Build: explain lockfile copy rationale

package.json

@@ -39,8 +39,9 @@
     "android:install": "cd apps/android && ./gradlew :app:installDebug",
     "android:run": "cd apps/android && ./gradlew :app:installDebug && adb shell am start -n ai.openclaw.android/.MainActivity",
     "android:test": "cd apps/android && ./gradlew :app:testDebugUnitTest",
-    "build": "pnpm canvas:a2ui:bundle && tsdown && pnpm build:plugin-sdk:dts && node --import tsx scripts/write-plugin-sdk-entry-dts.ts && node --import tsx scripts/canvas-a2ui-copy.ts && node --import tsx scripts/copy-hook-metadata.ts && node --import tsx scripts/write-build-info.ts && node --import tsx scripts/write-cli-compat.ts",
+    "build": "pnpm canvas:a2ui:bundle && tsdown && pnpm build:plugin-sdk:dts && node --import tsx scripts/write-plugin-sdk-entry-dts.ts && node --import tsx scripts/canvas-a2ui-copy.ts && node --import tsx scripts/copy-hook-metadata.ts && node --import tsx scripts/write-build-info.ts && node --import tsx scripts/write-cli-compat.ts && node scripts/copy-pnpm-lock-to-dist.mjs",
     "build:plugin-sdk:dts": "tsc -p tsconfig.plugin-sdk.dts.json",
+    "build:runtime": "pnpm canvas:a2ui:bundle && tsdown && node --import tsx scripts/canvas-a2ui-copy.ts && node --import tsx scripts/copy-hook-metadata.ts && node --import tsx scripts/write-build-info.ts && node --import tsx scripts/write-cli-compat.ts && node scripts/copy-pnpm-lock-to-dist.mjs",
     "canvas:a2ui:bundle": "bash scripts/bundle-a2ui.sh",
     "check": "pnpm format:check && pnpm tsgo && pnpm lint",
     "check:docs": "pnpm format:docs:check && pnpm lint:docs && pnpm docs:check-links",

scripts/copy-pnpm-lock-to-dist.mjs

@@ -0,0 +1,20 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+
+// Why is this in `dist/`?
+//
+// `npm pack`/`npm publish` will not include a top-level `pnpm-lock.yaml` in the
+// tarball, even if it is listed in `package.json#files`.
+//
+// Packagers (eg Nix) still want the lockfile to deterministically reproduce the
+// runtime `node_modules` for a published OpenClaw version.
+//
+// Workaround: copy it under `dist/` (which is already published) so it ships as
+// `dist/pnpm-lock.yaml`.
+const repoRoot = process.cwd();
+const src = path.join(repoRoot, "pnpm-lock.yaml");
+const outDir = path.join(repoRoot, "dist");
+const out = path.join(outDir, "pnpm-lock.yaml");
+
+await fs.mkdir(outDir, { recursive: true });
+await fs.copyFile(src, out);

scripts/release-check.ts

@@ -13,6 +13,7 @@ const requiredPathGroups = [
   "dist/plugin-sdk/index.js",
   "dist/plugin-sdk/index.d.ts",
   "dist/build-info.json",
+  "dist/pnpm-lock.yaml",
 ];
 const forbiddenPrefixes = ["dist/OpenClaw.app/"];