<!-- source: https://deepwiki.com/qhkm/zeptoclaw/13.2-dependencies-and-build -->

# Dependencies and Build

- .github/workflows/ci.yml
- .github/workflows/e2e.yml
- .github/workflows/release.yml
- Cargo.lock
- Cargo.toml
- codecov.yml
- deny.toml
- install.sh
- scripts/pre-push
- src/channels/factory.rs
- src/channels/mod.rs
- src/cli/channel.rs
- src/tools/screenshot.rs

This page documents ZeptoClaw's dependency structure, feature flags, build configuration, and compilation process. It covers the rationale behind dependency choices, optional feature gates, build profiles for release optimization, and platform-specific considerations.

For configuration file structure and validation, see [Configuration File Structure](https://github.com/qhkm/zeptoclaw/blob/2c743d31/Configuration File Structure) For deployment strategies including Docker builds, see [Deployment Options](https://github.com/qhkm/zeptoclaw/blob/2c743d31/Deployment Options)

## Dependency Categories

ZeptoClaw organizes dependencies into functional categories, each serving a specific architectural layer. The dependency manifest in `Cargo.toml` uses inline comments to group related crates and explain their purpose [Cargo.toml22-218](https://github.com/qhkm/zeptoclaw/blob/2c743d31/Cargo.toml#L22-L218)

### Dependency Ecosystem Overview

The following diagram maps high-level system requirements to specific crates and code entities.

**Diagram: Natural Language Space to Code Entity Space (Dependencies)**

```

```

**Sources:** [Cargo.toml28-157](https://github.com/qhkm/zeptoclaw/blob/2c743d31/Cargo.toml#L28-L157) [src/channels/mod.rs111-132](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/channels/mod.rs#L111-L132)

### Async Runtime

ZeptoClaw uses Tokio with the `"full"` feature set. This is an intentional trade-off to simplify the dependency graph since transitive dependencies (like `teloxide` or `reqwest`) pull in most features anyway [Cargo.toml25-28](https://github.com/qhkm/zeptoclaw/blob/2c743d31/Cargo.toml#L25-L28)

- tokio 1.51 : Core runtime Cargo.toml 28
- async-trait 0.1 : Enables async fn in traits like Channel , Tool , and LLMProvider Cargo.toml 108
- futures 0.3 : Stream combinators for the MessageBus Cargo.toml 109

### Serialization and HTTP

- serde : Primary framework for configuration and LLM JSON handling Cargo.toml 34-37
- json5 : Specifically used for migrating older OpenClaw configurations that allow comments and trailing commas Cargo.toml 39
- reqwest : Configured with rustls-tls to avoid a system OpenSSL dependency, reducing binary size and improving portability Cargo.toml 48 A separate reqwest013 binding is maintained for Google Workspace compatibility Cargo.toml 50

### Security Stack

The security architecture relies on a suite of specialized cryptographic crates:

- chacha20poly1305 : XChaCha20-Poly1305 AEAD for encrypting secrets at rest Cargo.toml 89
- argon2 : Argon2id for password-based key derivation Cargo.toml 91
- aho-corasick : High-performance multi-pattern matching used in the SafetyLayer for injection detection Cargo.toml 87
- subtle : Constant-time comparison to prevent timing attacks during token validation Cargo.toml 95
- ring : Used for HMAC-SHA256 CSRF token generation Cargo.toml 99

## Feature Flags

ZeptoClaw uses Cargo features to gate optional functionality. This is critical for supporting resource-constrained environments or specific hardware integrations.

### Feature Mapping to Implementation

**Diagram: Feature Flag to Code Entity Mapping**

```

```

**Sources:** [src/channels/mod.rs120-132](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/channels/mod.rs#L120-L132) [src/channels/factory.rs119-145](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/channels/factory.rs#L119-L145) [Cargo.toml132-147](https://github.com/qhkm/zeptoclaw/blob/2c743d31/Cargo.toml#L132-L147) [src/tools/screenshot.rs1-5](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/tools/screenshot.rs#L1-L5)

### Key Feature Categories

- Channels : whatsapp-web and mqtt are gated to keep the default binary slim Cargo.toml 120-121 src/channels/factory.rs 119-140
- Hardware : The hardware feature enables direct device interaction via SerialChannel src/channels/mod.rs 124-125 Specific platform support like peripheral-esp32 and peripheral-rpi is also feature-gated Cargo.toml 171-174
- Memory : Approximate nearest-neighbor search via instant-distance is gated behind memory-hnsw Cargo.toml 141
- Tools : Heavy tools like PDF parsing ( tool-pdf ) Cargo.toml 147 and web screenshots via chromiumoxide ( screenshot ) Cargo.toml 135 are optional to minimize dependencies.

## Build Configuration

### CI and Release Automation

ZeptoClaw uses GitHub Actions for continuous integration and automated releases across multiple architectures [GitHub Workflows](https://github.com/qhkm/zeptoclaw/blob/2c743d31/GitHub Workflows#LNaN-LNaN)

- Binary Size Limit : CI enforces a strict BINARY_SIZE_LIMIT_MB of 11MB to ensure the "Zepto" (small) philosophy is maintained .github/workflows/ci.yml 13-183
- Cross-Compilation : The release workflow builds binaries for x86_64-unknown-linux-gnu , aarch64-unknown-linux-gnu , aarch64-apple-darwin , and x86_64-apple-darwin .github/workflows/release.yml 17-32
- Security Auditing : cargo-deny and rustsec/audit-check run on every PR to check for vulnerable dependencies and license compliance .github/workflows/ci.yml 60-75

### Quality Gates

- Nextest : Uses cargo-nextest for faster parallel test execution .github/workflows/ci.yml 25-30
- Coverage : Code coverage is tracked via llvm-cov and reported to Codecov .github/workflows/ci.yml 109-130
- Feature Matrix : A dedicated job verifies that the crate compiles under various feature combinations (e.g., --no-default-features , panel , android , sandbox-landlock ) .github/workflows/ci.yml 76-100

### Dependency Auditing ( deny.toml )

ZeptoClaw uses a strict `cargo-deny` configuration [deny.toml1-67](https://github.com/qhkm/zeptoclaw/blob/2c743d31/deny.toml#L1-L67):

- Advisories : Zero-tolerance for security advisories deny.toml 15-19
- Licenses : Only permissive licenses (MIT, Apache-2.0, BSD, etc.) are allowed deny.toml 23-41
- Sources : Only crates from crates.io are allowed, with an exception for specific internal git dependencies deny.toml 59-66

## Channel Factory and Registration

The `register_configured_channels` function in `src/channels/factory.rs` serves as the primary entry point for initializing communication layers based on the loaded configuration.

- It checks for enabled flags in config.channels for Telegram, Slack, Discord, and others src/channels/factory.rs 28-84
- It utilizes #[cfg(feature = "...")] attributes to conditionally register channels like WhatsAppWebChannel only if the corresponding feature was included at compile time src/channels/factory.rs 119-130
- It warns users if a channel is enabled in the configuration but missing from the current build due to feature flags src/channels/factory.rs 132-139

**Sources:** [src/channels/factory.rs23-177](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/channels/factory.rs#L23-L177) [src/channels/mod.rs111-152](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/channels/mod.rs#L111-L152) [src/cli/channel.rs85-96](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/cli/channel.rs#L85-L96)
