PR #66903: fix(models): honor Codex synthetic auth in status

• Repository: openclaw/openclaw
• Author: neeravmakwana
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/66903

Description (problem / solution / changelog)

Summary

• Problem: openclaw models status --json could report auth.missingProvidersInUse: ["codex"] for codex/* models even when the Codex provider had plugin-owned synthetic auth available.
• Why it matters: the status output incorrectly implied missing Codex auth and sent people debugging a provider that was already usable.
• What changed: models status now resolves provider-plugin synthetic auth when building auth overviews, surfaces that auth in the provider summary, and treats token/oauth synthetic auth as satisfying the in-use provider check.
• What did NOT change (scope boundary): no model routing, provider execution, or Codex auth storage behavior changed; this only fixes status reporting and its regression coverage.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #66872
• Related #66872
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: src/commands/models/list.status-command.ts only considered auth entries returned from resolveProviderAuthOverview, and that overview only checked auth-store profiles, env keys, and models.json values. It never consulted provider-plugin resolveSyntheticAuth, so codex stayed absent from providerAuthMap and was flagged as missing.
• Missing detection / guardrail: the closest models status tests covered stored auth, env auth, and CLI backends, but not a provider whose usable auth only exists through plugin-owned synthetic auth.
• Contributing context (if known): the Codex provider already declared synthetic auth through the provider plugin, but the status path was not using the same seam that runtime auth resolution uses.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/commands/models/list.status.test.ts and src/commands/models/list.auth-overview.test.ts
• Scenario the test should lock in: codex/gpt-5.4 should not appear in missingProvidersInUse when the Codex provider resolves plugin-owned synthetic token auth.
• Why this is the smallest reliable guardrail: the regression is entirely inside the status/auth overview path, so command-level and overview-level tests cover it without needing a broader provider execution harness.
• Existing test that already covers this (if any): None.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

• openclaw models status --json no longer reports codex as missing when the Codex provider resolves plugin-owned synthetic auth.
• Provider auth summaries now show synthetic auth details for providers that expose them through the plugin runtime.

Diagram (if applicable)

Before:
[codex/* in use] -> [status checks store/env/models.json only] -> [codex missing]

After:
[codex/* in use] -> [status also checks provider synthetic auth] -> [codex synthetic auth found] -> [missingProvidersInUse stays empty]

Security Impact (required)

• New permissions/capabilities? (Yes/No): No
• Secrets/tokens handling changed? (Yes/No): No
• New/changed network calls? (Yes/No): No
• Command/tool execution surface changed? (Yes/No): No
• Data access scope changed? (Yes/No): No
• If any Yes, explain risk + mitigation:

Repro + Verification

Environment

• OS: macOS 15
• Runtime/container: local CLI on repo main
• Model/provider: codex/gpt-5.4, codex/gpt-5.4-mini
• Integration/channel (if any): N/A
• Relevant config (redacted): temp OPENCLAW_HOME with codex/* defaults and the Codex plugin enabled

Steps

1. Create a temp OPENCLAW_HOME with codex/gpt-5.4 as the default model and an openai-codex OAuth profile in auth-profiles.json.
2. Run pnpm openclaw models status --json against that temp home.
3. Inspect auth.missingProvidersInUse and the provider auth summary.

Expected

• missingProvidersInUse is empty for the active codex/* models.
• The provider summary reflects that Codex auth is available through the provider plugin.

Actual

• Before this change, the same repro reported missingProvidersInUse: ["codex"].
• After this change, the repro reports missingProvidersInUse: [] and shows codex with synthetic token auth.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

• Verified scenarios:
  • Ran pnpm test src/commands/models/list.status.test.ts src/commands/models/list.auth-overview.test.ts
  • Ran pnpm build
  • Reproduced the issue with a temp OPENCLAW_HOME before the fix and verified the same repro returns missingProvidersInUse: [] after the fix
• Edge cases checked:
  • Existing stored/env auth summaries still pass in the targeted tests
  • Codex synthetic auth is surfaced both in the auth overview unit test and the command-level JSON output test
• What you did not verify:
  • Full pnpm test
  • Other providers with synthetic auth beyond the targeted command tests

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes/No): Yes
• Config/env changes? (Yes/No): No
• Migration needed? (Yes/No): No
• If yes, exact upgrade steps:

Risks and Mitigations

• Risk: providers with synthetic auth now appear in the status provider summary where they were previously invisible.
  • Mitigation: coverage was added at both the auth-overview and command JSON layers, and the change is limited to the status-reporting path.

Changed files

• src/commands/models/list.auth-overview.test.ts (modified, +54/-22)
• src/commands/models/list.auth-overview.ts (modified, +43/-2)
• src/commands/models/list.status-command.ts (modified, +31/-8)
• src/commands/models/list.status.test.ts (modified, +74/-0)
• src/commands/models/list.types.ts (modified, +2/-1)
• src/plugins/provider-runtime.runtime.ts (modified, +9/-0)