Best possible solution:

Port the narrow external-CLI status/probe discovery fix onto current main with focused regression coverage and no changelog or unrelated test churn.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible but not live-run here: current main's plain models status path loads the no-external-profile store while external CLI discovery requires a provider/profile scope to surface missing runtime-only credentials.

Is this the best way to solve the issue?

Unclear as submitted: the status-store change is the right narrow direction, but the branch needs to be refreshed onto current main and trimmed before it is the best mergeable fix.

Full review comments:

• [P3] Remove the release-owned changelog edit — CHANGELOG.md:16
CHANGELOG.md is release-owned for normal PRs in this repo. Please move this release-note context to the PR body or eventual squash message instead of landing a source changelog edit here.
  Confidence: 0.9

Overall correctness: patch is correct
Overall confidence: 0.78

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against e1a98171417c.

Label changes:

• add P2: This is a normal-priority CLI auth-status/probe regression with limited blast radius but real operator-facing false-missing-auth impact.
• add merge-risk: 🚨 auth-provider: The patch changes how CLI status/probe discovers external auth profiles, which can affect provider auth reporting and probe target selection.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a bot-authored ClawSweeper PR, so the external-contributor real-behavior proof gate does not apply; the body reports targeted tests and a temporary CLI auth resolver smoke, not a live provider probe.
• remove rating: 🌊 off-meta tidepool: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.

Label justifications:

• P2: This is a normal-priority CLI auth-status/probe regression with limited blast radius but real operator-facing false-missing-auth impact.
• merge-risk: 🚨 auth-provider: The patch changes how CLI status/probe discovers external auth profiles, which can affect provider auth reporting and probe target selection.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a bot-authored ClawSweeper PR, so the external-contributor real-behavior proof gate does not apply; the body reports targeted tests and a temporary CLI auth resolver smoke, not a live provider probe.

PR surface:

Source +6, Tests +112, Docs +1. Total +119 across 6 files.

Acceptance criteria:

• [P1] node scripts/run-vitest.mjs src/commands/models/list.probe.targets.test.ts src/commands/models/list.status.test.ts.
• [P1] git diff --check.
• [P1] node scripts/crabbox-wrapper.mjs run --shell -- "pnpm check:changed" if maintainers require the broad changed gate.

What I checked:

• Current main status path still misses external CLI overlay: modelsStatusCommand imports ensureAuthProfileStoreWithoutExternalProfiles as ensureAuthProfileStore and calls it without an external CLI discovery scope, so CLI-only runtime credentials can still be absent from plain status output. (src/commands/models/list.status-command.ts:326, e1a98171417c)
• Current main probe path is already partly fixed: buildProbeTargets already calls ensureAuthProfileStore with externalCliDiscoveryScoped, providerIds, profileIds, and allowKeychainPrompt: false, so the probe half is mostly present on current main. (src/commands/models/list.probe.ts:297, e1a98171417c)
• External CLI discovery is scope-sensitive: When no provider/profile scope is supplied, external CLI discovery only considers matching existing OAuth profiles; scoped provider/profile IDs are what let missing runtime-only CLI profiles be discovered. (src/agents/auth-profiles/external-cli-sync.ts:264, e1a98171417c)
• Proposed status fix direction: The PR branch changes modelsStatusCommand to load ensureAuthProfileStore with externalCliDiscoveryForConfigStatus({ cfg: resolvedConfig }), which matches the missing current-main status behavior. (src/commands/models/list.status-command.ts:241, 10312a90647e)
• Branch needs cleanup before merge: The PR diff includes a normal-PR CHANGELOG.md edit and an unrelated cron test type-only change, both outside the narrow CLI auth status/probe repair. (CHANGELOG.md:16, 10312a90647e)
• Branch is not directly mergeable: Provided GitHub context reports mergeable=false / mergeableState=dirty; local git diff main...10312a90647ecc0a1db39f5d9700c680f67bc8fc also failed with no merge base, so review should be against a refreshed branch.

Likely related people:

• Peter Steinberger: Commit 581fbea1d65355917886babffe4161f8b3178a12 introduced scoped external CLI credential discovery, and current-main blame/log evidence for the status/probe area also points through recent release/current-main work by Peter. (role: introduced related behavior and recent area contributor; confidence: high; commits: 581fbea1d653, 40181afdedb0, 22e4289d3f05; files: src/agents/auth-profiles/external-cli-scope.ts, src/agents/auth-profiles/external-cli-sync.ts, src/agents/model-auth.ts)
• Josh Avant: git log -G on the probe/status/auth scope paths shows adjacent credential-semantics work in commit 1c200ca7ae3cd4a3e2861b1a32fc16b917630f09. (role: adjacent credential-semantics contributor; confidence: medium; commits: 1c200ca7ae3c; files: src/commands/models/list.probe.ts, src/commands/models/list.status-command.ts, src/agents/auth-profiles/external-cli-scope.ts)
• Jeremiah Lowin: git log -G 'ensureAuthProfileStore\(agentDir' shows dd4715a2c409cb70a47b0658a0ebe735ffb2ee99 adding the --agent flag to models status, an adjacent CLI status path. (role: adjacent CLI status contributor; confidence: medium; commits: dd4715a2c409; files: src/commands/models/list.status-command.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.