Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: Gateway unconditionally probes all 115 manifest providers and external CLI credentials at startup — causing 50s+ blocking even with 1 configured provider [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#73908•Fetched 2026-04-29 06:13:25
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
0
Author
AilurasAiluras
Participants
AilurasAilurasclawsweeper[bot]clawsweeper[bot]
Timeline (top)
labeled ×2commented ×1cross-referenced ×1

Gateway startup (sidecars.channels / prewarmConfiguredPrimaryModel) blocks ~56s and credential discovery calls security find-generic-password for Claude on macOS, even with only 1 configured provider, 3 plugins, and no Anthropic/Claude credentials anywhere in config or env.

Root Cause

Gateway startup (sidecars.channels / prewarmConfiguredPrimaryModel) blocks ~56s and credential discovery calls security find-generic-password for Claude on macOS, even with only 1 configured provider, 3 plugins, and no Anthropic/Claude credentials anywhere in config or env.

Fix Action

Fix / Workaround

  • sidecars.channels takes 56.7s (all other sidecar stages <100ms)
  • agents/auth-profiles logs read anthropic credentials from claude cli keychain on every startup/connection
  • macOS Keychain query blocks handshake/connection ~5-10s each call
  • With OPENCLAW_SKIP_MODEL_PREWARM=1 + code guard: startup drops to 2.1s
  • With OPENCLAW_SKIP_CLAUDE_CLI_KEYCHAIN code guard: Keychain calls stop, handshake no longer times out
  • No config-level workaround without code patches

PR fix notes

PR #73952: fix(auth): scope external CLI credential overlays

Description (problem / solution / changelog)

Summary

  • Root cause: runtime auth-store overlays always evaluated every external CLI credential source before checking whether that provider was relevant to the current model auth status request.
  • Fixes #73908 by threading provider eligibility and keychain prompt policy through external CLI auth overlay resolution, then scoping models.authStatus to configured refreshable providers.
  • Adds regression coverage for api-key-only model auth status and scoped external CLI readers.

Why This Is Safe

  • Existing unrestricted callers keep the same behavior because the new provider scope is optional.
  • models.authStatus already computes the refreshable provider set; the change reuses that existing view to avoid unrelated runtime-only overlays.
  • Security/runtime controls are unchanged: credential parsing, identity checks, persistence filtering, token health rollups, and OAuth bootstrap safety rules are not relaxed.

Tests

  • pnpm test src/agents/auth-profiles.store-cache.test.ts src/agents/auth-profiles.external-cli-sync.test.ts src/gateway/server-methods/models-auth-status.test.ts -- --reporter=verbose
  • pnpm exec oxfmt --check --threads=1 CHANGELOG.md src/agents/auth-profiles/external-cli-sync.ts src/agents/auth-profiles/external-auth.ts src/agents/auth-profiles/store.ts src/gateway/server-methods/models-auth-status.ts src/agents/auth-profiles.external-cli-sync.test.ts src/gateway/server-methods/models-auth-status.test.ts
  • git diff --check
  • pnpm check:changed

Out Of Scope

  • Startup model prewarm behavior; current main already scopes and backgrounds that path.
  • Changing supported CLI credential formats or external CLI auth persistence rules.
  • Broad plugin-owner discovery changes beyond this provider-scoped overlay guard.

Made with Cursor

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • src/agents/auth-profiles.external-cli-sync.test.ts (modified, +33/-1)
  • src/agents/auth-profiles/external-auth.ts (modified, +19/-2)
  • src/agents/auth-profiles/external-cli-sync.ts (modified, +28/-4)
  • src/agents/auth-profiles/store.ts (modified, +17/-3)
  • src/gateway/server-methods/models-auth-status.test.ts (modified, +12/-0)
  • src/gateway/server-methods/models-auth-status.ts (modified, +3/-1)
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

Gateway startup (sidecars.channels / prewarmConfiguredPrimaryModel) blocks ~56s and credential discovery calls security find-generic-password for Claude on macOS, even with only 1 configured provider, 3 plugins, and no Anthropic/Claude credentials anywhere in config or env.

Steps to reproduce

  1. OpenClaw 2026.4.26, macOS, Node 24, config:
    • auth.profiles: only opencode-go:default (api_key)
    • agents.defaults.model.primary: opencode-go/kimi-k2.6
    • plugins.allow: ["opencode-go", "device-pair"] (3 enabled)
    • No fallbacks, no Anthropic/Claude env vars or profiles
  2. openclaw gateway restart
  3. Observe OPENCLAW_GATEWAY_STARTUP_TRACE=1 output showing sidecars.channels ~56.7s, all other stages sub-100ms
  4. Observe log line: [agents/auth-profiles] read anthropic credentials from claude cli keychain — even though no Anthropic/Claude is configured
  5. Run openclaw tui and observe handshake timeout / gateway connect failed correlating with repeated Keychain calls

Expected behavior

  • Startup time proportional to number of configured providers, not full manifest index (115 entries)
  • Credential discovery (readClaudeCliCredentialsCached) should skip providers not in plugins.allow or auth.profiles
  • No calls to security find-generic-password when user never configured Anthropic/Claude

Actual behavior

  • sidecars.channels takes 56.7s (all other sidecar stages <100ms)
  • agents/auth-profiles logs read anthropic credentials from claude cli keychain on every startup/connection
  • macOS Keychain query blocks handshake/connection ~5-10s each call
  • With OPENCLAW_SKIP_MODEL_PREWARM=1 + code guard: startup drops to 2.1s
  • With OPENCLAW_SKIP_CLAUDE_CLI_KEYCHAIN code guard: Keychain calls stop, handshake no longer times out
  • No config-level workaround without code patches

OpenClaw version

OpenClaw 2026.4.26 (be8c246)

Operating system

macOS 26.3.1(25D2128)

Install method

npm gobal

Model

kimi2.6

Provider / routing chain

Single provider, local loopback, no fallbacks: TUI/CLI → ws://127.0.0.1:18789 → opencode-go/kimi-k2.6

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

TL;DR

The most likely fix is to apply a code patch to skip unnecessary credential discovery calls for unconfigured providers.

Guidance

  • Investigate the readClaudeCliCredentialsCached function to determine why it's being called for unconfigured Anthropic/Claude providers.
  • Verify that the plugins.allow and auth.profiles configurations are being correctly applied to filter out unwanted providers.
  • Consider adding a code guard to skip Keychain calls when Anthropic/Claude is not configured, similar to the existing OPENCLAW_SKIP_CLAUDE_CLI_KEYCHAIN code guard.
  • Review the sidecars.channels startup process to identify potential bottlenecks and optimize its performance.

Example

No code snippet is provided due to the lack of specific implementation details in the issue.

Notes

The issue seems to be related to the credential discovery process and the sidecars.channels startup stage. However, without more information about the implementation, it's difficult to provide a more specific solution.

Recommendation

Apply a workaround by adding a code patch to skip unnecessary credential discovery calls for unconfigured providers, as this has been shown to resolve the issue in the provided test cases.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

  • Startup time proportional to number of configured providers, not full manifest index (115 entries)
  • Credential discovery (readClaudeCliCredentialsCached) should skip providers not in plugins.allow or auth.profiles
  • No calls to security find-generic-password when user never configured Anthropic/Claude
#api#training loop#device allocation#model download#tokenizer error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: Gateway unconditionally probes all 115 manifest providers and external CLI credentials at startup — causing 50s+ blocking even with 1 configured provider [1 pull requests, 1 comments, 2 participants]