@@ -30,7 +30,6 @@ const REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDINGS = new Set([
3030"@openclaw/google-meet:dangerous-exec:src/node-host.ts",
3131"@openclaw/google-meet:dangerous-exec:src/realtime.ts",
3232"@openclaw/matrix:dangerous-exec:src/matrix/deps.ts",
33-"@openclaw/slack:dynamic-code-execution:dist/outbound-payload.test-harness-<hash>.js",
3433"@openclaw/voice-call:dangerous-exec:src/tunnel.ts",
3534"@openclaw/voice-call:dangerous-exec:src/webhook/tailscale.ts",
3635]);
@@ -40,6 +39,7 @@ const OPTIONAL_REVIEWED_PUBLISHABLE_DIST_CRITICAL_FINDINGS = new Set([
4039"@openclaw/acpx:dangerous-exec:dist/service-<hash>.js",
4140"@openclaw/codex:dangerous-exec:dist/client-<hash>.js",
4241"@openclaw/google-meet:dangerous-exec:dist/index.js",
42+"@openclaw/slack:dynamic-code-execution:dist/outbound-payload.test-harness-<hash>.js",
4343"@openclaw/voice-call:dangerous-exec:dist/runtime-entry-<hash>.js",
4444]);
4545@@ -99,6 +99,16 @@ function normalizePackedFindingPath(packedPath: string): string {
9999return packedPath;
100100}
101101102+function expectedOptionalReviewedFindingsForPackedPath(
103+packageName: string,
104+packedPath: string,
105+): string[] {
106+const normalizedPath = normalizePackedFindingPath(packedPath);
107+return [...OPTIONAL_REVIEWED_PUBLISHABLE_DIST_CRITICAL_FINDINGS].filter(
108+(key) => key.startsWith(`${packageName}:`) && key.endsWith(`:${normalizedPath}`),
109+);
110+}
111+102112function stageScannerRelevantPackedFiles(
103113packageDir: string,
104114packedFiles: readonly string[],
@@ -182,8 +192,10 @@ async function scanPublishablePluginPackage(plugin: PublishablePluginPackage): P
182192const unexpectedCriticalFindings: string[] = [];
183193const packedFiles = await collectNpmPackedFiles(plugin.packageDir, plugin.packageName);
184194for (const packedFile of packedFiles) {
185-const key = `${plugin.packageName}:dangerous-exec:${normalizePackedFindingPath(packedFile)}`;
186-if (OPTIONAL_REVIEWED_PUBLISHABLE_DIST_CRITICAL_FINDINGS.has(key)) {
195+for (const key of expectedOptionalReviewedFindingsForPackedPath(
196+plugin.packageName,
197+packedFile,
198+)) {
187199expectedReviewedCriticalFindings.push(key);
188200}
189201}
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。