shell: bash

env:

OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1"

OPENCLAW_QA_MATRIX_CANARY_TIMEOUT_MS: "90000"

OPENCLAW_QA_MATRIX_NO_REPLY_WINDOW_MS: "3000"

run: |

set -euo pipefail

| Variable | Default | Effect |

| --------------------------------------- | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| `OPENCLAW_QA_MATRIX_TIMEOUT_MS` | `1800000` (30 min) | Hard upper bound on the entire run. |

| `OPENCLAW_QA_MATRIX_CANARY_TIMEOUT_MS` | `45000` | Bound for the initial canary reply. Release CI raises this on shared runners so a slow first gateway turn does not fail before scenario coverage starts. |

| `OPENCLAW_QA_MATRIX_NO_REPLY_WINDOW_MS` | `8000` | Quiet window for negative no-reply assertions. Clamped to `≤` the run timeout. |

| `OPENCLAW_QA_MATRIX_CLEANUP_TIMEOUT_MS` | `90000` | Bound for Docker teardown. Failure surfaces include the recovery `docker compose ... down --remove-orphans` command. |

| `OPENCLAW_QA_MATRIX_TUWUNEL_IMAGE` | `ghcr.io/matrix-construct/tuwunel:v1.5.1` | Override the homeserver image when validating against a different Tuwunel version. |

} finally {

if (gatewayHarness) {

try {

const shouldPreserveGatewayDebugArtifacts = scenarioResults.some(

(scenario) => scenario?.status === "fail",

);

const shouldPreserveGatewayDebugArtifacts =

scenarioResults.some((scenario) => scenario?.status === "fail") || canaryFailed;

preservedGatewayDebugDirPath = shouldPreserveGatewayDebugArtifacts

? path.join(outputDir, "gateway-debug")

: undefined;

},

]);

await doctorCommand(createDoctorRuntime(), { yes: true });

const previousConfigWriteSupport =

process.env.OPENCLAW_UPDATE_PARENT_SUPPORTS_DOCTOR_CONFIG_WRITE;

process.env.OPENCLAW_UPDATE_PARENT_SUPPORTS_DOCTOR_CONFIG_WRITE = "1";

try {

await doctorCommand(createDoctorRuntime(), { yes: true });

} finally {

if (previousConfigWriteSupport === undefined) {

delete process.env.OPENCLAW_UPDATE_PARENT_SUPPORTS_DOCTOR_CONFIG_WRITE;

} else {

process.env.OPENCLAW_UPDATE_PARENT_SUPPORTS_DOCTOR_CONFIG_WRITE =

previousConfigWriteSupport;

}

}

const written = writeConfigFile.mock.calls.at(-1)?.[0] as Record<string, unknown>;

const profiles = (written.auth as { profiles: Record<string, unknown> }).profiles;