* feat(usage): surface plan windows and account email in the chat context popover
The context-window popover now shows which account a session runs on:
provider usage snapshots carry an accountEmail resolved from the auth
profile when stored, the ChatGPT access-token JWT claims (openai/codex),
or the Claude CLI config file (~/.claude.json oauthAccount) for
keychain-synced logins. models.authStatus embeds it, quota groups keep
distinct accounts separate, and the popover renders the email under the
plan header for local CLI sessions and OpenClaw-configured subscriptions
alike.
* test(openai): assemble the fake usage JWT from parts
* test(usage): keep fixture tokens and identity plumbing scanner-safe
* fix(usage): verify the Claude CLI login before labeling usage with its email
Review findings: the CLI-config email fallback now requires the usage token
to match the cached CLI credential (and honors CLAUDE_CONFIG_DIR), so an
ambient login for another account never labels a snapshot; token-type
credentials propagate their stored email alongside oauth ones.
* style(anthropic): scanner-safe local for the CLI login read
* fix(usage): capture the Claude CLI account email on the credential
Review findings: reading ambient CLI config at usage-fetch time could not
verify keychain-only logins and could go stale across account switches.
The credential reader now captures oauthAccount.emailAddress next to the
credential it belongs to, the synced claude-cli profile carries it, and
the anthropic fetcher uses only the credential-borne identity.
* style(usage): scanner-safe credential fixtures and helper naming
* fix(auth): backfill the CLI account email onto existing synced profiles
Profiles synced before identity capture stay usable and skip CLI reads,
so upgraded installs would never gain the email until token rotation.
While the stored token material matches the CLI login, merge the
non-secret email onto the stored profile.
* style(test): scanner-safe email assertion
* test(auth): pin the no-reread invariant to identity-complete profiles
* feat(ui): move Devices page into settings and redesign device inventory
- Devices now lives at /settings/devices (System group); /nodes stays as alias
- per-device form-factor icons (phone/browser/terminal/machine) with status dot
- equal-height header actions; stale cleanup and pairing only
- drop manual Refresh button; page already auto-refreshes via presence events + 30s poll
- dynamic connected/pending summary replaces static card subtitle
* style(ui): oxfmt pass + loading empty state for devices inventory
* chore(ui): sync locale bundles for devices settings copy; docs point at Settings → Devices
* refactor(ui): split device tile + pending rows out of view-inventory; drop unused icons
Keeps the TypeScript LOC ratchet green: view-inventory.ts returns below its
baseline and icons.ts sheds unused folderOpen/micOff/volumeOff glyphs.
* fix(ui): ratchet LOC baseline, drop unused DeviceIconSource export, settle devices settings copy
- baseline: icons.ts 693, view-inventory.ts back under the 500 ceiling
- subtitles.nodes now describes the settings page; nav tests updated
- locale bundles resynced (fallbacks=0)
* refactor(ui): rename token row param for reviewer-tool clarity
* fix(ui): collapse device rows in narrow containers and classify the TUI as a terminal client
Review findings: the nodes-entry grid override beat the shared 560px
list-item collapse, overflowing phone-width rows; openclaw-tui connects
with mode ui so only its client id marks it as a terminal.
* chore(ui): translate pending locale keys after rebase (fallbacks=0)
* feat(ui): restyle composer send button as filled accent circle
The send button was an outline ghost (transparent bg, 1px accent border,
outlined paper plane) while every other primary action uses the solid
.btn.primary fill. Send now matches: solid accent circle, white arrow-up
glyph, accent-hover + glow on hover, muted fill when disabled. Stop and
voice variants drop their borders and escalate via fill strength instead.
* fix(ui): keep send button focus ring visible under hover
Hover rules now set box-shadow and out-specify :focus-visible, so a
box-shadow focus ring vanished for keyboard users hovering the control.
Use an offset outline instead; hover shadows cannot override it.
* chore(ui): compact arrow icons to satisfy TS LOC ratchet
icons.ts is over the 500-line ratchet cap, so the new arrowUp entry
must not grow the file; merge each arrow's two paths into one
(identical rendering) for a net -4 lines.
* fix(transcripts): stop live capture when the agent run is canceled
* fix(transcripts): preserve startup cleanup ownership
* fix(transcripts): keep runtime session type internal
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
* fix(agents): classify account-restricted model 400s as model_not_found
OpenAI-backed runtimes reject plan/account-restricted models with HTTP
400 invalid_request_error ("The '<model>' model is not supported when
using Codex with a ChatGPT account."). Without a model_not_found match
the ambiguous-400 branch collapses this into a format failure, so users
get the generic retry//new copy for a config-only problem (#104490).
The 'when using' qualifier keeps capability rejections ("not supported
for tool calling") out of the class, preserving the #97611 contract.
Fixes#104490
* fix(agents): narrow account model rejection match
---------
Co-authored-by: Altay <altay@hey.com>
* fix(config): clear snapshot marker on transient read error so future updates retry
The pre-update config snapshot marks a config path as snapshotted
before attempting the I/O. If readFile or writeFile threw a transient
error (e.g. disk space exhaustion, file locking), the catch block kept
the in-memory marker intact, permanently blocking snapshot retries for
the lifetime of the process.
Clear the marker in the catch block so a subsequent update can attempt
the snapshot again.
Fixes#105431
* test(config): cover snapshot retry failures
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
