Skip to main content
The plugin SDK contains narrow public subpaths and repository-only bundled helpers under openclaw/plugin-sdk/. This page catalogs every typed public subpath and labels selected private-local entries explicitly; it is not an inventory of every internal runtime helper. Four files define the boundary:
  • scripts/lib/plugin-sdk-entrypoints.json: the maintained entrypoint inventory the build compiles.
  • scripts/lib/plugin-sdk-private-local-only-subpaths.json: internal subpaths excluded from the typed, documented SDK. Production entries remain available as JavaScript-only host runtime exports for separately published official plugins; test-only entries stay unexported.
  • scripts/lib/plugin-sdk-deprecated-public-subpaths.json: public compatibility subpaths retained only through their documented removal windows.
  • scripts/lib/plugin-sdk-entries.mts: derived public/private export metadata, supported bundled facades, and plugin-owned public surfaces.
Maintainers audit the public export count with pnpm plugin-sdk:surface and the compatibility queue with pnpm plugins:boundary-report:summary. For the plugin authoring guide, see Plugin SDK overview.

​
Plugin entry

​
Compatibility and private-local helpers

Only the later-window deprecated subpaths remain exported. July 2026 aliases and unused subpaths were deleted, while bundled-only helpers were removed from the public package and are labeled private-local below. The maintained list is scripts/lib/plugin-sdk-deprecated-public-subpaths.json; CI rejects bundled imports of these compatibility-only subpaths. The broad domain barrels plugin-sdk/agent-runtime, plugin-sdk/channel-lifecycle, plugin-sdk/conversation-runtime, plugin-sdk/hook-runtime, plugin-sdk/media-runtime, plugin-sdk/plugin-runtime, and plugin-sdk/security-runtime are likewise deprecated in favor of focused subpaths. OpenClaw’s Vitest-backed test-helper subpaths are repo-local only and are no longer package exports: agent-runtime-test-contracts, channel-contract-testing, channel-target-testing, channel-test-helpers, plugin-state-test-runtime, plugin-test-api, plugin-test-contracts, plugin-test-runtime, provider-http-test-mocks, provider-test-contracts, reply-payload-testing, sqlite-runtime-testing, test-env, test-fixtures, test-live, test-live-auth, test-media-generation, test-media-understanding, test-node-mocks, and testing. ssrf-runtime-internal is a JavaScript-only host runtime reserved for exact trusted local-service plugins; it is not a public plugin authoring API.

​
Bundled plugin helper subpaths

Bundled-only helper modules are private-local after the July 2026 sweep. Package contract guardrails classify the supported bundled facades that remain public until generic contracts replace them. Those facades are deprecated for new code; see the per-row notes below.
Later-window channel compatibility subpaths remain public only through their registry dates. July aliases such as direct-DM access, reply-options, pairing paths, and channel runtime splinters have been removed; bundled-only helpers are private-local.
Provider usage snapshots normally report one or more quota windows, each with a label, percent used, and optional reset time. Providers that expose balance or account-state text instead of resettable quota windows should return summary with an empty windows array rather than fabricating percentages. OpenClaw displays that summary text in status output; use error only when the usage endpoint failed or returned no usable usage data.
Use isLoopbackHost(host) when a plugin must accept only the local machine. It accepts localhost, IPv4 loopback literals across 127.0.0.0/8, ::1, bracketed IPv6, and IPv4-mapped IPv6 loopback literals. It parses IP literals rather than matching text prefixes, so a DNS name such as 127.0.0.1.evil.com is not loopback. Use isPrivateOrLoopbackHost(host) only when private-network hosts such as RFC 1918 addresses are also valid.
Reserved bundled-helper SDK subpaths are narrow owner-specific surfaces for bundled plugin code. They are tracked in the SDK inventory so package builds and aliasing stay deterministic, but they are not general plugin authoring APIs. New reusable host contracts should use generic SDK subpaths such as plugin-sdk/gateway-runtime and plugin-sdk/ssrf-runtime.