* fix(microsoft-foundry): bound az login device-code subprocess
Add a 5-minute timeout to the az login spawn so a stalled Azure CLI
does not block the caller indefinitely. The timeout kills the child
process and rejects the promise with a descriptive message.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(microsoft-foundry): reject login timeout immediately
* refactor(microsoft-foundry): use shared process timeout
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* feat(models): add Claude Opus 5 support
* test(models): align Opus 5 setup fixtures
* test(models): update ambient Opus 5 detection
* fix(models): reconcile Opus 5 support with main
* fix(microsoft-foundry): decode spawn pipes statefully with setEncoding('utf8')
Co-Authored-By: SunnyShu0925 <sunny.shu0925@gmail.com>
child_process spawn stdout/stderr .on('data') handlers in
azLoginDeviceCodeWithOptions received raw Buffer chunks. When a
multi-byte UTF-8 code point straddled a chunk boundary, String(chunk)
produced U+FFFD (replacement characters) for the split partial
sequences.
Fix the same way as PR #108518 (provider-local-service) and #109220
(voice-call ngrok): call setEncoding('utf8') on the pipe streams before
attaching data listeners so Node's stream decoder reassembles full code
points across chunk boundaries.
Test: PassThrough stream that receives a 4-byte smiley (U+1F60A) split
mid-sequence across two Buffer writes. With setEncoding, the reassembled
output is the clean code point, not U+FFFD.
* test(microsoft-foundry): replace PassThrough test with azLoginDeviceCodeWithOptions regression
* test(microsoft-foundry): add real-spawn integration test for split-byte setEncoding proof
* fix: add :unknown to catch callback variable for oxlint
* chore: add proof script for setEncoding utf8 split-byte fix
* remove standalone proof script (proof lives in PR body + test coverage)
* test(microsoft-foundry): tighten UTF-8 stream regression
Co-authored-by: SunnyShu0925 <shu.zongyu@xydigit.com>
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
resolveTranscriptAssistantRoute read providerConfig.models.find without
guarding models, but the runtime config passed here is the raw user config
where a provider entry may omit models (e.g. models.providers.openai =
{ apiKey }). That threw "Cannot read properties of undefined (reading 'find')"
inside the SQLite transcript-append transaction, so every agent turn failed to
persist its transcript (the underlying error was swallowed to {} and surfaced
only as "Turn transcript persistence failed").
Guard the optional models array at the crash site, and fix two identical
raw-config hazards found in the same sweep (cron isolated-agent model api
resolution, microsoft-foundry image provider). Regression test drives
redactTranscriptMessage with a provider that has no models array.
* chore(plugins): gate deprecation hygiene in CI and purge internal deprecated usage
* fix(agents): migrate auth-profiles oauth import to OAuthProviderId
* fix(whatsapp): use durability param in delivery-recovery test
* chore(scripts): declare shouldRunDeprecationHygieneChecks in check-changed types
* test(plugins): update runtime-api guard for ssrf policy rename
* fix(extensions): make indexed access explicit across channel plugins
Transport-payload-safe burn-down: malformed Telegram/Discord/QQ/LINE
and sibling channel input keeps existing skip paths; no synthesized
fields, no new throws in delivery loops. Zalo escape sentinels preserve
literal matches instead of undefined replacements.
* fix(extensions): make indexed access explicit across provider and memory plugins
Stream and model iteration, tool-block guards, capture guards, and
sparse accumulators; singleton model reads carry named invariants.
* fix(extensions): make indexed access explicit across tooling plugins, flip the extensions lane
Remaining plugins (oc-path, qa-lab, browser, logbook, and siblings) plus
the tsconfig.extensions.json flag flip. Cleanup: logbook sampleFrames
NaN index at max=1, QA retry clamp at non-positive attempts, dead Canvas
probe and OpenShell no-op slice removed, twitch test setup leak excluded
from the prod lane.
* refactor(plugin-sdk): expose expectDefined via a focused SDK subpath
Extensions imported @openclaw/normalization-core directly, crossing the
external-plugin packaging boundary (it only worked because the runtime
builder bundles undeclared workspace helpers). expect-runtime joins the
canonical entrypoints JSON, generated exports, API baseline, docs, and
subpath contract test; all 78 extension imports now use the SDK seam.
Two scanner-shaped locals renamed for review-bundle hygiene.
* chore(plugin-sdk): raise surface budgets for the expect-runtime subpath
One new entrypoint with one callable export, added intentionally as the
packaging-honest seam for extension invariant helpers.
* chore(release): close out 2026.6.10 on main
* chore(release): align native app metadata for 2026.6.10
* chore(release): sync Android 2026.6.10 notes
* docs(changelog): preserve 2026.6.9 history
* docs(changelog): preserve 2026.6.9 history
