@blockrun/clawrouter 0.12.259 → 0.12.261

package/dist/cli.js

@@ -38926,6 +38926,14 @@ var init_models = __esm({
         toolCalling: true
       },
       {
+        // vision LIVE-VERIFIED 2026-08-31: 3 of 3 proxy probes with a 64x64 solid-red
+        // PNG answered "Red", each served as itself. blockrun's catalog does not tag
+        // it (same under-claim class as the Claude models below), and without the
+        // flag filterByVision() excluded the CHEAPEST paid model in the catalog from
+        // every image request — so image turns escalated past a $0.10/$0.40 rung that
+        // handles them. It is also router-core's eco SIMPLE cheapest-paid fallback.
+        // Unrelated to its presence in TOOL_NONCOMPLIANT_MODELS (proxy.ts), which is
+        // about tool schemas, not image input.
         id: "google/gemini-2.5-flash-lite",
         name: "Gemini 2.5 Flash Lite",
         version: "2.5",
@@ -38933,6 +38941,7 @@ var init_models = __esm({
         outputPrice: 0.4,
         contextWindow: 1048576,
         maxOutput: 65536,
+        vision: true,
         toolCalling: true
       },
       {
@@ -226792,7 +226801,8 @@ import {
   readdirSync,
   mkdirSync as mkdirSync3,
   copyFileSync,
-  renameSync as renameSync2
+  renameSync as renameSync2,
+  unlinkSync
 } from "fs";
 import { readFile as readFileAsync } from "fs/promises";
 import { homedir as homedir13 } from "os";
@@ -227137,6 +227147,15 @@ function injectAuthProfile(logger48) {
     for (const agentId of agents) {
       const authDir = join16(agentsDir, agentId, "agent");
       const authPath = join16(authDir, "auth-profiles.json");
+      const sqlitePath = join16(authDir, "openclaw-agent.sqlite");
+      if (existsSync4(sqlitePath)) {
+        removeInjectedAuthPlaceholder(authPath, logger48, agentId);
+        continue;
+      }
+      if (agentId === "main") {
+        removeInjectedAuthPlaceholder(authPath, logger48, agentId);
+        continue;
+      }
       if (!existsSync4(authDir)) {
         try {
           mkdirSync3(authDir, { recursive: true });
@@ -227179,6 +227198,25 @@ function injectAuthProfile(logger48) {
     logger48.info(`Auth injection failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+function removeInjectedAuthPlaceholder(authPath, logger48, agentId) {
+  try {
+    if (!existsSync4(authPath)) return;
+    const parsed = JSON.parse(readTextFileSync(authPath));
+    const profiles = parsed?.profiles;
+    if (!profiles || typeof profiles !== "object" || Array.isArray(profiles)) return;
+    const keys = Object.keys(profiles);
+    if (keys.length !== 1 || keys[0] !== "blockrun:default") return;
+    const entry = profiles["blockrun:default"];
+    if (!entry || typeof entry !== "object") return;
+    const profile = entry;
+    if (profile.type !== "api_key" || profile.provider !== "blockrun" || profile.key !== "x402-proxy-handles-auth") {
+      return;
+    }
+    unlinkSync(authPath);
+    logger48.info(`Removed legacy BlockRun auth placeholder for agent: ${agentId}`);
+  } catch {
+  }
+}
 function clearDeferredProxyStartTimer(proc = process) {
   if (!proc.__clawrouterDeferredStartTimer) return false;
   clearTimeout(proc.__clawrouterDeferredStartTimer);

package/dist/index.d.ts

@@ -1692,8 +1692,21 @@ declare function syncAgentModelCache(logger: {
 }): void;
 /**
  * Inject dummy auth profile for BlockRun into agent auth stores.
- * OpenClaw's agent system looks for auth credentials even if provider has auth: [].
- * We inject a placeholder so the lookup succeeds (proxy handles real auth internally).
+ *
+ * The legacy ``auth-profiles.json`` write is now deliberately narrow:
+ *
+ * - Wherever ``openclaw-agent.sqlite`` exists, the SQLite auth store is
+ *   authoritative. Writing the legacy JSON beside it is at best ignored, at
+ *   worst a failed-closed migration trigger: since OpenClaw 2026.8.1 a
+ *   leftover legacy file beside a store that holds no profiles fails auth
+ *   migration for the whole agent fleet. So we never write there, and we
+ *   clean up the placeholder we previously injected.
+ * - The shared auth-owner directory (``main``) is managed by OpenClaw
+ *   itself; a placeholder written there can shadow that state. The
+ *   provider's real auth comes from the x402 proxy (and the apiKey
+ *   injectModelsConfig writes into openclaw.json), so nothing is lost.
+ * - Only on very old installs with no SQLite store at all do we keep the
+ *   original JSON bootstrap, which those releases import.
  */
 declare function injectAuthProfile(logger: {
     info: (msg: string) => void;

package/dist/index.js

@@ -1329,6 +1329,14 @@ var init_models = __esm({
         toolCalling: true
       },
       {
+        // vision LIVE-VERIFIED 2026-08-31: 3 of 3 proxy probes with a 64x64 solid-red
+        // PNG answered "Red", each served as itself. blockrun's catalog does not tag
+        // it (same under-claim class as the Claude models below), and without the
+        // flag filterByVision() excluded the CHEAPEST paid model in the catalog from
+        // every image request — so image turns escalated past a $0.10/$0.40 rung that
+        // handles them. It is also router-core's eco SIMPLE cheapest-paid fallback.
+        // Unrelated to its presence in TOOL_NONCOMPLIANT_MODELS (proxy.ts), which is
+        // about tool schemas, not image input.
         id: "google/gemini-2.5-flash-lite",
         name: "Gemini 2.5 Flash Lite",
         version: "2.5",
@@ -1336,6 +1344,7 @@ var init_models = __esm({
         outputPrice: 0.4,
         contextWindow: 1048576,
         maxOutput: 65536,
+        vision: true,
         toolCalling: true
       },
       {
@@ -226539,7 +226548,8 @@ import {
   readdirSync,
   mkdirSync as mkdirSync3,
   copyFileSync,
-  renameSync as renameSync2
+  renameSync as renameSync2,
+  unlinkSync
 } from "fs";
 import { readFile as readFileAsync } from "fs/promises";
 import { homedir as homedir13 } from "os";
@@ -226884,6 +226894,15 @@ function injectAuthProfile(logger48) {
     for (const agentId of agents) {
       const authDir = join16(agentsDir, agentId, "agent");
       const authPath = join16(authDir, "auth-profiles.json");
+      const sqlitePath = join16(authDir, "openclaw-agent.sqlite");
+      if (existsSync3(sqlitePath)) {
+        removeInjectedAuthPlaceholder(authPath, logger48, agentId);
+        continue;
+      }
+      if (agentId === "main") {
+        removeInjectedAuthPlaceholder(authPath, logger48, agentId);
+        continue;
+      }
       if (!existsSync3(authDir)) {
         try {
           mkdirSync3(authDir, { recursive: true });
@@ -226926,6 +226945,25 @@ function injectAuthProfile(logger48) {
     logger48.info(`Auth injection failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+function removeInjectedAuthPlaceholder(authPath, logger48, agentId) {
+  try {
+    if (!existsSync3(authPath)) return;
+    const parsed = JSON.parse(readTextFileSync(authPath));
+    const profiles = parsed?.profiles;
+    if (!profiles || typeof profiles !== "object" || Array.isArray(profiles)) return;
+    const keys = Object.keys(profiles);
+    if (keys.length !== 1 || keys[0] !== "blockrun:default") return;
+    const entry = profiles["blockrun:default"];
+    if (!entry || typeof entry !== "object") return;
+    const profile = entry;
+    if (profile.type !== "api_key" || profile.provider !== "blockrun" || profile.key !== "x402-proxy-handles-auth") {
+      return;
+    }
+    unlinkSync(authPath);
+    logger48.info(`Removed legacy BlockRun auth placeholder for agent: ${agentId}`);
+  } catch {
+  }
+}
 function clearDeferredProxyStartTimer(proc = process) {
   if (!proc.__clawrouterDeferredStartTimer) return false;
   clearTimeout(proc.__clawrouterDeferredStartTimer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/clawrouter",
-  "version": "0.12.259",
+  "version": "0.12.261",
   "description": "Smart LLM router — save 84% on inference costs. 76 models (7 free), one wallet, x402 micropayments.",
   "type": "module",
   "main": "dist/index.js",