fix: revert OpenClaw default model to openrouter/auto

[AhmedTMM]

Summary

• OpenClaw uses provider/model format — requires openrouter/ prefix for OpenRouter models
• moonshotai/kimi-k2.5 (from fix: set OpenClaw default model to kimi-k2.5 #2419) was missing the prefix, causing Unknown model warnings
• Reverted to openrouter/openrouter/auto — OpenRouter's auto-router picks the best model per prompt
• Updated both code (agent-setup.ts) and manifest.json

Test plan

• bun test — 1398 pass, 0 fail
• biome check — clean
• Manual: spawn run digitalocean openclaw — no "Unknown model" warning

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: d46d614

Findings

No security vulnerabilities detected.

Changes Reviewed

• manifest.json:60 — Changed OpenClaw default model from to
• packages/cli/package.json:3 — Version bump from 0.16.12 to 0.16.13 (appropriate for config change)
• packages/cli/src/shared/agent-setup.ts:626,640 — Updated OpenClaw and fallback to

Security Analysis

• ✅ No command injection vectors
• ✅ No credential leaks
• ✅ No path traversal risks
• ✅ No unsafe eval or code execution
• ✅ Model ID is a configuration string, properly scoped
• ✅ Version bump follows project conventions

Tests

• biome lint: ✅ PASS (0 errors)
• bun test: ✅ PASS (1398/1398 tests passed)
• Impact: Configuration-only change, no runtime behavior changes
• Compatibility: macOS/Linux compatible (no shell scripts modified)

Summary

This is a safe configuration change that updates OpenClaw's default model to use OpenRouter's auto-routing feature instead of a specific model. The change is consistent across all three locations (manifest, modelDefault, configure fallback) and includes proper version bump.

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: d46d614

Findings

No security vulnerabilities detected.

Changes Reviewed

• manifest.json:60 — Changed OpenClaw default model from moonshotai/kimi-k2.5 to openrouter/openrouter/auto
• packages/cli/package.json:3 — Version bump from 0.16.12 to 0.16.13 (appropriate for config change)
• packages/cli/src/shared/agent-setup.ts:626,640 — Updated OpenClaw modelDefault and fallback to openrouter/openrouter/auto

Security Analysis

• No command injection vectors
• No credential leaks
• No path traversal risks
• No unsafe eval or code execution
• Model ID is a configuration string, properly scoped
• Version bump follows project conventions

Tests

• biome lint: PASS (0 errors)
• bun test: PASS (1398/1398 tests passed)
• Impact: Configuration-only change, no runtime behavior changes
• Compatibility: macOS/Linux compatible (no shell scripts modified)

Summary

This is a safe configuration change that updates OpenClaw default model to use OpenRouter auto-routing feature instead of a specific model. The change is consistent across all three locations (manifest, modelDefault, configure fallback) and includes proper version bump.

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 0285b8a

Findings

No security vulnerabilities detected.

Changes Reviewed (Conflict Resolution)

• packages/cli/package.json:3 — Version bump from 0.16.13 to 0.16.15 (resolved conflict with main branch at 0.16.14)

Original PR Changes

• manifest.json:60 — Changed OpenClaw default model from moonshotai/kimi-k2.5 to openrouter/openrouter/auto
• packages/cli/src/shared/agent-setup.ts:626,640 — Updated OpenClaw modelDefault and fallback to openrouter/openrouter/auto

Security Analysis

• ✅ No command injection vectors
• ✅ No credential leaks
• ✅ No path traversal risks
• ✅ No unsafe eval or code execution
• ✅ Model ID is a configuration string, properly scoped
• ✅ Version bump follows project conventions (patch version for config change)
• ✅ Conflict resolution is clean (version number only)

Tests

• biome lint: ✅ PASS
• bun test: ✅ PASS (Mock Tests, Unit Tests)
• shellcheck: ✅ PASS
• macOS compat: ✅ PASS

Summary

This is a safe configuration change that updates OpenClaw's default model to use OpenRouter's auto-routing feature. Conflict resolution was necessary due to version 0.16.14 being merged to main after this PR was created. The resolution correctly bumps to 0.16.15.

---

-- security/pr-reviewer

[louisgv]

Security Review (Post-Rebase)

Verdict: APPROVED
Commit: 3ef807b (merge with main)

Changes

Rebased onto latest main (commit 129f72d). Only test file changes pulled in from main - no security-relevant changes.

Security Status

✅ All original security approvals still valid
✅ All checks passing
✅ Ready to merge

---

-- security/pr-reviewer