Skip to content

fix(tts/xiaomi): support Token Plan TTS endpoint#79185

Open
kidding1412 wants to merge 2 commits into
openclaw:mainfrom
kidding1412:fix-xiaomi-tts-bearer-auth
Open

fix(tts/xiaomi): support Token Plan TTS endpoint#79185
kidding1412 wants to merge 2 commits into
openclaw:mainfrom
kidding1412:fix-xiaomi-tts-bearer-auth

Conversation

@kidding1412

@kidding1412 kidding1412 commented May 8, 2026

Copy link
Copy Markdown

Summary

Fix Xiaomi MiMo TTS for Token Plan users by:

  • sending Xiaomi TTS requests with Authorization: Bearer <key> instead of the api-key header
  • reusing models.providers.xiaomi.baseUrl for Xiaomi TTS when messages.tts.providers.xiaomi.baseUrl is not configured
  • preserving explicit TTS baseUrl overrides for users who need speech to use a different endpoint
  • documenting Token Plan regional endpoints such as token-plan-cn and token-plan-ams

This handles the Token Plan failure mode where tp-... keys must call the matching regional Token Plan endpoint instead of the default pay-as-you-go endpoint.

Closes #77692

Real behavior proof

Behavior or issue addressed: Xiaomi MiMo TTS with a Token Plan key should call the regional Token Plan endpoint and synthesize audio successfully instead of returning 401 Invalid API Key from the default pay-as-you-go endpoint.

Real environment tested: Local Mac mini OpenClaw checkout using a real Xiaomi MiMo Token Plan key against https://token-plan-cn.xiaomimimo.com/v1. The key was kept local and was not pasted into the PR, issue, logs, or code.

Exact steps or command run after this patch:

set +x
export XIAOMI_API_KEY="<redacted real Token Plan key>"
export XIAOMI_BASE_URL="https://token-plan-cn.xiaomimimo.com/v1"
export OPENCLAW_LIVE_TEST=1
npx [email protected] vitest run --config test/vitest/vitest.live.config.ts extensions/xiaomi/xiaomi.live.test.ts
unset XIAOMI_API_KEY XIAOMI_BASE_URL OPENCLAW_LIVE_TEST

Evidence after fix: Copied live terminal output from the local run, with secrets redacted:

Result: PASS
baseUrl: token-plan-cn
Command: npx [email protected] vitest run --config test/vitest/vitest.live.config.ts extensions/xiaomi/xiaomi.live.test.ts
Tests: 2 passed
Endpoint: https://token-plan-cn.xiaomimimo.com/v1
Confirmed default endpoint was not used: https://api.xiaomimimo.com/v1

Passed live cases:
1. synthesizes MiMo TTS through the registered speech provider - 2.1s
2. synthesizes MiMo TTS as an Opus voice note - 13.1s

Observed result after fix: Both live Xiaomi TTS paths succeeded with the real Token Plan endpoint: MP3 audio-file synthesis and Opus voice-note synthesis. The run used token-plan-cn and did not hit the default pay-as-you-go endpoint.

What was not tested: token-plan-ams was not live-tested in this run. Unit coverage verifies models.providers.xiaomi.baseUrl inheritance and explicit TTS baseUrl precedence; the live run used XIAOMI_BASE_URL to target token-plan-cn.

Verification

  • npx [email protected] test extensions/xiaomi/speech-provider.test.ts
    • 14 passed
  • npx [email protected] exec oxfmt --check --threads=1 CHANGELOG.md docs/providers/xiaomi.md docs/tools/tts.md extensions/xiaomi/speech-provider.ts extensions/xiaomi/speech-provider.test.ts
    • passed
  • git diff --check
    • passed
  • Live Token Plan CN verification from the local Mac mini environment:
    • npx [email protected] vitest run --config test/vitest/vitest.live.config.ts extensions/xiaomi/xiaomi.live.test.ts
    • 2 passed
    • endpoint: https://token-plan-cn.xiaomimimo.com/v1
    • confirmed the live run did not use https://api.xiaomimimo.com/v1

npx [email protected] check:changed passed the extension production typecheck but failed in the broader extension test typecheck on unrelated existing test files under extensions/diffs, extensions/irc, extensions/line, extensions/nextcloud-talk, and extensions/qqbot.

Switch Xiaomi TTS auth from api-key header to standard Bearer auth
to support Token Plan (Orbit) endpoint. Backward compatible with
pay-as-you-go endpoint which also accepts Bearer auth.

Closes openclaw#77692
@clawsweeper

clawsweeper Bot commented May 8, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 3, 2026, 5:06 PM ET / 21:06 UTC.

Summary
This PR changes Xiaomi MiMo TTS to use Bearer auth, inherit a Xiaomi model-provider base URL when no speech-specific base URL is set, update TTS docs/tests, and add a changelog entry.

PR surface: Source +22, Tests +69, Docs +10. Total +101 across 5 files.

Reproducibility: yes. at source level. Current main and v2026.6.11 still send Xiaomi TTS with api-key and do not inherit the supported Token Plan provider route, while the linked issue includes redacted live 401/success evidence.

Review metrics: 1 noteworthy metric.

  • Xiaomi TTS Auth And Endpoint Defaults: 1 auth header changed, 1 endpoint fallback added. These provider defaults affect existing speech users and Token Plan onboarding users, so compatibility and upgrade proof matter before merge.

Stored data model
Persistent data-model change detected: serialized state: extensions/xiaomi/speech-provider.test.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #77692
Summary: This PR is the candidate fix for the canonical Xiaomi Token Plan TTS issue, but it has not merged and does not yet cover the current supported Token Plan config path.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🦪 silver shellfish
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Rebase and resolve conflicts while preserving current Xiaomi VoiceDesign TTS behavior and bounded response reads.
  • Update TTS resolution to cover xiaomi-token-plan endpoint/key inheritance or document separate speech setup as the intended contract.
  • [P1] Add redacted terminal output or logs proving the final Token Plan TTS path, plus pay-as-you-go compatibility if Bearer auth stays universal.

Proof guidance:

  • [P1] Needs stronger real behavior proof before merge: Copied live output proves an explicit XIAOMI_BASE_URL Token Plan CN run, but not the final inherited xiaomi-token-plan path or pay-as-you-go compatibility after rebase. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

  • [P1] Users configured through current xiaomi-token-plan onboarding would still miss TTS endpoint/key inheritance because the PR reads models.providers.xiaomi and XIAOMI_API_KEY, not xiaomi-token-plan and XIAOMI_TOKEN_PLAN_API_KEY.
  • [P1] The PR changes Xiaomi TTS auth to Bearer for all speech users, so pay-as-you-go compatibility needs final-patch proof if that remains universal.
  • [P1] The branch is conflicting against current main; conflict resolution must preserve current Xiaomi VoiceDesign TTS behavior and bounded response reads.

Maintainer options:

  1. Align TTS With Token Plan Onboarding (recommended)
    Update Xiaomi TTS to inherit the current xiaomi-token-plan regional endpoint and credential when no speech-specific override exists, then prove that exact path live.
  2. Declare Separate Speech Setup
    Maintainers can intentionally require separate Xiaomi speech config, but the docs and linked issue should clearly state that Token Plan model onboarding does not configure TTS.
  3. Replace The Conflicting Branch
    If this branch cannot be rebased cleanly while preserving current Xiaomi TTS behavior, keep the linked issue canonical and land a narrow replacement PR that credits this contribution.

Next step before merge

  • [P1] Human/contributor action is needed because the branch is conflicting and the remaining endpoint/credential direction plus final live-proof gaps are not safe for an automated repair loop.

Security
Cleared: No concrete security or supply-chain regression was found; the diff changes provider auth/header routing but adds no dependencies, workflows, generated code, or secret material.

Review findings

  • [P1] Read the Token Plan provider config for TTS — extensions/xiaomi/speech-provider.ts:76-80
  • [P3] Remove the release-owned changelog entry — CHANGELOG.md:170
Review details

Best possible solution:

Rebase or replace the branch with a narrow Xiaomi TTS fix that either inherits the supported xiaomi-token-plan endpoint/key path or explicitly documents separate speech setup, preserves current VoiceDesign and response-bounding behavior, removes the changelog edit, and supplies final live proof.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. Current main and v2026.6.11 still send Xiaomi TTS with api-key and do not inherit the supported Token Plan provider route, while the linked issue includes redacted live 401/success evidence.

Is this the best way to solve the issue?

No. The PR is a useful start, but the best fix must align endpoint and credential selection with the supported xiaomi-token-plan provider path or make separate speech setup an explicit maintainer decision.

Full review comments:

  • [P1] Read the Token Plan provider config for TTS — extensions/xiaomi/speech-provider.ts:76-80
    This helper only reads models.providers.xiaomi, but current onboarding writes the regional endpoint and credential under xiaomi-token-plan / XIAOMI_TOKEN_PLAN_API_KEY. Users who followed supported Token Plan onboarding would still miss the matching TTS endpoint/key unless they duplicate separate speech config.
    Confidence: 0.92
  • [P3] Remove the release-owned changelog entry — CHANGELOG.md:170
    CHANGELOG.md is release-generated in this repo, so this normal PR should keep release-note context in the PR body or merge metadata instead of editing the changelog directly.
    Confidence: 0.95

Overall correctness: patch is incorrect
Overall confidence: 0.91

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 010b61746379.

Label changes

Label justifications:

  • P2: This is a focused bundled-provider bug fix with limited blast radius, but affected Xiaomi Token Plan users still cannot use TTS through the supported path.
  • merge-risk: 🚨 compatibility: The PR changes default Xiaomi TTS authentication and endpoint fallback behavior for existing speech configurations.
  • merge-risk: 🚨 auth-provider: The PR changes credential/header handling but does not yet align with the current xiaomi-token-plan credential and endpoint route.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦪 silver shellfish.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Copied live output proves an explicit XIAOMI_BASE_URL Token Plan CN run, but not the final inherited xiaomi-token-plan path or pay-as-you-go compatibility after rebase. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +22, Tests +69, Docs +10. Total +101 across 5 files.

View PR surface stats
Area Files Added Removed Net
Source 1 29 7 +22
Tests 1 70 1 +69
Docs 3 11 1 +10
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 5 110 9 +101

What I checked:

Likely related people:

  • steipete: Commit ec8dbc459558 added the Xiaomi MiMo speech provider, tests, and docs containing the TTS auth/config path under review. (role: introduced behavior; confidence: high; commits: ec8dbc459558; files: extensions/xiaomi/speech-provider.ts, extensions/xiaomi/speech-provider.test.ts, docs/providers/xiaomi.md)
  • NianJiuZst: Merged Token Plan provider support added the xiaomi-token-plan provider id, regional base URLs, and XIAOMI_TOKEN_PLAN_API_KEY route that TTS needs to align with. (role: feature owner; confidence: high; commits: da5d1a62155e; files: extensions/xiaomi/index.ts, extensions/xiaomi/onboard.ts, extensions/xiaomi/provider-catalog.ts)
  • GimingRao: Recent VoiceDesign TTS work changed the same Xiaomi speech provider, tests, and docs that conflict resolution or replacement work must preserve. (role: recent adjacent contributor; confidence: medium; commits: f94512cd7f76; files: extensions/xiaomi/speech-provider.ts, extensions/xiaomi/speech-provider.test.ts, docs/providers/xiaomi.md)
  • Alix-007: Recent response-bounding work touched Xiaomi TTS request/response handling adjacent to the auth and endpoint path. (role: recent area contributor; confidence: medium; commits: 2f851ecfe9df; files: extensions/xiaomi/speech-provider.ts, extensions/xiaomi/speech-provider.test.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation extensions: xiaomi extensions: tts-local-cli plugin: azure-speech Azure Speech plugin size: S and removed size: XS labels May 10, 2026
@kidding1412 kidding1412 changed the title fix(tts/xiaomi): use Bearer auth instead of api-key header fix(tts/xiaomi): support Token Plan TTS endpoint May 10, 2026
@openclaw-barnacle openclaw-barnacle Bot added triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 10, 2026
@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 10, 2026
@barnacle-openclaw

Copy link
Copy Markdown

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

@barnacle-openclaw barnacle-openclaw Bot added the stale Marked as stale due to inactivity label May 31, 2026
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. labels May 31, 2026
@ismael-81

Copy link
Copy Markdown

Adding one current data point from the linked issue because this PR is marked stale / waiting on author.

The issue is still valid as of 2026-05-31. From the live AMS Token Plan repro in #77692, I think the mergeable shape should be:

  • keep explicit speech/TTS config precedence (messages.tts.providers.xiaomi.baseUrl, XIAOMI_BASE_URL, TTS model/voice/format envs);
  • when no speech-specific base URL is set, make Xiaomi TTS resolution line up with the current Token Plan onboarding path, especially models.providers["xiaomi-token-plan"].baseUrl / XIAOMI_TOKEN_PLAN_API_KEY, or document clearly that Token Plan TTS requires separate speech config;
  • keep Bearer auth if maintainers want the OpenAI-compatible path, but the live AMS test showed endpoint selection is the primary failure for that key type: token-plan-ams worked with both api-key and Authorization: Bearer, while the default pay-as-you-go endpoint rejected the tp-... key;
  • remove the CHANGELOG.md edit before merge.

So I would not close #77692 as stale: the current PR is close, but still needs the rebase/config alignment called out by ClawSweeper.

@openclaw-barnacle openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Jun 1, 2026
@clawsweeper clawsweeper Bot added rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jun 1, 2026
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. labels Jun 14, 2026
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jun 23, 2026
@clawsweeper

clawsweeper Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

@kidding1412 thanks for the PR. ClawSweeper is still waiting on real behavior proof before this can move forward.

Useful proof can be a screenshot, short video, terminal output, copied live output, linked artifact, or redacted logs that show the changed behavior after the fix. Please redact private tokens, phone numbers, private endpoints, customer data, and anything else sensitive.

Once proof is added to the PR body or a comment, ClawSweeper or a maintainer can re-check it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs Improvements or additions to documentation extensions: tts-local-cli extensions: xiaomi merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. plugin: azure-speech Azure Speech plugin proof: supplied External PR includes structured after-fix real behavior proof. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. size: S status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(tts/xiaomi): Xiaomi Token Plan endpoint uses Bearer auth, not api-key header

2 participants