refactor: simplify plugin dependency handling

Simplify plugin installation and runtime loading around package-manager-owned dependencies, with Jiti reserved for local/TS fallback paths.

Also scans npm plugin install roots so hoisted transitive dependencies are covered by dependency denylist and node_modules symlink checks.

.github/codeql/codeql-plugin-boundary-critical-quality.yml

@@ -20,8 +20,7 @@ paths:
   - src/plugins/bundled-dir.ts
   - src/plugins/bundled-plugin-metadata.ts
   - src/plugins/bundled-public-surface-runtime-root.ts
-  - src/plugins/bundled-runtime-deps.ts
-  - src/plugins/bundled-runtime-root.ts
+  - src/plugins/plugin-sdk-dist-alias.ts
   - src/plugins/captured-registration.ts
   - src/plugins/config-activation-shared.ts
   - src/plugins/config-contracts.ts

.github/codeql/codeql-plugin-trust-boundary-critical-security.yml

@@ -25,8 +25,7 @@ paths:
   - src/plugins/bundled-dir.ts
   - src/plugins/bundled-plugin-metadata.ts
   - src/plugins/bundled-plugin-scan.ts
-  - src/plugins/bundled-runtime-deps*.ts
-  - src/plugins/bundled-runtime-root.ts
+  - src/plugins/plugin-sdk-dist-alias.ts
   - src/plugins/cli-registry-loader.ts
   - src/plugins/config-activation-shared.ts
   - src/plugins/config-contracts.ts

.github/workflows/ci.yml

@@ -564,9 +564,6 @@ jobs:
       - name: Smoke test built bundled plugin singleton
         run: pnpm test:build:singleton
 
-      - name: Smoke test built bundled runtime deps
-        run: pnpm test:build:bundled-runtime-deps
-
       - name: Check CLI startup memory
         run: pnpm test:startup:memory
 

.github/workflows/install-smoke.yml

@@ -510,9 +510,3 @@ jobs:
         with:
           install-bun: "false"
           install-deps: "true"
-
-      - name: Run fast bundled plugin Docker E2E
-        env:
-          OPENCLAW_BUNDLED_CHANNEL_DEPS_E2E_IMAGE: openclaw-bundled-channel-fast:local
-          OPENCLAW_BUNDLED_CHANNEL_DOCKER_RUN_TIMEOUT: 90s
-        run: timeout 480s pnpm test:docker:bundled-channel-deps:fast

.github/workflows/openclaw-live-and-e2e-checks-reusable.yml

@@ -646,21 +646,6 @@ jobs:
           - chunk_id: plugins-runtime-install-h
             label: plugins/runtime install H
             timeout_minutes: 120
-          - chunk_id: bundled-channels-core
-            label: bundled channels core
-            timeout_minutes: 90
-          - chunk_id: bundled-channels-update-a
-            label: bundled channels update A
-            timeout_minutes: 45
-          - chunk_id: bundled-channels-update-discord
-            label: bundled channels update Discord
-            timeout_minutes: 30
-          - chunk_id: bundled-channels-update-b
-            label: bundled channels update B
-            timeout_minutes: 45
-          - chunk_id: bundled-channels-contracts
-            label: bundled channels contracts
-            timeout_minutes: 90
     env:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }}

.github/workflows/openclaw-release-checks.yml

@@ -440,7 +440,7 @@ jobs:
       artifact_name: ${{ needs.prepare_release_package.outputs.artifact_name }}
       package_sha256: ${{ needs.prepare_release_package.outputs.package_sha256 }}
       suite_profile: custom
-      docker_lanes: bundled-channel-deps-compat plugins-offline
+      docker_lanes: plugins-offline plugin-update
       telegram_mode: mock-openai
       telegram_scenarios: telegram-help-command,telegram-commands-command,telegram-tools-compact-command,telegram-whoami-command,telegram-context-command,telegram-mention-gating
     secrets:

.github/workflows/package-acceptance.yml

@@ -386,10 +386,10 @@ jobs:
               docker_lanes="npm-onboard-channel-agent gateway-network config-reload"
               ;;
             package)
-              docker_lanes="npm-onboard-channel-agent doctor-switch update-channel-switch upgrade-survivor published-upgrade-survivor bundled-channel-deps-compat plugins-offline plugin-update"
+              docker_lanes="npm-onboard-channel-agent doctor-switch update-channel-switch upgrade-survivor published-upgrade-survivor plugins-offline plugin-update"
               ;;
             product)
-              docker_lanes="npm-onboard-channel-agent doctor-switch update-channel-switch upgrade-survivor published-upgrade-survivor bundled-channel-deps-compat plugins plugin-update mcp-channels cron-mcp-cleanup openai-web-search-minimal openwebui"
+              docker_lanes="npm-onboard-channel-agent doctor-switch update-channel-switch upgrade-survivor published-upgrade-survivor plugins plugin-update mcp-channels cron-mcp-cleanup openai-web-search-minimal openwebui"
               include_openwebui=true
               ;;
             full)