mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-12 21:53:00 -06:00
fix(google): align unsupported CLI auth paths (#118034)
This commit is contained in:
Vincent Koc
+1
-1
@@ -35,7 +35,7 @@ openclaw models scan
|
||||
Bare `openclaw models` is equivalent to `openclaw models status`.
|
||||
`openclaw models --json` returns the same object as `openclaw models status --json`.
|
||||
|
||||
`openclaw models status` shows the resolved default/fallbacks plus an auth overview. For plugin-owned agent runtimes such as Codex, it also checks whether the owning plugin is enabled and passed startup payload verification. A route with valid credentials but an unavailable runtime reports `status: unavailable` instead of `usable`; JSON output includes separate `authStatus`, `runtimeStatus`, and bounded runtime diagnostics. When provider usage snapshots are available, the OAuth/API-key status section includes provider usage windows and quota snapshots. Current usage-window providers: Anthropic, GitHub Copilot, Gemini CLI, OpenAI, MiniMax, Xiaomi, and z.ai. Usage auth comes from provider-specific hooks when available; otherwise OpenClaw falls back to matching OAuth/API-key credentials from auth profiles, env, or config.
|
||||
`openclaw models status` shows the resolved default/fallbacks plus an auth overview. For plugin-owned agent runtimes such as Codex, it also checks whether the owning plugin is enabled and passed startup payload verification. A route with valid credentials but an unavailable runtime reports `status: unavailable` instead of `usable`; JSON output includes separate `authStatus`, `runtimeStatus`, and bounded runtime diagnostics. When provider usage snapshots are available, the OAuth/API-key status section includes provider usage windows and quota snapshots. Current usage-window providers: Anthropic, GitHub Copilot, OpenAI, MiniMax, Xiaomi, and z.ai. Usage auth comes from provider-specific hooks when available; otherwise OpenClaw falls back to matching OAuth/API-key credentials from auth profiles, env, or config.
|
||||
|
||||
In `--json` output, `auth.providers` is the env/config/store-aware provider overview, while `auth.oauth` is auth-store profile health only.
|
||||
|
||||
|
||||
@@ -108,7 +108,7 @@ Credential types:
|
||||
OAuth logins create distinct profiles so multiple accounts can coexist.
|
||||
|
||||
- Default: `provider:default` when no email is available.
|
||||
- OAuth with email: `provider:<email>` (for example `google-antigravity:user@gmail.com`).
|
||||
- OAuth with email: `provider:<email>` (for example `openai:user@example.com`).
|
||||
|
||||
Profiles live in the per-agent `openclaw-agent.sqlite` auth profile store.
|
||||
|
||||
|
||||
@@ -315,7 +315,6 @@ provider-neutral for CLI, app, and Control UI consumers.
|
||||
- **DeepSeek**: API key via env/config/auth store (`DEEPSEEK_API_KEY`).
|
||||
Shows each provider-reported currency balance.
|
||||
- **GitHub Copilot**: OAuth tokens in auth profiles.
|
||||
- **Gemini CLI**: existing OAuth profiles or supported Google API-key profiles.
|
||||
- **MiniMax**: API key or MiniMax OAuth auth profile. OpenClaw treats
|
||||
`minimax`, `minimax-cn`, and `minimax-portal` as the same MiniMax quota
|
||||
surface, prefers stored MiniMax OAuth when present, and otherwise falls back
|
||||
|
||||
@@ -154,7 +154,7 @@ Further restrict tools for specific providers or models. Order: base profile →
|
||||
tools: {
|
||||
profile: "coding",
|
||||
byProvider: {
|
||||
"google-antigravity": { profile: "minimal" },
|
||||
anthropic: { profile: "minimal" },
|
||||
"openai/gpt-5.4": { allow: ["group:fs", "sessions_list"] },
|
||||
},
|
||||
},
|
||||
|
||||
@@ -70,7 +70,7 @@ Rules of thumb:
|
||||
- Tool policy is the hard stop: `/exec` cannot override a denied `exec` tool.
|
||||
- Tool policy filters tool availability by name; it does not inspect side effects inside `exec`. If `exec` is allowed, denying `write`, `edit`, or `apply_patch` does not make shell commands read-only.
|
||||
- `/exec` only changes session defaults for authorized senders; it does not grant tool access.
|
||||
- Provider tool keys accept either `provider` (e.g. `google-antigravity`) or `provider/model` (e.g. `openai/gpt-5.4`).
|
||||
- Provider tool keys accept either `provider` (e.g. `anthropic`) or `provider/model` (e.g. `openai/gpt-5.4`).
|
||||
- Gateway logs include `agents/tool-policy` audit entries when a tool policy step removes tools or a sandbox tool policy blocks a call. Use `openclaw logs` to see the rule label, config key, and affected tool names.
|
||||
|
||||
### Tool groups (shorthands)
|
||||
|
||||
@@ -103,7 +103,7 @@ MiniMax M3 uses `minimax/MiniMax-M3` as its default provider/model reference.
|
||||
- Exhaustive sweeps use `OPENCLAW_LIVE_TEST_TIMEOUT_MS` for the whole direct-model test timeout. Default: 60 minutes.
|
||||
- Direct-model probes run with 20-way parallelism by default; set `OPENCLAW_LIVE_MODEL_CONCURRENCY` to override.
|
||||
- How to select providers:
|
||||
- `OPENCLAW_LIVE_PROVIDERS="google,google-antigravity,google-gemini-cli"` (comma allowlist)
|
||||
- `OPENCLAW_LIVE_PROVIDERS="google,google-gemini-cli"` (comma allowlist)
|
||||
- Where keys come from:
|
||||
- By default: profile store and env fallbacks
|
||||
- Set `OPENCLAW_LIVE_REQUIRE_PROFILE_KEYS=1` to enforce **profile store** only
|
||||
@@ -136,7 +136,7 @@ MiniMax M3 uses `minimax/MiniMax-M3` as its default provider/model reference.
|
||||
- Or set `OPENCLAW_LIVE_GATEWAY_MODELS="provider/model"` (or comma list) to narrow
|
||||
- Modern/all and small gateway sweeps default to their curated-list length as a cap; set `OPENCLAW_LIVE_GATEWAY_MAX_MODELS=0` for an exhaustive selected sweep or a positive number for a smaller cap.
|
||||
- How to select providers (avoid "OpenRouter everything"):
|
||||
- `OPENCLAW_LIVE_GATEWAY_PROVIDERS="google,google-antigravity,google-gemini-cli,openai,anthropic,zai,minimax"` (comma allowlist)
|
||||
- `OPENCLAW_LIVE_GATEWAY_PROVIDERS="google,google-gemini-cli,openai,anthropic,zai,minimax"` (comma allowlist)
|
||||
- Tool + image probes are always on in this live test:
|
||||
- `read` probe + `exec+read` probe (tool stress)
|
||||
- image probe runs when the model advertises image input support
|
||||
@@ -525,9 +525,8 @@ Narrow, explicit allowlists are fastest and least flaky:
|
||||
- Z.AI Coding Plan GLM-5.2 direct smoke:
|
||||
- `ZAI_CODING_LIVE_TEST=1 pnpm test:live src/agents/zai.live.test.ts`
|
||||
|
||||
- Google focus (Gemini API key + Antigravity):
|
||||
- Google focus:
|
||||
- Gemini (API key): `OPENCLAW_LIVE_GATEWAY_MODELS="google/gemini-3.5-flash" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts`
|
||||
- Antigravity (OAuth): `OPENCLAW_LIVE_GATEWAY_MODELS="google-antigravity/claude-opus-4-6-thinking,google-antigravity/gemini-3-pro-high" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts`
|
||||
|
||||
- Google adaptive thinking smoke (`qa manual` from the private QA CLI - requires `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1` and a source checkout; see [QA overview](/concepts/qa-e2e-automation)):
|
||||
- Gemini 3 dynamic default: `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1 pnpm openclaw qa manual --provider-mode live-frontier --model google/gemini-3.1-pro-preview --alt-model google/gemini-3.1-pro-preview --message '/think adaptive Reply exactly: GEMINI_ADAPTIVE_OK' --timeout-ms 180000`
|
||||
@@ -536,8 +535,8 @@ Narrow, explicit allowlists are fastest and least flaky:
|
||||
Notes:
|
||||
|
||||
- `google/...` uses the Gemini API (API key).
|
||||
- `google-antigravity/...` uses the Antigravity OAuth bridge (Cloud Code Assist-style agent endpoint).
|
||||
- `google-gemini-cli/...` uses the local Gemini CLI on your machine (separate auth + tooling quirks).
|
||||
- `google-antigravity/...` is not a registered provider or supported setup path. Do not add it to live-test allowlists.
|
||||
- Gemini API vs Gemini CLI:
|
||||
- API: OpenClaw calls Google's hosted Gemini API over HTTP (API key / profile auth); this is what most users mean by "Gemini".
|
||||
- CLI: OpenClaw shells out to a local `gemini` binary; it has its own auth and can behave differently (streaming/tool support/version skew).
|
||||
@@ -594,7 +593,7 @@ Notes on the modern list:
|
||||
Run gateway smoke with tools + image across a hand-picked cross-provider set:
|
||||
|
||||
```bash
|
||||
OPENCLAW_LIVE_GATEWAY_MODELS="openai/gpt-5.6-luna,anthropic/claude-opus-4-6,google/gemini-3.1-pro-preview,google/gemini-3.5-flash,google-antigravity/claude-opus-4-6-thinking,deepseek/deepseek-v4-flash,zai/glm-5.1,minimax/MiniMax-M3" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts
|
||||
OPENCLAW_LIVE_GATEWAY_MODELS="openai/gpt-5.6-luna,anthropic/claude-opus-4-6,google/gemini-3.1-pro-preview,google/gemini-3.5-flash,deepseek/deepseek-v4-flash,zai/glm-5.1,minimax/MiniMax-M3" pnpm test:live src/gateway/gateway-models.profiles.live.test.ts
|
||||
```
|
||||
|
||||
Optional additional coverage outside the curated lists (nice to have, pick a "tools"-capable model you have enabled):
|
||||
@@ -612,7 +611,7 @@ If you have keys enabled, you can also test via:
|
||||
|
||||
More providers you can include in the live matrix (if you have creds/config):
|
||||
|
||||
- First-party provider plugins: `anthropic`, `cerebras`, `github-copilot`, `google`, `google-antigravity`, `google-gemini-cli`, `google-vertex`, `groq`, `mistral`, `openai`, `openrouter`, `opencode`, `opencode-go`, `xai`, `zai`
|
||||
- First-party provider plugins: `anthropic`, `cerebras`, `github-copilot`, `google`, `google-gemini-cli`, `google-vertex`, `groq`, `mistral`, `openai`, `openrouter`, `opencode`, `opencode-go`, `xai`, `zai`
|
||||
- Via `models.providers` (custom endpoints): `minimax` (cloud/API), plus any OpenAI/Anthropic-compatible proxy (LM Studio, vLLM, LiteLLM, etc.)
|
||||
|
||||
<Tip>
|
||||
|
||||
@@ -34,7 +34,7 @@ Map of OpenClaw features that can call paid provider APIs, where each reads its
|
||||
**CLI usage windows** (provider quotas, not per-message cost)
|
||||
|
||||
- `openclaw status --usage` and `openclaw channels list` show provider **usage windows** as `X% left`.
|
||||
- Current usage-window providers: Anthropic, ClawRouter, DeepSeek, GitHub Copilot, Gemini CLI, MiniMax, OpenAI (covers ChatGPT/Codex OAuth/token auth), Xiaomi, and z.ai. See [Models CLI](/cli/models) and [Channels CLI](/cli/channels) for the full provider/flag list.
|
||||
- Current usage-window providers: Anthropic, ClawRouter, DeepSeek, GitHub Copilot, MiniMax, OpenAI (covers ChatGPT/Codex OAuth/token auth), Xiaomi, and z.ai. See [Models CLI](/cli/models) and [Channels CLI](/cli/channels) for the full provider/flag list.
|
||||
- MiniMax's raw `usage_percent` / `usagePercent` fields report remaining quota, so OpenClaw inverts them; count-based fields win when present. If the response includes a `model_remains` array, OpenClaw picks the chat-model entry, derives the window label from timestamps when needed, and includes the model name in the plan label.
|
||||
- Usage auth comes from provider-specific hooks when available, otherwise OpenClaw falls back to matching OAuth/API-key credentials from auth profiles, env, or config.
|
||||
|
||||
|
||||
@@ -126,8 +126,7 @@ Other surfaces:
|
||||
- **CLI:** `openclaw status --usage` and `openclaw channels list` show
|
||||
normalized provider quota windows (`X% left`, not per-response costs).
|
||||
Current usage-window providers: Claude (Anthropic), ClawRouter, Copilot
|
||||
(GitHub), DeepSeek, Gemini (Google Gemini CLI), MiniMax, OpenAI, Xiaomi,
|
||||
Xiaomi Token Plan, and z.ai.
|
||||
(GitHub), DeepSeek, MiniMax, OpenAI, Xiaomi, Xiaomi Token Plan, and z.ai.
|
||||
|
||||
Usage surfaces normalize common provider-native field aliases before
|
||||
display. For OpenAI-family Responses traffic, that includes both
|
||||
|
||||
@@ -228,7 +228,7 @@ The filtering order is:
|
||||
- Each level can further restrict tools, but cannot grant back denied tools from earlier levels.
|
||||
- If `agents.entries.*.tools.sandbox.tools` is set, it replaces `tools.sandbox.tools` for that agent.
|
||||
- If `agents.entries.*.tools.profile` is set, it overrides `tools.profile` for that agent.
|
||||
- Provider tool keys accept either `provider` (e.g. `google-antigravity`) or `provider/model` (e.g. `openai/gpt-5.4`).
|
||||
- Provider tool keys accept either `provider` (e.g. `anthropic`) or `provider/model` (e.g. `openai/gpt-5.4`).
|
||||
|
||||
</Accordion>
|
||||
<Accordion title="Empty allowlist behavior">
|
||||
|
||||
@@ -33,6 +33,9 @@ type GoogleManifest = {
|
||||
paths?: Array<{ path?: string; expected?: string }>;
|
||||
};
|
||||
};
|
||||
contracts?: {
|
||||
usageProviders?: string[];
|
||||
};
|
||||
uiHints?: Record<string, { sensitive?: boolean }>;
|
||||
};
|
||||
|
||||
@@ -98,6 +101,10 @@ describe("google manifest model catalog", () => {
|
||||
expect(choices.some((choice) => choice.provider === "google-gemini-cli")).toBe(false);
|
||||
});
|
||||
|
||||
it("does not advertise retired Gemini CLI quota hooks", () => {
|
||||
expect(loadManifest().contracts?.usageProviders).toBeUndefined();
|
||||
});
|
||||
|
||||
it("suppresses retired Gemini chat model identifiers for all Google chat providers", () => {
|
||||
const manifest = loadManifest();
|
||||
const suppressionRefs = new Set(
|
||||
|
||||
@@ -738,8 +738,7 @@
|
||||
"realtimeVoiceProviders": ["google"],
|
||||
"speechProviders": ["google"],
|
||||
"videoGenerationProviders": ["google"],
|
||||
"webSearchProviders": ["gemini"],
|
||||
"usageProviders": ["google-gemini-cli"]
|
||||
"webSearchProviders": ["gemini"]
|
||||
},
|
||||
"mediaUnderstandingProviderMetadata": {
|
||||
"google": {
|
||||
|
||||
@@ -1566,14 +1566,14 @@ describe("buildFailoverRemediationHint", () => {
|
||||
);
|
||||
});
|
||||
|
||||
it("returns a hint for auth_permanent as well", () => {
|
||||
it("routes Gemini CLI auth failures to supported recovery paths", () => {
|
||||
const err = new FailoverError("revoked", {
|
||||
reason: "auth_permanent",
|
||||
provider: "google-gemini-cli",
|
||||
model: "gemini-3.1-pro-preview",
|
||||
});
|
||||
expect(buildFailoverRemediationHint(err)).toBe(
|
||||
"Re-authenticate with: openclaw models auth login --provider 'google-gemini-cli' --force",
|
||||
"Authenticate in Gemini CLI directly, or configure a supported Google API key with: openclaw configure",
|
||||
);
|
||||
});
|
||||
|
||||
|
||||
@@ -763,6 +763,9 @@ export function buildFailoverRemediationHint(err: unknown): string | undefined {
|
||||
if (!provider) {
|
||||
return undefined;
|
||||
}
|
||||
if (provider === "google-gemini-cli") {
|
||||
return `Authenticate in Gemini CLI directly, or configure a supported Google API key with: ${formatCliCommand("openclaw configure")}`;
|
||||
}
|
||||
const command = buildProviderReauthCommand(provider);
|
||||
return command ? `Re-authenticate with: ${command}` : undefined;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user