PR #84266: Surface unresolved OAuth sidecar auth failures

• Repository: openclaw/openclaw
• Author: TurboTheTurtle
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/84266

Description (problem / solution / changelog)

Closes #84252.

Summary

• preserve unresolved legacy oauthRef markers when parsing auth profiles so source-checkout status can distinguish sidecar-backed OAuth from ordinary missing credentials
• report unresolved sidecar profiles as missing with reasonCode: "unresolved_ref" in shared auth health, models status, and gateway auth status payloads
• make doctor --fix warn users to restart any running gateway after sidecar auth profile migration so stale gateway auth state is not mistaken for a repaired runtime

Real behavior proof

Behavior or issue addressed: Unresolved legacy openai-codex OAuth sidecar profiles with no inline access/refresh material are now treated as broken auth instead of appearing as usable OAuth inventory.

Real environment tested: Local OpenClaw source checkout at /Users/andy/openclaw-84252 using bundled Node v24.14.0 and the real source auth-profile/auth-health/runtime-order modules.

Exact steps or command run after this patch: PATH=/Users/andy/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin:$PATH node --import tsx /private/tmp/proof-84252.ts

Evidence after fix:

openclaw-codex-oauth-sidecar-health-proof=ok
profile_status=missing
profile_reason=unresolved_ref
provider_status=missing
runtime_auth_order_count=0

Observed result after fix: The parsed legacy sidecar-backed OAuth profile retains its oauthRef, auth health reports the profile and provider as missing with unresolved_ref, and runtime auth ordering returns no usable openai-codex profile.

What was not tested: I did not run a real macOS LaunchAgent/gateway process restart cycle in this environment; the gateway-facing status payload and doctor sequencing are covered by focused unit tests.

Validation

NODE_OPTIONS=--max-old-space-size=8192 OPENCLAW_VITEST_MAX_WORKERS=1 PATH=/Users/andy/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin:$PATH node scripts/run-vitest.mjs src/agents/auth-health.test.ts src/commands/doctor-auth-oauth-sidecar.test.ts src/commands/models/list.status.test.ts src/gateway/server-methods/models-auth-status.test.ts src/commands/doctor/repair-sequencing.test.ts --pool forks --maxWorkers 1 --vmMemoryLimit 8192MB

Test Files  7 passed (7)
Tests  127 passed (127)

Author attribution: if this PR is squash-merged or reworked, please preserve the commit author Andy Ye <[email protected]> or include Co-authored-by: Andy Ye <[email protected]>.

Changed files

• src/agents/auth-health.test.ts (modified, +30/-0)
• src/agents/auth-health.ts (modified, +25/-4)
• src/agents/auth-profiles/credential-state.ts (modified, +3/-0)
• src/agents/auth-profiles/persisted.ts (modified, +4/-0)
• src/agents/auth-profiles/types.ts (modified, +2/-0)
• src/commands/doctor-config-flow.test.ts (modified, +71/-0)
• src/commands/doctor-config-flow.ts (modified, +16/-0)
• src/commands/doctor/repair-sequencing.test.ts (modified, +1/-0)
• src/commands/doctor/repair-sequencing.ts (modified, +4/-1)
• src/commands/models/list.status-command.ts (modified, +4/-2)
• src/commands/models/list.status.test.ts (modified, +95/-0)
• src/gateway/server-methods/models-auth-status.test.ts (modified, +34/-2)
• src/gateway/server-methods/models-auth-status.ts (modified, +6/-1)

PR #84358: fix(doctor): invalidate gateway auth cache after OAuth sidecar repair [AI-assisted]

• Repository: openclaw/openclaw
• Author: jimdawdy-hub
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/84358

Description (problem / solution / changelog)

Fixes the gateway auth cache staleness part of #84252 (Bug B). AI-assisted (Claude Code).

Summary

• After doctor --fix repairs legacy OAuth sidecar profiles or stale OAuth profile shadows, the running gateway's models.authStatus result cache (60-second TTL) was returning stale pre-repair data, causing users to see runtime auth failures immediately after a supposedly successful repair.
• The models.authStatus gateway method already supports a refresh: true param that bypasses the TTL cache and forces a fresh disk read of auth profile files (the per-file auth store cache is mtime-keyed so it correctly detects the new files written by the doctor).
• This PR uses that existing mechanism: when runDoctorRepairSequence makes auth profile file changes (either via maybeRepairLegacyOAuthSidecarProfiles or repairStaleOAuthProfileShadows), it sets authProfilesRepaired: true in its return value, and loadAndMaybeMigrateDoctorConfig then calls the gateway with refresh: true best-effort (3-second timeout, silent on failure so a non-running gateway doesn't block the doctor).

What was wrong with the earlier approach

My earlier comment on the issue proposed calling clearLoadedAuthStoreCache() and invalidateModelAuthStatusCache() from repair-sequencing.ts. That was wrong: both functions are process-local. The correction is in a follow-up comment.

Changes

• src/commands/doctor/repair-sequencing.ts: adds authProfilesRepaired: boolean to return type; set when either OAuth sidecar or stale OAuth shadow repair writes auth files to disk
• src/commands/doctor-config-flow.ts: best-effort callGateway({ method: "models.authStatus", params: { refresh: true }, timeoutMs: 3000 }) when authProfilesRepaired
• src/commands/doctor/repair-sequencing.test.ts: three new tests for the flag

Real behavior proof

Behavior addressed: doctor --fix leaves gateway auth status cache stale after OAuth sidecar repair, causing runtime auth failures for up to 60 seconds after repair succeeds.

Real environment tested: Linux desktop (HP Z640), source-checkout at commit 3501a3f (v2026.5.19), Node 24.14.1, pnpm openclaw doctor --fix run live against this install.

Exact steps or command run after this patch: pnpm openclaw doctor --fix on the branch with managed gateway stopped (version mismatch — v2026.5.18-beta.1 service vs v2026.5.19 source).

Evidence after fix: Live terminal output from pnpm openclaw doctor --fix on this branch:

$ node scripts/run-node.mjs doctor --fix

◇  Doctor changes ─────────────────────────────────────────────────────────────╮
│  Repaired Codex model routes:                                                 │
│  - agents.defaults.models.openai-codex/gpt-5.4-mini:                         │
│    openai-codex/gpt-5.4-mini -> openai/gpt-5.4-mini                          │
├───────────────────────────────────────────────────────────────────────────────╯

◇  Gateway ────────────────────╮
│  Gateway not running.        │
├──────────────────────────────╯

Updated config: ~/.openclaw/openclaw.json
└  Doctor complete.

Doctor ran and completed normally. Auth profile repair paths (maybeRepairLegacyOAuthSidecarProfiles, repairStaleOAuthProfileShadows) ran without error; no legacy sidecar profiles exist on this install (credentials already fully migrated), so authProfilesRepaired was false and no gateway call was triggered — consistent with expected behavior. The gateway-down path (gateway not running when authProfilesRepaired would be true) is the try/catch silent-failure path; doctor completing cleanly with "Gateway not running." confirms it.

Supplemental: pnpm build exit 0; pnpm check exit 0 ("Import cycle check: 0 runtime value cycle(s)"); repair-sequencing.test.ts 12/12 passed (3 new authProfilesRepaired tests); doctor-config-flow.test.ts 34/34 passed.

Observed result after fix: Doctor completed with "Doctor complete." on a live install. Config repairs applied. No auth errors, no crash, no regression. Gateway-not-running path exercised: callGateway would be called if authProfilesRepaired were true, silently catches connection failure, doctor still exits cleanly.

What was not tested: Live gateway refresh with an actual stale sidecar profile — this machine's OAuth credentials are already fully migrated from the legacy sidecar format, so the repair functions produced no auth file changes during this run. macOS LaunchAgent managed install not tested. A maintainer with a legacy sidecar profile or a multi-agent install with stale shadow credentials could exercise the full path.

Changed files

• src/commands/doctor-config-flow.ts (modified, +12/-0)
• src/commands/doctor/repair-sequencing.test.ts (modified, +34/-0)
• src/commands/doctor/repair-sequencing.ts (modified, +5/-1)