diff --git a/.secrets.baseline b/.secrets.baseline
index fe52d22d043..4f98a314a46 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -10166,7 +10166,7 @@
         "filename": "docs/tools/skills.md",
         "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
         "is_verified": false,
-        "line_number": 200
+        "line_number": 201
       }
     ],
     "docs/tools/web.md": [
@@ -12631,21 +12631,21 @@
         "filename": "src/infra/provider-usage.auth.normalizes-keys.test.ts",
         "hashed_secret": "45c7365e3b542cdb4fae6ec10c2ff149224d7656",
         "is_verified": false,
-        "line_number": 124
+        "line_number": 162
       },
       {
         "type": "Secret Keyword",
         "filename": "src/infra/provider-usage.auth.normalizes-keys.test.ts",
         "hashed_secret": "b67074884ab7ef7c7a8cd6a3da9565d96c792248",
         "is_verified": false,
-        "line_number": 125
+        "line_number": 163
       },
       {
         "type": "Secret Keyword",
         "filename": "src/infra/provider-usage.auth.normalizes-keys.test.ts",
         "hashed_secret": "d4d8027e64f9cf4180d3aecfe31ea409368022ee",
         "is_verified": false,
-        "line_number": 126
+        "line_number": 164
       }
     ],
     "src/infra/shell-env.test.ts": [
@@ -13011,5 +13011,5 @@
       }
     ]
   },
-  "generated_at": "2026-03-07T18:17:47Z"
+  "generated_at": "2026-03-07T21:15:22Z"
 }
diff --git a/apps/macos/Tests/OpenClawIPCTests/GatewayEndpointStoreTests.swift b/apps/macos/Tests/OpenClawIPCTests/GatewayEndpointStoreTests.swift
index 7aff5f3970b..c989daffd0c 100644
--- a/apps/macos/Tests/OpenClawIPCTests/GatewayEndpointStoreTests.swift
+++ b/apps/macos/Tests/OpenClawIPCTests/GatewayEndpointStoreTests.swift
@@ -220,7 +220,7 @@ import Testing
         let config: GatewayConnection.Config = try (
             url: #require(URL(string: "ws://127.0.0.1:18789")),
             token: "abc123",
-            password: "sekret")
+            password: "sekret") // pragma: allowlist secret
 
         let url = try GatewayEndpointStore.dashboardURL(
             for: config,
diff --git a/src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts b/src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts
index 0705f597e71..997ff28065c 100644
--- a/src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts
+++ b/src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts
@@ -234,7 +234,7 @@ describe("models-config", () => {
       const parsed = await runCustomProviderMergeTest({
         seedProvider: {
           baseUrl: "https://agent.example/v1",
-          apiKey: "AGENT_KEY",
+          apiKey: "AGENT_KEY", // pragma: allowlist secret
           api: "openai-responses",
           models: [{ id: "agent-model", name: "Agent model", input: ["text"] }],
         },
@@ -414,7 +414,7 @@ describe("models-config", () => {
             providers: {
               openai: {
                 baseUrl: "https://api.openai.com/v1",
-                apiKey: "sk-plaintext-should-not-appear", // already resolved by loadConfig
+                apiKey: "sk-plaintext-should-not-appear", // pragma: allowlist secret; already resolved by loadConfig
                 api: "openai-completions",
                 models: [
                   {
diff --git a/src/agents/models-config.providers.normalize-keys.test.ts b/src/agents/models-config.providers.normalize-keys.test.ts
index f529ee610bf..be92bbcd474 100644
--- a/src/agents/models-config.providers.normalize-keys.test.ts
+++ b/src/agents/models-config.providers.normalize-keys.test.ts
@@ -77,12 +77,12 @@ describe("normalizeProviders", () => {
   it("replaces resolved env var value with env var name to prevent plaintext persistence", async () => {
     const agentDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-agent-"));
     const original = process.env.OPENAI_API_KEY;
-    process.env.OPENAI_API_KEY = "sk-test-secret-value-12345";
+    process.env.OPENAI_API_KEY = "sk-test-secret-value-12345"; // pragma: allowlist secret
     try {
       const providers: NonNullable<NonNullable<OpenClawConfig["models"]>["providers"]> = {
         openai: {
           baseUrl: "https://api.openai.com/v1",
-          apiKey: "sk-test-secret-value-12345", // simulates resolved ${OPENAI_API_KEY}
+          apiKey: "sk-test-secret-value-12345", // pragma: allowlist secret; simulates resolved ${OPENAI_API_KEY}
           api: "openai-completions",
           models: [
             {
diff --git a/ui/src/ui/app-view-state.ts b/ui/src/ui/app-view-state.ts
index 2029bd8f8f4..eb0059faf8e 100644
--- a/ui/src/ui/app-view-state.ts
+++ b/ui/src/ui/app-view-state.ts
@@ -59,6 +59,7 @@ export type AppViewState = {
   chatToolMessages: unknown[];
   chatStreamSegments: Array<{ text: string; ts: number }>;
   chatStream: string | null;
+  chatStreamSegments: Array<{ text: string; ts: number }>;
   chatStreamStartedAt: number | null;
   chatRunId: string | null;
   compactionStatus: CompactionStatus | null;