@codex review

Greptile Summary

This PR fixes a discovery regression where talk.config passed unresolved SecretRef objects into resolveTalkConfig because it prioritised the source (disk) config over the active runtime config. The fix is a single priority swap in resolveTalkResponseFromConfig (runtimeResolved?.config ?? sourceResolved?.config instead of the reverse), and a new integration-level test validates both that the source SecretRef stays redacted in the response and that the provider resolution receives the resolved string value.

Confidence Score: 5/5

Safe to merge — minimal one-line logic fix with correct test coverage and no security regressions.

The change is a single-line priority swap with a well-structured test that exercises the failure scenario. No P0/P1 issues found; the only observation is a dead mock setup line in the new test.

No files require special attention.

This is a comment left during a code review.
Path: src/gateway/server-methods/talk.test.ts
Line: 130

Comment:
**Unused mock setup**

`mocks.getRuntimeConfig.mockReturnValue(runtimeConfig)` has no effect in this test. The `talk.config` handler reads runtime config via `context.getRuntimeConfig()`, which is provided inline as `{ getRuntimeConfig: () => runtimeConfig }` at line 162 — bypassing the hoisted mock entirely. Consider removing this line to avoid misleading future maintainers.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(talk): resolve config from runtime s..." | Re-trigger Greptile}

Addressed the review notes in e78c17371c: removed the unused runtime-config mock setup and kept the resolved provider config paired with the selected provider when source/runtime snapshots diverge. Focused Talk tests pass locally:

CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- test src/gateway/server-methods/talk.test.ts src/gateway/server.talk-config.test.ts

@codex review latest head, please

Addressed the unresolved Codex P1 in 42c758e9cd: when source and runtime Talk providers diverge, talk.config now returns the redacted source payload without feeding unresolved source SecretRefs into resolveTalkConfig. Local checks pass: focused talk gateway test, format/lint on touched files, and check:changed. @codex review

Codex Review: Didn't find any major issues. Another round soon, please!

Rebased onto current upstream main and resolved the Talk config conflicts. The resolution keeps the upstream Google Live gateway-relay regression test, preserves source SecretRef redaction, and avoids resolving stale source provider configs when runtime/source providers diverge.

Local checks:

• CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- test src/gateway/server-methods/talk.test.ts src/gateway/server.talk-config.test.ts
• npm exec pnpm@10.33.0 -- exec oxfmt --check CHANGELOG.md src/gateway/server-methods/talk.ts src/gateway/server-methods/talk.test.ts

@codex review

Rebased again onto current upstream main (0ff60d162c) and pushed the refreshed branch. The prior check-test-types failure was also reproducing on upstream main, and the newer base includes the fixture typing fix; I also verified the previously failing CLI shard locally.

Local checks:

• CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- test src/gateway/server-methods/talk.test.ts src/gateway/server.talk-config.test.ts src/cli/run-main.exit.test.ts
• CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- run check:test-types
• npm exec pnpm@10.33.0 -- exec oxfmt --check CHANGELOG.md src/gateway/server-methods/talk.ts src/gateway/server-methods/talk.test.ts

@codex review

Codex Review: Didn't find any major issues. 👍

Rebased #72792 onto current upstream main and resolved the Talk config conflicts.

Conflict resolution kept both sides of the recent changes:

• preserved the runtime-resolved SecretRef path for provider resolvers
• preserved the newer source/runtime provider-divergence behavior so unresolved source SecretRefs are not fed into strict provider helpers
• kept base TTS SecretRef wrappers stripped when runtime TTS config is unavailable

Local verification:

• CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- test src/gateway/server-methods/talk.test.ts
• CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- run check:changed

@codex review

Codex Review: Didn't find any major issues. Keep it up!

Pushed a QA-only follow-up for the parity failure. The thread-memory-isolation scenario now uses the same direct qa-channel target delivery path as other stable QA scenarios, while still asserting the memory-backed answer lands in the thread and does not leak to the root channel.

Local verification:

• CI=true OPENCLAW_LOCAL_CHECK=0 OPENCLAW_BUILD_PRIVATE_QA=1 OPENCLAW_ENABLE_PRIVATE_QA_CLI=1 OPENCLAW_QA_TRANSPORT_READY_TIMEOUT_MS=180000 npm exec pnpm@10.33.0 -- openclaw qa suite --provider-mode mock-openai --scenario thread-memory-isolation --concurrency 1 --model '' --alt-model openai/gpt-5.4-alt --output-dir .artifacts/qa-e2e/local-thread-memory-patched-72792
• CI=true OPENCLAW_LOCAL_CHECK=0 OPENCLAW_BUILD_PRIVATE_QA=1 OPENCLAW_ENABLE_PRIVATE_QA_CLI=1 QA_PARITY_CONCURRENCY=1 OPENCLAW_QA_TRANSPORT_READY_TIMEOUT_MS=180000 npm exec pnpm@10.33.0 -- openclaw qa suite --provider-mode mock-openai --parity-pack agentic --concurrency 1 --model '' --alt-model openai/gpt-5.4-alt --output-dir .artifacts/qa-e2e/local-agentic-parity-patched-72792

@codex review

Codex Review: Didn't find any major issues. Nice work!

Pushed a11d501a6e to address the current CI failure in checks-node-core-fast-support.

What changed:

• isolated src/video-generation/provider-registry.test.ts imports behind vi.resetModules() so this test always observes the mocked capability-provider boundary, even when scheduled with other fast-support tests that load real plugin providers

Verification:

• CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- test src/video-generation/provider-registry.test.ts
• CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- test src/video-generation/provider-registry.test.ts src/video-generation/video-tools.test.ts src/video-generation/provider-selection.test.ts
• CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- run check:changed

@codex review

Codex review: needs real behavior proof before merge.

Latest ClawSweeper review: 2026-05-20 23:08 UTC / May 20, 2026, 7:08 PM ET.

Workflow note: Future ClawSweeper reviews update this same comment in place.

Summary
The PR updates talk.config to use provider-matched runtime/source config before redaction, adds Talk regression tests, adjusts the thread-memory QA scenario, and adds a changelog entry.

Reproducibility: yes. source-reproducible: current main can select the source Talk provider while feeding a different non-empty runtime provider config into that provider resolver. I did not run a live gateway repro in this read-only review, but the source path, provider contracts, docs, and PR tests make the failure mode high-confidence.

PR rating
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Summary: The implementation looks sound and tested, but overall readiness is capped by missing real behavior proof and the small extra QA-scenario scope.

Rank-up moves:

• Attach redacted after-fix openclaw gateway call talk.config or client discovery proof for a SecretRef-backed Talk provider.

Real behavior proof
Needs real behavior proof before merge: Needs real behavior proof before merge: only tests, CI, and local command claims are present; attach redacted after-fix gateway/client output, logs, terminal output, recording, or artifact, then update the PR body to trigger re-review or ask a maintainer for @clawsweeper re-review.

Risk before merge

• No redacted after-fix real gateway/client proof is attached; the available evidence is tests, CI, and local command claims.
• The PR also changes a QA memory scenario outside the Talk config fix; it is test-surface only, but maintainers should accept that scope or split it before landing.

Maintainer options:

1. Decide the mitigation before merge
   Land the provider-matched Talk handler and focused regression coverage after redacted real gateway/client proof is added or a maintainer explicitly overrides the proof gate.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge
Needs contributor real behavior proof or a maintainer proof override; there is no narrow automated repair because the code review found no blocking patch defect.

Security
Cleared: No concrete security or supply-chain regression found; the diff keeps talk.config responses on the existing redaction path while narrowing when resolved secrets enter provider helpers.

Rebased on upstream main and force-pushed 1982696a14.

Post-rebase verification:

• CI=true OPENCLAW_LOCAL_CHECK=0 npm exec pnpm@10.33.0 -- test src/video-generation/provider-registry.test.ts src/auto-reply/reply/commands-status.thinking-default.test.ts

Note: I also tried including qa/scenarios/memory/thread-memory-isolation.md in pnpm test, but that path is a QA scenario markdown file rather than a Vitest file, so the test runner correctly reported no matching test files for that path. The actual QA scenario had already passed in the earlier local QA run after the scenario fix.

@codex review

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/25627637199
• Updated: 2026-05-10T11:39:24.789Z

Codex Review: Didn't find any major issues. You're on a roll.

ClawSweeper PR egg

🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.