fix(memory-lancedb): declare apache-arrow peer

AGENTS.md

@@ -30,6 +30,7 @@ Telegraph style. Root rules only. Read scoped `AGENTS.md` before subtree work.
 - Core/tests: no deep plugin internals (`extensions/*/src/**`, `onboard.js`). Use `api.ts`, SDK facade, generic contracts.
 - Extension-owned behavior stays extension-owned: repair, detection, onboarding, auth/provider defaults, provider tools/settings.
 - Owner boundary: fix owner-specific behavior in the owner module. Shared/core gets generic seams only; no owner ids, dependency strings, defaults, migrations, or recovery policy. If a bug names an extension or its dependency, start in that extension and add a generic core seam only when multiple owners need it.
+- Dependency ownership follows runtime ownership: extension-only deps stay plugin-local; root deps only for core imports or intentionally internalized bundled plugin runtime.
 - Legacy config repair: doctor/fix paths, not startup/load-time core migrations.
 - Core test asserting extension-specific behavior: move to owner extension or generic contract test.
 - New seams: backwards-compatible, documented, versioned. Third-party plugins exist.

CHANGELOG.md

@@ -36,6 +36,7 @@ Docs: https://docs.openclaw.ai
 - Plugins/catalog: supplement lagging official external WeCom and Yuanbao npm manifests with channel config descriptors and declared tool contracts from the OpenClaw catalog, so trusted package sweeps no longer fail because external package metadata trails the host contract. Thanks @vincentkoc.
 - Plugins/install: let trusted official `@openclaw/*` catalog installs recover when npm `latest` points at a prerelease by falling back to the newest stable version, or by selecting the newest exact prerelease for prerelease-only launch packages with a warning instead of making beta/development plugin sweeps fail at install time. Thanks @vincentkoc.
 - Google Meet: grant Chrome media permissions against the actual Meet tab, start the local realtime audio bridge only after Meet joins, expose realtime transcripts in status/logs, and force explicit audio responses with current OpenAI realtime output-audio events so BlackHole capture does not keep the OpenClaw participant muted or silent.
+- Memory/LanceDB: declare `apache-arrow` in the bundled memory plugin package so LanceDB installs include its runtime peer. Fixes #76910. Thanks @afiqfiles-max.
 - Google Meet: use the local call-control microphone button instead of disabled remote participant mute buttons, and block realtime speech when the OpenClaw Meet microphone remains muted.
 - Google Meet: refresh realtime browser state during status and retry delayed speech after Meet finishes joining, so a just-opened in-call tab no longer leaves speech stuck behind stale `not-in-call` health.
 - Plugins/install: recover the install ledger from the managed npm root when `plugins/installs.json` is empty or partial, so reinstalling Discord and Codex no longer makes the other installed plugin disappear.

extensions/AGENTS.md

@@ -31,6 +31,14 @@ third-party plugins see.
 - Do not use relative imports that escape the current extension package root.
 - Keep plugin metadata accurate in `openclaw.plugin.json` and the package
   `openclaw` block so discovery and setup work without executing plugin code.
+- Plugin runtime dependencies belong to the owning plugin package. If a plugin
+  dependency has a runtime peer, declare/provide it in that plugin's
+  `package.json`; do not move it to root unless root/package dist owns the
+  import. Runtime never installs deps; install/update/doctor are repair points.
+- Keep plugin dependency assertions in generic contracts
+  (`package-manifest.contract.test.ts`,
+  `extension-runtime-dependencies.contract.test.ts`) rather than plugin e2e
+  tests when they express package ownership.
 - Treat files like `src/**`, `onboard.ts`, and other local helpers as private
   unless you intentionally promote them through `api.ts` and, if needed, a
   matching `src/plugin-sdk/<id>.ts` facade.

extensions/memory-lancedb/package.json

@@ -9,6 +9,7 @@
   "type": "module",
   "dependencies": {
     "@lancedb/lancedb": "^0.27.2",
+    "apache-arrow": "18.1.0",
     "openai": "^6.35.0",
     "typebox": "1.1.37"
   },

pnpm-lock.yaml

@@ -940,6 +940,9 @@ importers:
       '@lancedb/lancedb':
         specifier: ^0.27.2
         version: 0.27.2(apache-arrow@18.1.0)
+      apache-arrow:
+        specifier: 18.1.0
+        version: 18.1.0
       openai:
         specifier: ^6.35.0
         version: 6.35.0(ws@8.20.0)(zod@4.4.1)

src/plugins/contracts/extension-runtime-dependencies.contract.test.ts

@@ -25,6 +25,11 @@ const INDIRECT_RUNTIME_DEPENDENCIES = new Map<string, Set<string>>([
     // Baileys loads jimp as an optional peer when it needs media thumbnails.
     new Set(["jimp"]),
   ],
+  [
+    "extensions/memory-lancedb",
+    // LanceDB imports apache-arrow at runtime through its peer dependency.
+    new Set(["apache-arrow"]),
+  ],
   [
     "extensions/tlon",
     // The Tlon plugin manifest exposes the bundled skill from this package path.

src/plugins/contracts/package-manifest.contract.test.ts

@@ -44,7 +44,7 @@ const packageManifestContractTests: PackageManifestContractParams[] = [
   { pluginId: "mattermost", minHostVersionBaseline: "2026.3.22" },
   {
     pluginId: "memory-lancedb",
-    pluginLocalRuntimeDeps: ["@lancedb/lancedb"],
+    pluginLocalRuntimeDeps: ["@lancedb/lancedb", "apache-arrow"],
     minHostVersionBaseline: "2026.3.22",
   },
   {