fix(release): restore bundled plugin package validation (#130875)

* test(plugins): align Slack configured-state metadata

* fix(openshell): exclude test support from package

* test(release): record Daytona security finding

extensions/openshell/.npmignore

@@ -0,0 +1,12 @@
+.DS_Store
+dist/.boundary-tsc.tsbuildinfo
+**/*.map
+**/*.test.ts
+**/*.test.tsx
+**/*.spec.ts
+**/*.spec.tsx
+**/*.test-helpers.ts
+**/*.test-harness.ts
+**/*.test-support.ts
+src/test-*.ts
+src/test-support/

src/plugins/bundled-plugin-metadata.test.ts

@@ -503,6 +503,8 @@ describe("bundled plugin metadata", () => {
           env: {
             anyOf: ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_USER_TOKEN"],
           },
+          specifier: "./configured-state",
+          exportName: "hasConfiguredSlackChannelState",
         },
       },
       {

src/plugins/npm-install-security-scan.release.test.ts

@@ -29,6 +29,7 @@ const REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDING_COUNTS = new Map<string, nu
   ["@openclaw/acpx:dangerous-exec:src/runtime-internals/mcp-proxy.mjs", 1],
   ["@openclaw/codex:dangerous-exec:src/app-server/transport-stdio.ts", 1],
   ["@openclaw/codex:dangerous-exec:src/doctor.ts", 1],
+  ["@openclaw/daytona-sandbox:dangerous-exec:src/upload.ts", 1],
   ["@openclaw/discord:dangerous-exec:src/voice/audio.ts", 1],
   ["@openclaw/imessage:dangerous-exec:src/client.ts", 1],
   ["@openclaw/llama-cpp-provider:dangerous-exec:src/llama-server-install.ts", 1],