fix(config): preserve agent-level apiKey/baseUrl during models.json merge by Sid-Qin · Pull Request #27293 · openclaw/openclaw

Sid-Qin · 2026-02-26T07:20:06Z

Summary

Problem: Agent-level models.json entries (with custom apiKey/baseUrl) are silently overwritten by the main openclaw.json config during ensureOpenClawModelsJson() merge, because the shallow merge { ...existingProviders, ...providers } replaces entire provider objects.
Why it matters: Users who configure per-agent API keys or custom base URLs lose those settings every time the models config is refreshed.
What changed: The merge loop now preserves existing agent-level apiKey and baseUrl when merging new provider data, while still accepting model catalog updates (models, api type, etc.) from the main config.
What did NOT change (scope boundary): Replace mode (non-merge), model catalog refresh, and providers not already in the agent's models.json are unaffected.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes [Bug]: Agent-level models.json apiKey not overriding main config #27243
Related #

User-visible / Behavior Changes

Agent-level apiKey and baseUrl in ~/.openclaw/agents/{agentId}/agent/models.json are now preserved across config refreshes. Previously they were silently replaced by the main config values.

Security Impact (required)

New permissions/capabilities: None
Auth/token changes: Agent-level API keys are no longer silently dropped — this is a security improvement (prevents fallback to unintended keys)
Data exposure risk: None — agent-level keys are already stored in mode 0o600 files

Testing

npx vitest run src/agents/models-config — 43 tests ✓

Rollback Plan

Revert the single commit. No migration or data changes involved.

greptile-apps · 2026-02-26T07:24:01Z

Greptile Summary

Correctly preserves agent-level apiKey and baseUrl during merge-mode config refresh. The fix replaces a shallow spread merge with explicit preservation logic that:

Maintains all existing providers from the agent's models.json
For providers also in main config: updates model catalog and other fields while preserving custom apiKey and baseUrl (if non-empty strings)
For new providers: adds them without modification
Only affects merge mode; replace mode is unchanged

The implementation properly guards against edge cases (empty strings, non-string values, undefined) and maintains backward compatibility.

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The fix is well-scoped, only affects merge mode behavior, includes proper type guards and runtime checks, preserves backward compatibility, and all 43 existing tests pass. The logic correctly implements the stated goal of preserving agent-level apiKey/baseUrl while updating other provider fields from main config.
No files require special attention

_{Last reviewed commit: c61a624}

…erge When ensureOpenClawModelsJson runs in merge mode, the shallow merge { ...existingProviders, ...providers } causes the main config to overwrite agent-level models.json entries entirely. This drops any apiKey or baseUrl that the user set specifically for an agent. Preserve existing agent-level apiKey and baseUrl when merging, while still accepting all other updates (model catalog, api type, etc.) from the newly computed provider config. Closes openclaw#27243

gumadeiras · 2026-02-26T08:46:39Z

Merged via squash.

Prepared head SHA: 6b4b37b
Merge commit: c289b5f

Thanks @Sid-Qin!

Syncs 29 upstream commits including: - Account-scoped bind and routing commands (openclaw#27195) - Single-account config migration to accounts.default (openclaw#27334) - Preserve agent-level apiKey/baseUrl during models.json merge (openclaw#27293) - Plugin-owned interactive channel onboarding flows (openclaw#27191) - Android notifications.list, invoke refactoring - Daemon launchd restart hardening - SSRF dispatcher fix, doctor improvements Conflict resolution: 4 import-order conflicts in onboarding/channel commands resolved by taking upstream (no custom code in those files).

@gumadeiras

…erge (#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

@gumadeiras

…erge (openclaw#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <[email protected]> Co-authored-by: gumadeiras <[email protected]> Reviewed-by: @gumadeiras

openclaw-barnacle Bot added agents Agent runtime and tooling size: XS experienced-contributor labels Feb 26, 2026

gumadeiras self-assigned this Feb 26, 2026

gumadeiras force-pushed the fix/27243-agent-models-json-override branch from c61a624 to 130b90f Compare February 26, 2026 08:39

openclaw-barnacle Bot added size: S docs Improvements or additions to documentation gateway Gateway runtime and removed size: XS labels Feb 26, 2026

SidQin-cyber and others added 5 commits February 26, 2026 03:44

test(models): cover merge auth/baseUrl precedence

b7841d8

test(models): complete merge precedence fixtures

68cebc0

docs(changelog): record merge auth/baseUrl precedence fix

e5fdffd

docs(models): clarify merge auth/baseUrl precedence

6b4b37b

gumadeiras force-pushed the fix/27243-agent-models-json-override branch from 448e48e to 6b4b37b Compare February 26, 2026 08:45

gumadeiras merged commit c289b5f into openclaw:main Feb 26, 2026
21 checks passed

github-actions Bot mentioned this pull request Feb 26, 2026

🦞 OpenClaw 项目动态日报 2026-02-26 duanyytop/agents-radar#15

Closed

github-actions Bot mentioned this pull request Feb 26, 2026

📡 Upstream Digest — 2026-02-26 10:38 UTC curtismercier/openclaw-mods#128

Open

This was referenced Feb 26, 2026

fix(models): agent-level models.json apiKey overrides main config (#27243) #27274

Closed

fix(agents): agent-level models.json should override main config #27285

Closed

gemini-code-assist Bot mentioned this pull request Feb 27, 2026

chore(sync): replay rollup fixes on upstream/main MillionthOdin16/openclaw#94

Merged

This was referenced Apr 29, 2026

[Bug] Onboard UI fails to overwrite existing provider configurations #38657

Closed

[Bug]: Gateway Configuration Persistence Issue #64676

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(config): preserve agent-level apiKey/baseUrl during models.json merge#27293

fix(config): preserve agent-level apiKey/baseUrl during models.json merge#27293
gumadeiras merged 5 commits into
openclaw:mainfrom
Sid-Qin:fix/27243-agent-models-json-override

Sid-Qin commented Feb 26, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Feb 26, 2026

Uh oh!

Uh oh!

gumadeiras commented Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Sid-Qin commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Testing

Rollback Plan

Uh oh!

greptile-apps Bot commented Feb 26, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

Uh oh!

gumadeiras commented Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Sid-Qin commented Feb 26, 2026 •

edited

Loading