Greptile Summary

This PR adds nostr-tools to the root package.json to fix an ERR_MODULE_NOT_FOUND error in Docker and bundled environments, where only root-level dependencies are reliably available. The change is consistent with the project's existing pattern — extensions/nostr/package.json already declares nostr-tools: ^2.23.3 under both dependencies and releaseChecks.rootDependencyMirrorAllowlist, explicitly indicating this package is expected to be mirrored at the root.

• nostr-tools: ^2.23.3 added to root package.json, matching the version constraint already declared in extensions/nostr/package.json
• pnpm-lock.yaml updated to reflect the new root dependency; the lock file also picks up two new dependency-free workspace packages (extensions/elevenlabs and extensions/microsoft) as empty importers, which is expected pnpm behavior when new workspaces are present and pnpm install is re-run

Confidence Score: 5/5

• This PR is safe to merge — it is a minimal, targeted dependency addition with no logic changes.
• The change is a single dependency entry added to the root package.json, with a version that exactly matches what is already declared in extensions/nostr/package.json. The rootDependencyMirrorAllowlist in the extension's config explicitly anticipates this pattern. The pnpm-lock.yaml is consistent with the declared version. No code logic is touched.
• No files require special attention.

_{Last reviewed commit: 5bea524}

Closing this as implemented after Codex review.

Current main already handles bundled channel runtime dependencies without mirroring nostr-tools into the root package, so this PR's root-dependency change is obsolete.

What I checked:

• Nostr plugin owns nostr-tools and opts into staged runtime deps: extensions/nostr/package.json declares nostr-tools as a plugin dependency and sets openclaw.bundle.stageRuntimeDependencies to true, which means runtime deps are expected to be staged per plugin rather than mirrored at the repo root. (extensions/nostr/package.json:7, 01bc49c88c0c)
• Root package intentionally does not mirror nostr-tools: A repository search finds "nostr-tools" only in extensions/nostr/package.json, not in the root package.json, matching the current plugin-owned dependency model. (01bc49c88c0c)
• Runtime-deps loader installs missing bundled deps into plugin/external stage roots: ensureBundledPluginRuntimeDeps resolves an install root per plugin, computes missing specs from the plugin package.json, and installs them there. resolveBundledRuntimeDependencyInstallRoot also falls back to an external stage dir when the plugin/package tree is not writable. (src/plugins/bundled-runtime-deps.ts:750, 01bc49c88c0c)
• Postinstall explicitly rejects eager root installation of bundled plugin deps: The shipped postinstall script states that bundled extension runtime dependencies are extension-owned and should not all be installed during core package install; openclaw doctor --fix owns the repair path. (scripts/postinstall-bundled-plugins.mjs:2, 01bc49c88c0c)
• Tests prove root-level deps are not trusted for bundled plugins: src/plugins/bundled-runtime-deps.test.ts has coverage that source-checkout bundled plugins do not trust package-root runtime deps and instead trigger plugin-specific installs. (src/plugins/bundled-runtime-deps.test.ts:860, 01bc49c88c0c)
• Docker E2E now asserts bundled deps are absent from package root and repaired externally: The bundled-channel Docker E2E fails if a channel's deps are preinstalled under dist/extensions/<channel>/node_modules or at the package root, then expects openclaw doctor to stage them externally after configuration. (scripts/e2e/bundled-channel-runtime-deps-docker.sh:101, 01bc49c88c0c)

So I’m closing this as already implemented rather than keeping a duplicate issue open.

Review notes: reviewed against 01bc49c88c0c; fix evidence: release v2026.4.22, commit 00bd2cf7a376.