Skip to content

fix(auth): show claude-cli reauth hint for expired OAuth#97561

Closed
lin-hongkuan wants to merge 2 commits into
openclaw:mainfrom
lin-hongkuan:fix/claude-cli-oauth-expired-97553
Closed

fix(auth): show claude-cli reauth hint for expired OAuth#97561
lin-hongkuan wants to merge 2 commits into
openclaw:mainfrom
lin-hongkuan:fix/claude-cli-oauth-expired-97553

Conversation

@lin-hongkuan

@lin-hongkuan lin-hongkuan commented Jun 28, 2026

Copy link
Copy Markdown
Contributor

Related: #97553

What Problem This Solves

Fixes an issue where users running the Claude CLI OAuth route could see a generic provider authentication failure after the OAuth token expired, instead of an actionable OpenClaw re-authentication hint.

Why This Change Was Made

This recognizes the Claude CLI expired-OAuth 401 shape as a gateway login refresh failure and lets that specialized handling run before the generic provider-authentication copy. The matcher is intentionally narrow to claude-cli plus the observed 401 invalid-credentials message so unrelated 401 failures keep the existing generic handling.

User Impact

Users now get the exact recovery command for the affected route:

openclaw models auth login --provider claude-cli

instead of a generic “re-authenticate this provider” message.

Evidence

  • node scripts/run-vitest.mjs src/agents/auth-profiles/oauth-refresh-failure.test.ts src/auto-reply/reply/agent-runner-execution.test.ts
    • src/agents/auth-profiles/oauth-refresh-failure.test.ts: 3 tests passed
    • src/auto-reply/reply/agent-runner-execution.test.ts: 216 tests passed
  • git diff --check
  • Secret scan over the diff: no findings

This PR is AI-assisted.

@lin-hongkuan
lin-hongkuan requested a review from a team as a code owner June 28, 2026 20:38
@openclaw-barnacle openclaw-barnacle Bot added agents Agent runtime and tooling size: S labels Jun 28, 2026
@clawsweeper

clawsweeper Bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed June 28, 2026, 5:51 PM ET / 21:51 UTC.

Summary
The PR teaches the OAuth refresh-failure classifier to recognize the reported claude-cli 401 invalid-credentials message, prefers that OAuth guidance over generic provider-auth copy in the reply path, and updates regression tests.

PR surface: Source +21, Tests +38. Total +59 across 4 files.

Reproducibility: yes. at source level: current main routes the reported typed Claude CLI 401 auth failure through generic provider-auth handling before OAuth reauth guidance, and the current OAuth matcher does not recognize the reported Claude CLI text. I did not run a live expired-token Claude CLI session.

Review metrics: 1 noteworthy metric.

  • Auth recovery command: 1 provider-specific command exception. The PR adds special Claude CLI recovery guidance, so the command and real runtime envelope matter before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #97553
Summary: This PR is the candidate fix for the open linked Claude CLI expired OAuth issue; related merged PRs introduced the shared OAuth guidance and generic provider-auth channel surfaces it extends.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦞 diamond lobster
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Add redacted after-fix proof from a real expired Claude CLI OAuth run; terminal output, logs, screenshots, recordings, or linked artifacts count.

Proof guidance:

  • [P1] Needs real behavior proof before merge: The PR has focused tests and checks but no redacted live output, logs, screenshot, recording, or artifact from a real expired Claude CLI OAuth run; screenshots or videos are preferred when they show the behavior, terminal output/logs count, and private details such as IPs, keys, phone numbers, non-public endpoints, and other secrets should be redacted. After proof is added to the PR body, ClawSweeper should re-review automatically; if it does not, a maintainer can comment @clawsweeper re-review.

Mantis proof suggestion
A live Telegram transcript would materially prove that the shared channel reply shows the supported Claude CLI re-auth guidance instead of generic auth copy. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis telegram live: verify an expired claude-cli OAuth failure replies with the supported Anthropic CLI re-auth command instead of generic auth copy.

Risk before merge

  • [P1] The PR changes auth-provider recovery guidance for Claude CLI, but the real expired-token Claude CLI stderr/stdout envelope has not been proven against the narrow matcher.
  • [P1] Because the changed reply is visible in channel flows, maintainers still need contributor-supplied real behavior proof or an explicit decision to accept test-only proof.

Maintainer options:

  1. Prove the expired Claude CLI path (recommended)
    Add redacted terminal output, logs, screenshot, recording, or a linked artifact from a real expired Claude CLI OAuth run showing the user-visible reauth reply before merge.
  2. Accept test-only proof
    Maintainers may intentionally land based on the focused synthetic FailoverError coverage while accepting that the real Claude CLI error envelope was not observed.

Next step before merge

  • [P1] Needs contributor-supplied real behavior proof or maintainer acceptance of test-only proof; there is no narrow code repair left to queue from this review.

Security
Cleared: The diff changes auth-error classification, reply ordering, and tests only; it does not add dependencies, workflows, secret storage, or new code-execution surfaces.

Review details

Best possible solution:

Land the focused classifier and reply-precedence fix after redacted real expired-token Claude CLI proof shows the channel-visible recovery command matches the documented Anthropic CLI auth flow.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: current main routes the reported typed Claude CLI 401 auth failure through generic provider-auth handling before OAuth reauth guidance, and the current OAuth matcher does not recognize the reported Claude CLI text. I did not run a live expired-token Claude CLI session.

Is this the best way to solve the issue?

Yes for the code shape: the shared OAuth classifier plus reply-precedence change is the narrow owner-boundary fix, and the follow-up commit corrected the command to the documented Anthropic CLI auth route. It is not merge-clear until real behavior proof is added.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8f31b3218f9d.

Label changes

Label justifications:

  • P2: This is a normal-priority user-facing auth-provider recovery bug with limited blast radius.
  • merge-risk: 🚨 auth-provider: The PR changes OAuth recovery guidance for Claude CLI and still lacks real expired-token proof that the narrowed matcher catches the actual provider failure envelope.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦞 diamond lobster.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR has focused tests and checks but no redacted live output, logs, screenshot, recording, or artifact from a real expired Claude CLI OAuth run; screenshots or videos are preferred when they show the behavior, terminal output/logs count, and private details such as IPs, keys, phone numbers, non-public endpoints, and other secrets should be redacted. After proof is added to the PR body, ClawSweeper should re-review automatically; if it does not, a maintainer can comment @clawsweeper re-review.
  • mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The changed shared reply text is visible in Telegram for the reported channel reproduction and can be shown in a short proof run.
Evidence reviewed

PR surface:

Source +21, Tests +38. Total +59 across 4 files.

View PR surface stats
Area Files Added Removed Net
Source 2 52 31 +21
Tests 2 38 0 +38
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 4 90 31 +59

Acceptance criteria:

  • [P1] node scripts/run-vitest.mjs src/agents/auth-profiles/oauth-refresh-failure.test.ts src/auto-reply/reply/agent-runner-execution.test.ts.
  • [P1] pnpm exec oxfmt --check src/agents/auth-profiles/oauth-refresh-failure.ts src/agents/auth-profiles/oauth-refresh-failure.test.ts src/auto-reply/reply/agent-runner-execution.ts src/auto-reply/reply/agent-runner-execution.test.ts.
  • [P1] Real expired Claude CLI OAuth run with redacted output or a Telegram-visible proof artifact.

What I checked:

Likely related people:

  • mbelinky: Merged related PR Reply: surface OAuth reauth failures #63217, which added the shared OAuth refresh-failure guidance paths this PR extends. (role: introduced OAuth reauth reply machinery; confidence: high; commits: b77db8c0b610; files: src/agents/auth-profiles/oauth-refresh-failure.ts, src/auto-reply/reply/agent-runner-execution.ts)
  • sjf-oa: Merged related PR fix: surface provider authentication failures in channels #96599, which added generic provider-authentication channel handling whose precedence currently masks the specialized OAuth hint. (role: recent area contributor; confidence: high; commits: 113d6f3c6483; files: src/auto-reply/reply/provider-request-error-classifier.ts, src/auto-reply/reply/agent-runner-execution.test.ts)
  • RomneyDa: Prior history on the OAuth refresh failure and auto-reply dispatch files is tied to the auth-failure handling this PR modifies. (role: auth failure dispatch contributor; confidence: medium; commits: 50b69e16dc0d; files: src/agents/auth-profiles/oauth-refresh-failure.ts, src/auto-reply/reply/agent-runner-execution.ts)
  • shakkernerd: Recent CLI runner history touched subprocess execution behavior adjacent to the Claude CLI 401-to-FailoverError path described by the linked issue. (role: adjacent CLI runner contributor; confidence: medium; commits: 2bde35d29c55, 81c9bd3997b2; files: src/agents/cli-runner/execute.ts)
  • Lu Wang: Direct blame in this grafted checkout points the current touched file contents at the snapshot commit, but this is weaker than the merged feature-history PRs. (role: recent current-line contributor; confidence: low; commits: 168299fc7d; files: src/agents/auth-profiles/oauth-refresh-failure.ts, src/auto-reply/reply/agent-runner-execution.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. mantis: telegram-visible-proof Mantis should capture Telegram visible proof. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. labels Jun 28, 2026
@lin-hongkuan

lin-hongkuan commented Jun 28, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Pushed a narrow follow-up commit fixing the re-auth command contract for Claude CLI OAuth expiry.

Commit: 2ab6bb3d92ac72c68afbbbbca1595d5b9929b2ed

What changed:

  • claude-cli still appears as the failing runtime/provider in the user-facing gateway message.
  • The recovery command now routes through the supported Anthropic CLI auth flow: openclaw models auth login --provider anthropic --method cli.
  • This matches the existing Claude CLI doctor guidance, which uses Anthropic provider auth for the Claude CLI backend rather than an unsupported --provider claude-cli login.

Validation on the PR branch:

  • node scripts/run-vitest.mjs src/agents/auth-profiles/oauth-refresh-failure.test.ts src/auto-reply/reply/agent-runner-execution.test.ts — 2 shards passed, 3 + 216 tests passed
  • pnpm exec oxfmt --check src/agents/auth-profiles/oauth-refresh-failure.ts src/agents/auth-profiles/oauth-refresh-failure.test.ts src/auto-reply/reply/agent-runner-execution.test.ts — passed
  • git diff --check — passed
  • added-line secret scan — clean

I did not fabricate live Telegram/Claude proof; this update addresses the actionable command-correctness issue and provides deterministic local regression evidence.

@clawsweeper

clawsweeper Bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot mentioned this pull request Jun 29, 2026
Merged
@lin-hongkuan

lin-hongkuan commented Jun 29, 2026

Copy link
Copy Markdown
Contributor Author

Closing this in favor of the newer overlapping PR #97669, which targets the same OAuth-expiry/Claude CLI re-auth gap and touches the same surface while directly closing #97553.

Thanks — abandoning this branch to avoid duplicate maintainer review on the same issue.

This was referenced Jun 29, 2026
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

agents Agent runtime and tooling mantis: telegram-visible-proof Mantis should capture Telegram visible proof. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. P2 Normal backlog priority with limited blast radius. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: S status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lin-hongkuan