Problem

models.list reports a model as unavailable when its provider config uses a non-env SecretRef apiKey, even if the same provider has a usable env-backed auth profile. That makes browse surfaces such as the model picker hide a runnable provider route as unavailable.

Source evidence

On current origin/main (520992a1defdeb213a4705a1f7690f2643769a42), src/gateway/server-methods/models-list-result.ts:60 defines modelCatalogEntryHasUnknownSecretRefAvailability(...) and returns true for both the literal secretref-managed marker and any SecretRef whose source is not env.

buildPublicModelsListEntry(...) then checks that helper at src/gateway/server-methods/models-list-result.ts:226 and immediately returns available: false before the normal provider auth checker can run.

That conflicts with the same file's auth-profile path: createModelsListProviderAuthChecker(...) calls hasRuntimeAvailableProviderAuth(...) || hasReadOnlyAvailableProfileAuth(...) at src/gateway/server-methods/models-list-result.ts:190. The read-only profile checker can prove env-backed API-key profiles at src/gateway/server-methods/models-list-result.ts:109.

Runtime auth also supports this shape. resolveApiKeyForProvider(...) in src/agents/model-auth.ts:939 walks configured auth profiles and can resolve an env-backed profile for the provider even when the provider config itself carries a non-env SecretRef marker.

Reproduction

This is the minimal shape:

• provider vllm has catalog model llama-secure
• models.providers.vllm.apiKey is a non-env SecretRef, for example { source: "file", provider: "mounted-json", id: "/providers/vllm/apiKey" }
• auth profiles contain vllm:env with keyRef: { source: "env", provider: "default", id: "VLLM_API_KEY" }
• VLLM_API_KEY is present

The runtime auth path can resolve the provider from profile:vllm:env, but models.list returns the catalog row with available: false.

Before-fix proof from a local source checkout:

{
  "runtimeAuth": {
    "source": "profile:vllm:env",
    "mode": "api-key",
    "profileId": "vllm:env",
    "hasApiKey": true
  },
  "modelsList": {
    "ok": true,
    "result": {
      "models": [
        {
          "id": "llama-secure",
          "name": "Llama Secure",
          "provider": "vllm",
          "available": false
        }
      ]
    }
  }
}

Expected behavior

models.list should report the row as available when the provider auth checker can prove usable runtime auth through a compatible env-backed auth profile. Non-env SecretRef-only providers without a usable profile should still remain unavailable/unknown in this read-only browse path.

Proposed fix

Remove the duplicate early SecretRef availability guard from buildPublicModelsListEntry(...) and let the existing provider auth checker make the single availability decision. That keeps non-env SecretRef-only providers unavailable while allowing the auth-profile-backed provider case.

Regression coverage

Add a focused models.list regression covering both non-env provider config shapes:

• file SecretRef object
• literal secretref-managed

Both should return available: true when an env-backed vllm:env profile is present. Existing negative coverage should continue proving non-env SecretRef-only providers stay unavailable.

Focused proof command:

node scripts/run-vitest.mjs src/gateway/server-methods/models.test.ts --reporter dot

Duplicate / overlap checks

I did not find an exact open issue or PR for this failure.

Commands checked:

gh issue list --repo openclaw/openclaw --state all --search '"models.list" "SecretRef" "auth profile"'
gh issue list --repo openclaw/openclaw --state all --search '"secretref-managed" "models.list"'
gh issue list --repo openclaw/openclaw --state open --search '"models.list" "available:false"'
gh pr list --repo openclaw/openclaw --state all --search '"modelCatalogEntryHasUnknownSecretRefAvailability"'
gh pr list --repo openclaw/openclaw --state open --search '"models-list-result.ts" "auth profile"'
gh pr list --repo openclaw/openclaw --state open --search '"models.list" "SecretRef"'

Closest overlap found: open PR #90328 also touches src/gateway/server-methods/models-list-result.ts, but its diff only adds model-picker agentRuntime metadata and does not change this SecretRef/profile availability path.