openclaw - 💡(How to fix) Fix openclaw infer model run hangs at secrets.resolve in 2026.4.26 (both --local and --gateway paths) [2 comments, 3 participants]

Summary

After upgrading to 2026.4.26 (be8c246) and registering an Anthropic auth profile via openclaw models auth login --provider anthropic --method cli --set-default, openclaw infer model run hangs indefinitely for any anthropic/* model. Both --local and --gateway execution paths fail at the secrets-resolution step.

The underlying claude -p --model X "..." works fine (12–21s latency across all 6 Anthropic models), so the auth itself is healthy — only OpenClaw's inference wrapper is affected. Other gateway WS calls succeed (cron.list, channels.status, plugins.list); only secrets.resolve times out.

Per docs (cli/infer.md): "The normal local path does not require the gateway to be running" — so --local failing on a gateway snapshot is unexpected.

Environment

• OpenClaw 2026.4.26 (commit be8c246), pnpm install, stable channel
• macOS (Darwin 25.3.0), Apple Silicon Mac mini
• Headless claude CLI: 2.1.105 at /usr/local/bin/claude
• Gateway: bind=loopback, port 18789, healthy (HTTP listening, channels & sidecars up, anthropic plugin loaded)
• Auth: anthropic:claude-cli OAuth profile present, expires in ~3h, doctor confirms Headless Claude auth: OK (oauth) and OpenClaw auth profile: anthropic:claude-cli (provider claude-cli)

Reproduction

# Both fail identically:
openclaw infer model run --local   --model anthropic/claude-sonnet-4-6 --prompt "alive"
openclaw infer model run --gateway --model anthropic/claude-opus-4-7   --prompt "alive"

Observed errors

Error: agent: failed to resolve secrets from the active gateway snapshot
(gateway timeout after 30000ms
Gateway target: ws://127.0.0.1:18789
Source: local loopback
Config: ~/.openclaw/openclaw.json
Bind: loopback). Start the gateway and retry.

In some runs (when gateway restarts mid-call):

gateway connect failed: Error: gateway closed (1000):
Error: agent: failed to resolve secrets from the active gateway snapshot
(gateway closed (1000 normal closure): no close reason

Latencies observed: --local calls hang ~43s, --gateway calls fail at the 30s gateway-timeout boundary.

What works (confirms it's not the underlying provider)

All 6 configured Anthropic models respond correctly via direct claude -p:

Doctor + status snapshots

- Binary: /usr/local/bin/claude.
- Headless Claude auth: OK (oauth).
- OpenClaw auth profile: anthropic:claude-cli (provider claude-cli).
- Workspace: ~/.openclaw/workspace (writable).

Auth overview
- claude-cli   effective=profiles | profiles=1 (oauth=1) | anthropic:claude-cli=OAuth
               | synthetic=plugin-owned | source=Claude CLI native auth
- anthropic    effective=profiles | profiles=1 (oauth=1) | anthropic:claude-cli=OAuth
OAuth/token status:
- claude-cli
  - anthropic:claude-cli   expiring expires in 3h   ← token IS valid

Workaround

Use claude -p --model <name> "<prompt>" directly. Channel-routed traffic (Discord/WhatsApp/Telegram) works fine — only the CLI infer model run path is affected.

Suspected area

The claude-cli provider's secrets.resolve flow (likely the synthetic=plugin-owned path that's expected to delegate to native Claude CLI auth) blocks the gateway WS server on a 30s timeout regardless of --local vs --gateway. Other WS operations remain responsive during the same window, suggesting this specific resolver is blocked rather than the gateway being down.