@@ -590,16 +590,11 @@ export function loadAuthProfileStoreForSecretsRuntime(agentDir?: string): AuthPr
590590 return loadAuthProfileStoreForRuntime ( agentDir , {
591591 readOnly : true ,
592592 allowKeychainPrompt : false ,
593- // L4 PATCH (lane-pump branch): include legacy OAuth sidecar material when
594- // the runtime is resolving secrets for an agent turn. Without this, embedded
595- // agent runs (Telegram replies, cron invocations) cannot reach the access
596- // token for openai-codex profiles whose `oauthRef.source` is
593+ // Include legacy OAuth sidecar material when the runtime is resolving
594+ // secrets for an agent turn. Without this, embedded agent runs cannot reach
595+ // the access token for openai-codex profiles whose `oauthRef.source` is
597596 // "openclaw-credentials", and resolveApiKeyForProfile() falls through to
598- // "No API key found". The OAuth-manager-internal refresh helper added in
599- // upstream #83312 already sets this to true; this default was inadvertently
600- // left at `false` after the sidecar runtime removal in #82777, breaking
601- // the embedded-agent OAuth resolution path while leaving the direct CLI
602- // inference path unaffected. See UPSTREAM_ISSUE_DRAFT.md in local-patches.
597+ // "No API key found".
603598 resolveLegacyOAuthSidecars : true ,
604599 } ) ;
605600}
@@ -614,12 +609,9 @@ export function loadAuthProfileStoreWithoutExternalProfiles(
614609 const options : LoadAuthProfileStoreOptions = {
615610 readOnly : true ,
616611 allowKeychainPrompt : loadOptions ?. allowKeychainPrompt ?? false ,
617- // L4.1 PATCH: default sidecar resolution to true so that any caller
618- // not explicitly overriding (model-auth-label, model-provider-auth,
619- // pi-auth-discovery, list.list-command, etc.) still picks up legacy
620- // OAuth credential material. Was inadvertently left at `false` in the
621- // upstream #82777/#83312 refactor and breaks isolated/sub-agent auth
622- // resolution paths (e.g., cron-nested lanes).
612+ // Default sidecar resolution to true so callers that do not explicitly
613+ // override still pick up legacy OAuth credential material for isolated and
614+ // sub-agent auth resolution paths.
623615 resolveLegacyOAuthSidecars : loadOptions ?. resolveLegacyOAuthSidecars ?? true ,
624616 } ;
625617 const store = loadAuthProfileStoreForAgent ( agentDir , options ) ;
@@ -657,10 +649,10 @@ export function ensureAuthProfileStoreWithoutExternalProfiles(
657649 agentDir ?: string ,
658650 options ?: { allowKeychainPrompt ?: boolean ; resolveLegacyOAuthSidecars ?: boolean } ,
659651) : AuthProfileStore {
660- // L4.1 PATCH: forward `resolveLegacyOAuthSidecars` through this entry
661- // point so embedded- runner sub-agents (cron-nested, isolated session
662- // lanes for AgentOS sweeps) can read the legacy sidecar credential
663- // material. Default true to match `loadAuthProfileStoreWithoutExternalProfiles`.
652+ // Forward `resolveLegacyOAuthSidecars` through this entry point so embedded
653+ // runner sub-agents and isolated session lanes can read legacy sidecar
654+ // credential material. Default true to match
655+ // `loadAuthProfileStoreWithoutExternalProfiles`.
664656 const resolveLegacyOAuthSidecars = options ?. resolveLegacyOAuthSidecars ?? true ;
665657 const effectiveOptions : LoadAuthProfileStoreOptions = {
666658 ...( options ?? { } ) ,
@@ -677,9 +669,8 @@ export function ensureAuthProfileStoreWithoutExternalProfiles(
677669 return store ;
678670 }
679671
680- // L4.1 PATCH: use effectiveOptions (with sidecar resolution) for the main
681- // fallback load too, otherwise sub-agents that need to merge in the main
682- // store would still miss the legacy credential material.
672+ // Use the same options for the main fallback load; sub-agents that merge in
673+ // the main store need the same legacy sidecar material.
683674 const mainStore = loadAuthProfileStoreForAgent ( undefined , effectiveOptions ) ;
684675 return mergeAuthProfileStores ( mainStore , store ) ;
685676}
0 commit comments