fix(auth): show claude-cli oauth reauth guidance

ly-wang19 · ly-wang19 · commit 75fff82ba87e · 2026-07-04T21:04:21.000+08:00
diff --git a/src/agents/auth-profiles/oauth-refresh-failure.test.ts b/src/agents/auth-profiles/oauth-refresh-failure.test.ts
@@ -96,8 +96,11 @@ describe("oauth refresh failure hints", () => {
         "Failed to authenticate. API Error: 401 Invalid authentication credentials",
       ),
     ).toEqual({
-      provider: null,
+      provider: "claude-cli",
       reason: null,
     });
+    expect(buildOAuthRefreshFailureLoginCommand("claude-cli")).toBe(
+      "claude auth login && openclaw models auth login --provider anthropic --method cli --set-default",
+    );
   });
 });
diff --git a/src/agents/auth-profiles/oauth-refresh-failure.ts b/src/agents/auth-profiles/oauth-refresh-failure.ts
@@ -45,15 +45,22 @@ function isOAuthRefreshFailureMessage(message: string): boolean {
     lower.includes("oauth token refresh failed") ||
     lower.includes("access token could not be refreshed") ||
     lower.includes("authentication session could not be refreshed automatically") ||
-    // Claude CLI subprocess emits its own 401 message when its stored OAuth
-    // token expires. OpenClaw strips ANTHROPIC_API_KEY before spawning it, so
-    // a 401 here is unambiguously an OAuth-expiry signal — recognize it so the
-    // re-auth hint reaches channel replies instead of the generic failure text.
-    (lower.includes("failed to authenticate") && lower.includes("401"))
+    isClaudeCliOAuth401Message(lower)
+  );
+}
+
+function isClaudeCliOAuth401Message(lowercaseMessage: string): boolean {
+  return (
+    lowercaseMessage.includes("failed to authenticate") &&
+    lowercaseMessage.includes("api error") &&
+    /\b401\b/u.test(lowercaseMessage)
   );
 }
 
 function extractOAuthRefreshFailureProvider(message: string): string | null {
+  if (isClaudeCliOAuth401Message(message.toLowerCase())) {
+    return "claude-cli";
+  }
   const provider = message.match(OAUTH_REFRESH_FAILURE_PROVIDER_RE)?.[1]?.trim();
   return provider && provider.length > 0 ? provider : null;
 }
@@ -151,6 +158,14 @@ export function buildOAuthRefreshFailureLoginCommand(
   options?: { profileId?: string | null },
 ): string {
   const sanitizedProvider = sanitizeOAuthRefreshFailureProvider(provider);
+  if (sanitizedProvider === "claude-cli") {
+    return [
+      "claude auth login",
+      formatCliCommand(
+        "openclaw models auth login --provider anthropic --method cli --set-default",
+      ),
+    ].join(" && ");
+  }
   const sanitizedProfileId = sanitizeOAuthRefreshFailureProfileId(options?.profileId);
   return sanitizedProvider
     ? formatCliCommand(
diff --git a/src/auto-reply/reply/agent-runner-execution.test.ts b/src/auto-reply/reply/agent-runner-execution.test.ts
@@ -7537,6 +7537,32 @@ describe("runAgentTurnWithFallback", () => {
     }
   });
 
+  it("surfaces Claude CLI OAuth 401 failures with claude-cli reauth guidance", async () => {
+    state.runEmbeddedAgentMock.mockRejectedValueOnce(
+      new FailoverError(
+        "Failed to authenticate. API Error: 401 Invalid authentication credentials",
+        {
+          reason: "auth",
+          provider: "claude-cli",
+          model: "claude-sonnet-4-6",
+          status: 401,
+        },
+      ),
+    );
+
+    const runAgentTurnWithFallback = await getRunAgentTurnWithFallback();
+    const result = await runAgentTurnWithFallback(createMinimalRunAgentTurnParams());
+
+    expect(result.kind).toBe("final");
+    if (result.kind === "final") {
+      expect(result.payload.text).toBe(
+        "⚠️ Model login failed on the gateway for claude-cli. Please try again. If this keeps happening, re-auth with `claude auth login && openclaw models auth login --provider anthropic --method cli --set-default` in a terminal.",
+      );
+      expect(result.payload.text).not.toBe(PROVIDER_AUTHENTICATION_ERROR_USER_MESSAGE);
+      expect(result.payload.text).not.toBe(GENERIC_RUN_FAILURE_TEXT);
+    }
+  });
+
   it("surfaces direct provider auth guidance for missing API keys", async () => {
     state.runEmbeddedAgentMock.mockRejectedValueOnce(
       new Error(
