@blockrun/clawrouter 0.12.259 → 0.12.260

package/dist/cli.js

@@ -226792,7 +226792,8 @@ import {
   readdirSync,
   mkdirSync as mkdirSync3,
   copyFileSync,
-  renameSync as renameSync2
+  renameSync as renameSync2,
+  unlinkSync
 } from "fs";
 import { readFile as readFileAsync } from "fs/promises";
 import { homedir as homedir13 } from "os";
@@ -227137,6 +227138,15 @@ function injectAuthProfile(logger48) {
     for (const agentId of agents) {
       const authDir = join16(agentsDir, agentId, "agent");
       const authPath = join16(authDir, "auth-profiles.json");
+      const sqlitePath = join16(authDir, "openclaw-agent.sqlite");
+      if (existsSync4(sqlitePath)) {
+        removeInjectedAuthPlaceholder(authPath, logger48, agentId);
+        continue;
+      }
+      if (agentId === "main") {
+        removeInjectedAuthPlaceholder(authPath, logger48, agentId);
+        continue;
+      }
       if (!existsSync4(authDir)) {
         try {
           mkdirSync3(authDir, { recursive: true });
@@ -227179,6 +227189,25 @@ function injectAuthProfile(logger48) {
     logger48.info(`Auth injection failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+function removeInjectedAuthPlaceholder(authPath, logger48, agentId) {
+  try {
+    if (!existsSync4(authPath)) return;
+    const parsed = JSON.parse(readTextFileSync(authPath));
+    const profiles = parsed?.profiles;
+    if (!profiles || typeof profiles !== "object" || Array.isArray(profiles)) return;
+    const keys = Object.keys(profiles);
+    if (keys.length !== 1 || keys[0] !== "blockrun:default") return;
+    const entry = profiles["blockrun:default"];
+    if (!entry || typeof entry !== "object") return;
+    const profile = entry;
+    if (profile.type !== "api_key" || profile.provider !== "blockrun" || profile.key !== "x402-proxy-handles-auth") {
+      return;
+    }
+    unlinkSync(authPath);
+    logger48.info(`Removed legacy BlockRun auth placeholder for agent: ${agentId}`);
+  } catch {
+  }
+}
 function clearDeferredProxyStartTimer(proc = process) {
   if (!proc.__clawrouterDeferredStartTimer) return false;
   clearTimeout(proc.__clawrouterDeferredStartTimer);

package/dist/index.d.ts

@@ -1692,8 +1692,21 @@ declare function syncAgentModelCache(logger: {
 }): void;
 /**
  * Inject dummy auth profile for BlockRun into agent auth stores.
- * OpenClaw's agent system looks for auth credentials even if provider has auth: [].
- * We inject a placeholder so the lookup succeeds (proxy handles real auth internally).
+ *
+ * The legacy ``auth-profiles.json`` write is now deliberately narrow:
+ *
+ * - Wherever ``openclaw-agent.sqlite`` exists, the SQLite auth store is
+ *   authoritative. Writing the legacy JSON beside it is at best ignored, at
+ *   worst a failed-closed migration trigger: since OpenClaw 2026.8.1 a
+ *   leftover legacy file beside a store that holds no profiles fails auth
+ *   migration for the whole agent fleet. So we never write there, and we
+ *   clean up the placeholder we previously injected.
+ * - The shared auth-owner directory (``main``) is managed by OpenClaw
+ *   itself; a placeholder written there can shadow that state. The
+ *   provider's real auth comes from the x402 proxy (and the apiKey
+ *   injectModelsConfig writes into openclaw.json), so nothing is lost.
+ * - Only on very old installs with no SQLite store at all do we keep the
+ *   original JSON bootstrap, which those releases import.
  */
 declare function injectAuthProfile(logger: {
     info: (msg: string) => void;

package/dist/index.js

@@ -226539,7 +226539,8 @@ import {
   readdirSync,
   mkdirSync as mkdirSync3,
   copyFileSync,
-  renameSync as renameSync2
+  renameSync as renameSync2,
+  unlinkSync
 } from "fs";
 import { readFile as readFileAsync } from "fs/promises";
 import { homedir as homedir13 } from "os";
@@ -226884,6 +226885,15 @@ function injectAuthProfile(logger48) {
     for (const agentId of agents) {
       const authDir = join16(agentsDir, agentId, "agent");
       const authPath = join16(authDir, "auth-profiles.json");
+      const sqlitePath = join16(authDir, "openclaw-agent.sqlite");
+      if (existsSync3(sqlitePath)) {
+        removeInjectedAuthPlaceholder(authPath, logger48, agentId);
+        continue;
+      }
+      if (agentId === "main") {
+        removeInjectedAuthPlaceholder(authPath, logger48, agentId);
+        continue;
+      }
       if (!existsSync3(authDir)) {
         try {
           mkdirSync3(authDir, { recursive: true });
@@ -226926,6 +226936,25 @@ function injectAuthProfile(logger48) {
     logger48.info(`Auth injection failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+function removeInjectedAuthPlaceholder(authPath, logger48, agentId) {
+  try {
+    if (!existsSync3(authPath)) return;
+    const parsed = JSON.parse(readTextFileSync(authPath));
+    const profiles = parsed?.profiles;
+    if (!profiles || typeof profiles !== "object" || Array.isArray(profiles)) return;
+    const keys = Object.keys(profiles);
+    if (keys.length !== 1 || keys[0] !== "blockrun:default") return;
+    const entry = profiles["blockrun:default"];
+    if (!entry || typeof entry !== "object") return;
+    const profile = entry;
+    if (profile.type !== "api_key" || profile.provider !== "blockrun" || profile.key !== "x402-proxy-handles-auth") {
+      return;
+    }
+    unlinkSync(authPath);
+    logger48.info(`Removed legacy BlockRun auth placeholder for agent: ${agentId}`);
+  } catch {
+  }
+}
 function clearDeferredProxyStartTimer(proc = process) {
   if (!proc.__clawrouterDeferredStartTimer) return false;
   clearTimeout(proc.__clawrouterDeferredStartTimer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/clawrouter",
-  "version": "0.12.259",
+  "version": "0.12.260",
   "description": "Smart LLM router — save 84% on inference costs. 76 models (7 free), one wallet, x402 micropayments.",
   "type": "module",
   "main": "dist/index.js",