From c720fa83bbe44d12ffe39533cfcfa18b3602b71c Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 27 Mar 2026 23:20:24 +0000
Subject: [PATCH] fix(browser): narrow browser support facades

---
 extensions/browser/src/cli/command-format.ts        |  2 +-
 extensions/browser/src/config/config.ts             | 10 +++++++++-
 extensions/browser/src/config/paths.ts              |  2 +-
 extensions/browser/src/config/port-defaults.ts      |  6 +++++-
 extensions/browser/src/gateway/auth.ts              |  2 +-
 extensions/browser/src/gateway/net.ts               |  2 +-
 extensions/browser/src/gateway/startup-auth.ts      |  2 +-
 extensions/browser/src/infra/errors.ts              |  2 +-
 extensions/browser/src/infra/fs-safe.ts             |  6 +++++-
 extensions/browser/src/infra/net/proxy-env.ts       |  2 +-
 extensions/browser/src/infra/net/ssrf.ts            |  8 +++++++-
 extensions/browser/src/infra/path-guards.ts         |  2 +-
 extensions/browser/src/infra/ports.ts               |  2 +-
 extensions/browser/src/infra/secure-random.ts       |  2 +-
 extensions/browser/src/infra/tmp-openclaw-dir.ts    |  2 +-
 extensions/browser/src/infra/ws.ts                  |  2 +-
 extensions/browser/src/logging/redact.ts            |  2 +-
 extensions/browser/src/logging/subsystem.ts         |  2 +-
 extensions/browser/src/media/image-ops.ts           |  7 ++++++-
 extensions/browser/src/media/store.ts               |  2 +-
 extensions/browser/src/process/exec.ts              |  2 +-
 extensions/browser/src/security/secret-equal.ts     |  2 +-
 extensions/browser/src/test-utils/fetch-mock.ts     |  2 +-
 extensions/browser/src/test-utils/vitest-mock-fn.ts |  2 +-
 extensions/browser/src/utils.ts                     |  7 ++++++-
 extensions/browser/src/utils/boolean.ts             |  2 +-
 26 files changed, 58 insertions(+), 26 deletions(-)

diff --git a/extensions/browser/src/cli/command-format.ts b/extensions/browser/src/cli/command-format.ts
index 700c049c4f3..2d7bf3db038 100644
--- a/extensions/browser/src/cli/command-format.ts
+++ b/extensions/browser/src/cli/command-format.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { formatCliCommand } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/config/config.ts b/extensions/browser/src/config/config.ts
index 700c049c4f3..a8aef77abdf 100644
--- a/extensions/browser/src/config/config.ts
+++ b/extensions/browser/src/config/config.ts
@@ -1 +1,9 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export {
+  createConfigIO,
+  getRuntimeConfigSnapshot,
+  loadConfig,
+  writeConfigFile,
+  type BrowserConfig,
+  type BrowserProfileConfig,
+  type OpenClawConfig,
+} from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/config/paths.ts b/extensions/browser/src/config/paths.ts
index 700c049c4f3..b515dd9f3a1 100644
--- a/extensions/browser/src/config/paths.ts
+++ b/extensions/browser/src/config/paths.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { resolveGatewayPort } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/config/port-defaults.ts b/extensions/browser/src/config/port-defaults.ts
index 700c049c4f3..46865789aa5 100644
--- a/extensions/browser/src/config/port-defaults.ts
+++ b/extensions/browser/src/config/port-defaults.ts
@@ -1 +1,5 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export {
+  DEFAULT_BROWSER_CONTROL_PORT,
+  deriveDefaultBrowserCdpPortRange,
+  deriveDefaultBrowserControlPort,
+} from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/gateway/auth.ts b/extensions/browser/src/gateway/auth.ts
index 700c049c4f3..ed61f80abd3 100644
--- a/extensions/browser/src/gateway/auth.ts
+++ b/extensions/browser/src/gateway/auth.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { resolveGatewayAuth } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/gateway/net.ts b/extensions/browser/src/gateway/net.ts
index 700c049c4f3..6e07db3fb9e 100644
--- a/extensions/browser/src/gateway/net.ts
+++ b/extensions/browser/src/gateway/net.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { isLoopbackHost } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/gateway/startup-auth.ts b/extensions/browser/src/gateway/startup-auth.ts
index 700c049c4f3..dc462888141 100644
--- a/extensions/browser/src/gateway/startup-auth.ts
+++ b/extensions/browser/src/gateway/startup-auth.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { ensureGatewayStartupAuth } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/infra/errors.ts b/extensions/browser/src/infra/errors.ts
index 700c049c4f3..15fce0169d2 100644
--- a/extensions/browser/src/infra/errors.ts
+++ b/extensions/browser/src/infra/errors.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { extractErrorCode, formatErrorMessage } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/infra/fs-safe.ts b/extensions/browser/src/infra/fs-safe.ts
index 700c049c4f3..c77358ae4b3 100644
--- a/extensions/browser/src/infra/fs-safe.ts
+++ b/extensions/browser/src/infra/fs-safe.ts
@@ -1 +1,5 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export {
+  SafeOpenError,
+  openFileWithinRoot,
+  writeFileFromPathWithinRoot,
+} from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/infra/net/proxy-env.ts b/extensions/browser/src/infra/net/proxy-env.ts
index 700c049c4f3..8324366349b 100644
--- a/extensions/browser/src/infra/net/proxy-env.ts
+++ b/extensions/browser/src/infra/net/proxy-env.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { hasProxyEnvConfigured } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/infra/net/ssrf.ts b/extensions/browser/src/infra/net/ssrf.ts
index 700c049c4f3..18ea2fce3d6 100644
--- a/extensions/browser/src/infra/net/ssrf.ts
+++ b/extensions/browser/src/infra/net/ssrf.ts
@@ -1 +1,7 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export {
+  SsrFBlockedError,
+  isPrivateNetworkAllowedByPolicy,
+  resolvePinnedHostnameWithPolicy,
+  type LookupFn,
+  type SsrFPolicy,
+} from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/infra/path-guards.ts b/extensions/browser/src/infra/path-guards.ts
index 700c049c4f3..f3737ae6404 100644
--- a/extensions/browser/src/infra/path-guards.ts
+++ b/extensions/browser/src/infra/path-guards.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { isNotFoundPathError, isPathInside } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/infra/ports.ts b/extensions/browser/src/infra/ports.ts
index 700c049c4f3..cf70623efe7 100644
--- a/extensions/browser/src/infra/ports.ts
+++ b/extensions/browser/src/infra/ports.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { ensurePortAvailable } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/infra/secure-random.ts b/extensions/browser/src/infra/secure-random.ts
index 700c049c4f3..4d3560ebcf4 100644
--- a/extensions/browser/src/infra/secure-random.ts
+++ b/extensions/browser/src/infra/secure-random.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { generateSecureToken } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/infra/tmp-openclaw-dir.ts b/extensions/browser/src/infra/tmp-openclaw-dir.ts
index 700c049c4f3..7eca68ee246 100644
--- a/extensions/browser/src/infra/tmp-openclaw-dir.ts
+++ b/extensions/browser/src/infra/tmp-openclaw-dir.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/infra/ws.ts b/extensions/browser/src/infra/ws.ts
index 700c049c4f3..88260e334f8 100644
--- a/extensions/browser/src/infra/ws.ts
+++ b/extensions/browser/src/infra/ws.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { rawDataToString } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/logging/redact.ts b/extensions/browser/src/logging/redact.ts
index 700c049c4f3..effad7efd94 100644
--- a/extensions/browser/src/logging/redact.ts
+++ b/extensions/browser/src/logging/redact.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { redactSensitiveText } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/logging/subsystem.ts b/extensions/browser/src/logging/subsystem.ts
index 700c049c4f3..b2866e39c7c 100644
--- a/extensions/browser/src/logging/subsystem.ts
+++ b/extensions/browser/src/logging/subsystem.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { createSubsystemLogger } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/media/image-ops.ts b/extensions/browser/src/media/image-ops.ts
index 700c049c4f3..f4247cdc496 100644
--- a/extensions/browser/src/media/image-ops.ts
+++ b/extensions/browser/src/media/image-ops.ts
@@ -1 +1,6 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export {
+  IMAGE_REDUCE_QUALITY_STEPS,
+  buildImageResizeSideGrid,
+  getImageMetadata,
+  resizeToJpeg,
+} from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/media/store.ts b/extensions/browser/src/media/store.ts
index 700c049c4f3..c7ec4ebf13f 100644
--- a/extensions/browser/src/media/store.ts
+++ b/extensions/browser/src/media/store.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { ensureMediaDir, saveMediaBuffer } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/process/exec.ts b/extensions/browser/src/process/exec.ts
index 700c049c4f3..84b2a492a18 100644
--- a/extensions/browser/src/process/exec.ts
+++ b/extensions/browser/src/process/exec.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { runExec } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/security/secret-equal.ts b/extensions/browser/src/security/secret-equal.ts
index 700c049c4f3..a6a2aa9c8fa 100644
--- a/extensions/browser/src/security/secret-equal.ts
+++ b/extensions/browser/src/security/secret-equal.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { safeEqualSecret } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/test-utils/fetch-mock.ts b/extensions/browser/src/test-utils/fetch-mock.ts
index 700c049c4f3..33c7124abdd 100644
--- a/extensions/browser/src/test-utils/fetch-mock.ts
+++ b/extensions/browser/src/test-utils/fetch-mock.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { withFetchPreconnect } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/test-utils/vitest-mock-fn.ts b/extensions/browser/src/test-utils/vitest-mock-fn.ts
index 700c049c4f3..4c79976b04a 100644
--- a/extensions/browser/src/test-utils/vitest-mock-fn.ts
+++ b/extensions/browser/src/test-utils/vitest-mock-fn.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export type { MockFn } from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/utils.ts b/extensions/browser/src/utils.ts
index 700c049c4f3..83ce3a3fab0 100644
--- a/extensions/browser/src/utils.ts
+++ b/extensions/browser/src/utils.ts
@@ -1 +1,6 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export {
+  CONFIG_DIR,
+  escapeRegExp,
+  resolveUserPath,
+  shortenHomePath,
+} from "openclaw/plugin-sdk/browser-support";
diff --git a/extensions/browser/src/utils/boolean.ts b/extensions/browser/src/utils/boolean.ts
index 700c049c4f3..8256a6e21d0 100644
--- a/extensions/browser/src/utils/boolean.ts
+++ b/extensions/browser/src/utils/boolean.ts
@@ -1 +1 @@
-export * from "openclaw/plugin-sdk/browser-support";
+export { parseBooleanValue } from "openclaw/plugin-sdk/browser-support";