Codex review: needs maintainer review before merge. Reviewed July 11, 2026, 8:48 PM ET / July 12, 2026, 00:48 UTC.

Summary
The PR preserves the selected Claude usage source after successful login, adds controller-level regression coverage for all five source modes, updates Claude documentation, and includes a release-note entry.

Reproducibility: yes. at source level with high confidence: current main unconditionally sets OAuth after login, and the canonical issue records OAuth failure followed by recovery when Auto is restored. This read-only review did not complete a live OAuth login.

Review metrics: 4 noteworthy metrics.

• Source modes covered: 5 tested. The regression covers Auto, API, OAuth, web, and CLI selections.
• Behavioral delta: 1 persisted assignment removed. The production fix is narrowly limited to preserving the selected source.
• Patch surface: 4 files, 64 additions, 3 deletions. Runtime code, one focused test, provider documentation, and release notes comprise the complete branch scope.
• Owner validation: 52 test shards, 0 retries. The repository owner reports a clean exact-head full suite in addition to focused and lint validation.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #1970
Summary: This PR directly fixes the canonical post-login source-pinning report; nearby Claude credential reports overlap in symptoms but retain broader or distinct causes.

Members:

• canonical: Claude login pins usage source to OAuth and disables Auto fallback #1970 - It reports the exact successful-login OAuth overwrite and loss of Auto fallback repaired here.
• partial_overlap: Claude constantly looses token for access #1823 - It tracks broader Claude token and credential-access failures that source preservation alone may not resolve.
• partial_overlap: Claude logging out and persistent macOS Keychain prompt loop on v0.41.0 #1998 - It reports a repeated Keychain prompt loop without establishing source pinning as the sole cause.
• adjacent_distinct: Fix #1844: block background Claude delegated refresh and mcpOAuth-only keychain touch #1848 - That merged work addresses delegated refresh and MCP-only Keychain handling rather than post-login source selection.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

• [P1] The Login action intentionally no longer changes existing API, web, or CLI selections to OAuth; this upgrade-visible behavior is documented and covered across all source modes.
• [P1] Two exact-head macOS test jobs were still pending at review time, so merge should remain gated on required CI completion.

Maintainer options:

1. Merge after exact-head checks (recommended)
   Accept the owner’s exact-head proof and land the documented source-preservation behavior once required CI passes.
2. Require an OAuth transcript
   Pause for an additional redacted completed OAuth login transcript despite the owner’s exact-head proof override.

Next step before merge

• [P2] No repair or product decision remains; merge should proceed through normal exact-head CI and maintainer handling.

Security
Cleared: The diff does not expand credential access, Keychain reads, permissions, dependencies, workflows, or external code execution; it removes a setting overwrite and adds a test seam.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Maintainer decision requested.

This PR is now scoped to the narrow fix ClawSweeper recommended:

• Default Claude Auto stays Auto after login, so fallback remains available.
• Explicit source choices stay explicit.
• Claude docs and the focused regression test were updated.
• make check, ClaudeLoginFlowPolicyTests, ClaudeSourcePlannerTests, and ClaudeOAuthTests pass.

The remaining ClawSweeper blocker is not another code issue. It wants either:

1. maintainer approval that source-level proof is enough for this auth-provider change, or
2. a maintainer-approved redacted proof format for running the live Claude login/OAuth/Keychain path.

I am not running live Claude/OAuth/Keychain proof unprompted because AGENTS.md says those probes can display macOS Keychain prompts and require explicit request.

Updated the PR body with clean-worktree after-fix proof at e5b551e29fe4b6a8399fbf522fcf0eb8cbde0f25.

Proof added:

• Clean detached worktree from origin/codex/claude-login-auto-source, no local modifications.
• make check passed there: SwiftFormat reported 0/1289 files require formatting; SwiftLint reported 0 violations, 0 serious in 1288 files.
• swift test --filter ClaudeLoginFlowPolicyTests passed there: the test covers every ClaudeUsageDataSource case and proves successful login preserves the selected source instead of forcing oauth.
• No live Claude/OAuth/Keychain probe was run; this stays within AGENTS.md by using the policy seam and focused regression test instead of prompting a real account.

@clawsweeper re-review

Added stronger behavior proof in c98779b7b2b03bc95da8fac409492d8a8faa559e and updated the PR body.

This no longer stops at the policy helper:

• Production runClaudeLoginFlow() still calls the real ClaudeLoginRunner.run(timeout:onPhaseChange:) path.
• The shared success branch now has an injected-runner seam so the focused test can execute the actual StatusItemController.runClaudeLoginFlow post-login path with a successful Claude runner result.
• The new controller-flow test constructs real SettingsStore, UsageStore, and StatusItemController instances and loops every Claude source: auto, api, oauth, web, cli.
• For each source it verifies successful login returns true, loginPhase == .idle, Claude becomes enabled, and settings.claudeUsageDataSource == source after the login success branch runs.
• The transcript shows Claude login outcome=success followed by Provider mode updated provider=claude value=auto/api/oauth/web/cli, proving the patched login/source path leaves the intended source intact.

Verified:

$ swift test --filter ClaudeLoginFlowPolicyTests
✔ Test "successful Claude login preserves selected source so auto fallback remains available" passed after 0.001 seconds.
✔ Test "successful Claude login controller flow preserves selected source and enables provider" passed after 0.304 seconds.
✔ Test run with 2 tests in 1 suite passed after 0.305 seconds.

$ make check
SwiftFormat completed in 0.51s.
0/1289 files require formatting.
Done linting! Found 0 violations, 0 serious in 1288 files.

No external fork code was downloaded or used.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Live proof attempt added to the PR body.

What I could verify without exposing secrets:

• Installed Claude CLI is 2.1.201 (Claude Code).
• claude auth status reports a real claude.ai login with loggedIn: true, apiProvider: firstParty, and subscriptionType: max; email/org are redacted from PR text.
• Patched-branch live Auto usage succeeds through the real Claude CLI source:

$ .build/debug/CodexBarCLI usage --provider claude --source auto --format json --pretty --status
[
  {
    "provider" : "claude",
    "source" : "claude",
    "status" : {
      "description" : "All Systems Operational",
      "indicator" : "none",
      "url" : "https://status.claude.com/"
    },
    "version" : "2.1.201"
  }
]

Live OAuth completion is blocked externally:

• claude auth login --claudeai opened the OAuth flow and waited for a code.
• agent-browser reached Claude/Cloudflare Performing security verification and could not advance past human verification.
• Retrying with Codex CI env vars removed opened normal Google Chrome with the user profile, but the page was Sign in - Claude; completing it would require interactive credentials/human verification.
• I stopped the waiting CLI and did not post any token, cookie, auth code, private path, or Keychain payload.

So the proof state is now:

• committed controller-flow proof shows the patched successful-login branch preserves auto instead of forcing oauth;
• live provider proof shows auto can fetch through the real Claude CLI source on this machine;
• full live OAuth-login completion is not automatable here because Claude/Cloudflare/sign-in blocks it.

@steipete could you accept this as the proof override ClawSweeper asks for, or provide/run a maintainer-side redacted live OAuth transcript?

@clawsweeper re-review

Current maintainer action needed after the latest ClawSweeper rerun:

1. Accept the current proof as the proof override ClawSweeper lists as the recommended path, or run/post a maintainer-side redacted completed Claude OAuth/Keychain transcript.
2. Approve the fork CI workflow run. The visible code check is GitGuardian passing; the CI run is action_required with no jobs, and GitHub rejects contributor-side approval with Must have admin rights to Repository.

The current branch head is c98779b7b2b03bc95da8fac409492d8a8faa559e. Code-side validation is already posted in the PR body/comment: controller-flow source preservation test, swift test --filter ClaudeLoginFlowPolicyTests, make check, and redacted live Auto CLI fallback proof. No external fork code was downloaded or used.

Pre-tag maintainer ask / final gate status:

• PR head: c98779b7b2b03bc95da8fac409492d8a8faa559e.
• Mergeability: GitHub reports the branch is mergeable, but the PR is still unstable because the fork CI run is action_required.
• CI: visible GitGuardian check passed; the main CI workflow run is pending maintainer/admin approval and has no jobs yet.
• Proof: I accept that the remaining ClawSweeper item is a maintainer proof decision, not another code change. Current proof includes the controller-flow source-preservation test, make check, targeted Claude tests, redacted live Auto fallback proof, and an independent Claude login pins usage source to OAuth and disables Auto fallback #1970 repro showing oauth hard-fails while auto recovers.

I attempted to approve the fork CI run from this account, but GitHub returned Must have admin rights to Repository. I also cannot submit an approving review because GitHub rejects approval on my own PR.

@steipete please approve the fork CI run and, if you agree, accept the current proof override so this can be merged before tagging.

Maintainer repair and exact-head proof for d2a6563:

• Rebased onto current main and removed the redundant source-policy indirection.
• Controller-level regression covers Auto, API, OAuth, Web, and CLI: successful login enables Claude without changing the selected usage source.
• swift test --filter ClaudeLoginFlowTests passes.
• make check passes.
• Full make test: 613 selections, all 52 shards first-pass green, zero retries/recoveries/timeouts.
• Final autoreview clean (0.97).

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29174171217
• Updated: 2026-07-12T00:50:00.831Z