From 70265fcc7e077382e5f163945f3c1cfe33060b1f Mon Sep 17 00:00:00 2001
From: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
Date: Mon, 16 Mar 2026 11:24:46 -0500
Subject: [PATCH] CI: tighten bundled plugin boundary ratchet

---
 scripts/check-plugin-boundary-ratchet.mjs     | 27 +++++++++++--------
 .../check-plugin-boundary-ratchet.test.ts     | 10 +++++--
 2 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/scripts/check-plugin-boundary-ratchet.mjs b/scripts/check-plugin-boundary-ratchet.mjs
index 584e986a1ff..640fdd9c86d 100644
--- a/scripts/check-plugin-boundary-ratchet.mjs
+++ b/scripts/check-plugin-boundary-ratchet.mjs
@@ -70,7 +70,10 @@ export function classifyPluginBoundaryImport(specifier, filePath, options = {})
     return null;
   }
 
-  if (normalizedSpecifier.includes("plugin-sdk-internal")) {
+  if (
+    normalizedSpecifier === "openclaw/plugin-sdk-internal" ||
+    normalizedSpecifier.startsWith("openclaw/plugin-sdk-internal/")
+  ) {
     return {
       kind: "plugin-sdk-internal",
       reason: "imports non-public plugin-sdk-internal surface",
@@ -314,13 +317,16 @@ export async function collectCurrentViolations(options = {}) {
 
   const deduped = [...new Map(violations.map((entry) => [toBaselineKey(entry), entry])).values()];
 
-  return deduped.toSorted((left, right) => {
-    const pathCompare = left.path.localeCompare(right.path);
-    if (pathCompare !== 0) {
-      return pathCompare;
-    }
-    return left.specifier.localeCompare(right.specifier);
-  });
+  return {
+    files,
+    violations: deduped.toSorted((left, right) => {
+      const pathCompare = left.path.localeCompare(right.path);
+      if (pathCompare !== 0) {
+        return pathCompare;
+      }
+      return left.specifier.localeCompare(right.specifier);
+    }),
+  };
 }
 
 function printViolations(header, violations) {
@@ -337,8 +343,7 @@ function printViolations(header, violations) {
 }
 
 async function main() {
-  const files = await collectBundledPluginSourceFiles(repoRoot);
-  const currentViolations = await collectCurrentViolations({ repoRoot });
+  const { files, violations: currentViolations } = await collectCurrentViolations({ repoRoot });
   const baseline = await loadViolationBaseline();
   const { newViolations, resolvedViolations } = compareViolationBaseline(
     currentViolations,
@@ -353,7 +358,7 @@ async function main() {
     if (resolvedViolations.length > 0) {
       console.error("");
       console.error(
-        `Note: ${resolvedViolations.length} baseline violation(s) were removed; delete them from ${path.relative(repoRoot, baselinePath)} after this change lands.`,
+        `Note: ${resolvedViolations.length} baseline violation(s) are already resolved. While fixing the above, also remove them from ${path.relative(repoRoot, baselinePath)}.`,
       );
     }
     console.error("");
diff --git a/test/scripts/check-plugin-boundary-ratchet.test.ts b/test/scripts/check-plugin-boundary-ratchet.test.ts
index 85824c845ba..cd7fade3194 100644
--- a/test/scripts/check-plugin-boundary-ratchet.test.ts
+++ b/test/scripts/check-plugin-boundary-ratchet.test.ts
@@ -36,6 +36,12 @@ describe("check-plugin-boundary-ratchet", () => {
     });
   });
 
+  it("does not reject same-plugin files that merely contain plugin-sdk-internal in the filename", () => {
+    expect(
+      classifyPluginBoundaryImport("./plugin-sdk-internal-fixture.js", extensionFile, { repoRoot }),
+    ).toBeNull();
+  });
+
   it("rejects direct core src imports", () => {
     expect(
       classifyPluginBoundaryImport(
@@ -87,7 +93,7 @@ describe("check-plugin-boundary-ratchet", () => {
         line: 3,
         preferredReplacement:
           "Use openclaw/plugin-sdk/* or openclaw/plugin-sdk/compat temporarily.",
-        reason: "imports non-public plugin-sdk-internal surface",
+        reason: "reaches into non-public plugin-sdk-internal implementation",
         specifier: "../../../src/plugin-sdk-internal/discord.js",
       },
       {
@@ -125,7 +131,7 @@ describe("check-plugin-boundary-ratchet", () => {
         line: 3,
         preferredReplacement:
           "Use openclaw/plugin-sdk/* or openclaw/plugin-sdk/compat temporarily.",
-        reason: "imports non-public plugin-sdk-internal surface",
+        reason: "reaches into non-public plugin-sdk-internal implementation",
         specifier: "../../../src/plugin-sdk-internal/discord.js",
       },
       {