fix: harden docker smoke packaging

scripts/lib/live-docker-stage.sh

@@ -54,13 +54,21 @@ openclaw_live_stage_state_dir() {
     # Sandbox workspaces can accumulate root-owned artifacts from prior Docker
     # runs. They are not needed for live-test auth/config staging and can make
     # temp-dir cleanup fail on exit, so keep them out of the staged state copy.
+    set +e
     tar -C "$source_dir" \
+      --warning=no-file-changed \
+      --ignore-failed-read \
       --exclude=workspace \
       --exclude=sandboxes \
       --exclude=relay.sock \
       --exclude='*.sock' \
       --exclude='*/*.sock' \
       -cf - . | tar -C "$dest_dir" -xf -
+    local status=$?
+    set -e
+    if [ "$status" -gt 1 ]; then
+      return "$status"
+    fi
     chmod -R u+rwX "$dest_dir" || true
     if [ -d "$source_dir/workspace" ] && [ ! -e "$dest_dir/workspace" ]; then
       ln -s "$source_dir/workspace" "$dest_dir/workspace"

src/plugin-sdk/qa-lab.test.ts

@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const loadBundledPluginPublicSurfaceModuleSync = vi.hoisted(() => vi.fn());
 const registerQaLabCliImpl = vi.hoisted(() => vi.fn());
+const isQaLabCliAvailableImpl = vi.hoisted(() => vi.fn());
 
 vi.mock("./facade-loader.js", async () => {
   const actual = await vi.importActual<typeof import("./facade-loader.js")>("./facade-loader.js");
@@ -14,7 +15,9 @@ vi.mock("./facade-loader.js", async () => {
 describe("plugin-sdk qa-lab", () => {
   beforeEach(() => {
     registerQaLabCliImpl.mockReset();
+    isQaLabCliAvailableImpl.mockReset().mockReturnValue(true);
     loadBundledPluginPublicSurfaceModuleSync.mockReset().mockReturnValue({
+      isQaLabCliAvailable: isQaLabCliAvailableImpl,
       registerQaLabCli: registerQaLabCliImpl,
     });
   });
@@ -36,4 +39,13 @@ describe("plugin-sdk qa-lab", () => {
     module.registerQaLabCli({} as never);
     expect(registerQaLabCliImpl).toHaveBeenCalledWith({} as never);
   });
+
+  it("reports qa-lab unavailable when private facade artifacts are not packed", async () => {
+    loadBundledPluginPublicSurfaceModuleSync.mockImplementation(() => {
+      throw new Error("Unable to resolve bundled plugin public surface qa-lab/cli.js");
+    });
+    const module = await import("./qa-lab.js");
+
+    expect(module.isQaLabCliAvailable()).toBe(false);
+  });
 });

src/plugin-sdk/qa-lab.ts

@@ -9,8 +9,26 @@ function loadFacadeModule(): FacadeModule {
   });
 }
 
+function isMissingQaLabFacadeError(err: unknown): boolean {
+  if (!(err instanceof Error)) {
+    return false;
+  }
+  return (
+    err.message === "Unable to resolve bundled plugin public surface qa-lab/cli.js" ||
+    err.message.startsWith("Unable to open bundled plugin public surface ")
+  );
+}
+
 export const registerQaLabCli: FacadeModule["registerQaLabCli"] = ((...args) =>
   loadFacadeModule().registerQaLabCli(...args)) as FacadeModule["registerQaLabCli"];
 
-export const isQaLabCliAvailable: FacadeModule["isQaLabCliAvailable"] = (() =>
-  loadFacadeModule().isQaLabCliAvailable()) as FacadeModule["isQaLabCliAvailable"];
+export const isQaLabCliAvailable: FacadeModule["isQaLabCliAvailable"] = (() => {
+  try {
+    return loadFacadeModule().isQaLabCliAvailable();
+  } catch (err) {
+    if (isMissingQaLabFacadeError(err)) {
+      return false;
+    }
+    throw err;
+  }
+}) as FacadeModule["isQaLabCliAvailable"];