diff --git a/docs/help/testing.md b/docs/help/testing.md
index 3e2a5dd2658..7e4a2ba91aa 100644
--- a/docs/help/testing.md
+++ b/docs/help/testing.md
@@ -316,6 +316,7 @@ Single-provider Docker recipes:
 
 ```bash
 pnpm test:docker:live-cli-backend:claude
+pnpm test:docker:live-cli-backend:claude-subscription
 pnpm test:docker:live-cli-backend:codex
 pnpm test:docker:live-cli-backend:gemini
 ```
@@ -325,6 +326,7 @@ Notes:
 - The Docker runner lives at `scripts/test-live-cli-backend-docker.sh`.
 - It runs the live CLI-backend smoke inside the repo Docker image as the non-root `node` user.
 - It resolves CLI smoke metadata from the owning extension, then installs the matching Linux CLI package (`@anthropic-ai/claude-code`, `@openai/codex`, or `@google/gemini-cli`) into a cached writable prefix at `OPENCLAW_DOCKER_CLI_TOOLS_DIR` (default: `~/.cache/openclaw/docker-cli-tools`).
+- `pnpm test:docker:live-cli-backend:claude-subscription` requires portable Claude Code subscription OAuth through either `~/.claude/.credentials.json` with `claudeAiOauth.subscriptionType` or `CLAUDE_CODE_OAUTH_TOKEN` from `claude setup-token`. It first proves direct `claude -p` in Docker, then runs two Gateway CLI-backend turns without preserving Anthropic API-key env vars. This subscription lane disables the Claude MCP/tool and image probes by default because Claude currently routes third-party app usage through extra-usage billing instead of normal subscription plan limits.
 - The live CLI-backend smoke now exercises the same end-to-end flow for Claude, Codex, and Gemini: text turn, image classification turn, then MCP `cron` tool call verified through the gateway CLI.
 - Claude's default smoke also patches the session from Sonnet to Opus and verifies the resumed session still remembers an earlier note.
 
@@ -669,6 +671,7 @@ Useful env vars:
   - Override manually with `OPENCLAW_DOCKER_AUTH_DIRS=all`, `OPENCLAW_DOCKER_AUTH_DIRS=none`, or a comma list like `OPENCLAW_DOCKER_AUTH_DIRS=.claude,.codex`
 - `OPENCLAW_LIVE_GATEWAY_MODELS=...` / `OPENCLAW_LIVE_MODELS=...` to narrow the run
 - `OPENCLAW_LIVE_GATEWAY_PROVIDERS=...` / `OPENCLAW_LIVE_PROVIDERS=...` to filter providers in-container
+- `OPENCLAW_SKIP_DOCKER_BUILD=1` to reuse an existing `openclaw:local-live` image for reruns that do not need a rebuild
 - `OPENCLAW_LIVE_REQUIRE_PROFILE_KEYS=1` to ensure creds come from the profile store (not env)
 - `OPENCLAW_OPENWEBUI_MODEL=...` to choose the model exposed by the gateway for the Open WebUI smoke
 - `OPENCLAW_OPENWEBUI_PROMPT=...` to override the nonce-check prompt used by the Open WebUI smoke
diff --git a/package.json b/package.json
index 67e98ef4312..4de0c5dab86 100644
--- a/package.json
+++ b/package.json
@@ -1232,6 +1232,7 @@
     "test:docker:live-build": "bash scripts/test-live-build-docker.sh",
     "test:docker:live-cli-backend": "bash scripts/test-live-cli-backend-docker.sh",
     "test:docker:live-cli-backend:claude": "OPENCLAW_LIVE_CLI_BACKEND_MODEL=claude-cli/claude-sonnet-4-6 bash scripts/test-live-cli-backend-docker.sh",
+    "test:docker:live-cli-backend:claude-subscription": "OPENCLAW_LIVE_CLI_BACKEND_AUTH=subscription OPENCLAW_LIVE_CLI_BACKEND_MODEL=claude-cli/claude-sonnet-4-6 OPENCLAW_LIVE_CLI_BACKEND_DISABLE_MCP_CONFIG=1 OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE=0 OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE=1 OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE=0 OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE=0 bash scripts/test-live-cli-backend-docker.sh",
     "test:docker:live-cli-backend:codex": "OPENCLAW_LIVE_CLI_BACKEND_MODEL=codex-cli/gpt-5.4 bash scripts/test-live-cli-backend-docker.sh",
     "test:docker:live-cli-backend:gemini": "OPENCLAW_LIVE_CLI_BACKEND_MODEL=google-gemini-cli/gemini-3-flash-preview bash scripts/test-live-cli-backend-docker.sh",
     "test:docker:live-gateway": "bash scripts/test-live-gateway-models-docker.sh",
diff --git a/scripts/lib/live-docker-stage.sh b/scripts/lib/live-docker-stage.sh
index a0bf56eda0f..c3adfecc3e3 100644
--- a/scripts/lib/live-docker-stage.sh
+++ b/scripts/lib/live-docker-stage.sh
@@ -3,7 +3,10 @@
 openclaw_live_stage_source_tree() {
   local dest_dir="${1:?destination directory required}"
 
+  set +e
   tar -C /src \
+    --warning=no-file-changed \
+    --ignore-failed-read \
     --exclude=.git \
     --exclude=node_modules \
     --exclude=dist \
@@ -23,6 +26,11 @@ openclaw_live_stage_source_tree() {
     --exclude='apps/*/.kotlin' \
     --exclude='apps/*/build' \
     -cf - . | tar -C "$dest_dir" -xf -
+  local status=$?
+  set -e
+  if [ "$status" -gt 1 ]; then
+    return "$status"
+  fi
 }
 
 openclaw_live_link_runtime_tree() {
diff --git a/scripts/test-live-cli-backend-docker.sh b/scripts/test-live-cli-backend-docker.sh
index aeeb28718be..f1555d64960 100644
--- a/scripts/test-live-cli-backend-docker.sh
+++ b/scripts/test-live-cli-backend-docker.sh
@@ -13,11 +13,26 @@ DEFAULT_PROVIDER="${OPENCLAW_DOCKER_CLI_BACKEND_PROVIDER:-claude-cli}"
 CLI_MODEL="${OPENCLAW_LIVE_CLI_BACKEND_MODEL:-}"
 CLI_PROVIDER="${CLI_MODEL%%/*}"
 CLI_DISABLE_MCP_CONFIG="${OPENCLAW_LIVE_CLI_BACKEND_DISABLE_MCP_CONFIG:-}"
+CLI_AUTH_MODE="${OPENCLAW_LIVE_CLI_BACKEND_AUTH:-auto}"
 
 if [[ -z "$CLI_PROVIDER" || "$CLI_PROVIDER" == "$CLI_MODEL" ]]; then
   CLI_PROVIDER="$DEFAULT_PROVIDER"
 fi
 
+case "$CLI_AUTH_MODE" in
+  auto | api-key | subscription)
+    ;;
+  *)
+    echo "ERROR: OPENCLAW_LIVE_CLI_BACKEND_AUTH must be one of: auto, api-key, subscription." >&2
+    exit 1
+    ;;
+esac
+
+if [[ "$CLI_AUTH_MODE" == "subscription" && "$CLI_PROVIDER" != "claude-cli" ]]; then
+  echo "ERROR: OPENCLAW_LIVE_CLI_BACKEND_AUTH=subscription is only supported for claude-cli." >&2
+  exit 1
+fi
+
 CLI_METADATA_JSON="$(node --import tsx "$ROOT_DIR/scripts/print-cli-backend-live-metadata.ts" "$CLI_PROVIDER")"
 read_metadata_field() {
   local field="$1"
@@ -33,11 +48,65 @@ CLI_DOCKER_NPM_PACKAGE="$(read_metadata_field dockerNpmPackage 2>/dev/null || tr
 CLI_DOCKER_BINARY_NAME="$(read_metadata_field dockerBinaryName 2>/dev/null || true)"
 
 if [[ "$CLI_PROVIDER" == "claude-cli" && -z "$CLI_DISABLE_MCP_CONFIG" ]]; then
-  CLI_DISABLE_MCP_CONFIG="0"
+  if [[ "$CLI_AUTH_MODE" == "subscription" ]]; then
+    CLI_DISABLE_MCP_CONFIG="1"
+  else
+    CLI_DISABLE_MCP_CONFIG="0"
+  fi
 fi
 
 mkdir -p "$CLI_TOOLS_DIR"
 
+if [[ "$CLI_PROVIDER" == "claude-cli" && "$CLI_AUTH_MODE" == "subscription" ]]; then
+  CLAUDE_CREDS_FILE="$HOME/.claude/.credentials.json"
+  CLAUDE_SUBSCRIPTION_AUTH_SOURCE=""
+  CLAUDE_SUBSCRIPTION_TYPE=""
+  if [[ -f "$CLAUDE_CREDS_FILE" ]]; then
+    CLAUDE_SUBSCRIPTION_TYPE="$(
+      node -e '
+        const fs = require("node:fs");
+        const file = process.argv[1];
+        const data = JSON.parse(fs.readFileSync(file, "utf8"));
+        const subscriptionType = String(data?.claudeAiOauth?.subscriptionType ?? "").trim();
+        if (!subscriptionType || subscriptionType === "unknown") process.exit(2);
+        process.stdout.write(subscriptionType);
+      ' "$CLAUDE_CREDS_FILE" 2>/dev/null
+    )" || {
+      echo "ERROR: $CLAUDE_CREDS_FILE does not look like Claude subscription OAuth auth." >&2
+      echo "Expected claudeAiOauth.subscriptionType to be present." >&2
+      exit 1
+    }
+    CLAUDE_SUBSCRIPTION_AUTH_SOURCE="credentials-file"
+  elif [[ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]]; then
+    CLAUDE_SUBSCRIPTION_TYPE="oauth-token"
+    CLAUDE_SUBSCRIPTION_AUTH_SOURCE="env-token"
+  else
+    echo "ERROR: Claude subscription auth requires either:" >&2
+    echo "  - $CLAUDE_CREDS_FILE with claudeAiOauth.subscriptionType, or" >&2
+    echo "  - CLAUDE_CODE_OAUTH_TOKEN from 'claude setup-token'." >&2
+    exit 1
+  fi
+  if [[ -z "${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}" ]]; then
+    if [[ "$CLAUDE_SUBSCRIPTION_AUTH_SOURCE" == "env-token" ]]; then
+      export OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV='["CLAUDE_CODE_OAUTH_TOKEN"]'
+    else
+      export OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV="[]"
+    fi
+  fi
+  if [[ "$OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV" == *ANTHROPIC_API_KEY* ]]; then
+    echo "ERROR: subscription auth smoke must not preserve Anthropic API-key env vars." >&2
+    exit 1
+  fi
+  if [[ "$CLAUDE_SUBSCRIPTION_AUTH_SOURCE" == "env-token" && "$OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV" != *CLAUDE_CODE_OAUTH_TOKEN* ]]; then
+    echo "ERROR: CLAUDE_CODE_OAUTH_TOKEN subscription smoke must preserve CLAUDE_CODE_OAUTH_TOKEN for the Gateway child process." >&2
+    exit 1
+  fi
+  export OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE:-0}"
+  export OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE:-1}"
+  export OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE:-0}"
+  export OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE:-0}"
+fi
+
 PROFILE_MOUNT=()
 if [[ -f "$PROFILE_FILE" ]]; then
   PROFILE_MOUNT=(-v "$PROFILE_FILE":/home/node/.profile:ro)
@@ -131,6 +200,30 @@ if [ -n "${OPENCLAW_LIVE_CLI_BACKEND_COMMAND:-}" ] && [ ! -x "${OPENCLAW_LIVE_CL
   npm_config_prefix="$HOME/.npm-global" npm install -g "$docker_package"
 fi
 if [ "$provider" = "claude-cli" ]; then
+  auth_mode="${OPENCLAW_LIVE_CLI_BACKEND_AUTH:-auto}"
+  if [ "$auth_mode" = "subscription" ]; then
+    unset ANTHROPIC_API_KEY
+    unset ANTHROPIC_API_KEY_OLD
+    unset ANTHROPIC_API_TOKEN
+    unset ANTHROPIC_AUTH_TOKEN
+    unset ANTHROPIC_OAUTH_TOKEN
+    node - <<'NODE'
+const fs = require("node:fs");
+const file = `${process.env.HOME}/.claude/.credentials.json`;
+if (fs.existsSync(file)) {
+  const data = JSON.parse(fs.readFileSync(file, "utf8"));
+  const subscriptionType = String(data?.claudeAiOauth?.subscriptionType ?? "").trim();
+  if (!subscriptionType || subscriptionType === "unknown") {
+    throw new Error("Claude subscription OAuth credentials are missing subscriptionType.");
+  }
+  console.error(`[claude-subscription] subscriptionType=${subscriptionType}`);
+} else if (process.env.CLAUDE_CODE_OAUTH_TOKEN?.trim()) {
+  console.error("[claude-subscription] using CLAUDE_CODE_OAUTH_TOKEN from environment");
+} else {
+  throw new Error("Claude subscription OAuth token or credentials file is required.");
+}
+NODE
+  fi
   real_claude="$HOME/.npm-global/bin/claude-real"
   if [ ! -x "$real_claude" ] && [ -x "$HOME/.npm-global/bin/claude" ]; then
     mv "$HOME/.npm-global/bin/claude" "$real_claude"
@@ -152,7 +245,29 @@ WRAP
   if [ -z "${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}" ]; then
     export OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV='["ANTHROPIC_API_KEY","ANTHROPIC_API_KEY_OLD"]'
   fi
-  claude auth status || true
+  if [ "$auth_mode" = "subscription" ]; then
+    claude --version
+    direct_token="OPENCLAW-CLAUDE-SUBSCRIPTION-DIRECT"
+    direct_output="$(
+      claude \
+        -p "Reply exactly: $direct_token" \
+        --output-format text \
+        --model sonnet \
+        --permission-mode bypassPermissions \
+        --setting-sources user \
+        --strict-mcp-config \
+        --mcp-config '{"mcpServers":{}}' \
+        --no-session-persistence
+    )"
+    if [[ "$direct_output" != *"$direct_token"* ]]; then
+      echo "ERROR: direct Claude subscription probe did not return expected token." >&2
+      echo "$direct_output" >&2
+      exit 1
+    fi
+    echo "[claude-subscription] direct claude -p probe ok"
+  else
+    claude auth status || true
+  fi
 fi
 tmp_dir="$(mktemp -d)"
 cleanup() {
@@ -175,21 +290,44 @@ cd "$tmp_dir"
 pnpm test:live src/gateway/gateway-cli-backend.live.test.ts
 EOF
 
-echo "==> Build live-test image: $LIVE_IMAGE_NAME (target=build)"
-docker build --target build -t "$LIVE_IMAGE_NAME" -f "$ROOT_DIR/Dockerfile" "$ROOT_DIR"
+if [[ "${OPENCLAW_SKIP_DOCKER_BUILD:-}" == "1" ]]; then
+  echo "==> Reuse live-test image: $LIVE_IMAGE_NAME (OPENCLAW_SKIP_DOCKER_BUILD=1)"
+else
+  echo "==> Build live-test image: $LIVE_IMAGE_NAME (target=build)"
+  docker build --target build -t "$LIVE_IMAGE_NAME" -f "$ROOT_DIR/Dockerfile" "$ROOT_DIR"
+fi
 
 echo "==> Run CLI backend live test in Docker"
 echo "==> Model: $CLI_MODEL"
 echo "==> Provider: $CLI_PROVIDER"
+echo "==> Auth mode: $CLI_AUTH_MODE"
+if [[ "$CLI_PROVIDER" == "claude-cli" && "$CLI_AUTH_MODE" == "subscription" ]]; then
+  echo "==> Claude subscription: $CLAUDE_SUBSCRIPTION_TYPE"
+  echo "==> Claude subscription source: $CLAUDE_SUBSCRIPTION_AUTH_SOURCE"
+fi
 echo "==> External auth dirs: ${AUTH_DIRS_CSV:-none}"
 echo "==> External auth files: ${AUTH_FILES_CSV:-none}"
+DOCKER_AUTH_ENV=(
+  -e OPENCLAW_LIVE_CLI_BACKEND_AUTH="$CLI_AUTH_MODE"
+)
+if [[ "$CLI_PROVIDER" == "claude-cli" && "$CLI_AUTH_MODE" == "subscription" ]]; then
+  DOCKER_AUTH_ENV+=(
+    -e CLAUDE_CODE_OAUTH_TOKEN="${CLAUDE_CODE_OAUTH_TOKEN:-}"
+    -e OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV="$OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV"
+  )
+else
+  DOCKER_AUTH_ENV+=(
+    -e ANTHROPIC_API_KEY
+    -e ANTHROPIC_API_KEY_OLD
+    -e OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY:-}"
+    -e OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY_OLD="${ANTHROPIC_API_KEY_OLD:-}"
+    -e OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV="${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}"
+  )
+fi
+
 docker run --rm -t \
   -u node \
   --entrypoint bash \
-  -e ANTHROPIC_API_KEY \
-  -e ANTHROPIC_API_KEY_OLD \
-  -e OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY:-}" \
-  -e OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY_OLD="${ANTHROPIC_API_KEY_OLD:-}" \
   -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
   -e HOME=/home/node \
   -e NODE_OPTIONS=--disable-warning=ExperimentalWarning \
@@ -203,15 +341,17 @@ docker run --rm -t \
   -e OPENCLAW_DOCKER_CLI_BACKEND_BINARY_NAME="$CLI_DOCKER_BINARY_NAME" \
   -e OPENCLAW_LIVE_TEST=1 \
   -e OPENCLAW_LIVE_CLI_BACKEND=1 \
+  -e OPENCLAW_LIVE_CLI_BACKEND_DEBUG="${OPENCLAW_LIVE_CLI_BACKEND_DEBUG:-}" \
+  -e OPENCLAW_CLI_BACKEND_LOG_OUTPUT="${OPENCLAW_CLI_BACKEND_LOG_OUTPUT:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_MODEL="$CLI_MODEL" \
   -e OPENCLAW_LIVE_CLI_BACKEND_COMMAND="${OPENCLAW_LIVE_CLI_BACKEND_COMMAND:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_ARGS="${OPENCLAW_LIVE_CLI_BACKEND_ARGS:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_CLEAR_ENV="${OPENCLAW_LIVE_CLI_BACKEND_CLEAR_ENV:-}" \
-  -e OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV="${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_DISABLE_MCP_CONFIG="$CLI_DISABLE_MCP_CONFIG" \
   -e OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_ARG="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_ARG:-}" \
   -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_MODE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_MODE:-}" \
   -v "$ROOT_DIR":/src:ro \
@@ -219,6 +359,7 @@ docker run --rm -t \
   -v "$WORKSPACE_DIR":/home/node/.openclaw/workspace \
   -v "$CLI_TOOLS_DIR":/home/node/.npm-global \
   "${EXTERNAL_AUTH_MOUNTS[@]}" \
+  "${DOCKER_AUTH_ENV[@]}" \
   "${PROFILE_MOUNT[@]}" \
   "$LIVE_IMAGE_NAME" \
   -lc "$LIVE_TEST_CMD"
diff --git a/src/agents/system-prompt.test.ts b/src/agents/system-prompt.test.ts
index aa1dadb6ba0..68e744842ef 100644
--- a/src/agents/system-prompt.test.ts
+++ b/src/agents/system-prompt.test.ts
@@ -251,6 +251,17 @@ describe("buildAgentSystemPrompt", () => {
     expect(prompt).not.toContain("## Skills");
   });
 
+  it("avoids the Claude subscription classifier wording in reply tag guidance", () => {
+    const prompt = buildAgentSystemPrompt({
+      workspaceDir: "/tmp/openclaw",
+    });
+
+    expect(prompt).toContain("## Reply Tags");
+    expect(prompt).toContain("[[reply_to_current]]");
+    expect(prompt).not.toContain("Tags are stripped before sending");
+    expect(prompt).toContain("Tags are removed before sending");
+  });
+
   it("omits the heartbeat section when no heartbeat prompt is provided", () => {
     const prompt = buildAgentSystemPrompt({
       workspaceDir: "/tmp/openclaw",
diff --git a/src/agents/system-prompt.ts b/src/agents/system-prompt.ts
index cf41a70bce6..1bab8b5f166 100644
--- a/src/agents/system-prompt.ts
+++ b/src/agents/system-prompt.ts
@@ -190,7 +190,7 @@ function buildReplyTagsSection(isMinimal: boolean) {
     "- [[reply_to_current]] replies to the triggering message.",
     "- Prefer [[reply_to_current]]. Use [[reply_to:<id>]] only when an id was explicitly provided (e.g. by the user or a tool).",
     "Whitespace inside the tag is allowed (e.g. [[ reply_to_current ]] / [[ reply_to: 123 ]]).",
-    "Tags are stripped before sending; support depends on the current channel config.",
+    "Tags are removed before sending; support depends on the current channel config.",
     "",
   ];
 }