chore: document external CLI auth overlay fix

neeravmakwana · neeravmakwana · commit 9646b5afe1f8 · 2026-04-28T21:59:39.000-04:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,6 +13,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Gateway/model auth: scope external CLI credential overlays to configured refreshable providers, avoiding unrelated Claude CLI Keychain reads in api-key-only setups. Fixes #73908. Thanks @Ailuras.
 - Security/audit: recognize dangerous node command IDs as valid `gateway.nodes.denyCommands` entries, so audit only warns on real typos or unsupported patterns. (#56923) Thanks @chziyue.
 - Telegram/exec approvals: stop treating general Telegram chat allowlists and `defaultTo` routes as native exec approvers; Telegram now uses explicit `execApprovals.approvers` or owner identity from `commands.ownerAllowFrom`, matching the first-pairing owner bootstrap path. Thanks @pashpashpash.
 - Chat commands: route sensitive group `/diagnostics` and `/export-trajectory` approvals and results to a private owner route, preferring same-surface DMs before falling back to the first configured owner route, so Discord group invocations can land in Telegram when that is the primary owner interface. Thanks @pashpashpash.
diff --git a/src/gateway/server-methods/models-auth-status.test.ts b/src/gateway/server-methods/models-auth-status.test.ts
@@ -131,7 +131,6 @@ describe("models.authStatus", () => {
     expect(mocks.ensureAuthProfileStore).toHaveBeenCalledWith("/tmp/agent", {
       externalCliProviderIds: [],
     });
-    expect(mocks.buildAuthHealthSummary).toHaveBeenCalledTimes(1);
   });
 
   it("serves cached response within TTL and marks it as cached", async () => {
