openclaw - 💡(How to fix) Fix Bug: gateway boot loads stale OAuth tokens on macOS; doesn't re-read keychain for `anthropic:claude-cli` profile (follow-up to #71026) [2 comments, 2 participants]

This is a macOS-keychain analog of the recently-closed #71026 ("Auth token sync: claude-cli OAuth token not refreshed in auth-profiles.json"). The fix for #71026 covers Linux's ~/.claude/.credentials.json but the identical symptom still reproduces on macOS where Claude CLI stores the OAuth refresh-token in the macOS keychain (security framework) rather than a flat JSON file.

When anthropic:claude-cli (and similar keychain-backed OAuth profiles) refresh their token through claude CLI's auth flow, the new token lands in the keychain. But the gateway's auth-profiles.json cache holds the previous token until manually re-synced.

Reproduce:

1. Configure anthropic:claude-cli OAuth profile.
2. Force a token refresh via claude /login.
3. Restart gateway. Observe: gateway uses the stale token from auth-profiles.json, not the fresh token in keychain. Provider calls fail with "401 invalid_credentials" until the user manually re-runs the keychain sync.

Workaround we patched today (this fork): wrote a chuck-mac-self-heal loop that re-reads keychain → auth-profiles.json on every boot. This belongs upstream in openclaw itself.

Proposed fix: on gateway boot, for any provider profile whose source is keychain (per the auth-profiles.json source field), re-read the keychain entry and update the in-memory cache. Specifically for the keychain-backed Anthropic OAuth path used by claude-cli, the keychain lookup is cheap (<10ms) so doing it on every boot has no measurable cost.

Code pointer: src/agents/auth/auth-profiles.ts (or wherever auth profiles hydrate during boot).