PR #80265: fix(agents): keep cli-auth-epoch stable when local credential file presence flips

• Repository: openclaw/openclaw
• Author: mushuiyu886
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/80265

Description (problem / solution / changelog)

Summary

• Extend shouldSkipLocalCliCredentialEpoch at the prepare/backend auth-epoch policy seam to skip local credentials for identity-less OAuth profiles (no email, no accountId) when execution is prepared.
• When a profile credential is OAuth but carries no stable account identity, local credential file presence was flipping the auth epoch hash, causing spurious reason=auth-epoch session resets for Anthropic Max plan users.
• Both sides encode the same identity-less constant (["oauth","provider",null,null,null,null,null]), so the only observable epoch change is file existence — not an actual account change.
• The fix keeps combined-mode behavior intact for identity-bearing profiles (those with email or accountId).

Verification

• pnpm test src/agents/cli-runner/prepare.test.ts — 21 passed
• pnpm test src/agents/cli-auth-epoch.test.ts — 13 passed
• pnpm test src/agents/cli-session.test.ts — 14 passed
• New test cases in prepare.test.ts cover identity-less skip, identity-bearing non-skip, and no-execution non-skip.
• Regression test in cli-auth-epoch.test.ts now asserts epoch equality (fixed behavior) with skipLocalCredential: true.

Real behavior proof

Behavior addressed: Identity-less OAuth profiles no longer include local credential file presence in the auth epoch, preventing spurious session resets.

Environment tested: Node 22.x on Linux, pnpm test + node --import tsx live verification.

Steps run after the patch: Ran shouldSkipLocalCliCredentialEpoch via node --import tsx with identity-less and identity-bearing OAuth credentials.

Evidence:

identity-less OAuth with execution: true
identity-bearing OAuth with execution: false
identity-less OAuth no execution: false
profile-only mode: true

Observed result: Identity-less OAuth profiles correctly skip local credentials; identity-bearing profiles remain in combined mode; profile-only mode unchanged.

Not tested: End-to-end session reuse with live Claude CLI credentials.

Closes #80178

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/agents/cli-auth-epoch.test.ts (modified, +53/-2)
• src/agents/cli-auth-epoch.ts (modified, +1/-1)
• src/agents/cli-runner/prepare.test.ts (modified, +49/-0)
• src/agents/cli-runner/prepare.ts (modified, +19/-3)

PR #80425: fix(cli-auth-epoch): exclude local credential from epoch when auth-profile is present

• Repository: openclaw/openclaw
• Author: hclsys
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/80425

Description (problem / solution / changelog)

Problem

resolveCliAuthEpoch included the local CLI credential file fingerprint in the epoch hash even when an auth-profile credential was present. When the claude CLI wrote or refreshed ~/.claude/.credentials.json, the local fingerprint flipped (present→absent or vice versa), triggering a spurious epoch change that invalidated every live CLI session — even though the user's OAuth identity was unchanged.

Fix

Resolve the auth-profile credential first. If one is found, use it as the canonical identity source and exclude the local file from the epoch hash. Fall back to the local fingerprint only in the bootstrap case (auth-profile ID provided but not yet populated in the store).

Real behavior proof

Behavior or issue addressed: resolveCliAuthEpoch returns different hashes before and after ~/.claude/.credentials.json appears on disk, even when the user's OAuth identity (email/accountId) is stable and an auth-profile credential is present. Every live CLI session is invalidated spuriously on each credential file write.

Real environment tested: Node.js v22, Linux, openclaw monorepo from source with this patch applied.

Exact steps or command run after fix:

pnpm vitest run src/agents/cli-auth-epoch.test.ts
openclaw /status

Evidence after fix: The new regression test "keeps epoch stable when local credential file flips while auth-profile credential is present" simulates readClaudeCliCredentialsCached returning a credential on the first call and null on the second (file disappeared). With the fix, both resolveCliAuthEpoch calls return the same epoch hash — no spurious invalidation. The updated test "profile credential is canonical when present" verifies local token/accountId changes leave the epoch unchanged while profile identity changes shift it correctly.

Test Files  2 passed (2)
     Tests  28 passed (28)

Observed result after fix: Running openclaw /status after credential file rotation shows a stable auth label (no session re-init). 28/28 unit tests pass including two new regression tests for the exact bug scenario.

What was not tested: Keychain-backed credential stores; multi-machine state convergence.

Closes #80178.

Changed files

• src/agents/cli-auth-epoch.test.ts (modified, +105/-12)
• src/agents/cli-auth-epoch.ts (modified, +19/-10)
• src/agents/model-auth-label.test.ts (modified, +30/-0)
• src/agents/model-auth-label.ts (modified, +14/-11)