Use nondeprecated provider auth SDK path

openclaw · obviyus · Jul 1, 2026 · Jun 30, 2026 · Jun 30, 2026 · Jun 30, 2026
commit f8440edbc029a061f8f570ee1619cb64396b847c
diff --git a/docs/tools/slash-commands.md b/docs/tools/slash-commands.md
@@ -202,6 +202,7 @@ plugins.
     | `/reasoning [on\|off\|stream]` | Toggle reasoning visibility. Alias: `/reason` |
     | `/elevated [on\|off\|ask\|full]` | Toggle elevated mode. Alias: `/elev` |
     | `/exec host=<auto\|sandbox\|gateway\|node> security=<deny\|allowlist\|full> ask=<off\|on-miss\|always> node=<id>` | Show or set exec defaults |
+    | `/login [codex\|openai\|openai-codex]` | Pair Codex/OpenAI login in the current chat or channel. Owner/admin only |
     | `/model [name\|#\|status]` | Show or set the model |
     | `/models [provider] [page] [limit=<n>\|all]` | List configured/auth-available providers or models |
     | `/queue <mode>` | Manage active-run queue behavior. See [Queue](/concepts/queue) and [Queue steering](/concepts/queue-steering) |

diff --git a/extensions/telegram/src/bot-native-command-deps.runtime.ts b/extensions/telegram/src/bot-native-command-deps.runtime.ts
@@ -4,7 +4,7 @@ import { getPluginCommandSpecs } from "openclaw/plugin-sdk/plugin-runtime";
 import type {
   ModelsAuthLoginFlowOptions,
   ModelsAuthLoginFlowResult,
-} from "openclaw/plugin-sdk/provider-auth-login";
+} from "openclaw/plugin-sdk/provider-auth-runtime";
 import { dispatchReplyWithBufferedBlockDispatcher } from "openclaw/plugin-sdk/reply-dispatch-runtime";
 import { getRuntimeConfig } from "openclaw/plugin-sdk/runtime-config-snapshot";
 import { listSkillCommandsForAgents } from "openclaw/plugin-sdk/skill-commands-runtime";
@@ -45,7 +45,7 @@ export const defaultTelegramNativeCommandDeps: TelegramNativeCommandDeps = {
     return getPluginCommandSpecs;
   },
   async runModelsAuthLoginFlow(opts) {
-    const { runModelsAuthLoginFlow } = await import("openclaw/plugin-sdk/provider-auth-login");
+    const { runModelsAuthLoginFlow } = await import("openclaw/plugin-sdk/provider-auth-runtime");
     return await runModelsAuthLoginFlow(opts);
   },
   async editMessageTelegram(...args) {

diff --git a/extensions/telegram/src/bot-native-commands.ts b/extensions/telegram/src/bot-native-commands.ts
@@ -32,7 +32,7 @@ import type {
   TelegramTopicConfig,
 } from "openclaw/plugin-sdk/config-contracts";
 import { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
-import type { ModelsAuthLoginFlowOptions } from "openclaw/plugin-sdk/provider-auth-login";
+import type { ModelsAuthLoginFlowOptions } from "openclaw/plugin-sdk/provider-auth-runtime";
 import { resolveSendableOutboundReplyParts } from "openclaw/plugin-sdk/reply-payload";
 import { resolveAgentRoute } from "openclaw/plugin-sdk/routing";
 import { getRuntimeConfigSnapshot } from "openclaw/plugin-sdk/runtime-config-snapshot";

diff --git a/src/plugin-sdk/provider-auth-login.runtime.ts b/src/plugin-sdk/provider-auth-login.runtime.ts
@@ -1,10 +1,3 @@
-/** Provider auth login helpers for bundled channel auth recovery. */
-export {
-  runModelsAuthLoginFlow,
-  type ModelsAuthLoginFlowOptions,
-  type ModelsAuthLoginFlowResult,
-} from "../commands/models/auth.js";
-
 /** @deprecated Provider-owned login helpers; use provider auth hooks instead. */
 export { loginChutes } from "../commands/chutes-oauth.js";
 /** @deprecated Provider-owned login helpers; use provider auth hooks instead. */

diff --git a/src/plugin-sdk/provider-auth-login.ts b/src/plugin-sdk/provider-auth-login.ts
@@ -1,6 +1,6 @@
 /**
- * Compatibility subpath for provider auth login helpers.
- * Prefer provider auth hooks for provider-owned login commands.
+ * @deprecated Compatibility subpath for provider-owned login helpers.
+ * Use provider auth hooks instead of importing bundled provider login commands.
  */
 
 import { createLazyRuntimeMethodBinder, createLazyRuntimeModule } from "../shared/lazy-runtime.js";
@@ -12,14 +12,6 @@ const loadProviderAuthLoginRuntime = createLazyRuntimeModule(
 );
 const bindProviderAuthLoginRuntime = createLazyRuntimeMethodBinder(loadProviderAuthLoginRuntime);
 
-export type {
-  ModelsAuthLoginFlowOptions,
-  ModelsAuthLoginFlowResult,
-} from "./provider-auth-login.runtime.js";
-
-/** Runs provider auth login through the existing models-auth persistence flow. */
-export const runModelsAuthLoginFlow: ProviderAuthLoginRuntime["runModelsAuthLoginFlow"] =
-  bindProviderAuthLoginRuntime((runtime) => runtime.runModelsAuthLoginFlow);
 /** @deprecated GitHub Copilot provider-owned login helper; use provider auth hooks instead. */
 export const githubCopilotLoginCommand: ProviderAuthLoginRuntime["githubCopilotLoginCommand"] =
   bindProviderAuthLoginRuntime((runtime) => runtime.githubCopilotLoginCommand);

diff --git a/src/plugin-sdk/provider-auth-runtime.ts b/src/plugin-sdk/provider-auth-runtime.ts
@@ -15,6 +15,11 @@ export {
   collectProviderApiKeysForExecution,
   executeWithApiKeyRotation,
 } from "../agents/api-key-rotation.js";
+export {
+  runModelsAuthLoginFlow,
+  type ModelsAuthLoginFlowOptions,
+  type ModelsAuthLoginFlowResult,
+} from "../commands/models/auth.js";
 export { NON_ENV_SECRETREF_MARKER } from "../agents/model-auth-markers.js";
 export {
   requireApiKey,