fix: preserve workspace auth in model registry discovery

CHANGELOG.md

@@ -62,6 +62,7 @@ Docs: https://docs.openclaw.ai
 - Cron/Gateway: abort and bounded-clean up timed-out isolated agent turns before recording the timeout, so stale cron sessions cannot leave Discord or other chat lanes stuck in `processing` after a timeout. Thanks @vincentkoc.
 - Agents/errors: suppress malformed streaming tool-call JSON fragments before they reach chat surfaces while preserving provider request-validation diagnostics. Fixes #59076; keeps #59080 as duplicate coverage. (#59118) Thanks @singleGanghood.
 - CLI/models: restore provider-filtered `models list --all --provider <id>` rows for providers without manifest/static catalog coverage, including Anthropic and Amazon Bedrock, while keeping the compatibility fallback off expensive availability and resolver paths. Thanks @shakkernerd.
+- CLI/models: keep manifest auth-evidence credentials visible across `models status`, auth probes, and PI model discovery so workspace-scoped provider auth does not disagree between listing, probing, and execution. Thanks @shakkernerd.
 - CLI/models: move local credential evidence such as Google Vertex ADC into generic plugin manifest setup metadata so the model-list auth index stays declarative without provider-specific runtime branches. Thanks @shakkernerd.
 - CLI/models: compute the `models list` Auth column through one command-local provider auth index so row rendering no longer repeats auth profile, env, configured-provider, AWS, or synthetic-auth checks per model row. Thanks @shakkernerd.
 - CLI/models: move the OpenAI listable catalog into the plugin manifest so `models list --all --provider openai` uses the manifest fast path instead of loading provider runtime normalization hooks. Thanks @shakkernerd.

src/commands/models/list.list-command.ts

@@ -111,6 +111,7 @@ export async function modelsListCommand(
       providerFilter,
       normalizeModels: opts?.normalizeModels ?? Boolean(providerFilter),
       loadAvailability: opts?.loadAvailability,
+      workspaceDir,
     });
     modelRegistry = loaded.registry;
     registryModels = loaded.models;
@@ -123,7 +124,10 @@ export async function modelsListCommand(
       await loadRegistryState();
     } else if (!opts.all && opts.local) {
       const { loadConfiguredListModelRegistry } = await loadRegistryLoadModule();
-      const loaded = loadConfiguredListModelRegistry(cfg, entries, { providerFilter });
+      const loaded = loadConfiguredListModelRegistry(cfg, entries, {
+        providerFilter,
+        workspaceDir,
+      });
       modelRegistry = loaded.registry;
       discoveredKeys = loaded.discoveredKeys;
       availableKeys = loaded.availableKeys;

src/commands/models/list.registry-load.ts

@@ -10,7 +10,12 @@ import { modelKey } from "./shared.js";
 
 export async function loadListModelRegistry(
   cfg: OpenClawConfig,
-  opts?: { providerFilter?: string; normalizeModels?: boolean; loadAvailability?: boolean },
+  opts?: {
+    providerFilter?: string;
+    normalizeModels?: boolean;
+    loadAvailability?: boolean;
+    workspaceDir?: string;
+  },
 ) {
   const loaded = await loadModelRegistry(cfg, opts);
   return {
@@ -44,10 +49,14 @@ function findConfiguredRegistryModel(params: {
 export function loadConfiguredListModelRegistry(
   cfg: OpenClawConfig,
   entries: ConfiguredEntry[],
-  opts?: { providerFilter?: string },
+  opts?: { providerFilter?: string; workspaceDir?: string },
 ) {
   const agentDir = resolveOpenClawAgentDir();
-  const authStorage = discoverAuthStorage(agentDir, { readOnly: true });
+  const authStorage = discoverAuthStorage(agentDir, {
+    readOnly: true,
+    config: cfg,
+    workspaceDir: opts?.workspaceDir,
+  });
   const registry = discoverModels(authStorage, agentDir, {
     providerFilter: opts?.providerFilter,
   });

src/commands/models/list.registry.ts

@@ -87,13 +87,20 @@ function loadAvailableModels(
 
 export async function loadModelRegistry(
   cfg: OpenClawConfig,
-  opts?: { providerFilter?: string; normalizeModels?: boolean; loadAvailability?: boolean },
+  opts?: {
+    providerFilter?: string;
+    normalizeModels?: boolean;
+    loadAvailability?: boolean;
+    workspaceDir?: string;
+  },
 ) {
   const runtimeSuppression = opts?.normalizeModels !== false;
   const agentDir = resolveOpenClawAgentDir();
   const authStorage = discoverAuthStorage(agentDir, {
     readOnly: true,
     skipCredentials: opts?.loadAvailability === false,
+    config: cfg,
+    workspaceDir: opts?.workspaceDir,
   });
   const registry = discoverModels(authStorage, agentDir, {
     providerFilter: opts?.providerFilter,