- Gateway/config: include rejected validation paths in foreground and service last-known-good recovery logs plus main-agent notices, so unsupported direct edits explain which key caused restore instead of looking like silent reversion. Fixes #75060. Thanks @amknight.

- Plugins/runtime-deps: hash the OS-canonical `packageRoot` via `fs.realpathSync.native` (with `path.resolve` fallback) when computing the bundled runtime-deps stage key, so loader and channel `bundled-root` callers no longer derive divergent stage directories under `~/.openclaw/plugin-runtime-deps/openclaw-<version>-<hash>/` and bundled channels stop failing with `ENOENT` on shared dist chunks under Windows npm symlinks, junctions, or PM2 multi-instance worker layouts. Fixes #74963. (#75048) Thanks @openperf and @vincentkoc.

- fix(logging): add redaction patterns for Tencent Cloud, Alibaba Cloud, HuggingFace and Replicate API keys (#58162). Thanks @gavyngong

- Pairing: surface unexpected allowlist filesystem stat errors instead of treating the allowlist as missing, so permission and I/O failures are visible during pairing authorization checks. (#63324) Thanks @franciscomaestre.

## 2026.4.29

import { describe, expect, it } from "vitest";

import fs from "node:fs";

import { describe, expect, it, vi } from "vitest";

import {

readAllowFromFileSyncWithExists,

resolveAllowFromAccountId,

resolveAllowFromFilePath,

safeChannelKey,

throw new Error("expected invalid pairing key error");

}

function fsError(message: string, code: string): NodeJS.ErrnoException {

return Object.assign(new Error(message), { code });

}

describe("allow-from store file keys", () => {

it("formats invalid channel diagnostics without stringifying unsafe values", () => {

const circular: Record<string, unknown> = { label: "private-channel-value" };

});

});

});

describe("allow-from store file reads", () => {

it("rethrows unexpected sync stat errors", () => {

const error = fsError("permission denied", "EACCES");

const statSpy = vi.spyOn(fs, "statSync").mockImplementation(() => {

throw error;

});

try {

expect(() =>

readAllowFromFileSyncWithExists({

cacheNamespace: "test",

filePath: "/tmp/openclaw-allowFrom.json",

normalizeStore: () => [],

}),

).toThrow(error);

} finally {

statSpy.mockRestore();

}

});

});

} catch (err) {

const code = (err as { code?: string }).code;

if (code !== "ENOENT") {

return { entries: [], exists: false };

throw err;

}

}

});

});

it("rethrows unexpected stat errors after allowFrom writes", async () => {

await withTempStateDir(async (stateDir) => {

const allowFromPath = resolveAllowFromFilePath(stateDir, "telegram", "yy");

const error = Object.assign(new Error("stat failed"), { code: "EACCES" });

const originalStat = fsSync.promises.stat.bind(fsSync.promises);

const statSpy = vi.spyOn(fsSync.promises, "stat").mockImplementation(async (target) => {

if (String(target) === allowFromPath) {

throw error;

}

return await originalStat(target);

});

try {

await expect(

addChannelAllowFromStoreEntry({

channel: "telegram",

accountId: "yy",

entry: "12345",

}),

).rejects.toBe(error);

} finally {

statSpy.mockRestore();

}

});

});

it("reads allowFrom variants with account-scoped isolation", async () => {

await withTempStateDir(async (stateDir) => {

for (const { setup, accountId, expected, expectedLegacy } of [

let stat: Awaited<ReturnType<typeof fs.promises.stat>> | null = null;

try {

stat = await fs.promises.stat(filePath);

} catch {}

} catch (err) {

const code = (err as { code?: string }).code;

if (code !== "ENOENT") {

throw err;

}

}

setAllowFromFileReadCache({

cacheNamespace: PAIRING_ALLOW_FROM_CACHE_NAMESPACE,

filePath,