fix(models): keep auth login out of main config by steipete · Pull Request #88612 · openclaw/openclaw

steipete · 2026-05-31T12:18:32Z

Summary

Keep ordinary provider auth login credentials in auth-profiles.json without rewriting openclaw.json.
Preserve openclaw.json writes for provider config patches and explicit --set-default model updates.
Normalize persisted auth profile type: apiKey to api_key, and create per-agent store order only when stale configured auth selection would otherwise shadow the newly logged-in profile.

Verification

OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/commands/models/auth.test.ts
OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/agents/auth-profiles/persisted-boundary.test.ts
OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/agents/auth-profiles/profiles.test.ts
OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/agents/auth-profiles.resolve-auth-profile-order.does-not-prioritize-lastgood-round-robin-ordering.test.ts
git diff --check origin/main...HEAD
pnpm tsgo:core
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main

Behavior addressed
models auth login now stores plain login credentials in the auth profile store and does not touch openclaw.json unless the provider returns a config patch or the user passes --set-default.

Real environment tested
Local OpenClaw checkout on macOS, Node repo test wrappers.

Exact steps or command run after this patch
The verification commands listed above were run after the final patch.

Evidence after fix
Focused tests cover plain login not calling updateConfig, config/profile and config/order shadowing cases, apiKey persisted type normalization, and store order creation preserving configured order tails.

Observed result after fix
All listed tests and checks passed, and autoreview reported no accepted/actionable findings.

What was not tested
No live provider OAuth flow was run.

Fixes #88565

clawsweeper · 2026-05-31T12:20:19Z

Codex review: needs real behavior proof before merge. Reviewed May 31, 2026, 10:07 AM ET / 14:07 UTC.

Summary
The branch keeps ordinary models auth login credentials in auth-profiles.json, avoids default openclaw.json auth writes, preserves provider config-patch and --set-default writes, and adjusts auth-profile order and persisted credential normalization.

PR surface: Source +99, Tests +398, Docs +5. Total +502 across 14 files.

Reproducibility: yes. Source inspection gives a high-confidence reproduction path: current origin/main always writes auth profile metadata through updateConfig during models auth login; I did not run a live provider login in this read-only review.

Review metrics: 2 noteworthy metrics.

Config write behavior: 1 default write path removed; 2 explicit write paths retained. The PR changes when models auth login mutates openclaw.json, which is an upgrade-sensitive auth/config boundary.
Auth order fallback behavior: 2 fallback paths changed. Stored-order repair and configured-order preservation can affect which credential is selected after relogin.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🦞 diamond lobster
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted terminal or live CLI/filesystem output showing models auth login updates auth-profiles.json without adding auth profiles/order to openclaw.json.
Include an existing-profile or upgrade-shaped case in the proof, with API keys, phone numbers, IPs, non-public endpoints, and private values redacted.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body provides tests/checks only and explicitly says no live provider OAuth flow was run, so it still needs redacted real CLI/filesystem proof before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] Contributor proof is still test-only; there is no redacted terminal, live CLI output, filesystem diff, or log showing models auth login updates auth-profiles.json without adding auth profiles/order to openclaw.json.
[P2] Auth-provider persistence and auth order fallback behavior are upgrade-sensitive, so maintainers should require fresh-install and existing-profile proof before merge.

Maintainer options:

Require real login persistence proof (recommended)
Ask for redacted terminal or live CLI/filesystem output showing login updates auth-profiles.json without adding auth profiles/order to openclaw.json, including an existing-profile upgrade case.
Accept test-only proof as maintainer-owned risk
Maintainers may land with the focused tests only, but they would own any missed upgrade/config persistence regression.
Pause for auth owner confirmation
If the configured-order override behavior is still a product question, pause until the auth/config owner confirms the intended upgrade contract.

Next step before merge

[P1] Human maintainer handling is needed because the PR has the protected maintainer label and still lacks real behavior proof; I found no narrow code repair to hand to automation.

Security
Cleared: No concrete security or supply-chain regression was found; the diff changes local auth persistence logic and tests without new dependencies, workflows, or broader secret exposure.

Review details

Best possible solution:

Land this only after maintainer review confirms the auth/config boundary and the PR includes redacted real CLI/filesystem proof for fresh and upgrade-shaped login behavior.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection gives a high-confidence reproduction path: current origin/main always writes auth profile metadata through updateConfig during models auth login; I did not run a live provider login in this read-only review.

Is this the best way to solve the issue?

Mostly yes. Keeping ordinary login credentials in auth-profiles.json while preserving provider config-patch and --set-default writes matches the documented storage boundary; the remaining blocker is proof and maintainer confirmation, not an identified code defect.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against ec8cb8bcbfae.

Label changes

Label justifications:

P1: The PR addresses a high-impact auth-provider/config persistence bug that can affect real users adding model credentials.
merge-risk: 🚨 compatibility: The diff changes shipped login persistence, config write behavior, and auth order fallback handling for existing setups.
merge-risk: 🚨 auth-provider: The affected path controls provider login credentials, key refs, profile selection, and auth-profile order resolution.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦞 diamond lobster.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides tests/checks only and explicitly says no live provider OAuth flow was run, so it still needs redacted real CLI/filesystem proof before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +99, Tests +398, Docs +5. Total +502 across 14 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	6	149	50	+99
Tests	7	405	7	+398
Docs	1	5	0	+5
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	14	559	57	+502

What I checked:

Current-main bug path: Current origin/main unconditionally calls updateConfig and then applyAuthProfileConfig for every provider login profile, matching the linked report that ordinary login writes auth metadata into openclaw.json. (src/commands/models/auth.ts:437, ec8cb8bcbfae)
PR config-write boundary: The PR gates updateConfig behind provider configPatch or explicit --set-default default-model writes, and ordinary login no longer calls applyAuthProfileConfig. (src/commands/models/auth.ts:425, f89c66e9b88f)
Focused regression coverage: The PR tests assert plain OpenAI login does not call updateConfig, configured profile/order shadowing creates store order, and config-patch login leaves auth out of the main config. (src/commands/models/auth.test.ts:489, f89c66e9b88f)
Auth storage contract: OpenClaw docs describe auth-profiles.json as the credential/token sink and list agent auth stores as the place where OAuth and API-key profiles live, supporting the direction of moving login credentials out of main config. Public docs: docs/concepts/oauth.md. (docs/concepts/oauth.md:43, ec8cb8bcbfae)
OpenAI provider config-patch contract: The OpenAI ChatGPT/Codex auth method returns OAuth profiles plus a provider config patch that only makes the default Codex model available, so preserving config-patch writes while removing auth-profile config writes matches that provider boundary. (extensions/openai/openai-chatgpt-provider.ts:373, ec8cb8bcbfae)
Codex dependency contract checked: Sibling Codex source shows account/login/start accepts external chatgptAuthTokens, and GetAccountParams.refresh_token documents that external-auth clients refresh tokens themselves and update via chatgptAuthTokens; this supports OpenClaw owning token persistence in its auth profile store rather than relying on Codex-managed auth.json for this flow. (../codex/codex-rs/app-server-protocol/src/protocol/v2/account.rs:64, cdde711fac00)

Likely related people:

steipete: Current-main blame for persistProviderAuthResult, promoteAuthProfileInOrder, and auth-profile merge logic points to Peter Steinberger, and this PR continues the same auth/config persistence surface. (role: feature owner and recent area contributor; confidence: high; commits: 2e254005a016; files: src/commands/models/auth.ts, src/agents/auth-profiles/profiles.ts, src/agents/auth-profiles/persisted.ts)
openclaw/openclaw-secops: .github/CODEOWNERS explicitly owns src/agents/*auth*.ts, src/agents/**/*auth*.ts, and src/agents/auth-profiles/, which are central to this PR's auth persistence changes. (role: code owner team; confidence: high; files: .github/CODEOWNERS, src/agents/auth-profiles/store.ts, src/agents/auth-profiles/persisted.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 870be5b6d0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-31T12:21:38Z

+      for (const profile of profiles) {
+        next = applyAuthProfileConfig(next, {
+          profileId: profile.profileId,
+          provider: profile.credential.provider,
+          mode: credentialMode(profile.credential),
+        });


Stop re-adding auth profiles during config-patch logins

When a provider returns any configPatch, this block still calls applyAuthProfileConfig for every login profile, so common SDK OAuth flows that include a model config patch (for example OpenAI Codex login via the standard auth-result helper) continue writing auth.profiles/auth.order into openclaw.json. In that scenario, models auth login --provider openai without --set-default still mutates the main config with auth login metadata even though the credential store is meant to own the login; apply the provider patch/default-model update without also re-adding auth profiles here.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 60dbb79577

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-31T12:46:29Z

+          ...(params.createFromOrder ?? []),
+          ...listProfilesForProvider(store, providerKey),


Preserve config-only order entries for scoped agents

When models auth login --agent ... runs for an agent whose existing config order includes a config-only profile (for example an aws-sdk auth profile with no persisted credential), this seeds the per-agent store order with that profile id. Non-default agent stores are later loaded through loadAuthProfileStoreForRuntime, which merges main+agent stores and mergeAuthProfileStores filters order entries to ids present in profiles, so the config-only fallback is dropped before resolveAuthProfileOrder can mark it eligible. The new login then shadows that configured fallback for scoped agents; preserve these ids through merge or avoid writing them into store order.

Useful? React with 👍 / 👎.

steipete · 2026-05-31T14:13:53Z

Verification before merge:

Behavior addressed: models auth login now keeps login-created auth profiles in the auth store instead of rewriting normal config auth profile patches, while preserving configured provider/profile order constraints and legacy credential compatibility.

Real environment tested: local macOS source checkout plus GitHub CI.

Exact steps or command run after this patch:

OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/commands/doctor/shared/stale-oauth-profile-shadows.test.ts src/commands/models/auth.test.ts src/agents/auth-profiles/persisted-boundary.test.ts src/agents/auth-profiles/profiles.test.ts src/agents/auth-profiles/order.test.ts src/agents/auth-profiles/store.runtime-external.test.ts src/agents/auth-profiles.resolve-auth-profile-order.does-not-prioritize-lastgood-round-robin-ordering.test.ts src/infra/device-auth-store.test.ts
OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/agents/auth-profiles/persisted-boundary.test.ts
OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/agents/auth-profiles/profiles.test.ts src/agents/auth-profiles/persisted-boundary.test.ts
pnpm tsgo:prod
pnpm check:test-types
pnpm format:docs:check
git diff --check origin/main...HEAD && git diff --check
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main

Evidence after fix: focused auth/profile tests, production/test type gates, docs format check, diff whitespace checks, and autoreview all passed locally. GitHub CI run 26714511861 is clean for f89c66e; two unrelated gateway shards initially hit no-output timeouts, then passed on failed-job rerun.

Observed result after fix: no accepted/actionable autoreview findings; required PR checks clean.

What was not tested: live provider login against real external OpenAI/Gemini/Codex accounts was not run in this landing pass.

steipete requested a review from a team as a code owner May 31, 2026 12:18

openclaw-barnacle Bot added commands Command implementations agents Agent runtime and tooling size: M maintainer Maintainer-authored PR labels May 31, 2026

chatgpt-codex-connector Bot reviewed May 31, 2026

View reviewed changes

steipete force-pushed the fix/models-auth-login-auth-store-only branch from 870be5b to 66e7589 Compare May 31, 2026 12:25

clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels May 31, 2026

openclaw-barnacle Bot added the channel: discord Channel integration: discord label May 31, 2026

chatgpt-codex-connector Bot reviewed May 31, 2026

View reviewed changes

openclaw-barnacle Bot added docs Improvements or additions to documentation size: L and removed size: M labels May 31, 2026

steipete added 10 commits May 31, 2026 14:33

fix(models): keep auth login out of main config

89c1c1a

fix(auth): promote store-only login profiles

8e0253e

fix(auth): narrow login profile order creation

d6f0d86

fix(auth): handle stale configured auth order

b5e5838

fix(auth): preserve configured auth order on relogin

5f785ec

fix(models): preserve config-only auth fallbacks

92ffd1c

fix(models): keep auth order fallbacks durable

db27dea

fix(auth): prune explicitly removed order profiles

069f74a

fix(auth): preserve only configured order fallbacks

519205a

fix(auth): keep config order constraints

bc1e7a7

steipete added 7 commits May 31, 2026 14:33

fix(auth): order repaired profiles normally

d4ab899

fix(device): keep device token parsing permissive

7c7c2e6

fix(auth): keep key refs authoritative

041e92d

fix(models): keep login profiles out of config patches

797ba6c

fix(auth): preserve scoped config order fallbacks

86341c8

fix(auth): retain legacy keys with malformed refs

c68d751

fix(auth): keep configured relogin order scoped

f89c66e

steipete force-pushed the fix/models-auth-login-auth-store-only branch from ca19a3f to f89c66e Compare May 31, 2026 13:53

openclaw-barnacle Bot removed the channel: discord Channel integration: discord label May 31, 2026

clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels May 31, 2026

steipete merged commit 1bfae9d into main May 31, 2026
256 of 261 checks passed

steipete deleted the fix/models-auth-login-auth-store-only branch May 31, 2026 14:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(models): keep auth login out of main config#88612

fix(models): keep auth login out of main config#88612
steipete merged 17 commits into
mainfrom
fix/models-auth-login-auth-store-only

steipete commented May 31, 2026

Uh oh!

clawsweeper Bot commented May 31, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 31, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 31, 2026

Uh oh!

steipete commented May 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		...(params.createFromOrder ?? []),
		...listProfilesForProvider(store, providerKey),

Uh oh!

Uh oh!

Conversation

steipete commented May 31, 2026

Uh oh!

clawsweeper Bot commented May 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 31, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 31, 2026

Choose a reason for hiding this comment

Uh oh!

steipete commented May 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented May 31, 2026 •

edited

Loading