Skip to content

Models: Cloudflare AI Gateway auth for OpenRouter#1

Draft
joncooper wants to merge 173 commits intomainfrom
cloudflare-aig-openrouter-auth
Draft

Models: Cloudflare AI Gateway auth for OpenRouter#1
joncooper wants to merge 173 commits intomainfrom
cloudflare-aig-openrouter-auth

Conversation

@joncooper
Copy link
Owner

Work-in-progress PR on my fork to refine the Cloudflare AI Gateway (Authenticated Gateway) approach for OpenRouter.

  • Injects cf-aig-authorization at runtime from CLOUDFLARE_AIG_TOKEN when provider=openrouter and baseUrl is gateway.ai.cloudflare.com.
  • Avoids writing the AI Gateway token into openclaw.json/models.json.

Next steps: tighten scope, add docs polish, and upstream once final.

conroywhitney and others added 30 commits January 28, 2026 20:08
…dding it

The system prompt intentionally excludes the current date/time for cache
stability (see 66eec29). This leaves agents without date awareness,
causing wrong day-of-week claims (openclaw#1897, openclaw#1928, openclaw#2108).

Instead of reverting the cache optimization, add a one-line hint directing
agents to use session_status when they need the current date/time. This
keeps the prompt stable while teaching frontier models where to look.

Also adds a negative test ensuring the date/time is NOT re-added to the
system prompt, with comments explaining why and pointing to openclaw#3658 for the
complementary gateway-level timestamp injection approach.

Refs: openclaw#1897, openclaw#1928, openclaw#3658
Messages arriving through the gateway agent method (TUI, web, spawned
subagents, sessions_send, heartbeats) now get a timestamp prefix
automatically. This gives all agent contexts date/time awareness
without modifying the system prompt (which is cached for stability).

Channel messages (Discord, Telegram, etc.) already have timestamps
via envelope formatting in a separate code path and never reach
the agent handler, so there is no double-stamping risk.

Cron jobs also inject their own 'Current time:' prefix and are
detected and skipped.

Extracted as a pure function (injectTimestamp) with 12 unit tests
covering: timezone handling, 12/24h format, midnight boundaries,
envelope detection, cron detection, and empty messages.

Integration test verifies the agent handler wires it in correctly.

Closes openclaw#3658
Refs: openclaw#1897, openclaw#1928, openclaw#2108
The chat.send handler (used by webchat and TUI) is a separate path
from the agent handler. Inject timestamp into BodyForAgent (what the
model sees) while keeping Body raw for UI display.

This completes timestamp coverage for all non-channel paths:
- agent handler: spawned subagents, sessions_send, heartbeats
- chat.send: webchat, TUI
Verifies that America/New_York correctly resolves to midnight for
both EST (winter, UTC-5) and EDT (summer, UTC-4) using the same
IANA timezone. Intl.DateTimeFormat handles the DST transition.
Replace verbose formatUserTime (Wednesday, January 28th, 2026 — 8:30 PM)
with the same formatZonedTimestamp used by channel envelopes (2026-01-28
20:30 EST). This:

- Saves ~4 tokens per message (~7 vs ~11)
- Uses globally unambiguous YYYY-MM-DD 24h format
- Removes 12/24h config option (always 24h, agent-facing)
- Anchors envelope detection to the actual format function — if channels
  change their timestamp format, our injection + detection change too
- Adds test that compares injection output to formatZonedTimestamp directly

Exported formatZonedTimestamp from auto-reply/envelope.ts for reuse.
Changes [2026-01-28 20:30 EST] to [Wed 2026-01-28 20:30 EST].
Costs ~1 extra token but provides day-of-week for smaller models
that can't derive DOW from a date. Frontier models already handle
it, but this is cheap insurance for 7B-class models.
Changes [Wed 2026-01-28 20:30 EST] to [Current Date: Wed 2026-01-28 20:30 EST].

Tested with qwen3-1.7B: even with DOW in the timestamp, the model
ignored it and tried to compute the day using Zeller's Congruence.
The "Current Date:" semantic label is widely present in training data
and gives small models the best chance of recognizing the timestamp
as authoritative context rather than metadata to parse.

Cost: ~18 tokens per message. Prevents hallucination spirals that
burn hundreds or thousands of tokens on date derivation.
Small model testing showed the label did not meaningfully help:
- Sub-3B models fail regardless of format
- 8B models untested with label specifically
- Frontier models never needed it

The bracket convention [Wed 2026-01-28 22:30 EST] matches existing
channel envelope format and is widely present in training data.
Saves ~2-3 tokens per message vs the labeled version.
…ent LFI (openclaw#4880)

* Media: restrict local path extraction to prevent LFI

* Lint: remove unused variable hasValidMediaOnLine
feat: Add shell completion for Zsh, Bash, Fish, and PowerShell
obviyus and others added 29 commits February 1, 2026 15:22
Co-authored-by: CLAWDINATOR <clawdinator@openclaw.ai>
Co-authored-by: Scott Hanselman <scott@hanselman.com>
* docs: document cacheRetention parameter (openclaw#6240)

* docs: standardize cacheRetention value quoting style

* style: format anthropic.md table

* Docs: align cacheRetention inline example

---------

Co-authored-by: Sebastian <sebslight@gmail.com>
* Docs: add zh-CN entrypoint translations

* Docs: harden docs-i18n parsing
…penclaw#5967)

* docs: fix anchor link for Google Vertex/Antigravity/Gemini section

* Docs: fix model provider MDX markers

---------

Co-authored-by: Sebastian <sebslight@gmail.com>
* fix: satisfy lint curly rule

* docs: apply oxfmt formatting
…claw#5663)

* docs(install): add pnpm approve-builds step for global installs

pnpm requires explicit approval for packages with build scripts.
Without running `pnpm approve-builds -g`, openclaw and its dependencies
(node-llama-cpp, sharp, protobufjs) won't have their postinstall scripts
executed, causing runtime errors.

Fixes openclaw#5579

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* docs(install): clarify pnpm reinstall step after approve-builds

Address review feedback: after running `pnpm approve-builds -g`,
users need to re-run the install command for postinstall scripts
to actually execute.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Update remaining __moltbot__ references in canvas skill documentation
to match the CANVAS_HOST_PATH constant (/__openclaw__/canvas).
* Docs: Direct link to BotFather on Telegram, sparing users from searching and potentially encountering impostors.

* Update numbering syntax

Update numbering syntax to match PR to latest doc layout.

* Docs: add BotFather verification note

---------

Co-authored-by: Sebastian <sebslight@gmail.com>
* docs: add device pairing section to Control UI docs

Explains that new browser connections require one-time pairing approval,
what error message users will see, and how to approve devices using the
CLI. This was a gap in the documentation that caused confusion for users
connecting via Tailscale Serve.

* docs: clarify Control UI pairing error

* docs: clarify device revoke flags

---------

Co-authored-by: Lucifer (via OpenClaw) <lucy@neuwirth.cc>
Co-authored-by: Sebastian <sebslight@gmail.com>
…enclaw#4502)

Co-authored-by: Jarvis <jarvis@openclaw.ai>
Co-authored-by: CLAWDINATOR Bot <clawdinator[bot]@users.noreply.github.com>
Co-authored-by: Shadow <shadow@openclaw.ai>
@joncooper joncooper force-pushed the cloudflare-aig-openrouter-auth branch from 373aa1b to 2048533 Compare February 1, 2026 19:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.