Skip to content

feat(providers): add ClawRouter routing and quotas#99658

Merged
steipete merged 5 commits into
mainfrom
feat/clawrouter
Jul 4, 2026
Merged

feat(providers): add ClawRouter routing and quotas#99658
steipete merged 5 commits into
mainfrom
feat/clawrouter

Conversation

@steipete

@steipete steipete commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Fixes #99657.

What Problem This Solves

OpenClaw could not consume ClawRouter's credential-scoped model catalog or show its managed quota. Manual provider duplication also lost ClawRouter's per-key access boundary.

This is a smaller, provider-owned alternative to #94012. The package is @openclaw/clawrouter, without the -provider suffix.

Why

ClawRouter owns upstream credentials and publishes the authorized model/transport catalog. OpenClaw should reuse its existing transport implementations where the wire contracts match, while refusing catalog rows whose native protocol OpenClaw cannot safely produce.

User Impact

  • One CLAWROUTER_API_KEY discovers only models granted to that key.
  • Model refs use clawrouter/<provider>/<model>.
  • OpenAI-compatible Responses/chat, native Anthropic Messages, and native Gemini streaming use their matching OpenClaw transports.
  • Provider-family replay and tool-schema policies still apply.
  • Unsupported wire formats are omitted fail-closed.
  • Status/dashboard usage includes ClawRouter request, token, spend, and monthly budget data.
  • The proxy credential is attached only at request dispatch, not stored in model metadata.

Evidence

  • Live credential-scoped catalog: 21 models across Anthropic, Google, OpenAI, DeepSeek, Mistral, xAI, and other granted providers.
  • Live OpenAI Responses: clawrouter/openai/gpt-4.1-mini returned the exact OPENAI_OK marker.
  • Live Anthropic Messages: clawrouter/anthropic/claude-haiku-4-5 returned the exact ANTHROPIC_OK marker.
  • Live Google Generative AI: clawrouter/google/gemini-3.5-flash returned the exact GOOGLE_OK marker.
  • Live quota: changed from 0 requests / $0.00 to 3 requests / 27,411 tokens / $0.0030, with 0.012% of the managed monthly budget used.
  • Focused tests: 35 passed across ClawRouter catalog, dispatch, usage, and shared usage mapping.
  • Plugin contracts: 43 files, 964 tests passed.
  • TypeScript package-boundary typecheck passed.
  • Bundled extension lint passed with zero warnings/errors.
  • Docs formatting, MDX, glossary, links, and docs map passed.
  • Shrinkwrap, plugin inventory, and plugin version checks passed.
  • Source-blind behavior validation: plugin load and explicit invalid-key HTTP 401 diagnostics passed.
  • Autoreview: zero accepted/actionable findings after implementation and follow-up fixes.
  • Remote Linux check:changed: provider blacksmith-testbox, lease tbx_01kwmzbskxx0ywxdtq8097mpky, succeeded in 6m14s. Actions evidence.

Deployment Status

The current ClawRouter Worker is deployed at https://clawrouter.openclaw.ai; its upstream smoke is green. This PR changes OpenClaw only and requires no ClawRouter redeploy.

Remaining Risk

Native Bedrock InvokeModel, Cohere v2, and Cloudflare universal-envelope rows remain intentionally unadvertised until ClawRouter normalizes them to an OpenClaw-supported transport.

@steipete steipete added the extensions: clawrouter Extension: clawrouter label Jul 3, 2026
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime scripts Repository scripts size: XL maintainer Maintainer-authored PR labels Jul 3, 2026
@clawsweeper

clawsweeper Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Codex review: found issues before merge. Reviewed July 3, 2026, 9:25 PM ET / 01:25 UTC.

Summary
Adds a bundled @openclaw/clawrouter provider plugin with credential-scoped catalog discovery, clawrouter/<provider>/<model> routing, quota/status reporting, docs, tests, labeler, and dependency metadata.

PR surface: Source +746, Tests +540, Docs +219, Config +36, Other +7. Total +1548 across 30 files.

Reproducibility: not applicable. this is a new provider integration PR, not a broken existing behavior report. Current-main search confirms the requested ClawRouter plugin and usage provider entries are absent.

Review metrics: 3 noteworthy metrics.

  • Provider setup surfaces: 1 provider id, 1 env var, 1 CLI/auth choice, 1 default URL added. These are user-facing configuration and operator-contract surfaces that need maintainer approval before merge.
  • Hosted ClawRouter contracts: 2 endpoints consumed: /v1/catalog and /v1/usage. The plugin depends on live hosted catalog and quota payload behavior at the credential boundary.
  • Validation evidence mismatch: 1 linked run inspected; cancelled on main SHA 525c4c7, PR-head CI not green. The PR body should not treat that linked run as successful validation of this head.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #99657
Summary: This PR is the current implementation candidate for the open ClawRouter models and quota integration issue; the older routing draft overlaps but represents a different product direction.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🐚 platinum hermit
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Remove the normal-PR CHANGELOG.md entry.
  • Replace or correct the cancelled main-branch Actions evidence with successful PR-head validation.
  • Have maintainers explicitly resolve or supersede the alternate ClawRouter routing draft.

Risk before merge

  • [P1] Merging adds a new bundled provider id, env var/CLI auth choice, hosted default URL, model-ref namespace, and API-key usage polling surface that needs explicit maintainer contract approval.
  • [P1] The PR body's linked Actions evidence for remote Linux validation is a cancelled main-branch run, and current PR-head CI had a failed shard/pending jobs when inspected.
  • [P1] feat: route canonical provider models through ClawRouter #94012 remains open with a conflicting canonical-provider routing direction, so maintainers should explicitly supersede or re-scope it.

Maintainer options:

  1. Resolve design, validation, and changelog before merge (recommended)
    Have maintainers accept this provider-id model-ref design, supersede or re-scope the alternate draft, remove the changelog entry, and require green PR-head validation.
  2. Accept the new provider contract explicitly
    Maintainers can intentionally own the new env/auth/model-ref/status contract if they are comfortable with the operator and upgrade impact.
  3. Pause for ClawRouter direction
    If the canonical-provider routing design is still preferred, pause or close this branch until the desired ClawRouter integration shape is settled.

Next step before merge

  • [P2] Protected maintainer-labeled provider routing with a new auth/security boundary and alternate open design needs human approval; the only mechanical patch item is dropping CHANGELOG.md.

Security
Cleared: No concrete code or supply-chain security defect was found, but the credential-scoped proxy boundary remains a maintainer merge-risk decision.

Review findings

  • [P3] Remove the normal-PR changelog entry — CHANGELOG.md:19
Review details

Best possible solution:

Land only after removing the normal-PR changelog entry, resolving the alternate ClawRouter design PR, maintainer product/security approval, and successful PR-head validation for the provider/quota path.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a new provider integration PR, not a broken existing behavior report. Current-main search confirms the requested ClawRouter plugin and usage provider entries are absent.

Is this the best way to solve the issue?

Unclear as a final merge state: the provider-owned plugin uses existing SDK seams and matches the ClawRouter source contract, but maintainers still need to accept this model-ref direction over #94012 and refresh PR-head validation.

Full review comments:

  • [P3] Remove the normal-PR changelog entry — CHANGELOG.md:19
    CHANGELOG.md is release-owned in this repo, and the PR body already carries the release-note context needed for generation. Please drop this entry and leave changelog updates to the release workflow.
    Confidence: 0.93

Overall correctness: patch is correct
Overall confidence: 0.82

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b38155918447.

Label changes

Label changes:

  • add proof: sufficient: Contributor real behavior proof is sufficient. The PR body now includes post-fix live catalog, OpenAI/Anthropic/Gemini marker, quota delta, and source-blind invalid-key proof; the separate linked broad validation run still needs correction.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body now includes post-fix live catalog, OpenAI/Anthropic/Gemini marker, quota delta, and source-blind invalid-key proof; the separate linked broad validation run still needs correction.
  • remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

  • P2: This is substantial provider-routing and quota/status feature work with limited current-user blast radius because ClawRouter is absent from current main.
  • merge-risk: 🚨 compatibility: The PR adds provider, setup, env/CLI credential, docs, model-ref, and usage-status surfaces that operators and docs need to absorb safely.
  • merge-risk: 🚨 auth-provider: The diff changes provider routing, model refs, credential resolution, and request-time bearer authentication for ClawRouter-discovered models.
  • merge-risk: 🚨 security-boundary: The PR routes model calls through a hosted proxy credential boundary and relies on fail-closed catalog filtering and dispatch-only credential attachment.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🐚 platinum hermit and patch quality is 🦐 gold shrimp.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body now includes post-fix live catalog, OpenAI/Anthropic/Gemini marker, quota delta, and source-blind invalid-key proof; the separate linked broad validation run still needs correction.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body now includes post-fix live catalog, OpenAI/Anthropic/Gemini marker, quota delta, and source-blind invalid-key proof; the separate linked broad validation run still needs correction.
Evidence reviewed

PR surface:

Source +746, Tests +540, Docs +219, Config +36, Other +7. Total +1548 across 30 files.

View PR surface stats
Area Files Added Removed Net
Source 9 747 1 +746
Tests 4 540 0 +540
Docs 12 222 3 +219
Config 3 36 0 +36
Generated 0 0 0 0
Other 2 7 0 +7
Total 30 1552 4 +1548

What I checked:

  • Repository policy applied: Root and scoped AGENTS.md guidance was read; provider routing, auth/config/setup surfaces, security boundaries, and normal-PR changelog edits affected this review. (AGENTS.md:29, e296d1447eb7)
  • ClawRouter catalog mapping: The PR fetches /v1/catalog, parses provider/model rows, maps OpenAI-compatible, native Anthropic, and native Gemini rows, and omits unsupported rows. (extensions/clawrouter/provider-catalog.ts:303, 8b2632348f52)
  • Request-time credential boundary: The stream wrapper rewrites native upstream model ids and replaces any existing Authorization header with the ClawRouter bearer token only at dispatch. (extensions/clawrouter/stream.ts:25, 8b2632348f52)
  • Usage/status wiring: The PR adds clawrouter to provider usage labels and ids, and the gateway status method polls it as an API-key usage provider. (src/infra/provider-usage.shared.ts:9, 8b2632348f52)
  • Current main lacks ClawRouter: A current-main search found no active ClawRouter provider implementation outside excluded changelog/i18n material, so this PR is not obsolete on main. (e296d1447eb7)
  • External ClawRouter contract checked: The ClawRouter worker exposes /v1/catalog and /v1/usage, authenticates proxy keys, returns policy-scoped catalog rows, and its deployed smoke run for commit ab73a19... succeeded. (19fa94b3e9f0)

Likely related people:

  • steipete: Authored this PR and has merged history in the provider usage split and provider usage snapshots touched by the quota/status surface. (role: candidate implementation author and adjacent provider-usage contributor; confidence: high; commits: 8b2632348f52, 3e0e608110fc, 18b4575e4dcd; files: extensions/clawrouter/*, src/infra/provider-usage.shared.ts, src/infra/provider-usage.types.ts)
  • vincentkoc: Authored the earlier merged ClawRouter provider, the merged revert, and the still-open alternate canonical-provider ClawRouter routing draft. (role: previous ClawRouter feature owner and alternative design author; confidence: high; commits: 8c6139006a48, 04255b247c6b, 4798e125f40c; files: extensions/clawrouter/*, src/agents/provider-stream.ts, src/plugins/types.ts)
  • Omar Shahine: Recent history on models-auth-status owns the gateway status aggregation path this PR extends for API-key usage polling. (role: recent gateway auth-status contributor; confidence: medium; commits: f2fdb9d1253c; files: src/gateway/server-methods/models-auth-status.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 3, 2026
@steipete
steipete marked this pull request as ready for review July 4, 2026 01:18
@steipete
steipete requested a review from a team as a code owner July 4, 2026 01:18
@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label Jul 4, 2026
@github-actions

github-actions Bot commented Jul 4, 2026

Copy link
Copy Markdown
Contributor

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • extensions/clawrouter/npm-shrinkwrap.json
  • extensions/clawrouter/package.json
  • pnpm-lock.yaml

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
  • Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@github-actions

github-actions Bot commented Jul 4, 2026

Copy link
Copy Markdown
Contributor

Dependency graph changes noted

This PR includes dependency graph changes. The dependency guard is informational because the PR author is a repository admin or a member of @openclaw/openclaw-secops.

  • Current SHA: 8b2632348f527ce66751c41f1b0d480512d3242f
  • Trusted actor: @steipete
  • Trusted role: pull request author; openclaw-secops

Security review is still recommended before merge when the dependency graph change is intentional.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jul 4, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8b2632348f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +276 to +280
params: {
[ROUTE_METADATA_KEY]: {
api,
baseUrl,
...(upstreamModel ? { upstreamModel } : {}),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve route metadata for overridden ClawRouter models

When a user adds an explicit model row for a discovered ClawRouter model (for example to tune maxTokens), mergeProviderModels keeps the explicit row and only copies a small set of fields from the implicit row, so the params.clawrouterRoute written here is dropped. For native Anthropic/Gemini catalog rows, normalizeClawRouterResolvedModel then has no route metadata, leaving the provider-level OpenAI /v1 transport and never rewriting to the upstream model id, so those overridden models hit the wrong endpoint or fail. Keep this routing metadata outside user-overridable params or merge it into explicit rows.

Useful? React with 👍 / 👎.

@steipete
steipete merged commit 4a354f7 into main Jul 4, 2026
223 of 230 checks passed
@steipete
steipete deleted the feat/clawrouter branch July 4, 2026 01:29
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 4, 2026
* feat(providers): add ClawRouter routing and quotas

* docs(plugins): refresh Ollama inventory

* test(plugins): register ClawRouter boundary coverage

* docs(i18n): add ClawRouter glossary terms

* docs(providers): expand ClawRouter setup guide
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies-changed PR changes dependency-related files docs Improvements or additions to documentation extensions: clawrouter Extension: clawrouter gateway Gateway runtime maintainer Maintainer-authored PR merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. scripts Repository scripts size: XL status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add bundled ClawRouter models and quota integration

1 participant