refactor(agents): carry resolved model runtime through auth by dutifulbob · Pull Request #85373 · openclaw/openclaw

dutifulbob · 2026-05-22T13:35:08Z

Opened on behalf of Onur Solmaz (@osolmaz). Ready for maintainer review.

AI-assisted implementation requested by a maintainer.

Summary

Carry the resolved model runtime through the embedded agent path.

This is a follow-up to #80488. That PR fixed the narrow transport-aware per-model override path; this PR handles the more general runtime/plugin-owned path by keeping the selected provider, final model API/base URL, provider refs that own auth/stream hooks, and runtime plan together after model resolution. Later auth, stream setup, compaction, and runtime planning use those resolved facts instead of deriving them again from provider/model strings.

Refs #80487. Follow-up to #80488.

What Changed

Added a resolved model runtime descriptor with provider/model ref, effective transport, auth provider refs, and source metadata.
Updated sync and async model resolution to return that descriptor alongside the existing resolved model.
Passed resolved runtime auth facts into embedded-run and compaction credential resolution, synthetic provider auth, and synthetic-profile defer hooks.
Let shared model auth derive selected-model auth facts when a caller has only the resolved model and not an explicit descriptor.
Let provider runtime auth hooks use explicit resolved provider refs when available.
Built the agent runtime plan from the resolved descriptor after runtime model updates.
Routed stream hook lookup through the selected model API owner when a custom provider's selected model changes API, and made Ollama selected-model baseUrl override provider baseUrl.

Testing

Latest after rebasing onto current upstream/main:

node scripts/run-vitest.mjs src/plugins/provider-runtime.test.ts extensions/ollama/src/stream.test.ts extensions/ollama/index.test.ts src/agents/model-auth.test.ts src/agents/pi-embedded-runner/model.test.ts src/agents/pi-embedded-runner/run/auth-controller.test.ts src/plugins/provider-runtime.synthetic-auth-discovery.test.ts src/agents/pi-embedded-runner/compact.hooks.test.ts src/agents/pi-embedded-runner/compaction-runtime-context.test.ts - passed, 14 files / 510 tests.
git diff --check - passed.
node --import tsx scripts/check-import-cycles.ts - passed, 0 runtime value cycles.

Earlier validation on the same implementation before the final rebase:

node scripts/run-vitest.mjs src/agents/model-auth.test.ts src/agents/pi-embedded-runner/compact.hooks.test.ts - passed, 4 files / 200 tests after the shared-auth fallback and compaction follow-through fix.
node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo - passed.
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo - passed.
node scripts/run-tsgo.mjs -p tsconfig.extensions.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions.tsbuildinfo - passed.
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions-test.tsbuildinfo - passed.
pnpm exec oxfmt --check extensions/ollama/index.test.ts extensions/ollama/index.ts extensions/ollama/provider-discovery.ts extensions/ollama/src/discovery-shared.ts extensions/ollama/src/stream.test.ts extensions/ollama/src/stream.ts src/agents/model-auth.test.ts src/agents/model-auth.ts src/agents/pi-embedded-runner/compact.hooks.harness.ts src/agents/pi-embedded-runner/compact.ts src/agents/pi-embedded-runner/model.test.ts src/agents/pi-embedded-runner/model.ts src/agents/pi-embedded-runner/resolved-model-runtime.ts src/agents/pi-embedded-runner/run.ts src/agents/pi-embedded-runner/run/auth-controller.test.ts src/agents/pi-embedded-runner/run/auth-controller.ts src/agents/resolved-model-runtime.types.ts src/plugins/provider-external-auth.types.ts src/plugins/provider-runtime.test.ts src/plugins/provider-runtime.ts src/plugins/types.ts - passed.
OPENCLAW_LIVE_TEST=1 OPENCLAW_LIVE_OLLAMA=1 OPENCLAW_LIVE_OLLAMA_MODEL=qwen2.5:3b OPENCLAW_LIVE_OLLAMA_WEB_SEARCH=0 node scripts/run-vitest.mjs --config test/vitest/vitest.live.config.ts extensions/ollama/ollama.live.test.ts -t "runs native chat" - passed, 1 live test / 3 skipped by filter.
Manual local source CLI proof with a custom provider whose provider-level API/baseUrl points at an inert router and whose selected model overrides to native local Ollama - passed.
codex review --base upstream/main - passed after fixing the review finding about callers that resolve model auth without an explicit runtime descriptor.

Real behavior proof

Behavior addressed: custom/router-backed model selections now carry the final resolved transport/auth/stream facts into auth, stream setup, compaction, and runtime planning. A provider default no longer stands in for a per-model runtime choice.

Real environment tested: local source checkout with Node 22, repo dependencies installed, and local Ollama serving qwen2.5:3b at http://127.0.0.1:11434. No external provider secrets were printed or committed.

Exact steps or command run after this patch: created a temporary openclaw.json where models.providers.custom-router had provider-level api: "openai-completions" and baseUrl: "https://router.invalid/v1", while selected model custom-router/qwen2.5:3b had model-level api: "ollama" and baseUrl: "http://127.0.0.1:11434"; then ran:

OPENCLAW_STATE_DIR="$tmp/state" \
OPENCLAW_CONFIG_PATH="$tmp/openclaw.json" \
OPENCLAW_NO_RESPAWN=1 \
OPENCLAW_TEST_FAST=1 \
OPENCLAW_LIVE_TEST=1 \
OPENCLAW_LIVE_OLLAMA=1 \
OLLAMA_API_KEY= \
node scripts/run-node.mjs infer model run \
  --local \
  --model custom-router/qwen2.5:3b \
  --prompt 'Reply with exactly one word: pong' \
  --json

Evidence after fix:

{
  "ok": true,
  "capability": "model.run",
  "transport": "local",
  "provider": "custom-router",
  "model": "qwen2.5:3b",
  "attempts": [],
  "outputs": [
    {
      "text": "pong",
      "mediaUrl": null
    }
  ]
}

Observed result after fix: OpenClaw kept the visible selected provider/model as custom-router/qwen2.5:3b, but used the selected model's native Ollama API/base URL for the actual local run. The inert provider-level router URL was not used, and the command returned ok: true with the local model response.

What was not tested: full remote pnpm check:changed proof is blocked in this environment because Blacksmith Testbox is unavailable (blacksmith CLI missing) and direct AWS Crabbox has no usable AWS credentials/IMDS identity. Live Anthropic, Google, and OpenAI auth-profile smokes were not run in this local pass.

Risks

This is an internal descriptor plumbing change, so the main risk is stale callers continuing to infer runtime facts from only provider/model strings.
Plugin auth hook contexts receive additive optional fields only, but this is still public plugin contract surface and should get owner review before merge.

clawsweeper · 2026-05-22T13:37:35Z

Codex review: needs real behavior proof before merge. Reviewed June 1, 2026, 12:08 PM ET / 16:08 UTC.

Summary
Review failed before ClawSweeper could summarize the requested change.

PR surface: Source +339, Tests +249. Total +588 across 21 files.

Reproducibility: unclear. The review failed before ClawSweeper could establish a reproduction path.

Review metrics: none identified.

Merge readiness
Overall: 🌊 off-meta tidepool
Proof: 🌊 off-meta tidepool
Patch quality: 🌊 off-meta tidepool
Result: rating does not apply to this item.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

[P1] No close action taken because the review did not complete.

Maintainer options:

Decide the mitigation before merge
Retry the Codex review after fixing the execution failure.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] Review did not complete, so no work-lane recommendation was made.

Review details

Best possible solution:

Retry the Codex review after fixing the execution failure.

Do we have a high-confidence way to reproduce the issue?

Unclear. The review failed before ClawSweeper could establish a reproduction path.

Is this the best way to solve the issue?

Unclear. Retry the review first so ClawSweeper can evaluate the actual issue and fix direction.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 6668eb82258c.

Label changes

Label changes:

add rating: 🌊 off-meta tidepool: Overall readiness is 🌊 off-meta tidepool; proof is 🌊 off-meta tidepool and patch quality is 🌊 off-meta tidepool.
remove proof: sufficient: Current real behavior proof status is not_applicable, not sufficient.
remove P2: Current review triage priority is none.
remove rating: 🐚 platinum hermit: Current PR rating is rating: 🌊 off-meta tidepool, so this older rating label is no longer current.
remove merge-risk: 🚨 compatibility: Current PR review selected no merge-risk labels.
remove merge-risk: 🚨 auth-provider: Current PR review selected no merge-risk labels.
remove status: 👀 ready for maintainer look: Current PR status no longer selects a status label.

Label justifications:

rating: 🌊 off-meta tidepool: Overall readiness is 🌊 off-meta tidepool; proof is 🌊 off-meta tidepool and patch quality is 🌊 off-meta tidepool.

Evidence reviewed

PR surface:

Source +339, Tests +249. Total +588 across 21 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	15	403	64	+339
Tests	6	254	5	+249
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	21	657	69	+588

What I checked:

failure reason: timeout.
codex failure detail: Codex review failed for this PR: spawnSync codex ETIMEDOUT.
codex stdout: Per-item Codex failure; continuing with the rest of the shard.

Likely related people:

unknown: Codex failed before it could trace repository history. (role: review did not complete; confidence: low)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper · 2026-05-22T13:46:21Z

ClawSweeper PR egg

✨ Hatched: 🥚 common Clockwork Review Wisp

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: sniffs out flaky tests.
Image traits: location merge queue dock; accessory CI status badge; palette cobalt, lime, and pearl; mood sparkly; pose balancing on a branch marker; shell frosted glass shell; lighting gentle morning glow; background gentle dashboard dots.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Clockwork Review Wisp in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

dutifulbob · 2026-05-22T14:19:49Z

Final draft implementation report for head 70c2fdbd7c3319f0eaefeb1d429372b8903fb803.

Implemented the resolved model runtime path end to end: model resolution now returns a runtime descriptor; embedded runs and compaction carry that descriptor through auth, runtime auth updates, stream setup, and runtime planning; shared model auth derives selected-model runtime facts for callers without an explicit descriptor; provider stream lookup can use the selected model API owner; Ollama selected-model baseUrl now wins over provider baseUrl.

Validation run:

node scripts/run-vitest.mjs src/plugins/provider-runtime.test.ts extensions/ollama/src/stream.test.ts extensions/ollama/index.test.ts src/agents/model-auth.test.ts src/agents/pi-embedded-runner/model.test.ts src/agents/pi-embedded-runner/run/auth-controller.test.ts src/plugins/provider-runtime.synthetic-auth-discovery.test.ts src/agents/pi-embedded-runner/compact.hooks.test.ts src/agents/pi-embedded-runner/compaction-runtime-context.test.ts - passed, 14 files / 510 tests.
node scripts/run-vitest.mjs src/agents/model-auth.test.ts src/agents/pi-embedded-runner/compact.hooks.test.ts - passed, 4 files / 200 tests after the shared-auth fallback and compaction follow-through fix.
node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo - passed.
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo - passed.
node scripts/run-tsgo.mjs -p tsconfig.extensions.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions.tsbuildinfo - passed.
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions-test.tsbuildinfo - passed.
pnpm exec oxfmt --check ...21 touched files... - passed.
git diff --check - passed.
node --import tsx scripts/check-import-cycles.ts - passed, 0 runtime value cycles.
OPENCLAW_LIVE_TEST=1 OPENCLAW_LIVE_OLLAMA=1 OPENCLAW_LIVE_OLLAMA_MODEL=qwen2.5:3b OPENCLAW_LIVE_OLLAMA_WEB_SEARCH=0 node scripts/run-vitest.mjs --config test/vitest/vitest.live.config.ts extensions/ollama/ollama.live.test.ts -t "runs native chat" - passed, 1 live test / 3 skipped by filter.
Manual source CLI proof with a custom provider whose provider-level api/baseUrl pointed at an inert OpenAI-compatible router and whose selected model overrode to native local Ollama - passed with ok: true, provider custom-router, model qwen2.5:3b, and output text pong.
codex review --base upstream/main - clean after addressing the review finding about auth callers that do not pass an explicit runtime descriptor.

Current PR checks: latest Real behavior proof passes, workflow sanity/security/socket/lightweight checks pass or skip as expected for a draft PR. No inline review comments are open. The PR remains draft for maintainer/owner review of the additive provider auth hook context fields.

Not covered here: full remote pnpm check:changed proof. Testbox-through-Crabbox is blocked because the blacksmith CLI is unavailable in this environment, and direct AWS Crabbox is blocked by missing usable AWS credentials/IMDS identity. Live Anthropic, Google, and OpenAI auth-profile smokes were not run in this local draft pass.

dutifulbob · 2026-05-22T16:19:39Z

@clawsweeper re-review

This PR is now rebased onto current upstream/main, marked ready for review, and the PR body has been updated to frame it as a follow-up to #80488 for the remaining resolved-runtime/plugin-owned path.

Latest head: 4e87c9e37a4cf118652eee0530e40642d3abb3c2.

Latest post-rebase validation:

node scripts/run-vitest.mjs src/plugins/provider-runtime.test.ts extensions/ollama/src/stream.test.ts extensions/ollama/index.test.ts src/agents/model-auth.test.ts src/agents/pi-embedded-runner/model.test.ts src/agents/pi-embedded-runner/run/auth-controller.test.ts src/plugins/provider-runtime.synthetic-auth-discovery.test.ts src/agents/pi-embedded-runner/compact.hooks.test.ts src/agents/pi-embedded-runner/compaction-runtime-context.test.ts - passed, 14 files / 510 tests.
git diff --check - passed.
node --import tsx scripts/check-import-cycles.ts - passed, 0 runtime value cycles.

clawsweeper · 2026-05-22T16:19:43Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26299255668
Updated: 2026-05-22T16:28:18.093Z

dutifulbob · 2026-05-29T08:01:15Z

Rebased this PR onto current upstream/main and force-pushed the conflict-resolved branch.

New head: 6409cf41ba0b4dc59fc7b5f8a0f970be1e589437.

Post-rebase local validation:

node scripts/run-vitest.mjs src/plugins/provider-runtime.test.ts extensions/ollama/src/stream.test.ts extensions/ollama/index.test.ts src/agents/model-auth.test.ts src/agents/embedded-agent-runner/model.test.ts src/agents/embedded-agent-runner/run/auth-controller.test.ts src/plugins/provider-runtime.synthetic-auth-discovery.test.ts src/agents/embedded-agent-runner/compact.hooks.test.ts src/agents/embedded-agent-runner/compaction-runtime-context.test.ts - passed, 14 files / 569 tests.
node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo - passed.
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo - passed.
node scripts/run-tsgo.mjs -p tsconfig.extensions.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions.tsbuildinfo - passed.
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions-test.tsbuildinfo - passed.
pnpm exec oxfmt --check ...21 touched files... - passed.
git diff --check - passed.
node --import tsx scripts/check-import-cycles.ts - passed, 0 runtime value cycles.

Notes from the rebase: the old pi-embedded-runner paths had moved to embedded-agent-runner; I kept current main's newer model-ref canonicalization, runtime-provider compaction selection, and static-catalog media-input merge behavior while reapplying this PR's resolved-runtime plumbing.

openclaw-barnacle Bot added agents Agent runtime and tooling size: M triage: mock-only-proof Candidate: PR proof only shows tests, mocks, snapshots, lint, typecheck, or CI. labels May 22, 2026

dutifulbob force-pushed the refactor/resolved-model-runtime branch from 714e9c3 to 25fa46f Compare May 22, 2026 13:46

openclaw-barnacle Bot added extensions: ollama size: L proof: supplied External PR includes structured after-fix real behavior proof. and removed size: M triage: mock-only-proof Candidate: PR proof only shows tests, mocks, snapshots, lint, typecheck, or CI. labels May 22, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 22, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 22, 2026

dutifulbob force-pushed the refactor/resolved-model-runtime branch from 70c2fdb to 4e87c9e Compare May 22, 2026 16:18

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 22, 2026

dutifulbob marked this pull request as ready for review May 22, 2026 16:19

dutifulbob requested a review from a team as a code owner May 22, 2026 16:19

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 22, 2026

clawsweeper Bot mentioned this pull request May 24, 2026

feat: expose resolved backend model in session_status and agent runtime #51441

Open

This comment was marked as spam.

Sign in to view

dutifulbob added 3 commits May 29, 2026 15:53

refactor(agents): carry resolved model runtime through auth

15822e1

fix(agents): route streams by resolved model api

f55a36f

fix(agents): derive auth facts from selected models

6409cf4

dutifulbob force-pushed the refactor/resolved-model-runtime branch from 4e87c9e to 6409cf4 Compare May 29, 2026 08:00

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 29, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 29, 2026

osolmaz marked this pull request as draft June 1, 2026 15:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

refactor(agents): carry resolved model runtime through auth#85373

refactor(agents): carry resolved model runtime through auth#85373
dutifulbob wants to merge 3 commits into
openclaw:mainfrom
dutifulbob:refactor/resolved-model-runtime

dutifulbob commented May 22, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 22, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 22, 2026 •

edited

Loading

Uh oh!

dutifulbob commented May 22, 2026

Uh oh!

dutifulbob commented May 22, 2026

Uh oh!

clawsweeper Bot commented May 22, 2026 •

edited

Loading

Uh oh!

This comment was marked as spam.

dutifulbob commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dutifulbob commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What Changed

Testing

Real behavior proof

Risks

Uh oh!

clawsweeper Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hatch command

Uh oh!

dutifulbob commented May 22, 2026

Uh oh!

dutifulbob commented May 22, 2026

Uh oh!

clawsweeper Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as spam.

dutifulbob commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dutifulbob commented May 22, 2026 •

edited

Loading

clawsweeper Bot commented May 22, 2026 •

edited

Loading

clawsweeper Bot commented May 22, 2026 •

edited

Loading

clawsweeper Bot commented May 22, 2026 •

edited

Loading