Skip to content

fix: load Claude CLI OAuth for PI auth profiles#87167

Merged
joshavant merged 6 commits into
mainfrom
joshavant/auth-profile-secretref-regressions
May 27, 2026
Merged

fix: load Claude CLI OAuth for PI auth profiles#87167
joshavant merged 6 commits into
mainfrom
joshavant/auth-profile-secretref-regressions

Conversation

@joshavant

@joshavant joshavant commented May 27, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Keep SecretRef/auth-profile startup snapshots static-only while loading scoped Claude CLI external OAuth only at PI run time when that auth can actually be selected.
  • Share that external CLI auth-selection path with /btw, so side questions preserve Claude CLI OAuth when the active session has a stale auto-selected static Anthropic profile.
  • Cover Claude CLI OAuth selected by config order, persisted auth-store order, explicit PI runtime, runtime policy, stale auto session profiles, legacy user-locked auth overrides, /btw, and direct Anthropic auth with Claude CLI fallback.
  • Preserve static Anthropic PI and /btw auth on the no-external auth-profile store path.
  • LoC against origin/main: production: ~320 added lines; tests: ~740 added lines.

Refs #86756.

Verification

  • .agents/skills/autoreview/scripts/autoreview --mode local (clean after fixing first-pass legacy source-less override finding)
  • node scripts/run-vitest.mjs src/agents/btw.test.ts -- --reporter=verbose (2 files passed, 66 tests passed)
  • node scripts/run-vitest.mjs src/agents/pi-embedded-runner/run.overflow-compaction.test.ts src/agents/auth-profiles.external-cli-sync.test.ts src/agents/auth-profiles.external-cli-scope.test.ts src/agents/model-runtime-aliases.test.ts -- --reporter=verbose (6 files passed, 129 tests passed)
  • ./node_modules/.bin/oxfmt --check --threads=1 src/agents/auth-profiles/external-cli-auth-selection.ts src/agents/pi-embedded-runner/run.ts src/agents/btw.ts src/agents/btw.test.ts
  • git diff --check

Real behavior proof

Behavior addressed: PI embedded runs and /btw side questions using Claude CLI OAuth no longer lose runtime-only Claude CLI credentials when the static SecretRef/auth-profile snapshot excludes external OAuth profiles.
Real environment tested: Local macOS checkout with real Claude Code OAuth copied from the local Claude credential source into an isolated HOME, no Anthropic or Claude token env vars present, synthetic OpenClaw auth-profile config/store state, and PI embedded-runner plus /btw live requests; earlier branch proof also used direct AWS Crabbox Linux for the SecretRef/auth-profile regression tests.
Exact steps or command run after this patch: node scripts/run-vitest.mjs src/agents/btw.test.ts -- --reporter=verbose; node scripts/run-vitest.mjs src/agents/pi-embedded-runner/run.overflow-compaction.test.ts src/agents/auth-profiles.external-cli-sync.test.ts src/agents/auth-profiles.external-cli-scope.test.ts src/agents/model-runtime-aliases.test.ts -- --reporter=verbose; then one-off node --import tsx/esm --input-type=module live probes with HOME, OPENCLAW_STATE_DIR, and OPENCLAW_SKIP_CHANNELS=1 isolated from the user profile, including stale-session repro probes and clean happy-path probes with no session auth override.
Evidence after fix: Focused /btw proof passed 2 files / 66 tests; PI/auth regression proof passed 6 files / 129 tests; the live stale-session PI prompt returned exactly OC87167_PI_OK; the live stale-session /btw side question returned exactly OC87167_PI_OK; the clean live auth resolver selected anthropic:claude-cli OAuth; the clean live PI prompt returned exactly OC87167_HAPPY_PI_OK; the clean live /btw side question returned exactly OC87167_HAPPY_PI_OK.
Observed result after fix: PI and /btw load ensureAuthProfileStore(... externalCliProviderIds: ["claude-cli"], allowKeychainPrompt: false) when Claude CLI OAuth is selected by config auth order, persisted auth-store order, runtime policy, explicit PI runtime, or fallback order; stale auto-selected static Anthropic profiles no longer suppress Claude CLI OAuth; user-locked static Anthropic profiles, including legacy source-less overrides, continue using the static profile path; clean Claude CLI OAuth PI and /btw flows still work without stale session auth state.
What was not tested: Full production UI/manual slash-command dispatch was not driven end-to-end; the live proof calls the same embedded PI and /btw runtime entrypoints directly with isolated local state.

@joshavant joshavant requested a review from a team as a code owner May 27, 2026 05:01
@openclaw-barnacle openclaw-barnacle Bot added agents Agent runtime and tooling size: S maintainer Maintainer-authored PR labels May 27, 2026
@clawsweeper

clawsweeper Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed May 27, 2026, 4:14 AM ET / 08:14 UTC.

Summary
The branch adds a shared Claude CLI external-OAuth selection helper and wires PI embedded runs plus /btw to load scoped runtime-only Claude CLI OAuth, with regression coverage for auth-profile persistence and SecretRef/OAuth preservation.

PR surface: Source +300, Tests +737. Total +1037 across 7 files.

Reproducibility: yes. source-reproducible: current main's PI and /btw paths use the no-external/static auth-profile snapshot, and the linked issue plus PR body give concrete stale-session Claude CLI OAuth probes. I did not rerun the live OAuth flow in this read-only review.

Review metrics: 1 noteworthy metric.

  • Runtime auth entrypoints changed: 2 changed. Both PI embedded runs and /btw now decide when to load runtime-only Claude CLI OAuth, so credential precedence must be reviewed across both user paths.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none

Risk before merge

  • Merging changes credential precedence for existing PI and /btw runs when stale auto-selected static Anthropic profiles coexist with runtime-only Claude CLI OAuth; maintainers should confirm that upgrade behavior before landing.
  • The branch was cut before current main's broader external CLI auth startup-scope work, so review should confirm the new selection-specific overlay remains consistent with that adjacent main-only path.

Maintainer options:

  1. Approve credential precedence before merge (recommended)
    A maintainer should explicitly confirm that stale auto-selected profiles may yield to runtime-only Claude CLI OAuth for PI and /btw, while user-locked static profiles remain pinned.
  2. Refresh against current main if needed
    If CI or review finds drift with the newer external CLI startup-scope path, rebase and keep the selection helper consistent with that main-only behavior before merge.
  3. Pause if precedence is unsettled
    If maintainers are not ready to change auth selection for upgraded sessions, keep the PR paused until the default and upgrade behavior are written down.

Next step before merge
Human maintainer review should decide the auth-provider compatibility and credential-precedence behavior before merge; there is no narrow automated repair blocker left.

Security
Cleared: No concrete security or supply-chain regression was found; the auth-sensitive changes keep keychain prompting disabled and do not touch workflows, dependencies, lockfiles, or secret-printing paths.

Review details

Best possible solution:

Land the focused runtime auth fix after maintainer auth-provider compatibility sign-off and current-main CI, while keeping any remaining on-disk SecretRef migration gap tracked by the linked issue.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main's PI and /btw paths use the no-external/static auth-profile snapshot, and the linked issue plus PR body give concrete stale-session Claude CLI OAuth probes. I did not rerun the live OAuth flow in this read-only review.

Is this the best way to solve the issue?

Mostly yes. A shared selection helper is a maintainable way to keep PI and /btw aligned, but the credential-precedence change needs maintainer compatibility sign-off before merge.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against cefa6777e20d.

Label changes

Label justifications:

  • P2: This is a normal-priority auth-provider bug fix with limited blast radius but real impact on Claude CLI OAuth PI and /btw runs.
  • merge-risk: 🚨 compatibility: The patch changes how existing stale auto-selected and user-locked auth profiles interact with runtime-only external OAuth during upgrades.
  • merge-risk: 🚨 auth-provider: The patch changes provider credential selection for Claude CLI OAuth in PI embedded runs and /btw side questions.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live output from isolated local state with real Claude Code OAuth, exact PI and /btw success markers, and focused regression tests; full slash-command UI dispatch remains untested but is not required for this proof gate.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live output from isolated local state with real Claude Code OAuth, exact PI and /btw success markers, and focused regression tests; full slash-command UI dispatch remains untested but is not required for this proof gate.
Evidence reviewed

PR surface:

Source +300, Tests +737. Total +1037 across 7 files.

View PR surface stats
Area Files Added Removed Net
Source 3 310 10 +300
Tests 4 738 1 +737
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 7 1048 11 +1037

What I checked:

  • Root policy read and applied: Root AGENTS.md treats provider routing, auth/session state, persisted preferences, config loading, setup, startup checks, and fallback behavior as compatibility-sensitive, which directly applies to this auth-provider PR. (AGENTS.md:26, cefa6777e20d)
  • Scoped agents policy read: The scoped agents guide favors narrow helpers and dependency injection around expensive runtime work; the PR's helper and mocked agent tests fit that review context. (src/agents/AGENTS.md:14, cefa6777e20d)
  • Current main PI behavior: Current main's non-plugin PI path still uses ensureAuthProfileStoreWithoutExternalProfiles, so runtime-only Claude CLI OAuth is not loaded through that startup snapshot today. (src/agents/pi-embedded-runner/run.ts:712, cefa6777e20d)
  • Current main /btw behavior: Current main passes the session auth profile directly to getApiKeyForModel without a scoped external CLI overlay store, matching the stale-auto-profile failure mode described in the PR body. (src/agents/btw.ts:399, cefa6777e20d)
  • PR PI implementation: The PR computes a selection-specific external CLI auth scope and calls ensureAuthProfileStore(... externalCliProviderIds: ...) only when Claude CLI OAuth can actually be selected for the PI run. (src/agents/pi-embedded-runner/run.ts:712, 75875a919c34)
  • PR /btw implementation: The PR applies the same scoped external CLI auth selection to /btw, ignores stale auto-selected profiles when Claude CLI OAuth should win, and passes the scoped store to getApiKeyForModel. (src/agents/btw.ts:418, 75875a919c34)

Likely related people:

  • Peter Steinberger: git blame and path shortlog tie much of the current PI, /btw, and auth-profile store surface to recent work in the affected files. (role: recent area contributor; confidence: high; commits: b28f9e0df35b, ee51169b2063; files: src/agents/pi-embedded-runner/run.ts, src/agents/btw.ts, src/agents/auth-profiles/store.ts)
  • Vincent Koc: Recent history shows repeated OAuth/auth-runtime refactors and fixes in the auth-profile area that this PR builds on. (role: auth/runtime adjacent owner; confidence: medium; commits: 4a4f52b097, f6921fd733, 859eb06662; files: src/agents/auth-profiles, src/agents/model-auth.ts)
  • Josh Avant: Beyond authoring this branch, Josh has recent merged PI embedded-runner work, so he is a useful routing contact for the changed PI surface. (role: current PR author and recent adjacent contributor; confidence: medium; commits: 75875a919c34, 3349fe21bbde; files: src/agents/auth-profiles/external-cli-auth-selection.ts, src/agents/pi-embedded-runner/run.ts, src/agents/btw.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. labels May 27, 2026
@clawsweeper

clawsweeper Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper PR egg

✨ Hatched: 🥚 common Gilded Shellbean

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

  • Merged PRs are hatchable.
  • Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
  • Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: keeps receipts.
Image traits: location status garden; accessory review stamp; palette coral, mint, and warm cream; mood celebratory; pose nestled inside a glowing shell; shell soft velvet shell; lighting soft studio lighting; background little resolved-comment flags.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Gilded Shellbean in ClawSweeper.

What is this egg doing here?
  • Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
  • The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
  • Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
  • The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
  • Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

@clawsweeper clawsweeper Bot added the merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. label May 27, 2026
@joshavant joshavant changed the title test: cover auth profile SecretRef regressions fix: load Claude CLI OAuth for PI auth profiles May 27, 2026
@joshavant joshavant force-pushed the joshavant/auth-profile-secretref-regressions branch from 0e13996 to 2e0af10 Compare May 27, 2026 06:30
@clawsweeper clawsweeper Bot added merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. and removed merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. labels May 27, 2026
@joshavant

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@joshavant

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Re-review progress:

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels May 27, 2026
@joshavant joshavant merged commit cc704ca into main May 27, 2026
97 of 98 checks passed
@joshavant joshavant deleted the joshavant/auth-profile-secretref-regressions branch May 27, 2026 08:15
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 28, 2026
* test: cover auth profile SecretRef regressions

* docs: note auth profile regression coverage

* test: satisfy auth profile regression lint

* fix: load Claude CLI OAuth overlay for PI runs

* fix(agents): share external CLI auth selection with btw

* chore: remove release-owned changelog entry
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request May 28, 2026
…026.5.27) (#698)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.26` → `2026.5.27` |

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.5.27`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026527)

[Compare Source](openclaw/openclaw@v2026.5.26...v2026.5.27)

##### Highlights

- Safer local/runtime boundaries: OpenClaw now rejects unsafe command wrappers, malformed CLI numeric options, unsafe Node runtime env overrides, no-auth Tailscale exposure, and non-admin device-role pairing approvals before they can affect live runs. ([#&#8203;87308](openclaw/openclaw#87308), [#&#8203;87305](openclaw/openclaw#87305), [#&#8203;87292](openclaw/openclaw#87292), [#&#8203;87146](openclaw/openclaw#87146))
- Matrix and auto-reply delivery are steadier: mention previews stay inert, final mention replies deliver normally, shared-DM notices are awaited, MXID parsing ignores filenames, and reasoning-prefixed `NO_REPLY` responses stay suppressed.
- Provider and agent reliability improved across OpenAI-compatible embeddings, cached token usage, Anthropic/Codex/Claude runtime state, unsupported tool-schema quarantine, heartbeat templates, and session fallback errors. ([#&#8203;85269](openclaw/openclaw#85269), [#&#8203;82062](openclaw/openclaw#82062), [#&#8203;85416](openclaw/openclaw#85416), [#&#8203;86855](openclaw/openclaw#86855))
- Plugin and package release paths got tighter: Pixverse ships as an external video plugin with region selection, package exclusions and shrinkwrap inventory match the published npm shape, and release/package smoke commands fail bounded instead of hanging.
- Gateway hot paths do less rediscovery by reusing current plugin metadata fingerprints, stable plugin index fingerprints, read-only session metadata, active working stores, status fast paths, and auth/env snapshots. ([#&#8203;86439](openclaw/openclaw#86439))

##### Changes

- Memory: add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support. ([#&#8203;85269](openclaw/openclaw#85269)) Thanks [@&#8203;dutifulbob](https://github.com/dutifulbob).
- Plugin SDK: mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics. ([#&#8203;85072](openclaw/openclaw#85072)) Thanks [@&#8203;mbelinky](https://github.com/mbelinky).
- Pixverse: add video generation provider support, API region selection, and external plugin publishing.
- Plugins: expose approval action metadata for plugin-driven approval surfaces.

##### Fixes

- Security/CLI/runtime: harden hostname normalization for repeated trailing dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject loose numeric CLI and gateway options, require admin approval for node device-role pairing, and reject no-auth Tailscale exposure. ([#&#8203;87305](openclaw/openclaw#87305), [#&#8203;87292](openclaw/openclaw#87292), [#&#8203;87308](openclaw/openclaw#87308), [#&#8203;87146](openclaw/openclaw#87146)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987).
- Doctor: validate runtime tool schemas for every configured embedded agent while skipping ACP-only profiles, so bad non-default plugin or MCP tools are reported before assistant turns.
- Telegram: route `sendMessage` action replies through durable outbound delivery so completed agent responses remain retryable when the gateway send path times out. ([#&#8203;87261](openclaw/openclaw#87261)) Thanks [@&#8203;mbelinky](https://github.com/mbelinky).
- Matrix/auto-reply: keep draft previews mention-inert, preserve final mention delivery, send mention finals normally, await shared DM notices, ignore filename-embedded MXIDs, and suppress reasoning-prefixed `NO_REPLY` responses.
- Agents/providers: add OpenAI-compatible cache retention, forward cached token usage in chat completions, preserve runtime context before active user turns, strip stale Anthropic thinking, load Claude CLI OAuth for Pi auth profiles, avoid false Codex runtime live switches, and quarantine unsupported tool schemas. ([#&#8203;82062](openclaw/openclaw#82062), [#&#8203;87167](openclaw/openclaw#87167), [#&#8203;86855](openclaw/openclaw#86855))
- Gateway/performance: cache plugin metadata fingerprints and stable plugin index fingerprints, borrow read-only session metadata safely, keep the active session working store hot, keep status on a bounded fast path, and preserve model auth profile suffixes. ([#&#8203;86439](openclaw/openclaw#86439))
- Package/install/release: align npm package exclusions and inventory, omit unpacked test helpers, skip Homebrew until macOS packages need it, cap tsdown heap in containers, bound install/release smoke waits, and harden post-publish verification.
- Codex/Auth: bound ChatGPT OAuth token exchange and refresh requests, and honor cancellation across Codex and Anthropic OAuth login flows.
- QA/E2E/CI: bound Telegram, kitchen-sink, Open WebUI, ClawHub, MCP, Discord, realtime, labeler, and GitHub API waits; fail empty explicit test, live-media, gateway CPU, startup benchmark, plugin gauntlet, and beta-smoke runs instead of false-greening.
- Agents/Codex: keep spawned agent bootstrap files rooted in the agent workspace while running task commands, transcripts, and compaction from the requested cwd. ([#&#8203;87218](openclaw/openclaw#87218)) Thanks [@&#8203;mbelinky](https://github.com/mbelinky).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/698
SYU8384 pushed a commit to SYU8384/openclaw that referenced this pull request Jun 3, 2026
* test: cover auth profile SecretRef regressions

* docs: note auth profile regression coverage

* test: satisfy auth profile regression lint

* fix: load Claude CLI OAuth overlay for PI runs

* fix(agents): share external CLI auth selection with btw

* chore: remove release-owned changelog entry
sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026
* test: cover auth profile SecretRef regressions

* docs: note auth profile regression coverage

* test: satisfy auth profile regression lint

* fix: load Claude CLI OAuth overlay for PI runs

* fix(agents): share external CLI auth selection with btw

* chore: remove release-owned changelog entry
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agents Agent runtime and tooling maintainer Maintainer-authored PR merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: XL status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant