github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-10 17:14:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auth profiles: never persist plaintext when refs are present

Browse Source
This commit is contained in:
joshavant
2026-02-21 17:08:20 -08:00
committed by Peter Steinberger
parent 4c5a2c3c6d
commit e1301c31e7
5 changed files with 157 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/agents/models-config.providers.ts
View File

@@ -1034,17 +1034,8 @@ export async function resolveImplicitCopilotProvider(params: {
}
}
// pi-coding-agent's ModelRegistry marks a model "available" only if its
// `AuthStorage` has auth configured for that provider (via auth.json/env/etc).
// Our Copilot auth lives in OpenClaw's auth-profiles store instead, so we also
// write a runtime-only auth.json entry for pi-coding-agent to pick up.
//
// This is safe because it's (1) within OpenClaw's agent dir, (2) contains the
// GitHub token (not the exchanged Copilot token), and (3) matches existing
// patterns for OAuth-like providers in pi-coding-agent.
// Note: we deliberately do not write pi-coding-agent's `auth.json` here.
// OpenClaw uses its own auth store and exchanges tokens at runtime.
// `models list` uses OpenClaw's auth heuristics for availability.
// We deliberately do not write pi-coding-agent auth.json here.
// OpenClaw keeps auth in auth-profiles and resolves runtime availability from that store.
// We intentionally do NOT define custom models for Copilot in models.json.
// pi-coding-agent treats providers with models as replacements requiring apiKey.