fix: surface provider authentication failures in channels by sjf-oa · Pull Request #96599 · openclaw/openclaw

sjf-oa · 2026-06-24T23:47:39Z

Related: #80040

What Problem This Solves

Fixes an issue where users messaging a bot in a channel would receive no reply when the model provider rejected the request with an HTTP 401 authentication failure. The user only sees the 👀 react, but there is not response or error message from the bot.

Why This Change Was Made

Classify proven invalid-token HTTP 401 failures as actionable provider request errors and reuse the existing sanitized authentication guidance. This keeps raw provider details private while allowing the shared channel reply path to surface the failure instead of treating it as a generic, silence-eligible error.

User Impact

Channel users now receive a concise authentication warning with retry and re-authentication guidance instead of seeing the bot silently stop.

Evidence

Observed failure shape: unexpected status 401 Unauthorized: Missing bearer or basic authentication in header.
Before: the failure fell through to the generic runner error and became NO_REPLY in channels.
After: the failure is classified and routed through the existing visible non-generic failure path.
Focused classifier suite: 18 tests passed.
Focused reply-runner suite: 214 tests passed, including Slack, Discord, Telegram, WhatsApp, and Microsoft Teams channel/group coverage.
Changed-file formatting check passed.

clawsweeper · 2026-06-24T23:48:38Z

Codex review: needs real behavior proof before merge. Reviewed June 24, 2026, 7:59 PM ET / 23:59 UTC.

Summary
Adds provider authentication error classification for HTTP 401 and typed failover auth failures, reuses sanitized auth guidance, and adds classifier plus channel-runner regression tests.

PR surface: Source +15. Total +15 across 3 files.

Reproducibility: no. live current-main channel reproduction was run. Source inspection shows current main has no provider-authentication case in the provider request classifier, and the runner relies on that classifier for visible channel failure replies.

Review metrics: none identified.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #80040
Summary: This PR is a candidate fix for the visible provider-auth no-reply slice of the broad open cascade issue, but it does not cover the duplicate-tool or context rollover parts.

Members:

canonical: Cascading failure: invalidated OAuth on primary provider produces empty placeholder reply; provider switch causes duplicate tool execution; cold-cache bootstrap on conversation rollover loses recent context #80040 - The PR body links this open issue, whose first and fourth expected behaviors include auth invalidation producing poor or missing channel-visible failure output.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted after-fix real channel output, terminal/live output, logs, a recording, or a linked artifact showing the sanitized auth warning is delivered instead of no reply.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body lists focused tests, but no after-fix real channel output, terminal/live output, redacted logs, screenshot, recording, or linked artifact proves the warning reaches a user-facing channel; contributors should redact private details and update the PR body so ClawSweeper re-runs.

Mantis proof suggestion
A real Telegram transcript would materially prove that the sanitized auth warning is delivered instead of a silent turn. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis telegram live: verify that a provider HTTP 401 during a Telegram turn sends the sanitized auth warning instead of no reply.

Risk before merge

[P1] No after-fix real channel or transport output yet proves the sanitized auth warning is delivered to users instead of a silent turn; the current evidence is focused tests and PR-body description.

Maintainer options:

Decide the mitigation before merge
Land the focused classifier and regression-test change after explicit maintainer handling and redacted real channel proof, while leaving the broader linked cascade issue open for its remaining fallback, duplicate-tool, and context-state work.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] Protected maintainer labeling and missing contributor real behavior proof require human handling; after the follow-up commit there is no narrow code repair left for ClawSweeper to queue.

Security
Cleared: The diff reuses sanitized authentication guidance and adds tests without changing credentials, dependency sources, CI, package metadata, or secret-handling behavior.

Review details

Best possible solution:

Land the focused classifier and regression-test change after explicit maintainer handling and redacted real channel proof, while leaving the broader linked cascade issue open for its remaining fallback, duplicate-tool, and context-state work.

Do we have a high-confidence way to reproduce the issue?

No live current-main channel reproduction was run. Source inspection shows current main has no provider-authentication case in the provider request classifier, and the runner relies on that classifier for visible channel failure replies.

Is this the best way to solve the issue?

Yes for the code shape: the provider request classifier is the right shared owner boundary, and the follow-up commit now covers typed 401 status and channel-runner behavior. It is not merge-clear until real channel proof and protected-label maintainer handling are complete.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 0a042f68dfbe.

Label changes

Label justifications:

P2: This is a normal-priority bug fix for provider-auth failures causing lost channel replies, with limited blast radius and no evidence of a current P0/P1 outage.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists focused tests, but no after-fix real channel output, terminal/live output, redacted logs, screenshot, recording, or linked artifact proves the warning reaches a user-facing channel; contributors should redact private details and update the PR body so ClawSweeper re-runs.
mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The change affects user-visible channel reply text and the linked report includes Telegram no-reply behavior that a short Telegram proof can demonstrate.

Evidence reviewed

PR surface:

Source +15. Total +15 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	3	20	5	+15
Tests	0	0	0	0
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	20	5	+15

What I checked:

Current main lacks provider-authentication classification: The current main classifier only defines conversation-state, internal, and rate-limit/quota provider request errors; there is no provider_authentication_error case on main. (src/auto-reply/reply/provider-request-error-classifier.ts:6, 0a042f68dfbe)
Runner uses the classifier for visible failure replies: The runner calls classifyProviderRequestError for non-billing channel failures before choosing the visible failure payload, so misses in this classifier can still fall through to the generic or silent channel path. (src/auto-reply/reply/agent-runner-execution.ts:3133, 0a042f68dfbe)
PR adds auth classification from typed and textual 401 signals: The PR head adds provider_authentication_error, detects FailoverError reason auth with status 401, and also reuses classifyProviderRuntimeFailureKind for textual auth_invalid_token signals. (src/auto-reply/reply/provider-request-error-classifier.ts:41, fcf450c8a491)
PR adds focused classifier coverage: The PR head tests textual HTTP 401 auth failures, typed FailoverError status 401 auth failures, a typed 403 non-match, and an unrelated 401 replay non-match. (src/auto-reply/reply/provider-request-error-classifier.test.ts:13, fcf450c8a491)
PR adds channel-runner regression coverage: The PR head covers the sanitized auth warning in non-direct Discord, Slack, Telegram, WhatsApp, and Microsoft Teams chat cases and asserts the raw provider error is not included. (src/auto-reply/reply/agent-runner-execution.test.ts:6538, fcf450c8a491)
Sanitized auth helper stays narrow: The existing helper requires positive 401 evidence and invalid-token hints before returning auth_invalid_token, avoiding broad relabeling of 403, scope, replay, or unrelated failures as HTTP 401 auth failures. (src/agents/embedded-agent-helpers/errors.ts:1266, 0a042f68dfbe)

Likely related people:

dutifulbob: Introduced the provider request classifier and visible conversation-state channel error path that this PR extends. (role: feature-history contributor; confidence: high; commits: 80d03a1e5bcc; files: src/auto-reply/reply/provider-request-error-classifier.ts, src/auto-reply/reply/agent-runner-execution.ts)
jeffrey701: Authored recent embedded-agent helper work that sanitizes raw HTTP 401 provider errors and established the narrow auth_invalid_token copy reused here. (role: adjacent auth-error contributor; confidence: high; commits: 01ef169004bc; files: src/agents/embedded-agent-helpers/errors.ts)
hxy91819: Authored the recent structured HTTP 429/quota provider request classifier path that is the closest sibling to this PR's structured 401 classification. (role: sibling classifier contributor; confidence: medium; commits: 439dcbde3b1f; files: src/auto-reply/reply/provider-request-error-classifier.ts, src/auto-reply/reply/provider-request-error-classifier.test.ts)
jalehman: Recent history and current blame show work on auto-reply runner and channel-adjacent session/Telegram cleanup near the affected channel failure surface. (role: recent area contributor; confidence: medium; commits: 4c841ac575d7, b6bc3ed0dbd8; files: src/auto-reply/reply/provider-request-error-classifier.ts, src/auto-reply/reply/agent-runner-execution.ts)
vincentkoc: Recent commits touched embedded agent helpers and fallback/runner state near provider failure routing, and several adjacent PRs list review or co-author involvement. (role: recent adjacent runner contributor; confidence: medium; commits: 2f9107f672df, 14e448e0e13d; files: src/agents/embedded-agent-helpers/errors.ts, src/auto-reply/reply/agent-runner-execution.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

…6599) * fix: surface provider authentication failures in channels * fix: handle typed provider auth failures --------- Co-authored-by: Sarah Fortune <sarah.fortune@gmail.com>

…6599) * fix: surface provider authentication failures in channels * fix: handle typed provider auth failures --------- Co-authored-by: Sarah Fortune <sarah.fortune@gmail.com> (cherry picked from commit 113d6f3)

fix: surface provider authentication failures in channels

0d1f70f

openclaw-barnacle Bot added agents Agent runtime and tooling size: XS maintainer Maintainer-authored PR labels Jun 24, 2026

fix: handle typed provider auth failures

fcf450c

openclaw-barnacle Bot added size: S and removed size: XS labels Jun 24, 2026

pash-openai approved these changes Jun 25, 2026

View reviewed changes

sjf-oa merged commit 113d6f3 into main Jun 25, 2026
120 of 122 checks passed

sjf-oa deleted the sjf/surface-auth-failures-in-channels branch June 25, 2026 00:16

Haderach-Ram mentioned this pull request Jun 25, 2026

Ecosystem Digest — 2026-06-25 Haderach-Ram/openclaw-radar#61

Open

github-actions Bot mentioned this pull request Jun 25, 2026

📡 Upstream Digest — 2026-06-25 02:33 UTC curtismercier/openclaw-mods#1149

Open

This was referenced Jun 29, 2026

Gateway chat sanitizer leaks unexpected-status 401 auth envelopes NousResearch/hermes-agent#55071

Open

fix(gateway): sanitize unexpected-status auth errors NousResearch/hermes-agent#55072

Open

clawsweeper Bot mentioned this pull request Jul 1, 2026

fix(auth): classify claude-cli 401 output as oauth refresh failure #98036

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: surface provider authentication failures in channels#96599

fix: surface provider authentication failures in channels#96599
sjf-oa merged 2 commits into
mainfrom
sjf/surface-auth-failures-in-channels

sjf-oa commented Jun 24, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

sjf-oa commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sjf-oa commented Jun 24, 2026 •

edited

Loading

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading