PR #60934: fix(auth): respect auth override by filtering profiles (token/oauth) (closes #60930)

• Repository: openclaw/openclaw
• Author: juliabush
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/60934

Description (problem / solution / changelog)

Summary

• Problem: Auth profile resolution ignored auth override and selected OAuth profiles even when mode: "token" was configured
• Why it matters: Telegram and other integrations incorrectly used OAuth, consuming credits instead of billing via API key
• What changed: Filtered auth profile resolution order to respect auth override (token or oauth) with fallback to original order
• What did NOT change (scope boundary): No changes to env resolution, custom provider keys, or downstream auth handling

Change Type (select all)

• Bug fix

Scope (select all touched areas)

• Auth / tokens

Linked Issue/PR

• Closes #60920
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: Auth resolution loop iterated over all profiles without considering configured auth override, allowing higher-priority OAuth profiles to be selected
• Missing detection / guardrail: No filtering or prioritization based on explicit auth mode in config
• Contributing context (if known): Mixed auth profiles (OAuth + token) combined with default ordering led to unintended selection

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
• Target test or file: model-auth.ts auth resolution logic
• Scenario the test should lock in: When auth: "token" is set, only token profiles are selected unless none exist
• Why this is the smallest reliable guardrail: Directly validates core resolution logic without requiring full integration setup
• Existing test that already covers this (if any): None
• If no new test is added, why not: Can be added separately to avoid blocking fix

User-visible / Behavior Changes

• Auth override (auth: "token" or "oauth") is now strictly respected during profile selection

Diagram (if applicable)

Before:
[request] -> [all profiles considered] -> [OAuth selected] -> [credits used]

After:
[request] -> [filter by auth override] -> [token selected] -> [API key billing]

## Changed files

- `src/agents/model-auth.ts` (modified, +12/-1)