test(e2e): resolve Slack proof workspace through the real OpenClaw root

[AzeelSajjad]

Outcome

The Slack installed-runtime proof now resolves the OpenClaw package root to its real path, so the proof workspace links the OpenClaw install root's hoisted production dependencies. Before, the workspace was built from a symlink parent that held only openclaw and mcporter, so fast-uri never reached it and Slack startup failed with Cannot find module 'fast-uri' before any provider behavior could be validated.

Reason

Messaging providers fails the Slack case on main. The published dependency closure is not incomplete: test/agents/openclaw/openclaw-locked-install.test.ts already verifies all 307 resolved specs including fast-uri@3.1.6. The failure is a hoisting assumption in the E2E proof workspace.

PR #10892 relocated fast-uri in agents/openclaw/openclaw-runtime/package-lock.json:

- node_modules/openclaw/node_modules/fast-uri   3.1.5
+ node_modules/fast-uri                          3.1.6

resolveOpenClawSlackApiLocation selected the OpenClaw root with path.resolve, keeping the symlink /usr/local/lib/node_modules/openclaw. createExternalProofRoot then linked hoisted siblings from path.dirname of that symlink instead of the real install root /usr/local/lib/nemoclaw/openclaw-runtime/node_modules.

Seven dependency edges escape the node_modules/openclaw/ subtree in the committed lock: tar, hono (x2), minipass (x2), and fast-uri. The proof workspace linked none of them. Only fast-uri surfaced, because only ajv runs at Slack provider start, and until #10892 fast-uri sat inside node_modules/openclaw where the workspace did link it. tar, hono, and minipass have been hoisted since #9929 and #8862 with Slack working, which is why the lockfile itself is not the defect.

Related issues

Fixes #10968
Relates to #10892

Changes

• test/e2e/live/messaging-providers-slack-runtime-proof.ts: resolve the discovered OpenClaw package root through fs.realpathSync, falling back to the candidate path when the link is missing, so createExternalProofRoot derives the true install root. This repairs all seven hoisted dependencies, not only fast-uri.
• test/e2e/live/messaging-providers-slack-runtime-proof.ts: fold the workspace resolution and linking helpers into the existing exported String.raw block and rename it SLACK_PROOF_WORKSPACE_SOURCE. This adds no new mechanism and no new generated probe block; it reuses the extraction pattern the block already used for managed npm project discovery so an e2e-support test can exercise the workspace against a built tree.
• test/e2e/support/messaging-providers-runtime-proofs.test.ts: add links hoisted OpenClaw install-root dependencies into the Slack proof workspace, which builds a synthetic installed tree (nested ajv, hoisted fast-uri sibling, global symlink, Slack extension with its own peer symlink) and evaluates the workspace source in a child Node process. It asserts on constructed workspace state, not on terminal output, and resolves from an installed tree shape rather than the source workspace.
• test/e2e/mock-parity.json: add messaging-providers-slack-runtime-proof.ts to the liveSources of the messaging-providers.test.ts entry, as required for a changed live helper.

No lockfile, Dockerfile, or assertion-budget change. A package-scoped override was evaluated as a way to keep fast-uri nested and rejected: it resolves to fast-uri@3.1.2, a version without the GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, and GHSA-jqff-g426-hqxp patches.

Verification

Selected and run by nemoclaw-contributor-implement-issue:

• npx vitest run --project e2e-support test/e2e/support/messaging-providers-runtime-proofs.test.ts — 43 passed
• Failing-first evidence, reproduced twice: replacing the realpath resolution with the plain candidate fails only the new test, with AssertionError: expected [ '@openclaw', 'ajv', ...(2) ] to include 'fast-uri' — 1 failed, 42 passed
• npx vitest run --project integration test/agents/openclaw/openclaw-locked-install.test.ts — 14 passed, confirming the published closure already contains fast-uri@3.1.6 across 307 resolved specs
• npx vitest run --project integration test/automation/pull-requests/growth-guardrails.test.ts — 39 passed
• npx vitest run test/automation/e2e/e2e-mock-parity.test.ts — 15 passed
• npm run e2e:assertions:check — passed, 1975 direct expect calls across 86 test files, budget unchanged
• npm run test:projects:check — exact, 2574 candidate files across 7 projects
• npm run checks:repository — all checks passed
• npm run validate:pr — passed against base 41f54637b317487397c5aa2dd47f7ff2271ad58a, including pre-commit, commitlint, and pre-push TypeScript (CLI)

Live Messaging providers E2E is maintainer-dispatched and has not been run for this candidate.

The diff contains no secrets, API keys, or credentials; gitleaks passed.

Review notes

Issue #10968 carries needs: triage with no recorded Accept. This is a regression fix to existing test infrastructure with no new product surface, so it is submitted under the low-risk-fix carve-out of the product scope gate. A maintainer may want that decision recorded before merge.

Separate from this change: scripts/find-source-shape-tests.mts:90 lists worktrees in SKIP_DIRS, but matches relative to the repository root, so it skips a top-level worktrees/ and not .claude/worktrees/. That is not touched here.

I have READ permission on this repository, so a maintainer must assign the PR.

---

Signed-off-by: Azeel Sajjad aasajjad05@gmail.com

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor finished for commit f4a7e6a. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

[ericksoa]

Closing because this work merged through #11011.

#11011 cherry-picked the signed fix from this PR: c1460ab9 became 0435f01f, preserving @AzeelSajjad as the Git author and retaining the original sign-off. The merged change resolves the installed OpenClaw path through its real location, restores access to hoisted dependencies such as fast-uri, and keeps the installed-tree regression coverage. #11011 also extended the installed-root correction to the Telegram and WeChat proofs and closed #10968.

Thank you, @AzeelSajjad, for isolating the symlink and dependency-hoisting root cause, documenting it thoroughly, and providing the failing-first regression coverage. That work directly contributed to the merged fix.