fix: ship bonjour runtime dependency

CHANGELOG.md

@@ -112,6 +112,7 @@ Docs: https://docs.openclaw.ai
 - Voice Call/Twilio: honor TTS directive text and provider voice/model overrides during telephony synthesis, so `[[tts:...]]` tags are not spoken literally and voiceId overrides reach OpenAI/ElevenLabs calls. Fixes #58114. Thanks @legonhilltech-jpg.
 - Agents/session-locks: reclaim untracked current-process session locks with matching starttime during acquisition and startup cleanup, so Gateway restarts recover from self-owned orphan `.jsonl.lock` files. Fixes #75805; refs #49603. Thanks @cdznho.
 - Agents/subagents: initialize built-in context engines before native `sessions_spawn` resolves spawn preparation, so cliBackend-only cold starts no longer fail with an unregistered `legacy` context engine. Fixes #73095. (#73904) Thanks @brokemac79.
+- Plugins/Bonjour: ship the ciao runtime dependency with packaged OpenClaw so fresh OCM envs can start default mDNS discovery without a missing-module failure. Thanks @shakkernerd.
 - Agents/tools: scope reply plugin-tool discovery to manifest-declared tool owners and already-active matching tool entries, avoiding broad plugin runtime loading for narrow or core-only tool allowlists. Thanks @shakkernerd.
 - Plugins/tools: enforce `contracts.tools` as the manifest ownership contract for plugin tool registration, rejecting undeclared runtime tool names and adding bundled plugin drift coverage. Thanks @shakkernerd.
 - Agents/Codex: stop prompting message-tool-only source turns to finish with `NO_REPLY`, so quiet turns are represented by not calling the visible message tool instead of conflicting final-text instructions. Thanks @pashpashpash.

extensions/bonjour/manifest.test.ts

@@ -0,0 +1,22 @@
+import fs from "node:fs";
+import { describe, expect, it } from "vitest";
+
+type PackageManifest = {
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+};
+
+describe("bonjour package manifest", () => {
+  it("keeps ciao available in packaged startup runtimes", () => {
+    const pluginPackageJson = JSON.parse(
+      fs.readFileSync(new URL("./package.json", import.meta.url), "utf8"),
+    ) as PackageManifest;
+    const rootPackageJson = JSON.parse(
+      fs.readFileSync(new URL("../../package.json", import.meta.url), "utf8"),
+    ) as PackageManifest;
+
+    expect(pluginPackageJson.dependencies?.["@homebridge/ciao"]).toBe("^1.3.7");
+    expect(rootPackageJson.dependencies?.["@homebridge/ciao"]).toBe("^1.3.7");
+    expect(pluginPackageJson.devDependencies?.["@homebridge/ciao"]).toBeUndefined();
+  });
+});

package.json

@@ -1615,6 +1615,7 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "0.21.0",
     "@clack/prompts": "^1.3.0",
+    "@homebridge/ciao": "^1.3.7",
     "@lydell/node-pty": "1.2.0-beta.12",
     "@mariozechner/pi-agent-core": "0.71.1",
     "@mariozechner/pi-ai": "0.71.1",

pnpm-lock.yaml

@@ -49,6 +49,9 @@ importers:
       '@clack/prompts':
         specifier: ^1.3.0
         version: 1.3.0
+      '@homebridge/ciao':
+        specifier: ^1.3.7
+        version: 1.3.7
       '@lydell/node-pty':
         specifier: 1.2.0-beta.12
         version: 1.2.0-beta.12