### Fixes

- Feishu: detect SecretRef top-level credentials as a configured default account instead of treating object-backed app secrets as missing.

- Providers/Google: preserve and recover Gemini 3 tool-call thought signatures during native replay so function-calling turns no longer fail with missing `thought_signature` 400s. Fixes #72879. (#80358) Thanks @abnershang.

- Gateway/secrets: split the lightweight secrets runtime state and auth-store cache from the full secrets runtime and take a startup fast path when the gateway startup config has no SecretRef values, speeding up secrets startup while preserving cleanup and refresh semantics.

- Gateway/restart: drain pending replies and active chat runs during restart shutdown before sockets and channels close, aborting timed-out chat runs through the normal cleanup path. (#69121) Thanks @alexlomt.

"feishu",

{

allowUnlistedDefaultAccount: true,

hasImplicitDefaultAccount: (cfg) =>

Boolean(

cfg.channels?.feishu?.appId?.trim() &&

hasConfiguredAccountValue(cfg.channels.feishu.appSecret),

),

hasImplicitDefaultAccount: (cfg) => {

const feishu = cfg.channels?.feishu;

return (

hasConfiguredAccountValue(feishu?.appId) && hasConfiguredAccountValue(feishu?.appSecret)

);

},

},

);

set +e

/usr/bin/env OPENCLAW_ALLOW_ROOT=1 ${shellQuote(`${this.auth.apiKeyEnv}=${this.auth.apiKeyValue}`)} openclaw agent --local --agent main --session-id "$session_id" --message ${shellQuote(

"Reply with exact ASCII text OK only.",

)} --thinking minimal --timeout ${resolveParallelsModelTimeoutSeconds("linux")} --json >"$output_file" 2>&1

)} --thinking off --timeout ${resolveParallelsModelTimeoutSeconds("linux")} --json >"$output_file" 2>&1

rc=$?

set -e

cat "$output_file"

set +e

/usr/bin/env ${shellQuote(`${this.auth.apiKeyEnv}=${this.auth.apiKeyValue}`)} ${guestNode} ${guestOpenClawEntry} agent --local --agent main --session-id "$session_id" --message ${shellQuote(

"Reply with exact ASCII text OK only.",

)} --thinking minimal --timeout ${resolveParallelsModelTimeoutSeconds("macos")} --json >"$output_file" 2>&1

)} --thinking off --timeout ${resolveParallelsModelTimeoutSeconds("macos")} --json >"$output_file" 2>&1

rc=$?

set -e

cat "$output_file"

rm -f "$HOME/.openclaw/agents/main/sessions/$session_id.jsonl"

output_file="$(mktemp)"

set +e

OPENCLAW_ALLOW_ROOT="\${OPENCLAW_ALLOW_ROOT:-}" ${input.auth.apiKeyEnv}=${shellQuote(input.auth.apiKeyValue)} ${command} agent --local --agent main --session-id "$session_id" --message 'Reply with exact ASCII text OK only.' --thinking minimal --json >"$output_file" 2>&1

OPENCLAW_ALLOW_ROOT="\${OPENCLAW_ALLOW_ROOT:-}" ${input.auth.apiKeyEnv}=${shellQuote(input.auth.apiKeyValue)} ${command} agent --local --agent main --session-id "$session_id" --message 'Reply with exact ASCII text OK only.' --thinking off --json >"$output_file" 2>&1

rc=$?

set -e

cat "$output_file"

$sessionsDir = Join-Path $env:USERPROFILE '.openclaw\\agents\\main\\sessions'

$sessionPath = Join-Path $sessionsDir "$sessionId.jsonl"

Remove-Item $sessionPath -Force -ErrorAction SilentlyContinue

$output = Invoke-OpenClaw agent --local --agent main --session-id $sessionId --model ${psSingleQuote(input.auth.modelId)} --message 'Reply with exact ASCII text OK only.' --thinking minimal --timeout ${resolveParallelsModelTimeoutSeconds("windows")} --json 2>&1

$output = Invoke-OpenClaw agent --local --agent main --session-id $sessionId --model ${psSingleQuote(input.auth.modelId)} --message 'Reply with exact ASCII text OK only.' --thinking off --timeout ${resolveParallelsModelTimeoutSeconds("windows")} --json 2>&1

if ($null -ne $output) { $output | ForEach-Object { $_ } }

if ($LASTEXITCODE -ne 0) { throw "agent failed with exit code $LASTEXITCODE" }

if (($output | Out-String) -match '"finalAssistant(Raw|Visible)Text":\\s*"OK"') {

'--message',

'Reply with exact ASCII text OK only.',

'--thinking',

'minimal',

'off',

'--timeout',

'${resolveParallelsModelTimeoutSeconds("windows")}',

'--json'

"--message",

"Reply with exact ASCII text OK only.",

"--thinking",

"minimal",

"off",

"--timeout",

String(CROSS_OS_AGENT_TURN_TIMEOUT_SECONDS),

"--json",

emitAcpLifecycleEnd: vi.fn(),

emitAcpLifecycleError: vi.fn(),

emitAcpLifecycleStart: vi.fn(),

emitAcpRuntimeEvent: vi.fn(),

persistAcpTurnTranscript: (...args: unknown[]) => state.persistAcpTurnTranscriptMock(...args),

persistSessionEntry: vi.fn(),

prependInternalEventContext: (_body: string) => _body,

return !!value && typeof value === "object" && !Array.isArray(value);

}

function setOwnSchemaProperty(target: Record<string, unknown>, key: string, value: unknown): void {

Object.defineProperty(target, key, {

value,

enumerable: true,

configurable: true,

writable: true,

});

}

function hasTopLevelArrayKeyword(

schemaRecord: Record<string, unknown>,

key: TopLevelConditionalKey,

if (key === "$defs" || key === "definitions") {

continue;

}

result[key] = inlineLocalSchemaRefsWithDefs(value, nextDefs, refStack, state);

setOwnSchemaProperty(

result,

key,

inlineLocalSchemaRefsWithDefs(value, nextDefs, refStack, state),

);

}

if (state.unresolvedLocalRefs) {

if ("$defs" in obj) {

await vi.advanceTimersByTimeAsync(4_001);

expect(announceSpy).toHaveBeenCalledTimes(3);

const run = listMainRuns()[0];

expect(run?.pendingFinalDelivery).toBe(true);

expect(run?.deliverySuspendedAt).toBeTypeOf("number");

expect(run?.deliverySuspendedReason).toBe("retry-limit");

expect(run?.cleanupCompletedAt).toBeUndefined();

await waitForRegistrySideEffect(() => {

const run = listMainRuns()[0];

expect(run?.pendingFinalDelivery).toBe(true);

expect(run?.deliverySuspendedAt).toBeTypeOf("number");

expect(run?.deliverySuspendedReason).toBe("retry-limit");

expect(run?.cleanupCompletedAt).toBeUndefined();

});

} finally {

vi.useRealTimers();

}