- Gateway/model pricing: report malformed external pricing catalog JSON with source-owned errors instead of leaking raw parser failures.

- QA Lab: report malformed model-catalog subprocess JSON with an owned error and ignore invalid catalog rows.

- Google Meet: report malformed browser-control status JSON with plugin-owned errors instead of leaking raw parser failures.

- Google provider: report malformed SSE stream JSON with provider-owned errors instead of leaking raw parser failures.

- Models config/auth: stop inferring provider env-var markers from broad `^[A-Z_][A-Z0-9_]*$` strings, and resolve config-backed provider `apiKey` values only through structured env SecretRefs (`secrets.providers[id]` / `secrets.defaults`), so unrelated env vars cannot accidentally become provider credentials. Thanks @sallyom.

- Media fetch: skip allocating and buffering the response body for bodyless media responses (HEAD probes and 204-style empty bodies), avoiding wasted heap on streams that carry no payload. Thanks @shakkernerd.

- CLI/onboarding: forward provider-specific auth flags (e.g. `--openai-api-key`) through the onboarding wizard so they reach provider auth methods via `ctx.opts`, letting `--openai-api-key "$OPENAI_API_KEY"` skip the redundant "use existing env var?" prompt in non-interactive harnesses. (#81669) Thanks @sjf.

function buildSseResponse(events: unknown[]): Response {

const sse = `${events.map((event) => `data: ${JSON.stringify(event)}\n\n`).join("")}data: [DONE]\n\n`;

return buildRawSseResponse(sse);

}

function buildRawSseResponse(sse: string): Response {

const encoder = new TextEncoder();

const body = new ReadableStream<Uint8Array>({

start(controller) {

});

});

it("wraps malformed Gemini SSE JSON", async () => {

guardedFetchMock.mockResolvedValueOnce(buildRawSseResponse("data: {not json\n\n"));

const streamFn = createGoogleGenerativeAiTransportStreamFn();

const stream = await Promise.resolve(

streamFn(

buildGeminiModel(),

{

messages: [{ role: "user", content: "hello", timestamp: 0 }],

} as unknown as Parameters<typeof streamFn>[1],

{

apiKey: "gemini-api-key",

} as Parameters<typeof streamFn>[2],

),

);

const result = await stream.result();

expect(result.stopReason).toBe("error");

expect(result.errorMessage).toBe("Google SSE stream returned malformed JSON");

});

it("retries Gemini 3 requests with lean thinking when the first attempt has no first response", async () => {

vi.stubEnv("OPENCLAW_GOOGLE_GEMINI_FIRST_RESPONSE_RETRY_MS", "10");

guardedFetchMock

if (!data || data === "[DONE]") {

continue;

}

yield JSON.parse(data) as GoogleSseChunk;

try {

yield JSON.parse(data) as GoogleSseChunk;

} catch {

throw new Error("Google SSE stream returned malformed JSON");

}

}

}

} finally {