#22105: feat(auth): add refreshable Anthropic OAuth login flow

## Summary - add a first-class Anthropic OAuth login helper (`loginAnthropicOAuth`) that stores refreshable `type: "oauth"` credentials - expose Anthropic OAuth in `openclaw models auth add` as `oauth (refreshable)` - allow `openclaw models auth login --provider anthropic` to work without provider plugins by routing to the built-in Anthropic OAuth flow - add a new onboarding auth choice `anthropic-oauth` and wire it through Anthropic auth application - surface the new option in auth-choice groups/options and add an e2e assertion ## Why Today Anthropic auth in OpenClaw primarily routes users through `setup-token`, which stores static bearer tokens (`type: "token"`) and cannot auto-refresh. This PR adds an explicit OAuth path so users can obtain refreshable credentials (`access + refresh + expires`) and avoid repeated manual token pastes. ## Testing - `pnpm -s vitest run --config vitest.e2e.config.ts src/commands/auth-choice-options.e2e.test.ts src/commands/onboard-auth.e2e.test.ts src/commands/onboard-non-interactive.provider-auth.e2e.test.ts` - `pnpm -s vitest run src/commands/models.list.auth-sync.test.ts` - `pnpm -s oxlint --type-aware src/commands/anthropic-oauth.ts src/commands/auth-choice.apply.anthropic.ts src/commands/auth-choice-options.ts src/commands/onboard-types.ts src/commands/models/auth.ts src/cli/models-cli.ts src/commands/auth-choice-options.e2e.test.ts` - `pnpm -s tsgo` ## Local Validation - `pnpm build` ✅ - `pnpm check` ✅ - `pnpm test` ➖ (targeted command/e2e runs listed above; full matrix covered by CI) ## AI-Assisted This PR was developed with AI assistance. <!-- greptile_comment --> <h3>Greptile Summary</h3> Adds first-class Anthropic OAuth support with auto-refreshable credentials, replacing the previous static token flow. The implementation introduces a new `loginAnthropicOAuth` helper, exposes OAuth as a choice in onboarding and `models auth` commands, and properly stores credentials via the existing `writeOAuthCredentials` infrastructure. **Major changes:** - New `anthropic-oauth.ts` module handles the OAuth flow with VPS/remote environment support - `models auth add` and `models auth login` now offer OAuth as the primary method for Anthropic - Auth choice UI updated to prioritize "OAuth (refreshable)" over static tokens - OAuth credentials sync across sibling agents when enabled - Full e2e test coverage for the new auth option **Implementation quality:** - Follows existing OAuth patterns (similar to OpenAI Codex and Chutes flows) - Proper error handling with user-friendly help messages - Remote/VPS detection correctly applied - All tests passing with new assertions confirming OAuth option availability <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk - The implementation follows established patterns in the codebase (similar to OpenAI Codex and Chutes OAuth flows), includes comprehensive test coverage with passing e2e tests, and properly integrates with existing credential storage infrastructure. The code quality is high with appropriate error handling, user-friendly messaging, and remote environment detection. No security vulnerabilities or logical errors were identified. - No files require special attention _{Last reviewed commit: 5ac3ca7} <!-- greptile_other_comments_section --> <!-- /greptile_comment -->