fix: OAuth model cleanup, skill nav, UI polish (#551)

* fix: OAuth disconnect clears models, skill detail back nav, UI polish

- OAuth disconnect now deletes provider model list and syncs config,
  so models don't linger in the selector after revoking OAuth
- OAuth-expired providers' models are excluded from listModels()
- Skill detail "Back to Skills" uses navigate(-1) to return to the
  previous page instead of always resetting to the initial tab
- Skills page persists active tab (Yours/ClawHub) in URL search params
  so navigating back preserves the selected tab
- GitHub import tab input disabled (coming soon)
- Added space between "GitHub Issues" link and "反馈" in disclaimer

* fix: add space between GitHub Issues link and disclaimer suffix

* fix: guard OAuth disconnect to only delete provider when actually connected

Author: alchemistklk

apps/controller/src/app/container.ts

@@ -124,6 +124,7 @@ export async function createContainer(): Promise<ControllerContainer> {
     openclawSyncService,
     openclawProcess,
   );
+  modelProviderService.setAuthService(openclawAuthService);
   const runtimeModelStateService = new RuntimeModelStateService(env);
 
   // Wire cloud state change callback to sync refreshed cloud inventory without

apps/controller/src/routes/provider-oauth-routes.ts

@@ -135,8 +135,18 @@ export function registerProviderOAuthRoutes(
     }),
     async (c) => {
       const { providerId } = c.req.valid("param");
+      const wasConnected = (
+        await container.openclawAuthService.getProviderOAuthStatus(providerId)
+      ).connected;
       const ok =
         await container.openclawAuthService.disconnectOAuth(providerId);
+      if (ok && wasConnected) {
+        // Remove the provider's stored model list so models don't linger
+        // in the model selector after OAuth is revoked.
+        await container.modelProviderService.deleteProvider(providerId);
+        await container.modelProviderService.ensureValidDefaultModel();
+        await container.openclawSyncService.syncAll();
+      }
       return c.json({ ok }, 200);
     },
   );

apps/controller/src/services/model-provider-service.ts

@@ -14,6 +14,7 @@ import { isSupportedByokProviderId } from "../lib/byok-providers.js";
 import { logger } from "../lib/logger.js";
 import type { OpenClawProcessManager } from "../runtime/openclaw-process.js";
 import type { NexuConfigStore } from "../store/nexu-config-store.js";
+import type { OpenClawAuthService } from "./openclaw-auth-service.js";
 import type { OpenClawSyncService } from "./openclaw-sync-service.js";
 
 export interface ModelAutoSelectResult {
@@ -255,7 +256,12 @@ function getOpenClawCommandSpec(env: ControllerEnv): {
   };
 }
 
+// Providers that support OAuth login (no API key needed).
+const OAUTH_PROVIDER_IDS = new Set(["openai"]);
+
 export class ModelProviderService {
+  private openclawAuthService: OpenClawAuthService | null = null;
+
   private miniMaxOauthAbortController: AbortController | null = null;
 
   private miniMaxOauthBrowserUrl: string | null = null;
@@ -287,35 +293,89 @@ export class ModelProviderService {
     private readonly openclawProcess: OpenClawProcessManager,
   ) {}
 
+  /**
+   * Inject the auth service after construction to avoid circular deps.
+   */
+  setAuthService(authService: OpenClawAuthService): void {
+    this.openclawAuthService = authService;
+  }
+
   async listModels() {
     await this.refreshMiniMaxOauthModelsIfNeeded();
 
     const config = await this.configStore.getConfig();
     const desktopCloud = await this.configStore.getDesktopCloudStatus();
-    const cloudModels: Model[] = (desktopCloud.models ?? []).map((model) => ({
-      id: model.id,
-      name: model.name || model.id,
-      provider: "nexu",
-      description: "Cloud model via Nexu Link",
-    }));
-
     const providers = config.providers.filter(
       (provider) =>
         provider.enabled && isSupportedByokProviderId(provider.providerId),
     );
-    const byokModels: Model[] = providers.flatMap((provider) =>
-      provider.models.map((modelId) => ({
-        id: `${provider.providerId}/${modelId}`,
-        name: modelId,
-        provider: provider.providerId,
-      })),
+    const { cloudModels, byokModels } = await this.getAvailableModels(
+      providers,
+      desktopCloud,
     );
 
     return {
       models: [...cloudModels, ...byokModels],
     };
   }
 
+  private async getAvailableModels(
+    providers: ReadonlyArray<{
+      providerId: string;
+      apiKey: string | null;
+      models: string[];
+    }>,
+    desktopCloud: {
+      models?: Array<{ id: string; name?: string | null }> | null;
+    },
+  ): Promise<{ cloudModels: Model[]; byokModels: Model[] }> {
+    const cloudModels: Model[] = (desktopCloud.models ?? []).map((model) => ({
+      id: model.id,
+      name: model.name || model.id,
+      provider: "nexu",
+      description: "Cloud model via Nexu Link",
+    }));
+
+    // Exclude OAuth-only providers whose token has expired
+    const expiredOAuthProviderIds =
+      await this.getExpiredOAuthProviderIds(providers);
+
+    const byokModels: Model[] = providers
+      .filter((provider) => !expiredOAuthProviderIds.has(provider.providerId))
+      .flatMap((provider) =>
+        provider.models.map((modelId) => ({
+          id: `${provider.providerId}/${modelId}`,
+          name: modelId,
+          provider: provider.providerId,
+        })),
+      );
+
+    return { cloudModels, byokModels };
+  }
+
+  /**
+   * Returns provider IDs that use OAuth (no API key) and whose token is expired.
+   */
+  private async getExpiredOAuthProviderIds(
+    providers: ReadonlyArray<{ providerId: string; apiKey: string | null }>,
+  ): Promise<Set<string>> {
+    if (!this.openclawAuthService) return new Set();
+
+    const expired = new Set<string>();
+    for (const provider of providers) {
+      if (provider.apiKey || !OAUTH_PROVIDER_IDS.has(provider.providerId)) {
+        continue;
+      }
+      const status = await this.openclawAuthService.getProviderOAuthStatus(
+        provider.providerId,
+      );
+      if (!status.connected) {
+        expired.add(provider.providerId);
+      }
+    }
+    return expired;
+  }
+
   async listProviders() {
     await this.refreshMiniMaxOauthModelsIfNeeded();
 
@@ -576,18 +636,9 @@ export class ModelProviderService {
       return "unknown";
     }
 
-    const cloudModels: Model[] = (desktopCloud.models ?? []).map((model) => ({
-      id: model.id,
-      name: model.name || model.id,
-      provider: "nexu",
-      description: "Cloud model via Nexu Link",
-    }));
-    const byokModels: Model[] = providers.flatMap((provider) =>
-      provider.models.map((modelId) => ({
-        id: `${provider.providerId}/${modelId}`,
-        name: modelId,
-        provider: provider.providerId,
-      })),
+    const { cloudModels, byokModels } = await this.getAvailableModels(
+      providers,
+      desktopCloud,
     );
     const knownModels = [...cloudModels, ...byokModels];
 

apps/controller/tests/provider-oauth-routes.test.ts

@@ -91,6 +91,8 @@ function createTestContainer(rootDir: string): ControllerContainer {
       {} as ControllerContainer["runtimeModelStateService"],
     modelProviderService: {
       upsertProvider,
+      deleteProvider: vi.fn(async () => true),
+      ensureValidDefaultModel: vi.fn(async () => null),
     } as unknown as ControllerContainer["modelProviderService"],
     integrationService: {} as ControllerContainer["integrationService"],
     localUserService: {} as ControllerContainer["localUserService"],
@@ -173,4 +175,84 @@ describe("provider OAuth routes", () => {
       models: ["gpt-5.4"],
     });
   });
+
+  it("disconnect removes provider models and syncs config", async () => {
+    const container = createTestContainer("/tmp/nexu-provider-oauth-routes");
+    (
+      container.openclawAuthService.getProviderOAuthStatus as ReturnType<
+        typeof vi.fn
+      >
+    ).mockResolvedValueOnce({ connected: true });
+    (
+      container.openclawAuthService.disconnectOAuth as ReturnType<typeof vi.fn>
+    ).mockResolvedValueOnce(true);
+    const app = createApp(container);
+
+    const response = await app.request(
+      "/api/v1/providers/openai/oauth/disconnect",
+      { method: "POST" },
+    );
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ ok: true });
+    expect(container.modelProviderService.deleteProvider).toHaveBeenCalledWith(
+      "openai",
+    );
+    expect(
+      container.modelProviderService.ensureValidDefaultModel,
+    ).toHaveBeenCalledTimes(1);
+    expect(container.openclawSyncService.syncAll).toHaveBeenCalledTimes(1);
+  });
+
+  it("disconnect does not delete provider when OAuth disconnect fails", async () => {
+    const container = createTestContainer("/tmp/nexu-provider-oauth-routes");
+    (
+      container.openclawAuthService.getProviderOAuthStatus as ReturnType<
+        typeof vi.fn
+      >
+    ).mockResolvedValueOnce({ connected: true });
+    (
+      container.openclawAuthService.disconnectOAuth as ReturnType<typeof vi.fn>
+    ).mockResolvedValueOnce(false);
+    const app = createApp(container);
+
+    const response = await app.request(
+      "/api/v1/providers/openai/oauth/disconnect",
+      { method: "POST" },
+    );
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ ok: false });
+    expect(
+      container.modelProviderService.deleteProvider,
+    ).not.toHaveBeenCalled();
+  });
+
+  it("disconnect does not delete provider when no OAuth profile was connected", async () => {
+    const container = createTestContainer("/tmp/nexu-provider-oauth-routes");
+    (
+      container.openclawAuthService.getProviderOAuthStatus as ReturnType<
+        typeof vi.fn
+      >
+    ).mockResolvedValueOnce({ connected: false });
+    (
+      container.openclawAuthService.disconnectOAuth as ReturnType<typeof vi.fn>
+    ).mockResolvedValueOnce(true);
+    const app = createApp(container);
+
+    const response = await app.request(
+      "/api/v1/providers/openai/oauth/disconnect",
+      { method: "POST" },
+    );
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ ok: true });
+    expect(
+      container.modelProviderService.deleteProvider,
+    ).not.toHaveBeenCalled();
+    expect(
+      container.modelProviderService.ensureValidDefaultModel,
+    ).not.toHaveBeenCalled();
+    expect(container.openclawSyncService.syncAll).not.toHaveBeenCalled();
+  });
 });

apps/web/src/components/skills/import-skill-modal.tsx

@@ -237,6 +237,8 @@ export default function ImportSkillModal({
                   type="url"
                   placeholder="https://github.com/user/repo"
                   className="mt-1.5"
+                  disabled
+                  readOnly
                 />
                 <div className="mt-4 flex items-start gap-1.5">
                   <Lock size={12} className="text-text-muted shrink-0 mt-0.5" />

apps/web/src/pages/skills.tsx

@@ -16,7 +16,7 @@ import type { InstalledSkill, MinimalSkill } from "@/types/desktop";
 import { Compass, Loader2, Plus, Search, Settings2, Zap } from "lucide-react";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Link } from "react-router-dom";
+import { Link, useSearchParams } from "react-router-dom";
 import { toast } from "sonner";
 
 type TopTab = "explore" | "yours";
@@ -265,7 +265,12 @@ export function SkillsPage() {
 
   const [searchQuery, setSearchQuery] = useState("");
   const debouncedQuery = useDebounce(searchQuery, 150);
-  const [topTab, setTopTab] = useState<TopTab>("yours");
+  const [searchParams, setSearchParams] = useSearchParams();
+  const topTab: TopTab =
+    searchParams.get("tab") === "explore" ? "explore" : "yours";
+  const setTopTab = (tab: TopTab) => {
+    setSearchParams(tab === "yours" ? {} : { tab }, { replace: true });
+  };
   const [yoursSubTab, setYoursSubTab] = useState<YoursSubTab>("all");
   const [activeTag, setActiveTag] = useState<string | null>(null);
   const [visibleCount, setVisibleCount] = useState(PAGE_SIZE);
@@ -713,7 +718,7 @@ export function SkillsPage() {
             className="text-[var(--color-accent)] hover:underline"
           >
             GitHub Issues
-          </a>
+          </a>{" "}
           {t("skills.clawhubDisclaimerAfterLink")}
         </p>
 

tests/controller/provider-oauth-routes.test.ts

@@ -0,0 +1 @@
+import "../../apps/controller/tests/provider-oauth-routes.test.ts";