fix(ci): harden full release live checks

test/helpers/media-generation/live-video-skip-reason.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+import { resolveLiveVideoSkipReason } from "./live-video-skip-reason.js";
+
+describe("resolveLiveVideoSkipReason", () => {
+  it("classifies provider policy moderation blocks as skip-worthy drift", () => {
+    expect(resolveLiveVideoSkipReason("Your request was blocked by our moderation system.")).toBe(
+      "provider policy drift",
+    );
+  });
+
+  it("does not hide ordinary provider failures", () => {
+    expect(resolveLiveVideoSkipReason("video generation returned an empty asset")).toBeNull();
+  });
+});

test/helpers/media-generation/live-video-skip-reason.ts

@@ -0,0 +1,44 @@
+import {
+  isAuthErrorMessage,
+  isBillingErrorMessage,
+  isModelNotFoundErrorMessage,
+  isOverloadedErrorMessage,
+  isServerErrorMessage,
+  isTimeoutErrorMessage,
+} from "openclaw/plugin-sdk/test-env";
+
+export function resolveLiveVideoSkipReason(message: string): string | null {
+  if (isAuthErrorMessage(message)) {
+    return "auth drift";
+  }
+  if (isModelNotFoundErrorMessage(message)) {
+    return "model drift";
+  }
+  if (isBillingErrorMessage(message)) {
+    return "billing drift";
+  }
+  if (
+    isTimeoutErrorMessage(message) ||
+    /did not finish in time/i.test(message) ||
+    /last status:\s*in_progress/i.test(message)
+  ) {
+    return "provider timeout";
+  }
+  if (isOverloadedErrorMessage(message) || isServerErrorMessage(message)) {
+    return "provider outage";
+  }
+  if (
+    /HTTP\s+404/i.test(message) &&
+    /Invalid URL/i.test(message) &&
+    /\/platform\/video_gen/i.test(message)
+  ) {
+    return "provider endpoint drift";
+  }
+  if (/access denied|not authorized|not enabled|permission denied/i.test(message)) {
+    return "provider/model drift";
+  }
+  if (/blocked by (?:our )?moderation system|content policy|policy violation/i.test(message)) {
+    return "provider policy drift";
+  }
+  return null;
+}

test/scripts/check-openclaw-package-tarball.test.ts

@@ -94,6 +94,39 @@ describe("check-openclaw-package-tarball", () => {
     );
   });
 
+  it("rejects dist files that import missing relative chunks", () => {
+    withTarball(
+      ["dist/cli/run-main.js"],
+      { "dist/cli/run-main.js": 'await import("../memory-state-old.js");\n' },
+      (tarball) => {
+        const result = spawnSync("node", [CHECK_SCRIPT, tarball], { encoding: "utf8" });
+
+        expect(result.status).not.toBe(0);
+        expect(result.stderr).toContain(
+          "dist/cli/run-main.js imports missing dist/memory-state-old.js",
+        );
+      },
+      "2026.4.27",
+    );
+  });
+
+  it("accepts dist files whose relative chunks are present", () => {
+    withTarball(
+      ["dist/cli/run-main.js", "dist/memory-state-current.js"],
+      {
+        "dist/cli/run-main.js": 'await import("../memory-state-current.js");\n',
+        "dist/memory-state-current.js": "export {};\n",
+      },
+      (tarball) => {
+        const result = spawnSync("node", [CHECK_SCRIPT, tarball], { encoding: "utf8" });
+
+        expect(result.status, result.stderr).toBe(0);
+        expect(result.stdout).toContain("OpenClaw package tarball integrity passed.");
+      },
+      "2026.4.27",
+    );
+  });
+
   it("rejects missing Control UI assets", () => {
     withTarball(
       ["dist/index.js"],

test/scripts/test-install-sh-docker.test.ts

@@ -53,11 +53,18 @@ describe("test-install-sh-docker", () => {
 
   it("can reuse dist from the already-built root Docker smoke image", () => {
     const script = readFileSync(SCRIPT_PATH, "utf8");
+    const dockerfile = readFileSync("Dockerfile", "utf8");
 
     expect(script).toContain('UPDATE_DIST_IMAGE="${OPENCLAW_INSTALL_SMOKE_UPDATE_DIST_IMAGE:-}"');
     expect(script).toContain("restore_local_dist_from_image");
     expect(script).toContain('docker cp "${container_id}:/app/dist" "$ROOT_DIR/dist"');
     expect(script).toContain('echo "==> Reuse local dist/ from Docker image: $image"');
+    expect(script).toContain("ensure_local_update_dist_import_closure");
+    expect(script).toContain('node scripts/check-package-dist-imports.mjs "$ROOT_DIR"');
+    expect(script).toContain("WARN: reused Docker image dist failed import-closure check");
+    expect(script).toContain("pnpm build");
+    expect(script).toContain("pnpm ui:build");
+    expect(dockerfile).toContain("node scripts/check-package-dist-imports.mjs /app");
   });
 
   it("allows repository branch history and release tags for secret-backed Docker release checks", () => {
@@ -92,7 +99,9 @@ describe("test-install-sh-docker", () => {
     const script = readFileSync(SCRIPT_PATH, "utf8");
 
     expect(script).toContain("node --import tsx scripts/write-package-dist-inventory.ts");
+    expect(script).toContain('node scripts/check-package-dist-imports.mjs "$ROOT_DIR"');
     expect(script).toContain("quiet_npm pack --ignore-scripts");
+    expect(script).toContain("node scripts/check-openclaw-package-tarball.mjs");
   });
 });