Auto-merge upstream openclaw/openclaw

Author: friuns2

CHANGELOG.md

@@ -10,8 +10,11 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- QQBot/media-tags: support HTML entity-encoded angle brackets (`&lt;`/`&gt;`) in media-tag regexes so entity-escaped `<qqimg>` tags from upstream are correctly parsed and normalized. (#60493) Thanks @ylc0919.
 - Slack/media: preserve bearer auth across same-origin `files.slack.com` redirects while still stripping it on cross-origin Slack CDN hops, so `url_private_download` image attachments load again. (#62960) Thanks @vincentkoc.
 - Control UI: guard stale session-history reloads during fast session switches so the selected session and rendered transcript stay in sync. (#62975) Thanks @scoootscooob.
+- Agents/failover: classify Z.ai vendor code `1311` as billing and `1113` as auth, including long wrapped `1311` payloads, so these errors stop falling through to generic failover handling. (#49552) Thanks @1bcMax.
+- npm packaging: mirror bundled Slack, Telegram, Discord, and Feishu channel runtime deps at the root and harden published-install verification so fresh installs fail fast on manifest drift instead of missing-module crashes. (#63065) Thanks @scoootscooob.
 
 ## 2026.4.8
 

extensions/discord/package.json

@@ -60,6 +60,14 @@
     "bundle": {
       "stageRuntimeDependencies": true
     },
+    "releaseChecks": {
+      "rootDependencyMirrorAllowlist": [
+        "@buape/carbon",
+        "@discordjs/opus",
+        "https-proxy-agent",
+        "opusscript"
+      ]
+    },
     "release": {
       "publishToClawHub": true,
       "publishToNpm": true

extensions/feishu/package.json

@@ -51,6 +51,11 @@
     "bundle": {
       "stageRuntimeDependencies": true
     },
+    "releaseChecks": {
+      "rootDependencyMirrorAllowlist": [
+        "@larksuiteoapi/node-sdk"
+      ]
+    },
     "release": {
       "publishToClawHub": true,
       "publishToNpm": true

extensions/qa-channel/src/channel.test.ts

@@ -67,7 +67,7 @@ function createMockQaRuntime(): PluginRuntime {
 }
 
 describe("qa-channel plugin", () => {
-  it("roundtrips inbound DM traffic through the qa bus", async () => {
+  it("roundtrips inbound DM traffic through the qa bus", { timeout: 20_000 }, async () => {
     const state = createQaBusState();
     const bus = await startQaBusServer({ state });
     setQaChannelRuntime(createMockQaRuntime());
@@ -106,7 +106,7 @@ describe("qa-channel plugin", () => {
         kind: "message-text",
         textIncludes: "qa-echo: hello",
         direction: "outbound",
-        timeoutMs: 5_000,
+        timeoutMs: 15_000,
       });
       expect("text" in outbound && outbound.text).toContain("qa-echo: hello");
     } finally {

extensions/qa-lab/src/gateway-child.ts

@@ -48,6 +48,20 @@ const QA_MOCK_BLOCKED_ENV_VARS = Object.freeze([
   "VOYAGE_API_KEY",
 ]);
 
+const QA_MOCK_BLOCKED_ENV_KEY_PATTERNS = Object.freeze([
+  /^DISCORD_/i,
+  /^TELEGRAM_/i,
+  /^SLACK_/i,
+  /^MATRIX_/i,
+  /^SIGNAL_/i,
+  /^WHATSAPP_/i,
+  /^IMESSAGE_/i,
+  /^ZALO/i,
+  /^TWILIO_/i,
+  /^PLIVO_/i,
+  /^NGROK_/i,
+]);
+
 async function getFreePort() {
   return await new Promise<number>((resolve, reject) => {
     const server = net.createServer();
@@ -71,6 +85,11 @@ export function normalizeQaProviderModeEnv(
     for (const key of QA_MOCK_BLOCKED_ENV_VARS) {
       delete env[key];
     }
+    for (const key of Object.keys(env)) {
+      if (QA_MOCK_BLOCKED_ENV_KEY_PATTERNS.some((pattern) => pattern.test(key))) {
+        delete env[key];
+      }
+    }
     return env;
   }
 
@@ -250,14 +269,24 @@ async function createQaBundledPluginsDir(params: {
     await fs.rm(stagedRoot, { recursive: true, force: true });
     await fs.mkdir(stagedRoot, { recursive: true });
     const stagedTreeRoot = path.join(stagedRoot, path.basename(sourceTreeRoot));
-    await fs.cp(sourceTreeRoot, stagedTreeRoot, { recursive: true });
-    const stagedExtensionsDir = path.join(stagedTreeRoot, "extensions");
-    for (const entry of await fs.readdir(stagedExtensionsDir, { withFileTypes: true })) {
-      if (!entry.isDirectory() || params.allowedPluginIds.includes(entry.name)) {
+    await fs.mkdir(stagedTreeRoot, { recursive: true });
+    for (const entry of await fs.readdir(sourceTreeRoot, { withFileTypes: true })) {
+      const sourcePath = path.join(sourceTreeRoot, entry.name);
+      const targetPath = path.join(stagedTreeRoot, entry.name);
+      if (entry.name === "extensions") {
+        await fs.mkdir(targetPath, { recursive: true });
+        for (const pluginId of params.allowedPluginIds) {
+          const sourceDir = path.join(sourceRoot, pluginId);
+          if (!existsSync(sourceDir)) {
+            throw new Error(`qa bundled plugin not found: ${pluginId} (${sourceDir})`);
+          }
+          await fs.cp(sourceDir, path.join(targetPath, pluginId), { recursive: true });
+        }
         continue;
       }
-      await fs.rm(path.join(stagedExtensionsDir, entry.name), { recursive: true, force: true });
+      await fs.symlink(sourcePath, targetPath);
     }
+    const stagedExtensionsDir = path.join(stagedTreeRoot, "extensions");
     return {
       bundledPluginsDir: stagedExtensionsDir,
       stagedRoot,
@@ -386,8 +415,12 @@ export async function startQaGatewayChild(params: {
     controlUiEnabled: params.controlUiEnabled,
   });
   await fs.writeFile(configPath, `${JSON.stringify(cfg, null, 2)}\n`, "utf8");
-  const allowedPluginIds = (cfg.plugins?.allow ?? []).filter(
-    (pluginId): pluginId is string => typeof pluginId === "string" && pluginId.length > 0,
+  const allowedPluginIds = [...(cfg.plugins?.allow ?? []), "openai"].filter(
+    (pluginId, index, array): pluginId is string => {
+      return (
+        typeof pluginId === "string" && pluginId.length > 0 && array.indexOf(pluginId) === index
+      );
+    },
   );
   const bundledPluginsSourceRoot = resolveQaBundledPluginsSourceRoot(params.repoRoot);
   const { bundledPluginsDir, stagedRoot: stagedBundledPluginsRoot } =

extensions/qa-lab/src/mock-openai-server.test.ts

@@ -169,6 +169,62 @@ describe("qa mock openai server", () => {
     ]);
   });
 
+  it("supports exact reply memory prompts and embeddings requests", async () => {
+    const server = await startQaMockOpenAiServer({
+      host: "127.0.0.1",
+      port: 0,
+    });
+    cleanups.push(async () => {
+      await server.stop();
+    });
+
+    const remember = await fetch(`${server.baseUrl}/v1/responses`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+      },
+      body: JSON.stringify({
+        stream: false,
+        input: [
+          {
+            role: "user",
+            content: [
+              {
+                type: "input_text",
+                text: "Please remember this fact for later: the QA canary code is ALPHA-7. Reply exactly `Remembered ALPHA-7.` once stored.",
+              },
+            ],
+          },
+        ],
+      }),
+    });
+    expect(remember.status).toBe(200);
+    const rememberPayload = (await remember.json()) as {
+      output?: Array<{ content?: Array<{ text?: string }> }>;
+    };
+    expect(rememberPayload.output?.[0]?.content?.[0]?.text).toBe("Remembered ALPHA-7.");
+
+    const embeddings = await fetch(`${server.baseUrl}/v1/embeddings`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+      },
+      body: JSON.stringify({
+        model: "text-embedding-3-small",
+        input: ["Project Nebula ORBIT-10", "Project Nebula ORBIT-9"],
+      }),
+    });
+    expect(embeddings.status).toBe(200);
+    const embeddingPayload = (await embeddings.json()) as {
+      data?: Array<{ embedding?: number[]; index?: number }>;
+      model?: string;
+    };
+    expect(embeddingPayload.model).toBe("text-embedding-3-small");
+    expect(embeddingPayload.data).toHaveLength(2);
+    expect(embeddingPayload.data?.[0]?.index).toBe(0);
+    expect(embeddingPayload.data?.[0]?.embedding?.length).toBeGreaterThan(0);
+  });
+
   it("requests non-threaded subagent handoff for QA channel runs", async () => {
     const server = await startQaMockOpenAiServer({
       host: "127.0.0.1",

extensions/qa-lab/src/mock-openai-server.ts

@@ -66,6 +66,40 @@ function writeSse(res: ServerResponse, events: StreamEvent[]) {
   res.end(body);
 }
 
+function countApproxTokens(text: string) {
+  const trimmed = text.trim();
+  if (!trimmed) {
+    return 0;
+  }
+  return Math.max(1, Math.ceil(trimmed.length / 4));
+}
+
+function extractEmbeddingInputTexts(input: unknown): string[] {
+  if (typeof input === "string") {
+    return [input];
+  }
+  if (Array.isArray(input)) {
+    return input.flatMap((entry) => extractEmbeddingInputTexts(entry));
+  }
+  if (
+    input &&
+    typeof input === "object" &&
+    typeof (input as { text?: unknown }).text === "string"
+  ) {
+    return [(input as { text: string }).text];
+  }
+  return [];
+}
+
+function buildDeterministicEmbedding(text: string, dimensions = 16) {
+  const values = Array.from({ length: dimensions }, () => 0);
+  for (let index = 0; index < text.length; index += 1) {
+    values[index % dimensions] += text.charCodeAt(index) / 255;
+  }
+  const magnitude = Math.hypot(...values) || 1;
+  return values.map((value) => Number((value / magnitude).toFixed(8)));
+}
+
 function extractLastUserText(input: ResponsesInputItem[]) {
   for (let index = input.length - 1; index >= 0; index -= 1) {
     const item = input[index];
@@ -286,8 +320,21 @@ function extractOrbitCode(text: string) {
 }
 
 function extractExactReplyDirective(text: string) {
-  const match = /reply with exactly:\s*([^\n]+)/i.exec(text);
-  return match?.[1]?.trim() || null;
+  const colonMatch = /reply(?: with)? exactly:\s*([^\n]+)/i.exec(text);
+  if (colonMatch?.[1]) {
+    return colonMatch[1].trim();
+  }
+  const backtickedMatch = /reply(?: with)? exactly\s+`([^`]+)`/i.exec(text);
+  return backtickedMatch?.[1]?.trim() || null;
+}
+
+function extractExactMarkerDirective(text: string) {
+  const backtickedMatch = /exact marker:\s*`([^`]+)`/i.exec(text);
+  if (backtickedMatch?.[1]) {
+    return backtickedMatch[1].trim();
+  }
+  const plainMatch = /exact marker:\s*([^\s`.,;:!?]+(?:-[^\s`.,;:!?]+)*)/i.exec(text);
+  return plainMatch?.[1]?.trim() || null;
 }
 
 function isHeartbeatPrompt(text: string) {
@@ -311,11 +358,15 @@ function buildAssistantText(input: ResponsesInputItem[], body: Record<string, un
   const orbitCode = extractOrbitCode(memorySnippet);
   const mediaPath = /MEDIA:([^\n]+)/.exec(toolOutput)?.[1]?.trim();
   const exactReplyDirective = extractExactReplyDirective(allInputText);
+  const exactMarkerDirective = extractExactMarkerDirective(allInputText);
   const imageInputCount = countImageInputs(input);
 
   if (/what was the qa canary code/i.test(prompt) && rememberedFact) {
     return `Protocol note: the QA canary code was ${rememberedFact}.`;
   }
+  if (/remember this fact/i.test(prompt) && exactReplyDirective) {
+    return exactReplyDirective;
+  }
   if (/remember this fact/i.test(prompt) && rememberedFact) {
     return `Protocol note: acknowledged. I will remember ${rememberedFact}.`;
   }
@@ -328,6 +379,9 @@ function buildAssistantText(input: ResponsesInputItem[], body: Record<string, un
   if (/\bmarker\b/i.test(prompt) && exactReplyDirective) {
     return exactReplyDirective;
   }
+  if (/\bmarker\b/i.test(prompt) && exactMarkerDirective) {
+    return exactMarkerDirective;
+  }
   if (/visible skill marker/i.test(prompt)) {
     return "VISIBLE-SKILL-OK";
   }
@@ -377,7 +431,8 @@ function buildAssistantText(input: ResponsesInputItem[], body: Record<string, un
     return "Protocol note: delegated fanout complete. Alpha=ALPHA-OK. Beta=BETA-OK.";
   }
   if (toolOutput && (/\bdelegate\b/i.test(prompt) || /subagent handoff/i.test(prompt))) {
-    return `Protocol note: delegated result acknowledged. The bounded subagent task returned and is folded back into the main thread.`;
+    const compact = toolOutput.replace(/\s+/g, " ").trim() || "no delegated output";
+    return `Delegated task:\n- Inspect the QA workspace via a bounded subagent.\nResult:\n- ${compact}\nEvidence:\n- The child result was folded back into the main thread exactly once.`;
   }
   if (toolOutput && /worked, failed, blocked|worked\/failed\/blocked|follow-up/i.test(prompt)) {
     return `Worked:\n- Read seeded QA material.\n- Expanded the report structure.\nFailed:\n- None observed in mock mode.\nBlocked:\n- No live provider evidence in this lane.\nFollow-up:\n- Re-run with a real model for qualitative coverage.`;
@@ -647,6 +702,7 @@ export async function startQaMockOpenAiServer(params?: { host?: string; port?: n
           { id: "gpt-5.4", object: "model" },
           { id: "gpt-5.4-alt", object: "model" },
           { id: "gpt-image-1", object: "model" },
+          { id: "text-embedding-3-small", object: "model" },
         ],
       });
       return;
@@ -680,6 +736,28 @@ export async function startQaMockOpenAiServer(params?: { host?: string; port?: n
       });
       return;
     }
+    if (req.method === "POST" && url.pathname === "/v1/embeddings") {
+      const raw = await readBody(req);
+      const body = raw ? (JSON.parse(raw) as Record<string, unknown>) : {};
+      const inputs = extractEmbeddingInputTexts(body.input);
+      writeJson(res, 200, {
+        object: "list",
+        data: inputs.map((text, index) => ({
+          object: "embedding",
+          index,
+          embedding: buildDeterministicEmbedding(text),
+        })),
+        model:
+          typeof body.model === "string" && body.model.trim()
+            ? body.model
+            : "text-embedding-3-small",
+        usage: {
+          prompt_tokens: inputs.reduce((sum, text) => sum + countApproxTokens(text), 0),
+          total_tokens: inputs.reduce((sum, text) => sum + countApproxTokens(text), 0),
+        },
+      });
+      return;
+    }
     if (req.method === "POST" && url.pathname === "/v1/responses") {
       const raw = await readBody(req);
       const body = raw ? (JSON.parse(raw) as Record<string, unknown>) : {};

extensions/qa-lab/src/report.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { renderQaMarkdownReport } from "./report.js";
+
+describe("renderQaMarkdownReport", () => {
+  it("renders multiline scenario details in fenced blocks", () => {
+    const report = renderQaMarkdownReport({
+      title: "QA",
+      startedAt: new Date("2026-04-08T10:00:00.000Z"),
+      finishedAt: new Date("2026-04-08T10:00:02.000Z"),
+      scenarios: [
+        {
+          name: "Character vibes: Gollum improv",
+          status: "pass",
+          steps: [
+            {
+              name: "records transcript",
+              status: "pass",
+              details: "USER Alice: hello\n\nASSISTANT OpenClaw: my precious build",
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(report).toContain("```text");
+    expect(report).toContain("USER Alice: hello");
+    expect(report).toContain("ASSISTANT OpenClaw: my precious build");
+  });
+});