fix: materialize linked resources before npm publishing

.github/workflows/npm-publish.yml

@@ -56,14 +56,19 @@ jobs:
           fi
           echo "✓ npm $NPM_VERSION meets trusted publishing requirements"
 
-      # No install/test/build steps: @openhands/extensions ships source directly
-      # (plain ESM + hand-written .d.ts + JSON catalogs) with only peerDependencies,
-      # and has no build script, test suite, or lockfile.
+      # npm omits symlinks. Materialize shared resources in a release-only copy;
+      # retain the canonical linked source layout in the checkout.
+      - name: Stage package with linked resources
+        run: |
+          mkdir -p "$RUNNER_TEMP/extensions-package"
+          cp -RL . "$RUNNER_TEMP/extensions-package/"
 
       - name: Verify package contents
+        working-directory: ${{ runner.temp }}/extensions-package
         run: npm pack --dry-run
 
       - name: Validate package version matches release tag
+        working-directory: ${{ runner.temp }}/extensions-package
         env:
           # Pass inputs.tag via env var to prevent script injection from
           # GitHub Actions expression interpolation inside run blocks.
@@ -86,4 +91,5 @@ jobs:
           echo "✓ Version $PACKAGE_VERSION matches release tag"
 
       - name: Publish to npm with provenance
+        working-directory: ${{ runner.temp }}/extensions-package
         run: npm publish --access public --provenance

.pr/npm-archives.json

@@ -0,0 +1,59 @@
+[
+  {
+    "source": "factory-extension-npm-resources",
+    "source_head": "1bad294d4b9648b14ad335f516edf6f0a6622305",
+    "verified": [
+      {
+        "file": "skills/github/.claude-plugin/plugin.json",
+        "before_present": false,
+        "after_regular_file": true,
+        "canonical_bytes_match": true
+      }
+    ],
+    "worker_imports_passed": [],
+    "archive_size_bytes": 1124055
+  },
+  {
+    "source": "factory-extension-watchdog",
+    "source_head": "e8a4508296a7f3ec118b7e69ee681ab73bdcd800",
+    "verified": [
+      {
+        "file": "skills/github/.claude-plugin/plugin.json",
+        "before_present": false,
+        "after_regular_file": true,
+        "canonical_bytes_match": true
+      },
+      {
+        "file": "skills/github-issue-triage/scripts/github_client.py",
+        "before_present": false,
+        "after_regular_file": true,
+        "canonical_bytes_match": true
+      },
+      {
+        "file": "skills/github-issue-to-pr/scripts/github_client.py",
+        "before_present": false,
+        "after_regular_file": true,
+        "canonical_bytes_match": true
+      },
+      {
+        "file": "skills/github-pr-reviewer/scripts/github_client.py",
+        "before_present": false,
+        "after_regular_file": true,
+        "canonical_bytes_match": true
+      },
+      {
+        "file": "skills/github-delivery-watchdog/scripts/github_client.py",
+        "before_present": false,
+        "after_regular_file": true,
+        "canonical_bytes_match": true
+      }
+    ],
+    "worker_imports_passed": [
+      "github-issue-triage",
+      "github-issue-to-pr",
+      "github-pr-reviewer",
+      "github-delivery-watchdog"
+    ],
+    "archive_size_bytes": 1185905
+  }
+]

.pr/npm-resources-evidence.md

@@ -0,0 +1,16 @@
+# Actual npm archive verification
+
+September 13, 2026. [Recorded results](npm-archives.json) identify the exact main and composed factory source commits.
+
+From clean source checkouts, ran `npm pack --ignore-scripts --json` before and after the workflow's release staging operation:
+
+```bash
+mkdir -p "$RUNNER_TEMP/extensions-package"
+cp -RL . "$RUNNER_TEMP/extensions-package/"
+```
+
+Packed the staged directory, extracted its real tarball, and compared resource bytes with the canonical source. Main's `skills/github/.claude-plugin/plugin.json` and the four composed factory `scripts/github_client.py` resources were absent before staging. After staging, each was an ordinary file with identical contents. All four standalone workers imported successfully from the extracted npm package in an environment with their SDK dependencies installed. Package sizes were approximately 1.1–1.2 MB.
+
+`cp -aL` was also tried and rejected: preserving hard-link identity led to malformed hard links with npm 11.6.2 and an internal packaging failure with npm 11.18.0. `cp -RL` creates independent regular files and passed actual archive extraction/imports.
+
+This verifies release artifacts, not a changed Canvas interface. Raw `npm pack` from the linked source checkout still omits links; the production release workflow packs and publishes its materialized copy consistently. No npm release was published during validation. The functional change is confined to release staging; no loader, runtime, or fallback import code was introduced.