fix(ci): stabilize tests and detect-secrets after dep updates

.secrets.baseline

@@ -10956,7 +10956,7 @@
         "filename": "extensions/bluebubbles/src/monitor.webhook-auth.test.ts",
         "hashed_secret": "1ae0af3fe72b3ba394f9fa95a6cffc090d726c23",
         "is_verified": false,
-        "line_number": 514
+        "line_number": 490
       }
     ],
     "extensions/bluebubbles/src/reactions.test.ts": [
@@ -11277,7 +11277,7 @@
         "filename": "extensions/feishu/src/monitor.webhook-security.test.ts",
         "hashed_secret": "cf27add3cb4cb83efe9a48cf7289068fa869c4cd",
         "is_verified": false,
-        "line_number": 91
+        "line_number": 76
       }
     ],
     "extensions/feishu/src/onboarding.test.ts": [
@@ -11580,7 +11580,7 @@
         "filename": "extensions/nextcloud-talk/src/channel.ts",
         "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
         "is_verified": false,
-        "line_number": 408
+        "line_number": 399
       }
     ],
     "extensions/nextcloud-talk/src/send.test.ts": [
@@ -11802,7 +11802,7 @@
         "filename": "extensions/telegram/src/channel.test.ts",
         "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
         "is_verified": false,
-        "line_number": 136
+        "line_number": 132
       }
     ],
     "extensions/twitch/src/onboarding.test.ts": [
@@ -11827,7 +11827,7 @@
         "filename": "extensions/twitch/src/status.test.ts",
         "hashed_secret": "f2b14f68eb995facb3a1c35287b778d5bd785511",
         "is_verified": false,
-        "line_number": 122
+        "line_number": 92
       }
     ],
     "extensions/voice-call/README.md": [
@@ -11845,7 +11845,7 @@
         "filename": "extensions/voice-call/src/config.test.ts",
         "hashed_secret": "62207a469ec2fdcfc7d66b04c2980ac1501acbf0",
         "is_verified": false,
-        "line_number": 79
+        "line_number": 39
       }
     ],
     "extensions/voice-call/src/providers/telnyx.test.ts": [
@@ -11936,7 +11936,7 @@
         "filename": "src/acp/server.startup.test.ts",
         "hashed_secret": "60fe331dc434ac211c53f33da22a384aa0e3fec5",
         "is_verified": false,
-        "line_number": 178
+        "line_number": 183
       }
     ],
     "src/agents/auth-profiles/oauth.openai-codex-refresh-fallback.test.ts": [
@@ -11968,7 +11968,7 @@
         "filename": "src/agents/compaction.tool-result-details.test.ts",
         "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
         "is_verified": false,
-        "line_number": 67
+        "line_number": 57
       }
     ],
     "src/agents/memory-search.test.ts": [
@@ -12766,21 +12766,21 @@
         "filename": "src/cli/qr-cli.test.ts",
         "hashed_secret": "8fc5be300f480d027174b514b563e77548b636f2",
         "is_verified": false,
-        "line_number": 207
+        "line_number": 230
       },
       {
         "type": "Secret Keyword",
         "filename": "src/cli/qr-cli.test.ts",
         "hashed_secret": "f1355ae408e2068355dad8f3a503c2eaedefc0c6",
         "is_verified": false,
-        "line_number": 235
+        "line_number": 248
       },
       {
         "type": "Secret Keyword",
         "filename": "src/cli/qr-cli.test.ts",
         "hashed_secret": "4316c1b21634c0e3f4d53bfb3ca2f48dde69bc4e",
         "is_verified": false,
-        "line_number": 290
+        "line_number": 285
       }
     ],
     "src/cli/update-cli.test.ts": [
@@ -13815,49 +13815,49 @@
         "filename": "src/gateway/credentials.test.ts",
         "hashed_secret": "6255675480f681df08c1704b7b3cd2c49917f0e2",
         "is_verified": false,
-        "line_number": 60
+        "line_number": 81
       },
       {
         "type": "Secret Keyword",
         "filename": "src/gateway/credentials.test.ts",
         "hashed_secret": "de1c41e8ece73f5d5c259bb37eccb59a542b91dc",
         "is_verified": false,
-        "line_number": 240
+        "line_number": 227
       },
       {
         "type": "Secret Keyword",
         "filename": "src/gateway/credentials.test.ts",
         "hashed_secret": "e951da0670d747fb42c25e584913ced2a22df456",
         "is_verified": false,
-        "line_number": 271
+        "line_number": 258
       },
       {
         "type": "Secret Keyword",
         "filename": "src/gateway/credentials.test.ts",
         "hashed_secret": "c4268595e9bc82fd8385d7f5c31cff96d677e31d",
         "is_verified": false,
-        "line_number": 282
+        "line_number": 269
       },
       {
         "type": "Secret Keyword",
         "filename": "src/gateway/credentials.test.ts",
         "hashed_secret": "bc5f9ea9a906cf0641cf9e227b6b9ae3cdc9df59",
         "is_verified": false,
-        "line_number": 298
+        "line_number": 285
       },
       {
         "type": "Secret Keyword",
         "filename": "src/gateway/credentials.test.ts",
         "hashed_secret": "d51f846285cbc6d1dd76677a0fd588c8df44e506",
         "is_verified": false,
-        "line_number": 468
+        "line_number": 455
       },
       {
         "type": "Secret Keyword",
         "filename": "src/gateway/credentials.test.ts",
         "hashed_secret": "60acdb59369429ffd0729487ec638eb0f7f12976",
         "is_verified": false,
-        "line_number": 487
+        "line_number": 474
       }
     ],
     "src/gateway/gateway-cli-backend.live.test.ts": [
@@ -14463,14 +14463,14 @@
         "filename": "src/secrets/path-utils.test.ts",
         "hashed_secret": "c00dbbc9dadfbe1e232e93a729dd4752fade0abf",
         "is_verified": false,
-        "line_number": 50
+        "line_number": 54
       },
       {
         "type": "Secret Keyword",
         "filename": "src/secrets/path-utils.test.ts",
         "hashed_secret": "ff3390557335ba88d37755e41514beb03bc499ec",
         "is_verified": false,
-        "line_number": 68
+        "line_number": 72
       }
     ],
     "src/secrets/runtime.coverage.test.ts": [
@@ -14725,5 +14725,5 @@
       }
     ]
   },
-  "generated_at": "2026-03-07T10:32:59Z"
+  "generated_at": "2026-03-07T11:12:54Z"
 }

extensions/feishu/src/monitor.startup.test.ts

@@ -1,19 +1,35 @@
 import type { ClawdbotConfig } from "openclaw/plugin-sdk/feishu";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { monitorFeishuProvider, stopFeishuMonitor } from "./monitor.js";
-import {
-  createFeishuClientMockModule,
-  createFeishuRuntimeMockModule,
-} from "./monitor.test-mocks.js";
 
 const probeFeishuMock = vi.hoisted(() => vi.fn());
+const feishuClientMockModule = vi.hoisted(() => ({
+  createFeishuWSClient: vi.fn(() => ({ start: vi.fn() })),
+  createEventDispatcher: vi.fn(() => ({ register: vi.fn() })),
+}));
+const feishuRuntimeMockModule = vi.hoisted(() => ({
+  getFeishuRuntime: () => ({
+    channel: {
+      debounce: {
+        resolveInboundDebounceMs: () => 0,
+        createInboundDebouncer: () => ({
+          enqueue: async () => {},
+          flushKey: async () => {},
+        }),
+      },
+      text: {
+        hasControlCommand: () => false,
+      },
+    },
+  }),
+}));
 
 vi.mock("./probe.js", () => ({
   probeFeishu: probeFeishuMock,
 }));
 
-vi.mock("./client.js", () => createFeishuClientMockModule());
-vi.mock("./runtime.js", () => createFeishuRuntimeMockModule());
+vi.mock("./client.js", () => feishuClientMockModule);
+vi.mock("./runtime.js", () => feishuRuntimeMockModule);
 
 function buildMultiAccountWebsocketConfig(accountIds: string[]): ClawdbotConfig {
   return {

extensions/feishu/src/monitor.test-mocks.ts

@@ -1,13 +1,31 @@
 import { vi } from "vitest";
 
-export function createFeishuClientMockModule() {
+export function createFeishuClientMockModule(): {
+  createFeishuWSClient: () => { start: () => void };
+  createEventDispatcher: () => { register: () => void };
+} {
   return {
     createFeishuWSClient: vi.fn(() => ({ start: vi.fn() })),
     createEventDispatcher: vi.fn(() => ({ register: vi.fn() })),
   };
 }
 
-export function createFeishuRuntimeMockModule() {
+export function createFeishuRuntimeMockModule(): {
+  getFeishuRuntime: () => {
+    channel: {
+      debounce: {
+        resolveInboundDebounceMs: () => number;
+        createInboundDebouncer: () => {
+          enqueue: () => Promise<void>;
+          flushKey: () => Promise<void>;
+        };
+      };
+      text: {
+        hasControlCommand: () => boolean;
+      };
+    };
+  };
+} {
   return {
     getFeishuRuntime: () => ({
       channel: {

extensions/zalo/src/monitor.webhook.test.ts

@@ -269,7 +269,7 @@ describe("handleZaloWebhookRequest", () => {
         const saw429 = await postUntilRateLimited({
           baseUrl,
           path: "/hook-rate",
-          secret: "secret",
+          secret: "secret", // pragma: allowlist secret
         });
 
         expect(saw429).toBe(true);
@@ -287,7 +287,7 @@ describe("handleZaloWebhookRequest", () => {
           const response = await fetch(`${baseUrl}/hook-query-status?nonce=${i}`, {
             method: "POST",
             headers: {
-              "x-bot-api-secret-token": "invalid-token",
+              "x-bot-api-secret-token": "invalid-token", // pragma: allowlist secret
               "content-type": "application/json",
             },
             body: "{}",
@@ -310,7 +310,7 @@ describe("handleZaloWebhookRequest", () => {
         const saw429 = await postUntilRateLimited({
           baseUrl,
           path: "/hook-query-rate",
-          secret: "secret",
+          secret: "secret", // pragma: allowlist secret
           withNonceQuery: true,
         });
 

extensions/zalouser/src/monitor.account-scope.test.ts

@@ -1,5 +1,6 @@
 import type { OpenClawConfig, PluginRuntime, RuntimeEnv } from "openclaw/plugin-sdk/zalouser";
 import { describe, expect, it, vi } from "vitest";
+import "./monitor.send-mocks.js";
 import { __testing } from "./monitor.js";
 import { sendMessageZalouserMock } from "./monitor.send-mocks.js";
 import { setZalouserRuntime } from "./runtime.js";

extensions/zalouser/src/monitor.group-gating.test.ts

@@ -1,5 +1,6 @@
 import type { OpenClawConfig, PluginRuntime, RuntimeEnv } from "openclaw/plugin-sdk/zalouser";
 import { beforeEach, describe, expect, it, vi } from "vitest";
+import "./monitor.send-mocks.js";
 import { __testing } from "./monitor.js";
 import {
   sendDeliveredZalouserMock,

src/cli/memory-cli.test.ts

@@ -60,7 +60,7 @@ describe("memory cli", () => {
     return JSON.parse(String(log.mock.calls[0]?.[0] ?? "null")) as Record<string, unknown>;
   }
 
-  const inactiveMemorySecretDiagnostic = "agents.defaults.memorySearch.remote.apiKey inactive";
+  const inactiveMemorySecretDiagnostic = "agents.defaults.memorySearch.remote.apiKey inactive"; // pragma: allowlist secret
 
   function expectCliSync(sync: ReturnType<typeof vi.fn>) {
     expect(sync).toHaveBeenCalledWith(