- Providers/xAI: replace the retired `grok-imagine-image-pro` image model with `grok-imagine-image-quality` in the bundled image-generation provider and docs. (#81399) Thanks @KateWilkins.

- Providers/OAuth: let browser-hosted identity provider pages read successful localhost callback responses, preventing xAI Grok OAuth from showing a false connection failure after OpenClaw completes login.

- Gateway/security: reject malformed HTTP and WebSocket request targets with the existing auth failure response instead of letting invalid URL parsing crash the Gateway. Fixes GHSA-6hc3-f4rg-377m.

- Browser/CDP: redact credential-bearing Chrome MCP and managed Chrome launch diagnostics, and require exact loopback entries before treating `NO_PROXY` as already covering local CDP proxy bypasses.

- Gateway/diagnostics: redact credential-bearing gateway target URLs and client diagnostics while preserving raw connection URLs for programmatic use, so connect-failure logs no longer surface embedded tokens.

- Gateway/auth: honor `OPENCLAW_GATEWAY_TOKEN` as the remote interactive fallback when no remote token is configured, keeping remote TUI setup aligned with documented auth precedence.

- Providers/xAI: continue polling video generations while xAI reports in-flight jobs as `pending`, so Grok video requests no longer fail before the final `done` response. (#82610) Thanks @Manzojunior.

delete process.env.no_proxy;

}

});

it("does not treat substring matches as complete loopback coverage", async () => {

const userNoProxy = "notlocalhost,127.0.0.10,[::1].example";

process.env.NO_PROXY = userNoProxy;

process.env.no_proxy = userNoProxy;

process.env.HTTP_PROXY = "http://proxy:8080";

try {

const { withNoProxyForLocalhost } = await import("./cdp-proxy-bypass.js");

await withNoProxyForLocalhost(async () => {

expect(process.env.NO_PROXY).toBe(`${userNoProxy},localhost,127.0.0.1,[::1]`);

expect(process.env.no_proxy).toBe(`${userNoProxy},localhost,127.0.0.1,[::1]`);

});

expect(process.env.NO_PROXY).toBe(userNoProxy);

expect(process.env.no_proxy).toBe(userNoProxy);

} finally {

delete process.env.HTTP_PROXY;

delete process.env.NO_PROXY;

delete process.env.no_proxy;

}

});

});

describe("withNoProxyForCdpUrl", () => {

function noProxyAlreadyCoversLocalhost(): boolean {

const current = process.env.NO_PROXY || process.env.no_proxy || "";

return (

current.includes("localhost") && current.includes("127.0.0.1") && current.includes("[::1]")

const entries = new Set(

current

.split(",")

.map((entry) => entry.trim().toLowerCase())

.filter(Boolean),

);

return entries.has("localhost") && entries.has("127.0.0.1") && entries.has("[::1]");

}

export async function withNoProxyForLocalhost<T>(fn: () => Promise<T>): Promise<T> {

]);

});

it("redacts remote CDP URL secrets from attach failures", async () => {

const secretToken = "browserless-secret-token-1234567890"; // pragma: allowlist secret

const cdpUrl = `wss://browserless.example/chrome?token=${secretToken}`;

let message = "";

try {

await ensureChromeMcpAvailable(

"remote-profile",

{

cdpUrl,

mcpCommand: process.execPath,

mcpArgs: ["-e", "process.exit(1)"],

},

{ ephemeral: true },

);

} catch (err) {

message = err instanceof Error ? err.message : String(err);

}

expect(message).toContain("Chrome MCP existing-session attach failed");

expect(message).toContain("browserless.example");

expect(message).not.toContain(secretToken);

});

it("parses new_page text responses and returns the created tab", async () => {

const factory: ChromeMcpSessionFactory = async () => createFakeSession();

setChromeMcpSessionFactoryForTest(factory);

readStringValue,

} from "openclaw/plugin-sdk/string-coerce-runtime";

import { resolvePreferredOpenClawTmpDir } from "../infra/tmp-openclaw-dir.js";

import { redactSensitiveText } from "../logging/redact.js";

import { createSubsystemLogger } from "../logging/subsystem.js";

import { asRecord } from "../record-shared.js";

import { redactCdpUrl } from "./cdp.helpers.js";

import type { ChromeMcpSnapshotNode } from "./chrome-mcp.snapshot.js";

import type { BrowserTab } from "./client.types.js";

import { BrowserProfileUnavailableError, BrowserTabNotFoundError } from "./errors.js";

const stderr = getStderr();

if (stderr) {

log.warn(

`Chrome MCP attach failed for profile "${profileName}". Subprocess stderr:\n${stderr}`,

`Chrome MCP attach failed for profile "${profileName}". Subprocess stderr:\n${redactSensitiveText(stderr)}`,

);

}

const targetLabel = options.browserUrl

? `the configured Chrome endpoint (${options.browserUrl})`

? `the configured Chrome endpoint (${redactCdpUrl(options.browserUrl) ?? options.browserUrl})`

: options.userDataDir

? `the configured Chromium user data dir (${options.userDataDir})`

: "Google Chrome's default profile";

return false;

});

const fakeProc = makeFakeProc();

const secretToken = "chrome-stderr-secret-1234567890"; // pragma: allowlist secret

spawnMock.mockImplementation(() => {

// Synthesize stderr data shortly after spawn.

void Promise.resolve().then(() =>

fakeProc.stderr.emit("data", Buffer.from("chrome crash log\n")),

fakeProc.stderr.emit("data", Buffer.from(`chrome crash log token=${secretToken}\n`)),

);

return fakeProc;

});

noSandbox: true,

extraArgs: [],

} as unknown as ResolvedBrowserConfig;

await expect(launchOpenClawChrome(resolved, profile)).rejects.toThrow(/Chrome stderr:/);

let message = "";

try {

await launchOpenClawChrome(resolved, profile);

} catch (err) {

message = err instanceof Error ? err.message : String(err);

}

expect(message).toContain("Chrome stderr:");

expect(message).toContain("chrome crash log");

expect(message).not.toContain(secretToken);

});

it("omits the sandbox hint on non-linux platforms", async () => {

import type { SsrFPolicy } from "../infra/net/ssrf.js";

import { ensurePortAvailable } from "../infra/ports.js";

import { resolvePreferredOpenClawTmpDir } from "../infra/tmp-openclaw-dir.js";

import { redactSensitiveText } from "../logging/redact.js";

import { createSubsystemLogger } from "../logging/subsystem.js";

import { CONFIG_DIR } from "../utils.js";

import { hasChromeProxyControlArg, omitChromeProxyEnv } from "./browser-proxy-mode.js";

const diagnosticText = await diagnoseChromeCdp(profile.cdpUrl)

.then(formatChromeCdpDiagnostic)

.catch((err) => `CDP diagnostic failed: ${safeChromeCdpErrorMessage(err)}.`);

const stderrOutput =

normalizeOptionalString(Buffer.concat(stderrChunks).toString("utf8")) ?? "";

const stderrOutput = redactSensitiveText(

normalizeOptionalString(Buffer.concat(stderrChunks).toString("utf8")) ?? "",

);

if (

allowSingletonRecovery &&

CHROME_SINGLETON_IN_USE_PATTERN.test(stderrOutput) &&