ci(browser): ship full compiled dist/ runtime overlay (browser code is chunk-shared)

The browser plugin's compiled modules are hoisted into shared chunks across the runtime
bundle, so an isolated extensions/browser overlay is unsound. Publish the entire compiled
dist/ (node_modules excluded; deps unchanged from stock 2026.5.20); the fleet overlays it
onto the installed runtime's dist/ and restarts.

Author: pallaoro

.github/workflows/publish-browser-release.yml

@@ -76,46 +76,51 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
-      # The browser plugin is BUNDLED into the runtime (loads as stock:browser)
-      # and uses child_process/eval, so it cannot be installed as an external
-      # plugin (the loader's dangerous-code scan blocks it). We therefore ship
-      # it as a trusted bundled overlay: build the runtime bundle and tar the
-      # compiled extensions/browser tree. The fleet drops this over
-      # <openclaw-pkg>/dist/extensions/browser in the INSTALLED runtime, where
-      # it is trusted (under the package root) and exempt from the scan.
-      - name: Build runtime bundle (compiled extensions)
+      # The browser plugin is BUNDLED into the runtime (loads as stock:browser),
+      # uses child_process/eval (so the external-plugin security scan blocks
+      # installing it as a tarball), AND tsdown hoists its modules into shared
+      # chunks across the whole runtime bundle. So the change can't be isolated
+      # to extensions/browser — we ship the entire compiled dist/ as a runtime
+      # overlay. node_modules/deps are unchanged from stock 2026.5.20, so the
+      # fleet drops this dist/ over the INSTALLED runtime's dist/ and restarts.
+      - name: Build patched runtime (compiled dist)
         run: |
           pnpm plugins:assets:build
           node scripts/tsdown-build.mjs
+          node scripts/build-stamp.mjs
 
-      - name: Pack browser bundled-overlay tarball
+      - name: Pack runtime dist overlay
         id: pack
         run: |
-          test -f dist/extensions/browser/index.js || { echo "missing compiled browser bundle"; exit 1; }
-          # Identifiers are minified; assert on a string literal from env-secrets.ts.
-          grep -rq "providers.<env>.allowlist" dist/extensions/browser/ || { echo "patch not present in built bundle"; exit 1; }
+          test -f dist/extensions/browser/index.js || { echo "missing compiled runtime"; exit 1; }
+          # Identifiers are minified; assert on a string literal from env-secrets.ts
+          # somewhere in the compiled dist (it lands in a shared chunk).
+          grep -rq "providers.<env>.allowlist" dist/ || { echo "patch not present in built dist"; exit 1; }
           VERSION="${{ steps.target.outputs.tag }}"; VERSION="${VERSION#v}"
-          TARBALL="openclaw-browser-bundle-overlay-${VERSION}.tgz"
-          tar czf "$TARBALL" -C dist/extensions browser
+          TARBALL="openclaw-runtime-dist-overlay-${VERSION}.tgz"
+          # Exclude staged node_modules: the installed runtime already has them
+          # (deps are unchanged); we only overlay compiled JS.
+          tar czf "$TARBALL" --exclude='node_modules' -C dist .
           echo "tarball=$TARBALL" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "size=$(du -h "$TARBALL" | cut -f1)" >> "$GITHUB_OUTPUT"
 
       - name: Publish GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: browser-v${{ steps.pack.outputs.version }}
-          name: "openclaw browser bundled overlay ${{ steps.pack.outputs.version }} (Clawnify fork + env-var typing)"
+          name: "openclaw runtime dist overlay ${{ steps.pack.outputs.version }} (Clawnify fork + browser env-var typing)"
           body: |
-            Compiled `dist/extensions/browser` tree for openclaw `${{ steps.target.outputs.tag }}` with
-            `{{env:KEY}}` substitution in the browser tool's type/fill/select actions, gated by the native
-            `secrets.providers.<env>.allowlist`.
+            Compiled `dist/` for openclaw `${{ steps.target.outputs.tag }}` patched with `{{env:KEY}}`
+            substitution in the browser tool's type/fill/select actions, gated by the native
+            `secrets.providers.<env>.allowlist` (${{ steps.pack.outputs.size }}, node_modules excluded).
 
-            This is a BUNDLED overlay, not an installable plugin (the browser plugin uses child_process and
-            is rejected by the external-plugin security scan). Apply it on a server running openclaw
-            `${{ steps.pack.outputs.version }}` by overlaying it into the installed runtime:
+            The browser plugin is bundled and chunk-shared across the runtime bundle, so it can't be shipped
+            as an isolated plugin/dir. Apply on a server running openclaw `${{ steps.pack.outputs.version }}`
+            by overlaying the compiled dist/ into the installed runtime:
             ```
-            D="$(dirname "$(readlink -f "$(which openclaw)")")/dist/extensions"
-            cp -r "$D/browser" "$D/browser.bak"
+            D="$(dirname "$(readlink -f "$(which openclaw)")")/dist"
+            cp -a "$D" "$D.bak"
             curl -fsSL <this-asset-url> | tar xz -C "$D"
             systemctl restart openclaw-gateway
             ```