Merge 75fff82 into 045f42f

ly-wang19 · web-flow · commit 1e59f28ecc38 · 2026-07-04T13:08:10.000Z
diff --git a/src/agents/auth-profiles/oauth-refresh-failure.test.ts b/src/agents/auth-profiles/oauth-refresh-failure.test.ts
@@ -85,4 +85,22 @@ describe("oauth refresh failure hints", () => {
       reason: "token_invalidated",
     });
   });
+
+  it("recognizes claude-cli 401 subprocess output as an OAuth refresh failure", () => {
+    // Claude CLI emits its own "Failed to authenticate. API Error: 401 ..." line
+    // when its stored OAuth token expires. Without this match the channel reply
+    // falls back to the generic "Something went wrong" text instead of the
+    // re-auth hint.
+    expect(
+      classifyOAuthRefreshFailure(
+        "Failed to authenticate. API Error: 401 Invalid authentication credentials",
+      ),
+    ).toEqual({
+      provider: "claude-cli",
+      reason: null,
+    });
+    expect(buildOAuthRefreshFailureLoginCommand("claude-cli")).toBe(
+      "claude auth login && openclaw models auth login --provider anthropic --method cli --set-default",
+    );
+  });
 });
diff --git a/src/agents/auth-profiles/oauth-refresh-failure.ts b/src/agents/auth-profiles/oauth-refresh-failure.ts
@@ -45,11 +45,23 @@ function isOAuthRefreshFailureMessage(message: string): boolean {
   return (
     lower.includes("oauth token refresh failed") ||
     lower.includes("access token could not be refreshed") ||
-    lower.includes("authentication session could not be refreshed automatically")
+    lower.includes("authentication session could not be refreshed automatically") ||
+    isClaudeCliOAuth401Message(lower)
+  );
+}
+
+function isClaudeCliOAuth401Message(lowercaseMessage: string): boolean {
+  return (
+    lowercaseMessage.includes("failed to authenticate") &&
+    lowercaseMessage.includes("api error") &&
+    /\b401\b/u.test(lowercaseMessage)
   );
 }
 
 function extractOAuthRefreshFailureProvider(message: string): string | null {
+  if (isClaudeCliOAuth401Message(message.toLowerCase())) {
+    return "claude-cli";
+  }
   const provider = message.match(OAUTH_REFRESH_FAILURE_PROVIDER_RE)?.[1]?.trim();
   return provider && provider.length > 0 ? provider : null;
 }
@@ -142,6 +154,14 @@ export function buildOAuthRefreshFailureLoginCommand(
   options?: { profileId?: string | null },
 ): string {
   const sanitizedProvider = sanitizeOAuthRefreshFailureProvider(provider);
+  if (sanitizedProvider === "claude-cli") {
+    return [
+      "claude auth login",
+      formatCliCommand(
+        "openclaw models auth login --provider anthropic --method cli --set-default",
+      ),
+    ].join(" && ");
+  }
   const sanitizedProfileId = sanitizeOAuthRefreshFailureProfileId(options?.profileId);
   return sanitizedProvider
     ? formatCliCommand(
diff --git a/src/auto-reply/reply/agent-runner-execution.test.ts b/src/auto-reply/reply/agent-runner-execution.test.ts
@@ -7537,6 +7537,32 @@ describe("runAgentTurnWithFallback", () => {
     }
   });
 
+  it("surfaces Claude CLI OAuth 401 failures with claude-cli reauth guidance", async () => {
+    state.runEmbeddedAgentMock.mockRejectedValueOnce(
+      new FailoverError(
+        "Failed to authenticate. API Error: 401 Invalid authentication credentials",
+        {
+          reason: "auth",
+          provider: "claude-cli",
+          model: "claude-sonnet-4-6",
+          status: 401,
+        },
+      ),
+    );
+
+    const runAgentTurnWithFallback = await getRunAgentTurnWithFallback();
+    const result = await runAgentTurnWithFallback(createMinimalRunAgentTurnParams());
+
+    expect(result.kind).toBe("final");
+    if (result.kind === "final") {
+      expect(result.payload.text).toBe(
+        "⚠️ Model login failed on the gateway for claude-cli. Please try again. If this keeps happening, re-auth with `claude auth login && openclaw models auth login --provider anthropic --method cli --set-default` in a terminal.",
+      );
+      expect(result.payload.text).not.toBe(PROVIDER_AUTHENTICATION_ERROR_USER_MESSAGE);
+      expect(result.payload.text).not.toBe(GENERIC_RUN_FAILURE_TEXT);
+    }
+  });
+
   it("surfaces direct provider auth guidance for missing API keys", async () => {
     state.runEmbeddedAgentMock.mockRejectedValueOnce(
       new Error(
