// Verifies plugin SDK alias resolution for public import paths.
import fs from "node:fs";
import path from "node:path";
import { pathToFileURL } from "node:url";
import { expectDefined } from "@openclaw/normalization-core";
import {
  bundledDistPluginFile,
  bundledPluginFile,
  bundledPluginRoot,
} from "openclaw/plugin-sdk/test-fixtures";
import { afterAll, describe, expect, it, vi } from "vitest";
import { withEnv, withEnvAsync } from "../test-utils/env.js";
import {
  buildPluginLoaderAliasMap,
  createPluginLoaderModuleCacheKey,
  buildPluginLoaderJitiOptions,
  resolvePluginLoaderModuleConfig,
  resolvePluginLoaderTryNative,
  resolvePluginRuntimeModulePathWithDiagnostics,
  type PluginSdkResolutionPreference,
} from "./sdk-alias.js";
import {
  cleanupTrackedTempDirs,
  makeTrackedTempDir,
  mkdirSafeDir,
} from "./test-helpers/fs-fixtures.js";

type CreateJiti = typeof import("jiti").createJiti;

let createJitiPromise: Promise<CreateJiti> | undefined;

async function getCreateJiti() {
  createJitiPromise ??= import("jiti").then(({ createJiti }) => createJiti);
  return createJitiPromise;
}

const fixtureTempDirs: string[] = [];
const fixtureRoot = makeTrackedTempDir("openclaw-sdk-alias-root", fixtureTempDirs);
let tempDirIndex = 0;

function makeTempDir() {
  const dir = path.join(fixtureRoot, `case-${tempDirIndex++}`);
  mkdirSafeDir(dir);
  return dir;
}

function createTrustedOpenClawPackageFixture(version: string) {
  const root = makeTempDir();
  fs.writeFileSync(path.join(root, "openclaw.mjs"), "export {};\n", "utf-8");
  fs.writeFileSync(
    path.join(root, "package.json"),
    JSON.stringify(
      {
        name: "openclaw",
        version,
        bin: { openclaw: "openclaw.mjs" },
        exports: { "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" } },
      },
      null,
      2,
    ),
    "utf-8",
  );
  mkdirSafeDir(path.join(root, "dist", "plugins"));
  return root;
}

function withCwd<T>(cwd: string, run: () => T): T {
  const cwdSpy = vi.spyOn(process, "cwd").mockReturnValue(cwd);
  try {
    return run();
  } finally {
    cwdSpy.mockRestore();
  }
}

function createPluginSdkAliasFixture(params?: {
  srcFile?: string;
  distFile?: string;
  srcBody?: string;
  distBody?: string;
  packageExports?: Record<string, unknown>;
  trustedRootIndicators?: boolean;
  trustedRootIndicatorMode?: "bin+marker" | "cli-entry-only" | "none";
}) {
  const root = makeTempDir();
  const srcFile = path.join(root, "src", "plugin-sdk", params?.srcFile ?? "core.ts");
  const distFile = path.join(root, "dist", "plugin-sdk", params?.distFile ?? "core.js");
  mkdirSafeDir(path.dirname(srcFile));
  mkdirSafeDir(path.dirname(distFile));
  const trustedRootIndicatorMode =
    params?.trustedRootIndicatorMode ??
    (params?.trustedRootIndicators === false ? "none" : "bin+marker");
  const packageJson: Record<string, unknown> = {
    name: "openclaw",
    type: "module",
  };
  if (trustedRootIndicatorMode === "bin+marker") {
    packageJson.bin = {
      openclaw: "openclaw.mjs",
    };
  }
  if (params?.packageExports || trustedRootIndicatorMode === "cli-entry-only") {
    const trustedExports: Record<string, unknown> =
      trustedRootIndicatorMode === "cli-entry-only"
        ? { "./cli-entry": { default: "./dist/cli-entry.js" } }
        : {};
    packageJson.exports = {
      "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      ...trustedExports,
      ...params?.packageExports,
    };
  }
  fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(packageJson, null, 2), "utf-8");
  if (trustedRootIndicatorMode === "bin+marker") {
    fs.writeFileSync(path.join(root, "openclaw.mjs"), "export {};\n", "utf-8");
  }
  mkdirSafeDir(path.join(root, "scripts", "lib"));
  fs.writeFileSync(
    path.join(root, "scripts", "lib", "plugin-sdk-private-local-only-subpaths.json"),
    JSON.stringify(["qa-channel", "qa-channel-protocol", "qa-lab", "qa-runtime"], null, 2),
    "utf-8",
  );
  fs.writeFileSync(srcFile, params?.srcBody ?? "export {};\n", "utf-8");
  fs.writeFileSync(distFile, params?.distBody ?? "export {};\n", "utf-8");
  return { root, srcFile, distFile };
}

function writePluginSdkSubpathArtifacts(root: string, subpaths: readonly string[]) {
  for (const subpath of subpaths) {
    for (const candidate of [
      path.join(root, "src", "plugin-sdk", `${subpath}.ts`),
      path.join(root, "dist", "plugin-sdk", `${subpath}.js`),
    ]) {
      if (!fs.existsSync(candidate)) {
        fs.writeFileSync(candidate, "export {};\n", "utf-8");
      }
    }
  }
}

function writeWorkspacePackageEntry(params: {
  root: string;
  packageDir: string;
  srcFile: string;
  distFile: string;
}) {
  const srcFile = path.join(params.root, "packages", params.packageDir, "src", params.srcFile);
  const distFile = path.join(params.root, "packages", params.packageDir, "dist", params.distFile);
  mkdirSafeDir(path.dirname(srcFile));
  mkdirSafeDir(path.dirname(distFile));
  fs.writeFileSync(srcFile, "export {};\n", "utf-8");
  fs.writeFileSync(distFile, "export {};\n", "utf-8");
  return { srcFile, distFile };
}

type WorkspaceAliasFixture = readonly [
  alias: `@openclaw/${string}`,
  packageDir: string,
  entryStem: string,
  rootDistFile?: string,
  assert?: boolean,
];

function writeWorkspaceAliasFixtures(root: string, fixtures: readonly WorkspaceAliasFixture[]) {
  return fixtures.map(([alias, packageDir, entryStem, rootDistFile, assert]) => {
    const files = writeWorkspacePackageEntry({
      root,
      packageDir,
      srcFile: `${entryStem}.ts`,
      distFile: `${entryStem}.mjs`,
    });
    const expectedDistFile = rootDistFile ? path.join(root, rootDistFile) : files.distFile;
    if (rootDistFile) {
      mkdirSafeDir(path.dirname(expectedDistFile));
      fs.writeFileSync(expectedDistFile, "export {};\n", "utf-8");
    }
    return { alias, assert, ...files, expectedDistFile };
  });
}

function expectWorkspaceAliasTargets(
  aliases: Record<string, string | undefined>,
  fixtures: ReturnType<typeof writeWorkspaceAliasFixtures>,
  target: "srcFile" | "expectedDistFile",
) {
  for (const fixture of fixtures) {
    if (fixture.assert === false) {
      continue;
    }
    expect(fs.realpathSync(aliases[fixture.alias] ?? ""), fixture.alias).toBe(
      fs.realpathSync(fixture[target]),
    );
  }
}

function createPluginRuntimeAliasFixture(params?: { srcBody?: string; distBody?: string }) {
  const root = makeTempDir();
  const srcFile = path.join(root, "src", "plugins", "runtime", "index.ts");
  const distFile = path.join(root, "dist", "plugins", "runtime", "index.js");
  mkdirSafeDir(path.dirname(srcFile));
  mkdirSafeDir(path.dirname(distFile));
  fs.writeFileSync(
    path.join(root, "package.json"),
    JSON.stringify({ name: "openclaw", type: "module" }, null, 2),
    "utf-8",
  );
  fs.writeFileSync(
    srcFile,
    params?.srcBody ?? "export const createPluginRuntime = () => ({});\n",
    "utf-8",
  );
  fs.writeFileSync(
    distFile,
    params?.distBody ?? "export const createPluginRuntime = () => ({});\n",
    "utf-8",
  );
  return { root, srcFile, distFile };
}

function createPluginSdkAliasTargetFixture(params?: {
  sourceChannelRuntimeExtension?: ".ts" | ".mts" | ".js" | ".mjs" | ".cts" | ".cjs";
}) {
  const sourceChannelRuntimeExtension = params?.sourceChannelRuntimeExtension ?? ".ts";
  const fixture = createPluginSdkAliasFixture({
    srcFile: `channel-runtime-context${sourceChannelRuntimeExtension}`,
    distFile: "channel-runtime-context.js",
    packageExports: {
      "./plugin-sdk/channel-runtime-context": {
        default: "./dist/plugin-sdk/channel-runtime-context.js",
      },
      "./plugin-sdk/plugin-entry": { default: "./dist/plugin-sdk/plugin-entry.js" },
    },
  });
  const sourcePluginEntryPath = path.join(fixture.root, "src", "plugin-sdk", "plugin-entry.ts");
  const distPluginEntryPath = path.join(fixture.root, "dist", "plugin-sdk", "plugin-entry.js");
  fs.writeFileSync(
    sourcePluginEntryPath,
    "export const definePluginEntry = (entry) => entry;\n",
    "utf-8",
  );
  fs.writeFileSync(
    distPluginEntryPath,
    "export const definePluginEntry = (entry) => entry;\n",
    "utf-8",
  );
  return {
    fixture,
    sourceChannelRuntimePath: path.join(
      fixture.root,
      "src",
      "plugin-sdk",
      `channel-runtime-context${sourceChannelRuntimeExtension}`,
    ),
    distChannelRuntimePath: path.join(
      fixture.root,
      "dist",
      "plugin-sdk",
      "channel-runtime-context.js",
    ),
    sourcePluginEntryPath,
    distPluginEntryPath,
  };
}

function createBundledPluginPackagePublicSurfaceAliasFixture() {
  const fixture = createPluginSdkAliasTargetFixture();
  const extensionRoot = path.join(fixture.fixture.root, bundledPluginRoot("slack"));
  const distExtensionRoot = path.join(fixture.fixture.root, "dist", "extensions", "slack");
  mkdirSafeDir(extensionRoot);
  mkdirSafeDir(distExtensionRoot);
  fs.writeFileSync(
    path.join(extensionRoot, "package.json"),
    JSON.stringify({ name: "@openclaw/slack", type: "module" }, null, 2),
    "utf-8",
  );
  const sourceApiPath = path.join(extensionRoot, "api.ts");
  const sourceRuntimeApiPath = path.join(extensionRoot, "runtime-api.ts");
  const sourceTestApiPath = path.join(extensionRoot, "test-api.ts");
  const distApiPath = path.join(distExtensionRoot, "api.js");
  const distRuntimeApiPath = path.join(distExtensionRoot, "runtime-api.js");
  const distTestApiPath = path.join(distExtensionRoot, "test-api.js");
  fs.writeFileSync(sourceApiPath, "export const slackApi = 'source';\n", "utf-8");
  fs.writeFileSync(sourceRuntimeApiPath, "export const slackRuntimeApi = 'source';\n", "utf-8");
  fs.writeFileSync(sourceTestApiPath, "export const slackTestApi = 'source';\n", "utf-8");
  fs.writeFileSync(distApiPath, "export const slackApi = 'dist';\n", "utf-8");
  fs.writeFileSync(distRuntimeApiPath, "export const slackRuntimeApi = 'dist';\n", "utf-8");
  fs.writeFileSync(distTestApiPath, "export const slackTestApi = 'dist';\n", "utf-8");
  fs.writeFileSync(
    path.join(extensionRoot, "internal.ts"),
    "export const internal = true;\n",
    "utf-8",
  );
  return {
    ...fixture,
    distApiPath,
    distRuntimeApiPath,
    distTestApiPath,
    sourceApiPath,
    sourceRuntimeApiPath,
    sourceTestApiPath,
  };
}

function writePluginEntry(root: string, relativePath: string) {
  const pluginEntry = path.join(root, relativePath);
  fs.mkdirSync(path.dirname(pluginEntry), { recursive: true });
  fs.writeFileSync(pluginEntry, 'export const plugin = "demo";\n', "utf-8");
  return pluginEntry;
}

function writeInstalledPluginEntry(params: {
  installRoot: string;
  packageName: string;
  entry?: string;
}) {
  const entry = params.entry ?? "dist/index.js";
  const packageRoot = path.join(
    params.installRoot,
    "node_modules",
    ...params.packageName.split("/"),
  );
  const pluginEntry = path.join(packageRoot, entry);
  mkdirSafeDir(path.dirname(pluginEntry));
  fs.writeFileSync(
    path.join(packageRoot, "package.json"),
    JSON.stringify({ name: params.packageName, type: "module" }, null, 2),
    "utf-8",
  );
  fs.writeFileSync(pluginEntry, 'export const plugin = "installed";\n', "utf-8");
  return { packageRoot, pluginEntry };
}

function createUserInstalledPluginSdkAliasFixture() {
  const { fixture, sourcePluginEntryPath, sourceChannelRuntimePath } =
    createPluginSdkAliasTargetFixture();
  const externalPluginRoot = path.join(makeTempDir(), ".openclaw", "extensions", "demo");
  const externalPluginEntry = path.join(externalPluginRoot, "index.ts");
  mkdirSafeDir(externalPluginRoot);
  fs.writeFileSync(
    externalPluginEntry,
    [
      'import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";',
      'export default definePluginEntry({ id: "demo", register() {} });',
      "",
    ].join("\n"),
    "utf-8",
  );
  return {
    externalPluginEntry,
    externalPluginRoot,
    fixture,
    sourcePluginEntryPath,
    sourceChannelRuntimePath,
  };
}

function resolvePluginRuntimeModule(params: {
  modulePath: string;
  argv1?: string;
  devSourceRoot?: string | null;
  env?: NodeJS.ProcessEnv;
  pluginSdkResolution?: PluginSdkResolutionPreference;
}) {
  const run = () =>
    resolvePluginRuntimeModulePathWithDiagnostics({
      modulePath: params.modulePath,
      argv1: params.argv1,
      devSourceRoot: params.devSourceRoot,
      pluginSdkResolution: params.pluginSdkResolution,
    }).resolvedPath;
  return params.env ? withEnv(params.env, run) : run();
}

function expectResolvedFixturePath(params: {
  resolved: string | null;
  fixture: { srcFile: string; distFile: string };
  expected: "src" | "dist";
}) {
  expect(params.resolved).toBe(
    params.expected === "dist" ? params.fixture.distFile : params.fixture.srcFile,
  );
}

function expectPluginSdkAliasTargets(
  aliases: Record<string, string | undefined>,
  params: {
    channelRuntimePath?: string;
    pluginEntryPath?: string;
  },
) {
  if (params.channelRuntimePath) {
    expect(fs.realpathSync(aliases["openclaw/plugin-sdk/channel-runtime-context"] ?? "")).toBe(
      fs.realpathSync(params.channelRuntimePath),
    );
    expect(fs.realpathSync(aliases["@openclaw/plugin-sdk/channel-runtime-context"] ?? "")).toBe(
      fs.realpathSync(params.channelRuntimePath),
    );
  }
  if (params.pluginEntryPath) {
    expect(fs.realpathSync(aliases["openclaw/plugin-sdk/plugin-entry"] ?? "")).toBe(
      fs.realpathSync(params.pluginEntryPath),
    );
    expect(fs.realpathSync(aliases["@openclaw/plugin-sdk/plugin-entry"] ?? "")).toBe(
      fs.realpathSync(params.pluginEntryPath),
    );
  }
}

function listPluginSdkExportedSubpaths(params: {
  modulePath: string;
  argv1?: string;
  moduleUrl?: string;
  devSourceRoot?: string | null;
  pluginSdkResolution?: PluginSdkResolutionPreference;
}): string[] {
  return Object.keys(
    buildPluginLoaderAliasMap(
      params.modulePath,
      params.argv1 ?? "",
      params.moduleUrl,
      params.pluginSdkResolution,
      params.devSourceRoot,
    ),
  )
    .filter((key) => key.startsWith("openclaw/plugin-sdk/"))
    .map((key) => key.slice("openclaw/plugin-sdk/".length))
    .toSorted();
}

function expectExportedSubpaths(params: {
  fixture: { root: string };
  modulePath: string;
  expected: readonly string[];
  cwd?: string;
}) {
  const run = () => listPluginSdkExportedSubpaths({ modulePath: params.modulePath });
  const subpaths = params.cwd ? withCwd(params.cwd, run) : run();
  expect(subpaths).toEqual(params.expected);
}

function expectCwdFallbackPluginSdkAliasResolution(params: {
  fixture: { root: string; srcFile: string; distFile: string };
  expected: "src" | "dist" | null;
}) {
  const resolved = withCwd(params.fixture.root, () =>
    withEnv(
      { NODE_ENV: undefined },
      () =>
        buildPluginLoaderAliasMap("/tmp/tsx-cache/openclaw-loader.js", "")[
          "openclaw/plugin-sdk/channel-runtime-context"
        ] ?? null,
    ),
  );
  if (params.expected === null) {
    expect(resolved).toBeNull();
    return;
  }
  expectResolvedFixturePath({
    resolved,
    fixture: params.fixture,
    expected: params.expected,
  });
}

afterAll(() => {
  cleanupTrackedTempDirs(fixtureTempDirs);
});

describe("plugin sdk alias helpers", () => {
  it("derives plugin-sdk subpaths from package exports", () => {
    const fixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
        "./plugin-sdk/runtime": { default: "./dist/plugin-sdk/runtime.js" },
        "./plugin-sdk/nested/value": { default: "./dist/plugin-sdk/nested/value.js" },
        "./plugin-sdk/..\\..\\evil": { default: "./dist/plugin-sdk/evil.js" },
        "./plugin-sdk/C:temp": { default: "./dist/plugin-sdk/drive.js" },
        "./plugin-sdk/.hidden": { default: "./dist/plugin-sdk/hidden.js" },
      },
    });
    writePluginSdkSubpathArtifacts(fixture.root, ["core", "runtime"]);
    const subpaths = listPluginSdkExportedSubpaths({
      modulePath: path.join(fixture.root, "src", "plugins", "loader.ts"),
    });
    expect(subpaths).toEqual(["core", "runtime"]);
  });

  it("adds private qa plugin-sdk subpaths for trusted local checkouts when enabled", () => {
    const fixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      },
    });
    writePluginSdkSubpathArtifacts(fixture.root, ["core"]);
    fs.writeFileSync(
      path.join(fixture.root, "src", "plugin-sdk", "qa-channel.ts"),
      "export const qaChannel = true;\n",
      "utf-8",
    );
    fs.writeFileSync(
      path.join(fixture.root, "src", "plugin-sdk", "qa-channel-protocol.ts"),
      "export const qaChannelProtocol = true;\n",
      "utf-8",
    );
    fs.writeFileSync(
      path.join(fixture.root, "src", "plugin-sdk", "qa-runtime.ts"),
      "export const qaRuntime = true;\n",
      "utf-8",
    );
    fs.writeFileSync(
      path.join(fixture.root, "dist", "plugin-sdk", "qa-lab.js"),
      "export const qaLab = true;\n",
      "utf-8",
    );

    const subpaths = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1" }, () =>
      listPluginSdkExportedSubpaths({
        modulePath: path.join(fixture.root, "src", "plugins", "loader.ts"),
      }),
    );
    expect(subpaths).toEqual(["core", "qa-channel", "qa-channel-protocol", "qa-lab", "qa-runtime"]);
  });

  it("resolves a private-local bundled helper without enabling private QA mode", () => {
    const fixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      },
    });
    fs.writeFileSync(
      path.join(fixture.root, "scripts", "lib", "plugin-sdk-private-local-only-subpaths.json"),
      JSON.stringify(["qa-runner-runtime", "qa-runtime"], null, 2),
      "utf-8",
    );
    writePluginSdkSubpathArtifacts(fixture.root, ["core"]);
    const sourceQaRunnerPath = path.join(fixture.root, "src", "plugin-sdk", "qa-runner-runtime.ts");
    const sourcePrivateQaRuntimePath = path.join(
      fixture.root,
      "src",
      "plugin-sdk",
      "qa-runtime.ts",
    );
    fs.writeFileSync(sourceQaRunnerPath, "export const qaRunnerRuntime = true;\n", "utf-8");
    fs.writeFileSync(sourcePrivateQaRuntimePath, "export const qaRuntime = true;\n", "utf-8");
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );

    const subpaths = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined }, () =>
      listPluginSdkExportedSubpaths({ modulePath: sourcePluginEntry }),
    );
    const aliases = withEnv(
      { OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined },
      () => buildPluginLoaderAliasMap(sourcePluginEntry),
    );

    expect(subpaths).toEqual(["core", "qa-runner-runtime"]);
    expect(fs.realpathSync(aliases["openclaw/plugin-sdk/qa-runner-runtime"] ?? "")).toBe(
      fs.realpathSync(sourceQaRunnerPath),
    );
    expect(aliases["openclaw/plugin-sdk/qa-runtime"]).toBeUndefined();
  });

  it("adds the non-QA private Codex helper subpath only for trusted Codex plugins", () => {
    const fixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      },
    });
    writePluginSdkSubpathArtifacts(fixture.root, ["core"]);
    fs.rmSync(
      path.join(fixture.root, "scripts", "lib", "plugin-sdk-private-local-only-subpaths.json"),
      { force: true },
    );
    fs.writeFileSync(
      path.join(fixture.root, "src", "plugin-sdk", "codex-mcp-projection.ts"),
      "export const codexMcpProjection = true;\n",
      "utf-8",
    );
    fs.writeFileSync(
      path.join(fixture.root, "src", "plugin-sdk", "qa-runtime.ts"),
      "export const qaRuntime = true;\n",
      "utf-8",
    );
    const sourceCodexEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("codex", "src/index.ts"),
    );
    const sourceOtherEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );
    const { packageRoot: installedCodexRoot, pluginEntry: installedCodexEntry } =
      writeInstalledPluginEntry({
        installRoot: path.join(makeTempDir(), ".openclaw", "npm"),
        packageName: "@openclaw/codex",
      });
    const { packageRoot: installedOtherRoot, pluginEntry: installedOtherEntry } =
      writeInstalledPluginEntry({
        installRoot: path.join(makeTempDir(), ".openclaw", "npm"),
        packageName: "@openclaw/demo",
      });
    const shadowCodexRoot = path.join(makeTempDir(), ".openclaw", "extensions", "codex-shadow");
    const shadowCodexEntry = path.join(shadowCodexRoot, "dist", "index.js");
    mkdirSafeDir(path.dirname(shadowCodexEntry));
    fs.writeFileSync(
      path.join(shadowCodexRoot, "package.json"),
      JSON.stringify({ name: "@openclaw/codex", type: "module" }, null, 2),
      "utf-8",
    );
    fs.writeFileSync(shadowCodexEntry, 'export const plugin = "shadow";\n', "utf-8");

    const codexSubpaths = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined }, () =>
      listPluginSdkExportedSubpaths({
        modulePath: sourceCodexEntry,
      }),
    );
    const otherSubpaths = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined }, () =>
      listPluginSdkExportedSubpaths({
        modulePath: sourceOtherEntry,
      }),
    );
    const installedCodexSubpaths = withCwd(installedCodexRoot, () =>
      withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined }, () =>
        listPluginSdkExportedSubpaths({
          modulePath: installedCodexEntry,
          argv1: path.join(fixture.root, "openclaw.mjs"),
        }),
      ),
    );
    const installedOtherSubpaths = withCwd(installedOtherRoot, () =>
      withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined }, () =>
        listPluginSdkExportedSubpaths({
          modulePath: installedOtherEntry,
          argv1: path.join(fixture.root, "openclaw.mjs"),
        }),
      ),
    );
    const shadowCodexSubpaths = withCwd(shadowCodexRoot, () =>
      withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined }, () =>
        listPluginSdkExportedSubpaths({
          modulePath: shadowCodexEntry,
          argv1: path.join(fixture.root, "openclaw.mjs"),
        }),
      ),
    );

    expect(codexSubpaths).toEqual(["codex-mcp-projection", "core"]);
    expect(installedCodexSubpaths).toEqual(["codex-mcp-projection", "core"]);
    expect(otherSubpaths).toEqual(["core"]);
    expect(installedOtherSubpaths).toEqual(["core"]);
    expect(shadowCodexSubpaths).toEqual(["core"]);
  });

  it("does not reuse a non-private cached subpath list after private qa gets enabled", () => {
    const fixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      },
    });
    writePluginSdkSubpathArtifacts(fixture.root, ["core"]);
    fs.writeFileSync(
      path.join(fixture.root, "src", "plugin-sdk", "qa-channel.ts"),
      "export const qaChannel = true;\n",
      "utf-8",
    );
    fs.writeFileSync(
      path.join(fixture.root, "src", "plugin-sdk", "qa-channel-protocol.ts"),
      "export const qaChannelProtocol = true;\n",
      "utf-8",
    );
    fs.writeFileSync(
      path.join(fixture.root, "src", "plugin-sdk", "qa-runtime.ts"),
      "export const qaRuntime = true;\n",
      "utf-8",
    );
    fs.writeFileSync(
      path.join(fixture.root, "dist", "plugin-sdk", "qa-lab.js"),
      "export const qaLab = true;\n",
      "utf-8",
    );

    expect(
      listPluginSdkExportedSubpaths({
        modulePath: path.join(fixture.root, "src", "plugins", "loader.ts"),
      }),
    ).toEqual(["core"]);

    const privateSubpaths = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1" }, () =>
      listPluginSdkExportedSubpaths({
        modulePath: path.join(fixture.root, "src", "plugins", "loader.ts"),
      }),
    );
    expect(privateSubpaths).toEqual([
      "core",
      "qa-channel",
      "qa-channel-protocol",
      "qa-lab",
      "qa-runtime",
    ]);
  });

  it.each([
    {
      name: "does not derive plugin-sdk subpaths from cwd fallback when package root is not an OpenClaw root",
      fixture: () =>
        createPluginSdkAliasFixture({
          trustedRootIndicators: false,
          packageExports: {
            "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
            "./plugin-sdk/channel-runtime-context": {
              default: "./dist/plugin-sdk/channel-runtime-context.js",
            },
          },
        }),
      expected: [],
    },
    {
      name: "derives plugin-sdk subpaths via cwd fallback when trusted root indicator is cli-entry export",
      fixture: () =>
        createPluginSdkAliasFixture({
          trustedRootIndicatorMode: "cli-entry-only",
          packageExports: {
            "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
            "./plugin-sdk/channel-runtime-context": {
              default: "./dist/plugin-sdk/channel-runtime-context.js",
            },
          },
        }),
      expected: ["channel-runtime-context", "core"],
    },
  ] as const)("$name", ({ fixture: buildFixture, expected }) => {
    const fixture = buildFixture();
    writePluginSdkSubpathArtifacts(fixture.root, ["channel-runtime-context", "core"]);
    expectExportedSubpaths({
      fixture,
      cwd: fixture.root,
      modulePath: "/tmp/tsx-cache/openclaw-loader.js",
      expected,
    });
  });

  it("builds plugin-sdk aliases from the module being loaded, not the loader location", () => {
    const { fixture, sourceChannelRuntimePath, distChannelRuntimePath } =
      createPluginSdkAliasTargetFixture();
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );

    const sourceAliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry),
    );
    expectPluginSdkAliasTargets(sourceAliases, {
      channelRuntimePath: sourceChannelRuntimePath,
    });

    const distPluginEntry = writePluginEntry(
      fixture.root,
      bundledDistPluginFile("demo", "index.js"),
    );

    const distAliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(distPluginEntry),
    );
    expectPluginSdkAliasTargets(distAliases, {
      channelRuntimePath: distChannelRuntimePath,
    });
  });

  it("adds private qa plugin-sdk aliases for source plugins when enabled", () => {
    const fixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      },
    });
    const sourceQaChannelPath = path.join(fixture.root, "src", "plugin-sdk", "qa-channel.ts");
    const sourceQaChannelProtocolPath = path.join(
      fixture.root,
      "src",
      "plugin-sdk",
      "qa-channel-protocol.ts",
    );
    const sourceQaRuntimePath = path.join(fixture.root, "src", "plugin-sdk", "qa-runtime.ts");
    const distQaLabPath = path.join(fixture.root, "dist", "plugin-sdk", "qa-lab.js");
    fs.writeFileSync(sourceQaChannelPath, "export const qaChannel = true;\n", "utf-8");
    fs.writeFileSync(
      sourceQaChannelProtocolPath,
      "export const qaChannelProtocol = true;\n",
      "utf-8",
    );
    fs.writeFileSync(sourceQaRuntimePath, "export const qaRuntime = true;\n", "utf-8");
    fs.writeFileSync(distQaLabPath, "export const qaLab = true;\n", "utf-8");
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("qa-runner-fixture", "src/index.ts"),
    );

    const aliases = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1", NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry),
    );

    expect(fs.realpathSync(aliases["openclaw/plugin-sdk/qa-runtime"] ?? "")).toBe(
      fs.realpathSync(sourceQaRuntimePath),
    );
    expect(fs.realpathSync(aliases["openclaw/plugin-sdk/qa-channel"] ?? "")).toBe(
      fs.realpathSync(sourceQaChannelPath),
    );
    expect(fs.realpathSync(aliases["openclaw/plugin-sdk/qa-channel-protocol"] ?? "")).toBe(
      fs.realpathSync(sourceQaChannelProtocolPath),
    );
    expect(fs.realpathSync(aliases["openclaw/plugin-sdk/qa-lab"] ?? "")).toBe(
      fs.realpathSync(distQaLabPath),
    );
  });

  it("aliases non-QA private plugin-sdk subpaths for trusted Codex runtime loading", () => {
    const fixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      },
    });
    const sourceCodexMcpProjectionPath = path.join(
      fixture.root,
      "src",
      "plugin-sdk",
      "codex-mcp-projection.ts",
    );
    const distCodexMcpProjectionPath = path.join(
      fixture.root,
      "dist",
      "plugin-sdk",
      "codex-mcp-projection.js",
    );
    const sourceQaRuntimePath = path.join(fixture.root, "src", "plugin-sdk", "qa-runtime.ts");
    fs.rmSync(
      path.join(fixture.root, "scripts", "lib", "plugin-sdk-private-local-only-subpaths.json"),
      { force: true },
    );
    fs.writeFileSync(
      sourceCodexMcpProjectionPath,
      "export const codexMcpProjection = true;\n",
      "utf-8",
    );
    fs.writeFileSync(
      distCodexMcpProjectionPath,
      "export const codexMcpProjection = true;\n",
      "utf-8",
    );
    fs.writeFileSync(sourceQaRuntimePath, "export const qaRuntime = true;\n", "utf-8");
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("codex", "src/index.ts"),
    );
    const distCodexEntry = writePluginEntry(
      fixture.root,
      path.join("dist", "extensions", "codex", "index.js"),
    );
    const sourceOtherPluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );
    const devFixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      },
    });
    const devCodexMcpProjectionPath = path.join(
      devFixture.root,
      "dist",
      "plugin-sdk",
      "codex-mcp-projection.js",
    );
    mkdirSafeDir(path.join(devFixture.root, "extensions"));
    fs.writeFileSync(
      devCodexMcpProjectionPath,
      "export const devCodexMcpProjection = true;\n",
      "utf-8",
    );
    const { packageRoot: installedCodexRoot, pluginEntry: installedCodexEntry } =
      writeInstalledPluginEntry({
        installRoot: path.join(makeTempDir(), ".openclaw", "npm"),
        packageName: "@openclaw/codex",
      });
    const { packageRoot: installedOtherRoot, pluginEntry: installedOtherEntry } =
      writeInstalledPluginEntry({
        installRoot: path.join(makeTempDir(), ".openclaw", "npm"),
        packageName: "@openclaw/demo",
      });
    const shadowCodexRoot = path.join(makeTempDir(), ".openclaw", "extensions", "codex-shadow");
    const shadowCodexEntry = path.join(shadowCodexRoot, "dist", "index.js");
    mkdirSafeDir(path.dirname(shadowCodexEntry));
    fs.writeFileSync(
      path.join(shadowCodexRoot, "package.json"),
      JSON.stringify({ name: "@openclaw/codex", type: "module" }, null, 2),
      "utf-8",
    );
    fs.writeFileSync(shadowCodexEntry, 'export const plugin = "shadow";\n', "utf-8");

    const aliases = withEnv(
      { OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined },
      () => buildPluginLoaderAliasMap(sourcePluginEntry),
    );
    const otherAliases = withEnv(
      { OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined },
      () => buildPluginLoaderAliasMap(sourceOtherPluginEntry),
    );
    const devRootAliases = withEnv(
      { OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined },
      () =>
        buildPluginLoaderAliasMap(
          distCodexEntry,
          path.join(fixture.root, "openclaw.mjs"),
          undefined,
          "dist",
          devFixture.root,
        ),
    );
    const installedAliases = withCwd(installedCodexRoot, () =>
      withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined }, () =>
        buildPluginLoaderAliasMap(
          installedCodexEntry,
          path.join(fixture.root, "openclaw.mjs"),
          undefined,
          "dist",
        ),
      ),
    );
    const shadowCodexAliases = withCwd(shadowCodexRoot, () =>
      withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined }, () =>
        buildPluginLoaderAliasMap(
          shadowCodexEntry,
          path.join(fixture.root, "openclaw.mjs"),
          undefined,
          "dist",
        ),
      ),
    );
    const installedOtherAliases = withCwd(installedOtherRoot, () =>
      withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined }, () =>
        buildPluginLoaderAliasMap(
          installedOtherEntry,
          path.join(fixture.root, "openclaw.mjs"),
          undefined,
          "dist",
        ),
      ),
    );

    expect(fs.realpathSync(aliases["openclaw/plugin-sdk/codex-mcp-projection"] ?? "")).toBe(
      fs.realpathSync(sourceCodexMcpProjectionPath),
    );
    expect(
      fs.realpathSync(installedAliases["openclaw/plugin-sdk/codex-mcp-projection"] ?? ""),
    ).toBe(fs.realpathSync(distCodexMcpProjectionPath));
    expect(fs.realpathSync(devRootAliases["openclaw/plugin-sdk/codex-mcp-projection"] ?? "")).toBe(
      fs.realpathSync(devCodexMcpProjectionPath),
    );
    expect(aliases["openclaw/plugin-sdk/qa-runtime"]).toBeUndefined();
    expect(otherAliases["openclaw/plugin-sdk/codex-mcp-projection"]).toBeUndefined();
    expect(installedOtherAliases["openclaw/plugin-sdk/codex-mcp-projection"]).toBeUndefined();
    expect(shadowCodexAliases["openclaw/plugin-sdk/codex-mcp-projection"]).toBeUndefined();
  });

  it("aliases the SSRF internal helper only for bundled local IPC owner plugins", async () => {
    const fixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      },
    });
    writePluginSdkSubpathArtifacts(fixture.root, ["core"]);
    const sourceSsrFInternalPath = path.join(
      fixture.root,
      "src",
      "plugin-sdk",
      "ssrf-runtime-internal.ts",
    );
    const distSsrFInternalPath = path.join(
      fixture.root,
      "dist",
      "plugin-sdk",
      "ssrf-runtime-internal.js",
    );
    fs.rmSync(path.join(fixture.root, "scripts"), { force: true, recursive: true });
    fs.writeFileSync(sourceSsrFInternalPath, "export const ssrfInternal = true;\n", "utf-8");
    fs.writeFileSync(distSsrFInternalPath, "export const ssrfInternal = true;\n", "utf-8");
    const ssrfInternalSpecifier = "openclaw/plugin-sdk/ssrf-runtime-internal";
    const entryBody = [
      `import { ssrfInternal } from "${ssrfInternalSpecifier}";`,
      "export const loadedSsrFInternal = ssrfInternal;",
      "",
    ].join("\n");
    const ownerCases = [
      {
        entryPath: bundledPluginFile("ollama", "index.ts"),
        expectedAliasTarget: sourceSsrFInternalPath,
        resolution: undefined,
        tryNative: false,
      },
      {
        entryPath: bundledPluginFile("browser", "index.ts"),
        expectedAliasTarget: sourceSsrFInternalPath,
        resolution: undefined,
        tryNative: false,
      },
      {
        entryPath: bundledDistPluginFile("ollama", "index.js"),
        expectedAliasTarget: distSsrFInternalPath,
        resolution: "dist",
        tryNative: true,
      },
      {
        entryPath: bundledDistPluginFile("browser", "index.js"),
        expectedAliasTarget: distSsrFInternalPath,
        resolution: "dist",
        tryNative: true,
      },
      {
        entryPath: path.join("dist-runtime", "extensions", "ollama", "index.js"),
        expectedAliasTarget: distSsrFInternalPath,
        resolution: "dist",
        tryNative: true,
      },
      {
        entryPath: path.join("dist-runtime", "extensions", "browser", "index.js"),
        expectedAliasTarget: distSsrFInternalPath,
        resolution: "dist",
        tryNative: true,
      },
    ] as const;
    const owners = ownerCases.map((owner) => {
      const entry = writePluginEntry(fixture.root, owner.entryPath);
      fs.writeFileSync(entry, entryBody, "utf-8");
      return {
        entry,
        entryPath: owner.entryPath,
        expectedAliasTarget: owner.expectedAliasTarget,
        resolution: owner.resolution,
        tryNative: owner.tryNative,
      };
    });
    const sourceOtherPluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "index.ts"),
    );
    fs.writeFileSync(sourceOtherPluginEntry, entryBody, "utf-8");
    const { packageRoot: installedOllamaRoot, pluginEntry: installedOllamaEntry } =
      writeInstalledPluginEntry({
        installRoot: path.join(makeTempDir(), ".openclaw", "npm"),
        packageName: "@openclaw/ollama",
      });

    for (const owner of owners.filter(({ resolution }) => resolution === undefined)) {
      const sourceSubpaths = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined }, () =>
        listPluginSdkExportedSubpaths({ modulePath: owner.entry }),
      );
      expect(sourceSubpaths).toEqual(["core", "ssrf-runtime-internal"]);
    }
    const privateQaOtherSubpaths = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1" }, () =>
      listPluginSdkExportedSubpaths({
        modulePath: sourceOtherPluginEntry,
      }),
    );
    const ownersWithAliases = owners.map((owner) => ({
      aliases: withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined }, () =>
        owner.resolution === "dist"
          ? buildPluginLoaderAliasMap(owner.entry, undefined, undefined, "dist")
          : buildPluginLoaderAliasMap(owner.entry),
      ),
      entry: owner.entry,
      entryPath: owner.entryPath,
      expectedAliasTarget: owner.expectedAliasTarget,
      tryNative: owner.tryNative,
    }));
    const otherAliases = withEnv(
      { OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined },
      () => buildPluginLoaderAliasMap(sourceOtherPluginEntry),
    );
    const privateQaOtherAliases = withEnv(
      { OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1", NODE_ENV: undefined },
      () => buildPluginLoaderAliasMap(sourceOtherPluginEntry),
    );
    const installedAliases = withCwd(installedOllamaRoot, () =>
      withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined, NODE_ENV: undefined }, () =>
        buildPluginLoaderAliasMap(
          installedOllamaEntry,
          path.join(fixture.root, "openclaw.mjs"),
          undefined,
          "dist",
        ),
      ),
    );

    expect(privateQaOtherSubpaths).toEqual(["core"]);
    for (const owner of ownersWithAliases) {
      expect(fs.realpathSync(owner.aliases[ssrfInternalSpecifier] ?? ""), owner.entryPath).toBe(
        fs.realpathSync(owner.expectedAliasTarget),
      );
    }
    expect(otherAliases[ssrfInternalSpecifier]).toBeUndefined();
    expect(privateQaOtherAliases[ssrfInternalSpecifier]).toBeUndefined();
    expect(installedAliases[ssrfInternalSpecifier]).toBeUndefined();

    const createJiti = await getCreateJiti();
    const sourceLoaderBaseUrl = pathToFileURL(
      path.join(fixture.root, "src", "plugins", "loader.ts"),
    ).href;
    for (const owner of ownersWithAliases) {
      const loader = createJiti(sourceLoaderBaseUrl, {
        ...buildPluginLoaderJitiOptions(owner.aliases),
        tryNative: owner.tryNative,
      });
      const loaded = loader(owner.entry) as { loadedSsrFInternal?: unknown };
      expect(loaded.loadedSsrFInternal, owner.entryPath).toBe(true);
    }

    const otherLoader = createJiti(sourceLoaderBaseUrl, {
      ...buildPluginLoaderJitiOptions(privateQaOtherAliases),
      tryNative: false,
    });
    let otherLoadError: unknown;
    try {
      otherLoader(sourceOtherPluginEntry);
    } catch (error) {
      otherLoadError = error;
    }
    expect(otherLoadError).toBeInstanceOf(Error);
    expect((otherLoadError as Error).message).toContain("ssrf-runtime-internal");
  });

  it("applies explicit dist resolution to plugin-sdk subpath aliases too", () => {
    const { fixture, distChannelRuntimePath } = createPluginSdkAliasTargetFixture();
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );

    const distAliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry, undefined, undefined, "dist"),
    );

    expectPluginSdkAliasTargets(distAliases, {
      channelRuntimePath: distChannelRuntimePath,
    });
  });

  it("aliases workspace packages to source when dist artifacts are missing", () => {
    const fixture = createPluginSdkAliasFixture();
    const workspaceAliases = writeWorkspaceAliasFixtures(fixture.root, [
      ["@openclaw/gateway-client", "gateway-client", "index"],
      ["@openclaw/gateway-client/timeouts", "gateway-client", "timeouts"],
      ["@openclaw/gateway-protocol", "gateway-protocol", "index"],
      ["@openclaw/gateway-protocol/schema", "gateway-protocol", "schema"],
      ["@openclaw/gateway-protocol/frame-guards", "gateway-protocol", "frame-guards"],
      ["@openclaw/markdown-core", "markdown-core", "index"],
      ["@openclaw/markdown-core/tables", "markdown-core", "tables"],
      ["@openclaw/media-generation-core", "media-generation-core", "index"],
      ["@openclaw/media-generation-core/model-ref", "media-generation-core", "model-ref"],
      ["@openclaw/media-core", "media-core", "index"],
      ["@openclaw/media-core/mime", "media-core", "mime"],
      ["@openclaw/acp-core", "acp-core", "index"],
      ["@openclaw/acp-core/runtime/types", "acp-core", "runtime/types"],
      ["@openclaw/normalization-core", "normalization-core", "index"],
      ["@openclaw/normalization-core/boolean-coercion", "normalization-core", "boolean-coercion"],
      ["@openclaw/normalization-core/result", "normalization-core", "result"],
      ["@openclaw/normalization-core/agent-id", "normalization-core", "agent-id"],
      ["@openclaw/normalization-core/string-coerce", "normalization-core", "string-coerce"],
      ["@openclaw/retry", "retry", "index"],
      ["@openclaw/terminal-core", "terminal-core", "index"],
      ["@openclaw/terminal-core/theme", "terminal-core", "theme"],
      ["@openclaw/net-policy", "net-policy", "index"],
      ["@openclaw/net-policy/ip", "net-policy", "ip"],
      ["@openclaw/net-policy/url-protocol", "net-policy", "url-protocol"],
      ["@openclaw/model-catalog-core/provider-id", "model-catalog-core", "provider-id"],
    ]);
    for (const entry of workspaceAliases) {
      fs.rmSync(entry.distFile);
    }
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );

    const aliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry, undefined, undefined, "dist"),
    );

    expectWorkspaceAliasTargets(aliases, workspaceAliases, "srcFile");
  });

  it("aliases workspace package subpaths to dist when available", () => {
    const fixture = createPluginSdkAliasFixture();
    const workspaceAliases = writeWorkspaceAliasFixtures(fixture.root, [
      ["@openclaw/gateway-client/readiness", "gateway-client", "readiness"],
      [
        "@openclaw/gateway-protocol/connect-error-details",
        "gateway-protocol",
        "connect-error-details",
      ],
      ["@openclaw/gateway-protocol/frame-guards", "gateway-protocol", "frame-guards"],
      ["@openclaw/markdown-core/render", "markdown-core", "render"],
      ["@openclaw/media-generation-core/catalog", "media-generation-core", "catalog"],
      [
        "@openclaw/acp-core/normalize-text",
        "acp-core",
        "normalize-text",
        "dist/acp-core/normalize-text.js",
        false,
      ],
      [
        "@openclaw/normalization-core/record-coerce",
        "normalization-core",
        "record-coerce",
        "dist/normalization-core/record-coerce.js",
      ],
      ["@openclaw/retry", "retry", "index", "dist/retry/index.js"],
      ["@openclaw/terminal-core/links", "terminal-core", "links", "dist/terminal-core/links.js"],
      ["@openclaw/net-policy/url-protocol", "net-policy", "url-protocol"],
      [
        "@openclaw/model-catalog-core/provider-model-id-normalize",
        "model-catalog-core",
        "provider-model-id-normalize",
      ],
    ]);
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );

    const aliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry, undefined, undefined, "dist"),
    );

    expectWorkspaceAliasTargets(aliases, workspaceAliases, "expectedDistFile");
  });

  it("derives workspace aliases from packaged root dist when package metadata is absent", () => {
    const fixture = createPluginSdkAliasFixture();
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );
    const acpRuntimeErrors = path.join(fixture.root, "dist", "acp-core", "runtime", "errors.js");
    mkdirSafeDir(path.dirname(acpRuntimeErrors));
    fs.writeFileSync(acpRuntimeErrors, "export {};\n", "utf-8");
    const normalizationAgentId = path.join(
      fixture.root,
      "dist",
      "normalization-core",
      "agent-id.js",
    );
    mkdirSafeDir(path.dirname(normalizationAgentId));
    fs.writeFileSync(normalizationAgentId, "export {};\n", "utf-8");
    const cwdWithoutOpenClawPackage = makeTempDir();

    const aliases = withCwd(cwdWithoutOpenClawPackage, () =>
      withEnv({ NODE_ENV: undefined }, () =>
        buildPluginLoaderAliasMap(sourcePluginEntry, undefined, undefined, "dist"),
      ),
    );

    expect(fs.realpathSync(aliases["@openclaw/acp-core/runtime/errors"] ?? "")).toBe(
      fs.realpathSync(acpRuntimeErrors),
    );
    expect(fs.realpathSync(aliases["@openclaw/normalization-core/agent-id"] ?? "")).toBe(
      fs.realpathSync(normalizationAgentId),
    );
  });

  it("aliases bundled plugin package public surfaces for source plugin transforms", () => {
    const { fixture, sourceApiPath, sourceRuntimeApiPath } =
      createBundledPluginPackagePublicSurfaceAliasFixture();
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("qa-lab", "src/live-transports/slack/slack-live.runtime.ts"),
    );

    const aliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry),
    );

    expect(fs.realpathSync(aliases["@openclaw/slack/api.js"] ?? "")).toBe(
      fs.realpathSync(sourceApiPath),
    );
    expect(fs.realpathSync(aliases["@openclaw/slack/runtime-api.js"] ?? "")).toBe(
      fs.realpathSync(sourceRuntimeApiPath),
    );
    expect(aliases["@openclaw/slack/test-api.js"]).toBeUndefined();
    expect(aliases["@openclaw/slack/internal.js"]).toBeUndefined();
  });

  it("aliases bundled plugin package test surfaces only in private QA mode", () => {
    const { fixture, sourceTestApiPath } = createBundledPluginPackagePublicSurfaceAliasFixture();
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("qa-lab", "src/live-transports/slack/slack-live.runtime.ts"),
    );

    const aliases = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1", NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry),
    );

    expect(fs.realpathSync(aliases["@openclaw/slack/test-api.js"] ?? "")).toBe(
      fs.realpathSync(sourceTestApiPath),
    );
  });

  it("aliases bundled plugin package public surfaces to dist when dist resolution is requested", () => {
    const { fixture, distApiPath, distRuntimeApiPath } =
      createBundledPluginPackagePublicSurfaceAliasFixture();
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("qa-lab", "src/live-transports/slack/slack-live.runtime.ts"),
    );

    const aliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry, undefined, undefined, "dist"),
    );

    expect(fs.realpathSync(aliases["@openclaw/slack/api.js"] ?? "")).toBe(
      fs.realpathSync(distApiPath),
    );
    expect(fs.realpathSync(aliases["@openclaw/slack/runtime-api.js"] ?? "")).toBe(
      fs.realpathSync(distRuntimeApiPath),
    );
  });

  it("falls back to source plugin-sdk subpath aliases when dist chunks are stale", () => {
    const fixture = createPluginSdkAliasFixture({
      srcFile: "provider-entry.ts",
      distFile: "provider-entry.js",
      distBody: 'import { entry } from "../missing-provider-entry-chunk.js";\nexport { entry };\n',
      packageExports: {
        "./plugin-sdk/provider-entry": { default: "./dist/plugin-sdk/provider-entry.js" },
      },
    });
    const sourceProviderEntryPath = path.join(
      fixture.root,
      "src",
      "plugin-sdk",
      "provider-entry.ts",
    );
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );

    const distAliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry, undefined, undefined, "dist"),
    );

    expect(fs.realpathSync(distAliases["openclaw/plugin-sdk/provider-entry"] ?? "")).toBe(
      fs.realpathSync(sourceProviderEntryPath),
    );
  });

  it("builds source plugin-sdk subpath aliases through the wider source extension family", () => {
    const { fixture, sourceChannelRuntimePath } = createPluginSdkAliasTargetFixture({
      sourceChannelRuntimeExtension: ".mts",
    });
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );

    const sourceAliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(sourcePluginEntry),
    );

    expectPluginSdkAliasTargets(sourceAliases, {
      channelRuntimePath: sourceChannelRuntimePath,
    });
  });

  it("resolves plugin-sdk aliases for user-installed plugins via the running openclaw argv hint", () => {
    const {
      externalPluginEntry,
      externalPluginRoot,
      fixture,
      sourcePluginEntryPath,
      sourceChannelRuntimePath,
    } = createUserInstalledPluginSdkAliasFixture();

    const aliases = withCwd(externalPluginRoot, () =>
      withEnv({ NODE_ENV: undefined }, () =>
        buildPluginLoaderAliasMap(externalPluginEntry, path.join(fixture.root, "openclaw.mjs")),
      ),
    );

    expectPluginSdkAliasTargets(aliases, {
      channelRuntimePath: sourceChannelRuntimePath,
      pluginEntryPath: sourcePluginEntryPath,
    });
  });

  it("resolves plugin-sdk aliases for user-installed plugins via moduleUrl hint", () => {
    const {
      externalPluginEntry,
      externalPluginRoot,
      fixture,
      sourcePluginEntryPath,
      sourceChannelRuntimePath,
    } = createUserInstalledPluginSdkAliasFixture();

    // Simulate loader.ts passing its own import.meta.url as the moduleUrl hint.
    // This covers installations where argv1 does not resolve to the openclaw root
    // (e.g. single-binary distributions or custom process launchers).
    // Use openclaw.mjs which is created by createPluginSdkAliasFixture (bin+marker mode).
    // Use fixture.root as cwd so process.cwd() fallback also resolves to fixture, not the
    // real openclaw repo root in the test runner environment.
    const loaderModuleUrl = pathToFileURL(path.join(fixture.root, "openclaw.mjs")).href;

    // Use externalPluginRoot as cwd so process.cwd() fallback cannot accidentally
    // resolve to the fixture root — only the moduleUrl hint can bridge the gap.
    // Pass "" for argv1: undefined would trigger the STARTUP_ARGV1 default (the vitest
    // runner binary, inside the openclaw repo), which resolves before moduleUrl is checked.
    // An empty string is falsy so resolveTrustedOpenClawRootFromArgvHint returns null,
    // meaning only the moduleUrl hint can bridge the gap.
    const aliases = withCwd(externalPluginRoot, () =>
      withEnv({ NODE_ENV: undefined }, () =>
        buildPluginLoaderAliasMap(
          externalPluginEntry,
          "", // explicitly disable argv1 (empty string bypasses STARTUP_ARGV1 default)
          loaderModuleUrl,
        ),
      ),
    );

    expectPluginSdkAliasTargets(aliases, {
      channelRuntimePath: sourceChannelRuntimePath,
      pluginEntryPath: sourcePluginEntryPath,
    });
  });

  it.each([
    {
      name: "does not resolve plugin-sdk alias files from cwd fallback when package root is not an OpenClaw root",
      fixture: () =>
        createPluginSdkAliasFixture({
          srcFile: "channel-runtime-context.ts",
          distFile: "channel-runtime-context.js",
          trustedRootIndicators: false,
          packageExports: {
            "./plugin-sdk/channel-runtime-context": {
              default: "./dist/plugin-sdk/channel-runtime-context.js",
            },
          },
        }),
      expected: null,
    },
  ] as const)("$name", ({ fixture: buildFixture, expected }) => {
    const fixture = buildFixture();
    expectCwdFallbackPluginSdkAliasResolution({
      fixture,
      expected,
    });
  });

  it("configures the plugin loader native-first boundary to prefer native dist modules", () => {
    const options = buildPluginLoaderJitiOptions({});

    expect(options.tryNative).toBe(true);
    expect(options.nativeModules).toEqual(["openclaw"]);
    expect(options.interopDefault).toBe(true);
    expect(options.extensions).toContain(".js");
    expect(options.extensions).toContain(".ts");
    expect("alias" in options).toBe(false);
  });

  it("preserves configured jiti native modules while adding openclaw", () => {
    const options = withEnv(
      { JITI_NATIVE_MODULES: JSON.stringify(["native-addon", "openclaw"]) },
      () => buildPluginLoaderJitiOptions({}),
    );

    expect(options.nativeModules).toEqual(["native-addon", "openclaw"]);
  });

  it("uses transpiled module loads for source TypeScript plugin entries", () => {
    expect(resolvePluginLoaderTryNative("/repo/dist/plugins/runtime/index.js")).toBe(true);
    expect(
      resolvePluginLoaderTryNative(
        `/repo/${bundledPluginFile("discord", "src/channel.runtime.ts")}`,
      ),
    ).toBe(false);
  });

  it("disables native module loads under Bun even for built JavaScript entries", () => {
    const originalVersions = process.versions;
    Object.defineProperty(process, "versions", {
      configurable: true,
      value: {
        ...originalVersions,
        bun: "1.2.0",
      },
    });

    try {
      expect(resolvePluginLoaderTryNative("/repo/dist/plugins/runtime/index.js")).toBe(false);
      expect(
        resolvePluginLoaderTryNative(`/repo/${bundledDistPluginFile("browser", "index.js")}`),
      ).toBe(false);
    } finally {
      Object.defineProperty(process, "versions", {
        configurable: true,
        value: originalVersions,
      });
    }
  });

  it("enables native module loads on Windows for built JavaScript entries", () => {
    const originalPlatform = process.platform;
    Object.defineProperty(process, "platform", {
      configurable: true,
      value: "win32",
    });

    try {
      expect(resolvePluginLoaderTryNative("/repo/dist/plugins/runtime/index.js")).toBe(true);
      expect(
        resolvePluginLoaderTryNative(`/repo/${bundledDistPluginFile("browser", "index.js")}`),
      ).toBe(true);
    } finally {
      Object.defineProperty(process, "platform", {
        configurable: true,
        value: originalPlatform,
      });
    }
  });

  it("keeps plugin loader dist shortcuts on native module loading on Windows for JS entries", () => {
    const originalPlatform = process.platform;
    Object.defineProperty(process, "platform", {
      configurable: true,
      value: "win32",
    });

    try {
      expect(
        resolvePluginLoaderTryNative(`/repo/${bundledDistPluginFile("browser", "index.js")}`, {
          preferBuiltDist: true,
        }),
      ).toBe(true);
      expect(
        resolvePluginLoaderTryNative(`/repo/${bundledDistPluginFile("browser", "helper.ts")}`, {
          preferBuiltDist: true,
        }),
      ).toBe(false);
    } finally {
      Object.defineProperty(process, "platform", {
        configurable: true,
        value: originalPlatform,
      });
    }
  });

  it("prefers native module loading for bundled plugin dist .js modules, keeps .ts on aliased path", () => {
    // Built .js/.mjs/.cjs files under dist/extensions/ should now delegate
    // to native loading on Node for compiled artifacts, avoiding the slow jiti transform path.
    expect(
      resolvePluginLoaderTryNative(`/repo/${bundledDistPluginFile("browser", "index.js")}`, {
        preferBuiltDist: true,
      }),
    ).toBe(true);
    // TypeScript source files still need jiti's transform pipeline.
    expect(
      resolvePluginLoaderTryNative(`/repo/${bundledDistPluginFile("browser", "helper.ts")}`, {
        preferBuiltDist: true,
      }),
    ).toBe(false);
    expect(
      resolvePluginLoaderTryNative("/repo/dist/plugins/runtime/index.js", {
        preferBuiltDist: true,
      }),
    ).toBe(true);
  });

  it("keeps plugin loader module cache keys stable across alias insertion order", () => {
    expect(
      createPluginLoaderModuleCacheKey({
        tryNative: true,
        aliasMap: {
          zeta: "/repo/zeta.js",
          alpha: "/repo/alpha.js",
        },
      }),
    ).toBe(
      createPluginLoaderModuleCacheKey({
        tryNative: true,
        aliasMap: {
          alpha: "/repo/alpha.js",
          zeta: "/repo/zeta.js",
        },
      }),
    );
  });

  it("returns plugin loader module config with stable cache keys", () => {
    const first = resolvePluginLoaderModuleConfig({
      modulePath: `/repo/${bundledDistPluginFile("browser", "index.js")}`,
      argv1: "/repo/openclaw.mjs",
      moduleUrl: "file:///repo/src/plugins/public-surface-loader.ts",
      preferBuiltDist: true,
    });
    const second = resolvePluginLoaderModuleConfig({
      modulePath: `/repo/${bundledDistPluginFile("browser", "index.js")}`,
      argv1: "/repo/openclaw.mjs",
      moduleUrl: "file:///repo/src/plugins/public-surface-loader.ts",
      preferBuiltDist: true,
    });

    expect(second).toBe(first);
  });

  it("scopes plugin loader module config by plugin-sdk resolution", () => {
    const { fixture, sourceChannelRuntimePath, distChannelRuntimePath } =
      createPluginSdkAliasTargetFixture();
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("demo", "src/index.ts"),
    );

    const { auto, dist, distAgain } = withEnv({ NODE_ENV: undefined }, () => ({
      auto: resolvePluginLoaderModuleConfig({
        modulePath: sourcePluginEntry,
        argv1: path.join(fixture.root, "openclaw.mjs"),
        moduleUrl: pathToFileURL(path.join(fixture.root, "src/plugins/loader.ts")).href,
        pluginSdkResolution: "auto",
      }),
      dist: resolvePluginLoaderModuleConfig({
        modulePath: sourcePluginEntry,
        argv1: path.join(fixture.root, "openclaw.mjs"),
        moduleUrl: pathToFileURL(path.join(fixture.root, "src/plugins/loader.ts")).href,
        pluginSdkResolution: "dist",
      }),
      distAgain: resolvePluginLoaderModuleConfig({
        modulePath: sourcePluginEntry,
        argv1: path.join(fixture.root, "openclaw.mjs"),
        moduleUrl: pathToFileURL(path.join(fixture.root, "src/plugins/loader.ts")).href,
        pluginSdkResolution: "dist",
      }),
    }));

    expect(distAgain).toBe(dist);
    expect(auto).not.toBe(dist);
    expect(
      fs.realpathSync(auto.aliasMap["openclaw/plugin-sdk/channel-runtime-context"] ?? ""),
    ).toBe(fs.realpathSync(sourceChannelRuntimePath));
    expect(
      fs.realpathSync(dist.aliasMap["openclaw/plugin-sdk/channel-runtime-context"] ?? ""),
    ).toBe(fs.realpathSync(distChannelRuntimePath));
  });

  it("loads source runtime shims through the non-native module loading boundary", async () => {
    const copiedExtensionRoot = path.join(makeTempDir(), bundledPluginRoot("discord"));
    const copiedSourceDir = path.join(copiedExtensionRoot, "src");
    const copiedPluginSdkDir = path.join(copiedExtensionRoot, "plugin-sdk");
    mkdirSafeDir(copiedSourceDir);
    mkdirSafeDir(copiedPluginSdkDir);
    const sourceLoaderBaseFile = path.join(copiedSourceDir, "__jiti-base__.mjs");
    fs.writeFileSync(sourceLoaderBaseFile, "export {};\n", "utf-8");
    fs.writeFileSync(
      path.join(copiedSourceDir, "channel.runtime.ts"),
      `import { resolveOutboundSendDep } from "@openclaw/plugin-sdk/channel-outbound";

export const syntheticRuntimeMarker = {
  resolveOutboundSendDep,
};
`,
      "utf-8",
    );
    const copiedChannelRuntimeShim = path.join(copiedPluginSdkDir, "channel-outbound.ts");
    fs.writeFileSync(
      copiedChannelRuntimeShim,
      `export function resolveOutboundSendDep() {
  return "shimmed";
}
`,
      "utf-8",
    );
    const copiedChannelRuntime = path.join(copiedExtensionRoot, "src", "channel.runtime.ts");
    const sourceLoaderBaseUrl = pathToFileURL(sourceLoaderBaseFile).href;

    const createJiti = await getCreateJiti();
    const withoutAlias = createJiti(sourceLoaderBaseUrl, {
      ...buildPluginLoaderJitiOptions({}),
      tryNative: false,
    });
    let loadError: unknown;
    try {
      withoutAlias(copiedChannelRuntime);
    } catch (error) {
      loadError = error;
    }
    expect(loadError).toBeInstanceOf(Error);
    expect((loadError as Error).message).toContain("channel-outbound");

    const withAlias = createJiti(sourceLoaderBaseUrl, {
      ...buildPluginLoaderJitiOptions({
        "openclaw/plugin-sdk/channel-outbound": copiedChannelRuntimeShim,
        "@openclaw/plugin-sdk/channel-outbound": copiedChannelRuntimeShim,
      }),
      tryNative: false,
    });
    const loadedRuntime = withAlias(copiedChannelRuntime) as {
      syntheticRuntimeMarker?: { resolveOutboundSendDep?: unknown };
    };
    expect(typeof loadedRuntime.syntheticRuntimeMarker?.resolveOutboundSendDep).toBe("function");
  }, 240_000);

  it.each([
    {
      name: "prefers dist plugin runtime module when loader runs from dist",
      modulePath: (root: string) => path.join(root, "dist", "plugins", "loader.js"),
      expected: "dist" as const,
    },
    {
      name: "resolves plugin runtime module from package root when loader runs from transpiler cache path",
      modulePath: () => "/tmp/tsx-cache/openclaw-loader.js",
      argv1: (root: string) => path.join(root, "openclaw.mjs"),
      env: { NODE_ENV: undefined },
      expected: "src" as const,
    },
  ])("$name", ({ modulePath, argv1, env, expected }) => {
    const fixture = createPluginRuntimeAliasFixture();
    const resolved = resolvePluginRuntimeModule({
      modulePath: modulePath(fixture.root),
      argv1: argv1?.(fixture.root),
      env,
    });
    expect(resolved).toBe(expected === "dist" ? fixture.distFile : fixture.srcFile);
  });

  it("resolves plugin runtime modules from an explicit dev source root", () => {
    const stableFixture = createPluginRuntimeAliasFixture({
      distBody: "export const stableRuntime = true;\n",
    });
    const devFixture = createPluginRuntimeAliasFixture({
      distBody: "export const devRuntime = true;\n",
    });
    mkdirSafeDir(path.join(devFixture.root, "extensions"));
    const entry = path.join(stableFixture.root, "dist", "plugins", "loader.js");
    mkdirSafeDir(path.dirname(entry));
    fs.writeFileSync(entry, "export {};\n", "utf-8");

    const resolved = resolvePluginRuntimeModule({
      modulePath: entry,
      pluginSdkResolution: "dist",
      devSourceRoot: devFixture.root,
    });

    expect(fs.realpathSync(resolved ?? "")).toBe(fs.realpathSync(devFixture.distFile));
  });

  it("falls back to ancestor runtime candidates when package-root markers are unavailable", () => {
    const root = makeTempDir();
    const distFile = path.join(root, "dist", "plugins", "runtime", "index.js");
    const loaderCachePath = path.join(root, ".cache", "tsx", "openclaw-loader.js");
    mkdirSafeDir(path.dirname(distFile));
    mkdirSafeDir(path.dirname(loaderCachePath));
    fs.writeFileSync(distFile, "export const createPluginRuntime = () => ({});\n", "utf-8");
    fs.writeFileSync(loaderCachePath, "export {};\n", "utf-8");

    expect(
      resolvePluginRuntimeModule({
        modulePath: loaderCachePath,
        argv1: path.join(root, "bin", "openclaw"),
        pluginSdkResolution: "dist",
      }),
    ).toBe(distFile);
  });

  it("uses the default startup argv hint for runtime fallback when argv1 is omitted", () => {
    const root = makeTempDir();
    const distFile = path.join(root, "dist", "plugins", "runtime", "index.js");
    const loaderCacheRoot = makeTempDir();
    const loaderCachePath = path.join(loaderCacheRoot, "tsx", "openclaw-loader.js");
    const originalArgv1 = process.argv[1];
    mkdirSafeDir(path.dirname(distFile));
    mkdirSafeDir(path.dirname(loaderCachePath));
    mkdirSafeDir(path.join(root, "bin"));
    fs.writeFileSync(distFile, "export const createPluginRuntime = () => ({});\n", "utf-8");
    fs.writeFileSync(loaderCachePath, "export {};\n", "utf-8");

    process.argv[1] = path.join(root, "bin", "openclaw");
    try {
      expect(
        resolvePluginRuntimeModule({
          modulePath: loaderCachePath,
          pluginSdkResolution: "dist",
        }),
      ).toBe(distFile);
    } finally {
      if (originalArgv1 === undefined) {
        process.argv.splice(1, 1);
      } else {
        process.argv[1] = originalArgv1;
      }
    }
  });

  it("prefers startup argv runtime candidates over cache ancestor fallbacks", () => {
    const root = makeTempDir();
    const distFile = path.join(root, "dist", "plugins", "runtime", "index.js");
    const loaderCacheRoot = makeTempDir();
    const cacheDistFile = path.join(loaderCacheRoot, "dist", "plugins", "runtime", "index.js");
    const loaderCachePath = path.join(loaderCacheRoot, "tsx", "openclaw-loader.js");
    mkdirSafeDir(path.dirname(distFile));
    mkdirSafeDir(path.dirname(cacheDistFile));
    mkdirSafeDir(path.dirname(loaderCachePath));
    mkdirSafeDir(path.join(root, "bin"));
    fs.writeFileSync(distFile, "export const runtime = 'startup';\n", "utf-8");
    fs.writeFileSync(cacheDistFile, "export const runtime = 'cache';\n", "utf-8");
    fs.writeFileSync(loaderCachePath, "export {};\n", "utf-8");

    expect(
      resolvePluginRuntimeModule({
        modulePath: loaderCachePath,
        argv1: path.join(root, "bin", "openclaw"),
        pluginSdkResolution: "dist",
      }),
    ).toBe(distFile);
  });

  it("resolves runtime fallback through symlinked startup argv", () => {
    const root = makeTempDir();
    const distFile = path.join(root, "dist", "plugins", "runtime", "index.js");
    const binFile = path.join(root, "bin", "openclaw");
    const shimRoot = makeTempDir();
    const shimFile = path.join(shimRoot, "bin", "openclaw");
    const loaderCachePath = path.join(makeTempDir(), "tsx", "openclaw-loader.js");
    mkdirSafeDir(path.dirname(distFile));
    mkdirSafeDir(path.dirname(binFile));
    mkdirSafeDir(path.dirname(shimFile));
    mkdirSafeDir(path.dirname(loaderCachePath));
    fs.writeFileSync(distFile, "export const runtime = 'startup';\n", "utf-8");
    fs.writeFileSync(binFile, "#!/usr/bin/env node\n", "utf-8");
    fs.symlinkSync(binFile, shimFile);
    fs.writeFileSync(loaderCachePath, "export {};\n", "utf-8");

    expect(
      resolvePluginRuntimeModule({
        modulePath: loaderCachePath,
        argv1: shimFile,
        pluginSdkResolution: "dist",
      }),
    ).toBe(fs.realpathSync(distFile));
  });

  it("resolves runtime fallback through npm .bin startup argv", () => {
    const root = makeTempDir();
    const packageRoot = path.join(root, "node_modules", "openclaw");
    const distFile = path.join(packageRoot, "dist", "plugins", "runtime", "index.js");
    const projectDistFile = path.join(root, "dist", "plugins", "runtime", "index.js");
    const binFile = path.join(root, "node_modules", ".bin", "openclaw");
    const loaderCachePath = path.join(makeTempDir(), "tsx", "openclaw-loader.js");
    mkdirSafeDir(path.dirname(distFile));
    mkdirSafeDir(path.dirname(projectDistFile));
    mkdirSafeDir(path.dirname(binFile));
    mkdirSafeDir(path.dirname(loaderCachePath));
    fs.writeFileSync(distFile, "export const runtime = 'startup';\n", "utf-8");
    fs.writeFileSync(projectDistFile, "export const runtime = 'project';\n", "utf-8");
    fs.writeFileSync(binFile, "#!/usr/bin/env node\n", "utf-8");
    fs.writeFileSync(loaderCachePath, "export {};\n", "utf-8");

    expect(
      resolvePluginRuntimeModule({
        modulePath: loaderCachePath,
        argv1: binFile,
        pluginSdkResolution: "dist",
      }),
    ).toBe(distFile);
  });

  it("reports loader, package root, and candidate paths when runtime resolution fails", () => {
    const root = makeTempDir();
    const modulePath = path.join(root, "dist", "plugins", "loader.js");
    fs.writeFileSync(
      path.join(root, "package.json"),
      JSON.stringify({ name: "openclaw", type: "module" }, null, 2),
      "utf-8",
    );
    mkdirSafeDir(path.dirname(modulePath));
    fs.writeFileSync(modulePath, "export {};\n", "utf-8");

    const resolution = resolvePluginRuntimeModulePathWithDiagnostics({
      modulePath,
      pluginSdkResolution: "dist",
    });

    expect(resolution.resolvedPath).toBeNull();
    expect(resolution.modulePath).toBe(modulePath);
    expect(resolution.packageRoot).toBe(root);
    expect(resolution.candidates).toContain(
      path.join(root, "dist", "plugins", "runtime", "index.js"),
    );
    expect(resolution.candidates).toContain(
      path.join(root, "src", "plugins", "runtime", "index.ts"),
    );
  });
});

describe("buildPluginLoaderAliasMap memoization", () => {
  it("returns the same object reference for identical effective context", () => {
    const fixture = createPluginSdkAliasFixture();
    const sourcePluginEntry = writePluginEntry(
      fixture.root,
      bundledPluginFile("memo-demo", "src/index.ts"),
    );

    const first = buildPluginLoaderAliasMap(sourcePluginEntry);
    const second = buildPluginLoaderAliasMap(sourcePluginEntry);

    expect(second).toBe(first);
  });

  it("returns different references for different modulePath inputs", () => {
    const fixtureA = createPluginSdkAliasFixture();
    const fixtureB = createPluginSdkAliasFixture();
    const entryA = writePluginEntry(fixtureA.root, bundledPluginFile("a", "src/index.ts"));
    const entryB = writePluginEntry(fixtureB.root, bundledPluginFile("b", "src/index.ts"));

    const aliasA = buildPluginLoaderAliasMap(entryA);
    const aliasB = buildPluginLoaderAliasMap(entryB);

    expect(aliasA).not.toBe(aliasB);
  });

  it("reuses one merged map for plugin entrypoints with the same effective SDK surface", () => {
    const fixture = createPluginSdkAliasFixture();
    const entryA = writePluginEntry(fixture.root, bundledPluginFile("a", "src/index.ts"));
    const entryB = writePluginEntry(fixture.root, bundledPluginFile("b", "src/index.ts"));

    expect(buildPluginLoaderAliasMap(entryB)).toBe(buildPluginLoaderAliasMap(entryA));
  });

  it("returns different references when pluginSdkResolution differs", () => {
    const fixture = createPluginSdkAliasFixture();
    const entry = writePluginEntry(fixture.root, bundledPluginFile("res", "src/index.ts"));

    const auto = buildPluginLoaderAliasMap(entry, undefined, undefined, "auto");
    const dist = buildPluginLoaderAliasMap(entry, undefined, undefined, "dist");

    expect(auto).not.toBe(dist);
  });

  it("reuses one merged map when resolution modes have the same effective order", () => {
    const fixture = createPluginSdkAliasFixture();
    const entry = writePluginEntry(fixture.root, bundledPluginFile("same-order", "src/index.ts"));

    const auto = buildPluginLoaderAliasMap(entry, undefined, undefined, "auto");
    const source = buildPluginLoaderAliasMap(entry, undefined, undefined, "src");

    expect(source).toBe(auto);
  });

  it("reuses a merged map when different argv hints resolve the same SDK surface", () => {
    const fixture = createPluginSdkAliasFixture();
    const entry = writePluginEntry(fixture.root, bundledPluginFile("argv", "src/index.ts"));

    const a = buildPluginLoaderAliasMap(entry, "/path/to/cli-a.mjs");
    const b = buildPluginLoaderAliasMap(entry, "/path/to/cli-b.mjs");

    expect(a).toBe(b);
  });

  it("returns different references when an explicit dev source root differs", () => {
    const stableFixture = createPluginSdkAliasFixture();
    const devFixture = createPluginSdkAliasFixture();
    mkdirSafeDir(path.join(devFixture.root, "extensions"));
    const entry = writePluginEntry(
      stableFixture.root,
      bundledPluginFile("dev-env", "src/index.ts"),
    );

    const stableAliases = buildPluginLoaderAliasMap(entry, undefined, undefined, "dist", null);
    const devAliases = buildPluginLoaderAliasMap(
      entry,
      undefined,
      undefined,
      "dist",
      devFixture.root,
    );

    expect(devAliases).not.toBe(stableAliases);
  });

  it("does not reuse a public alias map after private qa aliases are enabled", () => {
    const fixture = createPluginSdkAliasFixture({
      packageExports: {
        "./plugin-sdk/core": { default: "./dist/plugin-sdk/core.js" },
      },
    });
    const sourceQaRuntimePath = path.join(fixture.root, "src", "plugin-sdk", "qa-runtime.ts");
    fs.writeFileSync(sourceQaRuntimePath, "export const qaRuntime = true;\n", "utf-8");
    const entry = writePluginEntry(fixture.root, bundledPluginFile("private-qa", "src/index.ts"));

    const publicAliases = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: undefined }, () =>
      buildPluginLoaderAliasMap(entry),
    );
    const privateAliases = withEnv({ OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1" }, () =>
      buildPluginLoaderAliasMap(entry),
    );

    expect(publicAliases).not.toBe(privateAliases);
    expect(publicAliases["openclaw/plugin-sdk/qa-runtime"]).toBeUndefined();
    expect(fs.realpathSync(privateAliases["openclaw/plugin-sdk/qa-runtime"] ?? "")).toBe(
      fs.realpathSync(sourceQaRuntimePath),
    );
  });

  it("does not reuse a development alias map in production mode", () => {
    const fixture = createPluginSdkAliasFixture();
    const entry = writePluginEntry(fixture.root, bundledPluginFile("env-mode", "src/index.ts"));

    const developmentAliases = withEnv({ NODE_ENV: undefined }, () =>
      buildPluginLoaderAliasMap(entry),
    );
    const productionAliases = withEnv({ NODE_ENV: "production" }, () =>
      buildPluginLoaderAliasMap(entry),
    );

    expect(developmentAliases).not.toBe(productionAliases);
  });

  it("memoized result has identical content to a freshly computed map", () => {
    const fixture = createPluginSdkAliasFixture();
    const entry = writePluginEntry(fixture.root, bundledPluginFile("eq", "src/index.ts"));

    const first = buildPluginLoaderAliasMap(entry);
    const second = buildPluginLoaderAliasMap(entry);

    // Same reference (cache hit)
    expect(second).toBe(first);
    // Same content
    expect(second).toEqual(first);
    // Same key set
    expect(Object.keys(second).toSorted()).toEqual(Object.keys(first).toSorted());
  });
});

describe("buildPluginLoaderJitiOptions", () => {
  it("scopes the jiti cache to the durable user cache and OpenClaw install", () => {
    const root = createTrustedOpenClawPackageFixture("2.0.0");
    const tmpDir = path.join(root, "tmp");
    const cacheRoot = path.join(root, "cache");

    const options = withEnv({ TMPDIR: tmpDir, XDG_CACHE_HOME: `  ${cacheRoot}  ` }, () =>
      buildPluginLoaderJitiOptions(
        { "openclaw/plugin-sdk/core": path.join(root, "dist", "plugin-sdk", "core.js") },
        { modulePath: path.join(root, "dist", "plugins", "loader.js") },
      ),
    );

    expect(options.fsCache).toContain(path.join(cacheRoot, "openclaw", "jiti", "2.0.0"));
    expect(options.fsCache).not.toContain(tmpDir);
  });

  it.each(["", "   ", "relative/cache"])(
    "ignores non-absolute XDG cache roots (%j)",
    (xdgCacheHome) => {
      const root = createTrustedOpenClawPackageFixture("2.0.0");
      const homeDir = path.join(root, "home");
      const options = withEnv(
        {
          XDG_CACHE_HOME: xdgCacheHome,
          LOCALAPPDATA: undefined,
          OPENCLAW_HOME: homeDir,
        },
        () => buildPluginLoaderJitiOptions({}, { modulePath: path.join(root, "dist", "plugins") }),
      );
      const platformCacheRoot =
        process.platform === "win32"
          ? path.join(homeDir, "AppData", "Local")
          : process.platform === "darwin"
            ? path.join(homeDir, "Library", "Caches")
            : path.join(homeDir, ".cache");

      expect(options.fsCache).toContain(path.join(platformCacheRoot, "openclaw", "jiti", "2.0.0"));
    },
  );

  it.skipIf(process.platform !== "win32")(
    "uses an absolute Windows local application-data cache root",
    () => {
      const root = createTrustedOpenClawPackageFixture("2.0.0");
      const localAppData = path.join(root, "local-app-data");
      const options = withEnv(
        {
          XDG_CACHE_HOME: undefined,
          LOCALAPPDATA: `  ${localAppData}  `,
          OPENCLAW_HOME: path.join(root, "home"),
        },
        () => buildPluginLoaderJitiOptions({}, { modulePath: path.join(root, "dist", "plugins") }),
      );

      expect(options.fsCache).toContain(path.join(localAppData, "openclaw", "jiti", "2.0.0"));
    },
  );

  it.each(["JITI_FS_CACHE", "JITI_CACHE"])("honors the %s filesystem-cache opt-out", (envKey) => {
    const root = createTrustedOpenClawPackageFixture("2.0.0");
    const options = withEnv(
      {
        JITI_FS_CACHE: envKey === "JITI_FS_CACHE" ? "false" : undefined,
        JITI_CACHE: envKey === "JITI_CACHE" ? "false" : undefined,
        XDG_CACHE_HOME: path.join(root, "cache"),
      },
      () => buildPluginLoaderJitiOptions({}, { modulePath: path.join(root, "dist", "plugins") }),
    );

    expect(options.fsCache).toBe(false);
  });

  it("keeps deferred jiti imports working after the temporary directory is deleted", async () => {
    const root = createTrustedOpenClawPackageFixture("2.0.0");
    const transientTmpRoot = path.join(root, "tmp");
    const durableCacheRoot = path.join(root, "cache");
    const sourceRoot = path.join(root, "source");
    const parentModulePath = path.join(sourceRoot, "parent.ts");
    const childModulePath = path.join(sourceRoot, "child.ts");
    mkdirSafeDir(sourceRoot);
    mkdirSafeDir(transientTmpRoot);
    fs.writeFileSync(
      parentModulePath,
      'export const loadChild = () => import("./child.ts");\n',
      "utf-8",
    );
    fs.writeFileSync(childModulePath, 'export const marker = "still-delivered";\n', "utf-8");
    const createJiti = await getCreateJiti();

    await withEnvAsync(
      {
        TMPDIR: transientTmpRoot,
        XDG_CACHE_HOME: durableCacheRoot,
        JITI_FS_CACHE: undefined,
        JITI_CACHE: undefined,
      },
      async () => {
        const options = buildPluginLoaderJitiOptions({}, { modulePath: parentModulePath });
        const loadSourceModule = createJiti(parentModulePath, {
          ...options,
          tryNative: false,
        });
        const parent = loadSourceModule(parentModulePath) as {
          loadChild: () => Promise<{ marker: string }>;
        };

        fs.rmSync(transientTmpRoot, { recursive: true, force: true });

        await expect(parent.loadChild()).resolves.toMatchObject({ marker: "still-delivered" });
        expect(String(options.fsCache)).toContain(path.join(durableCacheRoot, "openclaw", "jiti"));
        expect(fs.readdirSync(String(options.fsCache)).some((file) => file.includes("child"))).toBe(
          true,
        );
      },
    );
  });

  it("pre-normalizes and marks alias maps for source transforms", () => {
    const marker = Symbol.for("pathe:normalizedAlias");
    const aliasMap = {
      "openclaw/plugin-sdk/core": "/repo/src/plugin-sdk/core.ts",
      "@openclaw/plugin-sdk/core": "/repo/src/plugin-sdk/core.ts",
    };

    const first = buildPluginLoaderJitiOptions(aliasMap).alias as Record<string, string>;
    const second = buildPluginLoaderJitiOptions({ ...aliasMap }).alias as Record<string, string>;

    expect(second).toBe(first);
    expect((first as Record<symbol, unknown>)[marker]).toBe(true);
    expect(Object.prototype.propertyIsEnumerable.call(first, marker)).toBe(false);
  });

  it("applies source-transform alias-target normalization before caching", () => {
    const aliasMap = {
      alpha: "/repo/alpha",
      beta: "alpha/sub",
    };

    const alias = buildPluginLoaderJitiOptions(aliasMap).alias as Record<string, string>;

    expect(alias).not.toBe(aliasMap);
    expect(alias.beta).toBe("/repo/alpha/sub");
  });

  it("follows chained source-transform alias targets", () => {
    const aliasMap = {
      alpha: "/repo/alpha",
      gamma: "beta/gamma",
      beta: "alpha/beta",
    };

    const alias = buildPluginLoaderJitiOptions(aliasMap).alias as Record<string, string>;

    expect(alias.gamma).toBe("/repo/alpha/beta/gamma");
  });

  it("does not rewrite concrete Windows drive alias targets", () => {
    const aliasMap = {
      "C:": "/wrong",
      beta: "C:/repo/beta",
    };

    const alias = buildPluginLoaderJitiOptions(aliasMap).alias as Record<string, string>;

    expect(alias.beta).toBe("C:/repo/beta");
  });

  it("stops chained source-transform alias rewrites after reaching a Windows drive target", () => {
    const aliasMap = {
      beta: "C:/repo/beta",
      "C:": "/wrong",
      alpha: "beta/alpha",
    };

    const alias = buildPluginLoaderJitiOptions(aliasMap).alias as Record<string, string>;

    expect(alias.alpha).toBe("C:/repo/beta/alpha");
  });

  it("bounds cyclic source-transform alias targets", () => {
    const aliasMap = {
      alpha: "beta/a",
      beta: "alpha/b",
      gamma: "alpha/g",
    };

    const alias = buildPluginLoaderJitiOptions(aliasMap).alias as Record<string, string>;

    expect(expectDefined(alias.gamma, "alias.gamma test invariant").length).toBeLessThan(32);
  });

  it("does not attach an empty alias map", () => {
    expect(buildPluginLoaderJitiOptions({})).not.toHaveProperty("alias");
  });
});
/* oxlint-disable max-lines -- TODO: split this grandfathered oversized file. */
