Problem

OpenClaw's Control UI model picker is built from the bundled catalog in extensions/openai/openai-provider.ts — hardcoded entries like gpt-5.5, gpt-5.4-pro, etc., each with a baked-in baseUrl, cost, contextWindow, maxTokens. This means:

1. Wrong list when behind a proxy. Users running OpenClaw against a LiteLLM/vLLM/local-gateway/AceTeam-style upstream see picker options that the upstream doesn't actually accept — and pick one, only to get a 404 from the upstream when they hit send.
2. Stale cost/context. When OpenAI changes pricing or releases a new model, the bundled catalog has to ship a release before users see it. Even then, gateways with custom pricing (volume discounts, per-tenant caps) can't reflect that anywhere.
3. No source of truth. The OPENAI_BASE_URL env-var fallback (#74427, merged) and the whisper precedent (#55597, merged) accept that the upstream is the source of truth for where to send the call. The catalog should follow the same principle for what the call can be.

Proposal

Add an opt-in dynamic-catalog refresh path that mirrors the existing Bedrock-Mantle discovery pattern (extensions/amazon-bedrock-mantle/discovery.ts). At a high level:

// New optional hook on ProviderPlugin
interface ProviderPlugin {
  // ...existing fields...
  resolveDynamicCatalog?(ctx: ProviderResolveCatalogContext): Promise<ProviderRuntimeModel[]>;
}

interface ProviderResolveCatalogContext {
  providerConfig: ProviderConfig;  // baseUrl, apiKey, request headers, etc.
  fetchFn?: typeof fetch;
  now?: () => number;
}

For OpenAI provider:

1. Implement resolveDynamicCatalog to GET ${providerConfig.baseUrl}/models with the configured apiKey as Authorization: Bearer.
2. Parse the response — strict superset of OpenAI's {object: "list", data: [{id, object, created, owned_by}]}. Optional fields like context_window, max_output_tokens, modalities, cost_per_million_tokens (already shipped by some gateways) get mapped into ProviderRuntimeModel.contextWindow / maxTokens / cost when present, falling back to the bundled defaults otherwise.
3. Cache per providerConfig.baseUrl + apiKey with a 1h TTL (matches Mantle).
4. Surface the discovered models alongside the static catalog. With models.modelCatalogMode = "merge" (default), discovered + bundled deduped by id; with "replace", discovered wins entirely.

For the Control UI:

• On models.providers.{openai,anthropic,…} config change OR explicit refresh, call the dynamic resolver and rebuild the picker.
• Existing static catalog stays the fallback when the provider has no baseUrl + apiKey configured (i.e. default "I'll use the bundled OpenAI defaults" mode).

Why this matches existing patterns

• #55597 (whisper) — env-var-based base URL honoring. Merged.
• #74427 (openai env fallback) — config-vs-env precedence for OPENAI_BASE_URL. Merged.
• extensions/amazon-bedrock-mantle/discovery.ts — exact same pattern (fetch /v1/models, cache by key, normalize entries) for a different provider family.

This is a generalization of (3) to the OpenAI/Anthropic providers, gated behind an opt-in hook so providers that don't want dynamic discovery (raw Ollama running on localhost, SDK-only providers like Vertex) keep their existing static-catalog behavior.

Scope

• New hook on ProviderPlugin interface (additive, backwards-compatible)
• Implementation for extensions/openai/openai-provider.ts
• Implementation for extensions/anthropic/ (separate PR, mirror)
• Control UI hook to call resolveDynamicCatalog on config change / startup
• Cache invalidation on apiKey / baseUrl change

Each piece is a small focused PR; the hook itself can land first.

Asks for maintainers

1. Is the proposed hook name/shape acceptable, or do you prefer a different seam (e.g. extending the existing ProviderRuntimeModel template lookup)?
2. Is merge vs replace the right axis, or should dynamic-catalog have its own setting?
3. Anything about the cache key (per-baseUrl-and-key) that needs to factor in tenant context (e.g. for multi-org gateways where the same baseUrl returns different lists per org)?

Happy to write the implementation once we agree on the shape — would rather not write code that gets rewritten in review.

Forks affected

aceteam-ai/safeclaw (OpenClaw + AEP safety proxy) needs this for its model picker to reflect what its proxy actually accepts. Would consume the same hook.