fix(auth): treat keyRef/tokenRef profiles as valid in auth order resolution by Sid-Qin · Pull Request #30384 · openclaw/openclaw

Sid-Qin · 2026-03-01T06:35:24Z

Summary

Problem: models status --probe can report "Auth profile credentials are missing or expired" for profiles that use keyRef/tokenRef (especially with explicit auth.order), even though runtime secret resolution works.
Why it matters: Operators get false negatives during auth health checks after migrating credentials to SecretRef-based providers (e.g. source: exec).
What changed: Updated resolveAuthProfileOrder in src/agents/auth-profiles/order.ts so profiles backed by keyRef or tokenRef are treated as valid candidates (not dropped as empty plaintext credentials). Added regression tests in src/agents/auth-profiles.resolve-auth-profile-order.uses-stored-profiles-no-config-exists.test.ts for both api_key + keyRef and token + tokenRef.
What did NOT change: Secret resolution protocol, provider execution logic, and probe runtime execution path remain unchanged.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes [Bug]: models status --probe reports "missing or expired" for exec-based SecretRef auth profiles #30311

User-visible / Behavior Changes

models status --probe no longer prematurely marks SecretRef-backed auth profiles as "missing or expired" just because plaintext key/token fields are absent.

Security Impact (required)

New permissions/capabilities? No
Secrets/tokens handling changed? No (validation semantics only)
New/changed network calls? No
Command/tool execution surface changed? No
Data access scope changed? No

Repro + Verification

Environment

OS: macOS/Linux
Runtime: CLI (openclaw models status --probe)
Integration/channel: Auth profiles + SecretRef providers

Steps

Configure auth profile using keyRef/tokenRef with explicit auth.order
Run openclaw models status --probe

Expected

Profile is considered eligible and actually probed

Actual

Before fix: profile can be pre-filtered as "missing or expired"
After fix: profile remains in order candidates and is probed normally

Evidence

Targeted tests passing:

✓ src/agents/auth-profiles.resolve-auth-profile-order.uses-stored-profiles-no-config-exists.test.ts (11 tests)
✓ src/commands/models/list.probe.test.ts (3 tests)

New regression assertions:

keeps api_key profile with keyRef and no plaintext key
keeps token profile with tokenRef even when token field is blank/expired

Human Verification (required)

Verified scenarios: explicit order + SecretRef-backed profile eligibility
Edge cases checked: unchanged behavior for empty plaintext profiles without refs
What I did not verify: end-to-end live probe against a real exec secret provider

Compatibility / Migration

Backward compatible? Yes
Config/env changes? No
Migration needed? No

Failure Recovery (if this breaks)

How to disable/revert: Revert this commit
Files/config to restore: src/agents/auth-profiles/order.ts
Known bad symptoms: probe may regress to false "missing or expired" for SecretRef-backed profiles

Risks and Mitigations

Risk: potentially probing profiles that are still invalid at runtime.
Mitigation: runtime probe already captures and reports real auth failures; this change only removes premature false-negative filtering for SecretRef-backed profiles.

…lution resolveAuthProfileOrder previously treated profiles without plaintext key/token as invalid, even when they were backed by SecretRef fields (keyRef/tokenRef). This caused probe flows with explicit auth.order to mark those profiles as "missing or expired" before probing, despite runtime secret resolution working. Profiles backed by keyRef/tokenRef are now considered valid candidates for ordering, so models status --probe no longer produces false negatives for exec-based SecretRef auth profiles. Closes openclaw#30311

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddbfb04e60

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-01T06:38:44Z

src/agents/auth-profiles/order.ts

+      if (cred.tokenRef) {
+        return true;


Keep tokenRef validity aligned with runtime expiry checks

Returning true as soon as tokenRef exists makes this profile-order filter treat expired token profiles as usable, but resolveApiKeyForProfile still rejects type: "token" credentials when expires is in the past (even after resolving tokenRef). In stores that carry stale expires metadata alongside tokenRef (for example after migrating from plaintext token storage), this now admits profiles that are guaranteed to fail at use-time, so probes/selection repeatedly attempt a dead credential instead of filtering it out consistently.

Useful? React with 👍 / 👎.

greptile-apps · 2026-03-01T06:40:54Z

Greptile Summary

This PR correctly fixes auth profile validation to support SecretRef-backed credentials (keyRef/tokenRef). The changes prevent false negatives during models status --probe health checks for profiles that use external secret providers.

Key improvements:

Updated isValidProfile validation in src/agents/auth-profiles/order.ts:61 to treat api_key profiles with keyRef as valid
Updated token validation at src/agents/auth-profiles/order.ts:64-66 to treat token profiles with tokenRef as valid
Added regression tests covering both api_key + keyRef and token + tokenRef scenarios

Technical correctness:

The fix aligns validation logic with runtime secret resolution capability (confirmed in src/agents/auth-profiles/oauth.ts:317-348 which already handles keyRef/tokenRef)
Changes are minimal and targeted to the specific issue
No changes to secret resolution protocol or probe execution paths
Backward compatible - profiles without refs continue to work as before

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The changes are well-isolated, properly tested, and fix a clear validation gap without affecting runtime behavior. The logic correctly handles both plaintext and SecretRef-backed credentials, maintains backward compatibility, and includes comprehensive regression tests.
No files require special attention

_{Last reviewed commit: ddbfb04}

joshavant · 2026-03-04T02:33:11Z

Thanks for the report! Superseded by #33733.

openclaw-barnacle bot added agents Agent runtime and tooling size: S experienced-contributor labels Mar 1, 2026

chatgpt-codex-connector bot reviewed Mar 1, 2026

View reviewed changes

joshavant mentioned this pull request Mar 4, 2026

follow-up: align ingress, atomic paths, and channel tests with credential semantics #33733

Merged

joshavant closed this Mar 4, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(auth): treat keyRef/tokenRef profiles as valid in auth order resolution#30384

fix(auth): treat keyRef/tokenRef profiles as valid in auth order resolution#30384
Sid-Qin wants to merge 1 commit intoopenclaw:mainfrom
Sid-Qin:fix/30311-models-probe-exec-secretref

Sid-Qin commented Mar 1, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 1, 2026

Uh oh!

greptile-apps bot commented Mar 1, 2026

Uh oh!

joshavant commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Sid-Qin commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot commented Mar 1, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

joshavant commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Sid-Qin commented Mar 1, 2026 •

edited

Loading