From 4031bb1914c73b4a9ee3b2f2fdfcfb57730ea635 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 28 Mar 2026 02:24:57 +0000
Subject: [PATCH] refactor: trim secret and ssrf helper runtime seams

---
 extensions/line/src/accounts.ts            | 2 +-
 extensions/telegram/src/account-inspect.ts | 2 +-
 extensions/telegram/src/token.ts           | 2 +-
 extensions/tlon/src/urbit/base-url.ts      | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/extensions/line/src/accounts.ts b/extensions/line/src/accounts.ts
index 02c424c3159..4304386649b 100644
--- a/extensions/line/src/accounts.ts
+++ b/extensions/line/src/accounts.ts
@@ -5,7 +5,7 @@ import {
 } from "openclaw/plugin-sdk/account-id";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/account-resolution";
 import { resolveAccountEntry } from "openclaw/plugin-sdk/account-resolution";
-import { tryReadSecretFileSync } from "openclaw/plugin-sdk/infra-runtime";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/core";
 import type {
   LineAccountConfig,
   LineConfig,
diff --git a/extensions/telegram/src/account-inspect.ts b/extensions/telegram/src/account-inspect.ts
index 47c6183fb8b..b599e2870da 100644
--- a/extensions/telegram/src/account-inspect.ts
+++ b/extensions/telegram/src/account-inspect.ts
@@ -1,7 +1,7 @@
 import { resolveAccountWithDefaultFallback } from "openclaw/plugin-sdk/account-resolution";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";
 import { coerceSecretRef } from "openclaw/plugin-sdk/config-runtime";
-import { tryReadSecretFileSync } from "openclaw/plugin-sdk/infra-runtime";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/core";
 import { resolveDefaultSecretProviderAlias } from "openclaw/plugin-sdk/provider-auth";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/routing";
 import {
diff --git a/extensions/telegram/src/token.ts b/extensions/telegram/src/token.ts
index 011dab257b5..4f38d1a9f63 100644
--- a/extensions/telegram/src/token.ts
+++ b/extensions/telegram/src/token.ts
@@ -1,7 +1,7 @@
 import { resolveNormalizedAccountEntry } from "openclaw/plugin-sdk/account-resolution";
 import type { BaseTokenResolution } from "openclaw/plugin-sdk/channel-contract";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";
-import { tryReadSecretFileSync } from "openclaw/plugin-sdk/infra-runtime";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/core";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/routing";
 import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import type { TelegramAccountConfig } from "../runtime-api.js";
diff --git a/extensions/tlon/src/urbit/base-url.ts b/extensions/tlon/src/urbit/base-url.ts
index 61674b23321..e917949e0a9 100644
--- a/extensions/tlon/src/urbit/base-url.ts
+++ b/extensions/tlon/src/urbit/base-url.ts
@@ -1,4 +1,4 @@
-import { isBlockedHostnameOrIp } from "openclaw/plugin-sdk/infra-runtime";
+import { isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 
 export type UrbitBaseUrlValidation =
   | { ok: true; baseUrl: string; hostname: string }