Auto-merge upstream openclaw/openclaw

Author: github-actions[bot]

CHANGELOG.md

@@ -113,6 +113,7 @@ Docs: https://docs.openclaw.ai
 - Control UI/avatar: honor `ui.assistant.avatar` when serving `/avatar/:agentId` so Appearance UI avatar paths stop falling back to initials placeholders. (#60778) Thanks @hannasdev.
 - Control UI/Overview: prevent gateway access token/password visibility toggle buttons from overlapping their inputs at narrow widths. (#56924) Thanks @bbddbb1.
 - Control UI/cron: highlight the Cron refresh button while refresh is in flight so the page's loading state stays visible even when prior data remains on screen. (#60394) Thanks @coder-zhuzm.
+- MS Teams: replace the deprecated Teams SDK HttpPlugin stub with `httpServerAdapter` so recurring gateway deprecation warnings stop firing and the Express 5 compatibility workaround stays on the supported SDK path. (#60939) Thanks @coolramukaka-sys.
 
 ## 2026.4.2
 
@@ -209,6 +210,7 @@ Docs: https://docs.openclaw.ai
 - Browser/profiles: reject remote browser profile `cdpUrl` values that violate strict SSRF policy before saving config, with clearer validation errors for blocked endpoints. (#60477) Thanks @eleqtrizit.
 - Browser/screenshots: stop sending `fromSurface: false` on CDP screenshots so managed Chrome 146+ browsers can capture images again. (#60682) Thanks @mvanhorn.
 - Mattermost/slash commands: harden native slash-command callback token validation to use constant-time secret comparison, matching the existing interaction-token path.
+- Control UI/mobile chat: reduce narrow-screen overflow by shrinking the chat pane minimum width, removing extra mobile padding, widening message groups, and hiding avatars on very small screens. (#60220) Thanks @macdao.
 
 ## 2026.4.1
 

docs/cli/index.md

@@ -1479,13 +1479,14 @@ Tip: the owner-only `gateway` runtime tool still refuses to rewrite `tools.exec.
 
 See [/concepts/models](/concepts/models) for fallback behavior and scanning strategy.
 
-Billing note: Anthropic changed third-party harness billing on **April 4, 2026
-at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no
-longer cover OpenClaw, and Claude CLI usage in OpenClaw now requires **Extra
-Usage** billed separately from the subscription. For production, prefer an
-Anthropic API key or another supported subscription-style provider such as
-OpenAI Codex, Qwen Cloud Coding Plan, MiniMax Coding Plan, or
-Z.AI / GLM Coding Plan.
+Billing note: Anthropic's public Claude Code docs still include direct Claude
+Code terminal usage in Claude plan limits. Separately, Anthropic notified
+OpenClaw users on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST** that the
+**OpenClaw** Claude-login path counts as third-party harness usage and
+requires **Extra Usage** billed separately from the subscription. For
+production, prefer an Anthropic API key or another supported
+subscription-style provider such as OpenAI Codex, Alibaba Cloud Model Studio
+Coding Plan, MiniMax Coding Plan, or Z.AI / GLM Coding Plan.
 
 Anthropic Claude CLI migration:
 
@@ -1495,8 +1496,9 @@ openclaw models auth login --provider anthropic --method cli --set-default
 
 Onboarding shortcut: `openclaw onboard --auth-choice anthropic-cli`
 
-Existing Anthropic OAuth/token profiles still run if already configured, but
-OpenClaw no longer offers Anthropic setup-token as a new auth path.
+Anthropic setup-token is also available again as a legacy/manual auth path.
+Use it only with the expectation that Anthropic told OpenClaw users the
+OpenClaw Claude-login path requires **Extra Usage**.
 
 Legacy alias note: `claude-cli` is the deprecated onboarding auth-choice alias.
 Use `anthropic-cli` for onboarding, or use `models auth login` directly.
@@ -1609,7 +1611,7 @@ Notes:
 - `setup-token` and `paste-token` are generic token commands for providers that expose token auth methods.
 - `setup-token` requires an interactive TTY and runs the provider's token-auth method.
 - `paste-token` prompts for the token value and defaults to auth profile id `<provider>:manual` when `--profile-id` is omitted.
-- Anthropic OAuth/token profiles still run if already configured, but Anthropic no longer supports `setup-token` or `paste-token` as a new OpenClaw auth path.
+- Anthropic `setup-token` / `paste-token` are available again as a legacy/manual OpenClaw path. Anthropic told OpenClaw users this path requires **Extra Usage** on the Claude account.
 
 ### `models auth order get|set|clear`
 

docs/cli/models.md

@@ -99,7 +99,7 @@ openclaw models fallbacks list
 openclaw models auth add
 openclaw models auth login --provider <id>
 openclaw models auth setup-token --provider <id>
-openclaw models auth paste-token --provider <id>
+openclaw models auth paste-token
 ```
 
 `models auth add` is the interactive auth helper. It can launch a provider auth
@@ -126,10 +126,11 @@ Notes:
 - `setup-token` requires an interactive TTY and runs the provider's token-auth
   method (defaulting to that provider's `setup-token` method when it exposes
   one).
+- `paste-token` accepts a token string generated elsewhere or from automation.
 - `paste-token` requires `--provider`, prompts for the token value, and writes
   it to the default profile id `<provider>:manual` unless you pass
   `--profile-id`.
 - `paste-token --expires-in <duration>` stores an absolute token expiry from a
   relative duration such as `365d` or `12h`.
-- Anthropic billing note: Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover OpenClaw, and Claude CLI traffic in OpenClaw now requires **Extra Usage** billed separately from the subscription.
-- Existing Anthropic OAuth/token profiles still run if already configured, but Anthropic no longer supports `setup-token` or `paste-token` as a new OpenClaw auth path.
+- Anthropic billing note: Anthropic's public Claude Code docs still include direct Claude Code terminal usage in Claude plan limits. Separately, Anthropic notified OpenClaw users on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST** that the **OpenClaw** Claude-login path counts as third-party harness usage and requires **Extra Usage** billed separately from the subscription.
+- Anthropic `setup-token` / `paste-token` are available again as a legacy/manual OpenClaw path. Use them with the expectation that Anthropic told OpenClaw users this path requires **Extra Usage**.

docs/concepts/model-providers.md

@@ -255,8 +255,8 @@ OpenClaw ships with the pi‑ai catalog. These providers require **no**
 - Example model: `anthropic/claude-opus-4-6`
 - CLI: `openclaw onboard --auth-choice apiKey` or `openclaw onboard --auth-choice anthropic-cli`
 - Direct public Anthropic requests support the shared `/fast` toggle and `params.fastMode`, including API-key and OAuth-authenticated traffic sent to `api.anthropic.com`; OpenClaw maps that to Anthropic `service_tier` (`auto` vs `standard_only`)
-- Billing note: Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover OpenClaw, and Anthropic OAuth/subscription traffic now requires **Extra Usage** billed separately from the subscription.
-- Existing Anthropic OAuth/token profiles still run if already configured, but new setup is no longer offered through onboarding or auth commands.
+- Billing note: Anthropic's public Claude Code docs still include direct Claude Code terminal usage in Claude plan limits. Separately, Anthropic notified OpenClaw users on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST** that the **OpenClaw** Claude-login path counts as third-party harness usage and requires **Extra Usage** billed separately from the subscription.
+- Anthropic setup-token is available again as a legacy/manual OpenClaw path. Use it with the expectation that Anthropic told OpenClaw users this path requires **Extra Usage**.
 
 ```json5
 {

docs/concepts/oauth.md

@@ -13,11 +13,13 @@ title: "OAuth"
 OpenClaw supports “subscription auth” via OAuth for providers that offer it
 (notably **OpenAI Codex (ChatGPT OAuth)**). For Anthropic subscriptions, new
 setup should use the local **Claude CLI** login path on the gateway host, but
-Anthropic changed third-party harness billing on
-**April 4, 2026 at 12:00 PM PT / 8:00 PM BST**: Anthropic says Claude
-subscription limits no longer cover OpenClaw and Anthropic now requires **Extra
-Usage** for that traffic. OpenAI Codex OAuth is explicitly supported for use in
-external tools like OpenClaw. This page explains:
+Anthropic distinguishes between direct Claude Code usage and OpenClaw's reuse
+path. Anthropic's public Claude Code docs say direct Claude Code use stays
+inside Claude subscription limits. Separately, Anthropic notified OpenClaw
+users on **April 4, 2026 at 12:00 PM PT / 8:00 PM BST** that OpenClaw counts as
+a third-party harness and now requires **Extra Usage** for that traffic.
+OpenAI Codex OAuth is explicitly supported for use in external tools like
+OpenClaw. This page explains:
 
 For Anthropic in production, API key auth is the safer recommended path.
 
@@ -64,29 +66,33 @@ All of the above also respect `$OPENCLAW_STATE_DIR` (state dir override). Full r
 
 For static secret refs and runtime snapshot activation behavior, see [Secrets Management](/gateway/secrets).
 
-## Anthropic OAuth/token compatibility
+## Anthropic legacy token compatibility
 
 <Warning>
-Anthropic changed third-party harness billing on **April 4, 2026 at 12:00 PM
-PT / 8:00 PM BST**. Anthropic says Claude subscription limits no longer cover
-OpenClaw or other third-party harnesses. Existing Anthropic OAuth/token profiles
-remain technically usable in OpenClaw, but Anthropic now requires **Extra
+Anthropic's public Claude Code docs say direct Claude Code use stays within
+Claude subscription limits. Separately, Anthropic told OpenClaw users on
+**April 4, 2026 at 12:00 PM PT / 8:00 PM BST** that **OpenClaw counts as a
+third-party harness**. Existing Anthropic token profiles remain technically
+usable in OpenClaw, but Anthropic says the OpenClaw path now requires **Extra
 Usage** (pay-as-you-go billed separately from the subscription) for that
 traffic.
 
+For Anthropic's current direct-Claude-Code plan docs, see [Using Claude Code
+with your Pro or Max
+plan](https://support.claude.com/en/articles/11145838-using-claude-code-with-your-pro-or-max-plan)
+and [Using Claude Code with your Team or Enterprise
+plan](https://support.anthropic.com/en/articles/11845131-using-claude-code-with-your-team-or-enterprise-plan/).
+
 If you want other subscription-style options in OpenClaw, see [OpenAI
 Codex](/providers/openai), [Qwen Cloud Coding
 Plan](/providers/qwen), [MiniMax Coding Plan](/providers/minimax),
 and [Z.AI / GLM Coding Plan](/providers/glm).
 </Warning>
 
-OpenClaw no longer offers Anthropic setup-token onboarding or auth commands for
-new setup. Existing Anthropic OAuth/token profiles are still honored at runtime
-if they are already configured.
-
-The generic token helpers still exist for other providers:
-`openclaw models auth setup-token --provider <id>` and
-`openclaw models auth paste-token --provider <id>`.
+OpenClaw now exposes Anthropic setup-token again as a legacy/manual path.
+Anthropic's OpenClaw-specific billing notice still applies to that path, so
+use it with the expectation that Anthropic requires **Extra Usage** for
+OpenClaw-driven Claude-login traffic.
 
 ## Anthropic Claude CLI migration
 
@@ -113,10 +119,9 @@ openclaw onboard --auth-choice anthropic-cli
 ```
 
 This keeps existing Anthropic auth profiles for rollback, but rewrites the main
-default-model path from `anthropic/...` to a canonical
-`claude-cli/claude-*` ref, rewrites matching Anthropic Claude fallbacks, and
-adds matching canonical `claude-cli/claude-*` allowlist entries under
-`agents.defaults.models`.
+default-model path from `anthropic/...` to `claude-cli/...`, rewrites matching
+Anthropic Claude fallbacks, and adds matching `claude-cli/...` allowlist
+entries under `agents.defaults.models`.
 
 Verify:
 
@@ -136,10 +141,14 @@ Claude CLI path:
 
 1. sign in with `claude auth login` on the gateway host
 2. run `openclaw models auth login --provider anthropic --method cli --set-default`
-3. store no new auth profile; switch model selection to a canonical
-   `claude-cli/claude-*` ref
+3. store no new auth profile; switch model selection to `claude-cli/...`
 4. keep existing Anthropic auth profiles for rollback
 
+Anthropic's public Claude Code docs describe this direct Claude subscription
+login flow for `claude` itself. OpenClaw can reuse that local login, but
+Anthropic separately classifies the OpenClaw-controlled path as third-party
+harness usage for billing purposes.
+
 Interactive assistant path:
 
 - `openclaw onboard` / `openclaw configure` → auth choice `anthropic-cli`

docs/gateway/authentication.md

@@ -59,22 +59,17 @@ API keys for daemon use: `openclaw onboard`.
 See [Help](/help) for details on env inheritance (`env.shellEnv`,
 `~/.openclaw/.env`, systemd/launchd).
 
-## Anthropic: OAuth/token compatibility
+## Anthropic: legacy token compatibility
 
-Existing Anthropic OAuth/token profiles are still honored at runtime if they
-are already configured, but OpenClaw no longer offers Anthropic setup-token
-auth for new setup via onboarding or `models auth` commands.
+Anthropic setup-token auth is still available in OpenClaw as a
+legacy/manual path. Anthropic's public Claude Code docs still cover direct
+Claude Code terminal use under Claude plans, but Anthropic separately told
+OpenClaw users that the **OpenClaw** Claude-login path counts as third-party
+harness usage and requires **Extra Usage** billed separately from the
+subscription.
 
-For new setup, use an Anthropic API key or migrate to Claude CLI on the gateway
-host.
-
-Other providers can still use the generic token helpers:
-
-- `openclaw models auth setup-token --provider <id>` runs the provider's token
-  auth flow (interactive TTY required).
-- `openclaw models auth paste-token --provider <id>` prompts for a token value
-  and writes it to `auth-profiles.json` (default profile id:
-  `<provider>:manual`).
+For the clearest setup path, use an Anthropic API key or migrate to Claude CLI
+on the gateway host.
 
 Manual token entry (any provider; writes `auth-profiles.json` + updates config):
 
@@ -130,8 +125,8 @@ openclaw models auth login --provider anthropic --method cli --set-default
 ```
 
 This keeps your existing Anthropic auth profiles for rollback, but changes the
-default model selection to a canonical `claude-cli/claude-*` ref and adds
-matching Claude CLI allowlist entries under `agents.defaults.models`.
+default model selection to `claude-cli/...` and adds matching Claude CLI
+allowlist entries under `agents.defaults.models`.
 
 Verify:
 
@@ -145,8 +140,9 @@ Onboarding shortcut:
 openclaw onboard --auth-choice anthropic-cli
 ```
 
-Interactive `openclaw onboard` and `openclaw configure` prefer Claude CLI for
-Anthropic and no longer offer setup-token as a new setup path.
+Interactive `openclaw onboard` and `openclaw configure` still prefer Claude CLI
+for Anthropic, but Anthropic setup-token is available again as a
+legacy/manual path and should be used with the Extra Usage billing expectation.
 
 ## Checking model auth status
 
@@ -211,12 +207,12 @@ openclaw models status
 
 ### Token expiring/expired
 
-Run `openclaw models status` to confirm which profile is expiring. If an
-Anthropic OAuth/token profile is missing or expired, migrate that setup to Claude CLI
+Run `openclaw models status` to confirm which profile is expiring. If a legacy
+Anthropic token profile is missing or expired, migrate that setup to Claude CLI
 or an API key.
 
 ## Claude CLI requirements
 
 Only needed for the Anthropic Claude CLI reuse path:
 
-- Claude CLI installed (`claude` command available)
+- Claude Code CLI installed (`claude` command available)