test: harden linux runtime smoke guards

extensions/line/index.test.ts

@@ -198,6 +198,7 @@ describe("line runtime api", () => {
           "probeLineBot",
           "pushMessageLine",
         ],
+        realPluginSdkSpecifiers: ["openclaw/plugin-sdk/line-runtime"],
       }),
     ).toEqual({
       buildTemplateMessageFromPayload: "function",

extensions/matrix/index.test.ts

@@ -25,6 +25,7 @@ describe("matrix plugin registration", () => {
           "requiresExplicitMatrixDefaultAccount",
           "resolveMatrixDefaultOrOnlyAccountId",
         ],
+        realPluginSdkSpecifiers: [],
       }),
     ).toEqual({
       requiresExplicitMatrixDefaultAccount: "function",
@@ -44,6 +45,7 @@ describe("matrix plugin registration", () => {
       loadRuntimeApiExportTypesViaJiti({
         modulePath: runtimeApiPath,
         exportNames: ["resolveMatrixAccountStringValues"],
+        realPluginSdkSpecifiers: ["openclaw/plugin-sdk/matrix"],
       }),
     ).toEqual({
       resolveMatrixAccountStringValues: "function",

src/infra/exec-command-resolution.test.ts

@@ -294,6 +294,7 @@ describe("exec-command-resolution", () => {
     const envPath = path.join(binDir, "env");
     const rgPath = path.join(binDir, "rg");
     const busybox = path.join(dir, "busybox");
+    const resolvedShPath = fs.realpathSync("/bin/sh");
     for (const file of [envPath, rgPath, busybox]) {
       fs.writeFileSync(file, "");
       fs.chmodSync(file, 0o755);
@@ -316,7 +317,7 @@ describe("exec-command-resolution", () => {
         env: { PATH: `${binDir}${path.delimiter}/bin:/usr/bin` },
         expectedExecutionPath: "/bin/sh",
         expectedPolicyPath: busybox,
-        expectedPlannedArgv: ["/bin/sh", "-lc", "echo hi"],
+        expectedPlannedArgv: [resolvedShPath, "-lc", "echo hi"],
         allowlistPattern: busybox,
         allowlistSatisfied: true,
       },

test/helpers/extensions/jiti-runtime-api.ts

@@ -127,11 +127,13 @@ function collectSourceModuleRefs(filePath: string): SourceModuleRef[] {
 function collectPluginSdkAliases(params: {
   modulePath: string;
   root: string;
+  realPluginSdkSpecifiers?: readonly string[];
 }): Record<string, string> {
   const realSpecifiers = new Set<string>();
   const stubSpecifiers = new Set<string>();
   const visitedFiles = new Set<string>();
   const stubPath = path.join(params.root, "test", "helpers", "extensions", "plugin-sdk-stub.cjs");
+  const explicitRealSpecifiers = new Set(params.realPluginSdkSpecifiers ?? []);
 
   function visitModule(filePath: string, rootModule: boolean): void {
     if (visitedFiles.has(filePath)) {
@@ -141,7 +143,11 @@ function collectPluginSdkAliases(params: {
 
     for (const ref of collectSourceModuleRefs(filePath)) {
       if (ref.specifier.startsWith(PLUGIN_SDK_SPECIFIER_PREFIX)) {
-        if (rootModule && !ref.typeOnly) {
+        const shouldKeepReal =
+          rootModule &&
+          !ref.typeOnly &&
+          (explicitRealSpecifiers.size === 0 || explicitRealSpecifiers.has(ref.specifier));
+        if (shouldKeepReal) {
           realSpecifiers.add(ref.specifier);
           const subpath = ref.specifier.slice(PLUGIN_SDK_SPECIFIER_PREFIX.length);
           const target = resolvePluginSdkAliasTarget(params.root, subpath);
@@ -188,10 +194,15 @@ export function loadRuntimeApiExportTypesViaJiti(params: {
   modulePath: string;
   exportNames: readonly string[];
   additionalAliases?: Record<string, string>;
+  realPluginSdkSpecifiers?: readonly string[];
 }): Record<string, string> {
   const root = process.cwd();
   const alias = {
-    ...collectPluginSdkAliases({ modulePath: params.modulePath, root }),
+    ...collectPluginSdkAliases({
+      modulePath: params.modulePath,
+      root,
+      realPluginSdkSpecifiers: params.realPluginSdkSpecifiers,
+    }),
     ...params.additionalAliases,
   };