From 90322074ddb78c27ec00fcb444b21e5061583794 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Fri, 10 Jul 2026 09:41:01 -0700
Subject: [PATCH] fix(ci): validate Kova bin-only dependency (#103810)

---
 .github/workflows/openclaw-performance.yml    | 21 +++++++++++++++++--
 .../openclaw-performance-workflow.test.ts     |  8 +++++--
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/openclaw-performance.yml b/.github/workflows/openclaw-performance.yml
index ad04f96801fe..4dc8f3624362 100644
--- a/.github/workflows/openclaw-performance.yml
+++ b/.github/workflows/openclaw-performance.yml
@@ -288,10 +288,27 @@ jobs:
           git -C "$KOVA_SRC" checkout --detach FETCH_HEAD
           npm --prefix "$KOVA_SRC" ci --ignore-scripts --no-audit --no-fund
           node - "$KOVA_SRC" <<'NODE'
+          const fs = require("node:fs");
+          const path = require("node:path");
+
           const root = process.argv[2];
-          for (const dependency of ["mock-ai-provider", "zod"]) {
-            require.resolve(dependency, { paths: [root] });
+          const packageJsonPath = require.resolve("mock-ai-provider/package.json", {
+            paths: [root],
+          });
+          const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+          const bin =
+            typeof packageJson.bin === "string"
+              ? packageJson.bin
+              : packageJson.bin?.["mock-ai-provider"];
+          if (typeof bin !== "string" || bin.length === 0) {
+            throw new Error("mock-ai-provider does not declare its CLI entrypoint");
           }
+          fs.accessSync(path.resolve(path.dirname(packageJsonPath), bin), fs.constants.R_OK);
+          fs.accessSync(
+            path.join(root, "node_modules", ".bin", "mock-ai-provider"),
+            fs.constants.X_OK,
+          );
+          require.resolve("zod", { paths: [root] });
           NODE
           cat > "$HOME/.local/bin/kova" <<EOF
           #!/usr/bin/env bash
diff --git a/test/scripts/openclaw-performance-workflow.test.ts b/test/scripts/openclaw-performance-workflow.test.ts
index 45fa4abab731..3b6e5ec686c8 100644
--- a/test/scripts/openclaw-performance-workflow.test.ts
+++ b/test/scripts/openclaw-performance-workflow.test.ts
@@ -91,8 +91,12 @@ describe("OpenClaw performance workflow", () => {
     expect(installRun).toContain(
       'npm --prefix "$KOVA_SRC" ci --ignore-scripts --no-audit --no-fund',
     );
-    expect(installRun).toContain('for (const dependency of ["mock-ai-provider", "zod"])');
-    expect(installRun).toContain("require.resolve(dependency, { paths: [root] })");
+    expect(installRun).toContain('require.resolve("mock-ai-provider/package.json", {');
+    expect(installRun).toContain('packageJson.bin?.["mock-ai-provider"]');
+    expect(installRun).toContain('path.join(root, "node_modules", ".bin", "mock-ai-provider")');
+    expect(installRun).toContain("fs.constants.X_OK");
+    expect(installRun).toContain('require.resolve("zod", { paths: [root] })');
+    expect(installRun).not.toContain('require.resolve("mock-ai-provider",');
     expect(
       installRun.indexOf('npm --prefix "$KOVA_SRC" ci --ignore-scripts --no-audit --no-fund'),
     ).toBeLessThan(installRun.indexOf('cat > "$HOME/.local/bin/kova"'));