Greptile Summary

This PR registers claude-cli in EXTERNAL_CLI_SYNC_PROVIDERS so the auth store automatically syncs OAuth tokens from the macOS Keychain / ~/.claude/.credentials.json, mirroring the existing minimax-portal pattern.

• Type mismatch: readClaudeCliCredentialsCached returns ClaudeCliCredential | null, a discriminated union that includes a type: \"token\" variant incompatible with the () => OAuthCredential | null signature required by ExternalCliSyncProvider. The minimax-portal entry avoids this because MiniMaxCliCredential is always type: \"oauth\". This is likely a TypeScript compile error and, at runtime, would produce a structurally incomplete "OAuthCredential" if Claude CLI ever issues a non-OAuth token.

Confidence Score: 3/5

Not safe to merge without resolving the ClaudeCliCredential / OAuthCredential type incompatibility.

There is a P1 type mismatch: ClaudeCliCredential includes a type: "token" variant that is not assignable to OAuthCredential. This would cause a TypeScript compile error and a silent runtime bug if a token credential is ever returned. A one-line guard is all that is needed to fix it.

src/agents/auth-profiles/external-cli-sync.ts — the readCredentials lambda needs a type guard on the "oauth" variant before the PR can safely land.

This is a comment left during a code review.
Path: src/agents/auth-profiles/external-cli-sync.ts
Line: 78

Comment:
**Type mismatch: `ClaudeCliCredential` is not assignable to `OAuthCredential`**

`readClaudeCliCredentialsCached` returns `ClaudeCliCredential | null`, but `ExternalCliSyncProvider.readCredentials` is typed as `() => OAuthCredential | null`. `ClaudeCliCredential` is a discriminated union that includes a `{ type: "token"; token: string; expires: number; }` variant, which is structurally incompatible with `OAuthCredential` (which requires `type: "oauth"`, `access`, and `refresh`). TypeScript should reject this assignment.

At runtime, if Claude CLI ever returns a `type: "token"` credential, it would be silently pushed into `profiles` as a fake `OAuthCredential` with missing `access`/`refresh` fields, potentially breaking downstream refresh logic.

The fix is to filter only the `"oauth"` variant at the call site:

```suggestion
    readCredentials: () => {
      const creds = readClaudeCliCredentialsCached({ ttlMs: EXTERNAL_CLI_SYNC_TTL_MS });
      return creds?.type === "oauth" ? creds : null;
    },
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(auth): add Claude CLI to EXTERNAL_CL..." | Re-trigger Greptile}

+1 — hitting this on Windows 11 as well, which rules out macOS-Keychain-specific quirks. The same stale-snapshot pattern applies via the .credentials.json file path rather than Keychain.

Environment

• OpenClaw 2026.4.22 (00bd2cf), fresh install from today
• Windows 11, PowerShell 5.1 (non-elevated)
• Node v24.6.0, npm 11.11.1
• Claude CLI installed via npm at C:\Users\arvid\AppData\Roaming\npm\claude.ps1

Diagnostic path matched the PR description almost verbatim

1. openclaw models auth login --provider anthropic --method cli --set-default → succeeded, profile anthropic:claude-cli (claude-cli/oauth) registered.
2. openclaw doctor immediately flagged anthropic:claude-cli: expired (0m).
3. Verified by dumping the profile shape (values redacted): type=oauth, provider=claude-cli, access/refresh length 108 each, expires=1776562115377 (about an hour old already — tokens from the initial login landed just barely valid, then doctor's read was slightly after expiry).
4. Ran claude -p "reply with pong" directly — returned pong immediately, so Claude Code itself silently refreshed its tokens between login and that call.
5. Ran openclaw doctor again — same expired (0m) warning, expires value unchanged in auth-profiles.json. Confirms the read-back path is missing on Windows.

Where this shows up in doctor output

o  OAuth refresh errors -------
|  - anthropic:claude-cli: OAuth refresh failed - ... (when it tries)
o  Model auth -------
|  - anthropic:claude-cli: expired (0m) - `openclaw configure`.

In my case, configure --section model runs cleanly but does not refresh the stale snapshot — it only refreshes the model catalog for the CLI backend, not the cached credentials. So the doctor warning is persistent across configure runs.

Impact for Claude Max users on Windows
Identical to the macOS case described in the PR: primary=claude-cli/claude-opus-4-7 + fallbacks to API-key profiles means any request arriving during the stale window hits silent fallback to metered API billing. Not easy to notice until the Anthropic Console shows charges.

Happy to help test the fix once it lands — I already have a stale-snapshot repro standing by on this machine.

Landed on main.

• Landed source commit: e57102f
• Merge commit: 150f3e4

Thanks @starvex.