refactor: remove remaining channel and gateway boundary leaks

Author: steipete

src/channels/plugins/contracts/channel-import-guardrails.test.ts

@@ -3,21 +3,24 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 import { classifyBundledExtensionSourcePath } from "../../../../scripts/lib/extension-source-classifier.mjs";
-import {
-  BUNDLED_PLUGIN_PATH_PREFIX,
-  BUNDLED_PLUGIN_ROOT_DIR,
-  bundledPluginFile,
-} from "../../../../test/helpers/bundled-plugin-paths.js";
+import { loadPluginManifestRegistry } from "../../../plugins/manifest-registry.js";
 import { GUARDED_EXTENSION_PUBLIC_SURFACE_BASENAMES } from "../../../plugins/public-artifacts.js";
 
 const ROOT_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
 const REPO_ROOT = resolve(ROOT_DIR, "..");
 const ALLOWED_EXTENSION_PUBLIC_SURFACES = new Set(GUARDED_EXTENSION_PUBLIC_SURFACE_BASENAMES);
 ALLOWED_EXTENSION_PUBLIC_SURFACES.add("test-api.js");
-const BUNDLED_EXTENSION_IDS = readdirSync(resolve(REPO_ROOT, "extensions"), { withFileTypes: true })
-  .filter((entry) => entry.isDirectory() && entry.name !== "shared")
-  .map((entry) => entry.name)
-  .toSorted((left, right) => right.length - left.length);
+const BUNDLED_PLUGIN_ROOT_DIR = "extensions";
+const bundledPluginRecords = loadPluginManifestRegistry({
+  cache: true,
+  config: {},
+}).plugins.filter((plugin) => plugin.origin === "bundled");
+const bundledPluginRoots = new Map(
+  bundledPluginRecords.map((plugin) => [plugin.id, plugin.rootDir] as const),
+);
+const BUNDLED_EXTENSION_IDS = [...bundledPluginRoots.keys()].toSorted(
+  (left, right) => right.length - left.length,
+);
 const GUARDED_CHANNEL_EXTENSIONS = new Set([
   "bluebubbles",
   "discord",
@@ -44,6 +47,14 @@ const GUARDED_CHANNEL_EXTENSIONS = new Set([
 // Shared config validation intentionally consumes this curated Telegram contract.
 const ALLOWED_CORE_CHANNEL_SDK_SUBPATHS = new Set(["telegram-command-config"]);
 
+function bundledPluginFile(pluginId: string, relativePath: string): string {
+  const rootDir = bundledPluginRoots.get(pluginId);
+  if (!rootDir) {
+    throw new Error(`missing bundled plugin root for ${pluginId}`);
+  }
+  return normalizePath(resolve(rootDir, relativePath));
+}
+
 type GuardedSource = {
   path: string;
   forbiddenPatterns: RegExp[];
@@ -320,18 +331,18 @@ function readSetupBarrelImportBlock(path: string): string {
 }
 
 function collectExtensionSourceFiles(): string[] {
-  const extensionsDir = normalizePath(resolve(ROOT_DIR, "..", "extensions"));
-  const sharedExtensionsDir = normalizePath(resolve(extensionsDir, "shared"));
-  extensionSourceFilesCache = collectSourceFiles(extensionSourceFilesCache, {
-    rootDir: resolve(ROOT_DIR, "..", "extensions"),
-    shouldSkipPath: (normalizedFullPath) =>
-      normalizedFullPath.includes(sharedExtensionsDir) ||
-      normalizedFullPath.includes(`${extensionsDir}/shared/`),
-    shouldSkipEntry: ({ entryName, normalizedFullPath }) =>
-      classifyBundledExtensionSourcePath(normalizedFullPath).isTestLike ||
-      entryName === "api.ts" ||
-      entryName === "runtime-api.ts",
-  });
+  if (extensionSourceFilesCache) {
+    return extensionSourceFilesCache;
+  }
+  extensionSourceFilesCache = bundledPluginRecords.flatMap((plugin) =>
+    collectSourceFiles(undefined, {
+      rootDir: plugin.rootDir,
+      shouldSkipEntry: ({ entryName, normalizedFullPath }) =>
+        classifyBundledExtensionSourcePath(normalizedFullPath).isTestLike ||
+        entryName === "api.ts" ||
+        entryName === "runtime-api.ts",
+    }),
+  );
   return extensionSourceFilesCache;
 }
 
@@ -361,8 +372,12 @@ function collectCoreSourceFiles(): string[] {
 
 function collectExtensionFiles(extensionId: string): string[] {
   const cached = extensionFilesCache.get(extensionId);
+  const rootDir = bundledPluginRoots.get(extensionId);
+  if (!rootDir) {
+    return [];
+  }
   const files = collectSourceFiles(cached, {
-    rootDir: resolve(ROOT_DIR, "..", "extensions", extensionId),
+    rootDir,
     shouldSkipEntry: ({ entryName, normalizedFullPath }) =>
       classifyBundledExtensionSourcePath(normalizedFullPath).isTestLike ||
       entryName === "runtime-api.ts",
@@ -406,7 +421,7 @@ function getSourceAnalysis(path: string): SourceAnalysis {
     text,
     importSpecifiers,
     extensionImports: importSpecifiers.filter((specifier) =>
-      specifier.includes(BUNDLED_PLUGIN_PATH_PREFIX),
+      specifier.includes(`/${BUNDLED_PLUGIN_ROOT_DIR}/`),
     ),
   } satisfies SourceAnalysis;
   sourceAnalysisCache.set(fullPath, analysis);

src/channels/plugins/session-conversation.bundled-fallback.test.ts

@@ -27,17 +27,6 @@ vi.mock("../../plugin-sdk/facade-runtime.js", async () => {
   };
 });
 
-vi.mock("../../plugins/bundled-plugin-metadata.js", async () => {
-  const actual = await vi.importActual<typeof import("../../plugins/bundled-plugin-metadata.js")>(
-    "../../plugins/bundled-plugin-metadata.js",
-  );
-  return {
-    ...actual,
-    resolveBundledPluginPublicSurfacePath: ({ dirName }: { dirName: string }) =>
-      dirName === fallbackState.activeDirName ? `/tmp/${dirName}/session-key-api.js` : null,
-  };
-});
-
 import { resolveSessionConversationRef } from "./session-conversation.js";
 
 describe("session conversation bundled fallback", () => {

src/channels/plugins/session-conversation.ts

@@ -1,7 +1,4 @@
-import { fileURLToPath } from "node:url";
 import { tryLoadActivatedBundledPluginPublicSurfaceModuleSync } from "../../plugin-sdk/facade-runtime.js";
-import { resolveBundledPluginsDir } from "../../plugins/bundled-dir.js";
-import { resolveBundledPluginPublicSurfacePath } from "../../plugins/bundled-plugin-metadata.js";
 import {
   parseRawSessionConversationRef,
   parseThreadSessionSuffix,
@@ -47,7 +44,6 @@ type BundledSessionKeyModule = {
   ) => SessionConversationHookResult | null;
 };
 
-const OPENCLAW_PACKAGE_ROOT = fileURLToPath(new URL("../../..", import.meta.url));
 const SESSION_KEY_API_ARTIFACT_BASENAME = "session-key-api.js";
 
 type NormalizedSessionConversationResolution = ResolvedSessionConversation & {
@@ -140,16 +136,6 @@ function resolveBundledSessionConversationFallback(params: {
   rawId: string;
 }): NormalizedSessionConversationResolution | null {
   const dirName = normalizeResolvedChannel(params.channel);
-  if (
-    !resolveBundledPluginPublicSurfacePath({
-      rootDir: OPENCLAW_PACKAGE_ROOT,
-      bundledPluginsDir: resolveBundledPluginsDir(),
-      dirName,
-      artifactBasename: SESSION_KEY_API_ARTIFACT_BASENAME,
-    })
-  ) {
-    return null;
-  }
   let resolveSessionConversation: BundledSessionKeyModule["resolveSessionConversation"];
   try {
     resolveSessionConversation =

src/gateway/server.agent.gateway-server-agent.mocks.ts

@@ -1,7 +1,7 @@
 import { vi } from "vitest";
 import { createEmptyPluginRegistry, type PluginRegistry } from "../plugins/registry.js";
 import { setActivePluginRegistry } from "../plugins/runtime.js";
-import { setTestPluginRegistry } from "./test-helpers.mocks.js";
+import { setTestPluginRegistry } from "./test-helpers.plugin-registry.js";
 
 export const registryState: { registry: PluginRegistry } = {
   registry: createEmptyPluginRegistry(),

src/gateway/server.chat.gateway-server-chat.test.ts

@@ -18,7 +18,7 @@ import {
   withGatewayServer,
   writeSessionStore,
 } from "./test-helpers.js";
-import { agentCommand } from "./test-helpers.mocks.js";
+import { agentCommand } from "./test-helpers.runtime-state.js";
 import { installConnectedControlUiServerSuite } from "./test-with-server.js";
 
 installGatewayTestHooks({ scope: "suite" });

src/gateway/server.preauth-hardening.test.ts

@@ -6,7 +6,7 @@ import { MAX_PREAUTH_PAYLOAD_BYTES } from "./server-constants.js";
 import { attachGatewayUpgradeHandler, createGatewayHttpServer } from "./server-http.js";
 import { createPreauthConnectionBudget } from "./server/preauth-connection-budget.js";
 import type { GatewayWsClient } from "./server/ws-types.js";
-import { testState } from "./test-helpers.mocks.js";
+import { testState } from "./test-helpers.runtime-state.js";
 import {
   createGatewaySuiteHarness,
   installGatewayTestHooks,

src/gateway/session-message-events.test.ts

@@ -5,7 +5,7 @@ import { afterEach, describe, expect, test, vi } from "vitest";
 import { appendAssistantMessageToSessionTranscript } from "../config/sessions/transcript.js";
 import { emitSessionLifecycleEvent } from "../sessions/session-lifecycle-events.js";
 import { emitSessionTranscriptUpdate } from "../sessions/transcript-events.js";
-import { testState } from "./test-helpers.mocks.js";
+import { testState } from "./test-helpers.runtime-state.js";
 import {
   connectOk,
   createGatewaySuiteHarness,

src/gateway/sessions-history-http.test.ts

@@ -3,7 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { afterEach, describe, expect, test } from "vitest";
 import { appendAssistantMessageToSessionTranscript } from "../config/sessions/transcript.js";
-import { testState } from "./test-helpers.mocks.js";
+import { testState } from "./test-helpers.runtime-state.js";
 import {
   connectReq,
   createGatewaySuiteHarness,