diff --git a/src/agents/model-auth.profiles.test.ts b/src/agents/model-auth.profiles.test.ts
index b7db25f7d7d..03305096421 100644
--- a/src/agents/model-auth.profiles.test.ts
+++ b/src/agents/model-auth.profiles.test.ts
@@ -24,6 +24,7 @@ vi.mock("../plugins/provider-runtime.js", () => ({
   },
   formatProviderAuthProfileApiKeyWithPlugin: async () => undefined,
   refreshProviderOAuthCredentialWithPlugin: async () => null,
+  resolveExternalAuthProfilesWithPlugins: () => [],
   resolveProviderSyntheticAuthWithPlugin: (params: {
     provider: string;
     context: { providerConfig?: { api?: string; baseUrl?: string; models?: unknown[] } };
diff --git a/src/agents/model-auth.test.ts b/src/agents/model-auth.test.ts
index 331cdef1934..bf49a8af69c 100644
--- a/src/agents/model-auth.test.ts
+++ b/src/agents/model-auth.test.ts
@@ -22,6 +22,7 @@ import {
 
 vi.mock("../plugins/provider-runtime.js", () => ({
   buildProviderMissingAuthMessageWithPlugin: () => undefined,
+  resolveExternalAuthProfilesWithPlugins: () => [],
   shouldDeferProviderSyntheticProfileAuthWithPlugin: (params: {
     provider: string;
     context: { resolvedApiKey?: string };
diff --git a/src/agents/model-selection.test.ts b/src/agents/model-selection.test.ts
index ac4f2a72343..f060c203636 100644
--- a/src/agents/model-selection.test.ts
+++ b/src/agents/model-selection.test.ts
@@ -134,6 +134,10 @@ describe("model-selection", () => {
   });
 
   describe("isCliProvider", () => {
+    it("returns true for setup-registered cli backends", () => {
+      expect(isCliProvider("claude-cli", {} as OpenClawConfig)).toBe(true);
+    });
+
     it("returns false for provider ids", () => {
       expect(isCliProvider("example-cli", {} as OpenClawConfig)).toBe(false);
     });
diff --git a/src/agents/model-selection.ts b/src/agents/model-selection.ts
index ffce370af72..f81c859e443 100644
--- a/src/agents/model-selection.ts
+++ b/src/agents/model-selection.ts
@@ -7,6 +7,7 @@ import {
 } from "../config/model-input.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { resolveRuntimeCliBackends } from "../plugins/cli-backends.runtime.js";
+import { resolvePluginSetupCliBackend } from "../plugins/setup-registry.js";
 import { sanitizeForLog, stripAnsi } from "../terminal/ansi.js";
 import {
   resolveAgentConfig,
@@ -93,6 +94,9 @@ export function isCliProvider(provider: string, cfg?: OpenClawConfig): boolean {
   if (cliBackends.some((backend) => normalizeProviderId(backend.id) === normalized)) {
     return true;
   }
+  if (resolvePluginSetupCliBackend({ backend: normalized })) {
+    return true;
+  }
   const backends = cfg?.agents?.defaults?.cliBackends ?? {};
   return Object.keys(backends).some((key) => normalizeProviderId(key) === normalized);
 }
diff --git a/src/agents/pi-embedded-runner/model.forward-compat.errors-and-overrides.test.ts b/src/agents/pi-embedded-runner/model.forward-compat.errors-and-overrides.test.ts
index 915162b2b20..70bae435936 100644
--- a/src/agents/pi-embedded-runner/model.forward-compat.errors-and-overrides.test.ts
+++ b/src/agents/pi-embedded-runner/model.forward-compat.errors-and-overrides.test.ts
@@ -104,7 +104,7 @@ describe("resolveModel forward-compat errors and overrides", () => {
     expectResolvedForwardCompatFallbackResult({
       result: resolveModelForTest("google-antigravity", "claude-opus-4-6-thinking", "/tmp/agent"),
       expectedModel: {
-        api: "google-generative-ai",
+        api: "google-gemini-cli",
         baseUrl: "https://cloudcode-pa.googleapis.com",
         id: "claude-opus-4-6-thinking",
         provider: "google-antigravity",
diff --git a/src/agents/provider-request-config.test.ts b/src/agents/provider-request-config.test.ts
index df58847d189..22d201c7eb0 100644
--- a/src/agents/provider-request-config.test.ts
+++ b/src/agents/provider-request-config.test.ts
@@ -475,7 +475,7 @@ describe("provider request config", () => {
     });
 
     expect(resolved.baseUrl).toBe("https://api.openai.com/v1");
-    expect(resolved.allowPrivateNetwork).toBe(true);
+    expect(resolved.allowPrivateNetwork).toBe(false);
     expect(resolved.policy.endpointClass).toBe("openai-public");
     expect(resolved.capabilities.allowsResponsesStore).toBe(true);
     expect(resolved.headers).toMatchObject({