fix(deps): declare openclaw as an optional peer, not a runtime dependency

[omarshahine]

The bug

openclaw/package.json declared the host runtime as an ordinary runtime dependency:

"dependencies": { "openclaw": "^2026.7.1" }

So anyone installing findmy-cli pulled the entire OpenClaw runtime, and GitHub attributed every advisory in that tree to this repo at runtime scope — 23 open Dependabot alerts (hono ×7, undici ×5, ip-address ×3, fast-uri ×3, brace-expansion ×2, protobufjs, tar) for code no consumer of this plugin ever installs.

The fix

openclaw moves to an optional peerDependencies entry at >=2026.6.5 (matching openclaw.compat.pluginApi), plus devDependencies at ^2026.8.1.

This is what OpenClaw's own packaging guide prescribes (docs/snippets/plugin-publish/minimal-package.json), and what the sibling first-party plugins — apple-pim, porsche-connect, travel-hub, trakt-plugin — already ship.

No overrides are needed. openclaw pins its dependencies exactly, and 2026.8.1 already resolves all 23 advisories above their first-patched versions. Each advisory range was checked against the resolved lockfile with semver rather than assumed:

package	resolved	first patched
tar	7.5.22	7.5.21
hono	4.13.5	4.12.34
@hono/node-server	2.1.1	1.19.15
undici	8.10.0	8.9.0
ip-address	10.7.0	10.3.1
fast-uri	3.1.6	3.1.5
brace-expansion	5.0.9	5.0.9
protobufjs	7.6.6	7.6.5

The top-level import was deliberately left alone

src/index.ts does a hard, typed import { definePluginEntry } from 'openclaw/plugin-sdk/plugin-entry' — not the try/catch require that restaurant-cli uses. That is correct here and was not rewritten.

openclaw's plugins/dependency-resolution.md states that plugins importing openclaw/plugin-sdk/* declare the host as a peer, that OpenClaw refuses to npm-install a registry copy of the host into a managed plugin project (a stale host copy corrupts peer resolution inside the plugin), and that it reasserts a plugin-local node_modules/openclaw link for packages that declare the host peer. Declaring the peer is precisely what makes that import resolve; the old dependencies entry was the thing working against it.

The devDependency is here for types — and that is the whole reason

Unlike the restaurant-cli fix, where the entry was purely scope-pinning, definePluginEntry here is a typed import. Verified by hiding node_modules/openclaw:

• tsc --noEmit → fails TS2307 (and api degrades to implicit any)
• tsup build → still passes (the peer is externalized)
• plugin-inspector ci --mock-sdk → still passes

So a typecheck script was added and wired into the existing CI job. The reason is now enforced, not asserted, and it is written down in a "//" note in package.json next to the lines a maintainer would be tempted to delete.

Two traps that did not apply here

• CI's Node was not touched. It already runs Node 24, which satisfies openclaw@2026.8.1's >=24.15.0 <25 floor. restaurant-cli's Node-20 problem does not exist in this repo, so nothing had to be worked around.
• koffi (new native postinstall in openclaw 2026.8.1) installed cleanly under npm ci --force; no --ignore-scripts scoping was needed. npm's allowScripts field is advisory-only in npm 11.17, so it was deliberately not added.

Left open deliberately

Alert #5 — esbuild 0.27.7, low severity, development scope: arbitrary file read via esbuild's dev server on Windows. It comes from tsup@8.5.1, which declares esbuild: ^0.27.0 — a caret on a 0.x pins the minor, so forcing 0.28.x would put the build tool outside its own declared range while prepack runs that build. Nothing here starts that dev server or builds on Windows. Same call the restaurant-cli fix made for its identical alert.

Verification

npm ci --force            exit 0 (clean node_modules)
npm run typecheck         clean
npm run build             clean
plugin-inspector ci       PASS - 0 breakages, 0 warnings, 3 pre-existing suggestions
go test ./...             ok - 3/3 packages

Note: no workflow runs the Go tests (.github/workflows/ has only plugin-inspector and the tag-triggered publish jobs), so those were run locally. A go test CI job would be a reasonable follow-up, out of scope here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VDD6P9ft7DNNbrXpNWvCsk

[greptile-apps]

Greptile Summary

The PR reclassifies OpenClaw as an optional host peer while retaining a development copy for SDK typechecking.

• Removes OpenClaw from runtime dependencies and updates the lockfile so its tree is development-scoped.
• Adds a typecheck script and runs it in plugin-inspector CI.
• Documents the host-resolution and development-type dependency rationale in the package manifest.

Confidence Score: 5/5

The PR appears safe to merge with no concrete blocking or non-blocking defects identified.

The optional peer declaration matches the existing OpenClaw compatibility floor, the development installation remains lockfile-pinned, and CI now verifies the SDK type dependency.

Important Files Changed

Filename	Overview
openclaw/package.json	Moves OpenClaw to an optional peer and development dependency, adds typechecking, and documents the packaging contract.
openclaw/package-lock.json	Regenerates the lockfile with OpenClaw 2026.8.1 and its dependency tree marked for development use.
.github/workflows/plugin-inspector.yml	Adds the new TypeScript typecheck to the existing Node 24 plugin validation job.

_{Reviews (1): Last reviewed commit: "fix(deps): declare openclaw as an option..." | Re-trigger Greptile}