PR #69753: fix(auth-profiles): silently skip aws-sdk SDK-managed markers during store load

• Repository: openclaw/openclaw
• Author: hclsys
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/69753

Description (problem / solution / changelog)

Problem

Since 2026.4.1, auth-profiles.json entries with `"type": "aws-sdk"` are rejected as `invalid_type` and dropped during store load. This silently breaks Amazon Bedrock on EC2 instances that rely on IMDS (instance metadata) credentials — the gateway logs a generic "ignored invalid auth profile entries" warning, and Bedrock calls then fail with `DispatchFailure: Could not load credentials from any providers`.

Reported by @allamand in #69708 with complete EC2/IMDS repro.

Fix

`aws-sdk` is not a real credential variant — it's a marker that records the presence of a Bedrock profile while letting the AWS SDK resolve credentials independently at call time via its own chain (env vars, shared config, IMDS, etc.). The marker should be accepted silently, not rejected.

Introduce `AUTH_PROFILE_SDK_MARKER_TYPES = new Set(["aws-sdk"])` and short-circuit `parseCredentialEntry` to return `sdk_marker_skipped` (a new reason code) for any marker type. The "invalid entries" warning filters these out so genuine invalid entries remain visible in the log.

Why not widen `AuthProfileCredential` instead

Adding a real `AwsSdkCredential` variant to the union would require adjusting ~10 downstream type-narrowing switches (`credential-state.ts`, `oauth.ts`, `persisted.ts` migration path, etc.). That's a larger surface than the fix requires — the marker has no secret material for any of those switches to do anything with. The narrower "skip silently" shape both unblocks Bedrock and keeps the change scoped to one file of behavior.

Pre-implement audit

• A (existing helper): `AUTH_PROFILE_TYPES` set already drives the allow/reject boundary. Added a parallel `AUTH_PROFILE_SDK_MARKER_TYPES` for non-credential markers rather than shoehorning into the credential type union. ✓
• B (shared callers): The parse helper is called from every auth-profile load path. The behavior change is strictly narrower (a previously-rejected marker is now cleanly skipped) — no switch downstream needs a new branch. ✓
• C (broader rival): No rival on #69708. ✓

Testing

Two new regression tests in `auth-profiles.ensureauthprofilestore.test.ts`:

• `silently skips SDK-managed marker profiles (#69708)` — aws-sdk + a real api_key entry: asserts the marker is absent from the loaded store AND no warning is logged.
• `still warns about genuine invalid types alongside SDK markers (#69708)` — mixes an aws-sdk marker with a truly-invalid entry: asserts the warning surfaces only the real invalid entry (dropped: 1, reasons: {invalid_type: 1}), not inflated by the marker.

tsc clean on touched files, oxlint clean.

Fixes #69708

Changed files

• src/agents/auth-profiles.ensureauthprofilestore.test.ts (modified, +82/-0)
• src/agents/auth-profiles/persisted.ts (modified, +40/-5)