fix: avoid dependency installation during plugin install

.github/workflows/ci.yml

@@ -32,6 +32,32 @@ jobs:
       - name: Type check
         run: pnpm exec tsc --noEmit
 
+      - name: Verify packed plugin stays dependency-free
+        run: |
+          PACK_FILE="$(npm pack --silent)"
+          TMP_DIR="$(mktemp -d)"
+          tar -xzf "$PACK_FILE" -C "$TMP_DIR"
+
+          node - "$TMP_DIR/package/package.json" <<'EOF'
+          const fs = require("node:fs");
+          const manifestPath = process.argv[2];
+          const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+
+          const deps = manifest.dependencies ?? {};
+          if (Object.keys(deps).length > 0) {
+            console.error("Packed plugin must not publish runtime dependencies.");
+            console.error(JSON.stringify(deps, null, 2));
+            process.exit(1);
+          }
+
+          const peerDeps = manifest.peerDependencies ?? {};
+          if (Object.keys(peerDeps).length > 0) {
+            console.error("Packed plugin must not publish peer dependencies.");
+            console.error(JSON.stringify(peerDeps, null, 2));
+            process.exit(1);
+          }
+          EOF
+
   release:
     needs: build
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'

package.json

@@ -39,9 +39,6 @@
     "prepublishOnly": "npm run clean && npm run build",
     "release": "npm version patch && git push && git push --tags"
   },
-  "dependencies": {
-    "@sinclair/typebox": "^0.32.0"
-  },
   "devDependencies": {
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^13.0.1",
@@ -55,9 +52,6 @@
     "semantic-release": "^25.0.3",
     "typescript": "^5.3.0"
   },
-  "peerDependencies": {
-    "openclaw": ">=2024.0.0"
-  },
   "openclaw": {
     "extensions": [
       "./dist/index.js"