tighten reporting governance adapter exports

plugins/reporting-governance/test/exports-boundary.integration.test.mjs

@@ -40,7 +40,7 @@ function writeState(root) {
 }
 
 function runNodeEval(root, source, env = {}) {
-  const result = spawnSync(process.execPath, ['--input-type=module', '--eval', source], {
+  return spawnSync(process.execPath, ['--input-type=module', '--eval', source], {
     cwd: root,
     encoding: 'utf8',
     env: {
@@ -48,6 +48,10 @@ function runNodeEval(root, source, env = {}) {
       ...env,
     },
   });
+}
+
+function runJsonEval(root, source, env = {}) {
+  const result = runNodeEval(root, source, env);
   if (result.status !== 0) {
     throw new Error(`node eval failed: ${(result.stderr ?? '').trim() || '(no stderr)'}`);
   }
@@ -58,7 +62,7 @@ test('package root export resolves public package surface only', () => {
   const root = createFixtureRoot();
   try {
     installPackageAlias(root);
-    const result = runNodeEval(root, `
+    const result = runJsonEval(root, `
       import * as plugin from '@openclaw/plugin-reporting-governance';
       process.stdout.write(JSON.stringify({
         packageName: plugin.packageName,
@@ -79,7 +83,7 @@ test('adapters subpath export resolves package-owned adapter index', () => {
   const root = createFixtureRoot();
   try {
     installPackageAlias(root);
-    const result = runNodeEval(root, `
+    const result = runJsonEval(root, `
       import * as adapters from '@openclaw/plugin-reporting-governance/adapters';
       process.stdout.write(JSON.stringify({
         adapterKeys: Object.keys(adapters).sort(),
@@ -87,10 +91,7 @@ test('adapters subpath export resolves package-owned adapter index', () => {
     `);
 
     assert.deepEqual(result.adapterKeys, [
-      'SCRIPT_ENV_KEYS',
-      'SCRIPT_NAMES',
       'createRuntimeBinding',
-      'resolveScriptPath',
       'runBridgeSupervisorAdapter',
       'runDispatcherAdapter',
       'runOrchestratorAdapter',
@@ -102,6 +103,36 @@ test('adapters subpath export resolves package-owned adapter index', () => {
   }
 });
 
+test('deep runtime-binding subpath stays outside package exports boundary', () => {
+  const root = createFixtureRoot();
+  try {
+    installPackageAlias(root);
+    const result = runNodeEval(root, `
+      import('@openclaw/plugin-reporting-governance/src/adapters/runtime-binding.mjs')
+        .then(() => {
+          process.stdout.write(JSON.stringify({ ok: true }));
+        })
+        .catch((error) => {
+          process.stdout.write(JSON.stringify({
+            ok: false,
+            code: error?.code ?? null,
+            name: error?.name ?? null,
+            message: error?.message ?? null,
+          }));
+        });
+    `);
+
+    assert.equal(result.status, 0, result.stderr);
+    const payload = JSON.parse((result.stdout ?? '').trim());
+    assert.equal(payload.ok, false);
+    assert.equal(payload.code, 'ERR_PACKAGE_PATH_NOT_EXPORTED');
+    assert.equal(payload.name, 'Error');
+    assert.match(payload.message ?? '', /Package subpath '\.\/src\/adapters\/runtime-binding\.mjs' is not defined by "exports"/);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test('leaf subpath export resolves and can execute through injected runtime binding', () => {
   const root = createFixtureRoot();
   try {
@@ -121,7 +152,7 @@ test('leaf subpath export resolves and can execute through injected runtime bind
       }));
     `, 'utf8');
 
-    const result = runNodeEval(root, `
+    const result = runJsonEval(root, `
       import { runWatchdogAdapter } from '@openclaw/plugin-reporting-governance/adapters/watchdog';
       const out = runWatchdogAdapter({
         state: ${JSON.stringify(statePath)},