fix(agents): document runtime policy ambiguity

altaywtf · altaywtf · commit f5daa8498868 · 2026-05-24T21:03:28.000+03:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -33,6 +33,7 @@ Docs: https://docs.openclaw.ai
 - Crabbox: install Corepack shims into the writable hydration `PNPM_HOME` so local AWS runner hydration no longer tries to overwrite `/usr/local/bin/pnpm`.
 - Live tests: fail Gateway live model sweeps when selected coverage is lost to timeouts or stale high-signal filters instead of reporting false missing-profile coverage, and pin Docker OpenAI gateway coverage to the current `gpt-5.5` lane.
 - Tests: fail Docker resource-ceiling checks when stats samples or configured limits are invalid instead of silently reporting zero peaks.
+- Agents: fail closed when provider-less session models match multiple provider-prefixed runtime policies so CLI runtime routing no longer depends on config order. (#85970) Thanks @potterdigital.
 
 ## 2026.5.24
 
diff --git a/src/agents/model-runtime-aliases.ts b/src/agents/model-runtime-aliases.ts
@@ -288,11 +288,6 @@ export function resolveCliRuntimeExecutionProvider(params: {
   if (!runtime || runtime === "auto") {
     return resolveCliRuntimeFromAuthProfile({ ...params, provider });
   }
-  // When the caller provider is empty (legacy session entries that stored a
-  // bare model id without a provider prefix), validate the CLI runtime against
-  // the provider carried forward from the matched policy entry. This rejects
-  // misconfigured pairings like `agents.defaults.models["openrouter/X"]:
-  // claude-cli` (claude-cli is only a legal runtime for anthropic).
   const effectiveProvider = provider || normalizeProviderId(matchedProvider ?? "");
   if (!effectiveProvider) {
     return undefined;
diff --git a/src/agents/model-runtime-policy.test.ts b/src/agents/model-runtime-policy.test.ts
@@ -338,13 +338,13 @@ describe("resolveModelRuntimePolicy", () => {
     });
   });
 
-  it("does not fall back to a provider wildcard when exact bare-model matches are ambiguous", () => {
+  it("fails closed for duplicate provider-prefixed bare-model policies", () => {
     const config = {
       agents: {
         defaults: {
           models: {
             "openai/foo-1": { agentRuntime: { id: "codex" } },
-            "azure/foo-1": { agentRuntime: { id: "codex" } },
+            "anthropic/foo-1": { agentRuntime: { id: "claude-cli" } },
             "anthropic/*": { agentRuntime: { id: "claude-cli" } },
           },
         },
diff --git a/src/agents/model-runtime-policy.ts b/src/agents/model-runtime-policy.ts
@@ -11,11 +11,6 @@ export type ModelRuntimePolicySource = "model" | "provider";
 export type ResolvedModelRuntimePolicy = {
   policy?: AgentRuntimePolicyConfig;
   source?: ModelRuntimePolicySource;
-  /**
-   * Provider id from the matched entry key (e.g. "anthropic" for an
-   * `anthropic/foo` agent model entry). Lets downstream resolvers validate
-   * provider/runtime pairings when the caller passed an empty provider.
-   */
   matchedProvider?: string;
 };
 
@@ -89,6 +84,24 @@ function providerMatchesCaller(provider: string, callerProvider: string): boolea
   return !callerProvider || provider === callerProvider;
 }
 
+function resolvePolicyMatch(
+  matches: AgentModelRuntimePolicyMatch[],
+  callerProvider: string,
+): AgentModelRuntimePolicyResolution {
+  const [first] = matches;
+  if (!first) {
+    return {};
+  }
+  if (!callerProvider && matches.some((match) => match.provider !== first.provider)) {
+    return { ambiguous: true };
+  }
+  return {
+    policy: first.policy,
+    source: "model",
+    matchedProvider: first.provider || callerProvider,
+  };
+}
+
 function modelEntryMatches(params: {
   entry: Pick<ModelDefinitionConfig, "id">;
   provider: string | undefined;
@@ -184,25 +197,10 @@ function resolveAgentModelEntryRuntimePolicy(params: {
       }
       scopeMatches.push({ provider: parseProviderModelKey(key)?.provider ?? "", policy });
     }
-    if (scopeMatches.length === 0) {
-      continue;
-    }
-    if (callerProvider) {
-      return {
-        policy: scopeMatches[0].policy,
-        source: "model",
-        matchedProvider: scopeMatches[0].provider || callerProvider,
-      };
-    }
-    const distinctProviders = new Set(scopeMatches.map((m) => m.provider));
-    if (distinctProviders.size > 1) {
-      return { ambiguous: true };
+    const resolved = resolvePolicyMatch(scopeMatches, callerProvider);
+    if (resolved.policy || resolved.ambiguous) {
+      return resolved;
     }
-    return {
-      policy: scopeMatches[0].policy,
-      source: "model",
-      matchedProvider: scopeMatches[0].provider,
-    };
   }
   return {};
 }
