Fix sdk root imports in file-secrets and keychain plugins

[RhysSullivan]

Fixes #1833

plugin-file-secrets and plugin-keychain imported StorageError, definePlugin, PluginCtx, and Plugin from the @executor-js/sdk root. In the workspace, the root and /core both resolve to src/index.ts, so everything worked in-repo. The published root is the Promise surface (dist/index.js), which does not export those symbols, so both packages failed to load when installed from npm.

Change

• Import the plugin-authoring symbols from @executor-js/sdk/core, the same way plugin-onepassword does. This covers all five affected files; ProviderKey, ProviderItemId, and CredentialProvider move with them since /core exports the full Effect surface.
• Harden scripts/smoke-test-packed.ts: a does not provide an export named failure is now a hard FAIL. It was previously downgraded to a skip, which is how this shipped past the release smoke gate.

A browser e2e is meaningless for a packaging bug — nothing user-visible changes in the app. The repro below is at the published surface, the way an npm consumer resolves the packages.

Red (before the fix)

Packed all public packages via publish-packages.ts --dry-run, installed the two plugin tarballs into a fresh fixture with npm overrides pinning every @executor-js/* dep to its local tarball, then imported with node:

== import plugin-file-secrets
SyntaxError: The requested module '@executor-js/sdk' does not provide an export named 'StorageError'
== import plugin-keychain
SyntaxError: The requested module '@executor-js/sdk' does not provide an export named 'StorageError'

Green (after the fix)

Same pack-and-install fixture:

== import plugin-file-secrets
OK exports: fileSecretsPlugin
== import plugin-keychain
OK exports: keychainPlugin
== import /core subpaths
OK core subpaths

Gates: format:check, lint, typecheck, and package tests for both plugins (18 + 3) all pass.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	607a1df	Commit Preview URL Branch Preview URL	Aug 29 2026, 06:45 AM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	607a1df	Aug 29 2026, 06:47 AM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1838

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1838

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1838

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1838

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1838

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1838

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1838

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1838

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1838

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1838

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1838

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1838

executor

npm i https://pkg.pr.new/executor@1838

commit: 607a1df