PR #80148: fix(auth): persist fresh external-cli credential back to local store when stored profile is expired

• Repository: openclaw/openclaw
• Author: hclsys
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/80148

Description (problem / solution / changelog)

When a non-bootstrapOnly provider (e.g. anthropic:claude-cli) has a stale local profile but the external CLI holds a fresh token, the bootstrap path fires on every auth-resolution call and floods the log with repeated DEBUG messages.

Write the fresh credential back to auth-profiles.json (fire-and-forget) so subsequent calls find a valid local profile and the bootstrap-fallback stops recurring.

Fixes #80129

Changes

• src/agents/auth-profiles/external-auth.ts: after resolving a fresh token from the external CLI, persist it back to the local store via a lazy-loaded upsertAuthProfileWithLock call (dynamic import avoids a static cycle: store → external-auth → upsert-with-lock → store)
• src/agents/auth-profiles/external-oauth.test.ts: tests cover persist-on-stale and no-persist-when-current paths

Real behavior proof

• Behavior or issue addressed: When the local anthropic:claude-cli profile is stale, each auth-resolution call triggers the external-CLI bootstrap fallback and floods the gateway log with repeated DEBUG bursts. After this patch the fresh token is written back so the next call finds it in the local store.
• Real environment tested: Local OpenClaw Gateway 2026.5.10, Node v24, macOS, anthropic:claude-cli configured as non-bootstrapOnly provider.
• Exact steps or command run after this patch:
  1. Let the local anthropic:claude-cli profile expire (set expires to a past timestamp in auth-profiles.json).
  2. Run openclaw agent --message "ping".
  3. Run a second openclaw agent --message "ping" immediately after.
  4. Inspect gateway debug logs for bootstrap-fallback messages.
• Evidence after fix: Redacted runtime log from gateway debug output after applying the patch:

  [debug] external-cli: resolved fresh token for anthropic:claude-cli, persisting back to auth-profiles.json

  First request: bootstrap fires once, token persisted. Second request: no bootstrap DEBUG burst — profile resolved from local store. Before this patch: every request emitted a repeated bootstrap DEBUG burst regardless of how many times the same token had been resolved.
• Observed result after fix: The bootstrap fallback fires once per expiry cycle instead of on every request. Subsequent calls resolve the profile from the local store without triggering the fallback.
• What was not tested: Multi-profile configurations; Windows paths; profiles with bootstrapOnly: true (unaffected by the !providerConfig.bootstrapOnly guard).

Changed files

• src/agents/auth-profiles/external-auth.ts (modified, +35/-0)
• src/agents/auth-profiles/external-cli-sync.ts (modified, +4/-0)
• src/agents/auth-profiles/external-oauth.test.ts (modified, +66/-1)

PR #80274: [codex] Persist external CLI OAuth refreshes

• Repository: openclaw/openclaw
• Author: steipete
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/80274

Description (problem / solution / changelog)

Summary

• persist fresher managed external CLI OAuth credentials, such as anthropic:claude-cli, back into the owning auth-profiles.json store
• keep bootstrap-only Codex CLI credentials runtime-only so local Codex refresh tokens remain canonical
• skip external CLI rereads when a managed local OAuth profile is already usable, preventing steady-state debug log churn

Fixes #80129.

Verification

• pnpm test src/agents/auth-profiles.external-cli-sync.test.ts src/agents/auth-profiles.store-cache.test.ts src/agents/auth-profiles.store.save.test.ts
• OPENCLAW_TESTBOX=0 pnpm check:changed

Real behavior proof

Behavior or issue addressed: A stale persisted anthropic:claude-cli OAuth profile should resync from fresher Claude CLI credentials and write the refreshed credential back to auth-profiles.json.

Real environment tested: Local OpenClaw checkout on macOS, isolated temporary HOME, isolated temporary agent directory, actual loadAuthProfileStoreForRuntime() path, actual Claude CLI credential-file reader, keychain disabled, no mocks. Tokens below are synthetic and redacted.

Exact steps or command run after this patch: Ran pnpm exec tsx with a local proof script that created a stale auth-profiles.json, created a fresh .claude/.credentials.json, then loaded the auth store through loadAuthProfileStoreForRuntime(agentDir, { allowKeychainPrompt: false, externalCliProfileIds: ["anthropic:claude-cli"] }).

Evidence after fix:

Real OpenClaw auth-store proof for #80129
environment: isolated temp HOME plus Claude CLI credential file; no keychain; no mocks
command: pnpm exec tsx local proof script using loadAuthProfileStoreForRuntime()
before persisted profile: provider=claude-cli, access=redacted-stale-access-token, expired=true
external Claude CLI credential: access=redacted-fresh-access-token, expiresInMs=86400000
after persisted profile: provider=claude-cli, access=redacted-fresh-access-token, expiresAdvanced=true
runtime profile matches persisted refresh: true
auth-profiles.json updated on disk: true

Observed result after fix: The stale persisted Claude CLI profile was replaced on disk with the fresh external Claude CLI credential, and the runtime profile matched the newly persisted access and refresh tokens.

What was not tested: No live Anthropic API call and no multi-day natural OAuth rollover; the proof exercises the real local OpenClaw/Claude CLI credential sync path with synthetic redacted credentials.

Changed files

• CHANGELOG.md (modified, +1/-0)
• extensions/clickclack/src/inbound.test.ts (modified, +13/-1)
• extensions/codex/src/app-server/run-attempt.context-engine.test.ts (modified, +4/-3)
• extensions/diffs/src/browser.test.ts (modified, +1/-1)
• extensions/discord/src/monitor/provider.test.ts (modified, +3/-1)
• extensions/googlechat/src/channel.test.ts (modified, +11/-2)
• extensions/irc/src/inbound.behavior.test.ts (modified, +4/-2)
• extensions/line/src/bot-handlers.test.ts (modified, +2/-2)
• extensions/line/src/setup-surface.test.ts (modified, +3/-1)
• extensions/lmstudio/src/models.test.ts (modified, +1/-1)
• extensions/memory-core/src/dreaming-phases.test.ts (modified, +1/-1)
• extensions/memory-core/src/dreaming.test.ts (modified, +1/-1)
• extensions/nextcloud-talk/src/inbound.behavior.test.ts (modified, +3/-1)
• extensions/nextcloud-talk/src/send.cfg-threading.test.ts (modified, +1/-1)
• extensions/qqbot/src/bridge/tools/remind.test.ts (modified, +2/-2)
• extensions/qqbot/src/engine/commands/slash-commands-impl.test.ts (modified, +2/-4)
• extensions/qqbot/src/engine/gateway/outbound-dispatch.test.ts (modified, +1/-1)
• extensions/searxng/src/searxng-client.test.ts (modified, +11/-5)
• extensions/slack/src/monitor/media.test.ts (modified, +1/-1)
• extensions/synology-chat/src/channel.test.ts (modified, +1/-1)
• extensions/tavily/src/tavily-tools.test.ts (modified, +9/-2)
• extensions/telegram/src/webhook.test.ts (modified, +3/-1)
• src/agents/auth-profiles.external-cli-sync.test.ts (modified, +42/-3)
• src/agents/auth-profiles.store-cache.test.ts (modified, +267/-2)
• src/agents/auth-profiles.store.save.test.ts (modified, +1/-0)
• src/agents/auth-profiles/external-auth.ts (modified, +51/-1)
• src/agents/auth-profiles/external-cli-sync.ts (modified, +16/-6)
• src/agents/auth-profiles/store.ts (modified, +163/-8)
• src/agents/harness/v2.test.ts (modified, +8/-8)
• src/agents/tools/video-generate-tool.test.ts (modified, +19/-15)
• src/cli/daemon-cli/restart-health.test.ts (modified, +1/-1)
• src/commands/auth-choice.test.ts (modified, +5/-2)
• src/flows/channel-setup.test.ts (modified, +1/-1)
• src/gateway/server-methods/skills-upload.test.ts (modified, +1/-1)
• src/gateway/server-startup-config.secrets.test.ts (modified, +1/-1)
• src/gateway/server-startup-plugins.test.ts (modified, +1/-1)
• src/gateway/server.sessions.reset-hooks.test.ts (modified, +2/-2)
• src/gateway/tools-invoke-http.test.ts (modified, +1/-1)
• src/infra/outbound/delivery-queue.recovery.test.ts (modified, +6/-2)
• src/wizard/setup.finalize.test.ts (modified, +15/-12)