### Fixes

- Plugins/QR: replace legacy `qrcode-terminal` QR rendering with bounded `qrcode-tui` helpers for plugin login/setup flows. (#65969) Thanks @vincentkoc.

- Auto-reply/system events: route async exec-event completion replies through the persisted session delivery context, so long-running command results return to the originating channel instead of being dropped when live origin metadata is missing. (#70258) Thanks @wzfukui.

- OpenAI/image generation: send reference-image edits as guarded multipart uploads instead of JSON data URLs, restoring complex multi-reference `gpt-image-2` edits. Fixes #70642. Thanks @dashhuang.

- QA channel/security: reject non-HTTP(S) inbound attachment URLs before media fetch, and log rejected schemes so suspicious or misconfigured payloads are visible during debugging. (#70708) Thanks @vincentkoc.

## Quick start

> **Requires OpenClaw 2026.4.10 or above.** Run `openclaw --version` to check. Upgrade with `openclaw update`.

> **Requires OpenClaw 2026.4.23 or above.** Run `openclaw --version` to check. Upgrade with `openclaw update`.

<Steps>

<Step title="Run the channel setup wizard">

const isVoice = api.runtime.media.isVoiceCompatibleAudio(filePath);

const metadata = await api.runtime.media.getImageMetadata(filePath);

const resized = await api.runtime.media.resizeToJpeg(buffer, { maxWidth: 800 });

const terminalQr = await api.runtime.media.renderQrTerminal("https://openclaw.ai");

const pngQr = await api.runtime.media.renderQrPngBase64("https://openclaw.ai", {

scale: 6, // 1-12

marginModules: 4, // 0-16

});

```

### `api.runtime.config`

## QR import smoke (Docker)

Ensures `qrcode-terminal` loads under the supported Docker Node runtimes (Node 24 default, Node 22 compatible):

Ensures the maintained QR runtime helper loads under the supported Docker Node runtimes (Node 24 default, Node 22 compatible):

```bash

pnpm test:docker:qr

"type": "module",

"dependencies": {

"@larksuiteoapi/node-sdk": "^1.61.1",

"qrcode-terminal": "^0.12.0",

"typebox": "1.1.28"

},

"devDependencies": {

"@openclaw/plugin-sdk": "workspace:*",

"openclaw": "workspace:*"

},

"peerDependencies": {

"openclaw": ">=2026.4.20"

"openclaw": ">=2026.4.23"

},

"peerDependenciesMeta": {

"openclaw": {

"install": {

"npmSpec": "@openclaw/feishu",

"defaultChoice": "npm",

"minHostVersion": ">=2026.4.10"

"minHostVersion": ">=2026.4.23"

},

"compat": {

"pluginApi": ">=2026.4.20"

"pluginApi": ">=2026.4.23"

},

"build": {

"openclawVersion": "2026.4.20"

* Replaces axios with native fetch, removes inquirer/ora/chalk in favor of

* the openclaw WizardPrompter surface.

*/

import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";

import { renderQrTerminal } from "./qr-terminal.js";

import type { FeishuDomain } from "./types.js";

// ---------------------------------------------------------------------------

* otherwise the pattern is corrupted and cannot be scanned.

*/

export async function printQrCode(url: string): Promise<void> {

const mod = await import("qrcode-terminal");

const qrcode = mod.default ?? mod;

qrcode.generate(url, { small: true });

const output = await renderQrTerminal(url, { small: true });

process.stdout.write(output.endsWith("\n") ? output : `${output}\n`);

}

/**

export { renderQrTerminal } from "openclaw/plugin-sdk/media-runtime";

"dependencies": {

"@whiskeysockets/baileys": "7.0.0-rc.9",

"jimp": "^1.6.1",

"qrcode-terminal": "^0.12.0",

"typebox": "1.1.28",

"undici": "8.1.0"

},

"openclaw": "workspace:*"

},

"peerDependencies": {

"openclaw": ">=2026.4.20"

"openclaw": ">=2026.4.23"

},

"peerDependenciesMeta": {

"openclaw": {

"install": {

"npmSpec": "@openclaw/whatsapp",

"defaultChoice": "npm",

"minHostVersion": ">=2026.4.10"

"minHostVersion": ">=2026.4.23"

},

"compat": {

"pluginApi": ">=2026.4.20"

"pluginApi": ">=2026.4.23"

},

"bundle": {

"stageRuntimeDependencies": true

import { EventEmitter } from "node:events";

import { readFile } from "node:fs/promises";

import { resolve } from "node:path";

import { resetLogger, setLoggerOverride } from "openclaw/plugin-sdk/runtime-env";

import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";

import { renderQrPngBase64 } from "./qr-image.js";

const buf = Buffer.from(b64, "base64");

expect(buf.subarray(0, 8).toString("hex")).toBe("89504e470d0a1a0a");

});

it("avoids dynamic require of qrcode-terminal vendor modules", async () => {

const sourcePath = resolve(process.cwd(), "src/media/qr-image.ts");

const source = await readFile(sourcePath, "utf-8");

expect(source).not.toContain("createRequire(");

expect(source).not.toContain('require("qrcode-terminal/vendor/QRCode")');

expect(source).toContain("qrcode-terminal/vendor/QRCode/index.js");

expect(source).toContain("qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel.js");

});

});