fix(agents): carry the primary model's auth profile onto the derived utility default

steipete · steipete · commit 52498f7aef82 · 2026-07-10T08:35:30.000-07:00
A primary like openai/gpt-5.5@work previously reached utility tasks via the
profiled fallback; the derived default shares the provider, so its trailing
auth profile carries over instead of silently switching to default
credentials (Codex review). Gates on Testbox: oxfmt, check:test-types, tests.
diff --git a/src/agents/utility-model.test.ts b/src/agents/utility-model.test.ts
@@ -118,6 +118,16 @@ describe("resolveUtilityModelRefForAgent", () => {
     );
   });
 
+  it("carries the primary model's auth profile onto the derived default", () => {
+    const cfg = {
+      agents: { defaults: { model: "openai/gpt-5.5@work" } },
+    } as OpenClawConfig;
+
+    expect(resolveUtilityModelRefForAgent({ cfg, agentId: "main", metadataSnapshot })).toBe(
+      "openai/gpt-5.6-luna@work",
+    );
+  });
+
   it("prefers a caller-resolved primary provider over re-derivation", () => {
     expect(
       resolveUtilityModelRefForAgent({
diff --git a/src/agents/utility-model.ts b/src/agents/utility-model.ts
@@ -4,7 +4,8 @@
 import type { OpenClawConfig } from "../config/types.openclaw.js";
 import { getCurrentPluginMetadataSnapshot } from "../plugins/current-plugin-metadata-snapshot.js";
 import type { PluginMetadataSnapshot } from "../plugins/plugin-metadata-snapshot.types.js";
-import { resolveAgentConfig } from "./agent-scope.js";
+import { resolveAgentConfig, resolveAgentEffectiveModelPrimary } from "./agent-scope.js";
+import { splitTrailingAuthProfile } from "./model-ref-profile.js";
 import { resolveDefaultModelForAgent } from "./model-selection.js";
 
 export type UtilityModelSetting =
@@ -87,9 +88,18 @@ export function resolveUtilityModelRefForAgent(params: {
   if (!provider) {
     return undefined;
   }
-  return resolveProviderDefaultUtilityModelRef({
+  const derived = resolveProviderDefaultUtilityModelRef({
     cfg: params.cfg,
     provider,
     metadataSnapshot: params.metadataSnapshot,
   });
+  if (!derived) {
+    return undefined;
+  }
+  // The derived default shares the primary's provider, so a trailing auth
+  // profile on the primary ref must carry over; otherwise profile-isolated
+  // setups would route utility calls through default credentials.
+  const primaryRef = resolveAgentEffectiveModelPrimary(params.cfg, params.agentId) ?? "";
+  const primaryProfile = primaryRef ? splitTrailingAuthProfile(primaryRef)?.profile : undefined;
+  return primaryProfile ? `${derived}@${primaryProfile}` : derived;
 }
