openclaw/docs/plugins/reference.md
Midhun V Nadh de8de9c569
feat: add Bifrost gateway setup and model discovery (#175509)
* feat(providers): add Bifrost provider and allow anonymous self-hosted gateways

Bifrost is an OpenAI-compatible LLM gateway that unifies 20+ providers, but
OpenClaw had no bundled provider for it, so operators configured it by hand.

Add extensions/bifrost following the LiteLLM provider shape: interactive setup
asks for the gateway base URL, optionally for a virtual key, then lists the
models served by the gateway's /openai/v1/models endpoint and defaults to the
first. Discovery failures name the reason before falling back to manual entry,
and a config change during discovery aborts before credentials are sent.

Point providers at Bifrost's OpenAI-compatible surface
(http://localhost:8080/openai) rather than the core /v1 API, so discovery and
chat completions share one base URL. Bifrost advertises provider-qualified model
IDs such as openai/gpt-4o-mini, which resolve as bifrost/openai/gpt-4o-mini.

A gateway started without authentication needs no credential, so setup records
auth: "none" instead of storing a key that resolves to nothing. That reuses the
existing explicit-no-auth owner rather than adding a second mechanism, and
re-running setup for a URL change keeps an already configured key.

The shared self-hosted setup helper forced a non-empty API key, which pushed
SGLang and vLLM users toward a placeholder value for servers that accept
anonymous requests. Accept an empty key there and record the provider as
auth: "none", matching what the config already models.

* feat(providers): add Bifrost provider icons

Bifrost shipped without artwork, so it was the only user-facing provider
with no assets/icon.png or assets/activity.svg and the only bundled
provider still falling back to a letter avatar in the model picker.

- assets/icon.png: 512x512 inversion of the official Apache-2.0 mark,
  dark-on-white to match the other bundled provider icons.
- assets/activity.svg and ProviderIcon-bifrost.svg: OpenClaw-authored
  gateway glyph (many upstreams converging on one endpoint), registered
  in PROVIDER_ICON_NAMES so the model picker stops falling back.
- ATTRIBUTION.md: documents both, pinning the upstream commit.

* fix(providers): narrow anonymous-provider assertion and raise config budget

- provider-self-hosted-setup.interactive.test.ts reached through
  result.configPatch.models.providers.fixture, but configPatch, models and
  providers are all optional, so strict null checking rejected it. Bind the
  provider entry to a local and assert on that instead of a non-null cast.
- The Bifrost plugin schema grows the plugin config surface 4693 -> 4714.
  Regenerate the baseline hash and raise the budget deliberately.

* fix(providers): stop Bifrost onboarding from discarding a supplied key

ClawSweeper flagged two authentication defects, both confirmed against source.
resolveExplicitProviderNoAuth treats auth:"none" as terminal and strips the
Authorization header, so a stale anonymous marker silently defeats a credential.

applyBifrostConnection merged ...existing and only ever added the marker, so
re-running interactive setup against a gateway that now has a virtual key
inherited auth:"none" through the merge and through applyBifrostModelConfig.
An authenticated gateway then rejected inference although setup accepted the key.
The keyed branch now clears the marker, matching how omlx and llama-cpp drop
anonymous state once a credential exists.

runNonInteractive inferred anonymity from --bifrost-api-key and the inline
provider apiKey only, while the delegated method resolves BIFROST_VIRTUAL_KEY and
existing profiles too. A key in either of those made the wrapper write auth:"none",
which the delegate then preserved while saving the key it had resolved. The
ad-hoc check is gone: the delegated method owns the decision and returns null when
no credential resolves, so this path always applies one and must clear the marker.

Replaces the catalog shape test with coverage of the Bifrost-owned decision it
guarded, the single join of the version segment for /openai and /openai/v1.
Docs no longer describe merge and replace mode as though interactive onboarding
left the model list empty; only the non-interactive preset does.

Base-fail/head-pass: both new transition tests fail against 4d2478c4a6 and pass
here. tsgo:extensions, tsgo:extensions:test, oxlint, oxfmt and docs:check-links
are clean.

* fix(providers): clear anonymous mode when no URL flag is supplied

Third instance of the same defect, in the one branch the previous fix left
alone: runNonInteractive returned the delegate the original config whenever
--custom-base-url was absent, so applyBifrostConnection never ran and an
earlier auth:"none" survived. The delegate then saved the key while
applyProviderConfigWithDefaultModelsPreset spread existingProviderRest through,
leaving resolveExplicitProviderNoAuth terminal and stripping Authorization.

This path always applies a credential, so a gateway already on file counts as
configured. The base URL now resolves from the flag or the existing row, and
either way the credentialed connection update runs and clears the marker.

Base-fail/head-pass against 838b5e17cc: 1 failed / 18 passed -> 19 passed.

Live proof on an enforcing Bifrost gateway: config carrying auth:"none" plus an
active bifrost:default profile, re-authenticated with the key and no URL flag.
auth clears, then

  winnerProvider: "bifrost"   authMode: "auth-profile"   fallbackUsed: false
  finalAssistantMessageRawText: "REAUTH_OK"

106 tests across the 9 Bifrost/SGLang/vLLM/shared-setup files; tsgo:extensions,
tsgo:extensions:test, oxlint and oxfmt clean.

* docs(providers): state which Bifrost authentication modes are supported

The guide said supplying a virtual key handles deployments that enforce
authentication, which is true for modern keys with Bifrost HTTP auth off and
false otherwise. Two configurations complete setup and then fail at inference,
so operators hit it as a 401 during a session rather than at configuration:

- a legacy key without the sk-bf- prefix, honored only via x-bf-vk
- auth_config.is_enabled, which consumes Authorization for HTTP auth

Adds a support matrix and the x-bf-vk provider-row configuration, verified
against a local listener to send both x-bf-vk and Authorization. Warns that the
env reference must be set: unset, OpenClaw sends the literal text
${BIFROST_VIRTUAL_KEY} and Bifrost rejects the request with 401 while ignoring
the valid Authorization on the same request.

docs:check-links 15647 links, 0 broken. docs:check-links:anchors unchanged at 5
pre-existing failures, none in this file. oxfmt clean.

* docs(providers): separate dashboard auth from inference auth

ClawSweeper's Revision 4 review found the new support matrix conflated the two layers:
Bifrost keeps dashboard HTTP authentication (Authorization = user creds) and inference
virtual-key governance (x-bf-vk) as independent boundaries. Enabling
auth_config.is_enabled does not consume Authorization for the virtual key; it requires
separate HTTP credentials. Rewrote the matrix to qualify each setup by its actual behavior,
and the x-bf-vk fallback configuration now clearly applies only to legacy keys or inference-auth
deployments.

docs:check-links 15647 links, 0 broken; docs:check-links:anchors unchanged at 5 pre-existing
failures (none bifrost or secret-placeholder); oxfmt clean; markdown not in oxlint scope.

* fix(bifrost): preserve explicit credential and catalog scope

* fix(bifrost): preserve catalog routing and report setup failures

* style(bifrost): use a type-only setup import

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-10-20 13:28:34 -07:00

922 B

summary read_when title
Pointer to the generated OpenClaw plugin reference pages
You need a reference page for a specific OpenClaw plugin
You are auditing plugin docs coverage
Plugin reference

This section holds one reference page for each OpenClaw plugin. Each page states the package, the install route, and the surface the plugin adds.

This page is a pointer, not the index. The browsable list of all 174 generated plugin reference pages lives in Plugin inventory, sorted by distribution, package, and description.

How this page is built

OpenClaw generates this page from the top-level extensions/*/openclaw.plugin.json manifests. Package metadata enriches entries when package.json is present. Regenerate the page with:

pnpm plugins:inventory:gen