feat(cli): add models auth logout (#114407)

src/plugins/provider-auth-helpers.ts

@@ -239,6 +239,51 @@ export function applyAuthProfileConfig(
   };
 }
 
+/** Returns true when config still names a removed auth profile. */
+export function configReferencesAuthProfile(cfg: OpenClawConfig, profileId: string): boolean {
+  return (
+    Boolean(cfg.auth?.profiles?.[profileId]) ||
+    Object.values(cfg.auth?.order ?? {}).some((order) => order.includes(profileId))
+  );
+}
+
+/**
+ * Counterpart to {@link applyAuthProfileConfig}: drops a profile from
+ * `auth.profiles` and every `auth.order` list. An emptied provider order is
+ * deleted rather than left as `[]`, because an authored empty order is a hard
+ * "select no profiles" instruction and would disable the provider entirely.
+ */
+export function removeAuthProfileConfig(cfg: OpenClawConfig, profileId: string): OpenClawConfig {
+  if (!configReferencesAuthProfile(cfg, profileId)) {
+    return cfg;
+  }
+  const profiles = Object.fromEntries(
+    Object.entries(cfg.auth?.profiles ?? {}).filter(([id]) => id !== profileId),
+  );
+  const order = Object.entries(cfg.auth?.order ?? {}).reduce<Record<string, string[]>>(
+    (acc, [providerId, providerOrder]) => {
+      const next = providerOrder.filter((id) => id !== profileId);
+      // Drop only an order this removal emptied. An order that was already
+      // empty is an authored "select no profiles" instruction for an unrelated
+      // provider and must survive untouched.
+      if (next.length > 0 || next.length === providerOrder.length) {
+        acc[providerId] = next;
+      }
+      return acc;
+    },
+    {},
+  );
+  const { order: _droppedOrder, ...auth } = cfg.auth ?? {};
+  return {
+    ...cfg,
+    auth: {
+      ...auth,
+      profiles,
+      ...(Object.keys(order).length > 0 ? { order } : {}),
+    },
+  };
+}
+
 /** Resolve real path, returning null if the target doesn't exist. */
 function safeRealpathSync(dir: string): string | null {
   try {