Skip to content

fix: CLI auth status/probe path regression#75223

Open
clawsweeper[bot] wants to merge 5 commits into
mainfrom
clawsweeper/clawsweeper-commit-openclaw-openclaw-581fbea1d653
Open

fix: CLI auth status/probe path regression#75223
clawsweeper[bot] wants to merge 5 commits into
mainfrom
clawsweeper/clawsweeper-commit-openclaw-openclaw-581fbea1d653

Conversation

@clawsweeper

@clawsweeper clawsweeper Bot commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Found one regression in the CLI auth status/probe path. The commit intentionally makes unscoped external CLI discovery skip missing runtime-only profiles, but models status and models status --probe still load the auth store without passing the providers they are about to report or probe.

What ClawSweeper Is Fixing

  • Medium: models status --probe misses CLI-only credentials after scoped discovery (regression)
    • File: src/commands/models/list.probe.ts:259
    • Evidence: src/agents/auth-profiles/external-cli-sync.ts:210 now returns false for unscoped missing external CLI profiles unless a matching stored OAuth profile already exists. buildProbeTargets still calls ensureAuthProfileStore(agentDir) without allowKeychainPrompt: false, externalCliProviderIds, or externalCliProfileIds, even though the function receives the exact providers and probe profile filters at src/commands/models/list.probe.ts:254-256. A focused smoke with a temporary Codex CLI auth file confirmed resolveExternalCliAuthProfiles(emptyStore) returns [], while resolveExternalCliAuthProfiles(emptyStore, { providerIds: ["openai-codex"] }) returns ["openai-codex:default"].
    • Impact: A user who only has file-backed Codex/Claude/Minimax CLI credentials and no persisted OpenClaw auth profile can resolve runtime auth through the newly scoped model-auth path, but openclaw models status --probe will build no profile target for that same credential. This produces false “nothing to probe” or missing-auth diagnostics for the provider most likely being checked.
    • Suggested fix: In buildProbeTargets, load the store with a scope derived from the requested probe surface, for example ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false, config: cfg, externalCliProviderIds: providers, externalCliProfileIds: options.profileIds }). The plain status path at src/commands/models/list.status-command.ts:223 should likewise pass the config-derived external CLI scope, matching src/gateway/server-methods/models-auth-status.ts:296-301.
    • Confidence: high

Expected Repair Surface

  • src/commands/models/list.probe.ts
  • src/agents/auth-profiles.external-cli-scope.test.ts
  • src/agents/auth-profiles.external-cli-sync.test.ts
  • src/agents/auth-profiles/external-cli-scope.ts
  • src/agents/auth-profiles/external-cli-sync.ts
  • src/agents/model-auth.profiles.test.ts
  • src/agents/model-auth.ts

Source And Review Context

Expected validation

  • pnpm check:changed

ClawSweeper already ran:

  • pnpm docs:list
  • pnpm install --frozen-lockfile
  • Focused external CLI resolver smoke with temporary Codex CLI auth file
  • pnpm test src/agents/auth-profiles.external-cli-sync.test.ts src/agents/auth-profiles.external-cli-scope.test.ts src/agents/model-auth.profiles.test.ts src/commands/models/list.probe.targets.test.ts
  • git diff --check 54e6e3d7daf5d0d857edf756b35628a29d11c7f5..581fbea1d65355917886babffe4161f8b3178a12

Known review limits:

  • I did not run a full models status --probe live provider call, because the actionable regression is in target construction before network probing.

ClawSweeper Guardrails

  • Re-check the finding against latest main before changing code.
  • Keep the patch to the narrowest behavior change and matching regression coverage.
  • Do not merge automatically; this PR stays for maintainer review.

ClawSweeper 🐠 replacement reef notes:

  • Cluster: clawsweeper-commit-openclaw-openclaw-581fbea1d653
  • Source PRs: none
  • Credit: Detected by ClawSweeper commit review for 581fbea.; Original commit author: Peter Steinberger.
  • Validation: pnpm check:changed

fish notes: model gpt-5.5, reasoning medium; reviewed against 24edcd5.

@clawsweeper clawsweeper Bot added clawsweeper Tracked by ClawSweeper automation clawsweeper:commit-finding PR created from a ClawSweeper commit finding labels Apr 30, 2026
@openclaw-barnacle openclaw-barnacle Bot added commands Command implementations size: S labels Apr 30, 2026
@clawsweeper

clawsweeper Bot commented Apr 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Codex review: needs maintainer review before merge. Reviewed July 3, 2026, 11:41 PM ET / 03:41 UTC.

Summary
The PR scopes external CLI auth discovery for models status and narrows models status --probe external CLI discovery to the requested provider/profile surface.

PR surface: Source +6, Tests +124. Total +130 across 4 files.

Reproducibility: yes. source-reproducible: current main loads CLI status without an external CLI discovery scope while the resolver intentionally skips missing runtime-only CLI profiles when no provider/profile scope is supplied.

Review metrics: 1 noteworthy metric.

  • CLI auth discovery entry points: 2 changed. Plain status reporting and probe target construction now load scoped external CLI auth, so reviewers should treat the patch as one auth-provider visibility change.

Root-cause cluster
Relationship: canonical
Canonical: #75223
Summary: This PR remains the narrow canonical repair for the external CLI status/probe discovery gap; related items cover adjacent or broader auth/probe behavior.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Attach redacted exact-head models status and models status --probe output, or record an explicit maintainer waiver.
  • [P2] Validate the clean merge ref against current main before landing.

Risk before merge

  • [P1] Existing installs with file-backed external CLI credentials may see those credentials appear in CLI status output and probe target construction where they were previously hidden.
  • [P1] The auth-provider visibility change still needs maintainer acceptance plus redacted exact-head models status and models status --probe proof or an explicit waiver before landing.
  • [P1] The branch is mergeable, but touched command/auth files have moved on current main, so maintainers should validate the merge ref before landing.

Maintainer options:

  1. Capture Status And Probe Proof (recommended)
    Before merge, attach redacted exact-head models status --json and provider-scoped models status --probe --json output, or record an explicit maintainer proof waiver.
  2. Accept The Auth Visibility Change
    Maintainers may intentionally accept that scoped file-backed CLI credentials now appear in status/probe surfaces because it aligns CLI status with gateway auth status.
  3. Pause The Bot Repair
    If this operator-visible auth behavior is not wanted, pause or close the bot repair rather than keeping the branch open as a landing candidate.

Next step before merge

  • [P2] Human review should decide whether to accept the auth-provider visibility change and whether proof or waiver is enough; there is no narrow code defect to hand to repair automation.

Security
Cleared: No concrete security or supply-chain regression found; the diff changes scoped auth discovery and focused tests only, with no dependency, workflow, persistence-format, or secret-logging change.

Review details

Best possible solution:

Land the narrow scoped-discovery repair after maintainer acceptance of the auth-provider visibility behavior and fresh exact-head CLI proof or waiver.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main loads CLI status without an external CLI discovery scope while the resolver intentionally skips missing runtime-only CLI profiles when no provider/profile scope is supplied.

Is this the best way to solve the issue?

Yes; reusing the existing scoped discovery helper and matching the gateway auth-status pattern is the narrowest maintainable fix. Restoring broad unscoped scans would fight the scoped external CLI contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9d68f877ac3e.

Label changes

Label justifications:

  • P2: This is a normal-priority CLI auth status/probe regression with limited blast radius but real operator-visible missing-auth impact.
  • merge-risk: 🚨 compatibility: Existing status/probe output can change for installs with file-backed external CLI credentials because scoped external auth overlays become visible.
  • merge-risk: 🚨 auth-provider: The PR changes how CLI status/probe loads external auth profiles, affecting provider auth reporting and probe target selection.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor proof gate is not applicable to this ClawSweeper-authored bot repair, though maintainers may still require redacted exact-head CLI proof or a waiver before landing.
Evidence reviewed

PR surface:

Source +6, Tests +124. Total +130 across 4 files.

View PR surface stats
Area Files Added Removed Net
Source 2 11 5 +6
Tests 2 132 8 +124
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 4 143 13 +130

What I checked:

Likely related people:

  • steipete: Auth-profile history shows the scoped external CLI overlay/status work and the follow-up discovery change came through this area. (role: feature-history contributor; confidence: high; commits: f79553bef61f, 581fbea1d653; files: src/agents/auth-profiles/external-cli-discovery.ts, src/agents/auth-profiles/external-cli-sync.ts, src/gateway/server-methods/models-auth-status.ts)
  • nxmxbbd: Merged related Codex auth-probe hardening touched models status --probe, overlapping the probe surface without replacing this external CLI discovery repair. (role: adjacent auth-probe contributor; confidence: medium; commits: 37c5003ed966; files: src/commands/models/list.probe.ts, src/agents/openai-transport-stream.ts)
  • vincentkoc: Recent history on both status/probe command files and external auth helpers includes normalization/runtime refactors that may matter during merge refresh. (role: recent adjacent contributor; confidence: medium; commits: 152995806797, 4e2351dd4d35, 305a44388bcb; files: src/commands/models/list.status-command.ts, src/commands/models/list.probe.ts, src/agents/auth-profiles/external-cli-sync.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@ecochran76 ecochran76 mentioned this pull request Apr 30, 2026
Closed
25 tasks
@clawsweeper

clawsweeper Bot commented May 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

🦞🔧
ClawSweeper applied a repair to this PR branch.

Repair: kept the fix on this contributor branch instead of opening a replacement PR.
Validation: pnpm check:changed; pnpm lint; pnpm check:test-types
Updated head: 70a4d4099752
Run: https://github.com/openclaw/clawsweeper/actions/runs/27505586581

Current state: exact-head review queued immediately; GitHub checks and the review verdict gate final merge.

Automerge progress:

  • 2026-06-14 16:41:02 UTC review queued 1eb7a42f0739 (after repair)
  • 2026-06-14 16:48:18 UTC review requested repair 1eb7a42f0739 (structured ClawSweeper marker: fix-required (finding=review-feedback sha=1eb7a4...)
  • 2026-06-14 16:59:21 UTC review queued 70a4d4099752 (after repair)

@clawsweeper
clawsweeper Bot force-pushed the clawsweeper/clawsweeper-commit-openclaw-openclaw-581fbea1d653 branch from 24edcd5 to b2695bb Compare May 15, 2026 22:56
@barnacle-openclaw

barnacle-openclaw Bot commented May 30, 2026

Copy link
Copy Markdown

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

@barnacle-openclaw barnacle-openclaw Bot added the stale Marked as stale due to inactivity label May 30, 2026
@clawsweeper clawsweeper Bot added the rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. label May 30, 2026
@openclaw-barnacle openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label May 31, 2026
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. labels May 31, 2026
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels Jun 14, 2026
@clawsweeper
clawsweeper Bot force-pushed the clawsweeper/clawsweeper-commit-openclaw-openclaw-581fbea1d653 branch from 10312a9 to 1eb7a42 Compare June 14, 2026 16:41
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 14, 2026
@clawsweeper clawsweeper Bot added status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. status: needs maintainer proof decision A ClawSweeper-authored PR needs a maintainer proof capture or override decision. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. status: needs maintainer proof decision A ClawSweeper-authored PR needs a maintainer proof capture or override decision. labels Jun 18, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jun 21, 2026
Closed
@clawsweeper clawsweeper Bot added status: needs maintainer proof decision A ClawSweeper-authored PR needs a maintainer proof capture or override decision. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. status: needs maintainer proof decision A ClawSweeper-authored PR needs a maintainer proof capture or override decision. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. labels Jun 21, 2026
This was referenced Jun 27, 2026
Open
Open
@openclaw-barnacle

openclaw-barnacle Bot commented Jul 19, 2026

Copy link
Copy Markdown

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

@clawsweeper

clawsweeper Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor Author

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix: CLI auth status/probe path regression This is item 1/1 in the current shard. Shard 0/22.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

clawsweeper:commit-finding PR created from a ClawSweeper commit finding clawsweeper Tracked by ClawSweeper automation commands Command implementations merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: S stale Marked as stale due to inactivity status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants