Greptile Summary

This PR adds Azure Speech as a realtime transcription provider for the voice-call plugin, reusing existing credentials/config patterns and lazy-loading the SDK. The implementation is well-structured overall, but there is one data-loss bug in the lazy-connect path.

• P1 — First audio frame dropped on lazy connect (realtime-transcription-session.ts:281–289): sendAudio fires connect() asynchronously and immediately calls the inner sendAudio in the same tick. Since pushStream is always undefined at that point, the guard triggers onError(\"Azure Speech push stream is not initialized\") and discards the audio. The advertised lazy-connect behavior silently eats the triggering frame. The corresponding test only asserts startSpy was called, not that the audio arrived.

Confidence Score: 3/5

Not safe to merge as-is: lazy connect silently drops the first audio frame and fires an unexpected onError on every session that skips explicit connect().

One P1 data-loss bug (first audio frame discarded on lazy connect) with no test coverage catching it, capping confidence at 4; the pattern affects a core advertised feature path, pulling it down to 3.

extensions/azure-speech/realtime-transcription-session.ts (lazy-connect sendAudio race), extensions/azure-speech/realtime-transcription-lifecycle.test.ts (missing assertions on audio delivery and onError in lazy-connect test)

This is a comment left during a code review.
Path: extensions/azure-speech/realtime-transcription-session.ts
Line: 281-289

Comment:
**First audio frame dropped on lazy connect**

When `sendAudio` is invoked before `connect()` has resolved, it fires `connect()` asynchronously and then immediately calls the inner `sendAudio`. Because `pushStream` is still `undefined` at that synchronous moment, the inner guard triggers:

```ts
if (!pushStream) {
  handleError(new Error("Azure Speech push stream is not initialized"));
  return;
}
```

The audio from that triggering frame is silently discarded and `onError` fires unexpectedly on every lazy-connect caller. The test at line 353 (`lazily connects on the first audio frame`) only asserts that `startSpy` was called; it never checks `pushStream.writeSpy` or `onError`, so this data-loss path goes undetected.

If parity with sibling providers requires queuing audio until the stream is ready, the first frame should be buffered and flushed once `connect()` resolves rather than being forwarded before `pushStream` exists.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: extensions/azure-speech/realtime-transcription-provider.ts
Line: 217-223

Comment:
**Redundant re-normalization inside `isConfigured`**

`providerConfig` passed to `isConfigured` is already the resolved output of `resolveConfig` (which returns an `AzureSpeechRealtimeProviderConfig`). Calling `normalizeAzureSpeechRealtimeProviderConfig` on it again is wasteful and relies on the normalization being idempotent. The check can use the typed fields directly:

```ts
isConfigured: ({ providerConfig }) => {
  const cfg = providerConfig as AzureSpeechRealtimeProviderConfig;
  if (!cfg.apiKey) return false;
  return Boolean(cfg.endpoint || cfg.region);
},
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "feat(azure-speech): add realtime transcr..." | Re-trigger Greptile}

Codex review: needs real behavior proof before merge.

Summary
The PR adds an Azure Speech realtime transcription provider to the azure-speech plugin, including provider/session code, config/docs/tests, and the Microsoft Speech SDK runtime dependency.

Reproducibility: not applicable. this is a feature PR, not a bug report. The merge blocker is source-reproducible by comparing the PR head manifest with the PR head generated plugin docs, and real behavior proof is absent from the discussion.

Real behavior proof
Needs real behavior proof before merge: Missing: the PR includes unit tests and a skipped-unless-env live test definition, but no after-fix terminal output, logs, screenshot, or linked artifact showing Azure Speech realtime transcription working.

Next step before merge
Contributor action is needed for real behavior proof, and automation should not run a repair loop on this PR while that external proof gate is unsatisfied.

Security
Cleared: Cleared: the diff adds the official Microsoft Speech SDK dependency with lockfile entries and does not touch workflows, permissions, scripts, secret handling, or package sources in a concerning way.

Review findings

• [P2] Regenerate the plugin inventory docs — extensions/azure-speech/openclaw.plugin.json:29

Thanks for the review! Pushed 869a3237 addressing both Greptile findings:

P1 — first audio frame dropped on lazy connect. Now buffer pending audio frames in a small queue (capped at the existing AZURE_SPEECH_REALTIME_MAX_QUEUED_BYTES budget so it can't grow unbounded), kick off connect() once, and flush them after the push stream is ready. The lazy-connect lifecycle test now asserts the triggering frame actually reaches pushStream.write and that onError does not fire — so the silent-drop / spurious onError path is regression-tested.

P2 — redundant re-normalization in isConfigured. providerConfig is already the resolved output of resolveConfig, so it now uses the typed AzureSpeechRealtimeProviderConfig fields directly.

All 33 azure-speech unit tests still pass locally. The remaining red CI checks on this PR (build-artifacts, checks-fast-bundled, checks-node-agentic-*, build-smoke, etc.) look like pre-existing main instability — e.g. doctor-bundled-plugin-runtime-deps.test.ts reports missing grammy@1.37.0 for telegram, which is unrelated to azure-speech. Happy to rebase onto a green main if it would help, but the rebase across the recent large refactor commit is fairly conflict-heavy, so I'd prefer to wait for maintainer guidance before doing that.

Addressed the three P2 clawsweeper findings:

1. Abort connection when session is closed (realtime-transcription-session.ts)
The connect chain now checks closing after each await and tears down anything it allocated:

• After loadSdk() resolves (bail early, no Azure resources allocated)
• After createPushStream() (close push stream, undefined refs)
• After recognizer creation (close recognizer + push stream)
• After startContinuousRecognitionAsync resolves (call stopContinuousRecognitionAsync + close)

teardown() now bails when connect() is still pending and nothing has been allocated yet, leaving cleanup to the in-flight chain. Added 2 unit tests covering close-during-loadSdk and close-during-start. Commit a79665d.

2. Regenerated config-doc baseline — pnpm config:docs:gen updated 3 of 4 hashes (config-baseline.json, config-baseline.core.json, config-baseline.plugin.json) to reflect the merged-from-main schema. pnpm config:docs:check is green. Commit 75ac033.

3. CHANGELOG entry added under Unreleased \u203a Changes. Commit 6b1de3f.

Validation

• extensions/azure-speech vitest: 45/45 passing (4 files, 5.47s) including the 2 new lifecycle tests
• pnpm check:changed: clean (typecheck + lint + import cycles + sidecar loaders + duplicate-scan + wildcard-reexport guards all green)
• pnpm config:docs:check: OK

HEAD: 6b1de3f

Merged latest upstream/main (CHANGELOG conflict resolved by keeping both sides). Re-pushed.

Addressed clawsweeper [P1] in a1e47f6a94:

Bug: microsoft-cognitiveservices-speech-sdk was declared only at the extension level (extensions/azure-speech/package.json). For packaged/bundled installs the postinstall path does not install plugin package dependencies, and bundled runtime staging skips plugin node_modules, so the lazy-loaded SDK would fail to resolve at provider runtime when Voice Call requested realtime transcription.

Surface: bundled distribution installs (NPM tarball, Docker image, macOS bundle) loading the Azure Speech extension's realtime transcription provider.

Fix: hoisted microsoft-cognitiveservices-speech-sdk: ^1.49.0 into the root package.json dependencies block (same version range the extension already declared). Kept it as a runtime dependency (not devDependencies) because the provider lazy-loads it at runtime, not at build time. Lockfile regenerated via pnpm install --lockfile-only.

Why best: the alternative (moving Azure Speech behind an explicit downloadable plugin install path) is a larger architectural change that affects all SDK-heavy providers; hoisting the dep matches the existing pattern used by @aws-sdk/client-bedrock, @google/genai, and other provider SDKs already declared at root. Keeps the provider extension-owned per the core/extension boundary rule.

Closing — this grew into an XL change (size: XL, +1818) without the Real behavior proof maintainers expect for external PRs of this scope. Will rework as a smaller, scoped PR (provider config + minimal wiring) with end-to-end transcription evidence on a real device before reopening.