fix(models): reflect Claude CLI auth status

CHANGELOG.md

@@ -370,6 +370,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Models/status: report fresh Claude CLI native auth instead of stale stored `anthropic:claude-cli` profile expiry when local Claude credentials are current. Fixes #71256. Thanks @matthiasjanke.
 - Packaged installs: preserve package-root runtime dependencies and their exported subpaths when bundled plugin runtime mirrors fall back to copying shared chunks, fixing Windows npm updates that could fail to load copied `dist` modules.
 - Heartbeat: clamp oversized scheduler delays through the shared safe timer helper, preventing `every` values over Node's timeout cap from becoming a 1 ms crash loop. Fixes #71414. (#71478) Thanks @hclsys.
 - Agents/heartbeat: stop injecting the heartbeat system prompt into non-heartbeat runs, preventing ordinary user replies from being suppressed as `HEARTBEAT_OK` acknowledgments. Fixes #69079. (#69278) Thanks @stainlu.

extensions/anthropic/index.test.ts

@@ -332,6 +332,33 @@ describe("anthropic provider replay hooks", () => {
     });
   });
 
+  it("exposes Claude CLI auth as a runtime-only external profile", async () => {
+    readClaudeCliCredentialsForRuntimeMock.mockReset();
+    readClaudeCliCredentialsForRuntimeMock.mockReturnValue({
+      type: "oauth",
+      provider: "anthropic",
+      access: "fresh-cli-access",
+      refresh: "fresh-cli-refresh",
+      expires: 123,
+    });
+
+    const provider = await registerSingleProviderPlugin(anthropicPlugin);
+
+    expect(provider.resolveExternalAuthProfiles?.({} as never)).toEqual([
+      {
+        profileId: "anthropic:claude-cli",
+        credential: {
+          type: "oauth",
+          provider: "claude-cli",
+          access: "fresh-cli-access",
+          refresh: "fresh-cli-refresh",
+          expires: 123,
+        },
+        persistence: "runtime-only",
+      },
+    ]);
+  });
+
   it("stores a claude-cli auth profile during anthropic cli migration", async () => {
     readClaudeCliCredentialsForSetupMock.mockReset();
     readClaudeCliCredentialsForSetupMock.mockReturnValue({

extensions/anthropic/openclaw.plugin.json

@@ -49,6 +49,7 @@
     }
   ],
   "contracts": {
+    "externalAuthProviders": ["claude-cli"],
     "mediaUnderstandingProviders": ["anthropic"]
   },
   "mediaUnderstandingProviderMetadata": {

extensions/anthropic/register.runtime.ts

@@ -422,6 +422,26 @@ function resolveClaudeCliSyntheticAuth() {
       };
 }
 
+function resolveClaudeCliExternalAuthProfiles() {
+  const credential = claudeCliAuth.readClaudeCliCredentialsForRuntime();
+  if (!credential || credential.type !== "oauth") {
+    return [];
+  }
+  return [
+    {
+      profileId: "anthropic:claude-cli",
+      credential: {
+        type: "oauth" as const,
+        provider: CLAUDE_CLI_BACKEND_ID,
+        access: credential.access,
+        refresh: credential.refresh,
+        expires: credential.expires,
+      },
+      persistence: "runtime-only" as const,
+    },
+  ];
+}
+
 async function runAnthropicCliMigration(ctx: ProviderAuthContext): Promise<ProviderAuthResult> {
   const credential = claudeCliAuth.readClaudeCliCredentialsForSetup();
   if (!credential) {
@@ -587,6 +607,7 @@ export function buildAnthropicProvider(): ProviderPlugin {
       normalizeLowercaseStringOrEmpty(provider) === CLAUDE_CLI_BACKEND_ID
         ? resolveClaudeCliSyntheticAuth()
         : undefined,
+    resolveExternalAuthProfiles: () => resolveClaudeCliExternalAuthProfiles(),
     buildReplayPolicy: buildAnthropicReplayPolicy,
     isModernModelRef: ({ modelId }) => matchesAnthropicModernModel(modelId),
     resolveReasoningOutputMode: () => "native",

src/commands/models/list.status-command.ts

@@ -11,7 +11,7 @@ import {
   formatRemainingShort,
 } from "../../agents/auth-health.js";
 import { resolveAuthStorePathForDisplay } from "../../agents/auth-profiles/paths.js";
-import { ensureAuthProfileStoreWithoutExternalProfiles as ensureAuthProfileStore } from "../../agents/auth-profiles/store.js";
+import { ensureAuthProfileStore } from "../../agents/auth-profiles/store.js";
 import { resolveProfileUnusableUntilForDisplay } from "../../agents/auth-profiles/usage.js";
 import { resolveProviderEnvApiKeyCandidates } from "../../agents/model-auth-env-vars.js";
 import { resolveEnvApiKey } from "../../agents/model-auth.js";

src/commands/models/list.status.test.ts

@@ -43,6 +43,7 @@ const mocks = vi.hoisted(() => {
     resolveAgentModelFallbacksOverride: vi.fn().mockReturnValue(undefined),
     listAgentIds: vi.fn().mockReturnValue(["main", "jeremiah"]),
     ensureAuthProfileStore: vi.fn().mockReturnValue(store),
+    ensureAuthProfileStoreWithoutExternalProfiles: vi.fn().mockReturnValue(store),
     listProfilesForProvider: vi.fn((s: typeof store, provider: string) => {
       return Object.entries(s.profiles)
         .filter(([, cred]) => cred.provider === provider)
@@ -146,7 +147,8 @@ vi.mock("../../agents/auth-profiles/profiles.js", () => ({
 }));
 vi.mock("../../agents/auth-profiles/store.js", () => ({
   ensureAuthProfileStore: mocks.ensureAuthProfileStore,
-  ensureAuthProfileStoreWithoutExternalProfiles: mocks.ensureAuthProfileStore,
+  ensureAuthProfileStoreWithoutExternalProfiles:
+    mocks.ensureAuthProfileStoreWithoutExternalProfiles,
 }));
 vi.mock("../../agents/auth-profiles/usage.js", () => ({
   resolveProfileUnusableUntilForDisplay: mocks.resolveProfileUnusableUntilForDisplay,
@@ -284,6 +286,8 @@ describe("modelsStatusCommand auth overview", () => {
     const payload = JSON.parse(String((runtime.log as Mock).mock.calls[0]?.[0]));
 
     expect(mocks.resolveOpenClawAgentDir).toHaveBeenCalled();
+    expect(mocks.ensureAuthProfileStore).toHaveBeenCalled();
+    expect(mocks.ensureAuthProfileStoreWithoutExternalProfiles).not.toHaveBeenCalled();
     expect(payload.defaultModel).toBe("anthropic/claude-opus-4-6");
     expect(payload.configPath).toBe("/tmp/openclaw-dev/openclaw.json");
     expect(payload.auth.storePath).toBe("/tmp/openclaw-agent/auth-profiles.json");