fix(agents): resolve bare alias fallbacks via alias index#78395
fix(agents): resolve bare alias fallbacks via alias index#78395AtelyPham wants to merge 1 commit into
Conversation
openclaw-barnacle
Bot
added
agents
|
Codex review: needs maintainer review before merge. Reviewed July 3, 2026, 11:45 PM ET / 03:45 UTC. Summary PR surface: Source +27, Tests +176. Total +203 across 3 files. Reproducibility: yes. Current main lacks alias-first lookup in the fallback allowlist path, and Mantis baseline proof plus the PR's runtime output show Review metrics: 1 noteworthy metric.
Stored data model Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Security Review detailsBest possible solution: Land after maintainers explicitly accept alias-first semantics for providerless fallback strings, or pause for a broader runtime-selector and upgrade policy if that behavior is not intended. Do we have a high-confidence way to reproduce the issue? Yes. Current main lacks alias-first lookup in the fallback allowlist path, and Mantis baseline proof plus the PR's runtime output show Is this the best way to solve the issue? Yes, with compatibility signoff. The shared helper feeds both AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 9d68f877ac3e. Label changesLabel justifications:
Evidence reviewedPR surface: Source +27, Tests +176. Total +203 across 3 files. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5e545005f4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Real behavior proof (shared
|
| state | bug-report cfg: openai-codex byProvider |
regression cfg: openai byProvider |
regression cfg: openai/gpt-5.5 allowed by routing gate |
|---|---|---|---|
ffafa9008d (main, pre-PR) |
["gpt-5.5", "opus-cli"] bug present |
["gpt-4o", "gpt-5.5"] ok |
true ok |
5e545005f4 (initial PR fix) |
["gpt-5.5"] fixed |
["gpt-4o"] Codex P2 regression |
false Codex P2 regression |
f6ecb9f73e (PR tip) |
["gpt-5.5"] fixed |
["gpt-4o", "gpt-5.5"] fixed |
true fixed |
Raw output, PR tip (f6ecb9f73e)
=== bug-report cfg (primary openai-codex/gpt-5.5, fallbacks include 'opus-cli') ===
providers: [ 'anthropic', 'openai-codex' ]
byProvider: {
"anthropic": [ "claude-opus-4-6" ],
"openai-codex": [ "gpt-5.5" ]
}
openai-codex contains 'opus-cli'? false
claude-cli present as provider? false
=== regression cfg (bare key 'gpt-5.5' + another entry alias = 'gpt-5.5') ===
providers: [ 'openai' ]
byProvider: {
"openai": [ "gpt-4o", "gpt-5.5" ]
}
=== routing-allowlist gate (Codex P2 regression scenario) ===
openai/gpt-5.5 (bare allowlist key, not the default) allowed? true (must be true)
Raw output, main pre-PR (ffafa9008d) — original bug
=== bug-report cfg (primary openai-codex/gpt-5.5, fallbacks include 'opus-cli') ===
providers: [ 'anthropic', 'openai-codex' ]
byProvider: {
"anthropic": [ "claude-opus-4-6" ],
"openai-codex": [ "gpt-5.5", "opus-cli" ]
}
openai-codex contains 'opus-cli'? true
Raw output, initial PR fix (5e545005f4) — Codex P2 regression visible
=== regression cfg (bare key 'gpt-5.5' + another entry alias = 'gpt-5.5') ===
providers: [ 'openai' ]
byProvider: {
"openai": [ "gpt-4o" ]
}
=== routing-allowlist gate (Codex P2 regression scenario) ===
openai/gpt-5.5 (bare allowlist key, not the default) allowed? false (must be true)
Reproducer
import { buildModelsProviderData } from "src/auto-reply/reply/commands-models.ts";
import { getModelRefStatusWithFallbackModels } from "src/agents/model-selection-shared.ts";
const cfg = { /* either config above */ };
const data = await buildModelsProviderData(cfg);
console.log([...data.byProvider.entries()].map(([k, v]) => [k, [...v].toSorted()]));Run via pnpm exec tsx <script>. Verifies both:
- the original
/modelspicker leak (opus-clino longer listed underopenai-codex) - the Codex P2 regression fix (bare allowlist key not silently rewritten by an unrelated alias entry).
@clawsweeper re-review
Re-review progress:
- State: Complete
- Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
- Run: https://github.com/openclaw/clawsweeper/actions/runs/25681635416
- Updated: 2026-05-11T16:11:50.430Z
clawsweeper
Bot
added
the
proof: sufficient
openclaw-barnacle
Bot
added
proof: supplied
clawsweeper
Bot
added
the
proof: sufficient
f6ecb9f to
7936106
Compare
openclaw-barnacle
Bot
removed
the
proof: sufficient
|
@clawsweeper re-review |
clawsweeper
Bot
added
the
proof: sufficient
|
Codex Review: Didn't find any major issues. Can't wait for the next one! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
openclaw-barnacle
Bot
removed
the
proof: sufficient
clawsweeper
Bot
added
the
proof: sufficient
💡 Codex Reviewhttps://github.com/openclaw/openclaw/blob/6e6e22b0e3599f8a0ec7fef70434e670ed63c8d4/src/agents/model-selection-shared.ts#L681-L685 When a fallback alias points to a ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
openclaw-barnacle
Bot
removed
the
proof: sufficient
clawsweeper
Bot
added
the
proof: sufficient
openclaw-barnacle
Bot
removed
the
proof: sufficient
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5582a93bce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
clawsweeper
Bot
added
the
proof: sufficient
fa1edc6 to
7b9cfd7
Compare
openclaw-barnacle
Bot
removed
the
proof: sufficient
clawsweeper
Bot
added
the
proof: sufficient
5779d98 to
ee7aa7d
Compare
openclaw-barnacle
Bot
removed
the
proof: sufficient
|
Hi @steipete @vincentkoc @joshavant @sallyom — sorry to ping directly. This PR is a small |
clawsweeper
Bot
added
the
proof: sufficient
|
This pull request has been automatically marked as stale due to inactivity. |
64da605 to
05addd3
Compare
openclaw-barnacle
Bot
removed
the
proof: sufficient
clawsweeper
Bot
added
the
proof: sufficient
05addd3 to
642b3cb
Compare
openclaw-barnacle
Bot
removed
the
proof: sufficient
clawsweeper
Bot
added
proof: sufficient
clawsweeper
Bot
added
rating: 🌊 off-meta tidepool
Mantis Telegram Desktop ProofSummary: Mantis captured native Telegram Desktop before/after GIFs for the /models openai-codex picker.
Motion-trimmed clips: |
Bare CLI-runtime alias fallbacks (e.g. opus-cli) leaked into the Telegram, Discord, and Mattermost /model pickers as fake <defaultProvider>/<alias> entries. Resolve fallback aliases through the configured alias index, infer the catalog provider for the target, and forward the caller's manifest normalization context so /models snapshots resolve alias targets the same way the rest of the allowlist does.
642b3cb to
8f47039
Compare
|
This pull request has been automatically marked as stale due to inactivity. |
|
Closing — this is now fixed on The bare CLI-runtime alias leak this PR targeted (e.g.
Delivered by #110888 (wiring the alias index into the fallback/allowlist path), building on #100209 and the |
1 participant
Summary
Fix Telegram/Discord/Mattermost
/modelpickers misclassifying configured CLI-runtime bare aliases (opus-cli,sonnet-cli, etc.) under the agent's primary provider.buildAllowedModelSetWithFallbacks(src/agents/model-selection-shared.ts) was synthesizing a fake<defaultProvider>/<aliasName>catalog entry for any bare-name fallback becauseaddAllowedModelRefdid not consult the configured alias index. Repro: a config withmodel.fallbacks: ["opus-cli", ...]andmodels["claude-cli/claude-opus-4-6"].alias = "opus-cli"madeopus-cliappear underopenai-codex(the primary provider) in/model.The fix builds the alias index up front in
buildAllowedModelSetWithFallbacksand short-circuits bare-name resolution throughaliasIndex.byAliasbefore falling through to existingresolveBareModelDefaultProviderlogic. Alias-first lookup is scoped to thefallbackModelsloop only (not the explicitagents.defaults.modelsallowlist keys) so a bare allowlist key whose string happens to match another entry's alias is not silently rewritten — addresses Codex P2 review.Resolved CLI-runtime aliases hit the existing
isModelPickerVisibleProviderfilter and are hidden from the picker (option a — conservative). Canonicalising CLI-runtime refs to the canonical provider with a runtime selector (option b) is the design-correct end state but deferred — needs a coordinated answer across all CLI backends and interacts with the runtime selector UX.Side effect of the same synthesis bug:
allowedKeysingetModelRefStatusWithFallbackModelswas getting the wrong key (openai-codex/opus-cli) instead of the resolved one (claude-cli/claude-opus-4-6), so this is not just a UI fix — it also corrects the routing-allowlist gate.Real behavior proof
Behavior or issue addressed: Telegram/Discord/Mattermost
/modelspicker incorrectly listing bare CLI-runtime aliases (e.g.opus-cli) under the agent's primary canonical provider (e.g.openai-codex), and the same misrouting in thegetModelRefStatusWithFallbackModelsallowlist gate.Real environment tested: Local repo running the actual production picker-data path (
buildModelsProviderDatafromsrc/auto-reply/reply/commands-models.ts:68— the same function consumed by Telegram/Discord/Mattermost/modelscommands) and the routing-allowlist gate (getModelRefStatusWithFallbackModelsfromsrc/agents/model-selection-shared.ts:781) directly against the bug-report config and a regression-witness config across three commits on this branch.Exact steps or command run after this patch:
pnpm exec tsx <script>where the script callsbuildModelsProviderData(cfg)andgetModelRefStatusWithFallbackModels(...)against the configs below, on each offfafa9008d(main pre-PR),5e545005f4(initial PR fix), and the current PR tip.Evidence after fix: terminal output, copied live from a Node process running the actual
buildModelsProviderDataandgetModelRefStatusWithFallbackModelsruntime against the configs above on the PR tip:Before fix (
ffafa9008d, main) — original bug visible in same runtime:Before fix (
5e545005f4, initial PR fix) — Codex P2 regression visible:Observed result after fix: At PR tip, the
byProvidermap produced by the livebuildModelsProviderDataruntime no longer containsopus-cliunderopenai-codexfor the bug-report config, andgetModelRefStatusWithFallbackModelscorrectly returnsallowed: trueforopenai/gpt-5.5in the regression-witness config. Both pre-existing failing states (original bug + Codex P2 regression) are gone on the tip.What was not tested: Live end-to-end Telegram bot interaction (sending
/models openai-codexfrom a real Telegram chat to a running gateway) was not run, because the proof exercises the same sharedbuildModelsProviderDatafunction the channel handler consumes — channel plugin button rendering is a pure passthrough of thebyProvidermap captured above.Verification
pnpm test src/agents/model-selection.test.ts src/auto-reply/reply/commands-models.test.ts→ all green.src/agents/model-selection.test.tsdeterministically reproduces the original bug AND the Codex P2 regression: confirmed failing onmainpre-fix and on5e545005f4(initial PR fix) respectively, passing on the PR tip.src/auto-reply/reply/commands-models.test.tsassertsbyProvider.get("openai-codex")does not contain"opus-cli"for the bug-report config.commands-models.test.ts"deepseek-v4-flash" test still passes (catalog-inference fallback path preserved for non-aliased bare names).pnpm exec oxfmt --checkon touched files → clean.pnpm check:changed→ all gates pass.Cross-surface impact
buildAllowedModelSetWithFallbacksis shared. Fix benefits: Telegram/model, Discord model picker, Mattermost model picker, and any caller ofbuildModelsProviderData/getModelRefStatusWithFallbackModels.Related
src/flows/model-picker.ts) only. This PR addresses the shared seam used by channel surfaces. Files do not overlap; the two land independently.Test plan
buildModelsProviderDataconfirmsopenai-codexprovider list does not contain bare CLI-runtime aliases.model-selection.test.ts+commands-models.test.tssuites pass post-fix.oxfmt --checkclean on touched files.pnpm check:changedclean.