fix(nvidia): load featured model catalog by eleqtrizit · Pull Request #80775 · openclaw/openclaw

eleqtrizit · 2026-05-11T21:09:19Z

Summary

Loads NVIDIA's public featured-model catalog in the NVIDIA provider runtime and falls back to the bundled manifest catalog when the feed is unavailable.
Keeps NVIDIA setup and model-picker surfaces current without changing existing auth or config defaults.

Changes

Added a guarded HTTPS fetch for the featured catalog with hostname policy, a 10s timeout for the guarded pinned-dispatcher path, successful-result caching, row bounds, schema validation, and duplicate merging.
Registered the live NVIDIA catalog with the existing static provider catalog as the offline fallback.
Updated NVIDIA provider tests and docs, including the canonical normalized model-id expectation in onboarding coverage.

Real behavior proof

Behavior or issue addressed: NVIDIA setup/model-picker catalog loading can consume NVIDIA's public featured-model feed and merge live ranked rows with the bundled fallback catalog.

Real environment tested: Local OpenClaw checkout at branch 79431, commit 90b56ad407, Node v22.22.2, Linux container, no NVIDIA API key required because the featured catalog endpoint is public.

Exact steps or command run after this patch: Ran the provider runtime against the live NVIDIA featured catalog endpoint:

corepack pnpm exec tsx -e 'import { buildLiveNvidiaProvider } from "./extensions/nvidia/provider-catalog.ts"; void (async () => { const started = Date.now(); const provider = await buildLiveNvidiaProvider(); console.log(JSON.stringify({ elapsedMs: Date.now() - started, modelCount: provider.models.length, firstModels: provider.models.slice(0, 4).map((model) => ({ id: model.id, name: model.name, contextWindow: model.contextWindow, maxTokens: model.maxTokens })) }, null, 2)); })();'

Evidence after fix: Terminal output from the exact-head local runtime command:

{
  "elapsedMs": 5281,
  "modelCount": 6,
  "firstModels": [
    {
      "id": "nvidia/nemotron-3-super-120b-a12b",
      "name": "Nemotron 3 Super 120B",
      "contextWindow": 262144,
      "maxTokens": 8192
    },
    {
      "id": "z-ai/glm-5.1",
      "name": "GLM 5.1",
      "contextWindow": 202752,
      "maxTokens": 8192
    },
    {
      "id": "minimaxai/minimax-m2.7",
      "name": "Minimax M2.7",
      "contextWindow": 196608,
      "maxTokens": 8192
    },
    {
      "id": "moonshotai/kimi-k2.5",
      "name": "Kimi K2.5",
      "contextWindow": 262144,
      "maxTokens": 8192
    }
  ]
}

Observed result after fix: The provider runtime fetched NVIDIA's current public featured feed, promoted live rows such as z-ai/glm-5.1 and minimaxai/minimax-m2.7, and merged them ahead of bundled fallback rows.

What was not tested: Full interactive onboarding with a real NVIDIA API key was not tested; the changed provider catalog runtime path does not require the key.

Validation

corepack pnpm test -- extensions/nvidia/provider-catalog.test.ts extensions/nvidia/index.test.ts extensions/nvidia/onboard.test.ts
corepack pnpm check:changed -- --base upstream/main docs/providers/nvidia.md extensions/nvidia/index.test.ts extensions/nvidia/index.ts extensions/nvidia/onboard.test.ts extensions/nvidia/provider-catalog.test.ts extensions/nvidia/provider-catalog.ts
corepack pnpm exec tsx -e 'import { buildLiveNvidiaProvider } from "./extensions/nvidia/provider-catalog.ts"; void (async () => { const started = Date.now(); const provider = await buildLiveNvidiaProvider(); console.log(JSON.stringify({ elapsedMs: Date.now() - started, modelCount: provider.models.length, firstModels: provider.models.slice(0, 4).map((model) => ({ id: model.id, name: model.name, contextWindow: model.contextWindow, maxTokens: model.maxTokens })) }, null, 2)); })();'

Notes

Related: [Feature]: NVIDIA Featured Models API integration #79431
Incorporates the safe provider-owned live catalog approach from feat(nvidia): fetch featured model catalog #79482; @CaptainTimon is credited as co-author on the first commit.
No CHANGELOG.md update per maintainer instruction.
Project board update is blocked in this environment because the GitHub token lacks read:project scope.

clawsweeper · 2026-05-11T21:12:56Z

Codex review: needs real behavior proof before merge. Reviewed May 28, 2026, 3:27 PM ET / 19:27 UTC.

Summary
The PR adds live NVIDIA featured-catalog loading with guarded HTTPS fetch/caching, static fallback rows, provider-scoped model-picker loading, auth-aware catalog context, docs, and tests.

PR surface: Source +717, Tests +1101, Docs +18. Total +1836 across 18 files.

Reproducibility: not applicable. This PR implements a feature request rather than a reproducible bug. Source inspection confirms current main still exposes NVIDIA through a static bundled catalog only.

Review metrics: 2 noteworthy metrics.

Plugin/auth API surface: 1 ProviderAugmentModelCatalogContext field added; 1 provider-scoped picker loader added. This is maintainer-relevant because plugin API and auth-provider catalog context changes can affect external provider behavior.
New network catalog dependency: 1 fixed NVIDIA HTTPS endpoint added. The new runtime catalog fetch should be reviewed for timeout, SSRF policy, fallback, and operator expectations before merge.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted current-head terminal or live-output proof for b7563a8 showing the live NVIDIA catalog path after the latest changes.
Get maintainer sign-off on the plugin API/auth-provider catalog context and provider-scoped picker behavior.

Proof guidance:

[P1] Needs stronger real behavior proof before merge: The PR body includes terminal output, but it was recorded for commit 90b56ad rather than current head b7563a8; add redacted current-head terminal output, logs, live output, or a linked artifact, then update the PR body so ClawSweeper re-reviews automatically or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

[P1] The PR expands plugin-facing catalog/auth context and provider-scoped model-picker behavior, so maintainers should confirm the compatibility contract before merge.
[P1] The supplied terminal proof is for commit 90b56ad, not the current head b7563a8, so after-fix real behavior proof needs refreshing.
[P1] GitHub context reports the PR as mergeable but unstable, so exact-head checks still need to be green before landing.

Maintainer options:

Hold for contract review and fresh proof (recommended)
Require maintainer sign-off on the provider catalog/auth context change and current-head redacted terminal or live-output proof before merge.
Accept provider-owned live catalog risk
Maintainers can intentionally accept the new provider-owned live catalog path if they are comfortable with the plugin API and upgrade behavior as implemented.
Pause for a narrower provider-only path
If the shared model-picker/auth context expansion is too broad, pause this PR and replace it with a smaller NVIDIA-provider-only change.

Next step before merge

[P1] Manual review is required because the PR has a protected maintainer label, plugin API/auth-provider compatibility risk, and stale current-head proof rather than a narrow automation repair.

Security
Cleared: No concrete security or supply-chain defect found; the new outbound call is fixed-host HTTPS through fetchWithSsrFGuard with timeout, schema bounds, and no credential transmission.

Review details

Best possible solution:

Land only after maintainer sign-off on the plugin API/auth-provider catalog behavior, current-head redacted live-output proof, and green exact-head checks.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR implements a feature request rather than a reproducible bug. Source inspection confirms current main still exposes NVIDIA through a static bundled catalog only.

Is this the best way to solve the issue?

Unclear: the provider-owned live catalog plus static fallback is a plausible shape, but the plugin API/auth-context expansion needs maintainer approval and current-head proof before it is the best merge path.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 76130fd98873.

Label changes

Label changes:

add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
remove rating: 🦐 gold shrimp: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

P2: This is a normal-priority provider catalog improvement with bounded blast radius but real setup/model-picker impact.
merge-risk: 🚨 compatibility: The PR changes plugin-facing catalog context and provider-scoped model-picker behavior that existing provider/plugin flows may depend on.
merge-risk: 🚨 auth-provider: The live NVIDIA catalog path now depends on provider API-key/profile resolution during catalog and model-picker flows.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body includes terminal output, but it was recorded for commit 90b56ad rather than current head b7563a8; add redacted current-head terminal output, logs, live output, or a linked artifact, then update the PR body so ClawSweeper re-reviews automatically or ask a maintainer to comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +717, Tests +1101, Docs +18. Total +1836 across 18 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	10	759	42	+717
Tests	7	1124	23	+1101
Docs	1	28	10	+18
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	18	1911	75	+1836

What I checked:

Repository policy applied: Read the full root AGENTS.md plus scoped guides for extensions, docs, src/agents, and src/plugins; plugin API, auth/provider routing, setup, and fallback behavior are compatibility-sensitive review surfaces. (AGENTS.md:16, 76130fd98873)
Current main does not implement the live catalog: Current main registers NVIDIA with only buildNvidiaProvider and has no featured-model URL or live-catalog builder in the NVIDIA provider catalog. (extensions/nvidia/index.ts:40, 76130fd98873)
PR head implements provider-owned live NVIDIA loading: The branch adds NVIDIA_FEATURED_MODELS_URL, guarded fetch parsing/caching, buildLiveNvidiaProvider, and buildSelectableLiveNvidiaProvider; index.ts switches runtime catalog loading to the selectable live builder and keeps buildStaticProvider as fallback. (extensions/nvidia/provider-catalog.ts:75, b7563a89643f)
Plugin/auth surface changes need maintainer review: The PR adds resolveProviderApiKey to ProviderAugmentModelCatalogContext and threads provider auth into catalog augmentation/model-picker loading, expanding a plugin-facing auth/catalog context. (src/plugins/types.ts:1095, b7563a89643f)
Docs describe the new user-visible catalog behavior: The PR docs say NVIDIA setup/model-selection will try the public featured catalog, cache it for 24 hours, and fall back to bundled rows when unavailable or malformed. Public docs: docs/providers/nvidia.md. (docs/providers/nvidia.md:65, b7563a89643f)
Real behavior proof is stale for current head: The PR body's terminal proof names commit 90b56ad, but the provided live PR context shows current head b7563a8 after later force-pushes. (b7563a89643f)

Likely related people:

Lior Balmas: In this shallow checkout, git blame/log tie the current NVIDIA provider and shared model-picker/plugin files to commit 492105d; routing confidence is low because the available history is collapsed into a broad import-like commit. (role: current-main source provenance; confidence: low; commits: 492105db5a36; files: extensions/nvidia/index.ts, extensions/nvidia/provider-catalog.ts, src/flows/model-picker.ts)
eleqtrizit: Authored the PR commits that add the NVIDIA live catalog and model-picker/auth changes, including the current head commit; useful for follow-up on this branch, not treated as current-main ownership. (role: current PR implementer; confidence: medium; commits: 34b38b8a1b01, b7563a89643f; files: extensions/nvidia/provider-catalog.ts, extensions/nvidia/index.ts, src/flows/model-picker.ts)
CaptainTimon: The first PR commit credits CaptainTimon as co-author and the PR body says this incorporates the safe provider-owned live catalog approach from feat(nvidia): fetch featured model catalog #79482. (role: related implementation contributor; confidence: low; commits: 34b38b8a1b01; files: extensions/nvidia/provider-catalog.ts, extensions/nvidia/index.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

TurboTheTurtle

I didn't find a blocking issue in this pass. I checked the live NVIDIA catalog fetch path, SSRF host policy, response parsing bounds, merge order with the bundled fallback catalog, static fallback registration, and the focused provider/onboarding tests. Remaining risk is normal CI plus maintainer judgment on making model-picker/setup freshness depend on a bounded provider-owned network fetch.

chatgpt-codex-connector · 2026-05-15T19:31:23Z

To use Codex here, create a Codex account and connect to github.

clawsweeper · 2026-05-27T01:02:32Z

ClawSweeper PR egg

🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.

Where did the egg go?

The egg game starts only after the PR passes the real-behavior proof check.
Before that, no creature or rarity is rolled. The treat waits for real proof.
This is still just collectible flavor: proof affects review readiness, not creature quality.

Co-authored-by: CaptainTimon <CaptainTimon@users.noreply.github.com>

Replace minimaxai/minimax-m2.5 (MiniMax M2.5) with minimaxai/minimax-m2.7 (Minimax M2.7) and z-ai/glm5 (GLM-5) with z-ai/glm-5.1 (GLM 5.1) in the bundled fallback catalog to match NVIDIA's public featured-models endpoint. Update docs table and all extension test expectations.

openclaw-barnacle Bot added docs Improvements or additions to documentation extensions: nvidia size: M maintainer Maintainer-authored PR labels May 11, 2026

eleqtrizit mentioned this pull request May 11, 2026

[Feature]: NVIDIA Featured Models API integration #79431

Open

TurboTheTurtle reviewed May 11, 2026

View reviewed changes

eleqtrizit added the proof: supplied External PR includes structured after-fix real behavior proof. label May 11, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 11, 2026

clawsweeper Bot mentioned this pull request May 12, 2026

feat(nvidia): fetch featured model catalog #79482

Closed

25 tasks

eleqtrizit force-pushed the 79431 branch from 90b56ad to 3a03444 Compare May 12, 2026 15:00

openclaw-barnacle Bot added size: L and removed size: M labels May 12, 2026

clawsweeper Bot mentioned this pull request May 13, 2026

Add nvidia api support #68103

Closed

eleqtrizit requested a review from a team as a code owner May 14, 2026 02:29

eleqtrizit force-pushed the 79431 branch from 423c5cc to 28e3485 Compare May 14, 2026 04:45

github-actions Bot removed the dependencies-changed PR changes dependency-related files label May 14, 2026

clawsweeper Bot mentioned this pull request May 14, 2026

Update NVIDIA hosted model catalog #78137

Closed

25 tasks

eleqtrizit and others added 9 commits May 28, 2026 18:03

fix(nvidia): load featured model catalog

34b38b8

Co-authored-by: CaptainTimon <CaptainTimon@users.noreply.github.com>

fix(nvidia): widen catalog fetch timeout

ca79f61

fix(nvidia): cover catalog registration

d2ba5be

fix(picker): include provider catalog loader

fcbf252

fix(nvidia): guard featured catalog fetch

b8b968d

fix(nvidia): retain shipped catalog refs

9407556

fix(picker): keep alias catalog rows

32bd0a0

fix(nvidia): restore live catalog priority

b7563a8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(nvidia): load featured model catalog#80775

fix(nvidia): load featured model catalog#80775
eleqtrizit merged 9 commits into
openclaw:mainfrom
eleqtrizit:79431

eleqtrizit commented May 11, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 11, 2026 •

edited

Loading

Uh oh!

TurboTheTurtle left a comment

Uh oh!

chatgpt-codex-connector Bot commented May 15, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

eleqtrizit commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Real behavior proof

Validation

Notes

Uh oh!

clawsweeper Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TurboTheTurtle left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented May 15, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

eleqtrizit commented May 11, 2026 •

edited

Loading

clawsweeper Bot commented May 11, 2026 •

edited

Loading