fix: scope extension runtime deps to plugin manifests

extensions/bluebubbles/package.json

@@ -3,6 +3,9 @@
   "version": "2026.3.2",
   "description": "OpenClaw BlueBubbles channel plugin",
   "type": "module",
+  "dependencies": {
+    "zod": "^4.3.6"
+  },
   "openclaw": {
     "extensions": [
       "./index.ts"

extensions/irc/package.json

@@ -3,6 +3,9 @@
   "version": "2026.3.2",
   "description": "OpenClaw IRC channel plugin",
   "type": "module",
+  "dependencies": {
+    "zod": "^4.3.6"
+  },
   "openclaw": {
     "extensions": [
       "./index.ts"

extensions/llm-task/package.json

@@ -4,6 +4,10 @@
   "private": true,
   "description": "OpenClaw JSON-only LLM task plugin",
   "type": "module",
+  "dependencies": {
+    "@sinclair/typebox": "0.34.48",
+    "ajv": "^8.18.0"
+  },
   "openclaw": {
     "extensions": [
       "./index.ts"

extensions/lobster/package.json

@@ -3,6 +3,9 @@
   "version": "2026.3.2",
   "description": "Lobster workflow tool plugin (typed pipelines + resumable approvals)",
   "type": "module",
+  "dependencies": {
+    "@sinclair/typebox": "0.34.48"
+  },
   "openclaw": {
     "extensions": [
       "./index.ts"

extensions/matrix/package.json

@@ -4,6 +4,7 @@
   "description": "OpenClaw Matrix channel plugin",
   "type": "module",
   "dependencies": {
+    "@mariozechner/pi-agent-core": "0.55.3",
     "@matrix-org/matrix-sdk-crypto-nodejs": "^0.4.0",
     "@vector-im/matrix-bot-sdk": "0.8.0-element.3",
     "markdown-it": "14.1.1",

extensions/mattermost/package.json

@@ -3,6 +3,10 @@
   "version": "2026.3.2",
   "description": "OpenClaw Mattermost channel plugin",
   "type": "module",
+  "dependencies": {
+    "ws": "^8.19.0",
+    "zod": "^4.3.6"
+  },
   "openclaw": {
     "extensions": [
       "./index.ts"

extensions/nextcloud-talk/package.json

@@ -3,6 +3,9 @@
   "version": "2026.3.2",
   "description": "OpenClaw Nextcloud Talk channel plugin",
   "type": "module",
+  "dependencies": {
+    "zod": "^4.3.6"
+  },
   "openclaw": {
     "extensions": [
       "./index.ts"

extensions/tlon/package.json

@@ -7,7 +7,8 @@
     "@tloncorp/api": "github:tloncorp/api-beta#7eede1c1a756977b09f96aa14a92e2b06318ae87",
     "@tloncorp/tlon-skill": "0.1.9",
     "@urbit/aura": "^3.0.0",
-    "@urbit/http-api": "^3.0.0"
+    "@urbit/http-api": "^3.0.0",
+    "zod": "^4.3.6"
   },
   "openclaw": {
     "extensions": [

extensions/voice-call/package.json

@@ -5,6 +5,7 @@
   "type": "module",
   "dependencies": {
     "@sinclair/typebox": "0.34.48",
+    "commander": "^14.0.3",
     "ws": "^8.19.0",
     "zod": "^4.3.6"
   },

extensions/zalo/package.json

@@ -4,7 +4,8 @@
   "description": "OpenClaw Zalo channel plugin",
   "type": "module",
   "dependencies": {
-    "undici": "7.22.0"
+    "undici": "7.22.0",
+    "zod": "^4.3.6"
   },
   "openclaw": {
     "extensions": [

extensions/zalouser/package.json

@@ -5,7 +5,8 @@
   "type": "module",
   "dependencies": {
     "@sinclair/typebox": "0.34.48",
-    "zca-js": "2.1.1"
+    "zca-js": "2.1.1",
+    "zod": "^4.3.6"
   },
   "openclaw": {
     "extensions": [

package.json

@@ -173,7 +173,6 @@
     "@grammyjs/runner": "^2.0.3",
     "@grammyjs/transformer-throttler": "^1.2.1",
     "@homebridge/ciao": "^1.3.5",
-    "@larksuiteoapi/node-sdk": "^1.59.0",
     "@line/bot-sdk": "^10.6.0",
     "@lydell/node-pty": "1.2.0-beta.3",
     "@mariozechner/pi-agent-core": "0.55.3",
@@ -197,7 +196,6 @@
     "express": "^5.2.1",
     "file-type": "^21.3.0",
     "gaxios": "7.1.3",
-    "google-auth-library": "10.6.1",
     "grammy": "^1.41.0",
     "https-proxy-agent": "^7.0.6",
     "ipaddr.js": "^2.3.0",

pnpm-lock.yaml

@@ -45,9 +45,6 @@ importers:
       '@homebridge/ciao':
         specifier: ^1.3.5
         version: 1.3.5
-      '@larksuiteoapi/node-sdk':
-        specifier: ^1.59.0
-        version: 1.59.0
       '@line/bot-sdk':
         specifier: ^10.6.0
         version: 10.6.0
@@ -120,9 +117,6 @@ importers:
       gaxios:
         specifier: 7.1.3
         version: 7.1.3
-      google-auth-library:
-        specifier: 10.6.1
-        version: 10.6.1
       grammy:
         specifier: ^1.41.0
         version: 1.41.0
@@ -270,7 +264,11 @@ importers:
         specifier: 0.1.15
         version: 0.1.15(zod@4.3.6)
 
-  extensions/bluebubbles: {}
+  extensions/bluebubbles:
+    dependencies:
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
 
   extensions/copilot-proxy: {}
 
@@ -352,16 +350,34 @@ importers:
 
   extensions/imessage: {}
 
-  extensions/irc: {}
+  extensions/irc:
+    dependencies:
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
 
   extensions/line: {}
 
-  extensions/llm-task: {}
+  extensions/llm-task:
+    dependencies:
+      '@sinclair/typebox':
+        specifier: 0.34.48
+        version: 0.34.48
+      ajv:
+        specifier: ^8.18.0
+        version: 8.18.0
 
-  extensions/lobster: {}
+  extensions/lobster:
+    dependencies:
+      '@sinclair/typebox':
+        specifier: 0.34.48
+        version: 0.34.48
 
   extensions/matrix:
     dependencies:
+      '@mariozechner/pi-agent-core':
+        specifier: 0.55.3
+        version: 0.55.3(ws@8.19.0)(zod@4.3.6)
       '@matrix-org/matrix-sdk-crypto-nodejs':
         specifier: ^0.4.0
         version: 0.4.0
@@ -378,7 +394,14 @@ importers:
         specifier: ^4.3.6
         version: 4.3.6
 
-  extensions/mattermost: {}
+  extensions/mattermost:
+    dependencies:
+      ws:
+        specifier: ^8.19.0
+        version: 8.19.0
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
 
   extensions/memory-core:
     dependencies:
@@ -409,7 +432,11 @@ importers:
         specifier: ^5.2.1
         version: 5.2.1
 
-  extensions/nextcloud-talk: {}
+  extensions/nextcloud-talk:
+    dependencies:
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
 
   extensions/nostr:
     dependencies:
@@ -448,6 +475,9 @@ importers:
       '@urbit/http-api':
         specifier: ^3.0.0
         version: 3.0.0
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
 
   extensions/twitch:
     dependencies:
@@ -469,6 +499,9 @@ importers:
       '@sinclair/typebox':
         specifier: 0.34.48
         version: 0.34.48
+      commander:
+        specifier: ^14.0.3
+        version: 14.0.3
       ws:
         specifier: ^8.19.0
         version: 8.19.0
@@ -483,6 +516,9 @@ importers:
       undici:
         specifier: 7.22.0
         version: 7.22.0
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
 
   extensions/zalouser:
     dependencies:
@@ -492,6 +528,9 @@ importers:
       zca-js:
         specifier: 2.1.1
         version: 2.1.1
+      zod:
+        specifier: ^4.3.6
+        version: 4.3.6
 
   packages/clawdbot:
     dependencies: