fix(ci): refresh guardrails and config baselines

docs/.generated/config-baseline.channel.json

@@ -25115,6 +25115,16 @@
       "tags": [],
       "hasChildren": false
     },
+    {
+      "path": "channels.telegram.accounts.*.network.dangerouslyAllowPrivateNetwork",
+      "kind": "channel",
+      "type": "boolean",
+      "required": false,
+      "deprecated": false,
+      "sensitive": false,
+      "tags": [],
+      "hasChildren": false
+    },
     {
       "path": "channels.telegram.accounts.*.network.dnsResultOrder",
       "kind": "channel",
@@ -27319,6 +27329,24 @@
       "help": "Override Node autoSelectFamily for Telegram (true=enable, false=disable).",
       "hasChildren": false
     },
+    {
+      "path": "channels.telegram.network.dangerouslyAllowPrivateNetwork",
+      "kind": "channel",
+      "type": "boolean",
+      "required": false,
+      "deprecated": false,
+      "sensitive": false,
+      "tags": [
+        "access",
+        "advanced",
+        "channels",
+        "network",
+        "security"
+      ],
+      "label": "Telegram Dangerously Allow Private Network",
+      "help": "Dangerous opt-in for trusted fake-IP or transparent-proxy environments where Telegram media downloads resolve api.telegram.org to private/internal/special-use addresses.",
+      "hasChildren": false
+    },
     {
       "path": "channels.telegram.network.dnsResultOrder",
       "kind": "channel",

docs/plugins/architecture.md

@@ -197,10 +197,10 @@ plugins should import their own local runtime code directly from their
 extension-owned modules.
 
 The same boundary applies to provider-named SDK seams in general: core should
-not import `openclaw/plugin-sdk/slack`, `.../discord`, `.../signal`,
-`.../whatsapp`, or other channel-specific convenience barrels. If core needs a
-behavior, either consume the bundled plugin's own `api.ts` / `runtime-api.ts`
-barrel or promote the need into a narrow generic capability in the shared SDK.
+not import channel-specific convenience barrels for Slack, Discord, Signal,
+WhatsApp, or similar extensions. If core needs a behavior, either consume the
+bundled plugin's own `api.ts` / `runtime-api.ts` barrel or promote the need
+into a narrow generic capability in the shared SDK.
 
 For polls specifically, there are two execution paths:
 

src/config/schema.help.ts

@@ -748,7 +748,7 @@ export const FIELD_HELP: Record<string, string> = {
   "models.providers.*.authHeader":
     "When true, credentials are sent via the HTTP Authorization header even if alternate auth is possible. Use this only when your provider or proxy explicitly requires Authorization forwarding.",
   "models.providers.*.request":
-    "Optional request overrides for model-provider requests. Today this path supports header and auth overrides only; proxy and TLS transport settings are reserved for request paths that can carry them end to end.",
+    "Optional request overrides for model-provider requests. Use this only for header and auth overrides today; proxy and TLS transport settings are reserved for request paths that can carry them end to end.",
   "models.providers.*.request.headers":
     "Extra headers merged into provider requests after default attribution and auth resolution.",
   "models.providers.*.request.auth":

src/plugins/contracts/plugin-sdk-runtime-api-guardrails.test.ts

@@ -27,6 +27,7 @@ const RUNTIME_API_EXPORT_GUARDS: Record<string, readonly string[]> = {
     'export * from "./src/resolve-users.js";',
     'export * from "./src/outbound-session-route.js";',
     'export * from "./src/send.js";',
+    'export * from "./src/send.components.js";',
   ],
   [bundledPluginFile("imessage", "runtime-api.ts")]: [
     'export { DEFAULT_ACCOUNT_ID, buildChannelConfigSchema, getChatChannelMeta, type ChannelPlugin, type OpenClawConfig } from "openclaw/plugin-sdk/core";',