fix: preserve cli oauth session continuity

steipete · steipete · commit 25f16f8fe6c9 · 2026-05-07T06:10:19.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -132,6 +132,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- CLI backends: keep versioned OAuth identity matches reusable when auth profile ids rotate, so Claude CLI sessions do not reset and lose continuity during same-account OAuth refresh/profile alias changes. Fixes #78541.
 - Anthropic: reject uppercase provider-prefixed forward-compat model ids locally instead of sending malformed dynamic ids upstream. Fixes #73715.
 - OpenAI/embeddings: pass configured output dimensionality through single and batched embedding requests so memory embedding indexes can request smaller vectors. Fixes #55126.
 - CLI/infer: normalize HEIC/HEIF image files to JPEG before model-run requests, avoiding providers that reject Apple image container formats. Fixes #50081.
diff --git a/src/agents/cli-auth-epoch.test.ts b/src/agents/cli-auth-epoch.test.ts
@@ -184,6 +184,85 @@ describe("resolveCliAuthEpoch", () => {
     expect(second).toBe(first);
   });
 
+  it("keeps oauth auth-profile epochs stable across profile id aliases for the same account", async () => {
+    const store: AuthProfileStore = {
+      version: 1,
+      profiles: {
+        "anthropic:work": {
+          type: "oauth",
+          provider: "anthropic",
+          access: "access-a",
+          refresh: "refresh-a",
+          expires: 1,
+          email: "user@example.com",
+        },
+        "anthropic:work-alias": {
+          type: "oauth",
+          provider: "anthropic",
+          access: "access-b",
+          refresh: "refresh-b",
+          expires: 2,
+          email: "user@example.com",
+        },
+      },
+    };
+    setCliAuthEpochTestDeps({
+      readGeminiCliCredentialsCached: () => null,
+      loadAuthProfileStoreForRuntime: () => store,
+    });
+
+    const first = await resolveCliAuthEpoch({
+      provider: "google-gemini-cli",
+      authProfileId: "anthropic:work",
+    });
+    const second = await resolveCliAuthEpoch({
+      provider: "google-gemini-cli",
+      authProfileId: "anthropic:work-alias",
+    });
+
+    expect(first).toBeDefined();
+    expect(second).toBe(first);
+  });
+
+  it("keeps identity-less oauth auth-profile epochs scoped to the profile id", async () => {
+    const store: AuthProfileStore = {
+      version: 1,
+      profiles: {
+        "anthropic:work": {
+          type: "oauth",
+          provider: "anthropic",
+          access: "access-a",
+          refresh: "refresh-a",
+          expires: 1,
+        },
+        "anthropic:personal": {
+          type: "oauth",
+          provider: "anthropic",
+          access: "access-b",
+          refresh: "refresh-b",
+          expires: 2,
+        },
+      },
+    };
+    setCliAuthEpochTestDeps({
+      readGeminiCliCredentialsCached: () => null,
+      loadAuthProfileStoreForRuntime: () => store,
+    });
+
+    const first = await resolveCliAuthEpoch({
+      provider: "google-gemini-cli",
+      authProfileId: "anthropic:work",
+    });
+    const second = await resolveCliAuthEpoch({
+      provider: "google-gemini-cli",
+      authProfileId: "anthropic:personal",
+    });
+
+    expect(first).toBeDefined();
+    expect(second).toBeDefined();
+    expect(second).not.toBe(first);
+  });
+
   it("changes oauth auth-profile epochs when the account identity changes", async () => {
     let store: AuthProfileStore = {
       version: 1,
diff --git a/src/agents/cli-auth-epoch.ts b/src/agents/cli-auth-epoch.ts
@@ -114,6 +114,25 @@ function encodeAuthProfileCredential(credential: AuthProfileCredential): string
   throw new Error("Unsupported auth profile credential type");
 }
 
+function hasOAuthAccountIdentity(credential: AuthProfileCredential): boolean {
+  return (
+    credential.type === "oauth" &&
+    (normalizeOptionalString(credential.accountId) !== undefined ||
+      normalizeOptionalString(credential.email) !== undefined)
+  );
+}
+
+function encodeAuthProfileEpochPart(
+  authProfileId: string,
+  credential: AuthProfileCredential,
+): string {
+  const credentialHash = hashCliAuthEpochPart(encodeAuthProfileCredential(credential));
+  if (hasOAuthAccountIdentity(credential)) {
+    return `profile:oauth-identity:${credentialHash}`;
+  }
+  return `profile:${authProfileId}:${credentialHash}`;
+}
+
 function getLocalCliCredentialFingerprint(provider: string): string | undefined {
   switch (provider) {
     case "claude-cli": {
@@ -174,9 +193,7 @@ export async function resolveCliAuthEpoch(params: {
     });
     const credential = getAuthProfileCredential(store, authProfileId);
     if (credential) {
-      parts.push(
-        `profile:${authProfileId}:${hashCliAuthEpochPart(encodeAuthProfileCredential(credential))}`,
-      );
+      parts.push(encodeAuthProfileEpochPart(authProfileId, credential));
     }
   }
 
diff --git a/src/agents/cli-session.test.ts b/src/agents/cli-session.test.ts
@@ -128,7 +128,7 @@ describe("cli-session helpers", () => {
       resolveCliSessionReuse({
         binding,
         authProfileId: "anthropic:personal",
-        authEpoch: "auth-epoch-a",
+        authEpoch: "auth-epoch-b",
         authEpochVersion: 2,
         extraSystemPromptHash: "prompt-a",
         mcpConfigHash: "mcp-a",
@@ -166,6 +166,28 @@ describe("cli-session helpers", () => {
     ).toEqual({ invalidatedReason: "mcp" });
   });
 
+  it("reuses when auth profile ids rotate but the versioned auth epoch is stable", () => {
+    const binding = {
+      sessionId: "cli-session-1",
+      authProfileId: "anthropic:work",
+      authEpoch: "auth-epoch-a",
+      authEpochVersion: 2,
+      extraSystemPromptHash: "prompt-a",
+      mcpConfigHash: "mcp-a",
+    };
+
+    expect(
+      resolveCliSessionReuse({
+        binding,
+        authProfileId: "anthropic:work-alias",
+        authEpoch: "auth-epoch-a",
+        authEpochVersion: 2,
+        extraSystemPromptHash: "prompt-a",
+        mcpConfigHash: "mcp-a",
+      }),
+    ).toEqual({ sessionId: "cli-session-1" });
+  });
+
   it("accepts unversioned auth epochs for binding upgrades", () => {
     const binding = {
       sessionId: "cli-session-1",
diff --git a/src/agents/cli-session.ts b/src/agents/cli-session.ts
@@ -150,10 +150,17 @@ export function resolveCliSessionReuse(params: {
   const currentMcpConfigHash = normalizeOptionalString(params.mcpConfigHash);
   const currentMcpResumeHash = normalizeOptionalString(params.mcpResumeHash);
   const storedAuthProfileId = normalizeOptionalString(binding?.authProfileId);
+  const storedAuthEpoch = normalizeOptionalString(binding?.authEpoch);
+  const hasMatchingVersionedAuthEpoch =
+    binding?.authEpochVersion === params.authEpochVersion &&
+    storedAuthEpoch !== undefined &&
+    currentAuthEpoch !== undefined &&
+    storedAuthEpoch === currentAuthEpoch;
   if (storedAuthProfileId !== currentAuthProfileId) {
-    return { invalidatedReason: "auth-profile" };
+    if (!hasMatchingVersionedAuthEpoch) {
+      return { invalidatedReason: "auth-profile" };
+    }
   }
-  const storedAuthEpoch = normalizeOptionalString(binding?.authEpoch);
   if (
     binding?.authEpochVersion === params.authEpochVersion &&
     storedAuthEpoch !== currentAuthEpoch
