PR #80260: fix(status): prefer OAuth auth label over env api-key when runtime alias routes through claude-cli

• Repository: openclaw/openclaw
• Author: mushuiyu886
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/80260

Description (problem / solution / changelog)

Summary

• status-message.ts displayed api-key (env: ANTHROPIC_API_KEY) when the agent actually routed through claude-cli OAuth, because resolveModelAuthMode resolved auth against the raw model provider (anthropic) rather than the runtime provider (claude-cli).
• The existing runtimeAliasModelEquivalent fallback only covered the unknown to oauth case (from #79082), but not the api-key to oauth case.
• Extended the fallback to both the auth label and the cost display: when runtimeAliasModelEquivalent is true and selectedAuthMode is api-key but activeAuthMode is oauth, the status now correctly displays the OAuth label and suppresses the cost line from the unused env API key.

Verification

• Existing status-message.test.ts passes (2/2).
• New test in auto-reply/status.test.ts: verifies that cost is hidden and oauth label shown when api-key is selected but oauth is active via runtime alias (72/72 tests pass).
• Live buildStatusMessage output from source confirms the fix works end-to-end (see Real behavior proof below).

Real behavior proof

Behavior addressed: Status auth label now shows oauth instead of api-key and the cost line is suppressed when the agent routes through a claude-cli runtime alias but ANTHROPIC_API_KEY is also present in the environment.

Environment tested: Node 22.x on Linux, pnpm test, live buildStatusMessage invocation from source with node --import tsx.

Steps run after the patch: Ran buildStatusMessage from the fix branch source with modelAuth: "api-key", activeModelAuth: "oauth", and session entry model claude-cli/claude-opus-4-6 selected as anthropic/claude-opus-4-6 to reproduce the runtime alias scenario. Compared against the non-alias api-key-only baseline.

Evidence after fix:

Case 1 — api-key selected + oauth active via runtime alias (the fixed scenario):

🦞 OpenClaw 2026.5.10-beta.1 (70c9b8c)
🧠 Model: anthropic/claude-opus-4-6 · 🔑 oauth
🧮 Tokens: 1.0k in / 500 out
📚 Context: 1.5k/200k (1%) · 🧹 Compactions: 0
🧵 Session: agent:main:main • updated just now
⚙️ Execution: direct · Runtime: Claude CLI · Think: off · elevated
🪢 Queue: collect (depth 0)

Key observations: 🔑 oauth (not api-key), no 💵 Cost line.

Case 2 — api-key only, no runtime alias (original behavior preserved):

🦞 OpenClaw 2026.5.10-beta.1 (70c9b8c)
🧠 Model: anthropic/claude-opus-4-6 · 🔑 api-key
🧮 Tokens: 1.0k in / 500 out · 💵 Cost: $0.05
📚 Context: 1.5k/1.0m (0%) · 🧹 Compactions: 0
🧵 Session: agent:main:main • updated just now
⚙️ Execution: direct · Runtime: OpenClaw Pi Default · Think: off · elevated
🪢 Queue: collect (depth 0)

Key observations: 🔑 api-key, 💵 Cost: $0.05 shown as expected.

Test suite output:

pnpm test src/auto-reply/status.test.ts
 Tests  72 passed (72)

Observed result: In the runtime alias case, the status correctly shows the oauth auth label and suppresses the cost line. In the non-alias case, api-key label and cost are shown as before. Both scenarios verified against live buildStatusMessage output from the fix branch.

Not tested: Live gateway /status output from a running OpenClaw instance with a real claude-cli OAuth session.

Fixes #80184

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/auto-reply/status.test.ts (modified, +39/-0)
• src/status/status-message.ts (modified, +13/-3)

PR #80417: fix(status): prefer claude-cli OAuth over env API key shadowed by provider alias

• Repository: openclaw/openclaw
• Author: hclsys
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/80417

Description (problem / solution / changelog)

Summary

/status displayed 🔑 api-key (env: ANTHROPIC_API_KEY) for sessions running via claude-cli OAuth when ANTHROPIC_API_KEY was also present in the environment — even though the active auth path was OAuth through the Claude CLI integration, not the API key.

Root cause: resolveModelAuthLabel calls resolveEnvApiKey(providerKey, env, ...) before checking for CLI credentials. The provider alias system maps claude-cli → anthropic for env-var lookup (so claude-cli inherits ANTHROPIC_API_KEY from CORE_PROVIDER_AUTH_ENV_VAR_CANDIDATES.anthropic). When that env key was present, it short-circuited at the env check and the readClaudeCliCredentialsCached block was never reached.

Fix: Move the codex-cli and claude-cli credential checks before resolveEnvApiKey. Live OAuth credentials from a CLI integration always take priority over env API keys surfaced through the alias map.

The fix is symmetric: codex-cli is moved for the same reason — it also inherits env vars from its openai alias.

Changes

• src/agents/model-auth-label.ts: move CLI credential checks before env API key lookup
• src/agents/model-auth-label.test.ts: add regression test asserting oauth (claude-cli) when both CLI OAuth and an aliased env key are present

Real behavior proof

Behavior or issue addressed: openclaw /status shows 🔑 api-key (env: ANTHROPIC_API_KEY) when the agent is actually routing through claude-cli OAuth. After this fix, openclaw /status shows 🔑 oauth (claude-cli).

Real environment tested: Node.js v22, Linux, openclaw monorepo from source with this patch applied.

Exact steps or command run after fix:

1. Config: agents.defaults.agentRuntime.id = "claude-cli", ANTHROPIC_API_KEY present in env
2. Verify openclaw /status auth label via the resolveModelAuthLabel code path:

pnpm vitest run src/agents/model-auth-label.test.ts

Evidence after fix: The new regression test prefers claude-cli OAuth over env API key inherited via provider alias directly exercises the resolveModelAuthLabel function that openclaw /status calls. It sets up both readClaudeCliCredentialsCached → valid OAuth token and resolveEnvApiKey → {apiKey: "sk-ant-key", source: "env: ANTHROPIC_API_KEY"}. Before this patch, the env key was reached first. After this patch, the CLI OAuth check fires first and resolveEnvApiKey is never called.

Test Files  1 passed (1)
     Tests  16 passed (16)

Observed result after fix: openclaw /status reports 🔑 oauth (claude-cli) instead of 🔑 api-key (env: ANTHROPIC_API_KEY) when Claude CLI OAuth credentials are active. 16/16 unit tests pass. The regression test verifies both the return value and that resolveEnvApiKey was not reached.

What was not tested: Live openclaw /status output on a real gateway instance running the claude-cli integration with both ANTHROPIC_API_KEY and active CLI OAuth tokens simultaneously (no dual-auth test environment available), but resolveModelAuthLabel is the exact function /status calls for auth label resolution.

Fixes #80184.

Changed files

• src/agents/model-auth-label.test.ts (modified, +30/-0)
• src/agents/model-auth-label.ts (modified, +14/-11)