[codex] fix auth-backed provider discovery (#690)

Co-authored-by: zuolingxuan <zuolingxuan@bytedance.com>

tests/unit/openclaw-auth.test.ts

@@ -41,6 +41,12 @@ async function readAuthProfiles(agentId: string): Promise<Record<string, unknown
   return JSON.parse(content) as Record<string, unknown>;
 }
 
+async function writeAgentAuthProfiles(agentId: string, store: Record<string, unknown>): Promise<void> {
+  const agentDir = join(testHome, '.openclaw', 'agents', agentId, 'agent');
+  await mkdir(agentDir, { recursive: true });
+  await writeFile(join(agentDir, 'auth-profiles.json'), JSON.stringify(store, null, 2), 'utf8');
+}
+
 describe('saveProviderKeyToOpenClaw', () => {
   beforeEach(async () => {
     vi.resetModules();
@@ -201,3 +207,89 @@ describe('sanitizeOpenClawConfig', () => {
     logSpy.mockRestore();
   });
 });
+
+describe('auth-backed provider discovery', () => {
+  beforeEach(async () => {
+    vi.resetModules();
+    vi.restoreAllMocks();
+    await rm(testHome, { recursive: true, force: true });
+    await rm(testUserData, { recursive: true, force: true });
+  });
+
+  it('detects active providers from openclaw auth profiles and per-agent auth stores', async () => {
+    await writeOpenClawJson({
+      agents: {
+        list: [
+          { id: 'main', name: 'Main', default: true, workspace: '~/.openclaw/workspace', agentDir: '~/.openclaw/agents/main/agent' },
+          { id: 'work', name: 'Work', workspace: '~/.openclaw/workspace-work', agentDir: '~/.openclaw/agents/work/agent' },
+        ],
+      },
+      auth: {
+        profiles: {
+          'openai-codex:default': { type: 'oauth', provider: 'openai-codex', access: 'acc', refresh: 'ref', expires: 1 },
+          'anthropic:default': { type: 'api_key', provider: 'anthropic', key: 'sk-ant' },
+        },
+      },
+    });
+
+    await writeAgentAuthProfiles('work', {
+      version: 1,
+      profiles: {
+        'google-gemini-cli:default': {
+          type: 'oauth',
+          provider: 'google-gemini-cli',
+          access: 'goog-access',
+          refresh: 'goog-refresh',
+          expires: 2,
+        },
+      },
+    });
+
+    const { getActiveOpenClawProviders } = await import('@electron/utils/openclaw-auth');
+
+    await expect(getActiveOpenClawProviders()).resolves.toEqual(
+      new Set(['openai', 'anthropic', 'google']),
+    );
+  });
+
+  it('seeds provider config entries from auth profiles when models.providers is empty', async () => {
+    await writeOpenClawJson({
+      agents: {
+        list: [
+          { id: 'main', name: 'Main', default: true, workspace: '~/.openclaw/workspace', agentDir: '~/.openclaw/agents/main/agent' },
+          { id: 'work', name: 'Work', workspace: '~/.openclaw/workspace-work', agentDir: '~/.openclaw/agents/work/agent' },
+        ],
+        defaults: {
+          model: {
+            primary: 'openai/gpt-5.4',
+          },
+        },
+      },
+      auth: {
+        profiles: {
+          'openai-codex:default': { type: 'oauth', provider: 'openai-codex', access: 'acc', refresh: 'ref', expires: 1 },
+        },
+      },
+    });
+
+    await writeAgentAuthProfiles('work', {
+      version: 1,
+      profiles: {
+        'anthropic:default': {
+          type: 'api_key',
+          provider: 'anthropic',
+          key: 'sk-ant',
+        },
+      },
+    });
+
+    const { getOpenClawProvidersConfig } = await import('@electron/utils/openclaw-auth');
+    const result = await getOpenClawProvidersConfig();
+
+    expect(result.defaultModel).toBe('openai/gpt-5.4');
+    expect(result.providers).toMatchObject({
+      openai: {},
+      anthropic: {},
+    });
+  });
+});

tests/unit/provider-service-stale-cleanup.test.ts

@@ -9,6 +9,7 @@ const mocks = vi.hoisted(() => ({
   getOpenClawProvidersConfig: vi.fn(),
   getOpenClawProviderKeyForType: vi.fn(),
   getAliasSourceTypes: vi.fn(),
+  getProviderDefinition: vi.fn(),
   loggerWarn: vi.fn(),
   loggerInfo: vi.fn(),
 }));
@@ -59,7 +60,7 @@ vi.mock('@electron/utils/logger', () => ({
 
 vi.mock('@electron/shared/providers/registry', () => ({
   PROVIDER_DEFINITIONS: [],
-  getProviderDefinition: vi.fn(),
+  getProviderDefinition: mocks.getProviderDefinition,
 }));
 
 import { ProviderService } from '@electron/services/providers/provider-service';
@@ -97,6 +98,7 @@ describe('ProviderService.listAccounts (openclaw.json as sole source of truth)',
     mocks.ensureProviderStoreMigrated.mockResolvedValue(undefined);
     setupDefaultKeyMapping();
     mocks.getAliasSourceTypes.mockReturnValue([]);
+    mocks.getProviderDefinition.mockReturnValue(undefined);
     mocks.getOpenClawProvidersConfig.mockResolvedValue({ providers: {}, defaultModel: undefined });
     mocks.listProviderAccounts.mockResolvedValue([]);
     service = new ProviderService();
@@ -288,4 +290,59 @@ describe('ProviderService.listAccounts (openclaw.json as sole source of truth)',
     expect(ids).toContain('openrouter-uuid');
     expect(ids).toContain('minimax-portal-cn-uuid');
   });
+
+  it('seeds builtin providers discovered from auth profiles without explicit models.providers entries', async () => {
+    mocks.listProviderAccounts.mockResolvedValue([]);
+    mocks.getActiveOpenClawProviders.mockResolvedValue(new Set(['openai', 'anthropic']));
+    mocks.getOpenClawProvidersConfig.mockResolvedValue({
+      providers: {
+        openai: {},
+        anthropic: {},
+      },
+      defaultModel: undefined,
+    });
+    mocks.getProviderDefinition.mockImplementation((key: string) => {
+      if (key === 'openai') {
+        return {
+          id: 'openai',
+          name: 'OpenAI',
+          defaultAuthMode: 'oauth_browser',
+          defaultModelId: 'gpt-5.2',
+          providerConfig: {
+            baseUrl: 'https://api.openai.com/v1',
+            api: 'openai-responses',
+          },
+        };
+      }
+      if (key === 'anthropic') {
+        return {
+          id: 'anthropic',
+          name: 'Anthropic',
+          defaultAuthMode: 'api_key',
+          defaultModelId: 'claude-opus-4-6',
+        };
+      }
+      return undefined;
+    });
+
+    const result = await service.listAccounts();
+
+    expect(mocks.saveProviderAccount).toHaveBeenCalledTimes(2);
+    expect(result).toHaveLength(2);
+    expect(result).toEqual(expect.arrayContaining([
+      expect.objectContaining({
+        id: 'openai',
+        vendorId: 'openai',
+        authMode: 'oauth_browser',
+        baseUrl: 'https://api.openai.com/v1',
+        model: 'gpt-5.2',
+      }),
+      expect.objectContaining({
+        id: 'anthropic',
+        vendorId: 'anthropic',
+        authMode: 'api_key',
+        model: 'claude-opus-4-6',
+      }),
+    ]));
+  });
 });