refactor: simplify plugin dependency handling

Simplify plugin installation and runtime loading around package-manager-owned dependencies, with Jiti reserved for local/TS fallback paths.

Also scans npm plugin install roots so hoisted transitive dependencies are covered by dependency denylist and node_modules symlink checks.

package.json

@@ -31,9 +31,6 @@
     "!dist/.runtime-postbuildstamp",
     "!dist/**/*.map",
     "!dist/plugin-sdk/.tsbuildinfo",
-    "!dist/extensions/*/.openclaw-install-stage*/**",
-    "!dist/extensions/*/.openclaw-runtime-deps-*/**",
-    "!dist/extensions/*/.openclaw-runtime-deps-stamp.json",
     "!dist/extensions/node_modules/**",
     "!dist/extensions/*/node_modules/**",
     "!dist/extensions/qa-channel/**",
@@ -57,7 +54,6 @@
     "skills/",
     "scripts/npm-runner.mjs",
     "scripts/preinstall-package-manager-warning.mjs",
-    "scripts/lib/bundled-runtime-deps-install.mjs",
     "scripts/lib/package-dist-imports.mjs",
     "scripts/postinstall-bundled-plugins.mjs",
     "scripts/windows-cmd-helpers.mjs"
@@ -1446,12 +1442,11 @@
     "rtt": "node --import tsx scripts/rtt.ts",
     "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",
     "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",
-    "stage:bundled-plugin-runtime-deps": "node scripts/stage-bundled-plugin-runtime-deps.mjs",
     "start": "node scripts/run-node.mjs",
     "test": "node scripts/test-projects.mjs",
     "test:all": "pnpm lint && pnpm build && pnpm test && pnpm test:e2e && pnpm test:live && pnpm test:docker:all",
     "test:auth:compat": "node scripts/run-vitest.mjs run --config test/vitest/vitest.gateway.config.ts src/gateway/server.auth.compat-baseline.test.ts src/gateway/client.test.ts src/gateway/reconnect-gating.test.ts src/gateway/protocol/connect-error-details.test.ts",
-    "test:build:bundled-runtime-deps": "node scripts/test-built-bundled-runtime-deps.mjs",
+    "test:build:bundled-runtime-deps": "node -e \"console.log('bundled plugin runtime dependency staging was removed; no-op')\"",
     "test:build:singleton": "node scripts/test-built-plugin-singleton.mjs",
     "test:build:status-message-runtime": "node scripts/test-built-status-message-runtime.mjs",
     "test:bundled": "node scripts/run-vitest.mjs run --config test/vitest/vitest.bundled.config.ts",
@@ -1466,8 +1461,7 @@
     "test:docker:agents-delete-shared-workspace": "bash scripts/e2e/agents-delete-shared-workspace-docker.sh",
     "test:docker:all": "node scripts/test-docker-all.mjs",
     "test:docker:browser-cdp-snapshot": "bash scripts/e2e/browser-cdp-snapshot-docker.sh",
-    "test:docker:bundled-channel-deps": "bash scripts/e2e/bundled-channel-runtime-deps-docker.sh",
-    "test:docker:bundled-channel-deps:fast": "OPENCLAW_BUNDLED_CHANNEL_SCENARIOS=0 OPENCLAW_BUNDLED_CHANNEL_UPDATE_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_ROOT_OWNED_SCENARIO=0 OPENCLAW_BUNDLED_CHANNEL_SETUP_ENTRY_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_DISABLED_CONFIG_SCENARIO=1 OPENCLAW_BUNDLED_CHANNEL_LOAD_FAILURE_SCENARIO=1 bash scripts/e2e/bundled-channel-runtime-deps-docker.sh",
+    "test:docker:bundled-channel-deps:fast": "node -e \"console.log('bundled channel dependency staging was removed; no-op')\"",
     "test:docker:bundled-plugin-install-uninstall": "bash scripts/e2e/bundled-plugin-install-uninstall-docker.sh",
     "test:docker:cleanup": "bash scripts/test-cleanup-docker.sh",
     "test:docker:commitments-safety": "bash scripts/e2e/commitments-safety-docker.sh",
@@ -1641,9 +1635,9 @@
     "jszip": "^3.10.1",
     "markdown-it": "14.1.1",
     "openai": "^6.35.0",
+    "playwright-core": "1.59.1",
     "proxy-agent": "^8.0.1",
     "qrcode": "1.5.4",
-    "semver": "7.7.4",
     "sqlite-vec": "0.1.9",
     "tar": "7.5.13",
     "tslog": "^4.10.2",
@@ -1746,41 +1740,5 @@
       "@whiskeysockets/baileys@7.0.0-rc.9": "patches/@whiskeysockets__baileys@7.0.0-rc.9.patch",
       "@agentclientprotocol/claude-agent-acp@0.31.4": "patches/@agentclientprotocol__claude-agent-acp@0.31.4.patch"
     }
-  },
-  "openclaw": {
-    "bundle": {
-      "mirroredRootRuntimeDependencies": [
-        "@agentclientprotocol/sdk",
-        "@clack/prompts",
-        "@lydell/node-pty",
-        "@mariozechner/pi-ai",
-        "@mariozechner/pi-coding-agent",
-        "@modelcontextprotocol/sdk",
-        "ajv",
-        "chalk",
-        "chokidar",
-        "commander",
-        "croner",
-        "dotenv",
-        "global-agent",
-        "https-proxy-agent",
-        "jiti",
-        "json5",
-        "jszip",
-        "markdown-it",
-        "openai",
-        "qrcode",
-        "semver",
-        "sqlite-vec",
-        "tar",
-        "tslog",
-        "typebox",
-        "undici",
-        "web-push",
-        "ws",
-        "yaml",
-        "zod"
-      ]
-    }
   }
 }