@byokit/openclaw 0.16.2 → 0.16.4

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## Unreleased
 
+## 0.16.4 (2026-10-18)
+
+FIX: Re-check the installed Claude login at every setup detection and switch out of fallback when it becomes signed in.
+
+## 0.16.3 (2026-10-18)
+
+- Dependency update: pins @byokit/relay 0.8.2.
+- Dependency update: pins @byokit/pair 0.10.4.
+
+- FIX: The engine now uses the person's own Claude and Codex subscription sign-in. The gateway, doctor and its agent CLIs (Claude Code, Codex and the rest) run with the person's `HOME`, plus the person's own `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `XDG_CONFIG_HOME`, `XDG_DATA_HOME` and `XDG_STATE_HOME` when set, instead of a kit-owned home, so an installed, signed-in Claude Code or Codex works with no sign-in step. HOME is not an access boundary: engine processes run with the person's own account rights. The phone-started Claude sign-in stays as the fallback: only when the installed `claude auth status --json` is not signed in does a start point `CLAUDE_CONFIG_DIR` at the engine's own folder (`<stateDir>/openclaw/home/.claude`), as before.
+- `doctorContext().env.HOME` is now the person's home; the engine's own home is `OPENCLAW_HOME` (`<stateDir>/openclaw/home`), which is also the gateway's working directory. Engine state, config, cache, tmp, token and bridge socket stay in the state directory.
+
 ## 0.16.2 (2026-10-18)
 
 - Dependency update: pins @byokit/accounts 0.27.1.

package/README.md

@@ -387,7 +387,7 @@ streams, [`examples/openclaw-kit`](../../examples/openclaw-kit) for a whole app,
 
 Subscription sign-ins are offered by default. API-billed routes remain in `kit.routes()` with `offer: false`;
 apps can offer them when the app or person opts in, labelled API key (billed per use). Each `Route` carries `billing` (`subscription`, `api` or
-`local`) so the app can label what is billed. Proxy routes, compatibility aliases, local runtimes stay off. Native Claude Code sign-in is offered by default. The engine picks the installed Claude login when it starts; a person who signs in to Claude on that machine after the engine started restarts the engine to use it. A plan key (OpenCode Go: `kit.addAccount(member, { authChoice: 'opencode-go' }, on)`) asks for `Plan key`; `paste` it and the engine live-tests it before `done`. A paired device starts the same sign-in with either `via` and pastes the key over the sealed link, which keeps it on the host. A run reaches the pinned engine's static Go models (default `opencode-go/deepseek-v4-pro`); the kit keeps OpenCode Go's `x-opencode-session` header on every request, the setup probe included. A live-only Go model such as Muse needs no app config: the kit registers the plan's live catalog with each model's API, so `run({ model: 'opencode-go/muse-spark-1.3-contributor' })` runs on the account (or with `auth: 'apiKey'` on a Go key); an app that sets `config.models.providers['opencode-go'].models` keeps its own list. A choice the pinned Gateway cannot set up has readiness `no_upstream_flow` and is never offered. Pass the accounts the app offers in `KitOptions.offered` (the provider, auth choice or alias each route carries, e.g. `'openrouter'`); the kit allow-lists the plugin of every route those name, so an opted-in sign-in is not blocked. An app can still name a plugin directly in `config.plugins.allow`, and pass the route's `choice` explicitly to `kit.signIn()`.
+`local`) so the app can label what is billed. Proxy routes, compatibility aliases, local runtimes stay off. Native Claude Code sign-in is offered by default. The kit re-checks the installed Claude login at each setup detection and, once it is signed in, restarts the engine onto it. A plan key (OpenCode Go: `kit.addAccount(member, { authChoice: 'opencode-go' }, on)`) asks for `Plan key`; `paste` it and the engine live-tests it before `done`. A paired device starts the same sign-in with either `via` and pastes the key over the sealed link, which keeps it on the host. A run reaches the pinned engine's static Go models (default `opencode-go/deepseek-v4-pro`); the kit keeps OpenCode Go's `x-opencode-session` header on every request, the setup probe included. A live-only Go model such as Muse needs no app config: the kit registers the plan's live catalog with each model's API, so `run({ model: 'opencode-go/muse-spark-1.3-contributor' })` runs on the account (or with `auth: 'apiKey'` on a Go key); an app that sets `config.models.providers['opencode-go'].models` keeps its own list. A choice the pinned Gateway cannot set up has readiness `no_upstream_flow` and is never offered. Pass the accounts the app offers in `KitOptions.offered` (the provider, auth choice or alias each route carries, e.g. `'openrouter'`); the kit allow-lists the plugin of every route those name, so an opted-in sign-in is not blocked. An app can still name a plugin directly in `config.plugins.allow`, and pass the route's `choice` explicitly to `kit.signIn()`.
 Offered provider plugins are allowed by default alongside the app's plugin ids. A route whose provider plugin ships outside the engine (Z.AI's GLM Coding Plan, for one) has readiness `needs_plugin` until the app calls `await kit.installPlugin(route.needs.plugin)`: it installs that plugin into the kit's own engine at exactly the engine's version and pinned npm integrity, keeps it allowed across restarts, and rejects `PluginInstallError` (`code` `version` or `integrity`) with nothing installed on a mismatch. Discovery never installs.
 
 ## API at a glance

package/dist/engine.d.ts

@@ -70,6 +70,8 @@ export declare class Engine {
     /** The engine's own shutdown signal; aborted by stop() and replaced by the next start(). */
     get stopSignal(): AbortSignal;
     private installedClaudeSignedOut;
+    /** Re-select the installed login on setup detection; only a confirmed login switches away from fallback. */
+    refreshInstalledClaudeLogin(): Promise<boolean>;
     /** The fallback Claude sign-in for a machine whose installed Claude Code is signed out: it signs into the engine's folder. */
     nativeClaudeLogin(): ReturnType<typeof remoteCliHost>;
     /** Whether a fallback sign-in would write a folder this engine's gateway does not read: it started on the person's

package/dist/engine.js

@@ -207,7 +207,7 @@ export class Engine {
         putOnce(join(this.root, 'npmrc'), ''); // engine npm runs read this empty config, never the person's ~/.npmrc
         this.sweepAccountOrphans();
         if (this.o.spawnEngine)
-            this.claudeFallback = await this.installedClaudeSignedOut();
+            this.claudeFallback = (await this.installedClaudeSignedOut()) ?? false;
         try {
             await this.authStore.prepare();
             this.credentialsLocked = false;
@@ -376,9 +376,19 @@ export class Engine {
                 return resolve(true);
             }
             this.o.log?.(`claude: sign-in status unknown, using the person's own login location (${String(error?.message ?? 'unparseable output').slice(0, 200)})`);
-            resolve(false);
+            resolve(undefined);
         }));
     }
+    /** Re-select the installed login on setup detection; only a confirmed login switches away from fallback. */
+    async refreshInstalledClaudeLogin() {
+        if (!this.o.spawnEngine || !this.claudeFallback)
+            return false;
+        const signedOut = await this.installedClaudeSignedOut();
+        if (signedOut !== false)
+            return false;
+        this.claudeFallback = false;
+        return true;
+    }
     /** The fallback Claude sign-in for a machine whose installed Claude Code is signed out: it signs into the engine's folder. */
     nativeClaudeLogin() {
         if (this.claudeLogin)

package/dist/kit.js

@@ -997,7 +997,13 @@ export class OpenClawKit {
         const transport = this.transport;
         if (!transport || this.current.phase !== 'ready')
             return () => Promise.reject(new Error('gateway not ready'));
-        return (method, params, options) => {
+        return async (method, params, options) => {
+            // The gateway's own restart is in-process (OPENCLAW_NO_RESPAWN) and keeps CLAUDE_CONFIG_DIR: a new engine process drops it.
+            if (method === 'openclaw.setup.detect' && await this.engine.refreshInstalledClaudeLogin()) {
+                await this.stop();
+                await this.start();
+                return this.request()(method, params, options);
+            }
             const changesAuth = /^(models\.authLogout|openclaw\.setup\.(auth\.start|activate)|wizard\.(next|cancel)|config\.(apply|patch|set)|agents\.(create|update|delete)|secrets\.(reload|store\.(set|delete))|byokit\.keys)$/.test(method);
             if (!changesAuth || (method === 'byokit.keys' && params?.action === 'ready'))
                 return transport.request(method, params, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/openclaw",
-  "version": "0.16.2",
+  "version": "0.16.4",
   "description": "The OpenClaw runtime kit: the pinned engine's full operator surface with plain-words helpers for members, sign-in, runs and approvals.",
   "license": "Apache-2.0",
   "type": "module",
@@ -61,8 +61,8 @@
   },
   "dependencies": {
     "@byokit/accounts": "0.27.1",
-    "@byokit/pair": "0.10.3",
-    "@byokit/relay": "0.8.1",
+    "@byokit/pair": "0.10.4",
+    "@byokit/relay": "0.8.2",
     "@byokit/discover": "0.8.4",
     "@byokit/seal": "0.3.1",
     "@byokit/secrets": "0.5.2",