From 122649f2786aefb8d622c5e0992062db8b161159 Mon Sep 17 00:00:00 2001
From: Gustavo Madeira Santana <gumadeiras@gmail.com>
Date: Wed, 15 Apr 2026 12:49:44 -0400
Subject: [PATCH] perf: harden test cargo traversal checks

---
 scripts/openclaw-npm-release-check.ts         |  1 -
 scripts/stage-bundled-plugin-runtime-deps.mjs |  8 ++++----
 test/openclaw-npm-release-check.test.ts       | 13 +++++++++++++
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/scripts/openclaw-npm-release-check.ts b/scripts/openclaw-npm-release-check.ts
index f16563c3398..850b04a25f3 100644
--- a/scripts/openclaw-npm-release-check.ts
+++ b/scripts/openclaw-npm-release-check.ts
@@ -587,7 +587,6 @@ export function collectPackedTestCargoErrors(paths: Iterable<string>): string[]
   return errors.toSorted((left, right) => left.localeCompare(right));
 }
 
-async function main(): Promise<number> {
 async function main(): Promise<number> {
   const pkg = loadPackageJson();
   const now = new Date();
diff --git a/scripts/stage-bundled-plugin-runtime-deps.mjs b/scripts/stage-bundled-plugin-runtime-deps.mjs
index 8d44ad4be2b..d1ddf4c7635 100644
--- a/scripts/stage-bundled-plugin-runtime-deps.mjs
+++ b/scripts/stage-bundled-plugin-runtime-deps.mjs
@@ -478,8 +478,8 @@ function walkFiles(rootDir, visitFile) {
     return;
   }
   const queue = [rootDir];
-  while (queue.length > 0) {
-    const currentDir = queue.shift();
+  for (let index = 0; index < queue.length; index += 1) {
+    const currentDir = queue[index];
     for (const entry of fs.readdirSync(currentDir, { withFileTypes: true })) {
       const fullPath = path.join(currentDir, entry.name);
       if (entry.isDirectory()) {
@@ -522,8 +522,8 @@ function pruneDependencyDirectoriesByBasename(depRoot, basenames) {
   }
   const basenameSet = new Set(basenames);
   const queue = [depRoot];
-  while (queue.length > 0) {
-    const currentDir = queue.shift();
+  for (let index = 0; index < queue.length; index += 1) {
+    const currentDir = queue[index];
     for (const entry of fs.readdirSync(currentDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) {
         continue;
diff --git a/test/openclaw-npm-release-check.test.ts b/test/openclaw-npm-release-check.test.ts
index a89d33a410f..75c5a8748f5 100644
--- a/test/openclaw-npm-release-check.test.ts
+++ b/test/openclaw-npm-release-check.test.ts
@@ -415,6 +415,19 @@ describe("collectPackedTestCargoErrors", () => {
       ]),
     ).toEqual([]);
   });
+
+  it("normalizes Windows or mixed separators before classifying test cargo", () => {
+    expect(
+      collectPackedTestCargoErrors([
+        String.raw`dist\extensions\fixture-plugin\node_modules\direct\__tests__\index.js`,
+        String.raw`dist/extensions/fixture-plugin\node_modules/direct/src/runtime.spec.ts`,
+        String.raw`dist\extensions\fixture-plugin\node_modules\direct\node_modules\test\index.js`,
+      ]),
+    ).toEqual([
+      `npm package must not include test cargo "${String.raw`dist/extensions/fixture-plugin\node_modules/direct/src/runtime.spec.ts`}".`,
+      `npm package must not include test cargo "${String.raw`dist\extensions\fixture-plugin\node_modules\direct\__tests__\index.js`}".`,
+    ]);
+  });
 });
 
 describe("collectReleaseTagErrors", () => {