fix(plugin-sdk): scope facade verifier artifact scan

zhangguiping-xydt · zhangguiping-xydt · commit 2a2cd2042ea6 · 2026-06-04T00:13:00.000+08:00
diff --git a/scripts/openclaw-npm-postpublish-verify.ts b/scripts/openclaw-npm-postpublish-verify.ts
@@ -61,6 +61,8 @@ const MAX_INSTALLED_ROOT_PACKAGE_JSON_BYTES = 1024 * 1024;
 const MAX_INSTALLED_ROOT_DIST_JS_BYTES = 6 * 1024 * 1024;
 const MAX_INSTALLED_ROOT_DIST_JS_FILES = 5000;
 const ROOT_DIST_JAVASCRIPT_MODULE_FILE_RE = /\.(?:c|m)?js$/u;
+const INSTALLED_FACADE_ACTIVATION_RUNTIME_RELATIVE_PATH_RE =
+  /^facade-activation-check\.runtime\.(?:c|m)?js$/u;
 const OPTIONAL_OR_EXTERNALIZED_RUNTIME_IMPORTS = new Set([
   // Optional A2UI markdown renderer. The Canvas host bundle catches the missing
   // package and falls back when the optional renderer is unavailable.
@@ -350,6 +352,15 @@ function listInstalledRootDistJavaScriptFiles(packageRoot: string): string[] {
   });
 }
 
+function listInstalledFacadeActivationRuntimeFiles(packageRoot: string): string[] {
+  const distRoot = join(packageRoot, "dist");
+  return listInstalledRootDistJavaScriptFiles(packageRoot).filter((filePath) =>
+    INSTALLED_FACADE_ACTIVATION_RUNTIME_RELATIVE_PATH_RE.test(
+      relative(distRoot, filePath).replaceAll("\\", "/"),
+    ),
+  );
+}
+
 type ParsedImportSpecifiersResult =
   | { ok: true; specifiers: Set<string> }
   | { ok: false; error: string };
@@ -525,7 +536,7 @@ function isSafeBundledRuntimeFacadeDirName(value: string): boolean {
 
 export function collectInstalledAlwaysAllowedRuntimeFacadeErrors(packageRoot: string): string[] {
   const errors: string[] = [];
-  for (const filePath of listInstalledRootDistJavaScriptFiles(packageRoot)) {
+  for (const filePath of listInstalledFacadeActivationRuntimeFiles(packageRoot)) {
     const fileStat = lstatSync(filePath);
     const relativePath = relative(packageRoot, filePath).replaceAll("\\", "/");
     if (!fileStat.isFile() || fileStat.size > MAX_INSTALLED_ROOT_DIST_JS_BYTES) {
diff --git a/test/openclaw-npm-postpublish-verify.test.ts b/test/openclaw-npm-postpublish-verify.test.ts
@@ -163,6 +163,18 @@ describe("collectInstalledAlwaysAllowedRuntimeFacadeErrors", () => {
       expect(collectInstalledAlwaysAllowedRuntimeFacadeErrors(packageRoot)).toStrictEqual([]);
     });
   });
+
+  it("ignores oversized non-facade root dist files", () => {
+    withInstalledPackageRoot((packageRoot) => {
+      writeInstalledFile(
+        packageRoot,
+        "dist/typescript-compiler.js",
+        "x".repeat(6 * 1024 * 1024 + 1),
+      );
+
+      expect(collectInstalledAlwaysAllowedRuntimeFacadeErrors(packageRoot)).toStrictEqual([]);
+    });
+  });
 });
 
 describe("collectInstalledContextEngineRuntimeErrors", () => {
