From 30073feb6fcfe38a5451bfe829caf57d3a5cc009 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Tue, 14 Apr 2026 17:51:06 +0100
Subject: [PATCH] fix(matrix): sort safe wrapper sdk subpaths

---
 extensions/matrix/src/plugin-entry.runtime.js |  4 +-
 .../matrix/src/plugin-entry.runtime.test.ts   | 50 ++++++++++++++++++-
 2 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/extensions/matrix/src/plugin-entry.runtime.js b/extensions/matrix/src/plugin-entry.runtime.js
index 7aecd4d1288..4a0eba6ebf6 100644
--- a/extensions/matrix/src/plugin-entry.runtime.js
+++ b/extensions/matrix/src/plugin-entry.runtime.js
@@ -83,12 +83,12 @@ function buildPluginSdkAliasMap(moduleUrl) {
     }
   }
 
-  for (const exportKey of Object.keys(packageJson.exports ?? {})) {
+  for (const exportKey of Object.keys(packageJson.exports ?? {}).toSorted()) {
     if (!exportKey.startsWith(PLUGIN_SDK_EXPORT_PREFIX)) {
       continue;
     }
     const subpath = exportKey.slice(PLUGIN_SDK_EXPORT_PREFIX.length);
-    if (!subpath) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(subpath)) {
       continue;
     }
     const resolvedPath =
diff --git a/extensions/matrix/src/plugin-entry.runtime.test.ts b/extensions/matrix/src/plugin-entry.runtime.test.ts
index 3c2304a7074..0739a560308 100644
--- a/extensions/matrix/src/plugin-entry.runtime.test.ts
+++ b/extensions/matrix/src/plugin-entry.runtime.test.ts
@@ -80,7 +80,7 @@ function writeOpenClawPackageFixture(fixtureRoot: string) {
   writeFixtureFile(fixtureRoot, "dist/plugin-sdk/index.js", "export {};\n");
 }
 
-function writeOpenClawAliasFixture(fixtureRoot: string) {
+function writeOpenClawAliasFixture(fixtureRoot: string, extraExports?: Record<string, string>) {
   writeFixtureFile(
     fixtureRoot,
     "package.json",
@@ -91,6 +91,7 @@ function writeOpenClawAliasFixture(fixtureRoot: string) {
         exports: {
           "./plugin-sdk": "./dist/plugin-sdk/index.js",
           "./plugin-sdk/group-access": "./dist/plugin-sdk/group-access.js",
+          ...extraExports,
         },
       },
       null,
@@ -214,3 +215,50 @@ it("builds scoped and unscoped plugin-sdk aliases for the wrapper jiti loader",
     },
   });
 }, 240_000);
+
+it("keeps wrapper plugin-sdk aliases deterministic and ignores unsafe subpaths", async () => {
+  const fixtureRoot = makeFixtureRoot(".tmp-matrix-runtime-alias-order-");
+  const wrapperSource = fs.readFileSync(
+    path.join(REPO_ROOT, "extensions", "matrix", "src", "plugin-entry.runtime.js"),
+    "utf8",
+  );
+
+  delete matrixWrapperGlobal.__openclawMatrixWrapperJitiOptions;
+  writeOpenClawAliasFixture(fixtureRoot, {
+    "./plugin-sdk/zeta": "./dist/plugin-sdk/zeta.js",
+    "./plugin-sdk/../escape": "./dist/plugin-sdk/escape.js",
+    "./plugin-sdk/alpha": "./dist/plugin-sdk/alpha.js",
+  });
+  writeFixtureFile(fixtureRoot, "src/plugin-sdk/alpha.ts", "export {};\n");
+  writeFixtureFile(fixtureRoot, "src/plugin-sdk/zeta.ts", "export {};\n");
+  writeCapturingJitiFixture(fixtureRoot);
+  writeFixtureFile(fixtureRoot, "extensions/matrix/src/plugin-entry.runtime.js", wrapperSource);
+  writeFixtureFile(
+    fixtureRoot,
+    "extensions/matrix/plugin-entry.handlers.runtime.js",
+    PACKAGED_RUNTIME_STUB,
+  );
+
+  const wrapperUrl = pathToFileURL(
+    path.join(fixtureRoot, "extensions", "matrix", "src", "plugin-entry.runtime.js"),
+  );
+  await import(`${wrapperUrl.href}?t=${Date.now()}`);
+
+  const aliasKeys = Object.keys(
+    (
+      (matrixWrapperGlobal.__openclawMatrixWrapperJitiOptions ?? {}) as {
+        alias?: Record<string, string>;
+      }
+    ).alias ?? {},
+  );
+  expect(aliasKeys).toEqual([
+    "openclaw/plugin-sdk",
+    "@openclaw/plugin-sdk",
+    "openclaw/plugin-sdk/alpha",
+    "@openclaw/plugin-sdk/alpha",
+    "openclaw/plugin-sdk/group-access",
+    "@openclaw/plugin-sdk/group-access",
+    "openclaw/plugin-sdk/zeta",
+    "@openclaw/plugin-sdk/zeta",
+  ]);
+}, 240_000);