Declare openclaw as a peer dependency of the OpenClaw plugin - #1891

Purpose of the change

Stop counting OpenClaw's own dependency tree as runtime dependencies of the OpenClaw plugin. integrations/openclaw/package-lock.json has 219 open Dependabot alerts, 205 of them runtime scope. The plugin listed openclaw, the whole host application, as a regular dependency, and the lockfile has not changed since May (#1393).

Description

• openclaw moves from dependencies to peerDependencies and keeps the plugin's range, ^2026.4.10. OpenClaw's plugin guide declares the host this way. Its dependency resolution page says managed plugin installs run npm install --omit=dev --omit=peer ... and link the host's own package into plugins that declare the host peer.
• openclaw is also a development dependency, ~2026.7.35, so the type check, build, and smoke test have a host package to run against. 2026.7 is the newest line the plugin builds against (see Further comments). tsup still keeps openclaw/plugin-sdk/core external in dist.
• The lockfile is refreshed with npm update within the declared ranges, with no range changes. This moves @memmachine/client from 0.3.4 to 0.3.9, axios from 1.16.0 to 1.21.0, and the development tree to the newest versions its ranges allow.

After this change the runtime tree is @memmachine/client, @sinclair/typebox, and their dependencies, 27 packages in all. npm audit --omit=dev reports no advisories for it; it reads the GitHub Advisory Database, the same source Dependabot uses. The remaining advisories are all in the development tree.

Type of change

• Project Maintenance (updates to build scripts, CI, etc., that do not affect the main project)
• Security (improves security without changing functionality)

How Has This Been Tested?

• Unit Test
• Manual verification

Run at the head in integrations/openclaw/, on Node 22.23.4, macOS arm64:

• npm ci --ignore-scripts, npm run lint, npm test (3 suites, 37 tests passed), and npm run test:smoke (builds dist and imports dist/index.mjs against the installed OpenClaw) pass.
• npm audit --omit=dev reports 0 advisories. npm audit reports 49, all in development scope. On main's lockfile, npm audit reports 224.

Test Results: as listed above.

Checklist

• I have signed the commit(s) within this pull request
• I have performed a self-review of my own code
• New and existing unit tests pass locally with my changes

Further comments

• The plugin does not build against OpenClaw 2026.8.1 or later, and this PR does not change that. OpenClaw 2026.8.1 (2026-08-31) removed three things index.mts uses: the root openclaw/plugin-sdk entry point, api.registerMemoryPromptSection (OpenClaw's migration notes replace it with registerMemoryCapability), and the before_agent_start hook. The type check passes against 2026.7.35 and fails on exactly these three against 2026.8.1, 2026.8.2, 2026.8.33, 2026.8.34, 2026.9.36, and 2026.10.9. The 2026.10.9 runtime defines no registerMemoryPromptSection, and register() calls it before registering anything else. The plugin's ^2026.4.10 range admits all of those hosts. Porting the plugin to the current SDK is separate work; once that lands, the development pin can move to the current release.
• Dependabot still reports the development-scope advisories. A repository admin can triage them with a custom auto-triage rule scoped to this manifest and to development scope.
• Build(deps): Bump the npm_and_yarn group across 2 directories with 13 updates #1718 bumps this lockfile and packages/ts-client's. This PR supersedes its integrations/openclaw half.

🤖 Written by Claude Code (Claude Opus 5.5) on behalf of @edwinyyyu.