PR #65850: chore: channel infra consistency -- qqbot guardrails, synology-chat labeler, onboarding scopes

• Repository: openclaw/openclaw
• Author: Jah-yee
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/65850

Description (problem / solution / changelog)

Summary

Three small infra gaps found while auditing bundled channel and provider extensions:

• Problem 1: qqbot is a bundled channel plugin but was missing from package-manifest.contract.test.ts and channel-import-guardrails.test.ts, while all other bundled channels (feishu, zalo, telegram, discord, etc.) are covered. This means dependency drift and import boundary violations in qqbot would not be caught by CI.
• Problem 2: extensions/synology-chat/ and docs/channels/synology-chat.md exist, but .github/labeler.yml has no channel: synology-chat rule. PRs touching Synology Chat files are not auto-labeled.
• Problem 3: runway and alibaba are video-generation-only providers (no text providers key) but had no onboardingScopes set, defaulting to ["text-inference"] and appearing in the text model onboarding wizard. Other media-only providers (fal, vydra) correctly set ["image-generation"].
• What changed: Added qqbot to two test guardrail lists with its 3 mirrored runtime deps; added synology-chat labeler rule; set onboardingScopes: ["image-generation"] for runway and alibaba manifests.
• What did NOT change (scope boundary): No runtime logic, no new dependencies, no config migration. Pure additive test/infra/metadata fixes.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #65851
• Closes #65852
• Closes #65854
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: qqbot was added as a bundled channel but never included in the guardrail test lists. synology-chat was similarly missed in the labeler. runway and alibaba were contributed as video-only providers without explicit onboardingScopes, inheriting the default text-inference scope.
• Missing detection / guardrail: No automated check ensures all bundled channels appear in the guardrail lists or that the labeler covers all extension directories.
• Contributing context: Additive oversights from when the extensions were first contributed.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Existing coverage already sufficient
• Target test or file: package-manifest.contract.test.ts, channel-import-guardrails.test.ts
• Scenario the test should lock in: qqbot dependencies stay mirrored in root package.json; qqbot imports respect the plugin-sdk boundary
• Existing test that already covers this: The contract tests themselves -- this PR adds qqbot to them
• If no new test is added, why not: Adding qqbot to the existing test infrastructure IS the coverage fix

User-visible / Behavior Changes

1. QQBot dependency and import boundary violations will now be caught in CI (previously silent)
2. PRs touching extensions/synology-chat/** or docs/channels/synology-chat.md will get the channel: synology-chat label
3. Runway and Alibaba will no longer appear in the text-inference onboarding wizard; they will appear in the image-generation wizard instead (matching fal and vydra behavior)

Diagram (if applicable)

N/A

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? No

Repro + Verification

Environment

• OS: macOS (darwin 25.1.0)
• Runtime/container: Node 22+, pnpm
• Model/provider: N/A (infra changes)
• Integration/channel: qqbot, synology-chat, runway, alibaba

Steps

1. pnpm vitest run src/plugins/contracts/package-manifest.contract.test.ts -- 39 tests pass (was 38)
2. pnpm vitest run src/channels/plugins/contracts/channel-import-guardrails.test.ts -- 12 tests pass
3. Verify .github/labeler.yml contains channel: synology-chat
4. Verify extensions/runway/openclaw.plugin.json and extensions/alibaba/openclaw.plugin.json have onboardingScopes: ["image-generation"]

Expected

• All tests pass; labeler rule present; manifests correctly scoped

Actual

• Confirmed all of the above

Evidence

• Failing test/log before + passing after
• Contract tests: 39 passed (was 38 before qqbot)
• Guardrail tests: 12 passed
• Pre-commit hooks (lint + typecheck + format + import cycles) all pass

Human Verification (required)

• Verified scenarios: Both contract test suites pass locally; pre-commit hooks pass; manual diff review of all 5 changed files
• Edge cases checked: Confirmed byteplus and together are NOT changed because they register text providers (so defaulting to text-inference is correct for them); only pure video providers (runway, alibaba) get the scope fix
• What you did NOT verify: Actual onboarding UI rendering (would need interactive openclaw configure flow)

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No

Risks and Mitigations

• Risk: If qqbot currently has import boundary violations that were previously undetected, the guardrail test will now catch them and fail CI.
  • Mitigation: This is the intended behavior -- surfaces real issues rather than hiding them. Verified locally that qqbot passes the guardrails.
• Risk: Runway/Alibaba users who relied on finding these providers in the text-inference wizard will now need to look in the image-generation wizard.
  • Mitigation: These are video-only providers with no text model support, so appearing in text-inference was always incorrect.

Changed files

• .github/labeler.yml (modified, +5/-0)
• extensions/alibaba/openclaw.plugin.json (modified, +1/-0)
• extensions/runway/openclaw.plugin.json (modified, +1/-0)
• src/channels/plugins/contracts/channel-import-guardrails.test.ts (modified, +2/-0)
• src/plugins/contracts/package-manifest.contract.test.ts (modified, +5/-0)

PR #65856: fix(onboarding): set onboardingScopes for video-only providers runway and alibaba

• Repository: openclaw/openclaw
• Author: Jah-yee
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/65856

Description (problem / solution / changelog)

Summary

• Problem: runway and alibaba are video-generation-only providers (no text providers key in their manifests, only contracts.videoGenerationProviders). Their providerAuthChoices do not set onboardingScopes, which defaults to ["text-inference"] per src/plugins/manifest.ts. This causes them to appear in the text model onboarding wizard, where they are irrelevant.
• Why it matters: Users running openclaw configure to set up a text model see Runway and Alibaba Model Studio in the provider list, even though these providers only do video generation. This is confusing and adds noise to the setup flow.
• What changed: Added onboardingScopes: ["image-generation"] to providerAuthChoices in both extensions/runway/openclaw.plugin.json and extensions/alibaba/openclaw.plugin.json. This matches the pattern used by fal and vydra (other media-only providers).
• What did NOT change (scope boundary): No runtime logic, no new dependencies, no type changes. Only two manifest fields added.

Audit

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #65854
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: runway and alibaba were contributed as video-only providers without explicit onboardingScopes. The default (text-inference) was inherited silently.
• Missing detection / guardrail: No automated check validates that providers without text capabilities are not scoped to text-inference onboarding.
• Contributing context: The onboardingScopes field was added after these providers were initially contributed.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Existing coverage already sufficient
• If no new test is added, why not: This is a manifest metadata fix. The onboarding flow reads onboardingScopes from the manifest at runtime; there is no dedicated test for "which providers appear in which wizard" beyond the existing provider-flow.ts logic. A manifest-level assertion could be added in a follow-up if desired.

User-visible / Behavior Changes

1. Runway and Alibaba Model Studio will no longer appear in the text-inference onboarding wizard
2. They will appear in the image-generation wizard instead (alongside fal, vydra)

Diagram (if applicable)

Before:
[openclaw configure] -> text model wizard -> shows: [..., Runway, Alibaba, ...]

After:
[openclaw configure] -> text model wizard -> shows: [...] (no Runway/Alibaba)
[openclaw configure] -> image/video wizard -> shows: [..., Runway, Alibaba, fal, vydra, ...]

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? No

Repro + Verification

Environment

• OS: macOS (darwin 25.1.0)
• Runtime/container: Node 22+, pnpm
• Model/provider: runway, alibaba
• Integration/channel: N/A

Steps

1. Check extensions/runway/openclaw.plugin.json for onboardingScopes: ["image-generation"]
2. Check extensions/alibaba/openclaw.plugin.json for onboardingScopes: ["image-generation"]
3. Pre-commit hooks pass

Expected

• Both manifests correctly scoped; hooks pass

Actual

• Confirmed

Evidence

• Trace/log snippets
• Pre-commit hooks (lint + typecheck + format) pass
• Manifest diff review confirms only onboardingScopes added

Human Verification (required)

• Verified scenarios: Diff review; confirmed byteplus and together are NOT changed (they have text providers so text-inference default is correct)
• Edge cases checked: Only providers with no text providers key AND only video contracts are changed
• What you did NOT verify: Interactive onboarding UI rendering (would need openclaw configure flow)

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No

Risks and Mitigations

• Risk: Users who previously found Runway/Alibaba in the text wizard and used that path will now need to look in the image-generation wizard.
  • Mitigation: These are video-only providers with no text model support. Appearing in text-inference onboarding was always incorrect. Users can still configure them via openclaw config set or env vars regardless of wizard visibility.

Changed files

• extensions/alibaba/openclaw.plugin.json (modified, +1/-0)
• extensions/runway/openclaw.plugin.json (modified, +1/-0)