Summary

What problem does this PR solve?

• Prevents stale persisted session model/provider state from routing through a provider that is no longer visible to the current gateway model catalog/config.
• Applies the guard in resolveSessionModelRef, and wires chat.send to pass catalog visibility when provider rows, replace mode, or a non-default persisted session route can make stale providers risky.
• Covers explicit providerOverride/modelOverride and stale runtime modelProvider/model fields.

Why does this matter now?

• Issue [Bug]: Deleted provider session overrides persist in sessions.json — silent financial damage risk #90471 reports sessions continuing to use a deleted provider after config changes, creating silent billing/quota risk.

What is the intended outcome?

• Persisted session routes are preserved when they match the configured default, an explicit configured provider row, or a loaded catalog model.
• Persisted session routes fall back to the current configured default when catalog-aware gateway routing cannot find the stored provider/model anymore, including when the deleted provider was the last custom provider row.

What is intentionally out of scope?

• Adding a new user-facing session reset command.
• Changing provider catalog discovery or model picker behavior.
• Migrating or deleting sessions.json entries on disk.

What does success look like?

• Runtime chat routing no longer honors deleted-provider session state once the current catalog/config says the provider is gone.
• Valid merge-mode provider/plugin catalog routes outside models.providers continue to work.

What should reviewers focus on?

• Whether the catalog-aware resolver guard now matches OpenClaw merge/replace model visibility semantics.
• Whether chat.send loads catalog visibility at the right point for persisted session route validation.

Linked context

Which issue does this close?

Closes #90471

Which issues, PRs, or discussions are related?

Related #90462

Was this requested by a maintainer or owner?

• Not maintainer-requested; this addresses the open bug report and ClawSweeper's source-repro note on [Bug]: Deleted provider session overrides persist in sessions.json — silent financial damage risk #90471.

Real behavior proof (required for external PRs)

• Behavior or issue addressed: Deleted provider session override/runtime state no longer wins over the current configured default route when the current model catalog cannot see the stored provider/model.
• Real environment tested: Local OpenClaw source checkout on macOS, Node v24.15.0, with the gateway session resolver imported through tsx after this patch.
• Exact steps or command run after this patch:

node --import tsx - <<'EOF'
import { resolveSessionModelRef } from './src/gateway/session-utils.ts';
const cfg = {
  agents: { defaults: { model: { primary: 'custom-api-deepseek-com/deepseek-v4-pro' } } },
  models: { providers: { 'custom-api-deepseek-com': { api: 'openai-completions', models: [{ id: 'deepseek-v4-pro' }] } } },
};
const staleSession = {
  sessionId: 'webchat-main',
  updatedAt: Date.now(),
  providerOverride: 'ollama-cloud',
  modelOverride: 'deepseek-v4-pro:cloud',
  modelProvider: 'ollama-cloud',
  model: 'deepseek-v4-pro:cloud',
};
console.log(JSON.stringify(resolveSessionModelRef(cfg, staleSession, undefined, { modelCatalog: [] }), null, 2));
EOF

• Evidence after fix:

{
  "provider": "custom-api-deepseek-com",
  "model": "deepseek-v4-pro"
}

• Additional last-custom-provider deletion proof run after the ClawSweeper review finding:

node --import tsx - <<'EOF'
import { resolveSessionModelRef, shouldLoadModelCatalogForSessionModelResolution } from './src/gateway/session-utils.ts';
const cfg = { agents: { defaults: { model: { primary: 'openai/gpt-5.4' } } } };
const staleSession = {
  sessionId: 'webchat-main',
  updatedAt: Date.now(),
  providerOverride: 'custom-api-deepseek-com',
  modelOverride: 'deepseek-v4-pro',
  modelProvider: 'custom-api-deepseek-com',
  model: 'deepseek-v4-pro',
};
console.log(JSON.stringify({
  shouldLoadCatalog: shouldLoadModelCatalogForSessionModelResolution(cfg, staleSession),
  resolved: resolveSessionModelRef(cfg, staleSession, undefined, { modelCatalog: [] }),
}, null, 2));
EOF

• Additional last-custom-provider output:

{
  "shouldLoadCatalog": true,
  "resolved": {
    "provider": "openai",
    "model": "gpt-5.4"
  }
}

• Additional compatibility proof run after the first ClawSweeper review finding:

node --import tsx - <<'EOF'
import { resolveSessionModelRef } from './src/gateway/session-utils.ts';
const cfg = {
  agents: { defaults: { model: { primary: 'custom-api-deepseek-com/deepseek-v4-pro' } } },
  models: { providers: { 'custom-api-deepseek-com': { api: 'openai-completions', models: [{ id: 'deepseek-v4-pro' }] } } },
};
const validSession = {
  sessionId: 'webchat-main',
  updatedAt: Date.now(),
  providerOverride: 'plugin-provider',
  modelOverride: 'plugin-model',
};
console.log(JSON.stringify(resolveSessionModelRef(cfg, validSession, undefined, { modelCatalog: [{ provider: 'plugin-provider', id: 'plugin-model', name: 'Plugin Model' }] }), null, 2));
EOF

• Additional compatibility output:

{
  "provider": "plugin-provider",
  "model": "plugin-model"
}

• Additional /stop command regression proof run after the latest ClawSweeper review finding:

node scripts/run-vitest.mjs src/gateway/server.chat.gateway-server-chat-b.test.ts

• Additional /stop regression output:

Test Files  2 passed (2)
Tests  68 passed (68)

• The added chat.send regression stores a stale custom-provider session route, calls /stop, and asserts loadGatewayModelCatalog is not called before the stop response returns.

• Additional fresh/default custom-provider no-catalog proof run after the latest ClawSweeper review finding:

node scripts/run-vitest.mjs src/gateway/server.chat.gateway-server-chat-b.test.ts
node scripts/run-vitest.mjs src/gateway/session-utils.test.ts

• Additional no-catalog regression output:

server.chat.gateway-server-chat-b.test.ts: 2 files / 70 tests passed
session-utils.test.ts: 4 files / 456 tests passed

• The added regressions prove fresh custom-provider sessions, default persisted custom-provider sessions, and explicitly configured provider overrides do not call for catalog validation; the direct chat.send test asserts loadGatewayModelCatalog is not called before starting a fresh custom-provider send.

• Observed result after fix: stale persisted override/runtime fields are ignored when absent from current catalog/config, including when there are no remaining custom provider rows, while a valid catalog-backed provider outside models.providers remains selected in default merge mode. Stop commands and fresh/default custom-provider sends now return before session model catalog validation is loaded.

• What was not tested: a live Windows gateway sending real paid-provider traffic; no paid provider credentials were used.

• Proof limitations or environment constraints: this proof exercises the actual gateway session resolver and catalog-load predicate used by chat send, but does not perform an external model API call.

• Before evidence (optional but encouraged): the added regression tests encode the prior failure shape; before this patch, resolveSessionModelRef returned persisted override/runtime state before checking current provider visibility.

Tests and validation

Which commands did you run?

pnpm install --frozen-lockfile
node scripts/run-vitest.mjs src/gateway/session-utils.test.ts
node scripts/run-vitest.mjs src/gateway/server.chat.gateway-server-chat-b.test.ts
node scripts/run-oxlint.mjs src/gateway/session-utils.ts src/gateway/session-utils.test.ts src/gateway/server-methods/chat.ts src/gateway/server.chat.gateway-server-chat-b.test.ts scripts/check-no-raw-channel-fetch.mjs
pnpm run lint:tmp:no-raw-channel-fetch
git diff --check
pnpm tsgo:core:test
node scripts/run-additional-boundary-checks.mjs --shard=2/4,3/4,4/4

Results:

• pnpm install --frozen-lockfile: passed.
• node scripts/run-vitest.mjs src/gateway/session-utils.test.ts: passed, 4 files / 456 tests on the final run.
• node scripts/run-vitest.mjs src/gateway/server.chat.gateway-server-chat-b.test.ts: passed, 2 files / 70 tests on the final run.
• node scripts/run-oxlint.mjs src/gateway/session-utils.ts src/gateway/session-utils.test.ts src/gateway/server-methods/chat.ts src/gateway/server.chat.gateway-server-chat-b.test.ts scripts/check-no-raw-channel-fetch.mjs: passed.
• pnpm run lint:tmp:no-raw-channel-fetch: passed.
• git diff --check: passed.
• pnpm tsgo:core:test: passed.
• node scripts/run-additional-boundary-checks.mjs --shard=2/4,3/4,4/4: passed after updating the qa-lab raw-fetch allowlist line numbers to match current main.
• Direct stale-provider proof command: returned custom-api-deepseek-com/deepseek-v4-pro.
• Direct last-custom-provider proof command: returned shouldLoadCatalog: true and openai/gpt-5.4.
• Direct merge-mode compatibility proof command: returned plugin-provider/plugin-model.
• Fresh/default custom-provider no-catalog proof: chat.send started successfully without calling loadGatewayModelCatalog; helper tests returned false for fresh, default persisted, and explicitly configured provider-row sessions.

What regression coverage was added or updated?

• Added resolver tests for ignoring removed-provider explicit overrides.
• Added resolver tests for ignoring removed-provider runtime model fields.
• Added regressions for deleting the last custom provider row and falling back to a built-in/default provider.
• Added a preservation test for overrides whose provider still exists in explicit config.
• Added merge-mode preservation tests for built-in and catalog-backed providers outside models.providers.
• Added chat server coverage through the existing chat.send test shard after wiring catalog-aware session route resolution.
• Added a chat.send /stop regression proving stop commands bypass session model catalog validation.
• Added helper and chat.send regressions proving fresh/default custom-provider sends skip unnecessary catalog validation.

What failed before this fix, if known?

• Source-level behavior: persisted override/runtime session model state was returned before validating whether the provider/model was still visible in current config/catalog, so deleted provider state could remain the effective route.

If no test was added, why not?

• Regression tests were added.

Risk checklist

Did user-visible behavior change? (Yes/No)

Yes.

Did config, environment, or migration behavior change? (Yes/No)

No config shape, environment, or migration behavior changed. Runtime route resolution now treats catalog-missing persisted session providers as invalid when chat routing has catalog visibility.

Did security, auth, secrets, network, or tool execution behavior change? (Yes/No)

Yes, provider/auth routing behavior changes for stale persisted session state.

What is the highest-risk area?

• Existing sessions with persisted routes to providers that are no longer configured or present in the loaded catalog will now fall back to the configured default instead of continuing to use that stale provider.

How is that risk mitigated?

• The guard preserves the configured default provider.
• The guard preserves providers still present in explicit config.
• Default merge mode remains permissive when no catalog is available and no non-default persisted route needs validation.
• Catalog-backed provider/plugin routes outside models.providers are preserved when catalog visibility is available.
• Focused tests cover removed-provider override/runtime paths, last-custom-provider deletion, and merge-mode provider preservation.

Current review state

What is the next action?

• Waiting for CI and ClawSweeper review on the updated head.

What is still waiting on author, maintainer, CI, or external proof?

• CI and ClawSweeper need to complete after the fresh/default custom-provider no-catalog repair on head d7f2aa2e13c9808920e37dcfd6b33e0bd7531db4.
• Maintainers may decide whether this runtime fallback policy is the desired deleted-provider behavior.

Which bot or reviewer comments were addressed?

• Addresses ClawSweeper's P1 finding to preserve valid merge-mode providers outside models.providers by validating persisted routes against catalog visibility instead of treating provider rows as exhaustive.
• Addresses ClawSweeper's P1 finding to load catalog validation when a stale persisted provider remains after deleting the last custom provider row.
• Addresses ClawSweeper's P2 finding by returning /stop before loading session model catalog validation.
• Addresses ClawSweeper's P2 finding by narrowing catalog validation to actual non-default persisted refs and skipping catalog loads for fresh/default custom-provider sends.