fix(release): stage Codex for npm onboarding candidates (#130360)

* fix(release): stage Codex for npm onboarding candidates

* refactor(release): share candidate registry lifecycle

test/scripts/docker-build-helper.test.ts

@@ -3882,10 +3882,10 @@ grep -Fxq preserved "$TMPDIR/caller-fd"
 
     expectTextToIncludeAll(runner, [
       "OPENCLAW_DOCKER_ALL_LANES=codex-on-demand",
-      "OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR=/tmp/openclaw-prepublish-plugin-registry",
       "source scripts/e2e/lib/prepublish-plugin-registry.sh",
-      "openclaw_prepublish_plugin_registry_start",
-      "OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_REQUIRED_PACKAGES_JSON='[\"@openclaw/codex\"]'",
+      "openclaw_prepublish_plugin_registry_configure_docker_args",
+      "openclaw_prepublish_plugin_registry_start_mounted",
+      "'[\"@openclaw/codex\"]'",
     ]);
     expectTextToIncludeAll(registryHelper, [
       'OPENCLAW_NPM_REGISTRY_DIST_TAGS="$dist_tags"',
@@ -3899,6 +3899,20 @@ grep -Fxq preserved "$TMPDIR/caller-fd"
     );
   });
 
+  it("reuses the candidate registry lifecycle for channel onboarding", () => {
+    const runner = readFileSync(NPM_ONBOARD_CHANNEL_AGENT_DOCKER_E2E_PATH, "utf8");
+
+    expectTextToIncludeAll(runner, [
+      'source "$ROOT_DIR/scripts/e2e/lib/prepublish-plugin-registry.sh"',
+      "openclaw_prepublish_plugin_registry_configure_docker_args",
+      "openclaw_prepublish_plugin_registry_start_mounted",
+      "'[\"@openclaw/codex\"]'",
+    ]);
+    expect(runner.indexOf("openclaw_prepublish_plugin_registry_start_mounted")).toBeLessThan(
+      runner.indexOf("\nopenclaw_e2e_install_package"),
+    );
+  });
+
   it("cleans package-backed onboarding and plugin Docker artifacts on every exit path", () => {
     for (const path of [
       CODEX_ON_DEMAND_DOCKER_E2E_PATH,

test/scripts/docker-e2e-plan.test.ts

@@ -144,6 +144,22 @@ function bundledPluginSweepLane(index: number): ReturnType<typeof summarizeLane>
 }
 
 describe("scripts/lib/docker-e2e-plan", () => {
+  it("prepares the matching Codex package for candidate npm onboarding", () => {
+    const laneNames = [
+      "npm-onboard-channel-agent",
+      "npm-onboard-discord-channel-agent",
+      "npm-onboard-slack-channel-agent",
+      "npm-onboard-discord-candidate-channel-agent",
+      "npm-onboard-slack-candidate-channel-agent",
+    ];
+    const lanes = laneNames.map((name) => findLaneByName(name));
+
+    expect(lanes.map((lane) => lane?.name)).toEqual(laneNames);
+    expect(requiredPrepublishPluginPackagesForLanes(lanes.flatMap((lane) => lane ?? []))).toEqual([
+      "@openclaw/codex",
+    ]);
+  });
+
   it("omits a package-script lane unavailable from the candidate", () => {
     const plan = planFor({
       candidatePackageRoot: writeCandidatePackage({}),

test/scripts/prepublish-plugin-registry-shell.test.ts

@@ -30,6 +30,39 @@ function createTarball(
 }
 
 describe("prepublish plugin registry shell helper", () => {
+  it("derives the immutable Docker mount contract from the registry artifact", () => {
+    const root = tempDirs.make("openclaw-prepublish-registry-mount-");
+    const manifestPath = join(root, "prepublish-plugin-registry.json");
+    writeFileSync(
+      manifestPath,
+      `${JSON.stringify({ candidateVersion: VERSION, packages: [], sourceSha: SOURCE_SHA })}\n`,
+    );
+
+    const result = spawnSync(
+      "bash",
+      [
+        "-c",
+        `
+set -euo pipefail
+source "$HELPER"
+openclaw_prepublish_plugin_registry_configure_docker_args "$ARTIFACT_DIR"
+printf '%s\n' "\${OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DOCKER_ARGS[@]}"
+`,
+      ],
+      { encoding: "utf8", env: { ...process.env, ARTIFACT_DIR: root, HELPER: SCRIPT } },
+    );
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(result.stdout).toContain(`OPENCLAW_DOCKER_E2E_SELECTED_SHA=${SOURCE_SHA}`);
+    expect(result.stdout).toContain(
+      `OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_CANDIDATE_VERSION=${VERSION}`,
+    );
+    expect(result.stdout).toContain(`${root}:/tmp/openclaw-prepublish-plugin-registry:ro`);
+    expect(result.stdout).toContain(
+      `OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_MANIFEST_SHA256=${sha256(manifestPath)}`,
+    );
+  });
+
   it("verifies and serves every artifact package plus caller-owned fixtures", () => {
     const root = tempDirs.make("openclaw-prepublish-registry-shell-");
     const artifactDir = join(root, "artifact");
@@ -85,10 +118,12 @@ cleanup() {
   fi
 }
 trap cleanup EXIT
-export OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_REQUIRED_PACKAGES_JSON='["@openclaw/codex"]'
-openclaw_prepublish_plugin_registry_start \
-  "$ARTIFACT_DIR" "$SOURCE_SHA" "$VERSION" "$MANIFEST_SHA256" \
-  "$REGISTRY_ROOT" registry_pid \
+export OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR="$ARTIFACT_DIR"
+export OPENCLAW_DOCKER_E2E_SELECTED_SHA="$SOURCE_SHA"
+export OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_CANDIDATE_VERSION="$VERSION"
+export OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_MANIFEST_SHA256="$MANIFEST_SHA256"
+openclaw_prepublish_plugin_registry_start_mounted \
+  "$REGISTRY_ROOT" registry_pid '["@openclaw/codex"]' \
   "@openclaw/brave-plugin" "$VERSION" "$EXTRA_TARBALL"
 node <<'NODE'
 const packages = ["@openclaw/codex", "@openclaw/telegram", "@openclaw/brave-plugin"];