diff --git a/scripts/lib/extension-package-boundary.ts b/scripts/lib/extension-package-boundary.ts
index df7b093c594..15167d7ad24 100644
--- a/scripts/lib/extension-package-boundary.ts
+++ b/scripts/lib/extension-package-boundary.ts
@@ -20,10 +20,10 @@ export const EXTENSION_PACKAGE_BOUNDARY_BASE_PATHS = {
   "openclaw/plugin-sdk/*": ["../dist/plugin-sdk/src/plugin-sdk/*.d.ts"],
   "openclaw/plugin-sdk/account-id": ["../dist/plugin-sdk/src/plugin-sdk/account-id.d.ts"],
   "openclaw/plugin-sdk/channel-entry-contract": [
-    "../dist/plugin-sdk/src/plugin-sdk/channel-entry-contract.d.ts",
+    "../packages/plugin-sdk/dist/src/plugin-sdk/channel-entry-contract.d.ts",
   ],
   "openclaw/plugin-sdk/browser-maintenance": [
-    "../dist/plugin-sdk/src/plugin-sdk/browser-maintenance.d.ts",
+    "../packages/plugin-sdk/dist/extensions/browser/browser-maintenance.d.ts",
   ],
   "openclaw/plugin-sdk/browser-config-runtime": [
     "../dist/plugin-sdk/src/plugin-sdk/browser-config-runtime.d.ts",
@@ -37,22 +37,24 @@ export const EXTENSION_PACKAGE_BOUNDARY_BASE_PATHS = {
   "openclaw/plugin-sdk/browser-security-runtime": [
     "../dist/plugin-sdk/src/plugin-sdk/browser-security-runtime.d.ts",
   ],
+  "openclaw/plugin-sdk/channel-secret-basic-runtime": [
+    "../packages/plugin-sdk/dist/src/plugin-sdk/channel-secret-basic-runtime.d.ts",
+  ],
   "openclaw/plugin-sdk/channel-secret-runtime": [
     "../dist/plugin-sdk/src/plugin-sdk/channel-secret-runtime.d.ts",
   ],
+  "openclaw/plugin-sdk/channel-secret-tts-runtime": [
+    "../packages/plugin-sdk/dist/src/plugin-sdk/channel-secret-tts-runtime.d.ts",
+  ],
   "openclaw/plugin-sdk/channel-streaming": [
     "../dist/plugin-sdk/src/plugin-sdk/channel-streaming.d.ts",
   ],
   "openclaw/plugin-sdk/error-runtime": ["../dist/plugin-sdk/src/plugin-sdk/error-runtime.d.ts"],
   "openclaw/plugin-sdk/provider-catalog-shared": [
-    "../dist/plugin-sdk/src/plugin-sdk/provider-catalog-shared.d.ts",
+    "../packages/plugin-sdk/dist/src/plugin-sdk/provider-catalog-shared.d.ts",
   ],
-  "openclaw/plugin-sdk/provider-entry": ["../dist/plugin-sdk/src/plugin-sdk/provider-entry.d.ts"],
-  "openclaw/plugin-sdk/provider-web-fetch-contract": [
-    "../dist/plugin-sdk/src/plugin-sdk/provider-web-fetch-contract.d.ts",
-  ],
-  "openclaw/plugin-sdk/provider-web-search-contract": [
-    "../dist/plugin-sdk/src/plugin-sdk/provider-web-search-contract.d.ts",
+  "openclaw/plugin-sdk/provider-entry": [
+    "../packages/plugin-sdk/dist/src/plugin-sdk/provider-entry.d.ts",
   ],
   "openclaw/plugin-sdk/secret-ref-runtime": [
     "../dist/plugin-sdk/src/plugin-sdk/secret-ref-runtime.d.ts",
@@ -76,16 +78,36 @@ function prefixExtensionPackageBoundaryPaths(
 }
 
 export const EXTENSION_PACKAGE_BOUNDARY_XAI_PATHS = {
-  ...prefixExtensionPackageBoundaryPaths(EXTENSION_PACKAGE_BOUNDARY_BASE_PATHS, "../"),
-  "openclaw/plugin-sdk/cli-runtime": [
-    "../../packages/plugin-sdk/dist/src/plugin-sdk/cli-runtime.d.ts",
+  ...prefixExtensionPackageBoundaryPaths(
+    (({
+      "openclaw/plugin-sdk/channel-secret-basic-runtime": _omitBasic,
+      "openclaw/plugin-sdk/channel-secret-tts-runtime": _omitTts,
+      ...rest
+    }) => rest)(EXTENSION_PACKAGE_BOUNDARY_BASE_PATHS),
+    "../",
+  ),
+  "openclaw/plugin-sdk/channel-entry-contract": [
+    "../../dist/plugin-sdk/src/plugin-sdk/channel-entry-contract.d.ts",
+  ],
+  "openclaw/plugin-sdk/browser-maintenance": [
+    "../../dist/plugin-sdk/src/plugin-sdk/browser-maintenance.d.ts",
+  ],
+  "openclaw/plugin-sdk/cli-runtime": ["../../dist/plugin-sdk/src/plugin-sdk/cli-runtime.d.ts"],
+  "openclaw/plugin-sdk/provider-catalog-shared": [
+    "../../dist/plugin-sdk/src/plugin-sdk/provider-catalog-shared.d.ts",
   ],
   "openclaw/plugin-sdk/provider-env-vars": [
-    "../../packages/plugin-sdk/dist/src/plugin-sdk/provider-env-vars.d.ts",
+    "../../dist/plugin-sdk/src/plugin-sdk/provider-env-vars.d.ts",
+  ],
+  "openclaw/plugin-sdk/provider-entry": [
+    "../../dist/plugin-sdk/src/plugin-sdk/provider-entry.d.ts",
+  ],
+  "openclaw/plugin-sdk/provider-web-search-contract": [
+    "../../dist/plugin-sdk/src/plugin-sdk/provider-web-search-contract.d.ts",
   ],
   "@openclaw/*.js": ["../../packages/plugin-sdk/dist/extensions/*.d.ts", "../*"],
   "@openclaw/*": ["../*"],
-  "@openclaw/plugin-sdk/*": ["../../packages/plugin-sdk/dist/src/plugin-sdk/*.d.ts"],
+  "@openclaw/plugin-sdk/*": ["../../dist/plugin-sdk/src/plugin-sdk/*.d.ts"],
   "@openclaw/anthropic-vertex/api.js": ["./.boundary-stubs/anthropic-vertex-api.d.ts"],
   "@openclaw/ollama/api.js": ["./.boundary-stubs/ollama-api.d.ts"],
   "@openclaw/ollama/runtime-api.js": ["./.boundary-stubs/ollama-runtime-api.d.ts"],
diff --git a/src/plugins/contracts/boundary-invariants.test.ts b/src/plugins/contracts/boundary-invariants.test.ts
index a9b855033a3..9c44e0e32cc 100644
--- a/src/plugins/contracts/boundary-invariants.test.ts
+++ b/src/plugins/contracts/boundary-invariants.test.ts
@@ -15,6 +15,7 @@ const ALLOWED_BUNDLED_CAPABILITY_METADATA_CONSUMERS = new Set([
 const ALLOWED_EXTENSION_PATH_STRING_TESTS = new Set([
   "src/plugin-sdk/browser-maintenance.test.ts",
   "src/channels/plugins/bundled.shape-guard.test.ts",
+  "src/cli/capability-cli.test.ts",
   "src/commands/doctor-legacy-config.migrations.test.ts",
   "src/plugins/contracts/bundled-extension-config-api-guardrails.test.ts",
   "src/scripts/test-projects.test.ts",