openclaw - 💡(How to fix) Fix Flat-key disclosure: scope each agent's models.json to its own provider only

Every OpenClaw agent's models.json currently contains all sibling agents' saqi-max-* provider entries, including their bearer keys. A compromised or prompt-injected agent can read sibling agents' credentials directly from its own config file.

This was caught during cutover when one agent's models.json was observed to contain all 23 saqi-max-* provider entries instead of just its own.

Current mitigation: bridge cross-validation (agent in bearer must equal agent in model string). This caught a real misconfigured request during cutover (key=link, model=aria-syncro → 403). Defense-in-depth working as intended.

Proper fix: each agent's models.json should contain only its own provider entry. Sibling provider entries should not be readable by the agent.

Investigation needed:

1. Where in OpenClaw runtime is models.json populated/loaded for each agent?
2. Why are sibling entries currently included? (Bug, deliberate, or convenience?)
3. What's the smallest change to scope each models.json to its own provider?

Acceptance criteria:

• Each OpenClaw agent's models.json contains only its own provider entry
• Cross-validation defense remains in place (still useful as defense-in-depth)
• Bridge logs show no agent_mismatch events in normal operation after fix

Scope: Unknown until investigation. Could be small (single loading-logic change) or larger (refactor of how OpenClaw materializes per-agent configs).

Priority: Medium. Cross-validation mitigates the immediate risk. But the disclosure makes prompt-injection-to-credential-theft easier than it should be.

Labels (apply manually): security, defense-in-depth