@byokit/openclaw 0.11.1 → 0.13.0

package/dist/link.js

@@ -24,29 +24,32 @@ const isRecord = (value) => typeof value === 'object' && value !== null && !Arra
 const browserTag = (event) => event === 'byokit.browser';
 const browserEvent = (event, payload) => event === 'byokit.browser' && isRecord(payload) && typeof payload.member === 'string'
     && (payload.kind === 'state' || payload.kind === 'signin');
-const memberKey = (member, sessionKey) => sessionKey.startsWith(`agent:${member}:`);
-function memberSessions(result, member) {
+function memberSessions(result, owns) {
     const rows = Array.isArray(result) ? result : isRecord(result) && Array.isArray(result.sessions) ? result.sessions : [];
-    return rows.filter((row) => isRecord(row) && typeof row.sessionKey === 'string' && memberKey(member, row.sessionKey));
+    return rows.filter((row) => isRecord(row) && typeof row.sessionKey === 'string' && owns(row.sessionKey));
 }
 /** `oc.run`'s run options, type-checked; the kit's own checks (account, tool names) still apply. */
 function runOptions(args) {
-    const { message, model, auth, system, images, thinking, tools, schema } = args;
+    const { message, model, account, needs, auth, system, images, thinking, tools, schema } = args;
     const ok = typeof message === 'string'
         && (model === undefined || typeof model === 'string')
+        && (account === undefined || typeof account === 'string')
+        && (needs === undefined || (Array.isArray(needs) && needs.every((n) => typeof n === 'string')))
         && (auth === undefined || auth === 'apiKey')
         && (system === undefined || typeof system === 'string')
         && (images === undefined || (Array.isArray(images) && images.every((i) => isRecord(i) && typeof i.data === 'string' && typeof i.mimeType === 'string')))
         && (thinking === undefined || (typeof thinking === 'string' && THINKING.has(thinking)))
         && (tools === undefined || (Array.isArray(tools) && tools.every((t) => typeof t === 'string')));
     if (!ok)
-        throw new Error('oc.run needs { message, sessionKey?, model?, auth?, system?, images?, thinking?, tools?, schema? }');
+        throw new Error('oc.run needs { message, sessionKey?, model?, account?, needs?, auth?, system?, images?, thinking?, tools?, schema? }');
     if (schema !== undefined)
         outputSchema(schema);
     return {
         message: message,
         ...(schema === undefined ? {} : { schema: schema }),
         ...(model === undefined ? {} : { model: model }),
+        ...(account === undefined ? {} : { account: account }),
+        ...(needs === undefined ? {} : { needs: [...needs] }),
         ...(auth === undefined ? {} : { auth: 'apiKey' }),
         ...(system === undefined ? {} : { system: system }),
         ...(images === undefined ? {} : { images: images
@@ -74,6 +77,7 @@ function browserInput(value) {
 }
 export function openclawLink(kit, o) {
     const passThrough = o.passThrough ?? (() => false);
+    const memberKey = (member, sessionKey) => kit.memberOf(sessionKey) === member;
     // The host lifecycle extension is supplied by the browser host. Without it control fails closed.
     const browser = () => {
         if (!kit.browser)
@@ -120,10 +124,14 @@ export function openclawLink(kit, o) {
         if (grant.expires !== undefined) {
             const timer = setTimeout(() => {
                 const current = seen.get(grant.id);
-                if (current?.expires !== undefined && current.expires > Date.now())
-                    memberOf(current);
-                else
-                    void revoke(grant.id).catch(() => { });
+                if (current?.expires !== undefined && current.expires > Date.now()) {
+                    try {
+                        memberOf(current);
+                        return;
+                    }
+                    catch { /* refused at the boundary: revoke below, never throw from a timer */ }
+                }
+                void revoke(grant.id).catch(() => { });
             }, Math.min(grant.expires - Date.now(), 2 ** 31 - 1));
             timer.unref();
             expiry.set(grant.id, timer);
@@ -355,7 +363,7 @@ export function openclawLink(kit, o) {
             }
             case 'oc.sessions': {
                 const result = await kit.call('sessions.list', {});
-                return memberSessions(result, member);
+                return memberSessions(result, (key) => memberKey(member, key));
             }
             case 'oc.steer': {
                 if (typeof args.sessionKey !== 'string' || typeof args.text !== 'string' || (args.auth !== undefined && args.auth !== 'apiKey'))
@@ -584,9 +592,11 @@ export function openclawLink(kit, o) {
                         void s.write(`${JSON.stringify({ event: 'byokit.browser', payload: { member, kind: record.kind } })}\n`).catch(() => { });
                     return;
                 }
+                // Attribution (5.15): an `<member>--<hex6>` account agent's events are the member's.
                 const agent = record?.agentId;
                 const key = record?.sessionKey;
-                if (agent !== member && !(typeof key === 'string' && memberKey(member, key)))
+                if (!(typeof agent === 'string' && kit.memberOf(agent) === member)
+                    && !(typeof key === 'string' && memberKey(member, key)))
                     return;
                 void s.write(`${JSON.stringify({ event, payload })}\n`).catch(() => { });
             });

package/dist/routes.d.ts

@@ -17,5 +17,6 @@ export type RouteView = Route & {
 export declare function routes(facts?: RouteFacts): RouteView[];
 /** Retain explicit legacy selectors alongside corrected discovery metadata. A native CLI selector still
  * reaches engine detection (which checks its own login); it does not make an unavailable route default.
+ * An offered plan key is served whichever way was asked: it is always the pasted key.
  * API billing is never picked as a fallback. */
 export declare function routeFor(provider: string, via: 'browser' | 'code'): Route | undefined;

package/dist/routes.js

@@ -41,9 +41,11 @@ export function routes(facts = {}) {
 }
 /** Retain explicit legacy selectors alongside corrected discovery metadata. A native CLI selector still
  * reaches engine detection (which checks its own login); it does not make an unavailable route default.
+ * An offered plan key is served whichever way was asked: it is always the pasted key.
  * API billing is never picked as a fallback. */
 export function routeFor(provider, via) {
-    return table.find(route => route.billing === 'subscription' && route.offerPolicy === 'default'
-        && ((route.offer && route.provider === provider && route.via === via)
-            || (route.legacy?.provider === provider && route.legacy.via === via)));
+    const served = table.filter(route => route.billing === 'subscription' && route.offerPolicy === 'default');
+    return served.find(route => (route.offer && route.provider === provider && route.via === via)
+        || (route.legacy?.provider === provider && route.legacy.via === via))
+        ?? served.find(route => route.offer && route.provider === provider && route.keyEntry);
 }

package/dist/routes.json

@@ -8,7 +8,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Alibaba Model Studio: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/alibaba/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -33,7 +33,7 @@
             "id": "alibaba",
             "method": "api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -176,7 +176,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "The pinned Gateway has no app-guided sign-in for this choice.",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/anthropic/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -610,7 +610,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "ClawRouter: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/clawrouter/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -635,7 +635,7 @@
             "id": "clawrouter",
             "method": "api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -647,7 +647,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Cloudflare AI Gateway: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/cloudflare-ai-gateway/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -681,7 +681,7 @@
             "id": "cloudflare-ai-gateway",
             "method": "api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -739,7 +739,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "ComfyUI: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/comfy/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -773,7 +773,7 @@
             "id": "comfy",
             "method": "cloud-api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -785,7 +785,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Billing must be supplied by the host; a server address does not determine billing.",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/copilot-proxy/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -807,7 +807,7 @@
             "id": "copilot-proxy",
             "method": "local",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -911,7 +911,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "fal: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/fal/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -936,7 +936,7 @@
             "id": "fal",
             "method": "api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -1585,7 +1585,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "LongCat: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/longcat/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -1619,7 +1619,7 @@
             "id": "longcat",
             "method": "api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -1677,7 +1677,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Microsoft Foundry: Cloud credentials (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/microsoft-foundry/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -1699,7 +1699,7 @@
             "id": "microsoft-foundry",
             "method": "entra-id",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -1711,7 +1711,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Microsoft Foundry: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/microsoft-foundry/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -1736,7 +1736,7 @@
             "id": "microsoft-foundry",
             "method": "api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -2458,7 +2458,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "PixVerse: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/pixverse/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -2492,7 +2492,7 @@
             "id": "pixverse",
             "method": "api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -2838,7 +2838,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Runway: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/runway/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -2863,7 +2863,7 @@
             "id": "runway",
             "method": "api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -2875,7 +2875,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Local runtime; explicitly select this route.",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/sglang/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -2897,7 +2897,7 @@
             "id": "sglang",
             "method": "custom",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -3360,7 +3360,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Local runtime; explicitly select this route.",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/vllm/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -3382,7 +3382,7 @@
             "id": "vllm",
             "method": "custom",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -3440,7 +3440,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Vydra: API key (billed per use).",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "extensions/vydra/openclaw.plugin.json (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -3474,7 +3474,7 @@
             "id": "vydra",
             "method": "api-key",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     },
     {
@@ -4005,7 +4005,7 @@
         "prerequisite": null,
         "offer": false,
         "offerPolicy": "explicit",
-        "reason": "Billing must be supplied by the host; a server address does not determine billing.",
+        "reason": "The pinned Gateway has no app-guided setup for this choice.",
         "source": "src/commands/auth-choice-options.static.ts (2026.8.1)",
         "revision": "2026.8.1",
         "checked": "2026-10-02",
@@ -4030,7 +4030,7 @@
             "id": "custom",
             "method": "custom",
             "revision": "ea806575e6450e4d1efdfc72c19f04be982a1b9b",
-            "flow": "present"
+            "flow": "absent"
         }
     }
 ]

package/dist/runs.d.ts

@@ -20,7 +20,7 @@ export declare function createRuns(ctx: {
     }>;
     bridge: Pick<Bridge, 'register'>;
     tools: ReadonlySet<string>;
-    accounts?: Pick<ReturnType<typeof createAccounts>, 'pick' | 'rest'>;
+    accounts?: Pick<ReturnType<typeof createAccounts>, 'bind' | 'keyRefusal' | 'pick' | 'rest'>;
     locks?: ReturnType<typeof createLocks>;
     routes: Map<string, {
         session: string;

package/dist/runs.js

@@ -90,8 +90,9 @@ export function createRuns(ctx) {
         return { ok: false, ...classified, message };
     };
     const run = async (spec, on, keyAgent, preparedOutput) => {
-        // Member boundary first: a member never speaks in another member's session, refused before any request.
-        if (!spec.sessionKey.startsWith(`agent:${spec.member}:`))
+        // Member boundary first: a member never speaks in another member's session, refused before any request. A key
+        // of one of the member's account agents is the member's too; binding below checks the index names it.
+        if (!spec.sessionKey.startsWith(`agent:${spec.member}:`) && !(ctx.accounts && !keyAgent && spec.sessionKey.startsWith(`agent:${spec.member}--`)))
             throw new Error(`refused: "${spec.sessionKey}" is not a session of member "${spec.member}"`);
         // Same validation as the pin's NonEmptyString; preserve the caller's bytes (including whitespace).
         if (spec.idempotencyKey !== undefined && (typeof spec.idempotencyKey !== 'string' || !spec.idempotencyKey.length))
@@ -105,11 +106,29 @@ export function createRuns(ctx) {
         for (const tool of spec.tools ?? [])
             if (!ctx.tools.has(tool))
                 throw new Error(`refused: "${tool}" is not one of this kit's tools`);
-        const tail = spec.sessionKey.slice(`agent:${spec.member}:`.length);
-        // Runs step 3 (5.15): with `account` and `needs` both absent, exactly the run on the member agent it always was.
-        if (spec.account === undefined && !spec.needs?.length) {
-            const agentId = keyAgent ?? (await ctx.ensure(spec.member)).agentId;
-            return start(spec, on, { agentId, sessionKey: keyAgent ? `agent:${keyAgent}:${tail}` : spec.sessionKey, idempotencyKey, system, picked, output });
+        const tail = spec.sessionKey.slice(spec.sessionKey.indexOf(':', 'agent:'.length) + 1);
+        // Runs step 1 (5.15): every run first finds the account its session is bound to, the API-key lane included.
+        const binding = ctx.accounts ? await ctx.accounts.bind(spec.member, spec.sessionKey) : undefined;
+        // Step 2 on the API-key lane: only an API-billed conversation continues on its key; any other binding is refused.
+        if (keyAgent && ctx.accounts && binding) {
+            const message = await ctx.accounts.keyRefusal(spec.member, binding);
+            if (message !== undefined)
+                return { ok: false, kind: 'other', message };
+        }
+        // A run that waited for its agent's lock across a move (5.15) binds again under it: a changed binding means its
+        // session went to another account, so it ends before any event and the caller's retry lands there.
+        const moved = async () => !!binding && (await ctx.accounts.bind(spec.member, spec.sessionKey))?.agentId !== binding.agentId;
+        const movedEnd = { ok: false, kind: 'other', message: words('run.moved') };
+        // Step 3: with `account` and `needs` both absent, on a key no account agent holds (or an API-key run, whose
+        // binding is API-billed), exactly the run on the agent it always was (a bound key under its shared lock).
+        if ((keyAgent || binding?.id === undefined) && spec.account === undefined && !spec.needs?.length) {
+            if (keyAgent)
+                return start(spec, on, { agentId: keyAgent, sessionKey: `agent:${keyAgent}:${tail}`, idempotencyKey, system, picked, output });
+            const { agentId } = await ctx.ensure(spec.member);
+            const member = () => start(spec, on, { agentId, sessionKey: spec.sessionKey, idempotencyKey, system, picked, output });
+            if (!binding || !ctx.locks)
+                return member();
+            return ctx.locks.shared(agentId, async () => await moved() ? movedEnd : member());
         }
         if (keyAgent)
             throw new Error('refused: an API-key run uses its own account');
@@ -125,9 +144,10 @@ export function createRuns(ctx) {
         const signedIn = async (agentId, provider) => !!(await ctx.request('byokit.accounts', { action: 'ready', agentId, provider })).ok;
         const skipped = [];
         for (;;) {
-            // Step 4: the selection is resolved once per attempt, before any request; `needs` alone resolves as 'default'.
+            // Steps 2 and 4: the selection is resolved once per attempt, before any request, narrowed by the binding; `needs`
+            // alone resolves as 'default'. A refusal (`bound`, `paid`) ends the run with its words before any room, model or agent request.
             const { pick, agent } = await accounts.pick(spec.member, { account: spec.account ?? 'default',
-                ...(spec.model !== undefined ? { model: spec.model } : {}), ...(spec.needs ? { needs: spec.needs } : {}) }, skipped);
+                ...(spec.model !== undefined ? { model: spec.model } : {}), ...(spec.needs ? { needs: spec.needs } : {}) }, skipped, binding);
             if (!pick.ok) {
                 if (pick.code === 'unknown_account')
                     throw new Error(`unknown account: ${spec.account}`); // a caller bug
@@ -137,10 +157,12 @@ export function createRuns(ctx) {
             }
             const sessionKey = `agent:${agent}:${tail}`;
             const automatic = pick.how === 'auto' || pick.why === 'first_ready';
-            // An unbound key runs on the picked account's agent, under the app key's tail. The run holds the agent's shared
+            // The run goes to the picked account's agent, under the key's tail. The run holds the agent's shared
             // lock from its ready check to its end. An automatic pick not signed in is skipped before any event; an explicit
             // one announces itself, then ends signed-out.
             const end = await locks.shared(agent, async () => {
+                if (await moved())
+                    return movedEnd;
                 let ready;
                 try {
                     ready = await signedIn(agent, pick.account.provider);

package/dist/signin.d.ts

@@ -8,6 +8,8 @@ export type SignInCtx = {
     }>;
     callbackPort: number;
     onDisconnect?(fn: () => void): () => void;
+    authConfig(): string;
+    restarted(authBefore: string | undefined, signal?: AbortSignal): Promise<boolean>;
     fresh?: boolean;
 };
 /**

package/dist/signin.js

@@ -2,7 +2,9 @@
 // sign-in; OAuth credentials stay in the engine/CLI. Explicit API keys go only to engine activation (D11).
 import { randomUUID } from 'node:crypto';
 import { createServer } from 'node:http';
+import { activate, LATE_RESTART } from "./activation.js";
 import { authStatus } from "./auth-status.js";
+import { routes } from "./routes.js";
 import { signedInProviders } from "./runs.js";
 import { words } from "./words.js";
 // The pin's wizard contract (2026.8.1): steps arrive only from `wizard.next` (wizard.status answers {status, error}
@@ -15,6 +17,8 @@ const CANCEL_MS = 10_000;
 const RECONFIRM_MS = 60_000;
 const TURNS = 200;
 const PASTE_MS = 15 * 60_000;
+const KEY_UNAVAILABLE = 'This key type is not available on this engine.';
+const KEY_FAILED = 'API key activation failed';
 // Two of the pin's code routes print their code only into a note's text ("Code: X" with
 // "Code expires in N minutes", or "enter the code X." with "Expires at: <ISO>"), never as `deviceCode`.
 // Read it back so every code route reaches the caller in the one structured shape.
@@ -58,6 +62,7 @@ export function signIn(ctx, member, o, on) {
     let settleStart;
     const startingSettled = new Promise((resolve) => { settleStart = resolve; });
     let over = false;
+    let activating = false;
     let recovering = false;
     let offDisconnect;
     let agentId;
@@ -92,13 +97,21 @@ export function signIn(ctx, member, o, on) {
     let pasteIn;
     let returned;
     // Once a secret step is seen, no later gateway prose, link or code is safe to display.
-    let sensitive = o.authChoice === 'setup-token' || o.authChoice === 'apiKey';
-    const secretFailure = () => o.authChoice === 'apiKey' ? 'API key activation failed' : 'Sign-in failed. Try again.';
+    let sensitive = o.authChoice === 'setup-token';
+    const secretFailure = 'Sign-in failed. Try again.';
+    // A pasted key is scrubbed from every failure on top of the engine's own redaction.
+    const keyRoute = routes().find((r) => r.choice === o.authChoice && r.keyEntry);
+    let secret;
+    const clean = (value) => {
+        const text = value instanceof Error ? value.message : String(value);
+        return cut(secret ? text.split(secret).join('…') : text);
+    };
+    const keyFailed = (status) => status === 'unavailable' ? KEY_UNAVAILABLE : KEY_FAILED;
     const done = new Promise((resolve) => { settle = resolve; });
     const say = (v) => {
         if (!over && !recovering && !signal.aborted)
             on({ state: 'waiting', via, ...(sensitive
-                    ? { ...(v.prompt ? { prompt: v.prompt } : {}), ...(v.error ? { error: secretFailure() } : {}) }
+                    ? { ...(v.prompt ? { prompt: v.prompt } : {}), ...(v.error ? { error: secretFailure } : {}) }
                     : v) });
     };
     const closeCallback = async () => {
@@ -119,7 +132,7 @@ export function signIn(ctx, member, o, on) {
         pasteIn = undefined;
         await closeCallback();
         if (sensitive && view.state === 'failed' && view.why === 'failed')
-            view = { ...view, error: secretFailure() };
+            view = { ...view, error: secretFailure };
         on(view);
         settle(view);
     };
@@ -144,11 +157,13 @@ export function signIn(ctx, member, o, on) {
     };
     const cancel = () => {
         // Stop the drive now; the start itself is never aborted, and release waits for it to settle before cancelling,
-        // so the gateway's one setup admission is freed by a cancel that the engine can actually find.
+        // so the gateway's one setup admission is freed by a cancel that the engine can actually find. An activation in
+        // flight is not finished here: the drive returns once the engine answers, so cleanup follows the engine's answer.
         if (signal.aborted)
             return;
         owner.abort();
-        void (async () => { await release(); await finish(cancelled()); })();
+        void (async () => { await release(); if (!activating)
+            await finish(cancelled()); })();
     };
     o.signal?.addEventListener('abort', cancel, { once: true });
     if (o.signal?.aborted)
@@ -198,7 +213,9 @@ export function signIn(ctx, member, o, on) {
         }
         // Native login is completed by the person in unmodified Claude Code. The pin does not expose this
         // choice via auth.start; activation verifies the CLI route and persists it only after a live test succeeds.
-        if (o.authChoice === 'anthropic-cli' || o.authChoice === 'apiKey') {
+        // A key-entry choice (API key or plan key) is not an auth.start login either: the pin's Gateway sets it up only
+        // from the pasted key through typed activation, and refuses it there ("provider setup is not available").
+        if (o.authChoice === 'anthropic-cli' || keyRoute) {
             settleStart();
             let apiKey;
             if (o.authChoice === 'anthropic-cli') {
@@ -207,7 +224,7 @@ export function signIn(ctx, member, o, on) {
                     return { state: 'failed', via, why: 'failed', error: 'Sign in with Claude Code on this machine in the kit’s isolated HOME, then try again. The login stays in Claude Code.' };
             }
             else {
-                say({ prompt: 'API key (billed per use)' });
+                say({ prompt: keyRoute?.billing === 'api' ? 'API key (billed per use)' : 'Plan key' });
                 apiKey = returned ?? await new Promise((resolve) => {
                     const stop = (value) => { clearTimeout(timer); signal.removeEventListener('abort', abort); pasteIn = undefined; resolve(value); };
                     const abort = () => stop();
@@ -220,16 +237,23 @@ export function signIn(ctx, member, o, on) {
                 returned = undefined;
                 if (!apiKey)
                     return { state: 'failed', via, why: signal.aborted ? 'declined' : 'expired' };
+                secret = apiKey.trim() || undefined;
             }
             if (signal.aborted)
                 return { state: 'failed', via, why: 'declined' };
-            const result = await ctx.request('openclaw.setup.activate', {
+            // Done waits for the gateway restart an `auth` change causes (activation.ts); a run started before it runs on the
+            // old config. A restart that runs late or is cancelled ends failed, and the account is cleaned up by the caller.
+            activating = true;
+            const result = await activate(ctx, {
                 agentId, kind: apiKey === undefined ? 'claude-cli' : 'api-key',
-                ...(apiKey === undefined ? {} : { authChoice: 'apiKey', apiKey }),
-            }, { timeoutMs: PULL_MS, signal });
-            // API secrets must never be echoed in a view, even if the gateway returns an error containing one.
-            return result.ok ? { state: 'done', via } : { state: 'failed', via, why: 'failed',
-                error: apiKey === undefined ? cut(result.error ?? 'Claude Code activation failed') : 'API key activation failed' };
+                ...(apiKey === undefined ? {} : { authChoice: o.authChoice, apiKey }),
+            }, { timeoutMs: PULL_MS, signal }).finally(() => { activating = false; });
+            if (result.late)
+                return signal.aborted ? cancelled() : { state: 'failed', via, why: 'failed', error: LATE_RESTART };
+            if (!result.ok)
+                return { state: 'failed', via, why: 'failed',
+                    error: apiKey === undefined ? clean(result.error ?? 'Claude Code activation failed') : keyFailed(result.status) };
+            return signal.aborted ? cancelled() : { state: 'done', via };
         }
         // The client chooses the wizard id; cancellation waits for the engine to register it.
         sessionId = `byokit-${randomUUID()}`;
@@ -428,7 +452,7 @@ export function signIn(ctx, member, o, on) {
             else if (BUSY.test(cut(error)))
                 view = { state: 'failed', via, why: 'busy' };
             else
-                view = { state: 'failed', via, why: 'failed', error: o.authChoice === 'apiKey' ? 'API key activation failed' : cut(error) };
+                view = { state: 'failed', via, why: 'failed', error: keyRoute ? KEY_FAILED : clean(error) };
         }
         settleStart();
         if (view.state !== 'done')

package/dist/testing/fake-gateway.d.ts

@@ -26,6 +26,25 @@ export type FakeGateway = {
         usedPercent?: number;
         resetAt?: number;
     }[]): void;
+    /** Profile fields every later wizard sign-in stores (O14 identity): `accountId: undefined` signs in with no account
+     * id, so no `who`. With no call, or `signInAs()`, the account id is `fake-<agentId>`. */
+    signInAs(fields?: {
+        accountId?: string;
+        email?: string;
+        expires?: number;
+    }): void;
+    /** A sealed profile already in an agent's store, as a sign-in of another provider leaves it; the agent's model points at it. */
+    seedProfile(agentId: string, profileId: string, profile: {
+        provider: string;
+        type: string;
+    } & Record<string, unknown>): void;
+    /** A late engine refresh racing a removal (O14 S8): writes one profile of `provider` onto `agentId` whole, as the
+     * pin would under its store lock. With `order: false` it lands with no order entry; `expires` (default: valid)
+     * may name an expired credential. */
+    refresh(agentId: string, provider: string, o?: {
+        order?: boolean;
+        expires?: number;
+    }): void;
 } & {
     transport: GatewayTransport;
 };