@codex review

Greptile Summary

This PR fixes #73908 by scoping external CLI credential overlay resolution in the models.authStatus gateway handler to only those providers explicitly configured with refreshable auth (OAuth or bearer token), preventing unnecessary Keychain reads in api-key-only setups. The change threads externalCliProviderIds and allowKeychainPrompt through ensureAuthProfileStore → overlayExternalAuthProfiles → resolveExternalCliAuthProfiles; all unconstrained call-sites are unaffected because the new parameter is optional.

Confidence Score: 5/5

Safe to merge — the fix is narrowly scoped and all existing unrestricted callers are unaffected.

No logic, security, or runtime correctness issues found. The eligibility filter correctly handles an empty providerIds array (all providers skipped) versus undefined (all providers run). The readExternalCliBootstrapCredential path intentionally omits options, preserving the previous keychain behavior for active token refresh. Test isolation via invalidateModelAuthStatusCache() in beforeEach is correct. No P0 or P1 findings.

No files require special attention.

_{Reviews (1): Last reviewed commit: "chore: document external CLI auth overla..." | Re-trigger Greptile}

Thanks for the context here. I did a careful shell check against current main, and this is already implemented.

Current main already implements the intended provider-scoped external CLI auth overlay behavior with a broader maintainer fix. External CLI readers are skipped before credential reads when out of scope, models.authStatus passes config-derived provider/profile scope into the auth store overlay, and startup prewarm now scopes provider discovery as well. The fix is present on current main in commit 1375746 but is not contained in any local release tag yet.

Best possible solution:

Close this PR as implemented by the broader current-main fix in 1375746. Keep the current implementation because it covers this PR's auth-status overlay scoping and also scopes startup prewarm/provider discovery for the linked #73908 behavior.

What I checked:

• current-main-scoped-external-cli-readers: resolveExternalCliAuthProfiles() now accepts scope options, checks isExternalCliProviderInScope() before calling readCredentials(), and forwards allowKeychainPrompt into the credential reader. This prevents unrelated external CLI providers from being evaluated. (src/agents/auth-profiles/external-cli-sync.ts:221, 7e5d6dba8001)
• models-auth-status-passes-config-scope: models.authStatus now derives externalCliAuthScope from runtime config and passes externalCliProviderIds plus externalCliProfileIds to ensureAuthProfileStore(), so auth-status overlay reads are bounded to configured surfaces. (src/gateway/server-methods/models-auth-status.ts:296, 7e5d6dba8001)
• startup-provider-discovery-scoped-too: Startup prewarm passes only the selected provider through providerDiscoveryProviderIds, and implicit provider resolution forwards that scope into ensureAuthProfileStore() with allowKeychainPrompt: false. This covers the startup side of the linked [Bug]: Gateway unconditionally probes all 115 manifest providers and external CLI credentials at startup — causing 50s+ blocking even with 1 configured provider #73908 report, beyond this PR's narrower auth-status path. (src/gateway/server-startup-post-attach.ts:158, 7e5d6dba8001)
• regression-coverage-present: Current tests assert that an opencode-only scope does not call Codex, Claude, or MiniMax external CLI readers; that no-prompt Claude policy is forwarded when Claude is in scope; and that models.authStatus passes scoped provider/profile options and excludes claude-cli for opencode-only config. I inspected these tests but did not run them because this review is read-only. (src/agents/auth-profiles.external-cli-sync.test.ts:336, 7e5d6dba8001)
• fix-provenance: Commit 1375746 introduced the current-main implementation and changelog entry for scoping external CLI auth discovery. git tag --contains 13757465ba1b8b4508dedbf0d2b86afbf8deb051 returned no tags, so I cannot identify a shipped release for this fix yet. (CHANGELOG.md:56, 13757465ba1b)
• security-review-pass: The PR diff provided in the review context touches changelog, auth/gateway TypeScript, and auth/gateway tests only. It does not change workflows, Action refs, dependencies, lockfiles, package metadata, install/build/release scripts, generated/vendor artifacts, permissions, or secret scopes. The security-sensitive credential changes are consistent with the stated auth overlay scoping purpose and are superseded by the current-main implementation. (9646b5afe1f8)

Likely related people:

• @steipete: Auth/gateway blame and git show route the current-main scoped external CLI auth discovery implementation to commit 1375746, with related lines in external CLI sync, auth-store overlay propagation, models auth status, startup prewarm, tests, docs, and changelog. (role: fix/proof author and current maintainer; confidence: high; commits: 13757465ba1b, 1825f611f8c5; files: src/agents/auth-profiles/external-cli-sync.ts, src/agents/auth-profiles/external-cli-scope.ts, src/agents/auth-profiles/external-auth.ts)
• @neeravmakwana: Beyond proposing this PR, the provided related context shows merged fix(models): reflect Claude CLI auth status #71332 for Claude CLI auth-status behavior adjacent to the models.authStatus and auth-health surface involved here. (role: adjacent auth-status contributor; confidence: medium; commits: 3c33b31c6693; files: src/gateway/server-methods/models-auth-status.ts, src/agents/auth-health.ts)
• @starvex: The provided related context shows merged fix(auth): add Claude CLI to EXTERNAL_CLI_SYNC_PROVIDERS for automatic OAuth token sync #70902 adding Claude CLI to the managed external CLI sync provider path that this cleanup now scopes before Keychain reads. (role: prior Claude CLI external sync contributor; confidence: medium; commits: e57102fe4813; files: src/agents/auth-profiles/external-cli-sync.ts, src/agents/cli-credentials.ts)
• @vincentkoc: Prior changelog and ClawSweeper context credit work on runtime-only external CLI OAuth overlays and related auth-profile behavior, making this a useful adjacent routing candidate if follow-up issues appear. (role: prior external CLI OAuth overlay contributor; confidence: medium; commits: b96e7739a993; files: CHANGELOG.md, src/agents/auth-profiles/external-cli-sync.ts, src/agents/auth-profiles/external-auth.ts)

So I’m closing this as already implemented rather than keeping a duplicate issue open.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 7e5d6dba8001; fix evidence: commit 13757465ba1b, main fix timestamp 2026-04-29T07:52:13+01:00.

Codex Review: Didn't find any major issues. What shall we delve into next?