Tests: fix ClawMongo suite alignment

[romiluz13]

Summary

• Problem: the ClawMongo sync branch still had full-suite failures across fork-specific memory defaults, plugin metadata, onboarding, diagnostics, auth probe behavior, dependency ownership checks, fast JSON status memory path, a build-only plugin runtime dependency bundling issue, and the real E2E script called a stale openclaw memory status command plus assumed dist/memory/index.js already existed.
• Why it matters: full-suite, build, and real MongoDB/Voyage E2E green are required before considering a main merge.
• What changed: aligned ClawMongo memory/status defaults, wired ClawMongo memory setup into onboarding, fixed cached device-auth probe behavior, added a shared model-auth test mock, supported @romiluz/clawmongo plugin metadata, removed duplicate root Slack/Telegram runtime deps, updated status fast-json expectations for MongoDB memory, externalized plugin-local Slack/Telegram/WhatsApp runtime packages from the root tsdown build, changed the real ClawMongo E2E to call openclaw status --json --all, made it build dist before importing the memory runtime, and added a stable dist/memory/index.js build entry.
• What did NOT change (scope boundary): no release/version bump, no main merge, no real secret values committed.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Related Sync upstream and keep MongoDB-only memory #1
• This PR fixes a bug or regression

Real behavior proof (required for external PRs)

• Behavior or issue addressed: full-suite/build failures and stale real-E2E CLI/dist assumptions in the ClawMongo sync branch.
• Real environment tested: Cursor Cloud Linux workspace, Node 22.22.2, pnpm 11.1.0, real MongoDB Atlas connection, real Voyage env configured by operator in their terminal.
• Exact steps or command run after this patch: targeted failed-file Vitest set, pnpm test src/commands/status.scan.fast-json.test.ts, pnpm test src/infra/tsdown-config.test.ts src/plugins/bundled-runtime-deps.test.ts, pnpm test src/infra/tsdown-config.test.ts, pnpm check, full pnpm test, pnpm build, test -f dist/memory/index.js, pnpm clawmongo:e2e, MongoDB knowledge-base search, branch/main ancestry check, QA mock suite attempt, and redacted diff secret scans.
• Evidence after fix: targeted failed-file set passed 7 Vitest shards; pnpm check passed; full pnpm test passed 76 Vitest shards twice after the final build fix; pnpm build passed; dist/memory/index.js exists after build; current diff gitleaks scans reported no leaks; branch contains current origin/main (origin-main-included=yes); real pnpm clawmongo:e2e passed against Atlas with ok: true, deploymentProfile: atlas-cloud, and resultCount: 1.
• Observed result after fix: repository check, test, build, and real MongoDB/Voyage E2E gates are green on this branch.
• What was not tested: live-frontier QA through Grove/OpenAI-compatible credentials from the agent process; QA mock suite remains non-green and should not be used as a pass signal yet.
• Before evidence: initial pnpm test reported failures in gateway probe auth, logging redaction capture, status scan, version/plugin runtime metadata, onboarding memory setup, embedding mocks, MEMORY.md prompt text, query rewrite telemetry, bundled dependency ownership, plugin config defaults, min-host guardrails, and later fast-json memory expectation; pnpm build then exposed plugin-local Slack type dependency bundling from the root build; user-run real E2E exposed stale openclaw memory status --json and missing dist/memory/index.js before the fixes.

Root Cause (if applicable)

• Root cause: upstream OpenClaw assumptions were still present in tests and helper paths while ClawMongo defaults and package metadata had diverged toward MongoDB-only memory and @romiluz/clawmongo publishing metadata; root build also needed to externalize plugin-local runtime packages after removing duplicate root deps; E2E script retained an old CLI subcommand and assumed prebuilt dist/stable memory dist entry.
• Missing detection / guardrail: the fork sync had not rerun the full multi-shard suite plus build after ClawMongo identity/default changes, and the real E2E script had only reached preflight until credentials were injected externally.
• Contributing context (if known): plugin metadata exists under both openclaw and @romiluz/clawmongo shapes during fork alignment.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: full pnpm test, pnpm build, pnpm clawmongo:e2e, plus targeted failed-file reruns.
• Scenario the test should lock in: ClawMongo MongoDB defaults, fork metadata handling, cached probe auth, plugin dependency ownership, fast-json --all memory inspection, plugin-local runtime externalization, and the real E2E CLI/status/dist path.
• Why this is the smallest reliable guardrail: targeted tests isolate the regressions; full pnpm test, pnpm build, and pnpm clawmongo:e2e are the merge gates.
• Existing test that already covers this (if any): the updated tests in this PR plus the real E2E script.
• If no new test is added, why not: existing affected tests were corrected/extended rather than adding duplicate coverage.

User-visible / Behavior Changes

• ClawMongo onboarding now runs MongoDB memory setup before auth selection.
• Gateway probes with cached device auth prefer the cached operator token for detail RPCs.
• MongoDB prompt guidance no longer names MEMORY.md as runtime memory guidance.

Diagram (if applicable)

N/A

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? Yes
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? No
• If any Yes, explain risk + mitigation: gateway probe auth now prefers an already cached local operator device token for read-only probe details; this avoids mutating first-time probes and uses existing cached auth scope only.

Repro + Verification

Environment

• OS: Linux
• Runtime/container: Node 22.22.2 / pnpm 11.1.0
• Model/provider: MongoDB Atlas + Voyage env for real E2E
• Integration/channel (if any): N/A
• Relevant config (redacted): memory.mongodb.deploymentProfile=atlas-cloud, temporary E2E database/prefix generated by script

Steps

1. Run the targeted failed-file Vitest set from the initial full-suite failure.
2. Run pnpm check.
3. Run a redacted gitleaks scan on the current diff.
4. Run pnpm test and patch the remaining fast-json expectation.
5. Run pnpm test src/commands/status.scan.fast-json.test.ts.
6. Run a clean full pnpm test.
7. Run pnpm build; patch plugin runtime externalization; rerun pnpm test src/infra/tsdown-config.test.ts src/plugins/bundled-runtime-deps.test.ts, pnpm build, pnpm check, and full pnpm test.
8. Query MongoDB knowledge base for auto-embedding/vector-search behavior.
9. Attempt repo-backed QA mock suite and inspect report.
10. Patch the stale real-E2E CLI command and missing-dist assumption; add a stable memory dist entry; rerun preflight/status/build checks.
11. Operator runs pnpm clawmongo:e2e with rotated env vars set in their terminal.

Expected

• Targeted tests, check, full suite, build, and real MongoDB/Voyage E2E pass; diff secret scan is clean.

Actual

• Targeted tests passed.
• pnpm check passed.
• Full pnpm test passed 76 shards twice after the final build fix.
• pnpm build passed after externalizing plugin-local runtime dependencies and after adding the stable memory dist entry.
• Current diff gitleaks scans reported no leaks.
• Real pnpm clawmongo:e2e passed:
  • ok: true
  • deploymentProfile: atlas-cloud
  • temporary database clawmongo_e2e_386a6290
  • temporary prefix e2e_386a6290_
  • resultCount: 1
• MongoDB MCP knowledge-base search confirmed auto-embedding vector search uses text query plus compatible Voyage model and does not need client-computed queryVector for auto-embedding indexes.
• QA mock suite is not green: 56 passed, 12 failed. Failures include subagent completion timeout, memory recall/tool timeouts, builtin-memory assumptions in Claude CLI capability scenarios, missing skill_workshop MCP tool, runtime inventory drift expectation, and image/control UI roundtrip timeout.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

• Verified scenarios: targeted failed-file test set, fast-json follow-up test, tsdown externalization test, stable memory dist entry test, pnpm check, full pnpm test, pnpm build, real MongoDB/Voyage E2E pass, current diff secret scans, MongoDB docs/knowledge-base lookup, QA mock suite attempt/report inspection, stale E2E command fix, fresh-dist E2E build fix.
• Edge cases checked: full-tree gitleaks scan still reports pre-existing repository fixtures/findings, so current-diff scan was used as the actionable secret gate for this patch.
• What you did not verify: live-frontier QA because OPENAI_API_KEY/OPENCLAW_LIVE_OPENAI_KEY is not present in the agent process environment.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: QA mock suite has existing scenario failures under ClawMongo defaults.
  • Mitigation: do not treat QA mock as a merge-green signal until those scenarios are either fixed or explicitly rebaselined for MongoDB-only memory.
• Risk: secrets were pasted in chat during validation.
  • Mitigation: rotate MongoDB, Voyage, and Grove keys before any long-lived use.