fix(config): preserve agent-level apiKey/baseUrl during models.json merge by Sid-Qin · Pull Request #27293 · openclaw/openclaw

Sid-Qin · 2026-02-26T07:20:06Z

Summary

Problem: Agent-level models.json entries (with custom apiKey/baseUrl) are silently overwritten by the main openclaw.json config during ensureOpenClawModelsJson() merge, because the shallow merge { ...existingProviders, ...providers } replaces entire provider objects.
Why it matters: Users who configure per-agent API keys or custom base URLs lose those settings every time the models config is refreshed.
What changed: The merge loop now preserves existing agent-level apiKey and baseUrl when merging new provider data, while still accepting model catalog updates (models, api type, etc.) from the main config.
What did NOT change (scope boundary): Replace mode (non-merge), model catalog refresh, and providers not already in the agent's models.json are unaffected.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes [Bug]: Agent-level models.json apiKey not overriding main config #27243
Related #

User-visible / Behavior Changes

Agent-level apiKey and baseUrl in ~/.openclaw/agents/{agentId}/agent/models.json are now preserved across config refreshes. Previously they were silently replaced by the main config values.

Security Impact (required)

New permissions/capabilities: None
Auth/token changes: Agent-level API keys are no longer silently dropped — this is a security improvement (prevents fallback to unintended keys)
Data exposure risk: None — agent-level keys are already stored in mode 0o600 files

Testing

npx vitest run src/agents/models-config — 43 tests ✓

Rollback Plan

Revert the single commit. No migration or data changes involved.

greptile-apps · 2026-02-26T07:24:01Z

Greptile Summary

Correctly preserves agent-level apiKey and baseUrl during merge-mode config refresh. The fix replaces a shallow spread merge with explicit preservation logic that:

Maintains all existing providers from the agent's models.json
For providers also in main config: updates model catalog and other fields while preserving custom apiKey and baseUrl (if non-empty strings)
For new providers: adds them without modification
Only affects merge mode; replace mode is unchanged

The implementation properly guards against edge cases (empty strings, non-string values, undefined) and maintains backward compatibility.

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The fix is well-scoped, only affects merge mode behavior, includes proper type guards and runtime checks, preserves backward compatibility, and all 43 existing tests pass. The logic correctly implements the stated goal of preserving agent-level apiKey/baseUrl while updating other provider fields from main config.
No files require special attention

_{Last reviewed commit: c61a624}

…erge When ensureOpenClawModelsJson runs in merge mode, the shallow merge { ...existingProviders, ...providers } causes the main config to overwrite agent-level models.json entries entirely. This drops any apiKey or baseUrl that the user set specifically for an agent. Preserve existing agent-level apiKey and baseUrl when merging, while still accepting all other updates (model catalog, api type, etc.) from the newly computed provider config. Closes openclaw#27243

gumadeiras · 2026-02-26T08:46:39Z

Merged via squash.

Prepared head SHA: 6b4b37b
Merge commit: c289b5f

Thanks @Sid-Qin!

Syncs 29 upstream commits including: - Account-scoped bind and routing commands (openclaw#27195) - Single-account config migration to accounts.default (openclaw#27334) - Preserve agent-level apiKey/baseUrl during models.json merge (openclaw#27293) - Plugin-owned interactive channel onboarding flows (openclaw#27191) - Android notifications.list, invoke refactoring - Daemon launchd restart hardening - SSRF dispatcher fix, doctor improvements Conflict resolution: 4 import-order conflicts in onboarding/channel commands resolved by taking upstream (no custom code in those files).

@gumadeiras

…erge (#27293) Merged via /review-pr -> /prepare-pr -> /merge-pr. Prepared head SHA: 6b4b37b Co-authored-by: Sid-Qin <201593046+Sid-Qin@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

@gumadeiras