(cherry picked from commit 71ec421)

… runs

(cherry picked from commit 05fb16d)

(cherry picked from commit 36afd1b)

…6590)

Co-authored-by: Tyler Yust <[email protected]>
(cherry picked from commit 5d4b040)

…w#33813)

Co-authored-by: zhouhe-xydt <[email protected]>
Co-authored-by: altaywtf <[email protected]>
(cherry picked from commit a65d70f)

… usage limit (openclaw#30484) (openclaw#36802)

Co-authored-by: Val Alexander <[email protected]>
(cherry picked from commit 01b2017)

* add web search to onboarding flow

* remove post onboarding step (now redundant)

* post-onboarding nudge if no web search set up

* address comments

* fix test mocking

* add enabled: false assertion to the no-key test

* --skip-search cli flag

* use provider that a user has a key for

* add assertions, replace the duplicated switch blocks

* test for quickstart fast-path with existing config key

* address comments

* cover quickstart falls through to key test

* bring back key source

* normalize secret inputs instead of direct string trimming

* preserve enabled: false if it's already set

* handle missing API keys in flow

* doc updates

* hasExistingKey to detect both plaintext strings and SecretRef objects

* preserve enabled state only on the "keep current" paths

* add test for preserving

* better gate flows

* guard against invalid provider values in config

* Update src/commands/configure.wizard.ts

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* format fix

* only mentions env var when it's actually available

* search apiKey fields now typed as SecretInput

* if no provider check if any search provider key is detectable

* handle both kimi keys

* remove .filter(Boolean)

* do not disable web_search after user enables it

* update resolveSearchProvider

* fix(onboarding): skip search key prompt in ref mode

* fix: add onboarding web search step (openclaw#34009) (thanks @kesku)

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: Shadow <[email protected]>
(cherry picked from commit 3d7bc59)

(cherry picked from commit ee6f7b1)

…38117)

* Infra: tighten npm registry spec parsing

* Infra: block implicit prerelease npm installs

* Plugins: cover prerelease install policy

* Infra: add npm registry spec tests

* Hooks: cover prerelease install policy

* Docs: clarify plugin guide version policy

* Docs: clarify plugin install version policy

* Docs: clarify hooks install version policy

* Docs: clarify hook pack version policy

(cherry picked from commit f392b81)

… commit

- Add missing hasConfiguredSecretInput() to types.secrets.ts
- Add SecretInput import to types.tools.ts for apiKey fields
- Replace OpenClawConfig with RemoteClawConfig in onboard-search
- Remove non-existent DEFAULT_SECRET_PROVIDER_ALIAS import
- Remove invalid 'provider' field from SecretRef literal
- Stub resolveSyntheticLocalProviderAuth (models.providers was gutted)
- Replace undefined registerRun/emitLifecycleEnd test helpers with
  existing mod.registerSubagentRun/lifecycleHandler patterns

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* Changelog: note plugin HTTP route migration diagnostics

* Tests: cover registerHttpHandler migration diagnostics

* Plugins: clarify registerHttpHandler migration errors

* Tests: cover registerHttpHandler diagnostic edge cases

* Plugins: tighten registerHttpHandler migration hint

(cherry picked from commit d4021f4)

…nclaw#37179)

* Plugins: skip drift prompts for unpinned updates

* Plugins: cover unpinned integrity update behavior

(cherry picked from commit 428d176)

(cherry picked from commit f788ba1)

(cherry picked from commit eb2eeba)

(cherry picked from commit 7cc3376)

(cherry picked from commit 5470337)

Fixes openclaw#7631

(cherry picked from commit d000316)

(cherry picked from commit 4d9134f)

* WhatsApp: add media cap helper

* WhatsApp: cap outbound media loads

* WhatsApp: align auto-reply media caps

* WhatsApp: add outbound media cap test

* WhatsApp: update auto-reply cap tests

* Docs: update WhatsApp media caps

* Changelog: note WhatsApp media cap fix

(cherry picked from commit 222d635)

…37543)

Merged via squash.

Prepared head SHA: 4d59373
Co-authored-by: mukhtharcm <[email protected]>
Co-authored-by: mukhtharcm <[email protected]>
Reviewed-by: @mukhtharcm

(cherry picked from commit 4a80d48)

(cherry picked from commit a274ef9)

* Discord: assert bot-self filter queue guard

* Tests: remove dead gateway SIGTERM placeholder

(cherry picked from commit 38f46e8)

(cherry picked from commit 8f69e07)

(cherry picked from commit b127333)

Replace OpenClawConfig with RemoteClawConfig, openclaw/plugin-sdk with
remoteclaw/plugin-sdk, and fix import paths for fork type exports.

- Add missing RemoteClawConfig import in discord test
- Use spread with as-any for feishu SDK timeout property
- Remove allowUnresolvedSecretRef from mattermost test