@byokit/openclaw 0.6.2 → 0.8.0

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 ## Unreleased
 
+## 0.8.0 (2026-10-09)
+
+- Forward actual thinking-token progress and report Gateway acceptance as `started`; reuse bounded, file-witnessed member admission status so ready runs avoid redundant sign-in checks without skipping authority checks. Device state uses the same live readiness boundary; `providerStatus` preserves unknown versus empty sign-in status.
+- FIX: On the Claude CLI route the printed `## Tooling` list now uses the Claude wire catalog names (`mcp__openclaw__<tool>`), so a listed tool can be called exactly as printed. Every other route keeps the stock prompt byte-identical, and already-prefixed names are never prefixed again.
+- The deprecated `anthropic` provider alias on route `anthropic-cli` stays readable as `route.deprecatedProvider` (`'anthropic'`); its removal moves to 0.9.0.
+- FIX: `OpenClawKit.abort` always returns a Promise, including after an engine drop; cancellation failures remain catchable without changing healthy abort results.
+- FIX: `ensureMember` resolves only once `agents.list` shows the member (bounded ~5 s wait, then a plain error naming the member), so a turn sent right after it is no longer rejected as `unknown agent id` while the engine hot-reloads its roster.
+
+## 0.7.0 (2026-10-08)
+
+- FIX: Unreadable sealed sign-ins now fail closed with `AuthStoreUnreadableError` and recovery words, leaving `auth-store.sealed` byte-identical for original-key or backup repair and retry instead of starting signed out with a replacement store.
+
+## 0.6.3 (2026-10-07)
+
+- Dependency update: pins @byokit/relay 0.5.3.
+- Dependency update: pins @byokit/link 0.7.1.
+
+- FIX: Route `anthropic-cli` now reports provider `claude-cli`, the id `signedIn`, `providers()` and runs already use for a Claude Code login, so `kit.signedIn(member, route.provider)` answers true once Claude Code is signed in. **Deprecated:** the old provider `anthropic` on this route; it stays readable as `route.deprecatedProvider` (`'anthropic'`) through 0.7.x and is removed in 0.8.0. Match this route by `provider === 'claude-cli'` (or by `choice === 'anthropic-cli'`). The route id `anthropic:cli:anthropic-cli` is kept through 0.7.x and becomes `claude-cli:cli:anthropic-cli` in 0.8.0; choice `anthropic-cli` and the `{ provider: 'claude-cli', via: 'browser' }` link selector are unchanged. `anthropic` remains the API-billed provider only: a Claude Code login never makes `signedIn(member, 'anthropic')` true.
+FIX: Engine start on macOS no longer sticks on a dead-but-unreaped guard process. `pidAlive` detects zombies portably — `ps` state where there is no `/proc` — instead of Linux-only `/proc`, so a stale guard reads as stopped and start can recover. A live pid still reads as owned, an invalid guard still reads as ambiguous, and anything unexpected from the probe keeps the guard. Linux answers are unchanged.
+- FIX: Code sign-ins whose pinned engine prints the code only into a note now hand the caller the code, link, expiry (`expiresAt`) and instructions (`message`) in the same `SignInView` shape as structured codes, and wait out device approval instead of failing with `gateway request timeout for wizard.next` after two minutes.
+- The O16 day-usage engine tests no longer fail when a run straddles UTC midnight: a case that could still be running at midnight starts just after it, so the day (and month) it reads is the day its engine stamps charges in.
+- The `relay` option takes anything with `RelayClient`'s `notify`, so a host can hand the kit a relay it opens after `Host.open` (the client needs the open host). A `RelayClient` still fits; behaviour is unchanged.
+- FIX: The sealed credential store is written as `v: 1` again. 0.6.2's `v: 2` tag made every earlier kit (through 0.6.1) refuse an intact store with `invalid sealed credential store`, so a host rolled back to an earlier kit could not start and lost its saved sign-in. `v: 2` stores still restore and re-seal as `v: 1`.
+- A saved store the key cannot open (a different key, damaged or tampered bytes) or whose payload is not a credential snapshot no longer blocks engine start: it is kept as `auth-store.sealed.unreadable-<ms>` (never overwritten or deleted), the engine starts signed out, and the kit reports `{ phase: 'ready', why: 'sign-in-reset' }` with the words "Your saved sign-in couldn't be opened, so it was kept aside. Sign in again." until a sign-in through the kit completes.
+- FIX: Every wizard `text` step now reaches the caller as `SignInView.prompt`, not only sensitive ones. A non-sensitive step shows the engine's question as written (`github-copilot-enterprise` asks for the Enterprise domain first), so the sign-in no longer waits 15 minutes on a screen with nothing to answer. Once a step is sensitive (or the choice is `setup-token`), the prompt stays the fixed `Sign-in token` label and no gateway prose is shown, as before.
+- FIX: `setup-token` is no longer offered. The pinned Gateway has no app-guided sign-in for it and refuses every attempt with "That provider setup is not available on this Gateway.", so it is listed with `readiness: 'no_upstream_flow'`, the link no longer maps `{ provider: 'anthropic', via: 'browser' }` to it. `plugins.allow` now holds the plugin of every default-eligible bundled route rather than only the ready ones, so `anthropic-cli` and `apiKey` keep the `anthropic` plugin allowed without app config.
+- The R1 restart-recovery probe accepts both restart-time gate denials for the unowned recovering session (HEAD's `unknown run` and the published kit's `can't check this action right now`); any other transcript text still fails the denial assertion.
+
 ## 0.6.2 (2026-10-05)
 
 FIX: The browser broker now holds its CDP endpoint back until Chromium's initial tab exists, so `/json/list` can never serve an empty browser to an attaching engine on a cold or slow start; a browser that never lists a tab fails the launch honestly instead.

package/README.md

@@ -30,6 +30,8 @@ phone page that pairs, signs in with ChatGPT, runs and answers approvals, see
 `engine/patches.json` declares the exact upstream tarball integrity, commit, unique edits and before/after file
 hashes. The Gateway Workshop review patch writes content-free, durable usage facts only when the kit sets its
 accounting environment. The separately bundled worker and all other detached kinds remain uncovered.
+The Claude CLI route also uses the bundled [Tooling-name correction](../../docs/runtime-kits.md#516-bundled-engine-patches-and-engine-started-usage);
+apps do not need consumer tool aliases.
 The full upstream MIT notice ships in [engine/OPENCLAW-LICENSE](engine/OPENCLAW-LICENSE).
 
 Each `prepare()` verifies the **entire** selected engine tree, including unpatched files. The kit installs stock
@@ -102,6 +104,9 @@ just to read a final result: on cache eviction that would start another run. App
 recovery. Typed `kit.call('agent', ...)` remains exact upstream pass-through. Details and real-engine proof are
 in [the run contract](../../docs/runtime-kits.md#58-runs-members-and-streams).
 
+Every code route shows its code the same way: a waiting view carries `code`, `url`, `expiresAt` (epoch ms, when
+the engine gives a lifetime) and the engine's own instructions in `message`, including routes whose pinned engine
+prints the code only into a note's text.
 Device approval can take longer than two minutes. The kit waits through the engine's advertised code lifetime
 (`expiresInMinutes` on the pin, or `expires_in` seconds when supplied), including progress pulls. If the engine
 supplies no lifetime, it owns the deadline. Ordinary wizard requests keep their 120-second timeout.
@@ -109,7 +114,7 @@ supplies no lifetime, it owns the deadline. Ordinary wizard requests keep their
 `done` returns a typed `SignInView`: `why: 'expired'` for an expired code, `why: 'declined'` for cancellation,
 with a plain sentence in `error`. `SignInOptions` is exported from the host entry.
 
-For a subscription setup-token or any sensitive wizard text step, pass the token once through the same
+For any sensitive wizard text step, pass the secret once through the same
 `signIn.paste(token)` channel and clear the input afterwards. The kit displays only a fixed entry label;
 subsequent wizard errors, links and codes are withheld, and failures use a fixed message rather than
 engine text that could echo the token. It is sent only as this member's wizard answer, never in views,
@@ -127,7 +132,7 @@ For an owner who explicitly offers keys, `kit.addKey('ana', { authChoice: 'opena
 `ok`, `invalid` or `not_included`. Label the option **API key (billed per use)**. Select only `routes()` rows with
 `keyEntry: true`; API rows remain `offer: false`. Each route also carries its engine `revision`, `checked` date,
 label and key error word names. Submit the input directly, clear the field afterwards, and never log or save it in
-app state. The kit never returns engine key-check errors or the key. `ui-core/kits` supplies `keyStep`/`keyView`
+app state. The kit never returns engine key-check errors or the key. [`@byokit/ui/kits`](../ui/README.md) supplies `keyStep`/`keyView`
 for entry, checking, success and failure states, using the kit's `key.*` words.
 
 To use the saved key for one run, pass `auth: 'apiKey'`. The key lives in the member's separate
@@ -139,9 +144,23 @@ because the engine's profile pins can rotate. The `byokit-key-` member prefix is
 replaces the previous key; a failed replacement leaves this option unavailable. If the normal agent already has
 an API key added through pass-through calls, `addKey` returns `invalid` and leaves that key untouched.
 
+`OpenClawKit.abort` always returns a Promise. Await it or attach `.catch(...)`: an unavailable engine, transport
+failure or invalid API-key session key rejects with the original error, never throws synchronously, and is not
+reported as successful cancellation. Healthy cancellation ends the run as defined in
+[the run contract](../../docs/runtime-kits.md#58-runs-members-and-streams).
+
 A run spec also takes `system`, `images` (`{ data, mimeType }[]`), `thinking` and `tools`, a subset of the app tools
 (`KitOptions.tools` names) this run may call; any other app tool is refused at the gate before `ToolHost.gate` sees
-it. Tool events carry the engine's call `id`, the `input` on `start` and the `output` and `error` on `end`. A run that
+it. Run events report `started` when the Gateway accepts the request (not when it finishes), and forward
+actual `thinking` progress as `{ type: 'thinking', tokens }`. Silent routes invent no progress; cached replays
+without a new accepted frame emit no `started`. Handle these frames explicitly rather than treating every
+non-text/tool frame as an end.
+Live readiness reads (`providers`, `signedIn`, or device `state()`) prepare admission for the next run, avoiding
+redundant checks while authority remains reusable. `providerStatus(member)` returns `undefined` for unknown
+status rather than `[]`; `providers` maps unknown to `[]`, and `signedIn` to `false`.
+See [the admission contract](../../docs/runtime-kits.md#58-runs-members-and-streams) for lifetime, expiry,
+file witnesses, invalidation and remote-revocation limits.
+Tool events carry the engine's call `id`, the `input` on `start` and the `output` and `error` on `end`. A run that
 ends ok carries `usage` (the engine's token total for the run, and `costUsd` when it priced the model) and
 `planWindow` (the subscription's quota windows as the engine last read them), each only when the engine reports it.
 `openclawDevice(link).run(message, o)` takes the same options over the link, and `state()` adds the kit and engine
@@ -288,7 +307,6 @@ state: ready | protocol: 4
 event: {"type":"text","text":"fake: Say hello."}
 event: {"type":"text","text":"fake: Say hello."}
 end: {"ok":true,"text":"fake: Say hello.","usage":{"input":10,"output":16,"total":26}}
-route: setup-token                subscription setup_token
 route: github-copilot             subscription code
 route: github-copilot-enterprise  subscription code
 route: minimax-global-oauth       subscription code
@@ -329,7 +347,7 @@ Entries:
 | `RouteView`, `RouteFacts`, `JsonValue`, `UsageClient`, `DayUsageClient` (`.`) | The types `routes()`, `routes(facts)` and the usage readers return or take, nameable without a cast |
 | `openclawDevice(link)` (`./device`) | Portable client: state, routes, sign-in, runs, steer, abort, approvals, events, sealed notices, pass-through `call`. `OpenClawDevice` and `DeviceEndFrame` name what it returns |
 | `LinkRefused`, `openNotice` (`./device`) | The host's own refusal as an error; opens a sealed approval notice |
-| `words`, `stateWords`, `toAccountView` (`.`, `./device`) | The kit's sentences, so a phone shows the words the computer does; `toAccountView` feeds `@byokit/ui-core`'s `phaseOf` |
+| `words`, `stateWords`, `toAccountView` (`.`, `./device`) | The kit's sentences, so a phone shows the words the computer does; `toAccountView` feeds [`@byokit/ui`](../ui/README.md)'s `phaseOf` |
 | `openclawLink(kit, o)` (`./link`) | `handle` / `stream` / `allow` for a `@byokit/link` `Host`, checked per member, plus `onAction` for relay push actions. `OpenClawLinkOptions` / `OpenClawLinkHost` name both sides |
 | `serve(o)` (`./link`) | Binds the link host per reach and returns its URLs (`OpenClawServeOptions` / `OpenClawServeHandle`) |
 | `fakeGateway`, `openclawContract`, `startModelStub`, `useModelStub` (`./testing`) | In-memory Gateway, the contract suite and the scripted model for tests. `fakeGateway`'s script is typed per method (`FakeScript`, `FakeHandler`), and a recorded `StubCall` carries a typed `StubRequest` |
@@ -481,7 +499,19 @@ separately; dual-wrap rotation retains old wrapping keys for backups.
 Without `authSeal`, engine credentials remain plaintext. With it, successful `prepare()` and `stop()` leave
 only a sealed snapshot, `auth-store.sealed`, for the sealed credential paths; regenerable caches stay on
 disk unsealed. The adapter authenticates the snapshot
-before any restoration; a wrong key, tampering, or a missing adapter rejects. Files restored for the engine
+before any restoration; a missing adapter rejects. A store the key cannot open (a wrong key,
+damaged or tampered bytes) or whose payload is not a credential snapshot stays unchanged at
+`auth-store.sealed`. Both `prepare()` and `start()` reject with exported `AuthStoreUnreadableError`
+(`code: 'auth-store-unreadable'`, `reason: 'auth-failed' | 'invalid-snapshot'`). The kit reports
+`{ phase: 'failed', why: 'auth-store-unreadable' }`; show `stateWords(kit.state)`, not a sign-in prompt.
+Restore access to the original seal/key (and the original service/stateDir binding if the adapter uses
+one), then retry `start()` with that adapter. Do not generate/rotate a key to repair an unreadable store.
+If the bytes are damaged, stop all writers, acquire the host writer lock, and restore an authentic
+backup with its matching key before retrying. There is no automatic reset or overwrite.
+For stores kept aside by an older kit, restore the original `.unreadable-*` snapshot to
+`auth-store.sealed` only while stopped under that lock, preserving both it and any replacement as
+backups first; use the original seal. Without the matching key or an authentic backup the kit cannot
+recover the sign-in. Files restored for the engine
 have mode 0600 and directories 0700. File symlinks are sealed only when their fully resolved targets are
 regular files inside the isolated engine root; they restore as regular files at the link paths. Outside-root,
 dangling and directory symlinks (including loops), sockets, FIFOs and devices are skipped.
@@ -536,4 +566,4 @@ frozen (docs/runtime-kits.md §5).
 
 Apache-2.0. See [LICENSE](LICENSE); the bundled engine's MIT text is [engine/OPENCLAW-LICENSE](engine/OPENCLAW-LICENSE).
 
-Claude: `anthropic-cli` uses your own unmodified Claude Code login on this machine (provider `claude-cli`, plugin `anthropic`; subscription billing), with login kept in Claude Code under the kit’s isolated `HOME=<stateDir>/openclaw/home` and `CLAUDE_CONFIG_DIR=<stateDir>/openclaw/home/.claude`; sign in there with `claude auth login`, then call `signIn`. Activation live-tests the route; native sign-out is through Claude Code. `apiKey` is explicit API billing (“API key (billed per use)”, `offer: false`): `signIn` asks for the key through `paste`, then engine activation verifies it. The kit never imports Claude credentials or implements direct Claude.ai OAuth; [Anthropic’s terms](https://code.claude.com/docs/en/legal-and-compliance#authentication-and-credential-use) apply.
+Claude: `anthropic-cli` uses your own unmodified Claude Code login on this machine (provider `claude-cli`, plugin `anthropic`; subscription billing; `kit.signedIn(member, 'claude-cli')` is true once Claude Code is signed in, and `'anthropic'` stays the API-billed provider a Claude Code login never satisfies. Before 0.7.0 this route reported provider `anthropic`; that value is deprecated, kept as `deprecatedProvider` until 0.9.0), with login kept in Claude Code under the kit’s isolated `HOME=<stateDir>/openclaw/home` and `CLAUDE_CONFIG_DIR=<stateDir>/openclaw/home/.claude`; sign in there with `claude auth login`, then call `signIn`. Activation live-tests the route; native sign-out is through Claude Code. `apiKey` is explicit API billing (“API key (billed per use)”, `offer: false`): `signIn` asks for the key through `paste`, then engine activation verifies it. The `setup-token` choice is listed but never offered: the pinned Gateway has no app-guided sign-in for it. The kit never imports Claude credentials or implements direct Claude.ai OAuth; [Anthropic’s terms](https://code.claude.com/docs/en/legal-and-compliance#authentication-and-credential-use) apply.

package/SECURITY.md

@@ -28,7 +28,11 @@ resolve with `phase: 'locked'`, do not restore plaintext or launch the engine, a
 retries after unlock. Opt-in dual wrapping opens through an owner-only host key without prompting;
 its protection is only as strong as that file, which must stay outside sealed-store backups.
 Unlocked keyring-only snapshots upgrade atomically under the store's exclusive lock after verifying
-the replacement decrypts to identical contents. Other sealing failures still reject.
+the replacement decrypts to identical contents. A store the key cannot authenticate, or whose authentic
+payload is not a snapshot, is never restored, renamed, overwritten or deleted: it stays byte-identical
+at `auth-store.sealed`, blocking startup without plaintext fallback. No key rotation, reset or
+new sign-in is attempted as recovery. See [credential sealing and recovery](README.md#credential-sealing-and-threat-model)
+for the public error and host repair procedure. Other sealing failures still reject.
 
 ## Secrets at rest and in memory
 

package/dist/auth-status.d.ts

@@ -5,6 +5,7 @@ export type AuthStatus = {
         status?: unknown;
         profiles?: {
             status?: unknown;
+            expiresAt?: unknown;
         }[];
         usage?: unknown;
     })[];
@@ -15,3 +16,11 @@ export type AuthStatus = {
 /** Native Claude login stays in Claude Code. The pin's profile status does not include this synthetic auth;
  * setup detection asks the CLI itself, without handing credentials to the kit. */
 export declare function authStatus(request: GatewayTransport['request'], agentId: string, refresh?: boolean, native?: boolean): Promise<AuthStatus>;
+/** Admission snapshots, never credentials: per kit/agent/native route, at most 30s and never past reported expiry.
+ * Witness only app-owned file metadata (absence included); changed/unreadable state and auth/lifecycle mutations recheck.
+ * Remote revocation still comes from the real run's signed-out error (a local status read cannot prove it either).
+ */
+export declare function createAuthStatus(root: string, request: GatewayTransport['request']): {
+    read: (agentId: string, refresh?: boolean, native?: boolean, reuse?: boolean) => Promise<AuthStatus>;
+    invalidate: () => void;
+};

package/dist/auth-status.js

@@ -1,9 +1,13 @@
+import { statSync } from 'node:fs';
+import { join } from 'node:path';
+import { signedInProviders, USABLE } from "./runs.js";
 /** Native Claude login stays in Claude Code. The pin's profile status does not include this synthetic auth;
  * setup detection asks the CLI itself, without handing credentials to the kit. */
 export async function authStatus(request, agentId, refresh = false, native = false) {
     const status = await request('models.authStatus', { agentId, ...(refresh ? { refresh: true } : {}) }, { timeoutMs: 20_000 });
-    if (!native)
-        return status;
+    return native ? nativeStatus(request, agentId, status) : status;
+}
+async function nativeStatus(request, agentId, status) {
     const detected = await request('openclaw.setup.detect', { agentId }, { timeoutMs: 20_000 }).catch(() => ({}));
     const rows = (status.providers ?? []).filter((row) => (typeof row === 'string' ? row : row.provider) !== 'claude-cli');
     if (detected.candidates?.some((candidate) => candidate.kind === 'claude-cli' && candidate.credentials === true)) {
@@ -11,3 +15,63 @@ export async function authStatus(request, agentId, refresh = false, native = fal
     }
     return { ...status, providers: rows };
 }
+/** Admission snapshots, never credentials: per kit/agent/native route, at most 30s and never past reported expiry.
+ * Witness only app-owned file metadata (absence included); changed/unreadable state and auth/lifecycle mutations recheck.
+ * Remote revocation still comes from the real run's signed-out error (a local status read cannot prove it either).
+ */
+export function createAuthStatus(root, request) {
+    const snapshots = new Map();
+    let generation = 0;
+    const invalidate = () => { generation++; snapshots.clear(); };
+    const witness = (agentId) => {
+        try {
+            return ['openclaw.json', `state/agents/${agentId}/agent/auth-profiles.json`,
+                'state/auth-profiles.json', 'state/agents/main/agent/auth-profiles.json',
+                'home/.claude/.credentials.json', 'home/.claude/.claude.json', 'home/.claude/settings.json',
+                'home/.claude.json', 'home/.codex/auth.json'].map(path => {
+                try {
+                    const s = statSync(join(root, path), { bigint: true });
+                    return `${s.dev}:${s.ino}:${s.size}:${s.mtimeNs}:${s.ctimeNs}`;
+                }
+                catch (error) {
+                    if (error.code === 'ENOENT')
+                        return 'absent';
+                    throw error;
+                }
+            }).join('|');
+        }
+        catch {
+            return undefined;
+        } // unreadable witnesses never authorize reuse
+    };
+    const read = async (agentId, refresh = false, native = false, reuse = true) => {
+        const now = Date.now(), key = `${agentId}:${native}`, before = witness(agentId), epoch = generation;
+        for (const [key, snapshot] of snapshots)
+            if (snapshot.until <= now)
+                snapshots.delete(key);
+        const cached = snapshots.get(key);
+        if (reuse && !refresh && before !== undefined && cached?.witness === before && cached.until > now)
+            return cached.status;
+        snapshots.delete(key);
+        snapshots.delete(`${agentId}:false`);
+        const profiles = await authStatus(request, agentId, refresh);
+        const status = native ? await nativeStatus(request, agentId, profiles) : profiles;
+        if (before !== undefined && epoch === generation && witness(agentId) === before) {
+            for (const [route, answer] of (native ? [[false, profiles], [true, status]] : [[false, profiles]])) {
+                const usable = signedInProviders(answer);
+                if (!usable?.length || (route && !usable.includes('claude-cli')))
+                    continue;
+                let until = now + 30_000;
+                for (const row of answer.providers ?? [])
+                    if (typeof row !== 'string')
+                        for (const p of row.profiles ?? [])
+                            if (USABLE.has(String(p?.status)) && typeof p.expiresAt === 'number' && Number.isFinite(p.expiresAt))
+                                until = Math.min(until, p.expiresAt);
+                if (until > Date.now())
+                    snapshots.set(`${agentId}:${route}`, { status: answer, until, witness: before });
+            }
+        }
+        return status;
+    };
+    return { read, invalidate };
+}

package/dist/auth-store.d.ts

@@ -1,6 +1,12 @@
 import type { SealingAdapter } from '@byokit/secrets';
 /** True for the regenerable cache paths the collector never seals; tests assert these are all that stay at rest. */
 export declare function cached(name: string): boolean;
+/** Opening failed; the original snapshot stays in place for repair and retry. */
+export declare class AuthStoreUnreadableError extends Error {
+    readonly code = "auth-store-unreadable";
+    readonly reason: 'auth-failed' | 'invalid-snapshot';
+    constructor(reason: 'auth-failed' | 'invalid-snapshot');
+}
 export declare class AuthStore {
     private active;
     private owned;

package/dist/auth-store.js

@@ -88,6 +88,16 @@ function snapshot(text) {
             throw new Error('invalid sealed credential parent');
     return s;
 }
+/** Opening failed; the original snapshot stays in place for repair and retry. */
+export class AuthStoreUnreadableError extends Error {
+    code = 'auth-store-unreadable';
+    reason;
+    constructor(reason) {
+        super("Saved sign-in could not be opened; auth-store.sealed is unchanged. Restore the original seal/key access or a working backup with its matching key, then retry.");
+        this.name = 'AuthStoreUnreadableError';
+        this.reason = reason;
+    }
+}
 export class AuthStore {
     active = false;
     owned = false;
@@ -174,8 +184,22 @@ export class AuthStore {
         regular(this.file);
         const seal = this.o.seal;
         const bytes = readFileSync(this.file);
-        const text = seal.decryptString(bytes);
-        const saved = snapshot(text);
+        let text;
+        try {
+            text = seal.decryptString(bytes);
+        }
+        catch (error) {
+            if (error?.code !== 'auth-failed')
+                throw error;
+            throw new AuthStoreUnreadableError('auth-failed');
+        }
+        let saved;
+        try {
+            saved = snapshot(text);
+        }
+        catch {
+            throw new AuthStoreUnreadableError('invalid-snapshot');
+        }
         const upgraded = seal.upgrade?.(bytes);
         if (upgraded) {
             if (seal.decryptString(Buffer.from(upgraded)) !== text)
@@ -185,7 +209,7 @@ export class AuthStore {
         return saved;
     }
     collect() {
-        const s = { v: 2, dirs: [], files: [] };
+        const s = { v: 1, dirs: [], files: [] };
         const root = realpathSync(this.o.root);
         const walk = (path) => {
             const name = relative(this.o.root, path).split('\\').join('/');
@@ -272,7 +296,7 @@ export class AuthStore {
         put(this.file, sealed);
         if (this.o.seal.decryptString(readFileSync(this.file)) !== payload)
             throw new Error('credential seal verification failed');
-        if (previous?.v === 1)
+        if (previous?.dirs.some(cached))
             this.o.log?.('sealed credential store re-sealed: tool caches no longer sealed');
         put(this.cleanup, encoder.encode('1'));
         this.remove(saved);

package/dist/config.js

@@ -56,7 +56,10 @@ export function reconcileConfig(saved, o) {
     c.plugins.load ??= {};
     c.plugins.load.paths = [...new Set([...(c.plugins.load.paths ?? []).filter((p) => !p.includes('byokit-openclaw-bridge')), o.pluginDir])];
     c.plugins.allow = [...new Set([...(c.plugins.allow ?? []), o.pluginId,
-            ...routes().filter(route => route.offer && route.plugin).map(route => route.plugin)])];
+            // Every default-eligible bundled route, not only the ready ones: anthropic-cli waits on its binary and
+            // shares its plugin with the explicit apiKey route, so neither may depend on another route being offered.
+            ...routes().filter(route => route.offerPolicy === 'default' && !route.needs?.plugin && route.plugin)
+                .map(route => route.plugin)])];
     c.plugins.entries ??= {};
     c.plugins.entries[o.pluginId] = merge(c.plugins.entries[o.pluginId] ?? {}, { hooks: { timeouts: { before_tool_call: 200_000 } } });
     if (o.browser) {

package/dist/engine-status.d.ts

@@ -1,4 +1,4 @@
-import type { ChildProcess } from 'node:child_process';
+import { type ChildProcess } from 'node:child_process';
 /** Every process the kit itself spawned, held for shutdown by pid. */
 export declare class StartedProcesses {
     private readonly started;
@@ -16,4 +16,4 @@ export declare class EngineAlreadyRunningError extends Error {
     readonly code = "engine-already-running";
     constructor();
 }
-export declare function pidAlive(pid: number): boolean;
+export declare function pidAlive(pid: number, platform?: NodeJS.Platform): boolean;

package/dist/engine-status.js

@@ -1,4 +1,5 @@
 import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 /** Every process the kit itself spawned, held for shutdown by pid. */
 export class StartedProcesses {
     started = new Set();
@@ -38,20 +39,40 @@ export class EngineAlreadyRunningError extends Error {
         this.name = 'EngineAlreadyRunningError';
     }
 }
-export function pidAlive(pid) {
+export function pidAlive(pid, platform = process.platform) {
     if (!Number.isSafeInteger(pid) || pid < 1)
         return true; // An invalid guard is ambiguous, never stale.
     try {
         process.kill(pid, 0);
         // An orphan can remain a zombie until its new parent reaps it; it has no writer left.
-        if (process.platform === 'linux') {
+        if (platform === 'linux') {
             const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
             if (stat.slice(stat.lastIndexOf(')') + 2).startsWith('Z '))
                 return false;
         }
+        else if (platform !== 'win32' && psReportsZombie(pid)) {
+            // No /proc here (notably macOS): only a definite zombie reads as stale.
+            return false;
+        }
         return true;
     }
     catch (error) {
         return error.code !== 'ESRCH';
     }
 }
+/**
+ * Why ps: `ps -o stat=` exists on macOS and Linux with the same leading-letter state
+ * convention, so a `Z` first letter names the same kernel fact the /proc read names on
+ * Linux. Linux keeps its /proc read (no subprocess, unchanged answers); every other Unix
+ * asks ps. Only positive `Z` evidence flips the answer — a missing ps, an empty reply,
+ * or gibberish keeps the guard, so a reused live pid is never stolen.
+ */
+function psReportsZombie(pid) {
+    try {
+        const probed = spawnSync('ps', ['-o', 'stat=', '-p', String(pid)], { encoding: 'utf8', timeout: 5000 });
+        return (probed.stdout ?? '').trimStart().startsWith('Z');
+    }
+    catch {
+        return false;
+    }
+}

package/dist/engine.d.ts

@@ -1,3 +1,4 @@
+import { AuthStore } from './auth-store.ts';
 import type { KitOptions } from './kit.ts';
 import type { KitState, ToolSpec } from './types.ts';
 export type EngineOptions = Pick<KitOptions, 'stateDir' | 'engineDir' | 'npmPath' | 'enginePath' | 'config' | 'appOwnedSessions' | 'installPolicy' | 'log' | 'bridge' | 'authSeal'> & {
@@ -24,7 +25,7 @@ export declare class Engine {
     private child?;
     private readonly started;
     private starting?;
-    private readonly authStore;
+    readonly authStore: AuthStore;
     private stopping;
     private credentialsLocked;
     private repaired;

package/dist/engine.js

@@ -5,7 +5,7 @@ import { createServer } from 'node:net';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
-import { AuthStore } from "./auth-store.js";
+import { AuthStore, AuthStoreUnreadableError } from "./auth-store.js";
 import { EngineAlreadyRunningError, pidAlive, StartedProcesses } from "./engine-status.js";
 import { EnginePatchError, atomic, prepareEngineSet, processStartTime, readPatchSet, verifyEngineSet } from "./engine-patches.js";
 import { ENGINE_VERSION } from "./constants.js";
@@ -102,6 +102,8 @@ export class Engine {
                 this.patchSet = null;
                 this.state('failed', 'engine-patch');
             }
+            if (error instanceof AuthStoreUnreadableError)
+                this.state('failed', 'auth-store-unreadable');
             throw error;
         });
         this.prepared = pending;
@@ -293,6 +295,8 @@ export class Engine {
         catch (error) {
             if (this.locked(error))
                 return undefined;
+            if (error instanceof AuthStoreUnreadableError)
+                this.state('failed', 'auth-store-unreadable');
             throw error;
         }
         try {

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export type { RouteFacts, RouteView } from './routes.ts';
 export { OpenClawKit, type KitOptions, type RetainedLogin } from './kit.ts';
 export type { AddKeyResult } from './keys.ts';
 export { stateWords, toAccountView, words, type AccountView, type WordKey } from './words.ts';
+export { AuthStoreUnreadableError } from './auth-store.ts';
 export { EngineAlreadyRunningError } from './engine-status.ts';
 export { readAgentDayUsage } from './day-usage.ts';
 export type { AgentDayUsage, DayUsageClient, EngineStartedCharge, EngineStartedKind } from './day-usage.ts';

package/dist/index.js

@@ -3,6 +3,7 @@
 export { ENGINE_VERSION, OPERATOR_SCOPES, PROTOCOL_VERSION } from "./constants.js";
 export { OpenClawKit } from "./kit.js";
 export { stateWords, toAccountView, words } from "./words.js";
+export { AuthStoreUnreadableError } from "./auth-store.js";
 export { EngineAlreadyRunningError } from "./engine-status.js";
 export { readAgentDayUsage } from "./day-usage.js";
 export { readAgentUsage, agentUsageOf } from "./usage.js";

package/dist/kit.d.ts

@@ -55,6 +55,7 @@ export declare class OpenClawKit {
     private members?;
     private readonly bridge;
     private readonly keys;
+    private readonly admission;
     private readonly approvalsCtl;
     private listeners;
     private off;
@@ -99,6 +100,7 @@ export declare class OpenClawKit {
     }>;
     private signInCtx;
     routes(): RouteView[];
+    providerStatus(member: Member): Promise<string[] | undefined>;
     providers(member: Member): Promise<string[]>;
     signedIn(member: Member, provider: string): Promise<boolean>;
     signIn(member: Member, o: SignInOptions, on: (v: SignInView) => void): {

package/dist/kit.js

@@ -11,11 +11,12 @@ import { gatewayTransport } from "./transport.js";
 import { createMembers } from "./members.js";
 import { keyAgentId, KEY_PREFIX, MEMBER_ID } from "./members.js";
 import { confirmRetainedLogin as confirmLogin, migrateRetainedLogin as migrateLogin } from "./migrate.js";
-import { createRuns } from "./runs.js";
+import { createRuns, signedInProviders } from "./runs.js";
+import { createAuthStatus } from "./auth-status.js";
 import { outputSchema } from "./output.js";
 import { createKeys } from "./keys.js";
 import { routes as routeTable } from "./routes.js";
-import { providers as engineProviders, signIn as startSignIn, signOut as engineSignOut } from "./signin.js";
+import { signIn as startSignIn, signOut as engineSignOut } from "./signin.js";
 import { reconcileConfig, browserToolPolicySafe, browserProfileAcknowledged, browserSessionMayRun, memoryLimited as configMemoryLimited, configKeyPath, readConfigKey, writeConfigKey } from "./config.js";
 import { createBrowserHost } from "./browser/host.js";
 import { fileSignInStore } from "./browser/store.js";
@@ -428,6 +429,7 @@ export class OpenClawKit {
     // Only the socket itself is per-connection. Approvals always reaches the live transport through this.request().
     bridge;
     keys;
+    admission;
     approvalsCtl;
     listeners = new Set();
     off = [];
@@ -644,6 +646,7 @@ export class OpenClawKit {
             ...(o.browser ? { browserConfig: () => this.browserConfig() } : {}),
             gateBuiltins: o.gateBuiltins !== false, spawnEngine: o.spawnEngine !== false,
             onState: (s) => this.setState(s), onExit: () => this.closed('engine exited') });
+        this.admission = createAuthStatus(this.engine.root, (method, params, options) => this.request()(method, params, options));
         this.keys = createKeys({ root: this.engine.root,
             restarting: () => this.current.phase === 'restarting' || this.current.phase === 'starting',
             request: (method, params, options) => this.request()(method, params, options),
@@ -684,6 +687,8 @@ export class OpenClawKit {
         slot.bridge = this.bridge;
     }
     setState(s) {
+        if (s.phase !== 'ready')
+            this.admission?.invalidate();
         this.current = { ...s, ...(this.engine.patchSet !== undefined ? { patchSet: this.engine.patchSet } : {}) };
         this.o.onState?.(this.current);
     }
@@ -753,6 +758,10 @@ export class OpenClawKit {
                 this.setState({ phase: 'failed', why: 'engine-already-running' });
                 throw error;
             }
+            if (error instanceof Error && 'code' in error && error.code === 'auth-store-unreadable') {
+                this.setState({ phase: 'failed', why: 'auth-store-unreadable' });
+                throw error;
+            }
             if (patchFailure) {
                 this.setState({ phase: 'failed', why: 'engine-patch' });
                 throw error;
@@ -765,6 +774,7 @@ export class OpenClawKit {
         }
     }
     async disconnect() {
+        this.admission.invalidate();
         this.off.splice(0).forEach((fn) => fn());
         const transport = this.transport;
         this.transport = undefined;
@@ -812,7 +822,14 @@ export class OpenClawKit {
     request() {
         if (!this.transport || this.current.phase !== 'ready')
             throw new Error('gateway not ready');
-        return this.transport.request.bind(this.transport);
+        const transport = this.transport;
+        return (method, params, options) => {
+            const changesAuth = /^(models\.authLogout|openclaw\.setup\.(auth\.start|activate)|wizard\.(next|cancel)|config\.(apply|patch|set)|agents\.(create|update|delete)|secrets\.(reload|store\.(set|delete))|byokit\.keys)$/.test(method);
+            if (!changesAuth || (method === 'byokit.keys' && params?.action === 'ready'))
+                return transport.request(method, params, options);
+            this.admission.invalidate();
+            return Promise.resolve().then(() => transport.request(method, params, options)).finally(() => this.admission.invalidate());
+        };
     }
     call(method, params, o) {
         if (this.o.browser && /^(config\.(apply|patch|set)|agents\.(create|update|delete)|plugins\.(install|uninstall|setEnabled|refresh))$/.test(method))
@@ -869,17 +886,23 @@ export class OpenClawKit {
     // sign-in (5.7): every body here is the module's, with this kit's transport, members and ports.
     signInCtx() {
         return { request: (method, params, o) => this.request()(method, params, o),
+            // Public readiness/sign-in reads stay live; their fresh result can prepare the next run's admission.
+            authStatus: (agentId, refresh, native) => this.admission.read(agentId, refresh, native, false),
             ensure: (member) => this.ensureMember(member), callbackPort: this.o.callbackPort ?? 1455,
             onDisconnect: (fn) => { this.signInDisconnects.add(fn); return () => { this.signInDisconnects.delete(fn); }; } };
     }
     routes() {
         return routeTable();
     }
+    async providerStatus(member) {
+        const { agentId } = await this.ensureMember(member);
+        return signedInProviders(await this.admission.read(agentId, false, true, false));
+    }
     providers(member) {
-        return engineProviders(this.signInCtx(), member);
+        return this.providerStatus(member).then((names) => names ?? []);
     }
     signedIn(member, provider) {
-        return engineProviders(this.signInCtx(), member).then((names) => names.includes(provider)).catch(() => false);
+        return this.providers(member).then((names) => names.includes(provider)).catch(() => false);
     }
     signIn(member, o, on) {
         return startSignIn(this.signInCtx(), member, o, on);
@@ -903,6 +926,8 @@ export class OpenClawKit {
     runs() {
         return createRuns({
             request: (method, params, o) => this.request()(method, params, o),
+            authStatus: this.admission.read,
+            invalidateAuth: this.admission.invalidate,
             onEvent: (fn) => {
                 this.listeners.add(fn);
                 return () => {
@@ -960,7 +985,7 @@ export class OpenClawKit {
     steer(sessionKey, text, o) {
         return this.runs().steer(this.runKey(sessionKey, o), text);
     }
-    abort(sessionKey, o) {
+    async abort(sessionKey, o) {
         return this.runs().abort(this.runKey(sessionKey, o));
     }
     // approvals (5.9)

package/dist/link.d.ts

@@ -1,7 +1,7 @@
 import type { BrowserHost } from './browser.ts';
 import { type IncomingMessage, type ServerResponse } from 'node:http';
 import { type Grant, type Host, type HostOptions } from '@byokit/link';
-import { type ServeIngress, type Via } from '@byokit/reach';
+import { type ServeIngress, type Via } from '@byokit/discover';
 import type { PushAction, RelayClient } from '@byokit/relay';
 import type { OpenClawKit } from './kit.ts';
 import type { Member } from './types.ts';
@@ -9,7 +9,7 @@ import type { Member } from './types.ts';
 export type OpenClawLinkOptions = {
     memberOf: (grant: Grant) => Member | undefined;
     passThrough?: (method: string, grant: Grant) => boolean;
-    relay?: RelayClient;
+    relay?: Pick<RelayClient, 'notify'>;
 };
 /** What `openclawLink` hands the link host: its request/stream handlers plus the kit's push entry point. */
 export type OpenClawLinkHost = Pick<HostOptions, 'handle' | 'stream' | 'allow' | 'onGrantRemoved'> & {

package/dist/link.js

@@ -6,13 +6,11 @@ import { readFileSync } from 'node:fs';
 import { createServer } from 'node:http';
 import { WebSocketServer } from 'ws';
 import { PublicLinkError, } from '@byokit/link';
-import { reach } from '@byokit/reach';
+import { reach } from '@byokit/discover';
 import { ENGINE_VERSION } from "./constants.js";
 import { b64urlDecode, b64urlEncode, sealNotice } from "./notices.js";
 import { routeFor } from "./routes.js";
-import { authStatus } from "./auth-status.js";
 import { outputSchema } from "./output.js";
-import { signedInProviders } from "./runs.js";
 import { stateWords, words } from "./words.js";
 const VIEW_OPS = new Set(['oc.state', 'oc.routes', 'oc.signin.view', 'oc.sessions', 'oc.approvals', 'oc.events',
     'oc.browser.state', 'oc.browser.signins', 'oc.browser.thumb']);
@@ -228,20 +226,6 @@ export function openclawLink(kit, o) {
         return null;
     };
     const endReason = (error) => error instanceof PublicLinkError ? error.message.slice(0, 200) : 'failed';
-    const signIns = async (member) => {
-        try {
-            const { agentId } = await kit.ensureMember(member);
-            const status = await authStatus((method, params, options) => {
-                if (method === 'models.authStatus')
-                    return kit.call(method, params, options);
-                return kit.call('openclaw.setup.detect', params, options);
-            }, agentId, false, true);
-            return signedInProviders(status);
-        }
-        catch {
-            return undefined;
-        }
-    };
     const handle = async (req, grant) => {
         const member = memberOf(grant);
         if (grant.role === 'view' && !VIEW_OPS.has(req.op))
@@ -314,7 +298,7 @@ export function openclawLink(kit, o) {
             case 'oc.state': {
                 // signedIn: the providers the device member is usably signed in to (an expired or unfinished sign-in is not),
                 // only while the engine can say: absent is unknown, never "none".
-                const signedIn = kit.state.phase === 'ready' ? await signIns(member) : undefined;
+                const signedIn = kit.state.phase === 'ready' ? await kit.providerStatus(member).catch(() => undefined) : undefined;
                 return { state: kit.state, words: stateWords(kit.state), version: KIT_VERSION, engine: ENGINE_VERSION,
                     ...(signedIn ? { signedIn } : {}) };
             }

package/dist/members.js

@@ -2,8 +2,13 @@ import { join } from 'node:path';
 export const MEMBER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 export const KEY_PREFIX = 'byokit-key-';
 export const keyAgentId = (member) => `${KEY_PREFIX}${member}`;
+// The engine answers agents.create before its roster hot-reload applies (up to ~113 ms observed), so a turn sent
+// at once fails as 'unknown agent id'. ensure resolves only once agents.list shows the member.
+const VISIBLE_TIMEOUT_MS = 5_000;
+const VISIBLE_POLL_MS = 25;
 export function createMembers(ctx) {
     const cache = new Map();
+    const listed = (member) => ctx.request('agents.list').then((list) => list.agents.some((agent) => agent.id === member));
     return { ensure(member) {
             if (!MEMBER_ID.test(member) || member.startsWith(KEY_PREFIX))
                 return Promise.reject(new Error(`invalid member id: ${member}`));
@@ -12,9 +17,15 @@ export function createMembers(ctx) {
                 return existing;
             const workspace = join(ctx.root, 'workspaces', member);
             const result = (async () => {
-                const list = await ctx.request('agents.list');
-                if (!list.agents.some((agent) => agent.id === member))
+                if (!await listed(member)) {
                     await ctx.request('agents.create', { name: member, workspace });
+                    const deadline = Date.now() + VISIBLE_TIMEOUT_MS;
+                    while (!await listed(member)) {
+                        if (Date.now() >= deadline)
+                            throw new Error(`agent ${member} is not listed by agents.list after agents.create`);
+                        await new Promise((resolve) => setTimeout(resolve, VISIBLE_POLL_MS));
+                    }
+                }
                 return { agentId: member, workspace };
             })();
             cache.set(member, result);

package/dist/routes.json

@@ -122,7 +122,7 @@
     },
     {
         "choice": "anthropic-cli",
-        "provider": "anthropic",
+        "provider": "claude-cli",
         "plugin": "anthropic",
         "billing": "subscription",
         "via": "cli",
@@ -134,6 +134,7 @@
             "provider": "claude-cli",
             "via": "browser"
         },
+        "deprecatedProvider": "anthropic",
         "reason": "Anthropic Claude CLI: subscription sign-in.",
         "source": "extensions/anthropic/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
@@ -173,13 +174,9 @@
         "via": "setup_token",
         "auth": "token",
         "prerequisite": null,
-        "offer": true,
-        "offerPolicy": "default",
-        "legacy": {
-            "provider": "anthropic",
-            "via": "browser"
-        },
-        "reason": "Anthropic setup-token: subscription sign-in.",
+        "offer": false,
+        "offerPolicy": "explicit",
+        "reason": "The pinned Gateway has no app-guided sign-in for this choice.",
         "source": "extensions/anthropic/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -201,7 +198,7 @@
             "id": "anthropic",
             "method": "setup-token",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {

package/dist/runs.d.ts

@@ -1,6 +1,8 @@
 import type { Bridge } from './bridge.ts';
+import { authStatus } from './auth-status.ts';
 import { outputSchema, type OutputSchema, type SchemaOutput } from './output.ts';
 import type { GatewayTransport, Member, RunEnd, RunEvent, RunSpec } from './types.ts';
+export declare const USABLE: Set<string>;
 /**
  * The providers a `models.authStatus` answer shows usable (the rule a picked account is checked by), lowercased and
  * unique; undefined while the engine has no prepared status (unknown, not none).
@@ -8,6 +10,8 @@ import type { GatewayTransport, Member, RunEnd, RunEvent, RunSpec } from './type
 export declare function signedInProviders(status: unknown): string[] | undefined;
 export declare function createRuns(ctx: {
     request: GatewayTransport['request'];
+    authStatus?: (agentId: string, refresh: boolean, native: boolean) => ReturnType<typeof authStatus>;
+    invalidateAuth?: () => void;
     onEvent: GatewayTransport['onEvent'];
     ensure(member: Member): Promise<{
         agentId: string;

package/dist/runs.js

@@ -11,7 +11,7 @@ const WAIT_CLIENT_MS = 3_610_000;
 // The `agent` request's final frame lands with the run's end; a run already over waits no longer than this for it.
 const FINAL_GRACE_MS = 5_000;
 const STATUS_MS = 5_000;
-const USABLE = new Set(['ok', 'expiring', 'static']);
+export const USABLE = new Set(['ok', 'expiring', 'static']);
 const usable = (row) => typeof row === 'string'
     || (Array.isArray(row.profiles) && row.profiles.length > 0 ? row.profiles.some((p) => USABLE.has(String(p?.status)))
         : row.status === undefined || USABLE.has(String(row.status)));
@@ -80,6 +80,12 @@ export function createRuns(ctx) {
             return undefined;
         }
     };
+    const failure = (message) => {
+        const classified = classify(message);
+        if (classified.kind === 'signed-out')
+            ctx.invalidateAuth?.();
+        return { ok: false, ...classified, message };
+    };
     const run = async (spec, on, keyAgent, preparedOutput) => {
         // Member boundary first: a member never speaks in another member's session, refused before any request.
         if (!spec.sessionKey.startsWith(`agent:${spec.member}:`))
@@ -112,7 +118,10 @@ export function createRuns(ctx) {
             if (p.stream === 'lifecycle' && p.data?.phase === 'end'
                 && p.data.aborted === true)
                 abortedByEngine = true;
-            if (p.stream === 'assistant' && typeof p.data?.text === 'string') {
+            if (p.stream === 'thinking' && count(p.data?.progressTokens)) {
+                on?.({ type: 'thinking', tokens: p.data.progressTokens });
+            }
+            else if (p.stream === 'assistant' && typeof p.data?.text === 'string') {
                 last = p.data.text;
                 on?.({ type: 'text', text: p.data.text });
             }
@@ -135,7 +144,8 @@ export function createRuns(ctx) {
                 // The picked account must be the one called: check it is signed in for this member before the run, since
                 // the engine would otherwise fail the run only after admitting it. An explicit provider/model is strict on
                 // the pinned engine (never another provider or model), so this check plus the override is the guarantee.
-                const status = (refresh) => authStatus(ctx.request, agentId, refresh, picked.provider === 'claude-cli');
+                const status = (refresh) => ctx.authStatus ? ctx.authStatus(agentId, refresh, picked.provider === 'claude-cli')
+                    : authStatus(ctx.request, agentId, refresh, picked.provider === 'claude-cli');
                 let auth = await status(false);
                 if (auth.unavailable)
                     auth = await status(true); // no prepared snapshot yet: build it once
@@ -151,8 +161,12 @@ export function createRuns(ctx) {
             const ack = new Promise((resolve) => { accepted = resolve; });
             // The run id is taken as the accepted frame lands, so no event read after it is missed.
             const onAccepted = (payload) => {
-                if (isRecord(payload) && typeof payload.runId === 'string')
+                if (isRecord(payload) && typeof payload.runId === 'string') {
+                    const first = !runId;
                     runId = payload.runId;
+                    if (first && payload.status === 'accepted')
+                        on?.({ type: 'started' });
+                }
                 accepted(payload);
             };
             const final = ctx.request('agent', {
@@ -199,11 +213,11 @@ export function createRuns(ctx) {
                 return { ok: false, aborted: true };
             const message = typeof result.error === 'string' ? result.error
                 : typeof result.message === 'string' ? result.message : '';
-            return { ok: false, ...classify(message), message };
+            return failure(message);
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            return { ok: false, ...classify(message), message };
+            return failure(message);
         }
         finally {
             ended = true;
@@ -214,6 +228,6 @@ export function createRuns(ctx) {
     return {
         run,
         steer: (k, t) => ctx.request('sessions.steer', { sessionKey: k, message: t }),
-        abort: (k) => ctx.request('chat.abort', { sessionKey: k }),
+        abort: async (k) => { await ctx.request('chat.abort', { sessionKey: k }); },
     };
 }

package/dist/signin.d.ts

@@ -1,6 +1,8 @@
+import { authStatus } from './auth-status.ts';
 import type { GatewayTransport, Member, SignInOptions, SignInView } from './types.ts';
 export type SignInCtx = {
     request: GatewayTransport['request'];
+    authStatus?: (agentId: string, refresh: boolean, native: boolean) => ReturnType<typeof authStatus>;
     ensure(member: Member): Promise<{
         agentId: string;
     }>;

package/dist/signin.js

@@ -15,6 +15,19 @@ const CANCEL_MS = 10_000;
 const RECONFIRM_MS = 60_000;
 const TURNS = 200;
 const PASTE_MS = 15 * 60_000;
+// Two of the pin's code routes print their code only into a note's text ("Code: X" with
+// "Code expires in N minutes", or "enter the code X." with "Expires at: <ISO>"), never as `deviceCode`.
+// Read it back so every code route reaches the caller in the one structured shape.
+const noteCode = (step) => {
+    const text = step.type === 'note' ? step.message ?? '' : '';
+    const code = /^Code: (\S+)$/m.exec(text)?.[1] ?? /enter the code (\S+?)\.?$/m.exec(text)?.[1];
+    if (!code)
+        return undefined;
+    const minutes = /Code expires in (\d+) minutes/.exec(text)?.[1];
+    const at = Date.parse(/Expires at: (\S+)/.exec(text)?.[1] ?? '');
+    return { code, message: text, ...(minutes ? { expiresInMinutes: Number(minutes) }
+            : Number.isFinite(at) ? { expires_in: Math.max(0, Math.floor((at - Date.now()) / 1_000)) } : {}) };
+};
 const cut = (value) => (value instanceof Error ? value.message : String(value)).slice(0, 200);
 const pullOptions = (signal) => ({ timeoutMs: PULL_MS, signal });
 /**
@@ -268,19 +281,22 @@ export function signIn(ctx, member, o, on) {
             step = undefined;
             if (current.type === 'text' && current.sensitive)
                 sensitive = true;
-            if (current.deviceCode && current.type !== 'text') {
+            const deviceCode = current.type === 'text' ? undefined : current.deviceCode ?? noteCode(current);
+            if (deviceCode) {
                 stopApproval();
                 approval = true;
                 sawDeviceCode = true;
                 // The pin converts its provider duration to minutes. Prefer exact seconds if the engine supplies them.
-                const duration = current.deviceCode.expires_in !== undefined
-                    ? Number(current.deviceCode.expires_in) * 1_000
-                    : Number(current.deviceCode.expiresInMinutes) * 60_000;
-                if (Number.isFinite(duration) && duration >= 0) {
+                const duration = deviceCode.expires_in !== undefined
+                    ? Number(deviceCode.expires_in) * 1_000
+                    : Number(deviceCode.expiresInMinutes) * 60_000;
+                const timed = Number.isFinite(duration) && duration >= 0;
+                if (timed)
                     codeTimer = setTimeout(() => { codeExpired = true; owner.abort(); }, duration);
-                }
+                const message = deviceCode.message ?? current.message;
                 // The code is on the card; acknowledging it lets the engine poll the provider itself.
-                say({ ...(current.deviceCode.code ? { code: current.deviceCode.code } : {}), ...(current.externalUrl ? { url: current.externalUrl } : {}) });
+                say({ ...(deviceCode.code ? { code: deviceCode.code } : {}), ...(current.externalUrl ? { url: current.externalUrl } : {}),
+                    ...(timed ? { expiresAt: Date.now() + duration } : {}), ...(message ? { message } : {}) });
                 const next = await answer(current);
                 if (next.done) {
                     terminal = next;
@@ -292,8 +308,9 @@ export function signIn(ctx, member, o, on) {
             if (current.type !== 'progress')
                 stopApproval();
             if (current.type === 'text') {
-                if (current.sensitive)
-                    say({ prompt: 'Sign-in token' });
+                // Every text step is a question the person must answer, so it is always asked. A non-sensitive one is not a
+                // secret by the engine's own flag: its question is shown as written. Once anything is sensitive, only the fixed label is.
+                say({ prompt: sensitive ? 'Sign-in token' : current.message || 'Paste what the sign-in page gave you' });
                 const value = await waitForPaste();
                 if (value === undefined)
                     return signal.aborted ? cancelled() : expired();
@@ -413,7 +430,8 @@ export function signIn(ctx, member, o, on) {
 /** Usable provider profiles plus native Claude Code readiness reported by the engine. */
 export async function providers(ctx, member, refresh) {
     const { agentId } = await ctx.ensure(member);
-    return signedInProviders(await authStatus(ctx.request, agentId, refresh, true)) ?? [];
+    return signedInProviders(await (ctx.authStatus ? ctx.authStatus(agentId, refresh ?? false, true)
+        : authStatus(ctx.request, agentId, refresh, true))) ?? [];
 }
 export async function signOut(ctx, member, provider) {
     const { agentId } = await ctx.ensure(member);

package/dist/testing/contract.js

@@ -65,6 +65,19 @@ export function openclawContract(make, o) {
             await kit.stop();
         }
     });
+    test('contract: a turn sent right after ensureMember is not an unknown agent', async () => {
+        const { kit } = await make();
+        try {
+            // The roster applies a beat after agents.create answers (engine hot-reload); ensureMember must wait
+            // until agents.list shows the member, so the first turn is not rejected as 'unknown agent id'.
+            await kit.ensureMember('m1');
+            const end = await kit.run({ member: 'm1', sessionKey: 'agent:m1:contract:6', message: 'hello fresh member' });
+            assert.ok(end.ok, JSON.stringify(end));
+        }
+        finally {
+            await kit.stop();
+        }
+    });
     test('contract: a member cannot run in another member\'s session', async () => {
         const { kit } = await make();
         try {

package/dist/testing/fake-gateway.d.ts

@@ -23,4 +23,6 @@ export type FakeGateway = {
 } & {
     transport: GatewayTransport;
 };
-export declare function fakeGateway(script?: FakeScript): FakeGateway;
+export declare function fakeGateway(script?: FakeScript, o?: {
+    rosterApplyMs?: number;
+}): FakeGateway;

package/dist/testing/fake-gateway.js

@@ -94,7 +94,7 @@ function bridgeRequest(path, message) {
         });
     });
 }
-export function fakeGateway(script) {
+export function fakeGateway(script, o) {
     const calls = [];
     const failures = new Map();
     const handlers = new Map();
@@ -212,8 +212,15 @@ export function fakeGateway(script) {
             agents: [...agents.values()].map((agent) => ({ id: agent.id })),
         }),
         'agents.create': (p) => {
-            ensureAgent(String(p.name), p.workspace ? String(p.workspace) : undefined);
-            return { id: String(p.name) };
+            const id = String(p.name);
+            const workspace = p.workspace ? String(p.workspace) : undefined;
+            // With rosterApplyMs the fake mirrors the pinned engine: create answers before the roster hot-reload
+            // makes the agent visible to agents.list (Crewhouse saw ~113 ms).
+            if (o?.rosterApplyMs)
+                setTimeout(() => ensureAgent(id, workspace), o.rosterApplyMs);
+            else
+                ensureAgent(id, workspace);
+            return { id };
         },
         'models.authStatus': (p) => ({
             providers: (agents.get(String(p?.agentId ?? 'main'))?.providers ?? []).map((provider) => ({ provider })),

package/dist/types.d.ts

@@ -47,6 +47,11 @@ export interface RunSpec<S extends OutputSchema | undefined = OutputSchema | und
     register?: boolean;
 }
 export type RunEvent = {
+    type: 'started';
+} | {
+    type: 'thinking';
+    tokens: number;
+} | {
     type: 'text';
     text: string;
 } | {
@@ -103,6 +108,8 @@ export type SignInView = {
     via: 'browser' | 'code';
     url?: string;
     code?: string;
+    expiresAt?: number;
+    message?: string;
     prompt?: string;
     error?: string;
     why?: 'busy' | 'declined' | 'expired' | 'failed';
@@ -125,7 +132,7 @@ export type Decision = {
 };
 export type KitState = {
     phase: 'stopped' | 'installing' | 'starting' | 'repairing' | 'ready' | 'restarting' | 'failed' | 'needs-update' | 'locked';
-    why?: 'install' | 'handshake' | 'exited' | 'port' | 'version' | 'engine-already-running' | 'engine-patch';
+    why?: 'install' | 'handshake' | 'exited' | 'port' | 'version' | 'engine-already-running' | 'engine-patch' | 'sign-in-reset' | 'auth-store-unreadable';
     retryAt?: number;
     patchSet?: string | null;
 };
@@ -157,6 +164,10 @@ export type Route = {
         provider: string;
         via: 'browser' | 'code';
     };
+    /** @deprecated This route's `provider` before 0.7.0 (`anthropic` on `anthropic-cli`); use `provider` (`claude-cli`).
+     * Discovery data only, never a sign-in or `signedIn` id. Removed in 0.9.0, when that route's id becomes
+     * `claude-cli:cli:anthropic-cli`. */
+    deprecatedProvider?: string;
     billingFrom?: 'source' | 'host';
     group?: 'models' | 'services';
     platforms?: {

package/dist/words.js

@@ -21,6 +21,10 @@ export function stateWords(s) {
     // 'stopped' is never on screen (4.3 covers what a person can see), so 5.14 has no row for it.
     if (s.phase === 'failed' && s.why === 'engine-already-running')
         return words('engine.alreadyRunning');
+    if (s.why === 'auth-store-unreadable')
+        return words('engine.authStoreUnreadable');
+    if (s.why === 'sign-in-reset')
+        return words('engine.signInAgain');
     return s.phase === 'stopped' ? '' : words(PHASE_WORDS[s.phase]);
 }
 export function toAccountView(view, ready) {

package/dist/words.json

@@ -3,6 +3,8 @@
     "engine.starting": "Starting up…",
     "engine.repairing": "Fixing a small problem with the setup. This takes a moment.",
     "engine.locked": "Your saved sign-in is locked. Unlock your password storage, then try again.",
+    "engine.authStoreUnreadable": "Your saved sign-in couldn't be opened. It is unchanged. Restore its original key or a working backup, then retry.",
+    "engine.signInAgain": "Your saved sign-in couldn't be opened, so it was kept aside. Sign in again.",
     "engine.ready": "Ready.",
     "engine.restarting": "Something stopped. Starting it again by itself.",
     "engine.alreadyRunning": "Your saved sign-in is in use. Try again after the other session stops.",

package/engine/patches.json

@@ -1,6 +1,6 @@
 {
   "v": 1,
-  "id": "171ce088cd516dcf",
+  "id": "ee8913bf172b63b2",
   "upstream": {
     "name": "openclaw",
     "version": "2026.8.1",
@@ -54,6 +54,17 @@
           "replace": "// BYOKit: caller-owned task prefixes never acquire automatic restart recovery ownership.\nconst byokitAppOwnedSessionPrefixes = (() => {\n\ttry {\n\t\tconst prefixes = JSON.parse(process.env.BYOKIT_APP_OWNED_SESSION_PREFIXES ?? \"[]\");\n\t\treturn Array.isArray(prefixes) && prefixes.every((prefix) => {\n\t\t\tconst agent = typeof prefix === \"string\" && /^agent:([a-z0-9-]+):/.exec(prefix);\n\t\t\treturn agent && !`agent:${agent[1]}:main`.startsWith(prefix);\n\t\t}) ? prefixes : [];\n\t} catch { return []; }\n})();\nfunction isMainRestartRecoveryCandidate(entry, sessionKey) {\n\tif (byokitAppOwnedSessionPrefixes.some((prefix) => sessionKey.startsWith(prefix))) return false;"
         }
       ]
+    },
+    {
+      "path": "dist/prepare.runtime-y2eXKhY3.js",
+      "before": "001ebad506ae9550984e3256eb1a632daa2e3ad2b6e76e2ff903979eed3d04fc",
+      "after": "f9955de9dbdc30a6675802e940015ad77db3016e84c22a7e282cc5ed4ee350f8",
+      "edits": [
+        {
+          "find": "let systemPrompt = !skipsTurnPreparation ? backendResolved.transformSystemPrompt?.({\n\t\t\tconfig: params.config,\n\t\t\tworkspaceDir,\n\t\t\tprovider: params.provider,\n\t\t\tmodelId,\n\t\t\tmodelDisplay,\n\t\t\tagentId: sessionAgentId,\n\t\t\tsystemPrompt: builtSystemPrompt\n\t\t}) ?? builtSystemPrompt : builtSystemPrompt;\n",
+          "replace": "let systemPrompt = !skipsTurnPreparation ? backendResolved.transformSystemPrompt?.({\n\t\t\tconfig: params.config,\n\t\t\tworkspaceDir,\n\t\t\tprovider: params.provider,\n\t\t\tmodelId,\n\t\t\tmodelDisplay,\n\t\t\tagentId: sessionAgentId,\n\t\t\tsystemPrompt: builtSystemPrompt\n\t\t}) ?? builtSystemPrompt : builtSystemPrompt;\n\t\t// BYOKit: Claude wire names for the Tooling list (ch-cli-tool-prefix). The Claude wire catalog\n\t\t// exposes OpenClaw tools as mcp__openclaw__<name>, so the printed Tooling list on that route must\n\t\t// use those exact names. Every other route keeps the stock prompt byte-identical; already-prefixed\n\t\t// names are never prefixed again. Order, summaries and error semantics are unchanged.\n\t\tif (!skipsTurnPreparation && isClaudeCli && promptTools.length > 0) {\n\t\t\tconst byokitBareNames = new Set(promptTools.map((tool) => tool?.name).filter((name) => typeof name === \"string\" && name.length > 0 && !name.startsWith(\"mcp__openclaw__\")));\n\t\t\tif (byokitBareNames.size > 0) {\n\t\t\t\tconst byokitLines = systemPrompt.split(\"\\n\");\n\t\t\t\tlet byokitInTooling = false;\n\t\t\t\tlet byokitToolingArmed = false;\n\t\t\t\tfor (let byokitI = 0; byokitI < byokitLines.length; byokitI++) {\n\t\t\t\t\tconst byokitLine = byokitLines[byokitI];\n\t\t\t\t\tif (byokitLine.startsWith(\"## \")) {\n\t\t\t\t\t\tbyokitInTooling = byokitLine === \"## Tooling\";\n\t\t\t\t\t\tbyokitToolingArmed = false;\n\t\t\t\t\t} else if (byokitInTooling && !byokitToolingArmed) {\n\t\t\t\t\t\tif (byokitLine === \"Tools policy-filtered. Names case-sensitive; call exact.\") byokitToolingArmed = true;\n\t\t\t\t\t} else if (byokitInTooling && byokitToolingArmed && byokitLine.startsWith(\"- \")) {\n\t\t\t\t\t\tconst byokitMatch = /^- (\\S+?)(:.*)?$/.exec(byokitLine);\n\t\t\t\t\t\tif (byokitMatch && byokitBareNames.has(byokitMatch[1])) byokitLines[byokitI] = `- mcp__openclaw__${byokitMatch[1]}${byokitMatch[2] ?? \"\"}`;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tsystemPrompt = byokitLines.join(\"\\n\");\n\t\t\t}\n\t\t}\n"
+        }
+      ]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/openclaw",
-  "version": "0.6.2",
+  "version": "0.8.0",
   "description": "The OpenClaw runtime kit: the pinned engine's full operator surface with plain-words helpers for members, sign-in, runs and approvals.",
   "license": "Apache-2.0",
   "type": "module",
@@ -60,9 +60,9 @@
     "prepack": "tsc -b && node ../../scripts/fix-words-dts.cjs"
   },
   "dependencies": {
-    "@byokit/link": "0.7.0",
-    "@byokit/relay": "0.5.2",
-    "@byokit/reach": "0.6.0",
+    "@byokit/link": "0.7.1",
+    "@byokit/relay": "0.5.3",
+    "@byokit/discover": "0.6.0",
     "@byokit/seal": "0.3.0",
     "@byokit/secrets": "0.5.0",
     "@openclaw/gateway-client": "2026.9.6",