Fix Anthropic CLI auth routing for shorthand refs (#84374)

* Fix Anthropic CLI auth routing

* Add changelog for Anthropic CLI routing

CHANGELOG.md

@@ -33,6 +33,7 @@ Docs: https://docs.openclaw.ai
 - Agents: include bounded trajectory queued-writer diagnostics in `pi-trajectory-flush` timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes #82961. (#82962) Thanks @galiniliev.
 - Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes #83699. (#83700) Thanks @galiniliev.
 - Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes #84040. (#84357) Thanks @joshavant.
+- Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as `anthropic/opus-4.7` no longer fall back to embedded Anthropic billing. Fixes #84222. (#84374) Thanks @joshavant.
 - Agents: honor explicit `models.providers.<id>.timeoutSeconds` values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at ~120s when the provider timeout is higher. (#83979) Thanks @yujiawei.
 - Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing `reason=no_active_run` queue noise. (#82964) Thanks @galiniliev.
 - CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. (#83931) Thanks @honor2030.

extensions/anthropic/claude-model-refs.ts

@@ -0,0 +1,104 @@
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { CLAUDE_CLI_BACKEND_ID, CLAUDE_CLI_MODEL_ALIASES } from "./cli-constants.js";
+
+const DEFAULT_CLAUDE_MODEL_BY_FAMILY: Record<string, string> = {
+  opus: "claude-opus-4-7",
+  sonnet: "claude-sonnet-4-6",
+};
+
+export type ClaudeCliAnthropicModelRefs = {
+  selectedRef: string;
+  runtimeRefs: string[];
+  rewriteRef?: string;
+};
+
+function parseProviderModelRef(
+  raw: string,
+  defaultProvider: string,
+): { provider: string; model: string; explicitProvider: boolean } | null {
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    return null;
+  }
+  const slashIndex = trimmed.indexOf("/");
+  if (slashIndex <= 0) {
+    return { provider: defaultProvider, model: trimmed, explicitProvider: false };
+  }
+  const provider = trimmed.slice(0, slashIndex).trim();
+  const model = trimmed.slice(slashIndex + 1).trim();
+  if (!provider || !model) {
+    return null;
+  }
+  return {
+    provider: normalizeLowercaseStringOrEmpty(provider),
+    model,
+    explicitProvider: true,
+  };
+}
+
+function canonicalizeKnownClaudeCliModelId(modelId: string): string | null {
+  const trimmed = modelId.trim();
+  const normalized = normalizeLowercaseStringOrEmpty(trimmed);
+  if (!normalized) {
+    return null;
+  }
+  if (normalized.startsWith("claude-")) {
+    return trimmed;
+  }
+  const defaultModel = DEFAULT_CLAUDE_MODEL_BY_FAMILY[normalized];
+  if (defaultModel) {
+    return defaultModel;
+  }
+  const family = CLAUDE_CLI_MODEL_ALIASES[normalized];
+  if (!family) {
+    return null;
+  }
+  const version = normalized.slice(`${family}-`.length);
+  if (!version || version === normalized) {
+    return null;
+  }
+  return `claude-${family}-${version.replaceAll(".", "-")}`;
+}
+
+export function resolveClaudeCliAnthropicModelRefs(
+  raw: string,
+): ClaudeCliAnthropicModelRefs | null {
+  const parsed = parseProviderModelRef(raw, "anthropic");
+  if (!parsed) {
+    return null;
+  }
+  if (parsed.provider !== "anthropic" && parsed.provider !== CLAUDE_CLI_BACKEND_ID) {
+    return null;
+  }
+
+  const selectedRef = `anthropic/${parsed.model}`;
+  const runtimeRefs = new Set<string>([selectedRef]);
+  const canonicalModelId = canonicalizeKnownClaudeCliModelId(parsed.model);
+  if (!parsed.explicitProvider && !canonicalModelId) {
+    return null;
+  }
+  const rewriteRef =
+    canonicalModelId || parsed.provider === CLAUDE_CLI_BACKEND_ID
+      ? `anthropic/${canonicalModelId ?? parsed.model}`
+      : undefined;
+  if (rewriteRef) {
+    runtimeRefs.add(rewriteRef);
+  }
+
+  return {
+    selectedRef,
+    runtimeRefs: [...runtimeRefs],
+    ...(rewriteRef ? { rewriteRef } : {}),
+  };
+}
+
+export function resolveKnownAnthropicModelRef(raw?: string): string | null {
+  if (!raw) {
+    return null;
+  }
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    return null;
+  }
+  return resolveClaudeCliAnthropicModelRefs(trimmed)?.rewriteRef ?? trimmed;
+}

extensions/anthropic/cli-migration.test.ts

@@ -152,6 +152,67 @@ describe("anthropic cli migration", () => {
     });
   });
 
+  it("routes provider-qualified shorthand refs through Claude CLI without dropping the raw ref", () => {
+    const result = buildAnthropicCliMigrationResult({
+      agents: {
+        defaults: {
+          model: {
+            primary: "anthropic/opus-4.7",
+            fallbacks: ["anthropic/sonnet-4.6", "openai/gpt-5.2"],
+          },
+          models: {
+            "anthropic/opus-4.7": { alias: "Opus shorthand" },
+            "anthropic/sonnet-4.6": { alias: "Sonnet shorthand" },
+          },
+        },
+      },
+    });
+
+    const defaults = result.configPatch?.agents?.defaults;
+    expect(defaults?.model).toEqual({
+      primary: "anthropic/claude-opus-4-7",
+      fallbacks: ["anthropic/claude-sonnet-4-6", "openai/gpt-5.2"],
+    });
+    expect(defaults?.models?.["anthropic/opus-4.7"]).toEqual({
+      alias: "Opus shorthand",
+      agentRuntime: { id: "claude-cli" },
+    });
+    expect(defaults?.models?.["anthropic/claude-opus-4-7"]).toEqual({
+      alias: "Opus shorthand",
+      agentRuntime: { id: "claude-cli" },
+    });
+    expect(defaults?.models?.["anthropic/sonnet-4.6"]).toEqual({
+      alias: "Sonnet shorthand",
+      agentRuntime: { id: "claude-cli" },
+    });
+    expect(defaults?.models?.["anthropic/claude-sonnet-4-6"]).toEqual({
+      alias: "Sonnet shorthand",
+      agentRuntime: { id: "claude-cli" },
+    });
+  });
+
+  it("keeps unknown Anthropic refs raw while still selecting Claude CLI", () => {
+    const result = buildAnthropicCliMigrationResult({
+      agents: {
+        defaults: {
+          model: { primary: "anthropic/opus-5.0" },
+          models: {
+            "anthropic/opus-5.0": { alias: "Future Opus" },
+          },
+        },
+      },
+    });
+
+    const defaults = result.configPatch?.agents?.defaults;
+    expect(result.defaultModel).toBe("anthropic/opus-5.0");
+    expect(defaults?.model).toBeUndefined();
+    expect(defaults?.models?.["anthropic/opus-5.0"]).toEqual({
+      alias: "Future Opus",
+      agentRuntime: { id: "claude-cli" },
+    });
+    expect(defaults?.models?.["anthropic/claude-opus-5-0"]).toBeUndefined();
+  });
+
   it("adds a Claude CLI default when no anthropic default is present", () => {
     const result = buildAnthropicCliMigrationResult({
       agents: {
@@ -183,6 +244,23 @@ describe("anthropic cli migration", () => {
     });
   });
 
+  it("does not treat bare non-Claude model refs as Anthropic", () => {
+    const result = buildAnthropicCliMigrationResult({
+      agents: {
+        defaults: {
+          model: { primary: "gpt-5.2" },
+          models: {
+            "openai/gpt-5.2": {},
+          },
+        },
+      },
+    });
+
+    expect(result.defaultModel).toBe("anthropic/claude-opus-4-7");
+    expect(result.configPatch?.agents?.defaults?.model).toBeUndefined();
+    expect(result.configPatch?.agents?.defaults?.models?.["anthropic/gpt-5.2"]).toBeUndefined();
+  });
+
   it("backfills the Claude CLI allowlist when older configs only stored sonnet", () => {
     const result = buildAnthropicCliMigrationResult({
       agents: {

extensions/anthropic/cli-migration.ts

@@ -4,6 +4,7 @@ import {
   type ProviderAuthResult,
 } from "openclaw/plugin-sdk/provider-auth";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { resolveClaudeCliAnthropicModelRefs } from "./claude-model-refs.js";
 import {
   readClaudeCliCredentialsForSetup,
   readClaudeCliCredentialsForSetupNonInteractive,
@@ -18,21 +19,16 @@ type AgentDefaultsRuntimePolicy = NonNullable<
 type ClaudeCliCredential = NonNullable<ReturnType<typeof readClaudeCliCredentialsForSetup>>;
 
 function toAnthropicModelRef(raw: string): string | null {
-  const trimmed = raw.trim();
-  const lower = normalizeLowercaseStringOrEmpty(trimmed);
-  const provider = lower.startsWith("anthropic/")
-    ? "anthropic"
-    : lower.startsWith(`${CLAUDE_CLI_BACKEND_ID}/`)
-      ? CLAUDE_CLI_BACKEND_ID
-      : "";
-  if (!provider) {
-    return null;
-  }
-  const modelId = trimmed.slice(provider.length + 1).trim();
-  if (!normalizeLowercaseStringOrEmpty(modelId).startsWith("claude-")) {
-    return null;
-  }
-  return `anthropic/${modelId}`;
+  return resolveClaudeCliAnthropicModelRefs(raw)?.rewriteRef ?? null;
+}
+
+function toAnthropicRuntimeRefs(raw: string): string[] {
+  return resolveClaudeCliAnthropicModelRefs(raw)?.runtimeRefs ?? [];
+}
+
+function toAnthropicSelectedModelRef(raw: string): string | undefined {
+  const resolved = resolveClaudeCliAnthropicModelRefs(raw);
+  return resolved?.rewriteRef ?? resolved?.selectedRef;
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {
@@ -46,10 +42,17 @@ function rewriteModelSelection(model: AgentDefaultsModel): {
   changed: boolean;
 } {
   if (typeof model === "string") {
+    const runtimeRefs = toAnthropicRuntimeRefs(model);
     const converted = toAnthropicModelRef(model);
+    const selectedRef = converted ?? toAnthropicSelectedModelRef(model);
     return converted
-      ? { value: converted, primary: converted, runtimeRefs: [converted], changed: true }
-      : { value: model, runtimeRefs: [], changed: false };
+      ? { value: converted, primary: converted, runtimeRefs, changed: true }
+      : {
+          value: model,
+          ...(selectedRef ? { primary: selectedRef } : {}),
+          runtimeRefs,
+          changed: false,
+        };
   }
   if (!model || typeof model !== "object" || Array.isArray(model)) {
     return { value: model, runtimeRefs: [], changed: false };
@@ -62,12 +65,14 @@ function rewriteModelSelection(model: AgentDefaultsModel): {
   let primary: string | undefined;
 
   if (typeof current.primary === "string") {
+    runtimeRefs.push(...toAnthropicRuntimeRefs(current.primary));
     const converted = toAnthropicModelRef(current.primary);
     if (converted) {
       next.primary = converted;
       primary = converted;
-      runtimeRefs.push(converted);
       changed = true;
+    } else {
+      primary = toAnthropicSelectedModelRef(current.primary);
     }
   }
 
@@ -77,10 +82,8 @@ function rewriteModelSelection(model: AgentDefaultsModel): {
       if (typeof entry !== "string") {
         return entry;
       }
+      runtimeRefs.push(...toAnthropicRuntimeRefs(entry));
       const converted = toAnthropicModelRef(entry);
-      if (converted) {
-        runtimeRefs.push(converted);
-      }
       return converted ?? entry;
     });
     if (nextFallbacks.some((entry, index) => entry !== currentFallbacks[index])) {
@@ -100,15 +103,18 @@ function rewriteModelSelection(model: AgentDefaultsModel): {
 function rewriteModelEntryMap(models: Record<string, unknown> | undefined): {
   value: Record<string, unknown> | undefined;
   migrated: string[];
+  runtimeRefs: string[];
 } {
   if (!models) {
-    return { value: models, migrated: [] };
+    return { value: models, migrated: [], runtimeRefs: [] };
   }
 
   const next = { ...models };
   const migrated: string[] = [];
+  const runtimeRefs: string[] = [];
 
   for (const [rawKey, value] of Object.entries(models)) {
+    runtimeRefs.push(...toAnthropicRuntimeRefs(rawKey));
     const converted = toAnthropicModelRef(rawKey);
     if (!converted) {
       continue;
@@ -119,13 +125,16 @@ function rewriteModelEntryMap(models: Record<string, unknown> | undefined): {
     if (!(converted in next)) {
       next[converted] = value;
     }
-    delete next[rawKey];
+    if (normalizeLowercaseStringOrEmpty(rawKey).startsWith(`${CLAUDE_CLI_BACKEND_ID}/`)) {
+      delete next[rawKey];
+    }
     migrated.push(converted);
   }
 
   return {
-    value: migrated.length > 0 ? next : models,
+    value: migrated.length > 0 || runtimeRefs.length > 0 ? next : models,
     migrated,
+    runtimeRefs,
   };
 }
 
@@ -227,6 +236,7 @@ export function buildAnthropicCliMigrationResult(
     {}) as NonNullable<AgentDefaultsModels>;
   const nextModels = seedClaudeCliAllowlist(existingModels, [
     ...rewrittenModel.runtimeRefs,
+    ...rewrittenModels.runtimeRefs,
     ...rewrittenModels.migrated,
   ]);
   const defaultModel = rewrittenModel.primary ?? "anthropic/claude-opus-4-7";

extensions/anthropic/config-defaults.ts

@@ -1,4 +1,8 @@
 import type { OpenClawConfig } from "openclaw/plugin-sdk/plugin-entry";
+import {
+  resolveClaudeCliAnthropicModelRefs,
+  resolveKnownAnthropicModelRef,
+} from "./claude-model-refs.js";
 import { CLAUDE_CLI_BACKEND_ID, CLAUDE_CLI_DEFAULT_ALLOWLIST_REFS } from "./cli-constants.js";
 
 const ANTHROPIC_PROVIDER_API = "anthropic-messages";
@@ -92,24 +96,6 @@ function resolveModelPrimaryValue(
   return trimmed || undefined;
 }
 
-function resolveAnthropicPrimaryModelRef(raw?: string): string | null {
-  if (!raw) {
-    return null;
-  }
-  const trimmed = raw.trim();
-  if (!trimmed) {
-    return null;
-  }
-  const aliasKey = normalizeLowercaseStringOrEmpty(trimmed);
-  if (aliasKey === "opus") {
-    return "anthropic/claude-opus-4-7";
-  }
-  if (aliasKey === "sonnet") {
-    return "anthropic/claude-sonnet-4-6";
-  }
-  return trimmed;
-}
-
 function parseProviderModelRef(
   raw: string,
   defaultProvider: string,
@@ -171,30 +157,43 @@ function usesClaudeCliModelSelection(config: OpenClawConfig): boolean {
   });
 }
 
+function usesSelectedClaudeCliAuthProfile(config: OpenClawConfig): boolean {
+  const profiles = config.auth?.profiles ?? {};
+  const orderedProfileIds = [
+    ...(config.auth?.order?.anthropic ?? []),
+    ...((config.auth?.order as Record<string, string[] | undefined> | undefined)?.[
+      CLAUDE_CLI_BACKEND_ID
+    ] ?? []),
+  ];
+  for (const profileId of orderedProfileIds) {
+    const provider = profiles[profileId]?.provider;
+    if (provider === CLAUDE_CLI_BACKEND_ID) {
+      return true;
+    }
+    if (provider === "anthropic") {
+      return false;
+    }
+  }
+
+  let hasClaudeCliProfile = false;
+  let hasAnthropicProfile = false;
+  for (const profile of Object.values(profiles)) {
+    if (profile?.provider === CLAUDE_CLI_BACKEND_ID) {
+      hasClaudeCliProfile = true;
+    }
+    if (profile?.provider === "anthropic") {
+      hasAnthropicProfile = true;
+    }
+  }
+  return hasClaudeCliProfile && !hasAnthropicProfile;
+}
+
 function toCanonicalAnthropicModelRef(ref: string): string {
   return ref.startsWith(`${CLAUDE_CLI_BACKEND_ID}/`)
     ? `anthropic/${ref.slice(CLAUDE_CLI_BACKEND_ID.length + 1)}`
     : ref;
 }
 
-function toClaudeCliRuntimeModelRef(raw: string): string | null {
-  const ref = resolveAnthropicPrimaryModelRef(raw);
-  if (!ref) {
-    return null;
-  }
-  const parsed = parseProviderModelRef(ref, "anthropic");
-  if (!parsed) {
-    return null;
-  }
-  if (parsed.provider !== "anthropic" && parsed.provider !== CLAUDE_CLI_BACKEND_ID) {
-    return null;
-  }
-  if (!normalizeLowercaseStringOrEmpty(parsed.model).startsWith("claude-")) {
-    return null;
-  }
-  return `anthropic/${parsed.model}`;
-}
-
 function modelEntryWithClaudeCliRuntime(entry: unknown): Record<string, unknown> {
   const base = isRecord(entry) ? { ...entry } : {};
   const currentRuntimeId = isRecord(base.agentRuntime) ? base.agentRuntime.id : undefined;
@@ -214,20 +213,55 @@ function collectClaudeCliRuntimeRefs(
 ): string[] {
   const refs = new Set<string>();
   if (typeof model === "string") {
-    const ref = toClaudeCliRuntimeModelRef(model);
-    if (ref) {
+    for (const ref of resolveClaudeCliAnthropicModelRefs(model)?.runtimeRefs ?? []) {
       refs.add(ref);
     }
     return [...refs];
   }
-  const primary =
-    typeof model?.primary === "string" ? toClaudeCliRuntimeModelRef(model.primary) : null;
-  if (primary) {
-    refs.add(primary);
+  if (typeof model?.primary === "string") {
+    for (const ref of resolveClaudeCliAnthropicModelRefs(model.primary)?.runtimeRefs ?? []) {
+      refs.add(ref);
+    }
   }
   for (const fallback of model?.fallbacks ?? []) {
-    const ref = toClaudeCliRuntimeModelRef(fallback);
-    if (ref) {
+    for (const ref of resolveClaudeCliAnthropicModelRefs(fallback)?.runtimeRefs ?? []) {
+      refs.add(ref);
+    }
+  }
+  return [...refs];
+}
+
+function collectClaudeCliRuntimeRefsFromModelMap(
+  models: Record<string, unknown> | undefined,
+): string[] {
+  const refs = new Set<string>();
+  for (const key of Object.keys(models ?? {})) {
+    for (const ref of resolveClaudeCliAnthropicModelRefs(key)?.runtimeRefs ?? []) {
+      refs.add(ref);
+    }
+  }
+  return [...refs];
+}
+
+function collectClaudeCliRuntimeRefsFromConfig(config: OpenClawConfig): string[] {
+  const refs = new Set<string>(
+    collectClaudeCliRuntimeRefs(
+      config.agents?.defaults?.model as
+        | string
+        | { primary?: string; fallbacks?: string[] }
+        | undefined,
+    ),
+  );
+  for (const ref of collectClaudeCliRuntimeRefsFromModelMap(config.agents?.defaults?.models)) {
+    refs.add(ref);
+  }
+  for (const agent of config.agents?.list ?? []) {
+    for (const ref of collectClaudeCliRuntimeRefs(
+      agent.model as string | { primary?: string; fallbacks?: string[] } | undefined,
+    )) {
+      refs.add(ref);
+    }
+    for (const ref of collectClaudeCliRuntimeRefsFromModelMap(agent.models)) {
       refs.add(ref);
     }
   }
@@ -314,7 +348,7 @@ export function applyAnthropicConfigDefaults(params: {
       modelsMutated = true;
     }
 
-    const primary = resolveAnthropicPrimaryModelRef(
+    const primary = resolveKnownAnthropicModelRef(
       resolveModelPrimaryValue(
         defaults.model as string | { primary?: string; fallbacks?: string[] } | undefined,
       ),
@@ -355,10 +389,13 @@ export function applyAnthropicConfigDefaults(params: {
     }
   }
 
-  if (authMode === "oauth" && usesClaudeCliModelSelection(params.config)) {
+  if (
+    authMode === "oauth" &&
+    (usesClaudeCliModelSelection(params.config) || usesSelectedClaudeCliAuthProfile(params.config))
+  ) {
     const nextModels = defaults.models ? { ...defaults.models } : {};
     let modelsMutated = false;
-    const runtimeRefs = new Set<string>(collectClaudeCliRuntimeRefs(defaults.model));
+    const runtimeRefs = new Set<string>(collectClaudeCliRuntimeRefsFromConfig(params.config));
     for (const rawRef of CLAUDE_CLI_DEFAULT_ALLOWLIST_REFS) {
       runtimeRefs.add(toCanonicalAnthropicModelRef(rawRef));
     }

extensions/anthropic/index.test.ts

@@ -268,6 +268,185 @@ describe("anthropic provider replay hooks", () => {
     }
   });
 
+  it("backfills raw and canonical Claude CLI policies for provider-qualified shorthand refs", async () => {
+    const provider = await registerSingleProviderPlugin(anthropicPlugin);
+
+    const next = provider.applyConfigDefaults?.({
+      provider: "anthropic",
+      env: {},
+      config: {
+        auth: {
+          profiles: {
+            "anthropic:claude-cli": { provider: "claude-cli", mode: "oauth" },
+          },
+        },
+        agents: {
+          defaults: {
+            model: { primary: "anthropic/opus-4.7" },
+            models: {
+              "anthropic/opus-4.7": { params: { maxTokens: 1200 } },
+            },
+          },
+        },
+      },
+    } as never);
+
+    const models = requireRecord(next?.agents?.defaults?.models, "models");
+    expect(models["anthropic/opus-4.7"]).toEqual({
+      params: { maxTokens: 1200 },
+      agentRuntime: { id: "claude-cli" },
+    });
+    expect(models["anthropic/claude-opus-4-7"]).toEqual({
+      agentRuntime: { id: "claude-cli" },
+    });
+  });
+
+  it("backfills Claude CLI policy from per-agent shorthand refs selected under Claude CLI auth", async () => {
+    const provider = await registerSingleProviderPlugin(anthropicPlugin);
+
+    const next = provider.applyConfigDefaults?.({
+      provider: "anthropic",
+      env: {},
+      config: {
+        auth: {
+          profiles: {
+            "anthropic:claude-cli": { provider: "claude-cli", mode: "oauth" },
+          },
+        },
+        agents: {
+          defaults: {
+            models: {},
+          },
+          list: [
+            {
+              default: true,
+              id: "main",
+              model: { primary: "anthropic/opus-4.7" },
+              name: "Main",
+              workspace: "/tmp/openclaw-agent",
+            },
+          ],
+        },
+      },
+    } as never);
+
+    const models = requireRecord(next?.agents?.defaults?.models, "models");
+    expect(models["anthropic/opus-4.7"]).toEqual({ agentRuntime: { id: "claude-cli" } });
+    expect(models["anthropic/claude-opus-4-7"]).toEqual({
+      agentRuntime: { id: "claude-cli" },
+    });
+  });
+
+  it("backfills Claude CLI policy from shorthand model-map keys under Claude CLI auth", async () => {
+    const provider = await registerSingleProviderPlugin(anthropicPlugin);
+
+    const next = provider.applyConfigDefaults?.({
+      provider: "anthropic",
+      env: {},
+      config: {
+        auth: {
+          profiles: {
+            "anthropic:claude-cli": { provider: "claude-cli", mode: "oauth" },
+          },
+        },
+        agents: {
+          defaults: {
+            models: {
+              "anthropic/opus-4.7": { params: { maxTokens: 1200 } },
+            },
+          },
+          list: [
+            {
+              id: "main",
+              models: {
+                "anthropic/sonnet-4.6": { alias: "Sonnet shorthand" },
+              },
+              name: "Main",
+              workspace: "/tmp/openclaw-agent",
+            },
+          ],
+        },
+      },
+    } as never);
+
+    const models = requireRecord(next?.agents?.defaults?.models, "models");
+    expect(models["anthropic/opus-4.7"]).toEqual({
+      params: { maxTokens: 1200 },
+      agentRuntime: { id: "claude-cli" },
+    });
+    expect(models["anthropic/claude-opus-4-7"]).toEqual({
+      agentRuntime: { id: "claude-cli" },
+    });
+    expect(models["anthropic/sonnet-4.6"]).toEqual({ agentRuntime: { id: "claude-cli" } });
+    expect(models["anthropic/claude-sonnet-4-6"]).toEqual({
+      agentRuntime: { id: "claude-cli" },
+    });
+  });
+
+  it("does not backfill Claude CLI policy from an unselected rollback profile", async () => {
+    const provider = await registerSingleProviderPlugin(anthropicPlugin);
+
+    const next = provider.applyConfigDefaults?.({
+      provider: "anthropic",
+      env: {},
+      config: {
+        auth: {
+          order: {
+            anthropic: ["anthropic:oauth", "anthropic:claude-cli"],
+          },
+          profiles: {
+            "anthropic:oauth": { provider: "anthropic", mode: "oauth" },
+            "anthropic:claude-cli": { provider: "claude-cli", mode: "oauth" },
+          },
+        },
+        agents: {
+          defaults: {
+            model: { primary: "anthropic/opus-4.7" },
+            models: {
+              "anthropic/opus-4.7": { params: { maxTokens: 1200 } },
+            },
+          },
+        },
+      },
+    } as never);
+
+    const models = requireRecord(next?.agents?.defaults?.models, "models");
+    expect(models["anthropic/opus-4.7"]).toEqual({ params: { maxTokens: 1200 } });
+    expect(models["anthropic/claude-opus-4-7"]).toBeUndefined();
+  });
+
+  it("backfills Claude CLI policy for unknown future Anthropic refs without guessing aliases", async () => {
+    const provider = await registerSingleProviderPlugin(anthropicPlugin);
+
+    const next = provider.applyConfigDefaults?.({
+      provider: "anthropic",
+      env: {},
+      config: {
+        auth: {
+          profiles: {
+            "anthropic:claude-cli": { provider: "claude-cli", mode: "oauth" },
+          },
+        },
+        agents: {
+          defaults: {
+            agentRuntime: { id: "claude-cli" },
+            model: { primary: "anthropic/opus-5.0" },
+            models: {
+              "anthropic/opus-5.0": { alias: "Future Opus" },
+            },
+          },
+        },
+      },
+    } as never);
+
+    const models = requireRecord(next?.agents?.defaults?.models, "models");
+    expect(models["anthropic/opus-5.0"]).toEqual({
+      alias: "Future Opus",
+      agentRuntime: { id: "claude-cli" },
+    });
+    expect(models["anthropic/claude-opus-5-0"]).toBeUndefined();
+  });
+
   it("resolves explicit claude-opus-4-7 refs from the 4.6 template family", async () => {
     const provider = await registerSingleProviderPlugin(anthropicPlugin);
     const resolved = provider.resolveDynamicModel?.({

src/agents/command/attempt-execution.cli.test.ts

@@ -1022,6 +1022,61 @@ describe("CLI attempt execution", () => {
     });
   });
 
+  it("routes provider-qualified Anthropic shorthand through the configured Claude CLI runtime", async () => {
+    const sessionKey = "agent:main:direct:shorthand-claude-cli";
+    const sessionEntry: SessionEntry = {
+      sessionId: "openclaw-session-shorthand-cli",
+      updatedAt: Date.now(),
+    };
+    const sessionStore: Record<string, SessionEntry> = { [sessionKey]: sessionEntry };
+    await fs.writeFile(storePath, JSON.stringify(sessionStore, null, 2), "utf-8");
+    runCliAgentMock.mockResolvedValueOnce(makeCliResult("shorthand cli"));
+
+    await runAgentAttempt({
+      providerOverride: "anthropic",
+      originalProvider: "anthropic",
+      modelOverride: "opus-4.7",
+      cfg: {
+        agents: {
+          defaults: {
+            models: {
+              "anthropic/opus-4.7": { agentRuntime: { id: "claude-cli" } },
+            },
+          },
+        },
+      } as OpenClawConfig,
+      sessionEntry,
+      sessionId: sessionEntry.sessionId,
+      sessionKey,
+      sessionAgentId: "main",
+      sessionFile: path.join(tmpDir, "session.jsonl"),
+      workspaceDir: tmpDir,
+      body: "route this",
+      isFallbackRetry: false,
+      resolvedThinkLevel: "medium",
+      timeoutMs: 1_000,
+      runId: "run-shorthand-claude-cli",
+      opts: { senderIsOwner: false } as Parameters<typeof runAgentAttempt>[0]["opts"],
+      runContext: {} as Parameters<typeof runAgentAttempt>[0]["runContext"],
+      spawnedBy: undefined,
+      messageChannel: "telegram",
+      skillsSnapshot: undefined,
+      resolvedVerboseLevel: undefined,
+      agentDir: tmpDir,
+      onAgentEvent: vi.fn(),
+      authProfileProvider: "anthropic",
+      sessionStore,
+      storePath,
+      sessionHasHistory: false,
+    });
+
+    expect(runEmbeddedPiAgentMock).not.toHaveBeenCalled();
+    expectMockArgFields(runCliAgentMock, {
+      provider: "claude-cli",
+      model: "opus-4.7",
+    });
+  });
+
   it("routes canonical OpenAI models through the configured embedded Codex runtime", async () => {
     const sessionKey = "agent:main:direct:canonical-codex-cli";
     const sessionEntry: SessionEntry = {

src/agents/command/attempt-execution.ts

@@ -434,6 +434,7 @@ export function runAgentAttempt(params: {
         cfg: params.cfg,
         agentId: params.sessionAgentId,
         modelId: params.modelOverride,
+        authProfileId: params.sessionEntry?.authProfileOverride,
       }) ?? params.providerOverride);
   const agentHarnessPolicy = isRawModelRun
     ? ({ runtime: "pi" } as const)

src/agents/model-runtime-aliases.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, it } from "vitest";
+import type { OpenClawConfig } from "../config/types.openclaw.js";
+import { resolveCliRuntimeExecutionProvider } from "./model-runtime-aliases.js";
+
+function createAnthropicAuthConfig(params: {
+  order?: string[];
+  models?: NonNullable<NonNullable<OpenClawConfig["agents"]>["defaults"]>["models"];
+}): OpenClawConfig {
+  return {
+    auth: {
+      order: params.order ? { anthropic: params.order } : undefined,
+      profiles: {
+        "anthropic:api": { provider: "anthropic", mode: "api_key" },
+        "anthropic:claude-cli": { provider: "claude-cli", mode: "oauth" },
+      },
+    },
+    agents: {
+      defaults: {
+        models: params.models,
+      },
+    },
+  } as OpenClawConfig;
+}
+
+describe("resolveCliRuntimeExecutionProvider", () => {
+  it("routes Anthropic execution to Claude CLI when the selected auth profile is Claude CLI", () => {
+    expect(
+      resolveCliRuntimeExecutionProvider({
+        cfg: createAnthropicAuthConfig({ order: ["anthropic:claude-cli"] }),
+        provider: "anthropic",
+        modelId: "opus-4.7",
+      }),
+    ).toBe("claude-cli");
+  });
+
+  it("keeps direct Anthropic execution when the selected auth profile is direct Anthropic", () => {
+    expect(
+      resolveCliRuntimeExecutionProvider({
+        cfg: createAnthropicAuthConfig({
+          order: ["anthropic:api", "anthropic:claude-cli"],
+        }),
+        provider: "anthropic",
+        modelId: "opus-4.7",
+      }),
+    ).toBeUndefined();
+  });
+
+  it("honors an explicit direct Anthropic auth profile over CLI auth order", () => {
+    expect(
+      resolveCliRuntimeExecutionProvider({
+        authProfileId: "anthropic:api",
+        cfg: createAnthropicAuthConfig({ order: ["anthropic:claude-cli"] }),
+        provider: "anthropic",
+        modelId: "opus-4.7",
+      }),
+    ).toBeUndefined();
+  });
+
+  it("uses an explicit Claude CLI auth profile without a model-runtime entry", () => {
+    expect(
+      resolveCliRuntimeExecutionProvider({
+        authProfileId: "anthropic:claude-cli",
+        cfg: createAnthropicAuthConfig({ order: ["anthropic:api"] }),
+        provider: "anthropic",
+        modelId: "opus-4.7",
+      }),
+    ).toBe("claude-cli");
+  });
+
+  it("does not override an explicit PI model-runtime policy with CLI auth", () => {
+    expect(
+      resolveCliRuntimeExecutionProvider({
+        cfg: createAnthropicAuthConfig({
+          order: ["anthropic:claude-cli"],
+          models: {
+            "anthropic/opus-4.7": { agentRuntime: { id: "pi" } },
+          },
+        }),
+        provider: "anthropic",
+        modelId: "opus-4.7",
+      }),
+    ).toBeUndefined();
+  });
+});

src/agents/model-runtime-aliases.ts

@@ -1,6 +1,7 @@
 import type { OpenClawConfig } from "../config/types.openclaw.js";
 import { normalizeStaticProviderModelId } from "./model-ref-shared.js";
 import { resolveModelRuntimePolicy } from "./model-runtime-policy.js";
+import { resolveProviderIdForAuth } from "./provider-auth-aliases.js";
 import { normalizeProviderId } from "./provider-id.js";
 
 type LegacyRuntimeModelProviderAlias = {
@@ -181,16 +182,93 @@ function resolveConfiguredRuntime(params: {
   }).policy?.id?.trim();
 }
 
+function resolveProfileRuntimeAlias(params: {
+  cfg?: OpenClawConfig;
+  provider: string;
+  profileId: string;
+}): string | undefined {
+  const profile = params.cfg?.auth?.profiles?.[params.profileId];
+  if (!profile?.provider) {
+    return undefined;
+  }
+  const provider = normalizeProviderId(params.provider);
+  const profileProvider = normalizeProviderId(profile.provider);
+  if (!provider || !profileProvider) {
+    return undefined;
+  }
+  const providerAuthKey = resolveProviderIdForAuth(provider, { config: params.cfg });
+  const profileAuthKey = resolveProviderIdForAuth(profileProvider, { config: params.cfg });
+  if (providerAuthKey !== profileAuthKey) {
+    return undefined;
+  }
+  return CLI_RUNTIME_BY_PROVIDER.get(`${provider}:${profileProvider}`)?.runtime;
+}
+
+function resolveCliRuntimeFromAuthProfile(params: {
+  cfg?: OpenClawConfig;
+  provider: string;
+  authProfileId?: string;
+}): string | undefined {
+  if (!params.cfg?.auth?.profiles) {
+    return undefined;
+  }
+  if (params.authProfileId?.trim()) {
+    return resolveProfileRuntimeAlias({
+      cfg: params.cfg,
+      provider: params.provider,
+      profileId: params.authProfileId.trim(),
+    });
+  }
+
+  const provider = normalizeProviderId(params.provider);
+  const providerAuthKey = resolveProviderIdForAuth(provider, { config: params.cfg });
+  const orderedProfileIds = [
+    ...(params.cfg.auth.order?.[providerAuthKey] ?? []),
+    ...(providerAuthKey === provider ? [] : (params.cfg.auth.order?.[provider] ?? [])),
+  ];
+  for (const profileId of orderedProfileIds) {
+    const profile = params.cfg.auth.profiles[profileId];
+    if (!profile?.provider) {
+      continue;
+    }
+    const profileAuthKey = resolveProviderIdForAuth(profile.provider, { config: params.cfg });
+    if (profileAuthKey !== providerAuthKey) {
+      continue;
+    }
+    return resolveProfileRuntimeAlias({ cfg: params.cfg, provider, profileId });
+  }
+
+  const compatibleProfileIds = Object.entries(params.cfg.auth.profiles)
+    .filter(([, profile]) => {
+      if (!profile?.provider) {
+        return false;
+      }
+      return resolveProviderIdForAuth(profile.provider, { config: params.cfg }) === providerAuthKey;
+    })
+    .map(([profileId]) => profileId);
+  if (compatibleProfileIds.length !== 1) {
+    return undefined;
+  }
+  const [profileId] = compatibleProfileIds;
+  return profileId
+    ? resolveProfileRuntimeAlias({ cfg: params.cfg, provider, profileId })
+    : undefined;
+}
+
 export function resolveCliRuntimeExecutionProvider(params: {
   provider: string;
   cfg?: OpenClawConfig;
   agentId?: string;
   modelId?: string;
+  authProfileId?: string;
 }): string | undefined {
   const provider = normalizeProviderId(params.provider);
   const runtime = resolveConfiguredRuntime({ ...params, provider });
-  if (!runtime || runtime === "auto" || runtime === "pi") {
+  if (runtime === "pi") {
     return undefined;
   }
+  if (!runtime || runtime === "auto") {
+    return resolveCliRuntimeFromAuthProfile({ ...params, provider });
+  }
   return CLI_RUNTIME_BY_PROVIDER.get(`${provider}:${runtime}`)?.runtime;
 }

src/auto-reply/reply/agent-runner-execution.ts

@@ -1616,6 +1616,9 @@ export async function runAgentTurnWithFallback(params: {
             provider,
             entry: params.getActiveSessionEntry(),
           });
+          const selectedAuthProfile = resolveRunAuthProfile(candidateRun, provider, {
+            config: runtimeConfig,
+          });
           const cliExecutionProvider =
             sessionRuntimeOverride === "pi"
               ? provider
@@ -1627,6 +1630,7 @@ export async function runAgentTurnWithFallback(params: {
                   cfg: runtimeConfig,
                   agentId: params.followupRun.run.agentId,
                   modelId: model,
+                  authProfileId: selectedAuthProfile.authProfileId,
                 }) ??
                 provider);
 

src/auto-reply/reply/followup-runner.ts

@@ -569,7 +569,7 @@ export function createFollowupRunner(params: {
                 sessionKey: replySessionKey,
               });
             }
-            const authProfile = resolveRunAuthProfile(candidateRun, provider, {
+            const selectedAuthProfile = resolveRunAuthProfile(candidateRun, provider, {
               config: runtimeConfig,
             });
             const sessionRuntimeOverride = resolveSessionRuntimeOverrideForProvider({
@@ -587,6 +587,7 @@ export function createFollowupRunner(params: {
                     cfg: runtimeConfig,
                     agentId: run.agentId,
                     modelId: model,
+                    authProfileId: selectedAuthProfile.authProfileId,
                   }) ??
                   provider);
             let attemptCompactionCount = 0;
@@ -733,7 +734,7 @@ export function createFollowupRunner(params: {
                 allowEmptyAssistantReplyAsSilent: run.allowEmptyAssistantReplyAsSilent,
                 provider,
                 model,
-                ...authProfile,
+                ...selectedAuthProfile,
                 thinkLevel: run.thinkLevel,
                 verboseLevel: run.verboseLevel,
                 reasoningLevel: run.reasoningLevel,

src/config/config.pruning-defaults.test.ts

@@ -44,6 +44,33 @@ describe("config pruning defaults", () => {
     expectAnthropicPruningDefaults(cfg, "1h");
   });
 
+  it("backfills raw and canonical Claude CLI policies for selected Anthropic CLI auth", () => {
+    const cfg = applyAnthropicDefaultsForTest({
+      auth: {
+        order: { anthropic: ["anthropic:claude-cli"] },
+        profiles: {
+          "anthropic:claude-cli": { provider: "claude-cli", mode: "oauth" },
+        },
+      },
+      agents: {
+        defaults: {
+          model: { primary: "anthropic/opus-4.7" },
+          models: {
+            "anthropic/opus-4.7": { params: { maxTokens: 1200 } },
+          },
+        },
+      },
+    });
+
+    expect(cfg.agents?.defaults?.models?.["anthropic/opus-4.7"]).toEqual({
+      params: { maxTokens: 1200 },
+      agentRuntime: { id: "claude-cli" },
+    });
+    expect(cfg.agents?.defaults?.models?.["anthropic/claude-opus-4-7"]).toEqual({
+      agentRuntime: { id: "claude-cli" },
+    });
+  });
+
   it("enables cache-ttl pruning + 1h cache TTL for Anthropic API keys", () => {
     const cfg = applyAnthropicDefaultsForTest({
       auth: {