fix(auth-profiles): break self-reinforcing session auth override loop

Jordi · Jordi · commit 266039f5e706 · 2026-05-22T18:41:41.000+08:00
When a session falls back to a different provider (e.g. minimax → deepseek), the session entry stores the fallback provider's auth profile override (e.g. deepseek:default) with source 'auto'. On subsequent turns, resolveSessionAuthProfileOverride builds the auth profile order from the current run's provider (deepseek), not the agent's configured default model provider (minimax). Since deepseek:default is valid for deepseek's auth order, it's never re-evaluated against the agent's actual default model, creating a self-reinforcing loop. Fix: when source === 'auto', also include the agent's configured default model provider's auth profiles in the order list. This ensures the resolver can find and prefer the default model's auth profile when it's available, breaking the loop. Fixes #85126
diff --git a/src/agents/auth-profiles/session-override.ts b/src/agents/auth-profiles/session-override.ts
@@ -1,6 +1,7 @@
 import type { SessionEntry } from "../../config/sessions/types.js";
 import type { OpenClawConfig } from "../../config/types.openclaw.js";
 import { createLazyImportLoader } from "../../shared/lazy-promise.js";
+import { resolveAgentConfig, resolveSessionAgentId } from "../agent-scope.js";
 import {
   isConfiguredAwsSdkAuthProfileForProvider,
   isStoredCredentialCompatibleWithAuthProvider,
@@ -161,6 +162,34 @@ export async function resolveSessionAuthProfileOverride(params: {
     current = undefined;
   }
 
+  // When the override was set automatically (via fallback) and the current
+  // run's provider differs from the agent's configured default model provider,
+  // include the default provider's auth profiles in the order list. This
+  // prevents a fallback from permanently locking the session to the fallback
+  // provider's auth profile (https://github.com/openclaw/openclaw/issues/85126).
+  if (source === "auto") {
+    const sessionAgentId = resolveSessionAgentId({ config: cfg, sessionKey });
+    const agentCfg = resolveAgentConfig(cfg, sessionAgentId);
+    const rawModel: string | { primary?: string } | undefined =
+      agentCfg?.model ?? cfg.agents?.defaults?.model;
+    const agentPrimary =
+      typeof rawModel === "string"
+        ? rawModel
+        : rawModel && typeof rawModel === "object" && "primary" in rawModel
+          ? (rawModel as { primary: string }).primary
+          : undefined;
+    if (agentPrimary) {
+      const agentProvider = agentPrimary.split("/")[0];
+      if (agentProvider && agentProvider !== provider) {
+        const agentOrder = resolveAuthProfileOrder({ cfg, store, provider: agentProvider });
+        if (agentOrder.length > 0) {
+          // Prepend default provider's order so it's preferred over the fallback's
+          order.splice(0, order.length, ...new Set([...agentOrder, ...order]));
+        }
+      }
+    }
+  }
+
   if (order.length === 0) {
     return undefined;
   }
