2026 OpenClaw Frontend on Remote Mac:
package.json Scripts Preflight & Diff Report

Run the workflow on a clean working tree of the same branch you intend to ship—typically main or your release candidate. On a remote Mac, verify SSH key or CI runner identity can read the repo, execute git, and write to an artifacts directory (for example artifacts/preflight/) without sudo.

Install & pin tooling: align node and your package manager (npm, pnpm, yarn) with production CI. If you use Corepack, document the exact version in the report header. Missing or mismatched tooling is the top cause of "scripts unchanged but behavior changed" incidents.

OpenClaw configuration: give the agent read-only repo access plus permission to post files to your notification channel. Never store registry tokens inside package.json scripts; inject secrets via CI env and keep them out of generated diff reports. For monorepos, repeat the snapshot step per workspace package that defines deploy or test entrypoints—see pnpm & Turborepo checklist for cache and registry parity.

Treat scripts as a release API: renaming build, adding a release shim, or tweaking test:e2e flags can invalidate downstream automation even when application code is untouched.

Git diff scope (checklist):

• ☐ Compare HEAD against origin/main, the previous tag, or git merge-base for your release branch—document which in the report title.
• ☐ Include package.json at repo root and every packages/*/package.json (or your glob) that participates in build or deploy.
• ☐ Optionally narrow with git diff <range> -- package.json packages/ so dependency-only churn does not spam reviewers.

Script snapshots (checklist): for each targeted package.json, extract the scripts object, sort keys alphabetically, and write pretty-printed JSON (stable ordering). Store scripts.<pkg>.<sha>.json next to a scripts.<pkg>.baseline.json checked in or generated from the last green release. A one-liner pattern is: node -e "const p=require('./package.json'); console.log(JSON.stringify(p.scripts||{}, null, 2))" piped through your normalizer.

When to trigger: on every PR that touches any scoped package.json; on nightly main; and immediately before tagging a version. Wire the same step into OpenClaw so an agent can re-run the snapshot after merge without a laptop.

Publish a single markdown or JSON file per run so humans and automation share one source of truth. Below is a report template you can paste into your generator.

# Scripts preflight — <repo> @ <short_sha>
Range: <from_ref>..<to_ref> | Node <version> | <npm|pnpm|yarn> <version>

## Summary
- Packages touched: …
- Scripts added: … | removed: … | modified: …
- Risk: low / medium / high (see table)

## Per-package deltas
### root
| script | change | inferred impact |
| build | flag … | CI artifact path |
| … | … | … |

## Required follow-ups
- [ ] Re-run smoke / E2E matrix
- [ ] Update runbook or deployment docs
- [ ] Notify SRE if deploy hooks changed

## Artifacts
- snapshot JSON paths / URLs
- raw unified diff attachment

Notifications (checklist): post a three-line summary to Slack, Feishu, or a generic webhook—range, count of changed scripts, highest risk label—with a link to the full report. For OpenClaw, include the artifact path in the task payload so the agent can open the file on the remote Mac and append remediation steps.

Add a fast job ahead of expensive steps (build, Lighthouse, Playwright). The job should: (1) fail if JSON is invalid; (2) emit the report; (3) exit non-zero when protected script names change without an allowlist file or changelog entry.

Sequence this check inside your broader predeploy chain—after dependency install and lockfile verification, before AI-assisted smoke or browser work—so reviewers see script drift before minutes-long suites start.

Expose the report as a CI artifact and optionally open a GitHub/GitLab check annotation listing each changed script. On Apple Silicon runners, set CI=true and log the architecture to catch arm64-only assumptions in script bodies.

Parse errors: if package.json contains trailing commas or duplicate keys, Node will throw before diffing—fix the file locally, then re-run. Use npm pkg get scripts as a secondary parser when you need npm’s normalization.

False "no diff": ensure you compared the same file path in a monorepo; developers sometimes edit the wrong package.json. Another pitfall is shell-specific syntax in script strings that behaves differently under sh vs zsh; document the shell CI uses.

Merge conflicts: when two teams rename scripts, prefer additive aliases (build:legacy) for one release cycle instead of breaking consumers overnight. Reference E2E log triage when script changes correlate with flaky suites.

Use this list before you call the release green. It aligns preflight checks with the rest of your OpenClaw-powered web pipeline.