fix(regression): merge aliased auth order provider keys

src/commands/onboard-auth.test.ts

@@ -257,6 +257,32 @@ describe("applyAuthProfileConfig", () => {
     });
   });
 
+  it("merges split canonical and aliased auth.order entries for the same provider", () => {
+    const next = applyAuthProfileConfig(
+      {
+        auth: {
+          profiles: {
+            "zai:default": { provider: "z.ai", mode: "api_key" },
+            "zai:backup": { provider: "z-ai", mode: "token" },
+          },
+          order: {
+            zai: ["zai:default"],
+            "z.ai": ["zai:backup"],
+          },
+        },
+      },
+      {
+        profileId: "zai:work",
+        provider: "z-ai",
+        mode: "oauth",
+      },
+    );
+
+    expect(next.auth?.order).toEqual({
+      zai: ["zai:work", "zai:default", "zai:backup"],
+    });
+  });
+
   it("keeps implicit round-robin when no mixed provider modes are present", () => {
     const next = applyAuthProfileConfig(
       {

src/plugins/provider-auth-helpers.ts

@@ -4,7 +4,7 @@ import type { OAuthCredentials } from "@mariozechner/pi-ai";
 import { resolveOpenClawAgentDir } from "../agents/agent-paths.js";
 import { buildAuthProfileId } from "../agents/auth-profiles/identity.js";
 import { upsertAuthProfile } from "../agents/auth-profiles/profiles.js";
-import { findNormalizedProviderKey, normalizeProviderIdForAuth } from "../agents/provider-id.js";
+import { normalizeProviderIdForAuth } from "../agents/provider-id.js";
 import type { OpenClawConfig } from "../config/config.js";
 import { resolveStateDir } from "../config/paths.js";
 import {
@@ -131,9 +131,13 @@ export function applyAuthProfileConfig(
 
   // Maintain `auth.order` when it already exists. Additionally, if we detect
   // mixed auth modes for the same provider, keep the newly selected profile first.
-  const existingProviderKey = findNormalizedProviderKey(cfg.auth?.order, normalizedProvider);
+  const matchingProviderOrderEntries = Object.entries(cfg.auth?.order ?? {}).filter(
+    ([providerId]) => normalizeProviderIdForAuth(providerId) === normalizedProvider,
+  );
   const existingProviderOrder =
-    existingProviderKey !== undefined ? cfg.auth?.order?.[existingProviderKey] : undefined;
+    matchingProviderOrderEntries.length > 0
+      ? [...new Set(matchingProviderOrderEntries.flatMap(([, order]) => order))]
+      : undefined;
   const preferProfileFirst = params.preferProfileFirst ?? true;
   const reorderedProviderOrder =
     existingProviderOrder && preferProfileFirst
@@ -155,10 +159,10 @@ export function applyAuthProfileConfig(
         ]
       : undefined;
   const baseOrder =
-    existingProviderKey && existingProviderKey !== normalizedProvider
+    matchingProviderOrderEntries.length > 0
       ? Object.fromEntries(
           Object.entries(cfg.auth?.order ?? {}).filter(
-            ([providerId]) => providerId !== existingProviderKey,
+            ([providerId]) => normalizeProviderIdForAuth(providerId) !== normalizedProvider,
           ),
         )
       : cfg.auth?.order;