Plugin SDK: guard package subpaths and fix Twitch setup export

* fix(plugins): add missing secret-input-schema build entry and Matrix runtime export

buildSecretInputSchema was not included in plugin-sdk-entrypoints.json,
so it was never emitted to dist/plugin-sdk/secret-input-schema.js. This
caused a ReferenceError during onboard when configuring channels that use
secret input schemas (matrix, feishu, mattermost, bluebubbles, nextcloud-talk, zalo).

Additionally, the Matrix extension's hand-written runtime-api barrel was
missing the re-export, unlike other extensions that use `export *` from
their plugin-sdk subpath.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Plugin SDK: guard package subpaths and fix Twitch setup export

* Plugin SDK: fix import guardrail drift

---------

Co-authored-by: hxy91819 <masonxhuang@icloud.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

extensions/discord/src/directory-config.ts

@@ -4,15 +4,20 @@ import {
   toDirectoryEntries,
   type DirectoryConfigParams,
 } from "openclaw/plugin-sdk/directory-runtime";
-import type { InspectedDiscordAccount } from "../../../src/channels/read-only-account-inspect.discord.runtime.js";
-import { inspectReadOnlyChannelAccount } from "../../../src/channels/read-only-account-inspect.js";
+import { inspectDiscordAccount } from "../api.js";
+import type { InspectedDiscordAccount } from "../api.js";
 
-export async function listDiscordDirectoryPeersFromConfig(params: DirectoryConfigParams) {
-  const account = (await inspectReadOnlyChannelAccount({
-    channelId: "discord",
+function inspectDiscordDirectoryAccount(
+  params: DirectoryConfigParams,
+): InspectedDiscordAccount | null {
+  return inspectDiscordAccount({
     cfg: params.cfg,
     accountId: params.accountId,
-  })) as InspectedDiscordAccount | null;
+  });
+}
+
+export async function listDiscordDirectoryPeersFromConfig(params: DirectoryConfigParams) {
+  const account = inspectDiscordDirectoryAccount(params);
   if (!account || !("config" in account)) {
     return [];
   }
@@ -34,11 +39,7 @@ export async function listDiscordDirectoryPeersFromConfig(params: DirectoryConfi
 }
 
 export async function listDiscordDirectoryGroupsFromConfig(params: DirectoryConfigParams) {
-  const account = (await inspectReadOnlyChannelAccount({
-    channelId: "discord",
-    cfg: params.cfg,
-    accountId: params.accountId,
-  })) as InspectedDiscordAccount | null;
+  const account = inspectDiscordDirectoryAccount(params);
   if (!account || !("config" in account)) {
     return [];
   }

extensions/slack/src/directory-config.ts

@@ -1,3 +1,4 @@
+import { normalizeSlackMessagingTarget } from "openclaw/plugin-sdk/channel-runtime";
 import {
   applyDirectoryQueryAndLimit,
   collectNormalizedDirectoryIds,
@@ -5,16 +6,18 @@ import {
   toDirectoryEntries,
   type DirectoryConfigParams,
 } from "openclaw/plugin-sdk/directory-runtime";
-import { normalizeSlackMessagingTarget } from "../../../src/channels/plugins/normalize/slack.js";
-import { inspectReadOnlyChannelAccount } from "../../../src/channels/read-only-account-inspect.js";
-import type { InspectedSlackAccount } from "../../../src/channels/read-only-account-inspect.slack.runtime.js";
+import { inspectSlackAccount } from "../api.js";
+import type { InspectedSlackAccount } from "../api.js";
 
-export async function listSlackDirectoryPeersFromConfig(params: DirectoryConfigParams) {
-  const account = (await inspectReadOnlyChannelAccount({
-    channelId: "slack",
+function inspectSlackDirectoryAccount(params: DirectoryConfigParams): InspectedSlackAccount | null {
+  return inspectSlackAccount({
     cfg: params.cfg,
     accountId: params.accountId,
-  })) as InspectedSlackAccount | null;
+  });
+}
+
+export async function listSlackDirectoryPeersFromConfig(params: DirectoryConfigParams) {
+  const account = inspectSlackDirectoryAccount(params);
   if (!account || !("config" in account)) {
     return [];
   }
@@ -40,11 +43,7 @@ export async function listSlackDirectoryPeersFromConfig(params: DirectoryConfigP
 }
 
 export async function listSlackDirectoryGroupsFromConfig(params: DirectoryConfigParams) {
-  const account = (await inspectReadOnlyChannelAccount({
-    channelId: "slack",
-    cfg: params.cfg,
-    accountId: params.accountId,
-  })) as InspectedSlackAccount | null;
+  const account = inspectSlackDirectoryAccount(params);
   if (!account || !("config" in account)) {
     return [];
   }

extensions/slack/src/message-action-dispatch.ts

@@ -1,7 +1,7 @@
 import type { AgentToolResult } from "@mariozechner/pi-agent-core";
 import type { ChannelMessageActionContext } from "openclaw/plugin-sdk/channel-runtime";
 import { normalizeInteractiveReply } from "openclaw/plugin-sdk/interactive-runtime";
-import { readNumberParam, readStringParam } from "../../../src/agents/tools/common.js";
+import { readNumberParam, readStringParam } from "openclaw/plugin-sdk/slack-core";
 import { parseSlackBlocksInput } from "./blocks-input.js";
 import { buildSlackInteractiveBlocks } from "./blocks-render.js";
 

extensions/telegram/src/directory-config.ts

@@ -6,15 +6,20 @@ import {
   toDirectoryEntries,
   type DirectoryConfigParams,
 } from "openclaw/plugin-sdk/directory-runtime";
-import { inspectReadOnlyChannelAccount } from "../../../src/channels/read-only-account-inspect.js";
-import type { InspectedTelegramAccount } from "../../../src/channels/read-only-account-inspect.telegram.runtime.js";
+import { inspectTelegramAccount } from "../api.js";
+import type { InspectedTelegramAccount } from "../api.js";
 
-export async function listTelegramDirectoryPeersFromConfig(params: DirectoryConfigParams) {
-  const account = (await inspectReadOnlyChannelAccount({
-    channelId: "telegram",
+async function inspectTelegramDirectoryAccount(
+  params: DirectoryConfigParams,
+): Promise<InspectedTelegramAccount | null> {
+  return inspectTelegramAccount({
     cfg: params.cfg,
     accountId: params.accountId,
-  })) as InspectedTelegramAccount | null;
+  });
+}
+
+export async function listTelegramDirectoryPeersFromConfig(params: DirectoryConfigParams) {
+  const account = await inspectTelegramDirectoryAccount(params);
   if (!account || !("config" in account)) {
     return [];
   }
@@ -36,11 +41,7 @@ export async function listTelegramDirectoryPeersFromConfig(params: DirectoryConf
 }
 
 export async function listTelegramDirectoryGroupsFromConfig(params: DirectoryConfigParams) {
-  const account = (await inspectReadOnlyChannelAccount({
-    channelId: "telegram",
-    cfg: params.cfg,
-    accountId: params.accountId,
-  })) as InspectedTelegramAccount | null;
+  const account = await inspectTelegramDirectoryAccount(params);
   if (!account || !("config" in account)) {
     return [];
   }

extensions/whatsapp/src/directory-config.ts

@@ -3,8 +3,8 @@ import {
   listDirectoryUserEntriesFromAllowFrom,
   type DirectoryConfigParams,
 } from "openclaw/plugin-sdk/directory-runtime";
-import { isWhatsAppGroupJid, normalizeWhatsAppTarget } from "../../../src/whatsapp/normalize.js";
 import { resolveWhatsAppAccount } from "./accounts.js";
+import { isWhatsAppGroupJid, normalizeWhatsAppTarget } from "./normalize.js";
 
 export async function listWhatsAppDirectoryPeersFromConfig(params: DirectoryConfigParams) {
   const account = resolveWhatsAppAccount({ cfg: params.cfg, accountId: params.accountId });

extensions/whatsapp/src/normalize.ts

@@ -1,5 +1,7 @@
 export {
+  isWhatsAppGroupJid,
   looksLikeWhatsAppTargetId,
   normalizeWhatsAppAllowFromEntries,
   normalizeWhatsAppMessagingTarget,
+  normalizeWhatsAppTarget,
 } from "openclaw/plugin-sdk/channel-runtime";