Auto-merge upstream openclaw/openclaw

Author: friuns2

.agents/skills/openclaw-parallels-smoke/SKILL.md

@@ -29,7 +29,13 @@ Use this skill for Parallels guest workflows and smoke interpretation. Do not lo
 ## npm install then update
 
 - Preferred entrypoint: `pnpm test:parallels:npm-update`
-- Flow: fresh snapshot -> install npm package baseline -> smoke -> install current main tgz on the same guest -> smoke again.
+- Required coverage: every release/update regression run must include both lanes:
+  - fresh snapshot -> install requested package/baseline -> smoke
+  - same guest baseline -> run the guest's installed `openclaw update ...` command -> smoke again
+- The update lane must exercise OpenClaw's internal updater. Do not count a direct `npm install -g <tgz-or-spec>` or harness-side package swap as update-flow coverage; those are install smokes only.
+- For published targets, install the old baseline package first (for example `openclaw@2026.4.9`), then run the installed guest CLI with the intended channel/tag (for example `openclaw update --channel beta --yes --json`) and verify `openclaw --version`, `openclaw update status --json`, gateway RPC, and an agent turn after the command.
+- For unpublished targets, pack the candidate on the host, serve the `.tgz` over the harness HTTP server, and point the guest updater at that served package. Prefer `openclaw update --tag http://<host-ip>:<port>/openclaw-<version>.tgz --yes --json`; when channel persistence also matters, pass `--channel <stable|beta>` and set `OPENCLAW_UPDATE_PACKAGE_SPEC` to the same served URL in the guest update environment. The command under test must still be `openclaw update`, not direct npm.
+- For unpublished local-fix validation, remember the old baseline updater code still controls the first hop. A fix that lives only in the new updater code cannot change that already-running old process; the served candidate must either keep package/plugin metadata compatible with the baseline host or the baseline itself must include the updater fix.
 - For beta/stable verification, resolve the tag immediately before the run (`npm view openclaw@beta version dist.tarball` or `npm view openclaw@latest ...`). Tags can move while a long VM matrix is already running; restart the matrix when the intended prerelease appears after an earlier registry 404/tag-lag check.
 - Source Peter's profile in the host shell (`set -a; source "$HOME/.profile"; set +a`) before OpenAI/Anthropic lanes. Do not print profile contents or env dumps; pass provider secrets through the guest exec environment.
 - Same-guest update verification should set the default model explicitly to `openai/gpt-5.4` before the agent turn and use a fresh explicit `--session-id` so old session model state does not leak into the check.

CHANGELOG.md

@@ -7,11 +7,14 @@ Docs: https://docs.openclaw.ai
 ### Changes
 
 - Tools/video_generate: allow providers and plugins to return URL-only generated video assets so agent delivery and `openclaw capability video generate --output ...` can forward or stream large videos without requiring the full file in memory first. (#61988) Thanks @xieyongliang.
+- Models/providers: surface how configured OpenAI-compatible endpoints are classified in embedded-agent debug logs, so local and proxy routing issues are easier to diagnose. (#64754) Thanks @ImLukeF.
 
 ### Fixes
 
 - WhatsApp: honor the configured default account when the active listener helper is used without an explicit account id, so named default accounts do not get registered under `default`. (#53918) Thanks @yhyatt.
 - QA/packaging: stop packaged CLI startup and completion cache generation from reading repo-only QA scenario markdown by routing QA command registration through a narrow facade. (#64648) Thanks @obviyus.
+- QA/packaging: ship the bundled QA scenario pack in npm releases and keep `openclaw completion --write-state` working even if QA setup is broken, so missing QA content only degrades QA instead of breaking broader CLI startup-adjacent flows. Thanks @vincentkoc.
+- Codex/QA: keep Codex app-server coordination chatter out of visible replies, add a live QA leak scenario, and classify leaked harness meta text as a QA failure instead of a successful reply. Thanks @vincentkoc.
 - Control UI/webchat: persist agent-run TTS audio replies into webchat history before finalization so tool-generated audio reaches webchat clients again. (#63514) thanks @bittoby
 - macOS/Talk Mode: after granting microphone permission on first enable, continue starting Talk Mode instead of requiring a second toggle. (#62459) Thanks @ggarber.
 - OpenAI/Codex OAuth: stop rewriting the upstream authorize URL scopes so new Codex sign-ins do not fail with `invalid_scope` before returning an authorization code. (#64713) Thanks @fuller-stack-dev.

docs/plugins/architecture.md

@@ -519,10 +519,15 @@ The manifest is the control-plane source of truth. OpenClaw uses it to:
 - validate `plugins.entries.<id>.config`
 - augment Control UI labels/placeholders
 - show install/catalog metadata
+- preserve cheap activation and setup descriptors without loading plugin runtime
 
 For native plugins, the runtime module is the data-plane part. It registers
 actual behavior such as hooks, tools, commands, or provider flows.
 
+Optional manifest `activation` and `setup` blocks stay on the control plane.
+They are metadata-only descriptors for activation planning and setup discovery;
+they do not replace runtime registration, `register(...)`, or `setupEntry`.
+
 ### What the loader caches
 
 OpenClaw keeps short in-process caches for:

docs/plugins/manifest.md

@@ -47,6 +47,10 @@ Use it for:
 - config validation
 - auth and onboarding metadata that should be available without booting plugin
   runtime
+- cheap activation hints that control-plane surfaces can inspect before runtime
+  loads
+- cheap setup descriptors that setup/onboarding surfaces can inspect before
+  runtime loads
 - alias and auto-enable metadata that should resolve before plugin runtime loads
 - shorthand model-family ownership metadata that should auto-activate the
   plugin before runtime loads
@@ -152,6 +156,8 @@ Those belong in your plugin code and `package.json`.
 | `providerAuthAliases`               | No       | `Record<string, string>`         | Provider ids that should reuse another provider id for auth lookup, for example a coding provider that shares the base provider API key and auth profiles.                                                   |
 | `channelEnvVars`                    | No       | `Record<string, string[]>`       | Cheap channel env metadata that OpenClaw can inspect without loading plugin code. Use this for env-driven channel setup or auth surfaces that generic startup/config helpers should see.                     |
 | `providerAuthChoices`               | No       | `object[]`                       | Cheap auth-choice metadata for onboarding pickers, preferred-provider resolution, and simple CLI flag wiring.                                                                                                |
+| `activation`                        | No       | `object`                         | Cheap activation hints for provider, command, channel, route, and capability-triggered loading. Metadata only; plugin runtime still owns actual behavior.                                                    |
+| `setup`                             | No       | `object`                         | Cheap setup/onboarding descriptors that discovery and setup surfaces can inspect without loading plugin runtime.                                                                                             |
 | `contracts`                         | No       | `object`                         | Static bundled capability snapshot for speech, realtime transcription, realtime voice, media-understanding, image-generation, music-generation, video-generation, web-fetch, web search, and tool ownership. |
 | `channelConfigs`                    | No       | `Record<string, object>`         | Manifest-owned channel config metadata merged into discovery and validation surfaces before runtime loads.                                                                                                   |
 | `skills`                            | No       | `string[]`                       | Skill directories to load, relative to the plugin root.                                                                                                                                                      |
@@ -208,6 +214,77 @@ uses this metadata for diagnostics without importing plugin runtime code.
 | `kind`       | No       | `"runtime-slash"` | Marks the alias as a chat slash command rather than a root CLI command. |
 | `cliCommand` | No       | `string`          | Related root CLI command to suggest for CLI operations, if one exists.  |
 
+## activation reference
+
+Use `activation` when the plugin can cheaply declare which control-plane events
+should activate it later.
+
+This block is metadata only. It does not register runtime behavior, and it does
+not replace `register(...)`, `setupEntry`, or other runtime/plugin entrypoints.
+
+```json
+{
+  "activation": {
+    "onProviders": ["openai"],
+    "onCommands": ["models"],
+    "onChannels": ["web"],
+    "onRoutes": ["gateway-webhook"],
+    "onCapabilities": ["provider", "tool"]
+  }
+}
+```
+
+| Field            | Required | Type                                                 | What it means                                                     |
+| ---------------- | -------- | ---------------------------------------------------- | ----------------------------------------------------------------- |
+| `onProviders`    | No       | `string[]`                                           | Provider ids that should activate this plugin when requested.     |
+| `onCommands`     | No       | `string[]`                                           | Command ids that should activate this plugin.                     |
+| `onChannels`     | No       | `string[]`                                           | Channel ids that should activate this plugin.                     |
+| `onRoutes`       | No       | `string[]`                                           | Route kinds that should activate this plugin.                     |
+| `onCapabilities` | No       | `Array<"provider" \| "channel" \| "tool" \| "hook">` | Broad capability hints used by control-plane activation planning. |
+
+## setup reference
+
+Use `setup` when setup and onboarding surfaces need cheap plugin-owned metadata
+before runtime loads.
+
+```json
+{
+  "setup": {
+    "providers": [
+      {
+        "id": "openai",
+        "authMethods": ["api-key"],
+        "envVars": ["OPENAI_API_KEY"]
+      }
+    ],
+    "cliBackends": ["openai-cli"],
+    "configMigrations": ["legacy-openai-auth"],
+    "requiresRuntime": false
+  }
+}
+```
+
+Top-level `cliBackends` stays valid and continues to describe CLI inference
+backends. `setup.cliBackends` is the setup-specific descriptor surface for
+control-plane/setup flows that should stay metadata-only.
+
+### setup.providers reference
+
+| Field         | Required | Type       | What it means                                                                      |
+| ------------- | -------- | ---------- | ---------------------------------------------------------------------------------- |
+| `id`          | Yes      | `string`   | Provider id exposed during setup or onboarding.                                    |
+| `authMethods` | No       | `string[]` | Setup/auth method ids this provider supports without loading full runtime.         |
+| `envVars`     | No       | `string[]` | Env vars that generic setup/status surfaces can check before plugin runtime loads. |
+
+### setup fields
+
+| Field              | Required | Type       | What it means                                                               |
+| ------------------ | -------- | ---------- | --------------------------------------------------------------------------- |
+| `providers`        | No       | `object[]` | Provider setup descriptors exposed during setup and onboarding.             |
+| `cliBackends`      | No       | `string[]` | Setup-time backend ids available without full runtime activation.           |
+| `configMigrations` | No       | `string[]` | Config migration ids owned by this plugin's setup surface.                  |
+| `requiresRuntime`  | No       | `boolean`  | Whether setup still needs plugin runtime execution after descriptor lookup. |
+
 ## uiHints reference
 
 `uiHints` is a map from config field names to small rendering hints.

extensions/browser/src/browser/control-auth.ts

@@ -3,8 +3,8 @@ import {
   normalizeLowercaseStringOrEmpty,
   normalizeOptionalString,
 } from "openclaw/plugin-sdk/text-runtime";
-import type { OpenClawConfig } from "../config/config.js";
 import { loadConfig, writeConfigFile } from "../config/config.js";
+import type { OpenClawConfig } from "../config/types.openclaw.js";
 import { resolveGatewayAuth } from "../gateway/auth.js";
 import { ensureGatewayStartupAuth } from "../gateway/startup-auth.js";
 

extensions/browser/src/doctor-browser.ts

@@ -5,7 +5,7 @@ import {
   readBrowserVersion,
   resolveGoogleChromeExecutableForPlatform,
 } from "./browser/chrome.executables.js";
-import type { OpenClawConfig } from "./config/config.js";
+import type { OpenClawConfig } from "./config/types.openclaw.js";
 import { asRecord } from "./record-shared.js";
 
 const CHROME_MCP_MIN_MAJOR = 144;

extensions/codex/src/app-server/event-projector.test.ts

@@ -79,14 +79,87 @@ describe("CodexAppServerEventProjector", () => {
     });
 
     expect(onAssistantMessageStart).toHaveBeenCalledTimes(1);
-    expect(onPartialReply).toHaveBeenLastCalledWith({ text: "hello" });
+    expect(onPartialReply).not.toHaveBeenCalled();
     expect(result.assistantTexts).toEqual(["hello"]);
     expect(result.messagesSnapshot.map((message) => message.role)).toEqual(["user", "assistant"]);
     expect(result.lastAssistant?.content).toEqual([{ type: "text", text: "hello" }]);
     expect(result.attemptUsage).toMatchObject({ input: 5, output: 7, cacheRead: 2, total: 12 });
     expect(result.replayMetadata.replaySafe).toBe(true);
   });
 
+  it("keeps intermediate agentMessage items out of the final visible reply", async () => {
+    const onAssistantMessageStart = vi.fn();
+    const onPartialReply = vi.fn();
+    const params = {
+      ...createParams(),
+      onAssistantMessageStart,
+      onPartialReply,
+    };
+    const projector = new CodexAppServerEventProjector(params, "thread-1", "turn-1");
+
+    await projector.handleNotification({
+      method: "item/agentMessage/delta",
+      params: {
+        threadId: "thread-1",
+        turnId: "turn-1",
+        itemId: "msg-commentary",
+        delta: "checking thread context; then post a tight progress reply here.",
+      },
+    });
+    await projector.handleNotification({
+      method: "item/agentMessage/delta",
+      params: {
+        threadId: "thread-1",
+        turnId: "turn-1",
+        itemId: "msg-final",
+        delta: "release fixes first. please drop affected PRs, failing checks, and blockers here.",
+      },
+    });
+    await projector.handleNotification({
+      method: "turn/completed",
+      params: {
+        threadId: "thread-1",
+        turnId: "turn-1",
+        turn: {
+          id: "turn-1",
+          status: "completed",
+          items: [
+            {
+              type: "agentMessage",
+              id: "msg-commentary",
+              text: "checking thread context; then post a tight progress reply here.",
+            },
+            {
+              type: "agentMessage",
+              id: "msg-final",
+              text: "release fixes first. please drop affected PRs, failing checks, and blockers here.",
+            },
+          ],
+        },
+      },
+    });
+
+    const result = projector.buildResult({
+      didSendViaMessagingTool: false,
+      messagingToolSentTexts: [],
+      messagingToolSentMediaUrls: [],
+      messagingToolSentTargets: [],
+    });
+
+    expect(onAssistantMessageStart).toHaveBeenCalledTimes(1);
+    expect(onPartialReply).not.toHaveBeenCalled();
+    expect(result.assistantTexts).toEqual([
+      "release fixes first. please drop affected PRs, failing checks, and blockers here.",
+    ]);
+    expect(result.lastAssistant?.content).toEqual([
+      {
+        type: "text",
+        text: "release fixes first. please drop affected PRs, failing checks, and blockers here.",
+      },
+    ]);
+    expect(JSON.stringify(result.messagesSnapshot)).not.toContain("checking thread context");
+  });
+
   it("ignores notifications for other turns", async () => {
     const params = createParams();
     const projector = new CodexAppServerEventProjector(params, "thread-1", "turn-1");

extensions/codex/src/app-server/event-projector.ts

@@ -44,6 +44,7 @@ const ZERO_USAGE: Usage = {
 
 export class CodexAppServerEventProjector {
   private readonly assistantTextByItem = new Map<string, string>();
+  private readonly assistantItemOrder: string[] = [];
   private readonly reasoningTextByItem = new Map<string, string>();
   private readonly planTextByItem = new Map<string, string>();
   private readonly activeItemIds = new Set<string>();
@@ -210,9 +211,12 @@ export class CodexAppServerEventProjector {
       this.assistantStarted = true;
       await this.params.onAssistantMessageStart?.();
     }
+    this.rememberAssistantItem(itemId);
     const text = `${this.assistantTextByItem.get(itemId) ?? ""}${delta}`;
     this.assistantTextByItem.set(itemId, text);
-    await this.params.onPartialReply?.({ text });
+    // Codex app-server can emit multiple agentMessage items per turn, including
+    // intermediate coordination/progress prose. Keep those deltas internal until
+    // turn completion chooses the last assistant item as the user-visible reply.
   }
 
   private async handleReasoningDelta(params: JsonObject): Promise<void> {
@@ -291,6 +295,7 @@ export class CodexAppServerEventProjector {
       this.completedItemIds.add(itemId);
     }
     if (item?.type === "agentMessage" && typeof item.text === "string" && item.text) {
+      this.rememberAssistantItem(item.id);
       this.assistantTextByItem.set(item.id, item.text);
     }
     if (item?.type === "plan" && typeof item.text === "string" && item.text) {
@@ -348,6 +353,7 @@ export class CodexAppServerEventProjector {
     }
     for (const item of turn.items ?? []) {
       if (item.type === "agentMessage" && typeof item.text === "string" && item.text) {
+        this.rememberAssistantItem(item.id);
         this.assistantTextByItem.set(item.id, item.text);
       }
       if (item.type === "plan" && typeof item.text === "string" && item.text) {
@@ -425,7 +431,29 @@ export class CodexAppServerEventProjector {
   }
 
   private collectAssistantTexts(): string[] {
-    return [...this.assistantTextByItem.values()].filter((text) => text.trim().length > 0);
+    const finalText = this.resolveFinalAssistantText();
+    return finalText ? [finalText] : [];
+  }
+
+  private resolveFinalAssistantText(): string | undefined {
+    for (let i = this.assistantItemOrder.length - 1; i >= 0; i -= 1) {
+      const itemId = this.assistantItemOrder[i];
+      if (!itemId) {
+        continue;
+      }
+      const text = this.assistantTextByItem.get(itemId)?.trim();
+      if (text) {
+        return text;
+      }
+    }
+    return undefined;
+  }
+
+  private rememberAssistantItem(itemId: string): void {
+    if (!itemId || this.assistantItemOrder.includes(itemId)) {
+      return;
+    }
+    this.assistantItemOrder.push(itemId);
   }
 
   private createAssistantMessage(text: string): AssistantMessage {

extensions/qa-lab/cli.ts

@@ -1 +1 @@
-export { registerQaLabCli } from "./src/cli.js";
+export { isQaLabCliAvailable, registerQaLabCli } from "./src/cli.js";