fix(ci): repair security and route test fixtures

extensions/mattermost/src/setup-surface.ts

@@ -1,7 +1,13 @@
-import { DEFAULT_ACCOUNT_ID, hasConfiguredSecretInput } from "openclaw/plugin-sdk/mattermost";
+import {
+  DEFAULT_ACCOUNT_ID,
+  applySetupAccountConfigPatch,
+  hasConfiguredSecretInput,
+  type OpenClawConfig,
+} from "openclaw/plugin-sdk/mattermost";
 import { type ChannelSetupWizard } from "../../../src/channels/plugins/setup-wizard.js";
 import { formatDocsLink } from "../../../src/terminal/links.js";
 import { listMattermostAccountIds } from "./mattermost/accounts.js";
+import { normalizeMattermostBaseUrl } from "./mattermost/client.js";
 import {
   isMattermostConfigured,
   mattermostSetupAdapter,

src/cli/program/routes.test.ts

@@ -32,9 +32,12 @@ describe("program routes", () => {
     await expect(route?.run(argv)).resolves.toBe(false);
   }
 
-  it("matches status route and always preloads plugins", () => {
+  it("matches status route and preloads plugins only for text output", () => {
     const route = expectRoute(["status"]);
-    expect(route?.loadPlugins).toBe(true);
+    expect(typeof route?.loadPlugins).toBe("function");
+    const shouldLoad = route?.loadPlugins as (argv: string[]) => boolean;
+    expect(shouldLoad(["node", "openclaw", "status"])).toBe(true);
+    expect(shouldLoad(["node", "openclaw", "status", "--json"])).toBe(false);
   });
 
   it("matches health route and preloads plugins only for text output", () => {

src/security/audit.test.ts

@@ -1803,7 +1803,14 @@ description: test skill
   });
 
   it("warns when multiple DM senders share the main session", async () => {
-    const cfg: OpenClawConfig = { session: { dmScope: "main" } };
+    const cfg: OpenClawConfig = {
+      session: { dmScope: "main" },
+      channels: {
+        whatsapp: {
+          enabled: true,
+        },
+      },
+    };
     const plugins: ChannelPlugin[] = [
       {
         id: "whatsapp",