fix: test bundled public surface loading

The stable and dogfood OpenClaw source pins need different public-surface hardlink patch shapes while upstream is still catching up. Select the right patch per source and make package contents import the OpenAI provider policy public surface, which is the path the gateway uses before a model run.

Tests: nix fmt --accept-flake-config; git diff --check; remote mac-mini nix build .#checks.aarch64-darwin.package-contents-dogfood --no-link; remote mac-mini nix build .#checks.aarch64-darwin.package-contents --no-link

Co-authored-by: Codex <noreply@openai.com>

nix/checks/openclaw-package-contents.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  nodejs_22,
   openclawGateway,
 }:
 
@@ -17,6 +18,7 @@ stdenv.mkDerivation {
   };
 
   doCheck = true;
+  nativeCheckInputs = [ nodejs_22 ];
   checkPhase = "${../scripts/check-package-contents.sh}";
   installPhase = "${../scripts/empty-install.sh}";
 }

nix/lib/openclaw-gateway-common.nix

@@ -40,6 +40,7 @@ let
     "releaseVersion"
     "applyPublicSurfaceHardlinksPatch"
     "applySkipPluginAutoEnableNixModePatch"
+    "publicSurfaceHardlinksPatch"
     "fsSafeSource"
   ];
 
@@ -59,6 +60,8 @@ let
       fetchFromGitHub sourceFetch;
 
   fsSafeSource = if sourceInfo ? fsSafeSource then fetchFromGitHub sourceInfo.fsSafeSource else null;
+  publicSurfaceHardlinksPatch =
+    sourceInfo.publicSurfaceHardlinksPatch or ../patches/allow-package-public-surface-hardlinks.patch;
 
   nodeAddonApi = import ../packages/node-addon-api.nix { inherit stdenv fetchurl; };
 
@@ -88,7 +91,7 @@ let
     PATCH_BUNDLED_RUNTIME_DEPS_SCRIPT = "${../patches/stage-bundled-plugin-runtime-deps.mjs}";
     PATCH_PUBLIC_SURFACE_HARDLINKS =
       if sourceInfo.applyPublicSurfaceHardlinksPatch or true then
-        "${../patches/allow-package-public-surface-hardlinks.patch}"
+        "${publicSurfaceHardlinksPatch}"
       else
         "";
     PATCH_SKIP_PLUGIN_AUTO_ENABLE_NIX_MODE =

nix/patches/allow-package-public-surface-hardlinks-open-root.patch

@@ -0,0 +1,20 @@
+diff --git a/src/plugins/public-surface-loader.ts b/src/plugins/public-surface-loader.ts
+index 5f6f939..b8d27c8 100644
+--- a/src/plugins/public-surface-loader.ts
++++ b/src/plugins/public-surface-loader.ts
+@@ -133,8 +133,12 @@ export function loadBundledPluginPublicArtifactModuleSync<T extends object>(para
+-  const opened = openRootFileSync({
++  const packageRoot = path.resolve(OPENCLAW_PACKAGE_ROOT);
++  const resolvedModulePath = path.resolve(location.modulePath);
++  const isPackagePublicSurface = resolvedModulePath.startsWith(`${packageRoot}${path.sep}`);
++
++  const opened = openRootFileSync({
+     absolutePath: location.modulePath,
+     rootPath: location.boundaryRoot,
+     boundaryLabel:
+       location.boundaryRoot === OPENCLAW_PACKAGE_ROOT ? "OpenClaw package root" : "plugin root",
+-    rejectHardlinks: true,
++    rejectHardlinks: !isPackagePublicSurface,
+   });
+   if (!opened.ok) {
+     throw new Error(

nix/patches/allow-package-public-surface-hardlinks.patch

@@ -1,13 +1,20 @@
 diff --git a/src/plugins/public-surface-loader.ts b/src/plugins/public-surface-loader.ts
-index 5f6f939..8cb550f 100644
+index 1f5b5ab..a08ef8a 100644
 --- a/src/plugins/public-surface-loader.ts
 +++ b/src/plugins/public-surface-loader.ts
-@@ -128,7 +128,7 @@ export function loadBundledPluginPublicArtifactModuleSync<T extends object>(para
+@@ -124,8 +124,12 @@ export function loadBundledPluginPublicArtifactModuleSync<T extends object>(para
+-  const opened = openBoundaryFileSync({
++  const packageRoot = path.resolve(OPENCLAW_PACKAGE_ROOT);
++  const resolvedModulePath = path.resolve(location.modulePath);
++  const isPackagePublicSurface = resolvedModulePath.startsWith(`${packageRoot}${path.sep}`);
++
++  const opened = openBoundaryFileSync({
+     absolutePath: location.modulePath,
      rootPath: location.boundaryRoot,
      boundaryLabel:
        location.boundaryRoot === OPENCLAW_PACKAGE_ROOT ? "OpenClaw package root" : "plugin root",
 -    rejectHardlinks: true,
-+    rejectHardlinks: location.boundaryRoot !== OPENCLAW_PACKAGE_ROOT,
++    rejectHardlinks: !isPackagePublicSurface,
    });
    if (!opened.ok) {
      throw new Error(

nix/scripts/check-package-contents.sh

@@ -36,7 +36,7 @@ require_path "${root}/node_modules/hasown"
 require_path "${root}/node_modules/combined-stream"
 
 public_surface_loader="$(
-  grep -Rsl "function loadBundledPluginPublicArtifactModuleSync" "${root}/dist" | head -1
+  find "${root}/dist" -name "*.js" -type f -exec grep -sl "function loadBundledPluginPublicArtifactModuleSync" {} + | head -1
 )"
 if [ -z "$public_surface_loader" ]; then
   echo "Missing bundled plugin public surface loader" >&2
@@ -46,6 +46,28 @@ if grep -q "rejectHardlinks: true" "$public_surface_loader"; then
   echo "Bundled plugin public surface loader still rejects hardlinked package files" >&2
   exit 1
 fi
+export PUBLIC_SURFACE_LOADER="$public_surface_loader"
+node --input-type=module <<'NODE'
+import { pathToFileURL } from "node:url";
+
+const loaderPath = process.env.PUBLIC_SURFACE_LOADER;
+if (!loaderPath) {
+  throw new Error("PUBLIC_SURFACE_LOADER is not set");
+}
+
+const loader = await import(pathToFileURL(loaderPath).href);
+const loadBundledPluginPublicArtifactModuleSync =
+  loader.loadBundledPluginPublicArtifactModuleSync ?? loader.t;
+
+if (typeof loadBundledPluginPublicArtifactModuleSync !== "function") {
+  throw new Error("Bundled plugin public surface loader export not found");
+}
+
+loadBundledPluginPublicArtifactModuleSync({
+  dirName: "openai",
+  artifactBasename: "provider-policy-api.js",
+});
+NODE
 
 require_js_alias_target() {
   alias="$1"

nix/sources/openclaw-dogfood-source.nix

@@ -12,5 +12,6 @@
     hash = "sha256-jndOOSSFROyrK4RiwAsJfUuCJTj7qbmmm4Qz8BqtJ/c=";
   };
 
+  publicSurfaceHardlinksPatch = ../patches/allow-package-public-surface-hardlinks-open-root.patch;
   applySkipPluginAutoEnableNixModePatch = false;
 }