### Fixes

- Agents/sandbox: include the container workspace path hint in sandbox-root escape errors while preserving shortened host workspace roots. Fixes #79712. Thanks @haumanto and @hclsys.

- Image generation: honor configured web-fetch SSRF policy across OpenAI, Google, MiniMax, OpenRouter, and Vydra provider requests so RFC2544 fake-IP proxy opt-ins reach generation calls. Fixes #79716. (#79765) Thanks @hclsys.

- QQBot: route gateway WebSocket connections through the ambient proxy agent so deployments with `https_proxy`, `HTTPS_PROXY`, or `HTTP_PROXY` can reach the QQ gateway. (#72961) Thanks @xialonglee.

- Agents/subagents: treat `sessions_spawn` `model: "default"` as the default-model fallback and ignore ACP-only stream targets for native sub-agent spawns. Fixes #72078. (#72101) Thanks @xialonglee.

- Agents/failover: stop retrying assistant-prefill format rejections across auth profiles or model fallbacks, surfacing the deterministic provider error instead of requeueing the lane. Fixes #79688. (#79728) Thanks @hclsys.

});

});

it("passes request SSRF policy to the provider HTTP helper", async () => {

mockGoogleApiKeyAuth();

const postJsonRequest = vi.spyOn(providerHttp, "postJsonRequest").mockResolvedValue({

response: new Response(

JSON.stringify({

candidates: [

{

content: {

parts: [

{

inlineData: {

mimeType: "image/png",

data: Buffer.from("png-data").toString("base64"),

},

},

],

},

},

],

}),

{ status: 200, headers: { "Content-Type": "application/json" } },

),

finalUrl:

"https://generativelanguage.googleapis.com/v1beta/models/gemini-3.1-flash-image-preview:generateContent",

release: async () => {},

});

const provider = buildGoogleImageGenerationProvider();

await provider.generateImage({

provider: "google",

model: "gemini-3.1-flash-image-preview",

prompt: "draw a cat",

cfg: {},

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

});

expect(postJsonRequest).toHaveBeenCalledWith(

expect.objectContaining({

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

}),

);

});

it("accepts OAuth JSON auth and inline_data responses", async () => {

vi.spyOn(providerAuthRuntime, "resolveApiKeyForProvider").mockResolvedValue({

apiKey: JSON.stringify({ token: "oauth-token" }),

fetchFn: fetch,

pinDns: false,

allowPrivateNetwork,

ssrfPolicy: req.ssrfPolicy,

dispatcherPolicy,

});

import * as providerAuth from "openclaw/plugin-sdk/provider-auth-runtime";

import * as providerHttp from "openclaw/plugin-sdk/provider-http";

import { installPinnedHostnameTestHooks } from "openclaw/plugin-sdk/test-env";

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";

import {

});

});

it("passes request SSRF policy to the provider HTTP helper", async () => {

mockMinimaxApiKey();

const postJsonRequest = vi.spyOn(providerHttp, "postJsonRequest").mockResolvedValue({

response: new Response(

JSON.stringify({

data: { image_base64: [Buffer.from("png-data").toString("base64")] },

base_resp: { status_code: 0 },

}),

{ status: 200, headers: { "Content-Type": "application/json" } },

),

finalUrl: "https://api.minimax.io/v1/image_generation",

release: async () => {},

});

const provider = buildMinimaxImageGenerationProvider();

await provider.generateImage({

provider: "minimax",

model: "image-01",

prompt: "draw a cat",

cfg: {},

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

});

expect(postJsonRequest).toHaveBeenCalledWith(

expect.objectContaining({

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

}),

);

});

it("keeps the dedicated global image endpoint when text config uses the global API host", async () => {

mockMinimaxApiKey();

const fetchMock = mockSuccessfulMinimaxImageResponse();

timeoutMs: req.timeoutMs,

fetchFn: fetch,

allowPrivateNetwork,

ssrfPolicy: req.ssrfPolicy,

dispatcherPolicy,

});

try {

expect(result.images).toHaveLength(1);

});

it("propagates request SSRF policy to JSON image requests", async () => {

mockGeneratedPngResponse();

const provider = buildOpenAIImageGenerationProvider();

await provider.generateImage({

provider: "openai",

model: "gpt-image-2",

prompt: "test",

cfg: {},

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

});

expect(postJsonRequestMock).toHaveBeenCalledWith(

expect.objectContaining({

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

}),

);

});

it("forwards generation count and custom size overrides", async () => {

mockGeneratedPngResponse();

},

},

authStore,

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

});

expect(sanitizeConfiguredModelProviderRequestMock).toHaveBeenCalledWith({

expect.objectContaining({

url: "http://127.0.0.1:44220/backend-api/codex/responses",

allowPrivateNetwork: true,

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

}),

);

expect(result.images[0]?.buffer).toEqual(Buffer.from("codex-image"));

timeoutMs,

fetchFn: fetch,

allowPrivateNetwork,

ssrfPolicy: req.ssrfPolicy,

dispatcherPolicy,

});

const { response, release } = requestResult;

timeoutMs,

fetchFn: fetch,

allowPrivateNetwork,

ssrfPolicy: req.ssrfPolicy,

dispatcherPolicy,

});

})()

timeoutMs,

fetchFn: fetch,

allowPrivateNetwork,

ssrfPolicy: req.ssrfPolicy,

dispatcherPolicy,

});

})();

resolution: "2K",

count: 2,

timeoutMs: 12_345,

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

cfg: {

models: {

providers: {

expect.objectContaining({

url: "https://custom.openrouter.test/api/v1/chat/completions",

timeoutMs: 12_345,

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

body: expect.objectContaining({

model: "google/gemini-3.1-flash-image-preview",

modalities: ["image", "text"],

timeoutMs: req.timeoutMs ?? DEFAULT_TIMEOUT_MS,

fetchFn: fetch,

allowPrivateNetwork,

ssrfPolicy: req.ssrfPolicy,

dispatcherPolicy,

});

});

});

it("passes request SSRF policy to the image creation request", async () => {

stubVydraApiKey();

const fetchMock = stubFetch(

jsonResponse({

jobId: "job-123",

status: "completed",

imageUrl: "https://cdn.vydra.ai/generated/test.png",

}),

binaryResponse("png-data", "image/png"),

);

const provider = buildVydraImageGenerationProvider();

await provider.generateImage({

provider: "vydra",

model: "grok-imagine",

prompt: "draw a cat",

cfg: {

models: {

providers: {

vydra: {

baseUrl: "https://198.18.0.10/api/v1",

},

},

},

} as never,

ssrfPolicy: { allowRfc2544BenchmarkRange: true },

});

expect(fetchMock).toHaveBeenNthCalledWith(

1,

"https://198.18.0.10/api/v1/models/grok-imagine",

expect.objectContaining({ method: "POST" }),

);

});

it("polls jobs when the create response is not completed yet", async () => {

stubVydraApiKey();

const fetchMock = stubFetch(