From 82a16d2feed484bd3779a35fc80d3ba4a3f66fdd Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 29 May 2026 10:47:20 +0100
Subject: [PATCH] fix: alias net policy in plugin loader

---
 src/plugins/sdk-alias.test.ts | 33 ++++++++++++++++++++++++++++--
 src/plugins/sdk-alias.ts      | 38 +++++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/src/plugins/sdk-alias.test.ts b/src/plugins/sdk-alias.test.ts
index 99e76820b60..fe8d129f7fe 100644
--- a/src/plugins/sdk-alias.test.ts
+++ b/src/plugins/sdk-alias.test.ts
@@ -1346,7 +1346,7 @@ describe("plugin sdk alias helpers", () => {
     });
   });
 
-  it("aliases gateway workspace packages to source when dist artifacts are missing", () => {
+  it("aliases workspace packages to source when dist artifacts are missing", () => {
     const fixture = createPluginSdkAliasFixture();
     const gatewayClient = writeWorkspacePackageEntry({
       root: fixture.root,
@@ -1372,10 +1372,24 @@ describe("plugin sdk alias helpers", () => {
       srcFile: "schema.ts",
       distFile: "schema.mjs",
     });
+    const netPolicy = writeWorkspacePackageEntry({
+      root: fixture.root,
+      packageDir: "net-policy",
+      srcFile: "index.ts",
+      distFile: "index.mjs",
+    });
+    const netPolicyIp = writeWorkspacePackageEntry({
+      root: fixture.root,
+      packageDir: "net-policy",
+      srcFile: "ip.ts",
+      distFile: "ip.mjs",
+    });
     fs.rmSync(gatewayClient.distFile);
     fs.rmSync(gatewayClientTimeouts.distFile);
     fs.rmSync(gatewayProtocol.distFile);
     fs.rmSync(gatewayProtocolSchema.distFile);
+    fs.rmSync(netPolicy.distFile);
+    fs.rmSync(netPolicyIp.distFile);
     const sourcePluginEntry = writePluginEntry(
       fixture.root,
       bundledPluginFile("demo", "src/index.ts"),
@@ -1397,9 +1411,15 @@ describe("plugin sdk alias helpers", () => {
     expect(fs.realpathSync(aliases["@openclaw/gateway-protocol/schema"] ?? "")).toBe(
       fs.realpathSync(gatewayProtocolSchema.srcFile),
     );
+    expect(fs.realpathSync(aliases["@openclaw/net-policy"] ?? "")).toBe(
+      fs.realpathSync(netPolicy.srcFile),
+    );
+    expect(fs.realpathSync(aliases["@openclaw/net-policy/ip"] ?? "")).toBe(
+      fs.realpathSync(netPolicyIp.srcFile),
+    );
   });
 
-  it("aliases gateway workspace package subpaths to dist when available", () => {
+  it("aliases workspace package subpaths to dist when available", () => {
     const fixture = createPluginSdkAliasFixture();
     const gatewayClient = writeWorkspacePackageEntry({
       root: fixture.root,
@@ -1413,6 +1433,12 @@ describe("plugin sdk alias helpers", () => {
       srcFile: "connect-error-details.ts",
       distFile: "connect-error-details.mjs",
     });
+    const netPolicy = writeWorkspacePackageEntry({
+      root: fixture.root,
+      packageDir: "net-policy",
+      srcFile: "redact-sensitive-url.ts",
+      distFile: "redact-sensitive-url.mjs",
+    });
     const sourcePluginEntry = writePluginEntry(
       fixture.root,
       bundledPluginFile("demo", "src/index.ts"),
@@ -1428,6 +1454,9 @@ describe("plugin sdk alias helpers", () => {
     expect(fs.realpathSync(aliases["@openclaw/gateway-protocol/connect-error-details"] ?? "")).toBe(
       fs.realpathSync(gatewayProtocol.distFile),
     );
+    expect(fs.realpathSync(aliases["@openclaw/net-policy/redact-sensitive-url"] ?? "")).toBe(
+      fs.realpathSync(netPolicy.distFile),
+    );
   });
 
   it("aliases bundled plugin package public surfaces for source plugin transforms", () => {
diff --git a/src/plugins/sdk-alias.ts b/src/plugins/sdk-alias.ts
index d377ad75daa..e6ef21ce31f 100644
--- a/src/plugins/sdk-alias.ts
+++ b/src/plugins/sdk-alias.ts
@@ -493,6 +493,9 @@ const PLUGIN_SDK_SOURCE_CANDIDATE_EXTENSIONS = [
 const BUNDLED_PLUGIN_PUBLIC_SURFACE_SOURCE_PATTERN = /^(?:api|runtime-api|test-api|.+-api)$/u;
 const JS_STATIC_RELATIVE_DEPENDENCY_PATTERN =
   /(?:\bfrom\s*["']|\bimport\s*\(\s*["']|\brequire\s*\(\s*["'])(\.{1,2}\/[^"']+)["']/g;
+// Jiti-loaded plugin code runs outside the Vitest/tsgo resolver, so every
+// workspace package import reachable from plugin SDK barrels needs an explicit
+// source/dist alias here to keep source checkouts and packaged builds aligned.
 const WORKSPACE_PACKAGE_ALIAS_ENTRIES = [
   {
     packageName: "@openclaw/gateway-client",
@@ -557,6 +560,41 @@ const WORKSPACE_PACKAGE_ALIAS_ENTRIES = [
     srcFile: "version.ts",
     distFile: "version.mjs",
   },
+  {
+    packageName: "@openclaw/net-policy",
+    packageDir: "net-policy",
+    subpath: "",
+    srcFile: "index.ts",
+    distFile: "index.mjs",
+  },
+  {
+    packageName: "@openclaw/net-policy",
+    packageDir: "net-policy",
+    subpath: "ip",
+    srcFile: "ip.ts",
+    distFile: "ip.mjs",
+  },
+  {
+    packageName: "@openclaw/net-policy",
+    packageDir: "net-policy",
+    subpath: "ipv4",
+    srcFile: "ipv4.ts",
+    distFile: "ipv4.mjs",
+  },
+  {
+    packageName: "@openclaw/net-policy",
+    packageDir: "net-policy",
+    subpath: "redact-sensitive-url",
+    srcFile: "redact-sensitive-url.ts",
+    distFile: "redact-sensitive-url.mjs",
+  },
+  {
+    packageName: "@openclaw/net-policy",
+    packageDir: "net-policy",
+    subpath: "url-userinfo",
+    srcFile: "url-userinfo.ts",
+    distFile: "url-userinfo.mjs",
+  },
 ] as const;
 
 function isUsableDistPluginSdkArtifact(candidate: string): boolean {