feat(tooling): enforce noUncheckedIndexedAccess in the extensions lane (NUIA phase 4) (#105132)

* fix(extensions): make indexed access explicit across channel plugins

Transport-payload-safe burn-down: malformed Telegram/Discord/QQ/LINE
and sibling channel input keeps existing skip paths; no synthesized
fields, no new throws in delivery loops. Zalo escape sentinels preserve
literal matches instead of undefined replacements.

* fix(extensions): make indexed access explicit across provider and memory plugins

Stream and model iteration, tool-block guards, capture guards, and
sparse accumulators; singleton model reads carry named invariants.

* fix(extensions): make indexed access explicit across tooling plugins, flip the extensions lane

Remaining plugins (oc-path, qa-lab, browser, logbook, and siblings) plus
the tsconfig.extensions.json flag flip. Cleanup: logbook sampleFrames
NaN index at max=1, QA retry clamp at non-positive attempts, dead Canvas
probe and OpenShell no-op slice removed, twitch test setup leak excluded
from the prod lane.

* refactor(plugin-sdk): expose expectDefined via a focused SDK subpath

Extensions imported @openclaw/normalization-core directly, crossing the
external-plugin packaging boundary (it only worked because the runtime
builder bundles undeclared workspace helpers). expect-runtime joins the
canonical entrypoints JSON, generated exports, API baseline, docs, and
subpath contract test; all 78 extension imports now use the SDK seam.
Two scanner-shaped locals renamed for review-bundle hygiene.

* chore(plugin-sdk): raise surface budgets for the expect-runtime subpath

One new entrypoint with one callable export, added intentionally as the
packaging-honest seam for extension invariant helpers.

extensions/github-copilot/embeddings.ts

@@ -154,8 +154,9 @@ function pickBestModel(available: string[], userModel?: string): string {
       return preferred;
     }
   }
-  if (available.length > 0) {
-    return available[0];
+  const [firstAvailable] = available;
+  if (firstAvailable) {
+    return firstAvailable;
   }
   throw new Error("No embedding models available from GitHub Copilot");
 }

extensions/github-copilot/index.ts

@@ -37,7 +37,11 @@ import {
 } from "./replay-policy.js";
 import { wrapCopilotProviderStream } from "./stream.js";
 
-const COPILOT_ENV_VARS = ["COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN"];
+const COPILOT_ENV_VARS: [string, string, string] = [
+  "COPILOT_GITHUB_TOKEN",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+];
 const DEFAULT_COPILOT_MODEL = "github-copilot/claude-opus-4.7";
 const DEFAULT_COPILOT_PROFILE_ID = "github-copilot:github";
 
@@ -165,25 +169,30 @@ function applyGithubCopilotDomainToConfig(
 
   const models = config.models ?? {};
   const providers = models.providers ?? {};
-  const provider = providers[PROVIDER_ID] ?? {};
-  const params = { ...provider.params } as Record<string, unknown>;
+  const provider = providers[PROVIDER_ID];
+  const params: Record<string, unknown> = {};
+  if (provider?.params) {
+    Object.assign(params, provider.params);
+  }
   if (isEnterprise) {
     params.githubDomain = domain;
   } else {
     delete params.githubDomain;
   }
+  const nextProviders = { ...providers };
+  if (provider) {
+    nextProviders[PROVIDER_ID] = { ...provider, params };
+  } else {
+    // Source config accepts partial provider inputs; catalog materialization
+    // supplies baseUrl/models before runtime consumption.
+    Object.assign(nextProviders, { [PROVIDER_ID]: { params } });
+  }
 
   return {
     ...config,
     models: {
       ...models,
-      providers: {
-        ...providers,
-        [PROVIDER_ID]: {
-          ...provider,
-          params,
-        },
-      },
+      providers: nextProviders,
     },
   };
 }

extensions/github-copilot/login.ts

@@ -368,8 +368,8 @@ export function withGithubCopilotDomainConfig(cfg: OpenClawConfig, domain: strin
   // `T | undefined`, which exactOptionalPropertyTypes rejects.
   const models: NonNullable<OpenClawConfig["models"]> = cfg.models ?? {};
   const providers: NonNullable<typeof models.providers> = models.providers ?? {};
-  const provider: NonNullable<(typeof providers)[string]> = providers["github-copilot"] ?? {};
-  const params = provider.params;
+  const provider = providers["github-copilot"];
+  const params = provider?.params;
   const isDefault = domain === PUBLIC_GITHUB_COPILOT_DOMAIN;
   if (isDefault && !(params && "githubDomain" in params)) {
     return cfg;
@@ -380,14 +380,19 @@ export function withGithubCopilotDomainConfig(cfg: OpenClawConfig, domain: strin
   } else {
     nextParams.githubDomain = domain;
   }
+  const nextProviders = { ...providers };
+  if (provider) {
+    nextProviders["github-copilot"] = { ...provider, params: nextParams };
+  } else {
+    // Source config accepts partial provider inputs; catalog materialization
+    // supplies baseUrl/models before runtime consumption.
+    Object.assign(nextProviders, { "github-copilot": { params: nextParams } });
+  }
   return {
     ...cfg,
     models: {
       ...models,
-      providers: {
-        ...providers,
-        "github-copilot": { ...provider, params: nextParams },
-      },
+      providers: nextProviders,
     },
   };
 }