fix: scope synthetic auth registry lookup

RomneyDa · RomneyDa · commit 8d65a37e9802 · 2026-05-22T14:31:57.000-07:00
diff --git a/src/agents/model-auth.ts b/src/agents/model-auth.ts
@@ -113,7 +113,7 @@ export function createRuntimeProviderAuthLookup(params: {
     workspaceDir: params.workspaceDir,
     env,
   };
-  const syntheticAuthProviderRefs = resolveRuntimeSyntheticAuthProviderRefState();
+  const syntheticAuthProviderRefs = resolveRuntimeSyntheticAuthProviderRefState(lookupParams);
   return {
     envApiKey: {
       aliasMap: resolveProviderAuthAliasMap(lookupParams),
diff --git a/src/plugins/synthetic-auth.runtime.test.ts b/src/plugins/synthetic-auth.runtime.test.ts
@@ -85,6 +85,34 @@ describe("synthetic auth runtime refs", () => {
     expect(pluginRegistryMocks.loadPluginRegistrySnapshotWithMetadata).toHaveBeenCalledWith({});
   });
 
+  it("loads manifest synthetic auth refs with the current runtime scope", () => {
+    const config = { plugins: { allow: ["external-local"] } };
+    const env = { OPENCLAW_HOME: "/tmp/openclaw-home" };
+    pluginRegistryMocks.loadPluginRegistrySnapshotWithMetadata.mockReturnValue({
+      source: "persisted",
+      snapshot: {
+        plugins: [{ syntheticAuthRefs: ["external-local"] }],
+      },
+      diagnostics: [],
+    });
+
+    expect(
+      resolveRuntimeSyntheticAuthProviderRefState({
+        config: config as never,
+        workspaceDir: "/tmp/workspace",
+        env,
+      }),
+    ).toEqual({
+      refs: ["external-local"],
+      complete: true,
+    });
+    expect(pluginRegistryMocks.loadPluginRegistrySnapshotWithMetadata).toHaveBeenCalledWith({
+      config,
+      workspaceDir: "/tmp/workspace",
+      env,
+    });
+  });
+
   it("uses persisted registry external auth provider refs before the runtime registry exists", () => {
     const snapshot = {
       plugins: [{ syntheticAuthRefs: [] }],
diff --git a/src/plugins/synthetic-auth.runtime.ts b/src/plugins/synthetic-auth.runtime.ts
@@ -1,7 +1,7 @@
 import { normalizeProviderId } from "../agents/provider-id.js";
 import { loadPluginManifestRegistryForInstalledIndex } from "./manifest-registry-installed.js";
 import { loadPluginRegistrySnapshotWithMetadata } from "./plugin-registry.js";
-import type { PluginRegistrySnapshot } from "./plugin-registry.js";
+import type { LoadPluginRegistryParams, PluginRegistrySnapshot } from "./plugin-registry.js";
 import { getPluginRegistryState } from "./runtime-state.js";
 
 function uniqueProviderRefs(values: readonly string[]): string[] {
@@ -20,15 +20,12 @@ function uniqueProviderRefs(values: readonly string[]): string[] {
 }
 
 function resolveManifestSyntheticAuthProviderRefState(
-  params: {
-    index?: PluginRegistrySnapshot;
-    registryDiagnostics?: readonly unknown[];
-  } = {},
+  params: SyntheticAuthProviderRefParams = {},
 ): { refs: string[]; complete: boolean } {
   if (params.index && (params.registryDiagnostics?.length ?? 0) > 0) {
     return { refs: [], complete: false };
   }
-  const result = loadPluginRegistrySnapshotWithMetadata({ index: params.index });
+  const result = loadPluginRegistrySnapshotWithMetadata(params);
   if (result.source !== "persisted" && result.source !== "provided") {
     return { refs: [], complete: false };
   }
@@ -40,16 +37,18 @@ function resolveManifestSyntheticAuthProviderRefState(
   };
 }
 
+type SyntheticAuthProviderRefParams = LoadPluginRegistryParams & {
+  index?: PluginRegistrySnapshot;
+  registryDiagnostics?: readonly unknown[];
+};
+
 function resolveManifestExternalAuthProviderRefs(
-  params: {
-    index?: PluginRegistrySnapshot;
-    registryDiagnostics?: readonly unknown[];
-  } = {},
+  params: SyntheticAuthProviderRefParams = {},
 ): string[] {
   if (params.index && (params.registryDiagnostics?.length ?? 0) > 0) {
     return [];
   }
-  const result = loadPluginRegistrySnapshotWithMetadata({ index: params.index });
+  const result = loadPluginRegistrySnapshotWithMetadata(params);
   if (result.source !== "persisted" && result.source !== "provided") {
     return [];
   }
@@ -62,19 +61,13 @@ function resolveManifestExternalAuthProviderRefs(
 }
 
 export function resolveRuntimeSyntheticAuthProviderRefs(
-  params: {
-    index?: PluginRegistrySnapshot;
-    registryDiagnostics?: readonly unknown[];
-  } = {},
+  params: SyntheticAuthProviderRefParams = {},
 ): string[] {
   return resolveRuntimeSyntheticAuthProviderRefState(params).refs;
 }
 
 export function resolveRuntimeSyntheticAuthProviderRefState(
-  params: {
-    index?: PluginRegistrySnapshot;
-    registryDiagnostics?: readonly unknown[];
-  } = {},
+  params: SyntheticAuthProviderRefParams = {},
 ): { refs: string[]; complete: boolean } {
   const registry = getPluginRegistryState()?.activeRegistry;
   if (registry) {
@@ -99,17 +92,11 @@ export function resolveRuntimeSyntheticAuthProviderRefState(
       complete: true,
     };
   }
-  return resolveManifestSyntheticAuthProviderRefState({
-    index: params.index,
-    registryDiagnostics: params.registryDiagnostics,
-  });
+  return resolveManifestSyntheticAuthProviderRefState(params);
 }
 
 export function resolveRuntimeExternalAuthProviderRefs(
-  params: {
-    index?: PluginRegistrySnapshot;
-    registryDiagnostics?: readonly unknown[];
-  } = {},
+  params: SyntheticAuthProviderRefParams = {},
 ): string[] {
   const registry = getPluginRegistryState()?.activeRegistry;
   if (registry) {
@@ -135,8 +122,5 @@ export function resolveRuntimeExternalAuthProviderRefs(
         .map((entry) => entry.backend.id),
     ]);
   }
-  return resolveManifestExternalAuthProviderRefs({
-    index: params.index,
-    registryDiagnostics: params.registryDiagnostics,
-  });
+  return resolveManifestExternalAuthProviderRefs(params);
 }
