feat: add OpenRouter OAuth to onboarding by Patrick-Erichsen · Pull Request #91830 · openclaw/openclaw

Patrick-Erichsen · 2026-06-10T04:21:47Z

Summary

Cherry-pick [codex] Add OpenRouter OAuth login #91031 to add provider-owned OpenRouter PKCE OAuth login while preserving @kenrogers' authorship.
Feature OpenRouter in the top-level CLI model/auth provider picker so onboarding shows it alongside OpenAI, Anthropic, xAI, and Google.
Keep OAuth mechanics owned by the OpenRouter provider metadata/runtime path instead of adding provider-specific onboarding code in core.

Verification

node scripts/run-vitest.mjs extensions/openrouter/oauth.test.ts extensions/openrouter/index.test.ts extensions/openrouter/onboard.test.ts extensions/openrouter/provider-runtime.contract.test.ts src/plugins/contracts/providers.contract.test.ts src/plugins/contracts/registry.contract.test.ts src/commands/auth-choice.test.ts src/commands/models/auth.test.ts src/commands/auth-choice-options.test.ts
git diff --check origin/main..HEAD
pnpm exec oxfmt --check src/commands/auth-choice-options.ts src/commands/auth-choice-options.test.ts extensions/openrouter/index.test.ts extensions/openrouter/oauth.ts extensions/openrouter/provider-contract-api.ts extensions/openrouter/openclaw.plugin.json
pnpm docs:list
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main

Real behavior proof

Behavior addressed: OpenRouter appears as a first-class top-level choice in the CLI model/auth provider picker, and selecting it shows the expected setup hint.

Real environment tested: Local OpenClaw checkout on macOS with an isolated temporary OpenClaw home/config path.

Exact steps or command run after this patch:

tmp=$(mktemp -d /tmp/openclaw-openrouter-onboarding-proof.XXXXXX)
env OPENCLAW_HOME="$tmp" \
  OPENCLAW_STATE_DIR="$tmp/state" \
  OPENCLAW_CONFIG_PATH="$tmp/openclaw.json" \
  pnpm openclaw configure --section model

Evidence after fix:

OpenClaw configure
Model/auth provider
● OpenAI (ChatGPT/Codex sign-in or API key)
○ Anthropic
○ xAI (Grok)
○ Google
○ OpenRouter
○ More…
○ Skip for now

Selected-row hint proof:

Model/auth provider
○ Google
● OpenRouter (OAuth or API key)
○ More…
○ Skip for now

Observed result after fix: OpenRouter is visible in the top-level provider list and carries the OAuth or API key help text from provider-owned auth metadata.

What was not tested: This PR did not run a fresh live OpenRouter browser consent flow. The cherry-picked OAuth PR includes redacted live proof of browser authorization, callback exchange, stored openrouter:default, and a model call with OPENROUTER_API_KEY unset.

Refs #91031.

(cherry picked from commit dccfb60)

clawsweeper · 2026-06-10T04:24:26Z

Codex review: needs maintainer review before merge. Reviewed June 10, 2026, 12:54 AM ET / 04:54 UTC.

Summary
The PR adds OpenRouter PKCE OAuth login, registers it in OpenRouter provider auth metadata and docs, and features OpenRouter in the top-level CLI model/auth provider picker.

PR surface: Source +459, Tests +350, Docs +41. Total +850 across 10 files.

Reproducibility: not applicable. this is a feature PR, not a bug report. The relevant behavior check is after-fix proof showing OpenRouter in the CLI picker plus predecessor live OAuth proof for the cherry-picked runtime commit.

Review metrics: 1 noteworthy metric.

Provider auth surfaces: 1 OAuth method added; 1 featured auth choice added. This changes the user-facing auth/provider picker and profile-writing behavior, so maintainers should review it as an auth surface change rather than ordinary docs polish.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] Merging ships a new auth-provider path that exchanges a browser OAuth callback for API-key material and writes openrouter:default; the discussion explicitly accepts this auth-provider risk, but it still needs maintainer landing judgment.
[P1] The current branch provides fresh terminal proof for the top-level picker, while the full live browser consent and model-call proof comes from the cherry-picked predecessor branch rather than a fresh run on this exact head.

Maintainer options:

Land With Accepted Auth Risk (recommended)
Maintain the current provider-owned implementation and land it only after the protected auth-provider review accepts the new OAuth-to-API-key storage path.
Request Fresh Live OAuth Proof
If maintainers want branch-local proof instead of relying on the predecessor live run, ask for a fresh redacted OpenRouter browser consent, callback exchange, profile status, and model-call transcript on this head.
Pause In Favor Of The Predecessor
If attribution plus picker follow-up is no longer the desired landing path, pause this PR and make the predecessor branch or a maintainer-owned replacement the canonical target.

Next step before merge

No automated repair is indicated; the remaining action is maintainer review and landing of a protected auth-provider PR with accepted merge risk.

Security
Cleared: The diff is security-sensitive because it adds OAuth callback and credential storage behavior, but I found no concrete supply-chain or credential-handling defect in the reviewed patch.

Review details

Best possible solution:

Land this canonical attributed branch after maintainer auth-provider review, then close the predecessor branch as superseded by this one.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a feature PR, not a bug report. The relevant behavior check is after-fix proof showing OpenRouter in the CLI picker plus predecessor live OAuth proof for the cherry-picked runtime commit.

Is this the best way to solve the issue?

Yes, with maintainer review: the implementation keeps OpenRouter-specific OAuth mechanics inside the OpenRouter plugin and uses existing provider auth metadata for the core picker. The safer alternative would only be to require fresh live OAuth proof on this exact branch before landing.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against b4cdd9211957.

Label changes

Label justifications:

P2: This is a normal-priority provider onboarding feature with limited scope, but it is auth-sensitive and user-facing.
merge-risk: 🚨 auth-provider: The PR adds a new OpenRouter OAuth flow that exchanges callback codes for API-key credentials and changes provider auth/profile behavior.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body and comment include branch-local terminal proof for the CLI picker, and the linked cherry-picked predecessor includes redacted live terminal proof of browser OAuth completion, stored profile use, and an OpenRouter model call.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body and comment include branch-local terminal proof for the CLI picker, and the linked cherry-picked predecessor includes redacted live terminal proof of browser OAuth completion, stored profile use, and an OpenRouter model call.

Evidence reviewed

PR surface:

Source +459, Tests +350, Docs +41. Total +850 across 10 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	5	462	3	+459
Tests	3	350	0	+350
Docs	2	61	20	+41
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	10	873	23	+850

What I checked:

Current main lacks OpenRouter OAuth: Current main's OpenRouter manifest has only the openrouter-api-key provider auth choice, so the requested OAuth onboarding is not already implemented on main. (extensions/openrouter/openclaw.plugin.json:46, b4cdd9211957)
Latest release lacks OpenRouter OAuth: The latest release tag v2026.6.5 shows the same API-key-only OpenRouter auth choice, so this is not already shipped. (extensions/openrouter/openclaw.plugin.json:46, 5181e4f7c82b)
PR adds the manifest auth choice: The PR adds a second OpenRouter provider auth choice with method oauth, choice id openrouter-oauth, and onboardingFeatured: true. (extensions/openrouter/openclaw.plugin.json:61, dfa22c0a73e7)
PR adds provider-owned OAuth runtime: The new OpenRouter OAuth runtime builds the OpenRouter auth URL, validates callback state, exchanges the code at the OpenRouter auth-keys endpoint, and returns an openrouter:default API-key profile plus OpenRouter config defaults. (extensions/openrouter/oauth.ts:162, dfa22c0a73e7)
Picker behavior is covered by branch tests: The PR updates the grouped auth-choice test to include OpenRouter in the featured top-level provider order after Google. (src/commands/auth-choice-options.test.ts:513, dfa22c0a73e7)
Dependency contract checked: OpenRouter's OAuth PKCE guide documents sending users to /auth with callback_url, code_challenge, and code_challenge_method=S256, then exchanging the returned code at /api/v1/auth/keys; the PR follows that shape. (openrouter.ai)

Likely related people:

Peter Steinberger: Introduced the provider onboarding auth metadata manifest path that this PR extends, and has broad prior ownership across provider/plugin auth configuration. (role: feature-history owner; confidence: medium; commits: ae60094fb556, 4a0f72866b4d; files: src/plugins/provider-auth-choices.ts, src/flows/provider-flow.ts, extensions/openrouter/openclaw.plugin.json)
Vincent Koc: Recent OpenRouter provider fixes and provider-family refactors make this person a good routing candidate for OpenRouter runtime behavior. (role: recent OpenRouter contributor; confidence: medium; commits: 791dbf4f9dde, b56517b0eede; files: extensions/openrouter/index.ts, extensions/openrouter/openclaw.plugin.json, docs/providers/openrouter.md)
Dallin Romney: Most recent blame on the OpenRouter provider entry and auth-choice ordering surface comes from a runtime-plugin prewarm refactor that moved the touched files on current main. (role: recent adjacent contributor; confidence: medium; commits: 8b84e951e5a6; files: extensions/openrouter/index.ts, src/commands/auth-choice-options.ts)
Pavan Kumar Gondhi: Recently fixed provider auth-choice resolution and trust boundaries, which are directly adjacent to this PR's manifest auth choice changes. (role: adjacent provider-auth-choice contributor; confidence: medium; commits: 2d97eae53e21; files: src/plugins/provider-auth-choices.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Patrick-Erichsen · 2026-06-10T04:26:15Z

Proof update before review loop:

node scripts/run-vitest.mjs extensions/openrouter/oauth.test.ts extensions/openrouter/index.test.ts extensions/openrouter/onboard.test.ts extensions/openrouter/provider-runtime.contract.test.ts src/plugins/contracts/providers.contract.test.ts src/plugins/contracts/registry.contract.test.ts src/commands/auth-choice.test.ts src/commands/models/auth.test.ts src/commands/auth-choice-options.test.ts — passed 4 shards / 166 tests locally after rebasing on current origin/main.
git diff --check origin/main..HEAD — clean.
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main — clean, no accepted/actionable findings.

CLI prompt proof:

Model/auth provider
● OpenAI (ChatGPT/Codex sign-in or API key)
○ Anthropic
○ xAI (Grok)
○ Google
○ OpenRouter
○ More…
○ Skip for now

Selected-row hint proof:

Model/auth provider
○ Google
● OpenRouter (OAuth or API key)
○ More…
○ Skip for now

Patrick-Erichsen · 2026-06-10T04:26:35Z

/clawsweeper re-review

clawsweeper · 2026-06-10T04:26:37Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Failed
Detail: The targeted re-review did not finish cleanly. Check the workflow run for details.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27254143834
Updated: 2026-06-10T05:21:21.379Z

Patrick-Erichsen · 2026-06-10T04:36:22Z

Maintainer decision: make this PR the canonical landing path for OpenRouter OAuth onboarding.

Rationale:

This branch preserves @kenrogers' original OpenRouter OAuth commit from [codex] Add OpenRouter OAuth login #91031 by cherry-pick, retaining attribution.
It adds the missing follow-up to feature OpenRouter in the top-level onboarding provider picker.
Current-branch proof covers the picker behavior, and the predecessor PR supplies redacted live OAuth callback/exchange/profile/model-call proof for the cherry-picked implementation.

I accept the auth-provider merge-risk label for this landing path. After this PR lands, #91031 should be closed as superseded by the attributed cherry-pick here.

Patrick-Erichsen · 2026-06-10T04:36:30Z

/clawsweeper re-review

clawsweeper · 2026-06-10T04:36:33Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27253521980
Updated: 2026-06-10T04:45:25.883Z

Patrick-Erichsen · 2026-06-10T04:46:09Z

/clawsweeper re-review

clawsweeper · 2026-06-10T04:46:11Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27253856189
Updated: 2026-06-10T04:55:01.251Z

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

kenrogers and others added 2 commits June 9, 2026 21:17

feat: add OpenRouter OAuth login

b318f35

(cherry picked from commit dccfb60)

feat: feature openrouter in onboarding provider picker

dfa22c0

openclaw-barnacle Bot added docs Improvements or additions to documentation commands Command implementations extensions: openrouter size: L maintainer Maintainer-authored PR labels Jun 10, 2026

Patrick-Erichsen merged commit e9671ed into main Jun 10, 2026
229 of 242 checks passed

Patrick-Erichsen deleted the pe/claw-256-openrouter-onboarding branch June 10, 2026 04:59

Patrick-Erichsen mentioned this pull request Jun 10, 2026

[codex] Add OpenRouter OAuth login #91031

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add OpenRouter OAuth to onboarding#91830

feat: add OpenRouter OAuth to onboarding#91830
Patrick-Erichsen merged 2 commits into
mainfrom
pe/claw-256-openrouter-onboarding

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Patrick-Erichsen commented Jun 10, 2026

Summary

Verification

Real behavior proof

Uh oh!

clawsweeper Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

clawsweeper Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

clawsweeper Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Patrick-Erichsen commented Jun 10, 2026

Uh oh!

clawsweeper Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading

clawsweeper Bot commented Jun 10, 2026 •

edited

Loading