fix: avoid provider policy runtime deps

CHANGELOG.md

@@ -7,6 +7,7 @@ Docs: https://docs.openclaw.ai
 ### Fixes
 
 - Agents/subagents: bound automatic orphan recovery with persisted recovery attempts and a wedged-session tombstone, and teach task maintenance/doctor to reconcile those sessions so restart loops no longer require manual `sessions.json` surgery. Fixes #74864. Thanks @solosage1.
+- Plugins/runtime-deps: keep bundled provider policy config loading from staging plugin runtime dependencies, so config reads no longer fail on locked-down `/var/lib/openclaw/plugin-runtime-deps` directories. Fixes #74971. Thanks @eurojojo.
 - Gateway/startup: skip pre-bind web-fetch provider discovery for credential-free `tools.web.fetch` config, so Docker/Kubernetes gateways bind even when optional fetch limits are present. Fixes #74896. Thanks @KoykL.
 - Slack: require bot-authored room messages with `allowBots=true` to come from an explicitly channel-allowlisted bot or from a room where an explicit Slack owner is present, so broad bot relays cannot run unattended. Fixes #59284. Thanks @andrewhong-translucent.
 - CLI/progress: suppress nested progress spinners and line clears while TUI input owns raw stdin, so Crestodian `/status` no longer disturbs the active input row. (#75003) Thanks @velvet-shark.

src/plugins/provider-public-artifacts.test.ts

@@ -1,8 +1,14 @@
-import { describe, expect, it } from "vitest";
+import { importFreshModule } from "openclaw/plugin-sdk/test-fixtures";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import type { ModelProviderConfig } from "../config/types.models.js";
 import { resolveBundledProviderPolicySurface } from "./provider-public-artifacts.js";
 
 describe("provider public artifacts", () => {
+  afterEach(() => {
+    vi.doUnmock("./public-surface-loader.js");
+    vi.resetModules();
+  });
+
   it("loads a lightweight bundled provider policy artifact smoke", () => {
     const surface = resolveBundledProviderPolicySurface("openai");
     expect(surface?.normalizeConfig).toBeTypeOf("function");
@@ -19,4 +25,26 @@ describe("provider public artifacts", () => {
       }),
     ).toBe(providerConfig);
   });
+
+  it("loads provider policy surfaces without staging runtime deps", async () => {
+    const loadBundledPluginPublicArtifactModuleSync = vi.fn(() => ({
+      normalizeConfig: (ctx: { providerConfig: ModelProviderConfig }) => ctx.providerConfig,
+    }));
+    vi.doMock("./public-surface-loader.js", () => ({
+      loadBundledPluginPublicArtifactModuleSync,
+    }));
+    vi.resetModules();
+
+    const { resolveBundledProviderPolicySurface: resolvePolicySurface } = await importFreshModule<
+      typeof import("./provider-public-artifacts.js")
+    >(import.meta.url, "./provider-public-artifacts.js?scope=no-runtime-deps");
+
+    const surface = resolvePolicySurface("openai");
+    expect(surface?.normalizeConfig).toBeTypeOf("function");
+    expect(loadBundledPluginPublicArtifactModuleSync).toHaveBeenCalledWith({
+      dirName: "openai",
+      artifactBasename: "provider-policy-api.js",
+      installRuntimeDeps: false,
+    });
+  });
 });

src/plugins/provider-public-artifacts.ts

@@ -36,6 +36,7 @@ function tryLoadBundledProviderPolicySurface(
       const mod = loadBundledPluginPublicArtifactModuleSync<Record<string, unknown>>({
         dirName: pluginId,
         artifactBasename,
+        installRuntimeDeps: false,
       });
       if (hasProviderPolicyHook(mod)) {
         return mod;