12 @@
}
},
"node_modules/@smithy/signature-v4": {
"version": "5.4.3",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.3.tgz",
"integrity": "sha512-53+75QuPl6DL+ct6vVEB51FDO5oulXr20TPV46VvJZg76lIlXNWfxi8j+G2V/t0I2qxCBOa3vX/8bmjrpFVo9g==",
"version": "5.4.4",
"resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.4.tgz",
"integrity": "sha512-e5UtkMvsatzBfbeBZjEOt0k0Z3BEsjTFL/n6fdO5vtBLe67tdy0dX7xw2DU7uZ3acwoHyeCqpU2Fzb7pxwHb6Q==",
"license": "Apache-2.0",
"dependencies": {
"@smithy/core": "^3.24.3",
"@smithy/core": "^3.24.4",
"@smithy/types": "^4.14.2",
"tslib": "^2.6.2"
},

29
scripts/lib/plugin-npm-package-manifest.mjs
View File

@@ -115,13 +115,36 @@ function hasPackageRuntimeDependencies(packageJson) {
);
}
function listPackageRuntimeDependencyNames(packageJson) {
return [
...Object.keys(packageJson.dependencies ?? {}),
...Object.keys(packageJson.optionalDependencies ?? {}),
].toSorted((left, right) => left.localeCompare(right));
}
function listConfiguredBundledDependencyNames(packageJson) {
if (Array.isArray(packageJson.bundledDependencies)) {
return packageJson.bundledDependencies.filter((name) => typeof name === "string");
}
if (Array.isArray(packageJson.bundleDependencies)) {
return packageJson.bundleDependencies.filter((name) => typeof name === "string");
}
if (packageJson.bundleDependencies === true) {
return listPackageRuntimeDependencyNames(packageJson);
}
return [];
}
function shouldBundleDependencies(value) {
return value === true || value === "1" || value === "true";
}
function installPackageLocalBundledDependencies(params) {
const packageJson = params.packageJson;
if (packageJson.bundleDependencies !== true || !hasPackageRuntimeDependencies(packageJson)) {
if (
!hasPackageRuntimeDependencies(packageJson) ||
listConfiguredBundledDependencyNames(packageJson).length === 0
) {
return () => {};
}
@@ -212,8 +235,8 @@ export function resolveAugmentedPluginNpmPackageJson(params) {
},
};
if (shouldBundleDependencies(params.bundleDependencies)) {
packageJson.bundleDependencies = true;
delete packageJson.bundledDependencies;
packageJson.bundledDependencies = listPackageRuntimeDependencyNames(packageJson);
delete packageJson.bundleDependencies;
delete packageJson.devDependencies;
}
const changed = JSON.stringify(packageJson) !== JSON.stringify(plan.packageJson);

8
test/plugin-npm-package-manifest.test.ts
View File

@@ -190,7 +190,7 @@ describe("plugin npm package manifest staging", () => {
name: "@openclaw/diffs",
version: "2026.5.3",
type: "module",
bundleDependencies: true,
bundledDependencies: [],
files: [
"dist/**",
"openclaw.plugin.json",
@@ -231,7 +231,8 @@ describe("plugin npm package manifest staging", () => {
expect(stagedPackageJson.openclaw.extensions).toEqual(["./index.ts"]);
expect(stagedPackageJson.openclaw.runtimeExtensions).toEqual(["./dist/index.js"]);
expect(stagedPackageJson.openclaw.runtimeSetupEntry).toBe("./dist/setup-entry.js");
expect(stagedPackageJson.bundleDependencies).toBe(true);
expect(stagedPackageJson.bundledDependencies).toEqual([]);
expect(stagedPackageJson.bundleDependencies).toBeUndefined();
expect(stagedPackageJson.files).toContain("dist/**");
expect(stagedPackageJson.files).toContain("npm-shrinkwrap.json");
expect(stagedPackageJson.files).toContain("skills/**");
@@ -303,7 +304,8 @@ describe("plugin npm package manifest staging", () => {
const stagedPackageJson = JSON.parse(
readFileSync(join(packageDir, "package.json"), "utf8"),
);
expect(stagedPackageJson.bundleDependencies).toBe(true);
expect(stagedPackageJson.bundledDependencies).toEqual(["local-runtime-dep"]);
expect(stagedPackageJson.bundleDependencies).toBeUndefined();
expect(stagedPackageJson.devDependencies).toBeUndefined();
expect(existsSync(join(nodeModulesPath, "local-runtime-dep", "package.json"))).toBe(true);
},