openclaw - 💡(How to fix) Fix 5.16-beta.5: /models browse picker exceeds Telegram answerCallbackQuery 30s timeout (auth checks per model, no cache)

Summary

On 2026.5.16-beta.5, opening the /models browse picker in Telegram is severely slow (15-60 seconds per button click) and frequently produces 400: query is too old and response timeout expired errors because Telegram's answerCallbackQuery 30-second timeout is exceeded.

Reproduction

1. Configure ~15-20 models across multiple providers in agents.defaults.models
2. Have claude-cli auth so the browse picker pulls the unfiltered claude-cli catalog (usesUnfilteredCatalogModels(claude-cli) → true)
3. Open /models in Telegram, click any provider or model button

Expected: Sub-second button response, picker renders smoothly.

Actual:

• Each button press takes 15-60 seconds to take effect
• Often requires 2-3 clicks before the menu advances
• Gateway log shows recurring:

  telegram answerCallbackQuery failed: Call to 'answerCallbackQuery' failed! 
    (400: Bad Request: query is too old and response timeout expired or query ID is invalid)

Root cause analysis

The browse picker calls buildModelsProviderData → resolveVisibleModelCatalog → createProviderAuthChecker, which invokes hasAuthForModelProvider for every entry in the catalog. That function:

1. Reads auth-profiles.json from disk
2. Calls ensureAuthProfileStore with externalCli: externalCliDiscoveryForProviderAuth(...) — probes CLI binaries on disk
3. Hits macOS Keychain for OAuth credentials (readClaudeCliCredentialsCached etc.)

For a catalog of ~50 entries (configured + pi-ai built-in catalogs that aren't filtered for CLI providers), the cumulative latency exceeds Telegram's 30s answerCallbackQuery deadline.

There's an auth result cache in createProviderAuthChecker (authCache = new Map()), but it appears to be per-call-instance, not persisted across menu interactions. Every button click rebuilds the picker from scratch and re-runs all auth checks.

Suggested fix

One or more of:

1. Process-lifetime auth result cache (with a TTL like 60s) instead of per-call cache — so consecutive button clicks within a session don't re-probe the keychain
2. Parallelize auth checks with Promise.all rather than sequential probes
3. Cache loadModelCatalog result across renders (it's static for the gateway lifetime barring config reload)
4. runtimeAuthDiscovery: false config flag to skip external CLI probing in browse picker rendering specifically

Even one of these would bring the picker under the 30s threshold.

Environment

• OpenClaw: 2026.5.16-beta.5 (5dab5ce)
• Node: 25.8.0
• macOS 26.3.1 arm64
• Channel: Telegram (5.16-beta.5 channel runtime)
• ~50 models in resolved catalog (config + pi-ai unfiltered claude-cli catalog)