refactor(plugins): move extension seams into extensions

extensions/irc/src/channel.ts

@@ -28,6 +28,7 @@ import {
   type ResolvedIrcAccount,
 } from "./accounts.js";
 import { IrcChannelConfigSchema } from "./config-schema.js";
+import { collectIrcMutableAllowlistWarnings } from "./doctor.js";
 import { monitorIrcProvider } from "./monitor.js";
 import {
   normalizeIrcMessagingTarget,
@@ -187,6 +188,10 @@ export const ircPlugin: ChannelPlugin<ResolvedIrcAccount, IrcProbe> = createChat
           },
         }),
     },
+    doctor: {
+      groupAllowFromFallbackToAllowFrom: false,
+      collectMutableAllowlistWarnings: collectIrcMutableAllowlistWarnings,
+    },
     groups: {
       resolveRequireMention: ({ cfg, accountId, groupId }) => {
         const account = resolveIrcAccount({ cfg: cfg as CoreConfig, accountId });

extensions/irc/src/doctor.ts

@@ -0,0 +1,53 @@
+import { createDangerousNameMatchingMutableAllowlistWarningCollector } from "openclaw/plugin-sdk/channel-policy";
+
+function asObjectRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function isIrcMutableAllowEntry(raw: string): boolean {
+  const text = raw.trim().toLowerCase();
+  if (!text || text === "*") {
+    return false;
+  }
+
+  const normalized = text
+    .replace(/^irc:/, "")
+    .replace(/^user:/, "")
+    .trim();
+
+  return !normalized.includes("!") && !normalized.includes("@");
+}
+
+export const collectIrcMutableAllowlistWarnings =
+  createDangerousNameMatchingMutableAllowlistWarningCollector({
+    channel: "irc",
+    detector: isIrcMutableAllowEntry,
+    collectLists: (scope) => {
+      const lists = [
+        {
+          pathLabel: `${scope.prefix}.allowFrom`,
+          list: scope.account.allowFrom,
+        },
+        {
+          pathLabel: `${scope.prefix}.groupAllowFrom`,
+          list: scope.account.groupAllowFrom,
+        },
+      ];
+      const groups = asObjectRecord(scope.account.groups);
+      if (groups) {
+        for (const [groupKey, groupRaw] of Object.entries(groups)) {
+          const group = asObjectRecord(groupRaw);
+          if (!group) {
+            continue;
+          }
+          lists.push({
+            pathLabel: `${scope.prefix}.groups.${groupKey}.allowFrom`,
+            list: group.allowFrom,
+          });
+        }
+      }
+      return lists;
+    },
+  });

extensions/irc/src/runtime-api.ts

@@ -1,38 +1,51 @@
 // Private runtime barrel for the bundled IRC extension.
-// Keep this barrel thin and aligned with the local extension surface.
+// Keep this barrel thin and generic-only.
 
-export {
-  buildBaseChannelStatusSummary,
-  createAccountStatusSink,
-  chunkTextForOutbound,
-  createChannelPairingController,
-  DEFAULT_ACCOUNT_ID,
-  deliverFormattedTextWithAttachments,
-  dispatchInboundReplyWithBase,
-  getChatChannelMeta,
-  GROUP_POLICY_BLOCKED_LABEL,
-  isDangerousNameMatchingEnabled,
-  logInboundDrop,
-  PAIRING_APPROVED_MESSAGE,
-  readStoreAllowFromForDmPolicy,
-  resolveAllowlistProviderRuntimeGroupPolicy,
-  resolveControlCommandGate,
-  resolveDefaultGroupPolicy,
-  resolveEffectiveAllowFromLists,
-  warnMissingProviderGroupPolicyFallbackOnce,
-} from "openclaw/plugin-sdk/irc";
 export type {
   BaseProbeResult,
-  BlockStreamingCoalesceConfig,
   ChannelPlugin,
+  OpenClawConfig,
+  PluginRuntime,
+} from "openclaw/plugin-sdk/core";
+export type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";
+export type {
+  BlockStreamingCoalesceConfig,
   DmConfig,
   DmPolicy,
   GroupPolicy,
   GroupToolPolicyBySenderConfig,
   GroupToolPolicyConfig,
   MarkdownConfig,
-  OpenClawConfig,
-  OutboundReplyPayload,
-  PluginRuntime,
-  RuntimeEnv,
-} from "openclaw/plugin-sdk/irc";
+} from "openclaw/plugin-sdk/config-runtime";
+export type { OutboundReplyPayload } from "openclaw/plugin-sdk/reply-payload";
+export {
+  DEFAULT_ACCOUNT_ID,
+  buildChannelConfigSchema,
+  getChatChannelMeta,
+} from "openclaw/plugin-sdk/core";
+export {
+  PAIRING_APPROVED_MESSAGE,
+  buildBaseChannelStatusSummary,
+} from "openclaw/plugin-sdk/channel-status";
+export { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
+export { createAccountStatusSink } from "openclaw/plugin-sdk/compat";
+export {
+  readStoreAllowFromForDmPolicy,
+  resolveEffectiveAllowFromLists,
+} from "openclaw/plugin-sdk/channel-policy";
+export { resolveControlCommandGate } from "openclaw/plugin-sdk/command-auth";
+export { dispatchInboundReplyWithBase } from "openclaw/plugin-sdk/inbound-reply-dispatch";
+export { chunkTextForOutbound } from "openclaw/plugin-sdk/text-chunking";
+export {
+  deliverFormattedTextWithAttachments,
+  formatTextWithAttachmentLinks,
+  resolveOutboundMediaUrls,
+} from "openclaw/plugin-sdk/reply-payload";
+export {
+  GROUP_POLICY_BLOCKED_LABEL,
+  resolveAllowlistProviderRuntimeGroupPolicy,
+  resolveDefaultGroupPolicy,
+  warnMissingProviderGroupPolicyFallbackOnce,
+  isDangerousNameMatchingEnabled,
+} from "openclaw/plugin-sdk/config-runtime";
+export { logInboundDrop } from "openclaw/plugin-sdk/channel-inbound";