fix(config): accept overlays for bundled provider aliases by Pluviobyte · Pull Request #88400 · openclaw/openclaw

Pluviobyte · 2026-05-30T17:51:54Z

Summary

Allow bundled provider aliases to be configured as lightweight provider overlays without baseUrl or models.
Add the reviewer-identified bundled overlay aliases to the schema allowlist: azure-openai-responses, moonshotai, moonshot-ai, z.ai, and z-ai.
Extend regression coverage for timeout-only overlays using those aliases.

Real behavior proof (required for external PRs)

Behavior or issue addressed: bundled provider overlay aliases were rejected as custom providers when present in plugin manifests/catalogs but absent from the schema allowlist.
Real environment tested: local OpenClaw source checkout on this branch, exercising the production OpenClawSchema path.

Exact steps or command run after this patch:

node --import tsx --input-type=module --eval 'import { OpenClawSchema } from "./src/config/zod-schema.js"; const aliases = ["azure-openai-responses", "moonshotai", "moonshot-ai", "z.ai", "z-ai"]; const failures = aliases.filter((id) => !OpenClawSchema.safeParse({ models: { providers: { [id]: { timeoutSeconds: 600 } } } }).success); if (failures.length) { console.error(`failed: ${failures.join(", ")}`); process.exit(1); } console.log(`OpenClawSchema safeParse accepted timeout-only overlays: ${aliases.join(", ")}`);'

Evidence after fix:

OpenClawSchema safeParse accepted timeout-only overlays: azure-openai-responses, moonshotai, moonshot-ai, z.ai, z-ai

Observed result after fix: the production OpenClaw config schema accepts timeout-only overlays for all five reviewer-identified bundled aliases without requiring baseUrl or models.
What was not tested: live provider API calls; this proof exercises config schema validation for bundled-provider overlay acceptance.

Tests and validation

node scripts/run-vitest.mjs run src/config/zod-schema.models.test.ts: passed, 17 tests
pnpm exec oxfmt --check src/config/zod-schema.core.ts src/config/zod-schema.models.test.ts: passed
model catalog provider/alias parity check: missing from overlay allowlist (none)
git diff --check: passed

clawsweeper · 2026-05-30T17:54:22Z

Codex review: needs maintainer review before merge. Reviewed June 21, 2026, 3:47 AM ET / 07:47 UTC.

Summary
Adds bundled provider and provider-alias IDs to the model provider overlay allowlist, plus table-driven schema coverage for timeout-only overlays.

PR surface: Source +16, Tests +29. Total +45 across 2 files.

Reproducibility: yes. Source inspection shows current main rejects timeout-only overlays unless the provider ID is in the built-in overlay allowlist, and the affected aliases are declared in bundled provider metadata.

Review metrics: 2 noteworthy metrics.

Provider overlay allowlist: 16 added, 0 changed, 0 removed. This static allowlist decides which bundled provider IDs may be configured as lightweight overlays instead of full custom provider definitions.
Current-main parity: 17 missing before PR, 16 covered, 1 remaining. The branch fixes the targeted alias gap but current main separately added cohere, so maintainers should notice the remaining parity choice before merge.

Root-cause cluster
Relationship: canonical
Canonical: #88400
Summary: This PR is the current open follow-up for alias-specific gaps left after the merged bundled-provider timeout overlay fix.

Members:

same_root_cause: [Bug]: models.providers.<id>.timeoutSeconds documented in schema as standalone-valid, rejected by startup validator on built-in providers #83201 - The closed issue reported the original timeout-only bundled-provider validation mismatch that the merged base fix and this alias follow-up address.
same_root_cause: fix(config): allow bundled provider timeout overlays #83267 - The merged PR fixed the base bundled-provider timeout-overlay validator behavior; this PR extends that behavior to additional provider aliases.
partial_overlap: feat: add hosted model providers #88247 - The merged hosted-provider PR added several provider and alias manifests whose IDs are part of this PR's allowlist update.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Decide whether to add cohere overlay parity before merge or track it separately.

Risk before merge

[P1] Current main now has a bundled cohere model provider that is still absent from the overlay allowlist; this PR covers the 16 older missing IDs, so maintainers should decide whether to add cohere here or track it as a separate follow-up.

Maintainer options:

Decide the mitigation before merge
Land the focused allowlist and test update after maintainer review, with an explicit decision on whether current-main cohere overlay parity belongs in this branch or a separate follow-up.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P2] No repair lane is needed; the branch is focused and proof-backed, but maintainers should decide the current-head cohere parity handling before merge.

Security
Cleared: The diff only changes a static config allowlist and a Vitest schema test, with no dependency, workflow, script, secret, package, or code-execution surface changes.

Review details

Best possible solution:

Land the focused allowlist and test update after maintainer review, with an explicit decision on whether current-main cohere overlay parity belongs in this branch or a separate follow-up.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main rejects timeout-only overlays unless the provider ID is in the built-in overlay allowlist, and the affected aliases are declared in bundled provider metadata.

Is this the best way to solve the issue?

Yes. For the current static schema design, adding the missing manifest-declared aliases with table coverage is the narrowest maintainable repair; deriving the allowlist from manifests would be broader hardening.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b15f745a605c.

Label changes

Label justifications:

P2: This is a normal config compatibility bugfix for bundled provider aliases with limited blast radius and focused schema coverage.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body and follow-up comments include after-fix production OpenClawSchema.safeParse output for the bundled aliases, which is sufficient for this schema-only validation change.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body and follow-up comments include after-fix production OpenClawSchema.safeParse output for the bundled aliases, which is sufficient for this schema-only validation change.

Evidence reviewed

PR surface:

Source +16, Tests +29. Total +45 across 2 files.

View PR surface stats

Area	Files	Added	Net
Source	1	16	+16
Tests	1	29	+29
Docs	0	0	0
Config	0	0	0
Generated	0	0	0
Other	0	0	0
Total	2	45	+45

What I checked:

Current schema gate: Current main only skips the custom-provider baseUrl and models requirements when isBuiltInModelProviderOverlayId(providerId) matches the static allowlist. (src/config/zod-schema.core.ts:519, b15f745a605c)
Runtime materialization uses the same predicate: Validated bundled provider overlays are materialized through isBuiltInModelProviderOverlayId, so the allowlist controls both validation acceptance and runtime default materialization. (src/config/validation.ts:107, b15f745a605c)
Validation order: Raw config validation calls OpenClawSchema.safeParse before overlay materialization, so IDs missing from the allowlist fail before runtime defaults can help. (src/config/validation.ts:1055, b15f745a605c)
Bundled alias metadata: Current bundled manifests declare the affected model provider IDs and aliases, including Qwen portal/CLI/OAuth, GMI, Novita, Moonshot, Azure OpenAI Responses, and Z.AI alias surfaces. (extensions/qwen/openclaw.plugin.json:7, b15f745a605c)
Current-main parity probe: A read-only parity probe found 17 model-provider IDs missing from the current allowlist; this PR covers 16 of them and leaves only current-main cohere uncovered. (b15f745a605c)
PR diff coverage: The PR head adds 16 allowlist IDs and adds a table-driven test proving each accepts a timeout-only provider overlay without baseUrl or models. (src/config/zod-schema.models.test.ts:5, 8d575291a325)

Likely related people:

giodl73-repo: Merged PR fix(config): allow bundled provider timeout overlays #83267 introduced bundled-provider timeout overlay validation and materialization, which this PR extends to additional aliases. (role: introduced behavior; confidence: high; commits: ff871e162aaf; files: src/config/zod-schema.core.ts, src/config/validation.ts)
steipete: Merged hosted-provider work added several affected provider and alias manifests, including GMI, Novita, Qwen OAuth, and Ollama Cloud. (role: feature-history owner; confidence: medium; commits: 470fc879e804; files: extensions/gmi/openclaw.plugin.json, extensions/novita/openclaw.plugin.json, extensions/qwen/openclaw.plugin.json)
vincentkoc: Current-main blame for the carried-forward schema allowlist and the current Cohere provider surface points through recent release forward-port history by Vincent Koc. (role: recent area contributor; confidence: medium; commits: 0f8df48a91, c645ec4555c0; files: src/config/zod-schema.core.ts, extensions/cohere/openclaw.plugin.json)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Pluviobyte · 2026-05-30T18:34:09Z

Real behavior proof follow-up

I added a direct config-schema proof using the production OpenClawSchema path, not just the regression test.

Command

pnpm exec tsx -e 'import { OpenClawSchema } from "./src/config/zod-schema.ts"; const result = OpenClawSchema.safeParse({ models: { providers: { "qwen-oauth": { timeoutSeconds: 600 }, "ollama-cloud": { timeoutSeconds: 120 }, "novita-ai": { timeoutSeconds: 90 } } } }); console.log("schema overlay proof:", result.success ? "PASS" : "FAIL"); if (!result.success) { console.log(result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("\n")); process.exit(1); } console.log("accepted providers:", Object.keys(result.data.models?.providers ?? {}).join(", "));'

Output

schema overlay proof: PASS
accepted providers: qwen-oauth, ollama-cloud, novita-ai

This exercises the real OpenClaw config schema with lightweight bundled-provider overlays. Before this patch, these manifest-declared bundled provider aliases were not in BUILT_IN_MODEL_PROVIDER_OVERLAY_IDS, so the same config was treated as a custom provider overlay and rejected for missing baseUrl/models.

Regression test

node scripts/run-vitest.mjs run src/config/zod-schema.models.test.ts

Test Files  1 passed (1)
     Tests  12 passed (12)

Co-authored-by: Cursor <[email protected]>

Pluviobyte · 2026-06-03T05:50:51Z

Updated the branch with 8d575291a3 to address the latest alias-parity blocker.

Added to the bundled overlay allowlist and regression table:

azure-openai-responses
moonshotai
moonshot-ai
z.ai
z-ai

Validation run locally:

node scripts/run-vitest.mjs run src/config/zod-schema.models.test.ts passed: 17 tests.
node --import tsx --input-type=module --eval ... production OpenClawSchema.safeParse proof passed for all five aliases as timeout-only overlays.
Model catalog provider/alias parity check now reports missing from overlay allowlist: (none).
pnpm exec oxfmt --check src/config/zod-schema.core.ts src/config/zod-schema.models.test.ts passed.
git diff --check passed.

…8400) Co-authored-by: Pluviobyte <[email protected]> Co-authored-by: Cursor <[email protected]>

openclaw-barnacle Bot added size: XS triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 30, 2026

fix(config): accept overlays for bundled provider aliases

8d57529

Co-authored-by: Cursor <[email protected]>

Pluviobyte force-pushed the fix/provider-overlay-allowlist-parity branch from 51a4ab7 to 8d57529 Compare June 3, 2026 05:50

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 3, 2026

clawsweeper Bot added status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jun 3, 2026

vincentkoc merged commit b01e612 into openclaw:main Jun 29, 2026
331 of 350 checks passed

github-actions Bot mentioned this pull request Jun 29, 2026

📡 Upstream Digest — 2026-06-29 08:51 UTC curtismercier/openclaw-mods#1172

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 30, 2026

fix(config): accept overlays for bundled provider aliases (openclaw#8…

16b3a86

…8400) Co-authored-by: Pluviobyte <[email protected]> Co-authored-by: Cursor <[email protected]>

QiuYuang pushed a commit to QiuYuang/openclaw that referenced this pull request Jul 1, 2026

fix(config): accept overlays for bundled provider aliases (openclaw#8…

946b707

…8400) Co-authored-by: Pluviobyte <[email protected]> Co-authored-by: Cursor <[email protected]>

chenyangjun-xy pushed a commit to chenyangjun-xy/openclaw that referenced this pull request Jul 1, 2026

fix(config): accept overlays for bundled provider aliases (openclaw#8…

fbc0f54

…8400) Co-authored-by: Pluviobyte <[email protected]> Co-authored-by: Cursor <[email protected]>

chenyangjun-xy pushed a commit to chenyangjun-xy/openclaw that referenced this pull request Jul 3, 2026

fix(config): accept overlays for bundled provider aliases (openclaw#8…

10888ae

…8400) Co-authored-by: Pluviobyte <[email protected]> Co-authored-by: Cursor <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(config): accept overlays for bundled provider aliases#88400

fix(config): accept overlays for bundled provider aliases#88400
vincentkoc merged 1 commit into
openclaw:mainfrom
Pluviobyte:fix/provider-overlay-allowlist-parity

Pluviobyte commented May 30, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 30, 2026 •

edited

Loading

Uh oh!

Pluviobyte commented May 30, 2026

Uh oh!

Pluviobyte commented Jun 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Pluviobyte commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof (required for external PRs)

Tests and validation

Uh oh!

clawsweeper Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Pluviobyte commented May 30, 2026

Real behavior proof follow-up

Command

Output

Regression test

Uh oh!

Pluviobyte commented Jun 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Pluviobyte commented May 30, 2026 •

edited

Loading

clawsweeper Bot commented May 30, 2026 •

edited

Loading