Summary

• Resolve bundled generated entries from dist-runtime/extensions before falling back to source paths when packaged dist artifacts are absent.
• Use the matched dist-runtime bundled channel root as the setup-entry module boundary root instead of falling back to source extensions.
• Preserve the existing openRootFileSync containment/alias check and add regressions for packaged setup-entry loading.
• Repair current-main session-store validation test fixtures that now require persisted entries to carry valid sessionId metadata.

Fixes #77805.

Tests

• CI=1 node scripts/run-vitest.mjs src/plugins/bundled-plugin-metadata.test.ts src/channels/plugins/bundled.shape-guard.test.ts src/channels/plugins/read-only.test.ts src/channels/plugins/bundled-root-caches.test.ts
• CI=1 node scripts/run-vitest.mjs src/gateway/server.sessions.create.test.ts src/commands/doctor-heartbeat-session-target.test.ts src/auto-reply/reply/session.test.ts -t "replaces a dead main entry|uses runtime session canonicalization|scoped WhatsApp group entry only contains activation state"
• CI=1 node scripts/run-vitest.mjs src/plugins/bundled-plugin-metadata.test.ts src/channels/plugins/bundled.shape-guard.test.ts src/channels/plugins/read-only.test.ts src/channels/plugins/bundled-root-caches.test.ts src/gateway/server.sessions.create.test.ts src/commands/doctor-heartbeat-session-target.test.ts src/auto-reply/reply/session.test.ts -t "dist-runtime|replaces a dead main entry|uses runtime session canonicalization|scoped WhatsApp group entry only contains activation state"
• pnpm exec oxfmt --check --threads=1 src/plugins/bundled-plugin-metadata.ts src/plugins/bundled-plugin-metadata.test.ts src/channels/plugins/bundled.ts src/channels/plugins/bundled.shape-guard.test.ts src/gateway/server.sessions.create.test.ts src/commands/doctor-heartbeat-session-target.test.ts src/auto-reply/reply/session.test.ts
• git diff --check
• pnpm check:changed

Real behavior proof

Behavior or issue addressed:
Packaged bundled channel setup entries can resolve to dist-runtime/extensions/<channel>/setup-entry.js, but the bundled channel loader only recognized override and dist/extensions roots before falling back to source extensions/<channel>. That made the unchanged fs-safe module open check reject the setup entry as outside the selected plugin root, producing plugin module path escapes plugin root or fails alias checks.

Real environment tested:
Ubuntu 24.04 WSL source checkout at /root/src/openclaw-branches/base on branch fix-telegram-setup-windows-77805, using focused source-level regressions that exercise the real bundled generated path resolver and the real bundled setup-entry load path with a temporary packaged dist-runtime/extensions/alpha/setup-entry.js module.

Exact steps or command run after this patch:

1. Reverted only the production resolver changes locally while keeping the new regressions, then ran CI=1 node scripts/run-vitest.mjs src/plugins/bundled-plugin-metadata.test.ts src/channels/plugins/bundled.shape-guard.test.ts -t "dist-runtime".
2. Re-applied this patch and ran the same command.
3. Ran the focused bundled channel/plugin tests, current-main session fixture repair tests, and changed-file gate listed above.

Evidence after fix:
Before the production fix, the new regressions failed:

before_status=1
bundled.shape-guard.test.ts > uses dist-runtime as the boundary root for packaged setup entries
AssertionError: expected undefined to be 'Setup dist-runtime'

bundled-plugin-metadata.test.ts > uses dist-runtime generated paths before source fallback when packaged dist is absent
AssertionError: expected .../extensions/plugin/index.ts to be .../dist-runtime/extensions/plugin/index.js

After this patch, the same regressions passed:

after_status=0
Test Files  2 passed (2)
Tests  2 passed | 51 skipped (53)

Observed result after fix:
The generated setup-entry path resolves from dist-runtime/extensions, and the bundled channel setup loader checks that module against the matching dist-runtime/extensions/<channel> boundary root. The existing fs-safe openRootFileSync containment/alias validation remains the final enforcement point.

What was not tested:
No native Windows host was available in this run. AWS Crabbox proof was attempted but blocked by Crabbox infrastructure before command execution: one script transport exited 127, one lease never bootstrapped SSH, and one lease lost SSH after sync. The source proof targets the reported packaged-root mismatch without relaxing the security boundary.