Summary

When Claude CLI refreshes its OAuth token (stored in ~/.claude/.credentials.json), OpenClaw's copy in ~/.openclaw/agents/main/agent/auth-profiles.json is not updated. This causes the Control UI status page to report anthropic:claude-cli: expired even though the underlying CLI auth is valid and working.

Steps to Reproduce

1. Have anthropic:claude-cli configured as an OAuth auth profile
2. Wait for the token to expire (tokens appear to have ~8 hour TTL)
3. Claude CLI automatically refreshes its own token in ~/.claude/.credentials.json
4. OpenClaw's auth-profiles.json still has the old token with the expired timestamp
5. openclaw status / Control UI reports: Model auth — anthropic:claude-cli: expired (0m) — openclaw configure
6. Running openclaw configure does not pull the refreshed token from Claude CLI's credential store

Expected Behavior

Either:

• openclaw configure should read ~/.claude/.credentials.json and sync the fresh token into auth-profiles.json, or
• The gateway should periodically check Claude CLI's credential store and refresh its own copy, or
• The claude-cli provider should delegate token management to Claude CLI rather than caching a copy

Workaround

Manually sync the token:

import json

with open(os.path.expanduser('~/.claude/.credentials.json')) as f:
    creds = json.load(f)['claudeAiOauth']

profiles_path = os.path.expanduser('~/.openclaw/agents/main/agent/auth-profiles.json')
with open(profiles_path) as f:
    profiles = json.load(f)

profiles['profiles']['anthropic:claude-cli']['access'] = creds['accessToken']
profiles['profiles']['anthropic:claude-cli']['refresh'] = creds['refreshToken']
profiles['profiles']['anthropic:claude-cli']['expires'] = creds['expiresAt']

with open(profiles_path, 'w') as f:
    json.dump(profiles, f, indent=4)

Environment

• OpenClaw 2026.4.22
• Claude CLI (/usr/bin/claude), OAuth auth method
• Linux (WSL2) 6.6.87.2-microsoft-standard-WSL2
• Node 22.22.2