fix: repair bundled channel secret sidecars

CHANGELOG.md

@@ -110,6 +110,7 @@ Docs: https://docs.openclaw.ai
 - Agents/model resolution: keep explicit-model runtime comparisons on the configured workspace plugin registry, so workspace-installed providers do not silently fall back to stale explicit metadata during runtime model lookup.
 - Providers/Z.AI: default onboarding and endpoint detection to GLM-5.1 instead of GLM-5. (#61998) Thanks @serg0x.
 - Telegram/setup: load setup and secret contracts through packaged top-level sidecars so installed 2026.4.7 npm builds no longer try to import missing `dist/extensions/telegram/src/*` files during gateway startup.
+- Bundled channels/setup: load shared secret contracts through packaged top-level sidecars across BlueBubbles, Feishu, Google Chat, IRC, Matrix, Mattermost, Microsoft Teams, Nextcloud Talk, Slack, and Zalo so installed npm builds no longer rely on missing `dist/extensions/*/src/*` files during gateway startup.
 
 ## 2026.4.5
 

extensions/bluebubbles/index.ts

@@ -10,7 +10,7 @@ export default defineBundledChannelEntry({
     exportName: "bluebubblesPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/bluebubbles/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/bluebubbles/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "bluebubblesSetupPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/feishu/channel-entry.ts

@@ -10,7 +10,7 @@ export default defineBundledChannelEntry({
     exportName: "feishuPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/feishu/index.ts

@@ -71,7 +71,7 @@ export default defineBundledChannelEntry({
     exportName: "feishuPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/feishu/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/feishu/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "feishuPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/googlechat/index.ts

@@ -10,7 +10,7 @@ export default defineBundledChannelEntry({
     exportName: "googlechatPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/googlechat/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/googlechat/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "googlechatPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/irc/index.ts

@@ -10,7 +10,7 @@ export default defineBundledChannelEntry({
     exportName: "ircPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/irc/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/irc/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "ircPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/matrix/index.ts

@@ -12,7 +12,7 @@ export default defineBundledChannelEntry({
     exportName: "matrixPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/matrix/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/matrix/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "matrixPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/mattermost/index.ts

@@ -22,7 +22,7 @@ export default defineBundledChannelEntry({
     exportName: "mattermostPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/mattermost/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/mattermost/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "mattermostSetupPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/msteams/index.ts

@@ -10,7 +10,7 @@ export default defineBundledChannelEntry({
     exportName: "msteamsPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/msteams/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/msteams/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "msteamsPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/nextcloud-talk/index.ts

@@ -10,7 +10,7 @@ export default defineBundledChannelEntry({
     exportName: "nextcloudTalkPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/nextcloud-talk/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/nextcloud-talk/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "nextcloudTalkPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/slack/channel-entry.ts

@@ -10,7 +10,7 @@ export default defineBundledChannelEntry({
     exportName: "slackPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/slack/index.ts

@@ -22,7 +22,7 @@ export default defineBundledChannelEntry({
     exportName: "slackPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/slack/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/slack/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "slackSetupPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

extensions/zalo/index.ts

@@ -10,7 +10,7 @@ export default defineBundledChannelEntry({
     exportName: "zaloPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
   runtime: {

extensions/zalo/secret-contract-api.ts

@@ -1,4 +1,5 @@
 export {
+  channelSecrets,
   collectRuntimeConfigAssignments,
   secretTargetRegistryEntries,
 } from "./src/secret-contract.js";

extensions/zalo/setup-entry.ts

@@ -7,7 +7,7 @@ export default defineBundledChannelSetupEntry({
     exportName: "zaloPlugin",
   },
   secrets: {
-    specifier: "./src/secret-contract.js",
+    specifier: "./secret-contract-api.js",
     exportName: "channelSecrets",
   },
 });

test/scripts/bundled-plugin-build-entries.test.ts

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import path from "node:path";
 import { describe, expect, it } from "vitest";
 import {
   listBundledPluginBuildEntries,
@@ -49,15 +50,40 @@ describe("bundled plugin build entries", () => {
     expect(artifacts).toContain("dist/extensions/matrix/plugin-entry.handlers.runtime.js");
   });
 
-  it("keeps the Telegram setup entry on packed top-level sidecars", () => {
-    const setupEntry = fs.readFileSync("extensions/telegram/setup-entry.ts", "utf8");
+  it("keeps bundled channel secret contracts on packed top-level sidecars", () => {
     const artifacts = listBundledPluginPackArtifacts();
+    const sourceEntries = ["index.ts", "channel-entry.ts", "setup-entry.ts"];
+    const offenders: string[] = [];
+    const secretBackedPluginIds = new Set<string>();
 
-    expect(setupEntry).toContain('specifier: "./setup-plugin-api.js"');
-    expect(setupEntry).toContain('specifier: "./secret-contract-api.js"');
-    expect(setupEntry).not.toContain("./src/channel.setup.js");
-    expect(setupEntry).not.toContain("./src/secret-contract.js");
-    expect(artifacts).toContain("dist/extensions/telegram/setup-plugin-api.js");
-    expect(artifacts).toContain("dist/extensions/telegram/secret-contract-api.js");
+    for (const dirent of fs.readdirSync("extensions", { withFileTypes: true })) {
+      if (!dirent.isDirectory()) {
+        continue;
+      }
+
+      for (const sourceEntry of sourceEntries) {
+        const entryPath = path.join("extensions", dirent.name, sourceEntry);
+        if (!fs.existsSync(entryPath)) {
+          continue;
+        }
+        const entry = fs.readFileSync(entryPath, "utf8");
+        if (!entry.includes('exportName: "channelSecrets"')) {
+          continue;
+        }
+        secretBackedPluginIds.add(dirent.name);
+        if (entry.includes("./src/secret-contract.js")) {
+          offenders.push(entryPath);
+        }
+        expect(entry).toContain('specifier: "./secret-contract-api.js"');
+      }
+    }
+
+    expect(offenders).toEqual([]);
+
+    for (const pluginId of [...secretBackedPluginIds].toSorted()) {
+      const secretApiPath = path.join("extensions", pluginId, "secret-contract-api.ts");
+      expect(fs.readFileSync(secretApiPath, "utf8")).toContain("channelSecrets");
+      expect(artifacts).toContain(`dist/extensions/${pluginId}/secret-contract-api.js`);
+    }
   });
 });