feat(xai): add device code OAuth login by fuller-stack-dev · Pull Request #84005 · openclaw/openclaw

fuller-stack-dev · 2026-05-19T05:50:54Z

Summary

add xAI OAuth device-code login using auth.x.ai device authorization and token polling
register the new xai-device-code auth choice alongside API key and loopback OAuth
document the remote/VPS-friendly login commands and cover the flow in xAI tests

Real behavior proof

Behavior or issue addressed: xAI device-code login can be selected in OpenClaw without a localhost callback and prints a local-browser verification URL/code for remote/VPS use.
Real environment tested: macOS source checkout at /Users/wilfred/.openclaw/workspace/core/openclaw-main-runtime, Node 24.14, OpenClaw source CLI 2026.5.19 (f5af40c3d9), source bundled plugins loaded via OPENCLAW_BUNDLED_PLUGINS_DIR=extensions, remote detection forced with SSH_TTY=/dev/pts/0.
Exact steps or command run after this patch:

OPENCLAW_BUNDLED_PLUGINS_DIR=extensions SSH_TTY=/dev/pts/0 \
  node --import tsx src/entry.ts --profile xai-pr-proof \
  models auth login --provider xai --device-code

Evidence after fix: terminal output from the command above, with the short-lived user code redacted:

OpenClaw 2026.5.19 (f5af40c3d9)
◓ Requesting xAI device code
◇ xAI device code
Open this URL in your LOCAL browser and enter the code below.
URL: https://accounts.x.ai/oauth2/device?user_code=<redacted>
Code: <redacted>
Code expires in 15 minutes. Never share it.

Open this URL in your LOCAL browser:

https://accounts.x.ai/oauth2/device

◑ Waiting for xAI device authorization...

Live xAI discovery used by the flow:

curl https://auth.x.ai/.well-known/openid-configuration
issuer=https://auth.x.ai
device_authorization_endpoint=https://auth.x.ai/oauth2/device/code
token_endpoint=https://auth.x.ai/oauth2/token

Observed result after fix: OpenClaw selected the new device-code auth method for provider xai, requested a real xAI device code, printed the complete verification URL/code for the operator, logged only the base device URL for remote access, skipped localhost callback/browser opening under SSH_TTY, and entered token polling.
What was not tested: Final token persistence after approving the code in an x.ai account was not completed; the CLI was canceled after the remote prompt/polling state appeared to avoid binding a personal account in PR proof.

Tests

pnpm test:extension xai
pnpm tsgo:extensions
pnpm tsgo:test:extensions
pnpm run lint:extensions:bundled
pnpm exec oxfmt --check extensions/xai/xai-oauth.ts extensions/xai/xai-oauth.test.ts extensions/xai/index.ts extensions/xai/index.test.ts docs/providers/xai.md extensions/xai/openclaw.plugin.json

clawsweeper · 2026-05-19T05:51:55Z

Codex review: needs maintainer review before merge.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
Adds xAI device-code OAuth login, onboarding/docs/changelog entries, and focused xAI auth tests.

Reproducibility: not applicable. this is a feature PR, not a bug report. The relevant proof path is the live device-code login and xAI model call supplied in the PR discussion, not a failing current-main reproduction.

PR rating
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Summary: Good, likely mergeable provider-auth PR with sufficient live proof and no blocking findings; final confidence depends on normal CI/head validation.

Rank-up moves:

Verify the listed xAI extension/type/lint checks or equivalent CI on head f800dc03a9ffd5d2785fdfc93240457dafef147a before merge.

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

PR egg
✨ Hatched: 🥚 common Mossy Test Hopper

        .--^^^^--.           
     .-'  o    o  '-.        
    /       \__/      \      
   |    /\  ____  /\   |     
   |   /  \/____\/  \  |     
    \  \_.------._/  /       
     '._  `----'  _.'        
        '-.____.-'           
       _/|_|  |_|\_          
      /__|      |__\         
       .-----------.         
      '-------------'

Rarity: 🥚 common.
Trait: watches the merge queue.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Mossy Test Hopper in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
How to hatch it: reach status: 👀 ready for maintainer look or status: 🚀 automerge armed; that usually means sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

Real behavior proof
Sufficient (live_output): The PR discussion now includes live after-fix proof of xAI device-code approval, OAuth profile persistence, default model update, and a live model call; the production auth file is unchanged between the proved head and final head.

Risk before merge
Why this matters: - This adds a selectable OAuth credential path, so maintainers still need to accept normal auth-provider risk around xAI account eligibility and upstream device-code policy despite the supplied live proof.

This read-only sweep did not rerun the listed extension/type/lint commands; merge should rely on CI or an equivalent head-SHA validation run.

Maintainer options:

Merge after CI with live-proofed auth risk (recommended)
If CI is green, maintainers can accept the additive auth-provider risk because the supplied live proof exercises approval, token persistence, and a live xAI model request.
Run one more xAI account smoke
A maintainer can repeat the device-code login on another eligible xAI account before merge if account-class coverage is important.

Next step before merge
No automated repair lane is needed; the PR has no blocking findings and should proceed through normal maintainer review, CI, and merge-risk acceptance.

Security
Cleared: No concrete security or supply-chain regression was found; the diff is limited to xAI auth/docs/tests/changelog, adds no dependencies or workflow execution, and validates HTTPS x.ai OAuth endpoints.

Review details

Best possible solution:

Land the provider-owned device-code method after head-SHA CI/validation, while preserving existing xAI API-key and loopback OAuth behavior.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a feature PR, not a bug report. The relevant proof path is the live device-code login and xAI model call supplied in the PR discussion, not a failing current-main reproduction.

Is this the best way to solve the issue?

Yes: implementing this as xAI plugin extraAuth plus a manifest auth choice uses the existing generic --device-code CLI seam and keeps provider policy out of core. The remaining merge decision is CI/head validation and auth-provider risk acceptance, not a different architecture.

Label justifications:

P2: This is a normal provider-auth feature with limited blast radius and no evidence of a current production regression.
merge-risk: 🚨 auth-provider: The PR adds a new OAuth device-code flow that creates and refreshes xAI credential profiles.

What I checked:

Current main does not already implement this: A current-main search found no xAI device-code identifiers or auth-flow markers under the xAI plugin/docs, so the PR is not obsolete on main. (ddeaebfc6807)
PR implements provider-owned device-code flow: The PR head adds discovery parsing, device-code request/polling, token parsing, credential extras, and the exported xAI device-code auth method inside the xAI plugin auth module. (extensions/xai/xai-oauth.ts:613, f800dc03a9ff)
PR registers the method with the xAI provider: The PR head registers createXaiDeviceCodeAuthMethod() alongside existing API-key and loopback OAuth auth methods. (extensions/xai/index.ts:190, f800dc03a9ff)
Manifest and docs expose the onboarding choice: The PR head adds xai-device-code to provider auth choices and documents both onboarding and models auth login --device-code commands. (extensions/xai/openclaw.plugin.json:66, f800dc03a9ff)
Docs describe the user-facing flow: The provider docs explain remote/VPS use and say OpenClaw prints an xAI URL and short code while the remote process polls for token exchange completion. Public docs: docs/providers/xai.md. (docs/providers/xai.md:58, f800dc03a9ff)
Focused tests cover registration and successful login shape: The PR head tests provider auth registration, remote behavior, device-code request/token bodies, credential persistence fields, and progress completion for the successful mocked flow. (extensions/xai/xai-oauth.test.ts:169, f800dc03a9ff)

Likely related people:

Peter Steinberger: Current-main blame/log in this checkout attributes the existing xAI OAuth module, plugin auth registration, and provider docs to the same commit by Peter Steinberger; the checkout history is shallow, so confidence is medium. (role: current xAI provider/auth area contributor; confidence: medium; commits: df8505b09d2e; files: extensions/xai/xai-oauth.ts, extensions/xai/index.ts, docs/providers/xai.md)
obviyus: The PR timeline shows obviyus assigned, authored follow-up commits on this branch, and supplied the live xAI approval/token-persistence/model-call proof; this makes them a likely follow-up reviewer for this PR. (role: PR follow-up contributor and proof provider; confidence: medium; commits: e73b283cba38, 2693a99e3a50, f800dc03a9ff; files: extensions/xai/xai-oauth.ts, extensions/xai/xai-oauth.test.ts, CHANGELOG.md)

Codex review notes: model gpt-5.5, reasoning high; reviewed against ddeaebfc6807.

fuller-stack-dev · 2026-05-19T06:09:19Z

@clawsweeper re-review

clawsweeper · 2026-05-19T06:10:04Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26079657276
Updated: 2026-05-19T06:17:44.355Z

obviyus · 2026-05-19T06:43:45Z

Proof for PR head 635bdab:

Behavior addressed: xAI device-code OAuth login completes the hosted approval flow, exchanges the code, persists an OAuth auth profile, and can use that profile for a live model request.

Real environment tested: homelab Linux, PR checkout at 635bdab, isolated ephemeral OpenClaw state. Account identifiers, auth code, and token-bearing paths are intentionally redacted.

Exact steps or command run after this patch:

OPENCLAW_STATE_DIR=<ephemeral-state> \
OPENCLAW_CONFIG_PATH=<ephemeral-state>/openclaw.json \
OPENCLAW_BUNDLED_PLUGINS_DIR=extensions \
node --import tsx src/entry.ts --profile xai-pr-e2e models auth login --provider xai --device-code --set-default

OPENCLAW_STATE_DIR=<ephemeral-state> \
OPENCLAW_CONFIG_PATH=<ephemeral-state>/openclaw.json \
OPENCLAW_BUNDLED_PLUGINS_DIR=extensions \
node --import tsx src/entry.ts --profile xai-pr-e2e infer model run --local --model xai/grok-4.3 --prompt 'Reply with exactly: xai-pr-84005-ok'

Evidence after fix: device-code auth completed successfully, the config was updated, an xai/oauth auth profile was created, and the default model was set to xai/grok-4.3.

Observed result after fix: live xAI model call returned xai-pr-84005-ok.

What was not tested: long-running gateway service mode; this was a source-checkout CLI/device-code/auth-profile/live-model E2E smoke.

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…ller-stack-dev

…ller-stack-dev)

obviyus · 2026-05-19T07:06:36Z

Landed via rebase onto main.

Scoped tests:
- node scripts/run-vitest.mjs extensions/xai/xai-oauth.test.ts extensions/xai/index.test.ts
- git diff --check
- node scripts/run-vitest.mjs test/extension-test-boundary.test.ts extensions/xai/xai-oauth.test.ts extensions/xai/index.test.ts
- node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json --incremental false
Live proof: redacted xAI device-code auth completed, created an xai/oauth profile, set xai/grok-4.3 as default, and a live infer model run --local --model xai/grok-4.3 returned xai-pr-84005-ok.
Changelog: CHANGELOG.md updated.
Land commit: c6967eea6840be49c04a84e77825ba663f5dfca6
Merge commit: 1d77170a305b039ce609a04ae17f0ec1c5b69ce8

Thanks @fuller-stack-dev!

…026.5.20) (#615) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.19` → `2026.5.20` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information. --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.5.20`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026520) [Compare Source](openclaw/openclaw@v2026.5.19...v2026.5.20) ##### Changes - Exec approvals: remove the old `cat SKILL.md && printf ... && <skill-wrapper>` allowlist compatibility path so skill files must be loaded with the read tool and only the real skill executable is auto-allowed. - Discord: let voice sessions follow configured Discord users into voice channels, with allowed-channel checks, multi-user handoff, bounded reconciliation, and DAVE recovery preservation. ([#84264](openclaw/openclaw#84264)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Discord/voice: include bounded `IDENTITY.md`, `USER.md`, and `SOUL.md` profile context in realtime voice session instructions by default, with `voice.realtime.bootstrapContextFiles: []` available to disable it. ([#84499](openclaw/openclaw#84499)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Dependencies: bump the bundled Codex harness to `@openai/codex` `0.132.0` and refresh the app-server model-list docs for the new catalog. - CLI/policy: add the bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair. ([#80407](openclaw/openclaw#80407)) Thanks [@giodl73-repo](https://github.com/giodl73-repo). - Agents/config: allow `agents.list[].experimental.localModelLean` so lean local-model mode can be enabled for one configured agent instead of globally. - Providers/xAI: add device-code OAuth login so remote and headless setups can authorize xAI without a localhost browser callback. ([#84005](openclaw/openclaw#84005)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Providers/OpenRouter: honor provider-level `params.provider` routing policy for OpenRouter requests, with model and agent params overriding the defaults. Thanks [@amknight](https://github.com/amknight). ##### Fixes - CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. ([#84691](openclaw/openclaw#84691)) Thanks [@efpiva](https://github.com/efpiva). - Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. ([#84736](openclaw/openclaw#84736)) Thanks [@JARVIS-Glasses](https://github.com/JARVIS-Glasses). - Providers/MiniMax music: stop advertising `durationSeconds` control and remove prompt-injected duration hints, so `music_generate` reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes [#84508](openclaw/openclaw#84508). Thanks [@neeravmakwana](https://github.com/neeravmakwana). - Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. ([#84699](openclaw/openclaw#84699)) Thanks [@nxmxbbd](https://github.com/nxmxbbd). - WhatsApp: update Baileys to `7.0.0-rc12`. - Build: suppress per-locale `rolldown-plugin-dts:fake-js` CommonJS dts warnings emitted while bundling the intentionally-inlined `zod/v4/locales/*.d.cts` files, so `pnpm build` output stays readable after the 0.25.1 plugin bump. Thanks [@romneyda](https://github.com/romneyda). - CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode `openclaw nodes` commands so stdout stays parseable. ([#84684](openclaw/openclaw#84684)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Approvals: route manual `/approve` decisions through the trusted approval runtime so active exec and plugin approvals no longer look unknown or expired. - Mac app: update the About settings copyright year to 2026. ([#84385](openclaw/openclaw#84385)) Thanks [@pejmanjohn](https://github.com/pejmanjohn). - Dependencies: update `@openclaw/fs-safe` to `0.2.7` so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS. - Infra/secrets: restore the fail-closed contract for `tryReadSecretFileSync` so credential loaders that pass `rejectSymlink: true` (Telegram, LINE, Zalo, IRC, Nextcloud Talk tokens) refuse symlinked credential files instead of silently accepting them, and the infra-state CI shard's secret-file symlink test passes again. Thanks [@romneyda](https://github.com/romneyda). - Browser: honor the configured image sanitization limit for screenshots and labeled snapshots so browser-captured images follow the same resize policy as other image results. ([#84595](openclaw/openclaw#84595)) - Doctor: remove unrecognized `models.providers.*.models[*].compat.thinkingFormat` values during `doctor --fix` so stale provider model config can validate after upgrade. Fixes [#77803](openclaw/openclaw#77803). - Doctor: warn when `openclaw.json` stores plaintext secret-bearing config fields, including model provider API keys and sensitive provider headers. ([#84718](openclaw/openclaw#84718)) Thanks [@lukaIvanic](https://github.com/lukaIvanic). - Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from `agents.defaults.model.primary`. - WebChat: clear stale typing indicators when session change events mark the active chat run complete. - Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports. - macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows. - Cron: deliver preferred final assistant output for successful scheduled runs when trailing plain tool warnings remain in diagnostics instead of marking the run failed. - fix(mattermost): fail closed on missing channel type \[AI]. ([#84091](openclaw/openclaw#84091)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Recheck rebuilt system.run argv \[AI]. ([#84090](openclaw/openclaw#84090)) Thanks [@pgondhi987](https://github.com/pgondhi987). - CLI: keep the private QA subcommand out of exported command descriptors unless `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1`, so root help and subcommand markers match runtime registration. ([#84519](openclaw/openclaw#84519)) - CLI/cron: bound `openclaw cron show` job lookup pagination so non-advancing or unbounded `cron.list` responses fail instead of hanging the command. Fixes [#83856](openclaw/openclaw#83856). ([#83989](openclaw/openclaw#83989)) - Agents/messages: stop message-tool-only turns after a successful source-channel `message` send while keeping transcript mirrors under the session write lock. ([#84289](openclaw/openclaw#84289)) - Agents: filter silent heartbeat response-tool transcript artifacts out of embedded context snapshots so later user turns are not polluted by heartbeat no-op messages. ([#83477](openclaw/openclaw#83477)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Agents/OpenAI: log repeated strict tool-schema downgrade diagnostics once per provider/model/tool signature, reducing duplicate debug noise while preserving `strict=false` fallback behavior. Fixes [#82930](openclaw/openclaw#82930). ([#82933](openclaw/openclaw#82933)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/code mode: spell out the `exec` tool's JavaScript/TypeScript, no Node module, and catalog-bridge constraints in model-visible schema text so agents can use enabled tools without trial-and-error. ([#84269](openclaw/openclaw#84269)) Thanks [@Kaspre](https://github.com/Kaspre). - Codex: give `image_generate` dynamic-tool calls a 120s default watchdog when no per-call or configured image timeout is set, so image generation no longer falls back to the generic 30s bridge timeout. ([#84254](openclaw/openclaw#84254)) Thanks [@moritzmmayerhofer](https://github.com/moritzmmayerhofer). - Codex: avoid duplicate dynamic tool terminal diagnostics while large diagnostic backlogs drain without blocking tool responses. ([#82937](openclaw/openclaw#82937)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI/message: include a stable top-level `messageId` in `openclaw message --json` output when channel sends return one. ([#84191](openclaw/openclaw#84191)) Thanks [@100menotu001](https://github.com/100menotu001). - Cron: preserve legacy top-level array `jobs.json` stores when loading or adding scheduled jobs so old cron jobs are no longer treated as an empty store during upgrade. Fixes [#60799](openclaw/openclaw#60799). ([#84433](openclaw/openclaw#84433)) Thanks [@IWhatsskill](https://github.com/IWhatsskill). - Gateway/agents: use an agent's `identity.name` in Gateway agent summaries when `agents.list[].name` is unset, so configured agent labels remain visible in clients. ([#84355](openclaw/openclaw#84355); refs [#57835](openclaw/openclaw#57835)) Thanks [@luoyanglang](https://github.com/luoyanglang). - Channels/replies: keep normal `/verbose` failed-tool progress compact in message-tool replies and prevent late text-only tool output from appearing after the final answer. ([#84303](openclaw/openclaw#84303)) Thanks [@VACInc](https://github.com/VACInc). - Plugins/hooks: apply a default 30-second timeout to `before_compaction` and `after_compaction` hooks so a hung plugin handler no longer blocks compaction completion. ([#84153](openclaw/openclaw#84153)) - Discord: preserve disabled presentation buttons when adapting and rendering Discord message controls. ([#84188](openclaw/openclaw#84188)) Thanks [@100menotu001](https://github.com/100menotu001). - Twitch: add a test-only client-manager registry reset helper so non-isolated Twitch tests can clear cached managers between cases. Fixes [#83887](openclaw/openclaw#83887). ([#84244](openclaw/openclaw#84244)) Thanks [@hclsys](https://github.com/hclsys). - Cron: run main-session scheduled work on a cron-owned wake lane while preserving reply delivery context, so background cron turns no longer block human main-session chat. Fixes [#82766](openclaw/openclaw#82766). ([#82767](openclaw/openclaw#82767)) Thanks [@galiniliev](https://github.com/galiniliev). - Cron: use structured embedded-run denial metadata for isolated scheduled tasks so blocked exec requests fail the job without treating ordinary assistant prose as a denial. ([#84067](openclaw/openclaw#84067)) Thanks [@abnershang](https://github.com/abnershang). - Cron: keep recovered tool warnings diagnostic for successful scheduled runs so final cron output is delivered instead of being replaced by a post-processing warning. ([#84045](openclaw/openclaw#84045)) Thanks [@abnershang](https://github.com/abnershang). - Plugins/perf: thread explicit plugin discovery results through `loadBundledCapabilityRuntimeRegistry`, `resolveBundledPluginSources`, and `listChannelCatalogEntries` so callers that already hold a discovery result skip redundant filesystem walks. Thanks [@SebTardif](https://github.com/SebTardif). - harden update restart script creation \[AI]. ([#84088](openclaw/openclaw#84088)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Docker: keep the bundled Codex plugin in official release image keep lists so the default OpenAI agent harness remains available after Docker pruning. Fixes [#83613](openclaw/openclaw#83613). ([#83626](openclaw/openclaw#83626)) Thanks [@YuanHanzhong](https://github.com/YuanHanzhong). - CLI/channels: preserve the first line of `openclaw channels logs` output when the rolling tail window starts exactly on a line boundary, mirroring the already-fixed `readLogSlice` behavior in `src/logging/log-tail.ts`. - Control UI: treat terminal session status as authoritative over stale active-run flags so completed terminal runs stop showing abort/live UI. ([#84057](openclaw/openclaw#84057)) - CLI: preserve embedded equals signs in inline root option values instead of truncating after the second separator. ([#83995](openclaw/openclaw#83995)) Thanks [@ThiagoCAltoe](https://github.com/ThiagoCAltoe). - Matrix/config: accept `messages.queue.byChannel.matrix` queue overrides and keep queue provider schema/type keys aligned for Matrix, Google Chat, and Mattermost. Thanks [@bdjben](https://github.com/bdjben). - CLI: format `openclaw acp client` failures through the shared error formatter so object-shaped errors stay readable instead of printing `[object Object]`. Fixes [#83904](openclaw/openclaw#83904). ([#84080](openclaw/openclaw#84080)) - Providers/Ollama: default unknown-capabilities models to tool-capable so discovered native Ollama models can use tools when `/api/show` omits capabilities. ([#84055](openclaw/openclaw#84055)) Thanks [@dutifulbob](https://github.com/dutifulbob). - Installer/Windows: launch `install.ps1` onboarding as an attached child process so fresh native Windows installs do not freeze visibly at `Starting setup...` or corrupt the wizard's terminal rendering. - CLI/update: keep restart health checks working across one-version CLI/Gateway protocol skew and use the managed Gateway service Node for all follow-up commands even when the package root is unchanged, so `openclaw update` no longer silently switches the gateway to a different Node binary when multiple Node installations are present. Thanks [@amknight](https://github.com/amknight). - CLI/gateway: include the running Gateway version in `gateway status` JSON output, preserving existing server metadata while falling back to status RPC data for read probes. Fixes [#56222](openclaw/openclaw#56222). Thanks [@galiniliev](https://github.com/galiniliev). - Memory/search: close local embedding providers when active-memory searches time out so pending local model loads and embedding contexts are aborted and released. ([#83858](openclaw/openclaw#83858)) Thanks [@brokemac79](https://github.com/brokemac79). - CLI/nodes: request pending node surface approval scopes before `openclaw nodes approve` so exec-capable node approval can use admin-scoped Gateway credentials instead of failing with `missing scope: operator.admin`. ([#84392](openclaw/openclaw#84392)) Thanks [@joshavant](https://github.com/joshavant). - Gateway: reject slow node event sends before outbound buffers grow unbounded and log the rejected payload diagnostic. ([#84387](openclaw/openclaw#84387)) Thanks [@samzong](https://github.com/samzong). - Agents: include bounded trajectory queued-writer diagnostics in `pi-trajectory-flush` timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes [#82961](openclaw/openclaw#82961). ([#82962](openclaw/openclaw#82962)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes [#83699](openclaw/openclaw#83699). ([#83700](openclaw/openclaw#83700)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes [#84040](openclaw/openclaw#84040). ([#84357](openclaw/openclaw#84357)) Thanks [@joshavant](https://github.com/joshavant). - Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as `anthropic/opus-4.7` no longer fall back to embedded Anthropic billing. Fixes [#84222](openclaw/openclaw#84222). ([#84374](openclaw/openclaw#84374)) Thanks [@joshavant](https://github.com/joshavant). - Agents: honor explicit `models.providers.<id>.timeoutSeconds` values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at \~120s when the provider timeout is higher. ([#83979](openclaw/openclaw#83979)) Thanks [@yujiawei](https://github.com/yujiawei). - Agents/Codex: keep encrypted Responses reasoning replay provenance-bound so stale mirrored Codex transcripts drop invalid encrypted content before request assembly while preserving matching same-session replay. Fixes [#83836](openclaw/openclaw#83836). ([#84367](openclaw/openclaw#84367)) Thanks [@joshavant](https://github.com/joshavant). - Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing `reason=no_active_run` queue noise. ([#82964](openclaw/openclaw#82964)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. ([#83931](openclaw/openclaw#83931)) Thanks [@honor2030](https://github.com/honor2030). - Media: decode URL path basenames before using them as remote media fallback filenames, so files like `My%20Report.pdf` are surfaced as `My Report.pdf`. Fixes [#84050](openclaw/openclaw#84050). ([#84052](openclaw/openclaw#84052)) Thanks [@jbetala7](https://github.com/jbetala7). - WhatsApp: clarify inbound group diagnostics so observed but unregistered groups point to `channels.whatsapp.groups` without changing routing or sender authorization. ([#83846](openclaw/openclaw#83846)) Thanks [@neeravmakwana](https://github.com/neeravmakwana). - WhatsApp: drain pending outbound deliveries on a 30s periodic timer in addition to the reconnect handler, so messages enqueued while the provider is already connected no longer wait for the next reconnect to send. ([#79083](openclaw/openclaw#79083)) Thanks [@Oviemudiaga](https://github.com/Oviemudiaga). - CLI/TUI: include gateway plugin slash commands in TUI autocomplete, so connected sessions can suggest plugin-owned commands exposed by the running Gateway. ([#83640](openclaw/openclaw#83640)) Thanks [@se7en-agent](https://github.com/se7en-agent). - Gateway/mobile: restore QR setup-code handoff of bounded operator tokens for iOS and Android onboarding while keeping admin and pairing scopes out of bootstrap. ([#83684](openclaw/openclaw#83684)) Thanks [@ngutman](https://github.com/ngutman). - iOS: repair Release archive compilation for the TestFlight build. ([#84255](openclaw/openclaw#84255)) Thanks [@ngutman](https://github.com/ngutman). - Agents/compaction: bound plugin-owned CLI transcript compaction with the host safety timeout so a hung context engine can no longer stall post-turn cleanup. ([#84083](openclaw/openclaw#84083)) Thanks [@100yenadmin](https://github.com/100yenadmin). - Control UI/usage: truncate long context skill, tool, and file names in the usage panel while keeping the full name available on hover. ([#42197](openclaw/openclaw#42197)) Thanks [@Rain120](https://github.com/Rain120). - Codex: respect explicit `models auth order set` and `config.auth.order` precedence over stale `lastGood` in `/codex account`, and show `no working credential` when every explicit-order profile is ineligible instead of marking a lower-ranked profile as active. Fixes [#84386](openclaw/openclaw#84386). ([#84412](openclaw/openclaw#84412)) Thanks [@openperf](https://github.com/openperf). - Agents: honor `messages.suppressToolErrors` for mutating tool failures so configured chat surfaces do not receive separate warning payloads. ([#81561](openclaw/openclaw#81561)) Thanks [@moeedahmed](https://github.com/moeedahmed). - Agents/fallback: surface billing guidance for mixed rate-limit plus billing fallback exhaustion instead of generic failure copy. Fixes [#79396](openclaw/openclaw#79396). ([#79489](openclaw/openclaw#79489)) Thanks [@aayushprsingh](https://github.com/aayushprsingh). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/615

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

…stack-dev

…stack-dev)

…ller-stack-dev

…ller-stack-dev)

openclaw-barnacle Bot added docs Improvements or additions to documentation extensions: xai size: M triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 19, 2026

obviyus self-assigned this May 19, 2026

clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels May 19, 2026

fuller-stack-dev force-pushed the codex/xai-device-code-auth branch from 73f8c31 to f5af40c Compare May 19, 2026 05:58

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 19, 2026

openclaw-barnacle Bot added size: L and removed size: M labels May 19, 2026

fuller-stack-dev and others added 3 commits May 19, 2026 06:47

feat(xai): add device code oauth login

abcc1aa

fix(xai): decouple device code discovery

e73b283

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

2693a99

…stack-dev)

obviyus force-pushed the codex/xai-device-code-auth branch from 635bdab to 2693a99 Compare May 19, 2026 06:49

obviyus added a commit to fuller-stack-dev/openclaw that referenced this pull request May 19, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

f800dc0

…ller-stack-dev)

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

c6967ee

…ller-stack-dev)

clawsweeper Bot added the status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. label May 19, 2026

obviyus merged commit 1d77170 into openclaw:main May 19, 2026
115 of 122 checks passed

obviyus added a commit that referenced this pull request May 19, 2026

fix(xai): add device code changelog (#84005) (thanks @fuller-stack-dev)

6ee60fc

github-actions Bot mentioned this pull request May 19, 2026

📡 Upstream Digest — 2026-05-19 07:37 UTC curtismercier/openclaw-mods#896

Open

clawsweeper Bot mentioned this pull request May 20, 2026

xAI OAuth fails: api:access scope rejected by xAI server ("Unknown scope: ap") #84379

Closed

clawsweeper Bot mentioned this pull request May 22, 2026

[Bug]: #85228

Open

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

1d2f7c1

…stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

582a1e3

…ller-stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

561d40c

…stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

6bb0489

…ller-stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

6bec453

…stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

17c229f

…ller-stack-dev)

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

2a62422

…stack-dev)

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

ab3767b

…ller-stack-dev)

galiniliev pushed a commit to galiniliev/openclaw that referenced this pull request May 25, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

85f424e

…stack-dev)

galiniliev pushed a commit to galiniliev/openclaw that referenced this pull request May 25, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

a941b7b

…ller-stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

02b0d5c

…stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

8e63e0f

…ller-stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

ef1cc15

…stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

85d4276

…ller-stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

e456110

…stack-dev)

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

ed99ff4

…ller-stack-dev)

jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

c3e4ed2

…stack-dev)

jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

7b7364c

…ller-stack-dev)

SYU8384 pushed a commit to SYU8384/openclaw that referenced this pull request Jun 3, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

14f073e

…stack-dev)

SYU8384 pushed a commit to SYU8384/openclaw that referenced this pull request Jun 3, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

ad35456

…ller-stack-dev)

sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026

fix(xai): add device code changelog (openclaw#84005) (thanks @fuller-…

c0b5c6c

…stack-dev)

sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026

fix(xai): use public plugin test runtime (openclaw#84005) (thanks @fu…

c2b85e8

…ller-stack-dev)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(xai): add device code OAuth login#84005

feat(xai): add device code OAuth login#84005
obviyus merged 4 commits into
openclaw:mainfrom
fuller-stack-dev:codex/xai-device-code-auth

fuller-stack-dev commented May 19, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 19, 2026 •

edited

Loading

Uh oh!

fuller-stack-dev commented May 19, 2026

Uh oh!

clawsweeper Bot commented May 19, 2026 •

edited

Loading

Uh oh!

obviyus commented May 19, 2026

Uh oh!

Uh oh!

obviyus commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

fuller-stack-dev commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof

Tests

Uh oh!

clawsweeper Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fuller-stack-dev commented May 19, 2026

Uh oh!

clawsweeper Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

obviyus commented May 19, 2026

Uh oh!

Uh oh!

obviyus commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fuller-stack-dev commented May 19, 2026 •

edited

Loading

clawsweeper Bot commented May 19, 2026 •

edited

Loading

clawsweeper Bot commented May 19, 2026 •

edited

Loading