#11454: fix(plugins): remove workspace:* from extension dependencies

#### Summary Fixes #10941, Fixes #11245 Four extensions had `"openclaw": "workspace:*"` in `dependencies` (not just `devDependencies`). When plugins are installed outside the pnpm workspace (e.g., `openclaw plugins install ./extensions/feishu`), npm cannot resolve the `workspace:` protocol and fails with `EUNSUPPORTEDPROTOCOL`. lobster-biscuit #### Repro Steps 1. `openclaw plugins install ./extensions/zalo` (or nostr, msteams, zalouser) 2. Plugin is copied to `~/.openclaw/extensions/` 3. `npm install --omit=dev` runs in the plugin dir 4. Fails: `Error: Unsupported URL Type "workspace:": workspace:*` #### Root Cause These 4 extensions had `"openclaw": "workspace:*"` in `dependencies`: - `extensions/zalo/package.json` - `extensions/zalouser/package.json` - `extensions/nostr/package.json` - `extensions/msteams/package.json` The `workspace:*` protocol is a pnpm workspace feature. When the plugin is copied outside the workspace for installation, npm doesn't understand `workspace:*` and errors out. Per CLAUDE.md: _"Avoid `workspace:*` in `dependencies` (npm install breaks); put `openclaw` in `devDependencies` or `peerDependencies` instead (runtime resolves `openclaw/plugin-sdk` via jiti alias)."_ Most other extensions (telegram, discord, slack, matrix, etc.) already follow this pattern correctly — only these 4 had the bug. #### Behavior Changes - Removed `"openclaw": "workspace:*"` from `dependencies` in 4 extensions - The `devDependencies` entry remains (for workspace-local development) - Runtime plugin-sdk resolution is unaffected (uses jiti alias) - No functional changes to plugin behavior #### Codebase and GitHub Search - Searched `workspace:*` across all `extensions/*/package.json` — found 4 with it in `dependencies` - Verified `extensions/memory-core` uses the correct pattern (`devDependencies` + `peerDependencies`) - Verified CLAUDE.md explicitly prohibits `workspace:*` in `dependencies` - Confirmed #10941 (feishu/zalo) and #11245 (matrix) describe the same root cause #### Tests - `pnpm build` ✓ - `pnpm check` ✓ - No runtime test changes needed (this is a packaging/metadata fix) **Sign-Off** - AI-assisted: Yes (Cursor + Claude). All changes reviewed and understood. - Degree of testing: Build + lint verified; packaging fix (no runtime logic changed) - Models used: Claude claude-4.6-opus - Submitter effort: Issue triage, codebase-wide search, pattern verification Made with [Cursor](https://cursor.com) <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR updates four extension `package.json` files (`msteams`, `nostr`, `zalo`, `zalouser`) to remove `"openclaw": "workspace:*"` from `dependencies` while keeping it in `devDependencies`. This aligns these extensions with the existing plugin packaging pattern in the repo: extensions are installed outside the pnpm workspace (via `openclaw plugins install ...`) and therefore must not rely on the pnpm-only `workspace:` protocol at runtime install time. Keeping `openclaw` only as a dev dependency preserves local workspace development while allowing `npm install --omit=dev` to succeed when extensions are copied to `~/.openclaw/extensions/`. <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk. - Changes are limited to removing a pnpm-only `workspace:*` dependency specifier from runtime `dependencies` in four extensions; this directly fixes `npm install --omit=dev` outside the workspace and does not affect runtime code paths. The remaining `devDependencies` entry preserves local development behavior. - No files require special attention <!-- greptile_other_comments_section --> _{(4/5) You can add custom instructions or style guidelines for the agent [here](https://app.greptile.com/review/github)!} **Context used:** - Context from `dashboard` - CLAUDE.md ([source](https://app.greptile.com/review/custom-context?memory=fd949e91-5c3a-4ab5-90a1-cbe184fd6ce8)) - Context from `dashboard` - AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=0d0c8278-ef8e-4d6c-ab21-f5527e322f13)) <!-- /greptile_comment -->