From a4ef5726cc650af78b86d8504c9f659162e19907 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Thu, 27 Aug 2026 19:32:29 +0800
Subject: [PATCH] fix(release): restore bundled plugin package validation
 (#130875)

* test(plugins): align Slack configured-state metadata

* fix(openshell): exclude test support from package

* test(release): record Daytona security finding
---
 extensions/openshell/.npmignore                      | 12 ++++++++++++
 src/plugins/bundled-plugin-metadata.test.ts          |  2 ++
 .../npm-install-security-scan.release.test.ts        |  1 +
 3 files changed, 15 insertions(+)
 create mode 100644 extensions/openshell/.npmignore

diff --git a/extensions/openshell/.npmignore b/extensions/openshell/.npmignore
new file mode 100644
index 000000000000..0d2ed77c73e1
--- /dev/null
+++ b/extensions/openshell/.npmignore
@@ -0,0 +1,12 @@
+.DS_Store
+dist/.boundary-tsc.tsbuildinfo
+**/*.map
+**/*.test.ts
+**/*.test.tsx
+**/*.spec.ts
+**/*.spec.tsx
+**/*.test-helpers.ts
+**/*.test-harness.ts
+**/*.test-support.ts
+src/test-*.ts
+src/test-support/
diff --git a/src/plugins/bundled-plugin-metadata.test.ts b/src/plugins/bundled-plugin-metadata.test.ts
index 2d02612b56e9..414a0147bc26 100644
--- a/src/plugins/bundled-plugin-metadata.test.ts
+++ b/src/plugins/bundled-plugin-metadata.test.ts
@@ -503,6 +503,8 @@ describe("bundled plugin metadata", () => {
           env: {
             anyOf: ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_USER_TOKEN"],
           },
+          specifier: "./configured-state",
+          exportName: "hasConfiguredSlackChannelState",
         },
       },
       {
diff --git a/src/plugins/npm-install-security-scan.release.test.ts b/src/plugins/npm-install-security-scan.release.test.ts
index 3b9a40880094..1c5b2a487d4b 100644
--- a/src/plugins/npm-install-security-scan.release.test.ts
+++ b/src/plugins/npm-install-security-scan.release.test.ts
@@ -29,6 +29,7 @@ const REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDING_COUNTS = new Map<string, nu
   ["@openclaw/acpx:dangerous-exec:src/runtime-internals/mcp-proxy.mjs", 1],
   ["@openclaw/codex:dangerous-exec:src/app-server/transport-stdio.ts", 1],
   ["@openclaw/codex:dangerous-exec:src/doctor.ts", 1],
+  ["@openclaw/daytona-sandbox:dangerous-exec:src/upload.ts", 1],
   ["@openclaw/discord:dangerous-exec:src/voice/audio.ts", 1],
   ["@openclaw/imessage:dangerous-exec:src/client.ts", 1],
   ["@openclaw/llama-cpp-provider:dangerous-exec:src/llama-server-install.ts", 1],