@openclaw/plugin-inspector 0.3.25 → 0.3.26

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 0.3.26 - 2026-09-20
+
+### Fixed
+
+- Recognize OpenClaw's declared private-local Plugin SDK subpaths and reserved bundled-plugin imports when inspecting bundled `extensions/*` fixtures, while continuing to report those imports for external plugins and genuinely missing SDK aliases.
+- Treat active OpenClaw conversation-access compat records with present contract tests as target-owned proof instead of repeatedly emitting a P1 Inspector probe backlog advisory.
+- Record explicit method-scoped Gateway probe prerequisites before calling handlers that require unavailable host state or live credentials; preserve actual response failures for admitted probes.
+- Preserve absent optional strings in SDK mocks and supply a stable runtime config snapshot to Gateway probes instead of inventing configured values or missing host accessors.
+- Generate SDK mocks for literal dynamic imports in retained handlers, including their named exports, while excluding TypeScript import types and keeping source inspection aligned with runtime capture.
+- Honor the OpenClaw lazy-runtime SDK contract in generated mocks, preserving deferred module loading, shared promise caches, explicit cache clearing, and rejected imports instead of returning callable placeholders.
+- Reject invalid batch concurrency instead of reporting success without inspecting any plugins, and preserve relative plugin paths in retained reports so similar directory names cannot overwrite each other's results.
+- Preserve error messages from the OpenClaw `error-runtime` SDK subpath in synthetic probes, including lazy CommonJS imports, so Gateway rejections report their actual cause and remain failures.
+- Keep tool-hook and conversation-privacy contract gaps open when runtime artifacts only capture hook registration. Preserve registration coverage and semantic contract probes.
+- Read OpenClaw compatibility records from the explicitly imported `registry-records.ts` data module, avoiding false missing-record findings after the registry split. Preserve inline registries and report missing delegated data as an error.
+
 ## 0.3.25 - 2026-09-09
 
 ### Fixed

package/README.md

@@ -200,6 +200,13 @@ Common options:
 | `--junit [path]` | Write JUnit XML from `check` or `inspect`; `ci` enables this by default. |
 | `--no-sarif` / `--no-junit` | Disable default `ci` outputs. |
 
+For `batch`, `--concurrency <n>` must be a finite number (default `4`, rounded
+and clamped to `1`–`32` workers). Invalid or missing values fail before inspection
+or report writes. `--keep-plugin-reports` retains individual reports under
+`<out>/plugins/<relative-plugin-path>/`, preserving the corpus directory layout
+and names so plugins such as `a/b`, `a-b`, and `a b` cannot overwrite each other's
+reports. If the corpus root is itself a plugin, its reports go in `<out>/plugins/`.
+
 Run the built-in help for the exact CLI surface:
 
 ```bash
@@ -338,6 +345,15 @@ aliases do not create extra calls. The handler receives synthetic Gateway
 options and a void `respond(ok, payload, error, meta)` callback. Existing
 `registrationProbeInputs` overrides remain available.
 
+For a method that needs unavailable host state or live credentials, pass
+`gatewayMethodPrerequisites: { "fixture.account": "saved account required" }`
+to `runCapturedSyntheticProbes` or `runEntrypointSyntheticProbes`. The named
+method produces a `blocked` row with its method and reason before its handler
+runs. Other methods retain normal response validation. Once a caller supplies
+the required inputs and runtime, omit that method from the prerequisite map;
+rejected or malformed responses still fail. This option never reports a
+missing prerequisite as a passing runtime check.
+
 The first emitted response is authoritative, even when malformed. Probes check
 its JSON-serialized response/error shape: `ok: true` passes, `ok: false` fails,
 and later responses cannot overwrite the outcome. Logging `meta` is not a wire
@@ -567,6 +583,8 @@ npm run check
 ```
 
 `npm run check` runs the Node test suite and the package-contents guard. The
+test runner limits parallel test files to four so process-supervision tests do
+not contend with a machine-wide burst of child processes for their deadlines. The
 contents guard shells through `npm pack --dry-run --json` and verifies the npm
 tarball includes package entrypoints, examples, README assets, and no private
 `test/`, `scripts/`, or `.github/` paths.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/plugin-inspector",
-  "version": "0.3.25",
+  "version": "0.3.26",
   "private": false,
   "description": "Offline compatibility inspector for OpenClaw plugins.",
   "type": "module",
@@ -57,7 +57,7 @@
     "release:readiness": "npm run release:local && npm run release:crabpot",
     "release:local": "npm run check",
     "release:notes": "node scripts/release-notes.mjs --unreleased",
-    "test": "node --test test/*.test.js",
+    "test": "node --test --test-concurrency=4 test/*.test.js",
     "check:changed": "npm run check",
     "test:changed": "npm test",
     "crabbox:hydrate": "crabbox actions hydrate",
@@ -72,6 +72,8 @@
     "ci"
   ],
   "dependencies": {
+    "acorn": "^8.18.0",
+    "eslint-scope": "^8.4.0",
     "semver": "^7.8.5",
     "tar": "^7.5.22"
   }

package/src/batch.js

@@ -21,7 +21,11 @@ export async function runBatchAnalysis(options = {}) {
   const rootDir = path.resolve(options.rootDir ?? options.inputDir ?? process.cwd());
   const outDir = options.outDir ?? "reports";
   const outRoot = path.resolve(rootDir, outDir);
-  const concurrency = Math.max(1, Math.min(Math.round(options.concurrency ?? 4), 32));
+  const requestedConcurrency = options.concurrency ?? 4;
+  if (!Number.isFinite(requestedConcurrency)) {
+    throw new TypeError("batch concurrency must be a finite number");
+  }
+  const concurrency = Math.max(1, Math.min(Math.round(requestedConcurrency), 32));
   const keepPluginReports = options.keepPluginReports === true;
   const targetOpenClaw =
     options.targetOpenClaw ??
@@ -35,8 +39,8 @@ export async function runBatchAnalysis(options = {}) {
   try {
     await runWithConcurrency(pluginRoots, concurrency, async (pluginRoot) => {
       const reportsRoot = keepPluginReports
-        ? path.join(outRoot, "plugins", slugForPath(path.relative(rootDir, pluginRoot)))
-        : path.join(tempRoot, slugForPath(path.relative(rootDir, pluginRoot)));
+        ? path.join(outRoot, "plugins", path.relative(rootDir, pluginRoot))
+        : path.join(tempRoot, path.relative(rootDir, pluginRoot));
       entries.push(
         await inspectBatchPlugin(pluginRoot, {
           ...options,
@@ -306,12 +310,3 @@ function packageNameFromReport(report) {
     "plugin"
   );
 }
-
-function slugForPath(value) {
-  return (
-    String(value)
-      .replaceAll(path.sep, "-")
-      .replace(/[^a-zA-Z0-9._-]+/g, "-")
-      .replace(/^-+|-+$/g, "") || "plugin"
-  );
-}

package/src/cli.js

@@ -61,7 +61,9 @@ async function runBatch(commandArgs) {
   const outDir = readFlag(commandArgs, "--out") ?? "reports";
   const openclawPath = commandArgs.includes("--no-openclaw") ? false : readFlag(commandArgs, "--openclaw");
   const openclawVersion = readOpenClawVersion(commandArgs);
-  const concurrency = Number(readFlag(commandArgs, "--concurrency") ?? "4");
+  const concurrency = commandArgs.includes("--concurrency")
+    ? Number(readFlag(commandArgs, "--concurrency") ?? NaN)
+    : 4;
   const json = commandArgs.includes("--json");
   const check = commandArgs.includes("--check");
   const keepPluginReports = commandArgs.includes("--keep-plugin-reports");

package/src/fixture-summary.js

@@ -550,14 +550,16 @@ export function classifyCompatibilityFixture({ fixture, inspection, fixtureRepor
 
   const conversationHooks = inspection.hooks.filter((hook) => conversationAccessHooks.has(hook));
   const conversationHookDetails = inspection.hookDetails.filter((hook) => conversationAccessHooks.has(hook.name));
-  if (conversationHooks.length > 0) {
+  const conversationCompatRecord = compatRecordForIssueCode("conversation-access-hook");
+  const conversationContractCovered = hasActiveTargetContractTests(targetOpenClaw, conversationCompatRecord);
+  if (conversationHooks.length > 0 && !conversationContractCovered) {
     warnings.push({
       fixture: fixture.id,
       code: "conversation-access-hook",
       level: "warning",
       message: "fixture observes raw model or conversation content and needs privacy-boundary contract probes",
       evidence: detailEvidence(conversationHookDetails),
-      compatRecord: compatRecordForIssueCode("conversation-access-hook"),
+      compatRecord: conversationCompatRecord,
     });
     decisions.push({
       fixture: fixture.id,
@@ -713,6 +715,15 @@ export function classifyCompatibilityFixture({ fixture, inspection, fixtureRepor
   return { breakages, warnings, suggestions, logs, decisions };
 }
 
+function hasActiveTargetContractTests(targetOpenClaw, compatRecord) {
+  if (!compatRecord || !["active", "supported"].includes(targetOpenClaw.compatRecordStatuses?.[compatRecord])) {
+    return false;
+  }
+  const tests = targetOpenClaw.compatRecordTests?.[compatRecord] ?? [];
+  const missingTests = targetOpenClaw.compatRecordMissingTests?.[compatRecord] ?? [];
+  return tests.length > 0 && missingTests.length === 0;
+}
+
 function classifySdkDeprecations({ fixture, inspection, fixtureReport, warnings, decisions }) {
   const grouped = new Map();
   for (const finding of fixtureReport.sdkDeprecations ?? inspection.sdkDeprecations ?? []) {
@@ -883,10 +894,22 @@ function classifySdkImportCoverage({ fixture, fixtureReport, targetOpenClaw, war
   }
 
   const sdkExports = new Set(targetOpenClaw.sdkExports);
-  const unknownImports = fixtureReport.sdkImportDetails.filter((sdkImport) => !sdkExports.has(sdkImport.specifier));
+  const bundledPluginId = bundledOpenClawPluginId(fixture, targetOpenClaw);
+  const isBundledFixture = bundledPluginId !== null;
+  const privateLocalSdkExports = new Set(targetOpenClaw.privateLocalSdkExports ?? []);
+  const unknownImports = fixtureReport.sdkImportDetails.filter(
+    (sdkImport) =>
+      !sdkExports.has(sdkImport.specifier) &&
+      !(isBundledFixture && privateLocalSdkExports.has(sdkImport.specifier)),
+  );
   const reservedSdkExports = new Set(targetOpenClaw.reservedSdkExports ?? []);
-  const reservedImports = fixtureReport.sdkImportDetails.filter((sdkImport) =>
-    reservedSdkExports.has(sdkImport.specifier),
+  const reservedImports = fixtureReport.sdkImportDetails.filter(
+    (sdkImport) =>
+      reservedSdkExports.has(sdkImport.specifier) &&
+      !(
+        bundledPluginId !== null &&
+        targetOpenClaw.reservedSdkExportOwners?.[sdkImport.specifier] === bundledPluginId
+      ),
   );
 
   if (reservedImports.length === 0 && unknownImports.length === 0) {
@@ -894,7 +917,9 @@ function classifySdkImportCoverage({ fixture, fixtureReport, targetOpenClaw, war
       fixture: fixture.id,
       code: "sdk-exports-present",
       level: "log",
-      message: "all observed plugin SDK imports exist in target OpenClaw package exports",
+      message: isBundledFixture
+        ? "all observed plugin SDK imports are exported or declared private-local for bundled plugins"
+        : "all observed plugin SDK imports exist in target OpenClaw package exports",
       evidence: fixtureReport.sdkImports,
     });
     return;
@@ -938,6 +963,18 @@ function classifySdkImportCoverage({ fixture, fixtureReport, targetOpenClaw, war
   }
 }
 
+function bundledOpenClawPluginId(fixture, targetOpenClaw) {
+  if (fixture.repo !== "local" || !fixture.checkoutPath || !targetOpenClaw.checkoutPath) return null;
+  const fixturePath = normalizeRepoPath(fixture.checkoutPath);
+  const targetPath = normalizeRepoPath(targetOpenClaw.checkoutPath);
+  const relativePath = targetPath === "."
+    ? fixturePath
+    : fixturePath.startsWith(`${targetPath}/`)
+      ? fixturePath.slice(targetPath.length + 1)
+      : "";
+  return relativePath.match(/^extensions\/([^/]+)(?:\/|$)/)?.[1] ?? null;
+}
+
 function addVersionDerivedFinding({ finding, fixtureReport, targetOpenClaw, breakages, warnings, suggestions }) {
   const compatibility = targetCompatibility(fixtureReport, targetOpenClaw);
   if (!compatibility) {

package/src/inspector.js

@@ -1,6 +1,5 @@
 import { existsSync } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
-import * as nodeModule from "node:module";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createCaptureApi } from "./capture-api.js";
@@ -12,7 +11,7 @@ import { prepareOpenClawTarget, resolveOpenClawTargetVersion } from "./openclaw-
 import { resolveProcessLimits, startOwnedProcess } from "./process-profile.js";
 import { buildCompatibilityReport, buildReport } from "./report.js";
 import { inspectSdkDeprecations } from "./sdk-deprecation-rules.js";
-import { collectCommonJsRequires } from "./sdk-mock.js";
+import { collectRuntimeModuleImports } from "./runtime-imports.js";
 
 const pluginFactoryNames = "defineBundledChannelEntry|defineChannelPluginEntry|createChatChannelPlugin|definePluginEntry";
 // Bundlers emit unbound calls as (0, sdk.factory)(...), including inline require receivers.
@@ -28,6 +27,13 @@ export async function inspectFixtureSet(config, options = {}) {
 
 export async function inspectCompatibilityFixtureSet(config, options = {}) {
   const { inspections, failures } = await inspectConfiguredFixtures(config, options);
+  const reportConfig = {
+    ...config,
+    fixtures: config.fixtures.map((fixture) => ({
+      ...fixture,
+      checkoutPath: normalizeFixtureCheckoutPath(config, fixture),
+    })),
+  };
   const targetOpenClaw =
     options.targetOpenClaw ??
     (options.openclawVersion
@@ -39,7 +45,7 @@ export async function inspectCompatibilityFixtureSet(config, options = {}) {
         }));
 
   return buildCompatibilityReport({
-    config,
+    config: reportConfig,
     inspections,
     failures,
     authorFacing: options.authorFacing,
@@ -57,6 +63,11 @@ export async function inspectCompatibilityFixtureSet(config, options = {}) {
   });
 }
 
+function normalizeFixtureCheckoutPath(config, fixture) {
+  const relative = path.relative(config.rootDir ?? process.cwd(), fixtureCheckoutPath(config, fixture));
+  return (relative || ".").replaceAll("\\", "/");
+}
+
 async function inspectConfiguredFixtures(config, options = {}) {
   const inspections = [];
   const failures = [];
@@ -169,7 +180,7 @@ export function inspectSourceText(text, filePath = "source.js") {
     ...collectDetailedMatches(searchableText, new RegExp(String.raw`\b(${pluginFactoryNames})\s*\(`, "g"), filePath, "name"),
     ...collectDetailedMatches(searchableText, compiledFactoryCall, filePath, "name"),
   ];
-  const sdkImports = collectSdkImports(searchableText, filePath);
+  const sdkImports = collectSdkImports(searchableText, filePath, text);
   const sdkDeprecations = inspectSdkDeprecations(searchableText, filePath);
 
   return {
@@ -440,7 +451,7 @@ function collectDetailedMatches(text, regex, filePath, key) {
   return details;
 }
 
-function collectSdkImports(text, filePath) {
+function collectSdkImports(text, filePath, sourceText) {
   const details = [];
   for (const candidate of text.matchAll(/(?:^|;)[\t ]*(import|export)\b/gm)) {
     const keyword = candidate[1];
@@ -457,19 +468,8 @@ function collectSdkImports(text, filePath) {
     });
   }
 
-  const dynamicMatches = [...text.matchAll(/\bimport\(\s*["'`]([^"'`]*openclaw\/plugin-sdk[^"'`]*)/g)];
-  const runtimeDynamicImports = runtimeDynamicImportIndexes(text, dynamicMatches);
-  for (const [index, match] of dynamicMatches.entries()) {
-    if (!runtimeDynamicImports.has(index)) continue;
-    const line = lineForOffset(text, match.index ?? 0);
-    details.push({
-      specifier: match[1],
-      file: filePath,
-      line,
-      ref: `${filePath}:${line}`,
-    });
-  }
-  for (const { specifier, index } of collectCommonJsRequires(text)) {
+  // Comment masking can erase executable interpolations after URL-like template text.
+  for (const { specifier, index } of collectRuntimeModuleImports(sourceText)) {
     if (specifier !== "openclaw/plugin-sdk" && !specifier.startsWith("openclaw/plugin-sdk/")) continue;
     const line = lineForOffset(text, index);
     details.push({
@@ -540,50 +540,6 @@ function skipQuotedText(text, quoteIndex, quote) {
   return cursor;
 }
 
-function runtimeDynamicImportIndexes(text, matches) {
-  if (matches.length === 0) return new Set();
-  const markedImports = matches.map((match, index) => {
-    const specifier = match[1];
-    const specifierStart = (match.index ?? 0) + match[0].indexOf(specifier);
-    return {
-      index,
-      specifierStart,
-      specifierEnd: specifierStart + specifier.length,
-      marker: `${specifier}/__plugin_inspector_runtime_import_${index}__`,
-    };
-  });
-  let markedText = text;
-  for (const markedImport of markedImports.toReversed()) {
-    markedText =
-      markedText.slice(0, markedImport.specifierStart) +
-      markedImport.marker +
-      markedText.slice(markedImport.specifierEnd);
-  }
-
-  try {
-    const runtimeText = eraseTypeScript(markedText);
-    if (runtimeText === null) {
-      return new Set(markedImports.map((markedImport) => markedImport.index));
-    }
-    return new Set(
-      markedImports.filter((markedImport) => runtimeText.includes(markedImport.marker)).map((markedImport) => markedImport.index),
-    );
-  } catch {
-    return new Set(markedImports.map((markedImport) => markedImport.index));
-  }
-}
-
-function eraseTypeScript(text) {
-  if (typeof nodeModule.stripTypeScriptTypes === "function") {
-    return nodeModule.stripTypeScriptTypes(text, { mode: "transform" });
-  }
-  if (typeof globalThis.Bun?.Transpiler === "function") {
-    const transpiler = new globalThis.Bun.Transpiler({ loader: "ts", target: "bun" });
-    return transpiler.transformSync(text);
-  }
-  return null;
-}
-
 function isTypeOnlyStaticImportClause(clause) {
   clause = clause.trim();
   if (/^type\b/.test(clause)) {

package/src/openclaw-target.js

@@ -30,17 +30,36 @@ export async function readOpenClawTargetSurface(options = {}) {
     return readPackedOpenClawTargetSurface({ rootDir, requestedPaths, ...match });
   }
 
-  const { requestedPath, resolvedPath, registryPath } = match;
+  const { requestedPath, resolvedPath, registryPath: registryEntryPath } = match;
   const hookTypesPath = path.join(resolvedPath, "src/plugins/hook-types.ts");
   const apiBuilderPath = path.join(resolvedPath, "src/plugins/api-builder.ts");
   const capturedRegistrationPath = path.join(resolvedPath, "src/plugins/captured-registration.ts");
   const currentManifestTypesPath = path.join(resolvedPath, "src/plugins/manifest-types.ts");
   const legacyManifestTypesPath = path.join(resolvedPath, "src/plugins/manifest.ts");
   const pluginSdkEntrypointsPath = path.join(resolvedPath, "src/plugin-sdk/entrypoints.ts");
+  const privateLocalSdkSubpathsPath = path.join(
+    resolvedPath,
+    "scripts/lib/plugin-sdk-private-local-only-subpaths.json",
+  );
   const packagePath = path.join(resolvedPath, "package.json");
 
-  const registrySource = await readFile(registryPath, "utf8");
+  const registryEntrySource = await readFile(registryEntryPath, "utf8");
+  const registryPath = importsCompatRecords(registryEntrySource)
+    ? path.join(path.dirname(registryEntryPath), "registry-records.ts")
+    : registryEntryPath;
+  const registrySource = registryPath === registryEntryPath
+    ? registryEntrySource
+    : await readFile(registryPath, "utf8");
   const compatRecordEntries = parseCompatRecordEntries(registrySource);
+  const compatRecordTests = Object.fromEntries(
+    compatRecordEntries.map((record) => [record.code, record.tests]),
+  );
+  const compatRecordMissingTests = Object.fromEntries(
+    compatRecordEntries.map((record) => [
+      record.code,
+      record.tests.filter((testPath) => !existsSync(path.join(resolvedPath, testPath))),
+    ]),
+  );
   const hookTypesSource = existsSync(hookTypesPath) ? await readFile(hookTypesPath, "utf8") : "";
   const hookNames = hookTypesSource ? parseConstStringArray(hookTypesSource, "PLUGIN_HOOK_NAMES") : [];
   const apiBuilderSource = existsSync(apiBuilderPath) ? await readFile(apiBuilderPath, "utf8") : "";
@@ -66,12 +85,21 @@ export async function readOpenClawTargetSurface(options = {}) {
   const sdkExports = existsSync(packagePath)
     ? parsePluginSdkExports(JSON.parse(await readFile(packagePath, "utf8")))
     : [];
+  const privateLocalSdkExports = existsSync(privateLocalSdkSubpathsPath)
+    ? parsePluginSdkSubpathSpecifiers(
+        JSON.parse(await readFile(privateLocalSdkSubpathsPath, "utf8")),
+      )
+    : [];
   const pluginSdkEntrypointsSource = existsSync(pluginSdkEntrypointsPath)
     ? await readFile(pluginSdkEntrypointsPath, "utf8")
     : "";
   const reservedSdkExports = pluginSdkEntrypointsSource
     ? parsePluginSdkEntrypointSpecifiers(pluginSdkEntrypointsSource, "reservedBundledPluginSdkEntrypoints")
     : [];
+  const bundledPluginIds = await readBundledPluginIds(resolvedPath);
+  const reservedSdkExportOwners = Object.fromEntries(
+    reservedSdkExports.map((specifier) => [specifier, resolveBundledSdkOwner(specifier, bundledPluginIds)]),
+  );
   const supportedFacadeSdkExports = pluginSdkEntrypointsSource
     ? parsePluginSdkEntrypointSpecifiers(pluginSdkEntrypointsSource, "supportedBundledFacadeSdkEntrypoints")
     : [];
@@ -81,12 +109,15 @@ export async function readOpenClawTargetSurface(options = {}) {
 
   return {
     configuredPath: requestedPath,
+    checkoutPath: relativePath(rootDir, resolvedPath) || ".",
     searchedPaths: requestedPaths,
     status: "ok",
     compatRegistryPath: relativePath(rootDir, registryPath),
     compatRecordCount: compatRecordEntries.length,
     compatRecords: compatRecordEntries.map((record) => record.code).sort(),
     compatRecordStatuses: Object.fromEntries(compatRecordEntries.map((record) => [record.code, record.status])),
+    compatRecordTests,
+    compatRecordMissingTests,
     hookTypesPath: existsSync(hookTypesPath) ? relativePath(rootDir, hookTypesPath) : null,
     hookNameCount: hookNames.length,
     hookNames,
@@ -99,11 +130,14 @@ export async function readOpenClawTargetSurface(options = {}) {
     packagePath: existsSync(packagePath) ? relativePath(rootDir, packagePath) : null,
     sdkExportCount: sdkExports.length,
     sdkExports,
+    privateLocalSdkExportCount: privateLocalSdkExports.length,
+    privateLocalSdkExports,
     pluginSdkEntrypointsPath: existsSync(pluginSdkEntrypointsPath)
       ? relativePath(rootDir, pluginSdkEntrypointsPath)
       : null,
     reservedSdkExportCount: reservedSdkExports.length,
     reservedSdkExports,
+    reservedSdkExportOwners,
     supportedFacadeSdkExports,
     publicPluginOwnedSdkExports,
     manifestTypesPath: existsSync(manifestTypesPath) ? relativePath(rootDir, manifestTypesPath) : null,
@@ -121,6 +155,23 @@ export function openClawTargetPathCandidates(manifest, configuredPath) {
   return unique([manifest?.openclaw?.defaultCheckoutPath, ...defaultOpenClawCheckoutPaths].filter(Boolean));
 }
 
+function importsCompatRecords(source) {
+  // Keep quoted text atomic and discard comments before recognizing the fixed delegation.
+  const tokens = (source.match(/\/\/[^\r\n]*|\/\*[\s\S]*?(?:\*\/|$)|"(?:\\[\s\S]|[^"\\])*"|'(?:\\[\s\S]|[^'\\])*'|`(?:\\[\s\S]|[^`\\])*`|[$A-Z_a-z][$\w]*|[^\s]/g) ?? [])
+    .filter((token) => !token.startsWith("//") && !token.startsWith("/*"));
+  for (let index = 0; index < tokens.length; index += 1) {
+    if (tokens[index] !== "import" || tokens[index + 1] !== "{") continue;
+    const end = tokens.indexOf("}", index + 2);
+    if (end === -1 || tokens[end + 1] !== "from") continue;
+    if (!['"./registry-records.js"', "'./registry-records.js'"].includes(tokens[end + 2])) continue;
+    const bindings = tokens.slice(index + 2, end).join(" ").split(",");
+    if (bindings.some((binding) => /^PLUGIN_COMPAT_RECORDS(?:\s+as\s+[$A-Z_a-z][$\w]*)?$/.test(binding.trim()))) {
+      return true;
+    }
+  }
+  return false;
+}
+
 export function parseCompatRecordEntries(source) {
   const entries = [];
   let cursor = 0;
@@ -132,8 +183,14 @@ export function parseCompatRecordEntries(source) {
 
     const statusProperty = readStringProperty(source, "status", codeProperty.end);
     if (statusProperty) {
-      entries.push({ code: codeProperty.value, status: statusProperty.value });
-      cursor = statusProperty.end;
+      const nextCodeProperty = readStringProperty(source, "code", statusProperty.end);
+      const recordEnd = nextCodeProperty?.propertyIndex ?? source.length;
+      entries.push({
+        code: codeProperty.value,
+        status: statusProperty.value,
+        tests: readStringArrayProperty(source, "tests", statusProperty.end, recordEnd),
+      });
+      cursor = recordEnd;
     } else {
       cursor = codeProperty.end;
     }
@@ -157,7 +214,21 @@ function readStringProperty(source, property, fromIndex) {
   if (!isQuote(source[quoteIndex])) {
     return null;
   }
-  return readQuotedValue(source, quoteIndex);
+  const value = readQuotedValue(source, quoteIndex);
+  return value ? { ...value, propertyIndex } : null;
+}
+
+function readStringArrayProperty(source, property, fromIndex, toIndex) {
+  const propertyIndex = findProperty(source, property, fromIndex);
+  if (propertyIndex === -1 || propertyIndex >= toIndex) return [];
+  const colonIndex = source.indexOf(":", propertyIndex + property.length);
+  const openIndex = source.indexOf("[", colonIndex + 1);
+  if (colonIndex === -1 || openIndex === -1 || openIndex >= toIndex) return [];
+  const closeIndex = source.indexOf("]", openIndex + 1);
+  if (closeIndex === -1 || closeIndex >= toIndex) return [];
+  return unique(
+    [...source.slice(openIndex + 1, closeIndex).matchAll(/["']([^"']+)["']/g)].map((match) => match[1]),
+  ).sort();
 }
 
 function findProperty(source, property, fromIndex) {
@@ -298,6 +369,7 @@ async function readPackedOpenClawTargetSurface({ rootDir, requestedPaths, reques
 
   return {
     configuredPath: requestedPath,
+    checkoutPath: relativePath(rootDir, resolvedPath) || ".",
     searchedPaths: requestedPaths,
     status: "ok",
     version: packageJson.version ?? null,
@@ -305,6 +377,8 @@ async function readPackedOpenClawTargetSurface({ rootDir, requestedPaths, reques
     compatRecordCount: 0,
     compatRecords: [],
     compatRecordStatuses: {},
+    compatRecordTests: {},
+    compatRecordMissingTests: {},
     hookTypesPath: hookDeclaration ? relativePath(rootDir, hookDeclaration.filePath) : null,
     hookNameCount: hookNames.length,
     hookNames,
@@ -317,9 +391,12 @@ async function readPackedOpenClawTargetSurface({ rootDir, requestedPaths, reques
     packagePath: relativePath(rootDir, packagePath),
     sdkExportCount: sdkExports.length,
     sdkExports,
+    privateLocalSdkExportCount: 0,
+    privateLocalSdkExports: [],
     pluginSdkEntrypointsPath: null,
     reservedSdkExportCount: 0,
     reservedSdkExports: [],
+    reservedSdkExportOwners: {},
     supportedFacadeSdkExports: [],
     publicPluginOwnedSdkExports: [],
     manifestTypesPath: manifestDeclaration ? relativePath(rootDir, manifestDeclaration.filePath) : null,
@@ -443,15 +520,20 @@ function parseStringUnion(source, typeName) {
 function emptyTargetSurface({ configuredPath, searchedPaths = undefined, status }) {
   return {
     configuredPath,
+    checkoutPath: null,
     searchedPaths,
     status,
     compatRecords: [],
     compatRecordStatuses: {},
+    compatRecordTests: {},
+    compatRecordMissingTests: {},
     hookNames: [],
     apiRegistrars: [],
     capturedRegistrars: [],
     sdkExports: [],
+    privateLocalSdkExports: [],
     reservedSdkExports: [],
+    reservedSdkExportOwners: {},
     supportedFacadeSdkExports: [],
     publicPluginOwnedSdkExports: [],
     manifestFields: [],
@@ -459,10 +541,33 @@ function emptyTargetSurface({ configuredPath, searchedPaths = undefined, status
   };
 }
 
+async function readBundledPluginIds(openClawRoot) {
+  const extensionsRoot = path.join(openClawRoot, "extensions");
+  if (!existsSync(extensionsRoot)) return [];
+  return (await readdir(extensionsRoot, { withFileTypes: true }))
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+    .sort((left, right) => right.length - left.length || left.localeCompare(right));
+}
+
+function resolveBundledSdkOwner(specifier, pluginIds) {
+  const entrypoint = specifier.slice("openclaw/plugin-sdk/".length);
+  return pluginIds.find((pluginId) => entrypoint === pluginId || entrypoint.startsWith(`${pluginId}-`)) ?? null;
+}
+
 export function parsePluginSdkEntrypointSpecifiers(source, exportName) {
   return parseExportedStringArray(source, exportName).map((entrypoint) => `openclaw/plugin-sdk/${entrypoint}`).sort();
 }
 
+function parsePluginSdkSubpathSpecifiers(value) {
+  if (!Array.isArray(value)) return [];
+  return unique(
+    value
+      .filter((entrypoint) => typeof entrypoint === "string" && !entrypoint.includes("/"))
+      .map((entrypoint) => `openclaw/plugin-sdk/${entrypoint}`),
+  ).sort();
+}
+
 function parseCapturedRegistrars(source) {
   return unique([...source.matchAll(/^\s*(register[A-Za-z0-9]+)\s*\(/gm)].map((match) => match[1])).sort();
 }

package/src/runtime-imports.js

@@ -0,0 +1,191 @@
+import * as nodeModule from "node:module";
+import { parse } from "acorn";
+import { analyze } from "eslint-scope";
+
+const literalModuleImport = /(?<![$\w.])(?:(?:const|let|var)\s+(?:\{[^{}]*\}|[$A-Z_a-z][$\w]*)\s*=\s*)?(?<kind>require|import)\s*\(\s*(?<quote>["'`])(?<specifier>[^"'`\\\r\n]+)\k<quote>/dg;
+
+export function collectRuntimeModuleImports(text) {
+  // Mark literal occurrences without interpreting quotes or regexes; the AST owns real calls.
+  const entries = [...text.matchAll(literalModuleImport)].map(moduleImportEntry).filter(Boolean);
+  if (entries.length === 0) return entries;
+  const { runtimeText, imports } = classifyRuntimeImports(text, entries);
+  let ast;
+  let scopes;
+  try {
+    // Accept both source modules and CommonJS wrappers without changing their runtime.
+    ast = parse(runtimeText, {
+      ecmaVersion: "latest", ranges: true, sourceType: "script",
+      allowAwaitOutsideFunction: true, allowReturnOutsideFunction: true, allowImportExportEverywhere: true,
+    });
+    scopes = analyze(ast, {
+      ecmaVersion: 2026,
+      sourceType: ast.body.some((node) => /^(?:Import|Export).*Declaration$/.test(node.type)) ? "module" : "commonjs",
+    });
+  } catch {
+    // Keep known imports if syntax is incomplete/unsupported; never guess namespace exports.
+    // Type erasure has already classified each occurrence, even when AST analysis fails.
+    const retained = new Set(imports.map(({ entry }) => entry.specifierStart));
+    return [...scanLiteralModuleImports(text)].filter((entry) => retained.has(entry.specifierStart))
+      .map((entry) => ({ ...entry, names: new Set() }));
+  }
+
+  const parents = new Map();
+  const nodes = [];
+  visit(ast);
+  function visit(node, parent) {
+    if (!node || typeof node.type !== "string") return;
+    parents.set(node, parent);
+    nodes.push(node);
+    for (const value of Object.values(node)) {
+      if (Array.isArray(value)) value.forEach((child) => visit(child, node));
+      else if (value && typeof value === "object") visit(value, node);
+    }
+  }
+  const byMarker = new Map(imports.map(({ marker, entry }) => [marker, entry]));
+  const result = [];
+  for (const node of nodes) {
+    const source = node.type === "ImportExpression" ? node.source
+      : node.type === "CallExpression" && node.callee.type === "Identifier"
+        && node.callee.name === "require" && node.arguments.length === 1 ? node.arguments[0] : null;
+    const specifier = source?.type === "Literal" ? source.value
+      : source?.type === "TemplateLiteral" && source.expressions.length === 0 ? source.quasis[0].value.cooked : null;
+    const entry = byMarker.get(specifier);
+    if (!entry) continue;
+    const names = new Set();
+    result.push({ ...entry, names });
+    const access = parents.get(node);
+    const call = parents.get(access);
+    if (node.type === "ImportExpression" && access?.type === "MemberExpression" && access.object === node
+      && !access.computed && access.property.name === "then" && call?.type === "CallExpression" && call.callee === access) {
+      const callback = call.arguments[0];
+      if (callback?.type === "ArrowFunctionExpression" || callback?.type === "FunctionExpression") {
+        collectBindingNames(callback.params[0], callback, names);
+      }
+    }
+    // Promise methods belong to import(), not its awaited module namespace.
+    const module = entry.kind === "require" ? node
+      : parents.get(node)?.type === "AwaitExpression" ? parents.get(node) : null;
+    if (!module) continue;
+    const parent = parents.get(module);
+    if (parent?.type === "MemberExpression" && parent.object === module && !parent.computed && parent.property.type === "Identifier") {
+      names.add(parent.property.name);
+    }
+    if (parent?.type === "VariableDeclarator" && parent.init === module) collectBindingNames(parent.id, parent, names);
+  }
+  return result.sort((a, b) => a.index - b.index);
+
+  function collectBindingNames(binding, owner, names) {
+    if (binding?.type === "ObjectPattern") {
+      for (const property of binding.properties) {
+        if (property.type === "Property" && !property.computed && property.key.type === "Identifier") {
+          names.add(property.key.name);
+        }
+      }
+    } else if (binding?.type === "Identifier") {
+      // Resolve references to this declaration, including closures but excluding shadowed names.
+      for (const variable of scopes.getDeclaredVariables(owner)) {
+        if (!variable.identifiers.includes(binding)) continue;
+        for (const reference of variable.references) {
+          const access = parents.get(reference.identifier);
+          if (access?.type === "MemberExpression" && access.object === reference.identifier && !access.computed && access.property.type === "Identifier") {
+            names.add(access.property.name);
+          }
+        }
+      }
+    }
+  }
+}
+
+function* scanLiteralModuleImports(text) {
+  const quotedOrComment = /\/\/[^\r\n]*|\/\*[\s\S]*?(?:\*\/|$)|"(?:\\[\s\S]|[^"\\])*"|'(?:\\[\s\S]|[^'\\])*'/;
+  const code = new RegExp(quotedOrComment.source + "|" + literalModuleImport.source + "|[`{}]", "dg");
+  const template = /\\[\s\S]|`|\$\{/g;
+  const templateDepths = [];
+  let inTemplateText = false;
+  let cursor = 0;
+  // Skip quoted/comment text, but scan executable template interpolations.
+  while (cursor < text.length) {
+    const pattern = inTemplateText ? template : code;
+    pattern.lastIndex = cursor;
+    const match = pattern.exec(text);
+    if (!match) break;
+    cursor = pattern.lastIndex;
+    if (inTemplateText) {
+      if (match[0] === "`") {
+        templateDepths.pop();
+        inTemplateText = false;
+      } else if (match[0] === "${") {
+        templateDepths[templateDepths.length - 1] = 1;
+        inTemplateText = false;
+      }
+      continue;
+    }
+    if (match[0] === "`") {
+      templateDepths.push(0);
+      inTemplateText = true;
+    } else if (templateDepths.length && match[0] === "{") {
+      templateDepths[templateDepths.length - 1] += 1;
+    } else if (templateDepths.length && match[0] === "}") {
+      inTemplateText = --templateDepths[templateDepths.length - 1] === 0;
+    }
+    const entry = moduleImportEntry(match);
+    if (entry) yield entry;
+  }
+}
+
+function moduleImportEntry(match) {
+  const groups = match.groups;
+  if (!groups?.specifier || (groups.quote === "`" && groups.specifier.includes("${"))) return null;
+  return {
+    specifier: groups.specifier,
+    specifierStart: match.indices.groups.specifier[0],
+    kind: groups.kind,
+    index: groups.kind === "import" ? match.indices.groups.kind[0] : match.index,
+  };
+}
+
+function classifyRuntimeImports(text, entries) {
+  const markedImports = entries.map((entry, index) => {
+    const { specifier, specifierStart } = entry;
+    return {
+      entry,
+      specifierStart,
+      specifierEnd: specifierStart + specifier.length,
+      marker: `${specifier}__plugin_inspector_runtime_import_${index}__`,
+    };
+  });
+  let markedText = text;
+  for (const markedImport of markedImports.toReversed()) {
+    markedText =
+      markedText.slice(0, markedImport.specifierStart) +
+      markedImport.marker +
+      markedText.slice(markedImport.specifierEnd);
+  }
+
+  let runtimeText = null;
+  try {
+    runtimeText = eraseTypeScript(markedText);
+  } catch {
+    // Unsupported or incomplete TypeScript cannot prove an import is type-only.
+  }
+  return {
+    runtimeText: runtimeText ?? markedText,
+    imports: runtimeText === null ? markedImports : markedImports.filter(({ marker }) => runtimeText.includes(marker)),
+  };
+}
+
+function eraseTypeScript(text) {
+  if (typeof nodeModule.stripTypeScriptTypes === "function") {
+    try {
+      return nodeModule.stripTypeScriptTypes(text, { mode: "transform" });
+    } catch (error) {
+      if (error?.code !== "ERR_INVALID_ARG_VALUE") throw error;
+      return nodeModule.stripTypeScriptTypes(text, { mode: "strip" });
+    }
+  }
+  if (typeof globalThis.Bun?.Transpiler === "function") {
+    const transpiler = new globalThis.Bun.Transpiler({ loader: "ts", target: "bun" });
+    return transpiler.transformSync(text);
+  }
+  return null;
+}

package/src/runtime-reconciliation.js

@@ -81,12 +81,6 @@ function expectedRuntimeCaptureKeys(finding) {
   if (finding.code === "runtime-tool-capture") {
     return ["registration:registerTool"];
   }
-  if (finding.code === "conversation-access-hook") {
-    return names.map((name) => `hook:${name}`);
-  }
-  if (finding.code === "before-tool-call-probe") {
-    return ["hook:before_tool_call"];
-  }
   return [];
 }
 

package/src/sdk-mock.js

@@ -2,6 +2,7 @@ import { mkdir, readdir, readFile, realpath, writeFile } from "node:fs/promises"
 import * as nodeModule from "node:module";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import { collectRuntimeModuleImports } from "./runtime-imports.js";
 
 const SOURCE_EXTENSIONS = new Set([".js", ".mjs", ".cjs", ".ts", ".mts", ".cts"]);
 const SKIP_DIRS = new Set([".git", "coverage", "node_modules", "reports"]);
@@ -164,6 +165,14 @@ export const mockSdkSubpathExports = {
     "normalizeSecretInputString",
   ],
   "plugin-runtime": ["createLoggerBackedRuntime", "createSubsystemLogger"],
+  "lazy-runtime": [
+    "createLazyRuntimeModule",
+    "createLazyRuntimeMethod",
+    "createLazyRuntimeMethodBinder",
+    "createLazyRuntimeNamedExport",
+    "createLazyRuntimeSurface",
+  ],
+  "error-runtime": ["formatErrorMessage"],
   "secret-input": [
     "buildOptionalSecretInputSchema",
     "buildSecretInputArraySchema",
@@ -430,62 +439,12 @@ function parseModuleImports(text) {
   for (const match of text.matchAll(/\bimport\s+["']([^"']+)["']/g)) {
     entries.push({ specifier: match[1], names: new Set() });
   }
-  for (const { specifier, binding, member } of collectCommonJsRequires(text)) {
-    const names = new Set();
-    if (binding?.startsWith("{")) {
-      for (const part of binding.slice(1, -1).split(",")) {
-        const name = part.split(/[:=]/)[0].trim();
-        if (isValidExportName(name)) names.add(name);
-      }
-    } else if (binding) {
-      const escaped = binding.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      for (const access of text.matchAll(new RegExp(`(?<![$\\w])${escaped}\\s*\\.\\s*([$\\w]+)`, "g"))) {
-        names.add(access[1]);
-      }
-    }
-    if (member) names.add(member);
-    entries.push({ specifier, names, require: true });
+  for (const { specifier, names, kind } of collectRuntimeModuleImports(text)) {
+    entries.push({ specifier, names, require: kind === "require" });
   }
   return entries;
 }
 
-export function* collectCommonJsRequires(text) {
-  const code = /\/\/[^\r\n]*|\/\*[\s\S]*?(?:\*\/|$)|"(?:\\[\s\S]|[^"\\])*"|'(?:\\[\s\S]|[^'\\])*'|(?<![$\w.])(?:(?:const|let|var)\s+(\{[^{}]*\}|[$A-Z_a-z][$\w]*)\s*=\s*)?require\s*\(\s*["']([^"']+)["']\s*\)(?:\s*\.\s*([$A-Z_a-z][$\w]*))?|[`{}]/g;
-  const template = /\\[\s\S]|`|\$\{/g;
-  const templateDepths = [];
-  let inTemplateText = false;
-  let cursor = 0;
-  // Skip quoted/comment text, but scan executable template interpolations.
-  while (cursor < text.length) {
-    const pattern = inTemplateText ? template : code;
-    pattern.lastIndex = cursor;
-    const match = pattern.exec(text);
-    if (!match) break;
-    cursor = pattern.lastIndex;
-    if (inTemplateText) {
-      if (match[0] === "`") {
-        templateDepths.pop();
-        inTemplateText = false;
-      } else if (match[0] === "${") {
-        templateDepths[templateDepths.length - 1] = 1;
-        inTemplateText = false;
-      }
-      continue;
-    }
-    if (match[0] === "`") {
-      templateDepths.push(0);
-      inTemplateText = true;
-    } else if (templateDepths.length && match[0] === "{") {
-      templateDepths[templateDepths.length - 1] += 1;
-    } else if (templateDepths.length && match[0] === "}") {
-      inTemplateText = --templateDepths[templateDepths.length - 1] === 0;
-    }
-    if (match[2]) {
-      yield { specifier: match[2], binding: match[1], member: match[3], index: match.index };
-    }
-  }
-}
-
 function isTypeOnlyImportOrExport(statement, clause) {
   return /^\s*import\s+type\b/u.test(statement) || /^\s*export\s+type\b/u.test(statement) || /^\s*type\b/u.test(clause);
 }
@@ -741,6 +700,11 @@ function isValidExportName(name) {
 }
 
 function genericExportStatement(name) {
+  if (name === "normalizeOptionalString") {
+    // Optional values stay absent; an empty string invents explicit input in
+    // callers that distinguish undefined from a configured policy value.
+    return 'export function normalizeOptionalString(value) { return typeof value === "string" ? value.trim() || undefined : undefined; }';
+  }
   if (name === "isRecord") {
     return "export function isRecord(value) { return isPlainObject(value); }";
   }
@@ -1758,6 +1722,37 @@ export function resolveRuntimeEnv(env = {}) {
   return createRuntimeEnv(env);
 }
 
+export function createLazyRuntimeSurface(importer, select) {
+  let promise;
+  const load = () => {
+    // SDK runtime imports retain the same promise, including rejection, until clear().
+    promise ??= Promise.resolve().then(() => importer().then(select));
+    return promise;
+  };
+  load.peek = () => promise;
+  load.clear = () => { promise = undefined; };
+  return load;
+}
+
+export function createLazyRuntimeModule(importer) {
+  return createLazyRuntimeSurface(importer, (module) => module);
+}
+
+export function createLazyRuntimeNamedExport(importer, key) {
+  return createLazyRuntimeSurface(importer, (module) => module[key]);
+}
+
+export function createLazyRuntimeMethod(load, select) {
+  return async (...args) => {
+    const method = select(await load());
+    return await method(...args);
+  };
+}
+
+export function createLazyRuntimeMethodBinder(load) {
+  return (select) => createLazyRuntimeMethod(load, select);
+}
+
 export function createLoggerBackedRuntime(logger = console) {
   return { logger };
 }

package/src/synthetic-probes.js

@@ -635,6 +635,7 @@ export async function runCapturedSyntheticProbes(capture, options = {}) {
   try {
     const result = await runCapturedProbes(capture, {
       ...options, hookEvents, hookContexts, timeoutMs, controller, signal: controller.signal,
+      gatewayConfig: options.apiOptions?.config ?? {},
     });
     if (options.signal?.aborted) throw controller.signal.reason;
     return result;
@@ -804,6 +805,16 @@ async function runRegistrationProbes(entry, retainedEntry, captureIndex, options
   if (!descriptor || typeof descriptor !== "object") {
     return [blockedResult(entry, captureIndex, "captured registration has no object descriptor")];
   }
+  const method = descriptor.method ?? descriptor.name;
+  if (entry.name === "registerGatewayMethod" && Object.hasOwn(options.gatewayMethodPrerequisites ?? {}, method)) {
+    const reason = options.gatewayMethodPrerequisites[method];
+    if (typeof reason !== "string" || reason.trim().length === 0) {
+      throw new TypeError(`Gateway probe prerequisite for ${method} must be a non-empty string`);
+    }
+    // A method needing host state or live credentials cannot be exercised with
+    // the default empty request. Record the missing prerequisite before calling it.
+    return [{ ...blockedResult(entry, captureIndex, reason), method }];
+  }
   if (profile.option && options[profile.option] !== true) {
     return [blockedResult(entry, captureIndex, `captured registration requires ${profile.option}=true`)];
   }
@@ -1022,7 +1033,7 @@ function gatewayProbeArgs(event, options = {}) {
       req: { type: "req", id: "fixture-request", method: event.method ?? "fixture.gateway.method", params: event.params },
       client: null,
       isWebchatConnect: () => false,
-      context: { source: event.source, logger: console },
+      context: { source: event.source, logger: console, getRuntimeConfig: () => options.gatewayConfig },
       signal: options.signal,
     },
   ];