fix: stabilize release validation gates

steipete · steipete · commit 9feca3e11efc · 2026-05-17T11:24:01.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -18,6 +18,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Feishu: detect SecretRef top-level credentials as a configured default account instead of treating object-backed app secrets as missing.
 - Providers/Google: preserve and recover Gemini 3 tool-call thought signatures during native replay so function-calling turns no longer fail with missing `thought_signature` 400s. Fixes #72879. (#80358) Thanks @abnershang.
 - Gateway/secrets: split the lightweight secrets runtime state and auth-store cache from the full secrets runtime and take a startup fast path when the gateway startup config has no SecretRef values, speeding up secrets startup while preserving cleanup and refresh semantics.
 - Gateway/restart: drain pending replies and active chat runs during restart shutdown before sockets and channels close, aborting timed-out chat runs through the normal cleanup path. (#69121) Thanks @alexlomt.
diff --git a/extensions/feishu/src/accounts.ts b/extensions/feishu/src/accounts.ts
@@ -21,11 +21,12 @@ const { listAccountIds: listFeishuAccountIds, resolveDefaultAccountId } = create
   "feishu",
   {
     allowUnlistedDefaultAccount: true,
-    hasImplicitDefaultAccount: (cfg) =>
-      Boolean(
-        cfg.channels?.feishu?.appId?.trim() &&
-        hasConfiguredAccountValue(cfg.channels.feishu.appSecret),
-      ),
+    hasImplicitDefaultAccount: (cfg) => {
+      const feishu = cfg.channels?.feishu;
+      return (
+        hasConfiguredAccountValue(feishu?.appId) && hasConfiguredAccountValue(feishu?.appSecret)
+      );
+    },
   },
 );
 
diff --git a/scripts/e2e/parallels/linux-smoke.ts b/scripts/e2e/parallels/linux-smoke.ts
@@ -789,7 +789,7 @@ for attempt in 1 2; do
   set +e
   /usr/bin/env OPENCLAW_ALLOW_ROOT=1 ${shellQuote(`${this.auth.apiKeyEnv}=${this.auth.apiKeyValue}`)} openclaw agent --local --agent main --session-id "$session_id" --message ${shellQuote(
     "Reply with exact ASCII text OK only.",
-  )} --thinking minimal --timeout ${resolveParallelsModelTimeoutSeconds("linux")} --json >"$output_file" 2>&1
+  )} --thinking off --timeout ${resolveParallelsModelTimeoutSeconds("linux")} --json >"$output_file" 2>&1
   rc=$?
   set -e
   cat "$output_file"
diff --git a/scripts/e2e/parallels/macos-smoke.ts b/scripts/e2e/parallels/macos-smoke.ts
@@ -1011,7 +1011,7 @@ for attempt in 1 2; do
   set +e
   /usr/bin/env ${shellQuote(`${this.auth.apiKeyEnv}=${this.auth.apiKeyValue}`)} ${guestNode} ${guestOpenClawEntry} agent --local --agent main --session-id "$session_id" --message ${shellQuote(
     "Reply with exact ASCII text OK only.",
-  )} --thinking minimal --timeout ${resolveParallelsModelTimeoutSeconds("macos")} --json >"$output_file" 2>&1
+  )} --thinking off --timeout ${resolveParallelsModelTimeoutSeconds("macos")} --json >"$output_file" 2>&1
   rc=$?
   set -e
   cat "$output_file"
diff --git a/scripts/e2e/parallels/npm-update-scripts.ts b/scripts/e2e/parallels/npm-update-scripts.ts
@@ -49,7 +49,7 @@ for attempt in 1 2; do
   rm -f "$HOME/.openclaw/agents/main/sessions/$session_id.jsonl"
   output_file="$(mktemp)"
   set +e
-  OPENCLAW_ALLOW_ROOT="\${OPENCLAW_ALLOW_ROOT:-}" ${input.auth.apiKeyEnv}=${shellQuote(input.auth.apiKeyValue)} ${command} agent --local --agent main --session-id "$session_id" --message 'Reply with exact ASCII text OK only.' --thinking minimal --json >"$output_file" 2>&1
+  OPENCLAW_ALLOW_ROOT="\${OPENCLAW_ALLOW_ROOT:-}" ${input.auth.apiKeyEnv}=${shellQuote(input.auth.apiKeyValue)} ${command} agent --local --agent main --session-id "$session_id" --message 'Reply with exact ASCII text OK only.' --thinking off --json >"$output_file" 2>&1
   rc=$?
   set -e
   cat "$output_file"
@@ -118,7 +118,7 @@ for ($attempt = 1; $attempt -le 2; $attempt++) {
   $sessionsDir = Join-Path $env:USERPROFILE '.openclaw\\agents\\main\\sessions'
   $sessionPath = Join-Path $sessionsDir "$sessionId.jsonl"
   Remove-Item $sessionPath -Force -ErrorAction SilentlyContinue
-  $output = Invoke-OpenClaw agent --local --agent main --session-id $sessionId --model ${psSingleQuote(input.auth.modelId)} --message 'Reply with exact ASCII text OK only.' --thinking minimal --timeout ${resolveParallelsModelTimeoutSeconds("windows")} --json 2>&1
+  $output = Invoke-OpenClaw agent --local --agent main --session-id $sessionId --model ${psSingleQuote(input.auth.modelId)} --message 'Reply with exact ASCII text OK only.' --thinking off --timeout ${resolveParallelsModelTimeoutSeconds("windows")} --json 2>&1
   if ($null -ne $output) { $output | ForEach-Object { $_ } }
   if ($LASTEXITCODE -ne 0) { throw "agent failed with exit code $LASTEXITCODE" }
   if (($output | Out-String) -match '"finalAssistant(Raw|Visible)Text":\\s*"OK"') {
diff --git a/scripts/e2e/parallels/windows-smoke.ts b/scripts/e2e/parallels/windows-smoke.ts
@@ -782,7 +782,7 @@ for ($attempt = 1; $attempt -le 2; $attempt++) {
     '--message',
     'Reply with exact ASCII text OK only.',
     '--thinking',
-    'minimal',
+    'off',
     '--timeout',
     '${resolveParallelsModelTimeoutSeconds("windows")}',
     '--json'
diff --git a/scripts/openclaw-cross-os-release-checks.ts b/scripts/openclaw-cross-os-release-checks.ts
@@ -3094,7 +3094,7 @@ function buildReleaseAgentTurnArgs(sessionId) {
     "--message",
     "Reply with exact ASCII text OK only.",
     "--thinking",
-    "minimal",
+    "off",
     "--timeout",
     String(CROSS_OS_AGENT_TURN_TIMEOUT_SECONDS),
     "--json",
diff --git a/src/agents/agent-command.live-model-switch.test.ts b/src/agents/agent-command.live-model-switch.test.ts
@@ -62,6 +62,7 @@ vi.mock("./command/attempt-execution.runtime.js", () => ({
   emitAcpLifecycleEnd: vi.fn(),
   emitAcpLifecycleError: vi.fn(),
   emitAcpLifecycleStart: vi.fn(),
+  emitAcpRuntimeEvent: vi.fn(),
   persistAcpTurnTranscript: (...args: unknown[]) => state.persistAcpTurnTranscriptMock(...args),
   persistSessionEntry: vi.fn(),
   prependInternalEventContext: (_body: string) => _body,
diff --git a/src/agents/pi-tools-parameter-schema.ts b/src/agents/pi-tools-parameter-schema.ts
@@ -82,6 +82,15 @@ function isSchemaRecord(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
+function setOwnSchemaProperty(target: Record<string, unknown>, key: string, value: unknown): void {
+  Object.defineProperty(target, key, {
+    value,
+    enumerable: true,
+    configurable: true,
+    writable: true,
+  });
+}
+
 function hasTopLevelArrayKeyword(
   schemaRecord: Record<string, unknown>,
   key: TopLevelConditionalKey,
@@ -453,7 +462,11 @@ function inlineLocalSchemaRefsWithDefs(
     if (key === "$defs" || key === "definitions") {
       continue;
     }
-    result[key] = inlineLocalSchemaRefsWithDefs(value, nextDefs, refStack, state);
+    setOwnSchemaProperty(
+      result,
+      key,
+      inlineLocalSchemaRefsWithDefs(value, nextDefs, refStack, state),
+    );
   }
   if (state.unresolvedLocalRefs) {
     if ("$defs" in obj) {
diff --git a/src/agents/subagent-registry.steer-restart.test.ts b/src/agents/subagent-registry.steer-restart.test.ts
@@ -802,11 +802,13 @@ describe("subagent registry steer restarts", () => {
 
         await vi.advanceTimersByTimeAsync(4_001);
         expect(announceSpy).toHaveBeenCalledTimes(3);
-        const run = listMainRuns()[0];
-        expect(run?.pendingFinalDelivery).toBe(true);
-        expect(run?.deliverySuspendedAt).toBeTypeOf("number");
-        expect(run?.deliverySuspendedReason).toBe("retry-limit");
-        expect(run?.cleanupCompletedAt).toBeUndefined();
+        await waitForRegistrySideEffect(() => {
+          const run = listMainRuns()[0];
+          expect(run?.pendingFinalDelivery).toBe(true);
+          expect(run?.deliverySuspendedAt).toBeTypeOf("number");
+          expect(run?.deliverySuspendedReason).toBe("retry-limit");
+          expect(run?.cleanupCompletedAt).toBeUndefined();
+        });
       } finally {
         vi.useRealTimers();
       }
diff --git a/src/plugins/cli.test.ts b/src/plugins/cli.test.ts
@@ -114,10 +114,12 @@ function expectAutoEnabledCliLoad(params: {
   autoEnabledConfig: OpenClawConfig;
   autoEnabledReasons?: Record<string, string[]>;
 }) {
-  expect(mocks.applyPluginAutoEnable).toHaveBeenCalledWith({
-    config: params.rawConfig,
-    env: process.env,
-  });
+  expect(mocks.applyPluginAutoEnable).toHaveBeenCalledWith(
+    expect.objectContaining({
+      config: params.rawConfig,
+      env: process.env,
+    }),
+  );
   const loadOptions = getMockCallObject(mocks.loadOpenClawPlugins);
   expect(loadOptions.config).toBe(params.autoEnabledConfig);
   expect(loadOptions.activationSourceConfig).toBe(params.rawConfig);
diff --git a/src/plugins/runtime/load-context.ts b/src/plugins/runtime/load-context.ts
@@ -4,7 +4,10 @@ import { applyPluginAutoEnable } from "../../config/plugin-auto-enable.js";
 import type { OpenClawConfig } from "../../config/types.openclaw.js";
 import { createSubsystemLogger } from "../../logging.js";
 import { resolvePluginActivationSourceConfig } from "../activation-source-config.js";
-import { setCurrentPluginMetadataSnapshot } from "../current-plugin-metadata-snapshot.js";
+import {
+  getCurrentPluginMetadataSnapshot,
+  setCurrentPluginMetadataSnapshot,
+} from "../current-plugin-metadata-snapshot.js";
 import type { PluginLoadOptions } from "../loader.js";
 import type { PluginManifestRegistry } from "../manifest-registry.js";
 import { loadPluginMetadataSnapshot } from "../plugin-metadata-snapshot.js";
@@ -61,11 +64,16 @@ export function resolvePluginRuntimeLoadContext(
     options?.workspaceDir ?? resolveAgentWorkspaceDir(rawConfig, resolveDefaultAgentId(rawConfig));
   const metadataSnapshot = options?.manifestRegistry
     ? undefined
-    : loadPluginMetadataSnapshot({
+    : (getCurrentPluginMetadataSnapshot({
         config: rawConfig,
         env,
         workspaceDir: rawWorkspaceDir,
-      });
+      }) ??
+      loadPluginMetadataSnapshot({
+        config: rawConfig,
+        env,
+        workspaceDir: rawWorkspaceDir,
+      }));
   const manifestRegistry = options?.manifestRegistry ?? metadataSnapshot?.manifestRegistry;
   const activationSourceConfig = resolvePluginActivationSourceConfig({
     config: rawConfig,
diff --git a/src/plugins/runtime/metadata-registry-loader.test.ts b/src/plugins/runtime/metadata-registry-loader.test.ts
@@ -62,20 +62,20 @@ describe("loadPluginMetadataRegistrySnapshot", () => {
     });
 
     const loadOptions = getOnlyLoadOpenClawPluginsOptions();
-    expect(loadOptions).toEqual({
+    expect(loadOptions).toMatchObject({
       config: { plugins: {} },
       activationSourceConfig: { plugins: { allow: ["demo"] } },
       autoEnabledReasons: {},
       workspaceDir: "/workspace",
       env: { HOME: "/tmp/openclaw-home" },
-      logger: loadOptions.logger,
       throwOnLoadError: true,
       cache: false,
       activate: false,
       mode: "validate",
       loadModules: undefined,
       onlyPluginIds: ["demo"],
     });
+    expect(loadOptions.logger).toBeDefined();
   });
 
   it("forwards explicit manifest-only requests", () => {
@@ -85,19 +85,19 @@ describe("loadPluginMetadataRegistrySnapshot", () => {
     });
 
     const loadOptions = getOnlyLoadOpenClawPluginsOptions();
-    expect(loadOptions).toEqual({
+    expect(loadOptions).toMatchObject({
       config: { plugins: {} },
       activationSourceConfig: { plugins: {} },
       autoEnabledReasons: {},
       workspaceDir: "/resolved-workspace",
-      env: loadOptions.env,
-      logger: loadOptions.logger,
       throwOnLoadError: true,
       cache: false,
       activate: false,
       mode: "validate",
       loadModules: false,
     });
+    expect(loadOptions.env).toBe(process.env);
+    expect(loadOptions.logger).toBeDefined();
   });
 
   it("forwards an explicit logger through metadata snapshots", () => {
@@ -113,7 +113,7 @@ describe("loadPluginMetadataRegistrySnapshot", () => {
       workspaceDir: "/workspace",
     });
 
-    expect(getOnlyLoadOpenClawPluginsOptions()).toEqual({
+    expect(getOnlyLoadOpenClawPluginsOptions()).toMatchObject({
       config: { plugins: {} },
       activationSourceConfig: { plugins: {} },
       autoEnabledReasons: {},
@@ -179,19 +179,19 @@ describe("loadPluginMetadataRegistrySnapshot", () => {
     });
 
     const loadOptions = getOnlyLoadOpenClawPluginsOptions();
-    expect(loadOptions).toEqual({
+    expect(loadOptions).toMatchObject({
       config: { plugins: {} },
       activationSourceConfig: { plugins: {} },
       autoEnabledReasons: {},
       workspaceDir: "/resolved-workspace",
-      env: loadOptions.env,
-      logger: loadOptions.logger,
       throwOnLoadError: true,
       cache: false,
       activate: false,
       mode: "validate",
       loadModules: undefined,
       onlyPluginIds: [],
     });
+    expect(loadOptions.env).toBe(process.env);
+    expect(loadOptions.logger).toBeDefined();
   });
 });
diff --git a/src/plugins/runtime/runtime-registry-loader.test.ts b/src/plugins/runtime/runtime-registry-loader.test.ts
@@ -180,10 +180,12 @@ describe("ensurePluginRegistryLoaded", () => {
     expect(channelOptions.activationSourceConfig).toEqual({ plugins: { allow: ["demo-channel"] } });
     expect(channelOptions.env).toBe(env);
     expect(channelOptions.workspaceDir).toBe("/resolved-workspace");
-    expect(mocks.applyPluginAutoEnable).toHaveBeenCalledWith({
-      config: rawConfig,
-      env,
-    });
+    expect(mocks.applyPluginAutoEnable).toHaveBeenCalledWith(
+      expect.objectContaining({
+        config: rawConfig,
+        env,
+      }),
+    );
     const load = loadOptions();
     const loadConfig = requireRecord(load.config, "load config");
     expect(loadConfig.channels).toEqual(rawConfig.channels);
diff --git a/src/plugins/status.test.ts b/src/plugins/status.test.ts
@@ -74,6 +74,7 @@ vi.mock("./plugin-registry.js", () => ({
 vi.mock("./manifest-registry-installed.js", () => ({
   loadPluginManifestRegistryForInstalledIndex: (...args: unknown[]) =>
     loadPluginManifestRegistryForInstalledIndexMock(...args),
+  resolveInstalledManifestRegistryIndexFingerprint: () => "test-installed-index",
 }));
 
 vi.mock("./plugin-metadata-snapshot.js", () => ({
diff --git a/src/plugins/tools.optional.test.ts b/src/plugins/tools.optional.test.ts
@@ -224,6 +224,7 @@ function resolveAutoEnabledOptionalDemoTools() {
   const { rawContext, autoEnabledConfig } = createAutoEnabledOptionalContext();
   installToolManifestSnapshot({
     config: autoEnabledConfig,
+    compatibleConfigs: [rawContext.config],
     plugin: {
       id: "optional-demo",
       origin: "bundled",
@@ -273,18 +274,21 @@ function createOptionalDemoActiveRegistry() {
 
 function installToolManifestSnapshot(params: {
   config: ReturnType<typeof createContext>["config"];
+  compatibleConfigs?: ReturnType<typeof createContext>["config"][];
   env?: NodeJS.ProcessEnv;
   plugin: Record<string, unknown>;
 }) {
   installToolManifestSnapshots({
     config: params.config,
+    compatibleConfigs: params.compatibleConfigs,
     env: params.env,
     plugins: [params.plugin],
   });
 }
 
 function installToolManifestSnapshots(params: {
   config: ReturnType<typeof createContext>["config"];
+  compatibleConfigs?: ReturnType<typeof createContext>["config"][];
   env?: NodeJS.ProcessEnv;
   plugins: Record<string, unknown>[];
 }) {
@@ -341,7 +345,12 @@ function installToolManifestSnapshots(params: {
         manifestPluginCount: plugins.length,
       },
     } as never,
-    { config: params.config, env: params.env ?? process.env, workspaceDir: "/tmp" },
+    {
+      config: params.config,
+      compatibleConfigs: params.compatibleConfigs,
+      env: params.env ?? process.env,
+      workspaceDir: "/tmp",
+    },
   );
 }
 
diff --git a/test/scripts/openclaw-cross-os-release-checks.test.ts b/test/scripts/openclaw-cross-os-release-checks.test.ts
@@ -266,7 +266,7 @@ describe("scripts/openclaw-cross-os-release-checks", () => {
     const providerOverride = "models.providers.${params.providerConfig.extensionId}";
 
     expect(CROSS_OS_RELEASE_SMOKE_TOOLS_PROFILE).toBe("minimal");
-    expect(source).toContain('"--thinking",\n    "minimal"');
+    expect(source).toContain('"--thinking",\n    "off"');
     expect(source.match(/"tools\.profile", CROSS_OS_RELEASE_SMOKE_TOOLS_PROFILE/g)).toHaveLength(2);
     expect(CROSS_OS_AGENT_TURN_TIMEOUT_SECONDS).toBeGreaterThanOrEqual(600);
     expect(source).toContain("buildReleaseProviderConfigOverride");
diff --git a/test/scripts/parallels-smoke-model.test.ts b/test/scripts/parallels-smoke-model.test.ts
@@ -345,7 +345,7 @@ console.log(JSON.stringify(result));
         expect(script, scriptPath).toContain("tools.profile");
       }
       expect(script, scriptPath).toContain("--thinking");
-      expect(script, scriptPath).toContain("minimal");
+      expect(script, scriptPath).toContain("off");
       expect(script, scriptPath).toContain("finalAssistant(Raw|Visible)Text");
     }
     expect(readFileSync(TS_PATHS.macos, "utf8")).toContain("modelProviderConfigBatchJson");
@@ -363,7 +363,7 @@ console.log(JSON.stringify(result));
     expect(npmUpdateScripts).toContain("posixAgentWorkspaceScript");
     expect(npmUpdateScripts).toContain("windowsAgentWorkspaceScript");
     expect(npmUpdateScripts).toContain("tools.profile");
-    expect(npmUpdateScripts).toContain("--thinking minimal");
+    expect(npmUpdateScripts).toContain("--thinking off");
     expect(npmUpdateScripts).toContain("finalAssistant(Raw|Visible)Text");
     expect(npmUpdateScripts).toContain("posixAssertAgentOkScript");
     expect(npmUpdateScripts).toContain("windowsAgentTurnConfigPatchScript");
