openclaw - 💡(How to fix) Fix /status shows "🔑 unknown" for working claude-cli runtime sessions [1 comments, 2 participants]

Symptom

Agents using a claude-cli/<model> model id (or anthropic/<model> with agentRuntime: { id: "claude-cli" }) authenticate and run conversations correctly via OAuth, but /status reports the auth label as "unknown":

🧠 Model: claude-cli/claude-opus-4-7 · 🔑 unknown

This is purely a display issue, conversations work fine.

Repro

1. Configure an agent with model: "claude-cli/claude-opus-4-7" and a working Claude CLI OAuth credential at ~/.claude/.credentials.json (the file the claude-cli runtime actually reads).
2. Ensure the agent's agentDir does not contain an auth-profiles.json (a clean fresh install path, or after manual cleanup).
3. Run /status against the agent.

Expected: 🔑 oauth (claude-cli) or similar, mirroring the codex-cli treatment. Actual: 🔑 unknown.

Root cause

src/agents/model-auth-label.ts has a credential-file probe for the codex provider (lines 77 to 79):

if (providerKey === "codex" && readCodexCliCredentialsCached({ ttlMs: 5_000 })) {
  return "oauth (codex-cli)";
}

There is no analogous probe for claude-cli, even though the credential reader exists at src/agents/cli-credentials.ts:453 (readClaudeCliCredentialsCached) and is already used elsewhere (e.g. src/commands/doctor-claude-cli.ts:18).

When the agent's auth-profiles.json is absent, the resolver walks: profile store (empty), env api key (none), codex special case (provider not codex), custom api key (none), and falls through to "unknown".

Suggested fix

Add a symmetric special case after the codex one:

if (providerKey === "claude-cli" && readClaudeCliCredentialsCached({ ttlMs: 5_000 })) {
  return "oauth (claude-cli)";
}

Functional behavior is unchanged; this only fixes the status display.

Environment

OpenClaw 2026.5.3 (Docker, openclaw-custom:2026.5.2 base).