fix: honest Claude connect + 'aios claude-login' (the OAuth step the button was missing)

'Connected but doesn't work' was because the button only pointed the hub at claude-code-api —
it never logged the Claude CLI into the Pro/Max account (that's the browser+code OAuth flow).

- /api/claude_connect now runs a real test completion and reports logged_in true/false with a
  clear instruction instead of a false 'connected'.
- New 'aios claude-login' command: runs the Claude Code CLI login (claude / claude setup-token)
  — the browser OAuth for your subscription. --token uses setup-token for a long-lived token.
- Settings card + connectClaude() now say the login happens in the terminal (aios claude-login),
  then the button routes everything through it.

Verified on Windows: claude_connect returns logged_in:false with the guidance (CLI not logged in);
'aios claude-login' registered and parses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ZD Studios

README.md

@@ -166,7 +166,7 @@ Plus two integrations that glue it together:
 - **✦ Team** — one assistant that orchestrates the whole team: the Brain plans, delegates subtasks to the specialist agents, and synthesizes one answer (the practical "merge").
 - **Configure openclaw AND hermes fully inside the hub** — both control-UIs are embedded via frame-stripping proxies, so you get channels, **connectors**, model providers, **MCP servers**, skills, plugins, **automations/cron**, and sessions right in the hub (they normally block embedding).
 - **Automations** — schedule prompts to run against any agent every N minutes (daily digests, checks).
-- **Connect your Claude account (Pro/Max)** — one click in **Settings** points the Brain/Team/crews at **claude-code** (your Claude subscription, no API key or per-token cost) and auto-configures everything.
+- **Connect your Claude account (Pro/Max)** — first run `aios claude-login` (opens the browser OAuth for your subscription), then one click in **Settings → "Use my Claude subscription"** routes the Brain/Team/crews through **claude-code** (no API key, no per-token cost). The button tests a real completion and tells you if you still need to log in.
 - **Settings** — edit provider/key/model, channel tokens, and `aios.config.yaml`; it re-renders into every agent, no terminal needed.
 - **Themes** — Light, Dark, Midnight, Slate, Rose. Chat renders markdown (headers, bullets, code blocks).
 

aios.py

@@ -1650,6 +1650,24 @@ def cmd_install_cli(args):
         install_cli()
 
 
+def cmd_claude_login(args):
+    """Log the Claude Code CLI into your Pro/Max account (OAuth browser + code)."""
+    claude = shutil.which("claude") or shutil.which("claude.cmd")
+    if not claude:
+        die("`claude` CLI not found. It ships with claude-code-api / Claude Code — install it, "
+            "then re-run.  (npm i -g @anthropic-ai/claude-code)")
+    head("Claude login (Pro / Max)")
+    say(f"{C.GRY}This opens your browser to authorize your Claude subscription. "
+        f"Approve it (or paste the code back here).{C.R}\n")
+    sub = "setup-token" if getattr(args, "token", False) else None
+    cmd = [claude, sub] if sub else [claude]
+    try:
+        subprocess.run(cmd)
+    except KeyboardInterrupt:
+        pass
+    say(f"\n{C.B}Done? Restart so agents pick up the login:{C.R} aios restart claudecode hub")
+
+
 def cmd_url(args):
     _print_urls(load_config())
 
@@ -1785,6 +1803,10 @@ def build_parser():
     s.add_argument("action", nargs="?", choices=["install", "uninstall"], default="install")
     s.set_defaults(func=cmd_install_cli)
 
+    s = sub.add_parser("claude-login", help="log the Claude Code CLI into your Pro/Max account")
+    s.add_argument("--token", action="store_true", help="use `claude setup-token` (long-lived token)")
+    s.set_defaults(func=cmd_claude_login)
+
     sub.add_parser("url", help="print dashboard URLs").set_defaults(func=cmd_url)
     sub.add_parser("wire", help="(re)install the openclaw-os plugin into openclaw").set_defaults(func=cmd_wire)
     return p

aios_hub.py

@@ -423,8 +423,25 @@ def do_POST(self):
                 "AIOS_DEFAULT_MODEL": model,
             })
             run_aios("setup", "--non-interactive", "--skip-tools", "--skip-install", "--skip-wire")
-            self._send(200, {"ok": True, "model": model, "reachable": authed,
-                             "note": "" if authed else "claude-code-api didn't answer — start it (`aios start claudecode`) and run `claude` once to log into your Pro/Max account."})
+            # Actually try a tiny completion — this reveals whether the `claude` CLI is logged in.
+            logged_in, detail = False, ""
+            if authed:
+                try:
+                    b = json.dumps({"model": model, "messages": [{"role": "user", "content": "hi"}],
+                                    "max_tokens": 5}).encode()
+                    rq = urllib.request.Request(CLAUDECODE + "/v1/chat/completions", data=b, method="POST",
+                                                headers={"Content-Type": "application/json",
+                                                         "Authorization": "Bearer sk-aios-claudecode"})
+                    urllib.request.urlopen(rq, timeout=45)
+                    logged_in = True
+                except Exception as e:
+                    detail = str(e)[:160]
+            self._send(200, {
+                "ok": True, "model": model, "reachable": authed, "logged_in": logged_in,
+                "note": ("Connected — your Claude subscription is working." if logged_in else
+                         "Pointed at claude-code, but the Claude CLI isn't logged in yet. Run "
+                         "`aios claude-login` (or `claude setup-token`) in a terminal to authorize your "
+                         "Pro/Max account, then chat.")})
         elif self.path == "/api/schedules":
             items = load_schedules()
             op = payload.get("op", "add")

docs/dashboard.html

@@ -239,7 +239,7 @@ <h3>🔗 Connect your Claude account (Pro / Max)</h3>
           <p>Use your Claude subscription for the Brain, Team and crews — routed through <b>claude-code</b>,
              no API key or per-token cost. One click points everything at it and re-renders.</p>
           <div class="row"><button class="btn primary" onclick="connectClaude()">Use my Claude subscription</button><span id="claudeMsg" class="kv"></span></div>
-          <p class="mono" style="font-size:.76rem;color:var(--text3);margin-top:12px">First time? run <b>claude</b> once in a terminal to log in to your Pro/Max account, then click above.</p>
+          <p style="font-size:.8rem;color:var(--text3);margin-top:12px"><b>The login happens in your terminal, not here.</b> First run <span class="mono" style="color:var(--accent-strong)">aios claude-login</span> — it opens your browser to authorize your Pro/Max account (or paste a code). Then click the button above to route everything through it.</p>
         </div>
         <div class="card">
           <h3>🔑 Model provider</h3>
@@ -378,8 +378,8 @@ <h3>${ICON[key]} ${key} <span class="badge ${up?'up':'down'}">${up?'running':'st
   async function connectClaude(){
     document.getElementById('claudeMsg').innerHTML='<span class="spin"></span> connecting…';
     try{const r=await(await fetch('/api/claude_connect',{method:'POST',headers:{'Content-Type':'application/json'},body:'{}'})).json();
-      document.getElementById('claudeMsg').textContent=r.reachable?('connected — model '+r.model+'. Restart agents to apply.'):(r.note||'set, but claude-code-api not reachable');
-      toast(r.reachable?'Connected to your Claude account':'Saved — start claude-code + run `claude` to log in');loadSettings();
+      document.getElementById('claudeMsg').textContent=r.note||(r.logged_in?'connected':'needs login');
+      toast(r.logged_in?'Connected — your Claude subscription works ✓':'Run  aios claude-login  first to log in');loadSettings();
     }catch(e){document.getElementById('claudeMsg').textContent='failed: '+e;}
   }
   async function saveChannels(){