fix: surface Claude CLI OAuth reauth hints#97894
Conversation
|
Codex review: needs maintainer review before merge. Reviewed July 6, 2026, 6:51 AM ET / 10:51 UTC. Summary PR surface: Source +101, Tests +122. Total +223 across 4 files. Reproducibility: yes. at source level: a claude-cli FailoverError with reason auth and status 401 currently reaches generic provider-auth guidance on main, while this PR routes it through OAuth guidance. I did not execute a fresh current-main expired-token run in this read-only review. Review metrics: 1 noteworthy metric.
Root-cause cluster Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Mantis proof suggestion Risk before merge
Maintainer options:
Next step before merge
Maintainer decision needed
Security Review detailsBest possible solution: Select one canonical fix for #97553; if this branch is chosen, land the scoped claude-cli OAuth 401 handling and close or supersede the overlapping PRs. Do we have a high-confidence way to reproduce the issue? Yes at source level: a claude-cli FailoverError with reason auth and status 401 currently reaches generic provider-auth guidance on main, while this PR routes it through OAuth guidance. I did not execute a fresh current-main expired-token run in this read-only review. Is this the best way to solve the issue? Yes: this is a narrow maintainable fix shape because it scopes detection to claude-cli provider/status/message evidence and keeps other provider auth failures on existing generic handling. The remaining question is canonical branch selection, not an observed code defect. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 1f06b890a66f. Label changesLabel changes:
Label justifications:
Evidence reviewedPR surface: Source +101, Tests +122. Total +223 across 4 files. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
Review history (3 earlier review cycles) |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39f657792c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Mantis Telegram Desktop ProofSummary: Mantis captured Telegram Desktop before/after GIFs for the Claude CLI auth failure message.
Motion-trimmed clips: Raw QA files: https://artifacts.openclaw.ai/mantis/telegram-desktop/pr-97894/run-28391904738-1/index.json |
d7bad1f to
2ac6874
Compare
2ac6874 to
305d073
Compare
|
@clawsweeper re-review Fixed the OAuth reply precedence finding in Current-head evidence:
No live Claude/Telegram provider proof was run in this pass. |
|
🦞🧹 I asked ClawSweeper to review this item again. |
384f97c to
ed32547
Compare
ed32547 to
06ea905
Compare
|
@clawsweeper re-review Current-head proof for Real Claude CLI OAuth-token 401 proof:
OpenClaw mapping proof:
This proves the current Claude CLI OAuth-token 401 output shape and the OpenClaw reauth-copy path at the PR head without exposing or depending on a real user credential. |
|
🦞🧹 I asked ClawSweeper to review this item again. |
|
Thanks for working through this. We’re going to make #97669 the canonical fix for #97553, since it was the earlier active PR and its current shape keeps the From my review: This PR is viable too and has a clean review, but it overlaps the same auth recovery surface. Thanks, again, for this contribution. |




Closes #97553
What Problem This Solves
Fixes an issue where users running Claude through the
claude-clibackend would see a generic provider authentication failure when the local Claude CLI OAuth login expired.Why This Change Was Made
Claude CLI 401 authentication failures are now recognized as Claude CLI OAuth-login failures before the generic provider-authentication copy is used. The recovery hint keeps the runtime id visible, but points users at the owning auth flow:
claude auth loginfollowed by the Anthropic CLI auth-profile refresh command, formatted through OpenClaw's command formatter so active profile/container flags are preserved and default model selection is not changed.User Impact
Users get an actionable re-authentication message for expired Claude CLI login state instead of a generic retry/re-auth note that does not name the correct repair path.
Evidence
node scripts/run-vitest.mjs src/agents/auth-profiles/oauth-refresh-failure.test.ts src/auto-reply/reply/agent-runner-execution.test.ts src/auto-reply/reply/provider-request-error-classifier.test.ts src/agents/cli-runner/execute.supervisor-capture.test.ts -- --reporter=dot— 3 shards passed: OAuth classifier, auto-reply, provider-request classifier, and CLI-runner supervisor capture.pnpm exec oxfmt --check src/agents/auth-profiles/oauth-refresh-failure.ts src/agents/auth-profiles/oauth-refresh-failure.test.ts src/auto-reply/reply/agent-runner-execution.ts src/auto-reply/reply/agent-runner-execution.test.tsgit diff --check.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --codex-bin .artifacts/codex-flex --no-web-search— clean, no accepted/actionable findings; overall patch correct 0.86.