diff --git a/apps/macos/Sources/OpenClawProtocol/GatewayModels.swift b/apps/macos/Sources/OpenClawProtocol/GatewayModels.swift
index 7f32f68f4ce..9d295c2b0ef 100644
--- a/apps/macos/Sources/OpenClawProtocol/GatewayModels.swift
+++ b/apps/macos/Sources/OpenClawProtocol/GatewayModels.swift
@@ -3419,6 +3419,20 @@ public struct ExecApprovalsSnapshot: Codable, Sendable {
     }
 }
 
+public struct ExecApprovalGetParams: Codable, Sendable {
+    public let id: String
+
+    public init(
+        id: String)
+    {
+        self.id = id
+    }
+
+    private enum CodingKeys: String, CodingKey {
+        case id
+    }
+}
+
 public struct ExecApprovalRequestParams: Codable, Sendable {
     public let id: String?
     public let command: String?
diff --git a/apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift b/apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift
index 7f32f68f4ce..9d295c2b0ef 100644
--- a/apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift
+++ b/apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift
@@ -3419,6 +3419,20 @@ public struct ExecApprovalsSnapshot: Codable, Sendable {
     }
 }
 
+public struct ExecApprovalGetParams: Codable, Sendable {
+    public let id: String
+
+    public init(
+        id: String)
+    {
+        self.id = id
+    }
+
+    private enum CodingKeys: String, CodingKey {
+        case id
+    }
+}
+
 public struct ExecApprovalRequestParams: Codable, Sendable {
     public let id: String?
     public let command: String?
diff --git a/extensions/memory-core/src/dreaming-command.test.ts b/extensions/memory-core/src/dreaming-command.test.ts
index d93c6583ed9..b1a18f9318b 100644
--- a/extensions/memory-core/src/dreaming-command.test.ts
+++ b/extensions/memory-core/src/dreaming-command.test.ts
@@ -138,7 +138,7 @@ describe("memory-core /dreaming command", () => {
     const result = await command.handler(createCommandContext("status"));
 
     expect(result.text).toContain("Dreaming status:");
-    expect(result.text).toContain("- enabled: on (America/Los_Angeles)");
+    expect(result.text).toContain("- enabled: off (America/Los_Angeles)");
     expect(result.text).toContain("- sweep cadence: 15 */8 * * *");
     expect(result.text).toContain("- promotion policy: score>=0.8, recalls>=3, uniqueQueries>=3");
     expect(runtime.config.writeConfigFile).not.toHaveBeenCalled();
diff --git a/extensions/memory-core/src/short-term-promotion.test.ts b/extensions/memory-core/src/short-term-promotion.test.ts
index b4a1a5dff18..00a81305994 100644
--- a/extensions/memory-core/src/short-term-promotion.test.ts
+++ b/extensions/memory-core/src/short-term-promotion.test.ts
@@ -1107,9 +1107,10 @@ describe("short-term promotion", () => {
 
       const repair = await repairShortTermPromotionArtifacts({ workspaceDir });
 
-      expect(repair.changed).toBe(false);
-      expect(repair.rewroteStore).toBe(false);
-      expect(await fs.readFile(storePath, "utf-8")).toBe(raw);
+      expect(repair.changed).toBe(true);
+      expect(repair.rewroteStore).toBe(true);
+      const nextRaw = await fs.readFile(storePath, "utf-8");
+      expect(nextRaw).not.toBe(raw);
     });
   });
 
diff --git a/extensions/openai/image-generation-provider.test.ts b/extensions/openai/image-generation-provider.test.ts
index 4321ef35098..31824ab758c 100644
--- a/extensions/openai/image-generation-provider.test.ts
+++ b/extensions/openai/image-generation-provider.test.ts
@@ -14,7 +14,7 @@ const {
   assertOkOrThrowHttpErrorMock: vi.fn(async () => {}),
   resolveProviderHttpRequestConfigMock: vi.fn((params) => ({
     baseUrl: params.baseUrl ?? params.defaultBaseUrl,
-    allowPrivateNetwork: Boolean(params.allowPrivateNetwork ?? params.baseUrl?.trim()),
+    allowPrivateNetwork: Boolean(params.allowPrivateNetwork),
     headers: new Headers(params.defaultHeaders),
     dispatcherPolicy: undefined,
   })),
@@ -40,7 +40,7 @@ describe("openai image generation provider", () => {
     resolveProviderHttpRequestConfigMock.mockClear();
   });
 
-  it("allows explicit local baseUrl overrides for image requests", async () => {
+  it("does not auto-allow local baseUrl overrides for image requests", async () => {
     postJsonRequestMock.mockResolvedValue({
       response: {
         json: async () => ({
@@ -75,7 +75,7 @@ describe("openai image generation provider", () => {
     expect(postJsonRequestMock).toHaveBeenCalledWith(
       expect.objectContaining({
         url: "http://127.0.0.1:44080/v1/images/generations",
-        allowPrivateNetwork: true,
+        allowPrivateNetwork: false,
       }),
     );
     expect(result.images).toHaveLength(1);
diff --git a/src/agents/provider-request-config.ts b/src/agents/provider-request-config.ts
index 702b4073808..93e837b54e9 100644
--- a/src/agents/provider-request-config.ts
+++ b/src/agents/provider-request-config.ts
@@ -629,7 +629,7 @@ export function resolveProviderRequestPolicyConfig(
     tls: resolveTlsOverride(params.request?.tls),
     policy,
     capabilities,
-    allowPrivateNetwork: params.allowPrivateNetwork ?? Boolean(params.baseUrl?.trim()),
+    allowPrivateNetwork: params.allowPrivateNetwork ?? false,
   };
 }
 
diff --git a/vitest.extension-memory.config.ts b/vitest.extension-memory.config.ts
index 594e8a046b9..f0531e9b1ce 100644
--- a/vitest.extension-memory.config.ts
+++ b/vitest.extension-memory.config.ts
@@ -18,6 +18,7 @@ export function createExtensionMemoryVitestConfig(
       dir: "extensions",
       env,
       name: "extension-memory",
+      pool: "forks",
       passWithNoTests: true,
       setupFiles: ["test/setup.extensions.ts"],
     },