@clawling/clawchat-plugin-openclaw 2026.5.12-28

package/src/login.runtime.test.ts

@@ -0,0 +1,737 @@
+import type { OpenClawConfig } from "openclaw/plugin-sdk/core";
+import { describe, expect, it, vi } from "vitest";
+import { ClawlingApiError } from "./api-types.ts";
+import { runOpenclawClawlingLogin } from "./login.runtime.ts";
+
+const CHANNEL_ID = "clawchat-plugin-openclaw";
+
+function buildCfg(
+  section: Record<string, unknown> = { baseUrl: "https://api.example.com" },
+): OpenClawConfig {
+  return {
+    channels: { [CHANNEL_ID]: section },
+  } as unknown as OpenClawConfig;
+}
+
+function makeApiClient(overrides: {
+  agentsConnect: ReturnType<typeof vi.fn>;
+}): ReturnType<typeof import("./api-client.ts").createOpenclawClawlingApiClient> {
+  return {
+    getMyProfile: vi.fn(),
+    getUserInfo: vi.fn(),
+    listFriends: vi.fn(),
+    updateMyProfile: vi.fn(),
+    uploadMedia: vi.fn(),
+    agentsConnect: overrides.agentsConnect,
+  } as never;
+}
+
+describe("runOpenclawClawlingLogin", () => {
+  it("works with no prior setup (baseUrl / websocketUrl default built-in)", async () => {
+    const cfg = buildCfg({}); // empty section — resolver provides defaults
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "u", owner_id: "owner-u" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    let capturedBaseUrl = "";
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV",
+      apiClientFactory: (opts) => {
+        capturedBaseUrl = opts.baseUrl;
+        return makeApiClient({ agentsConnect });
+      },
+      persistConfig: vi.fn(),
+    });
+    // The api-client was constructed with a non-empty baseUrl sourced
+    // from the default, even though the cfg had none.
+    expect(capturedBaseUrl).toMatch(/^https?:\/\//);
+  });
+
+  it("errors if invite code is blank", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "   ",
+      }),
+    ).rejects.toThrow(/invite code is required/);
+  });
+
+  it("calls agents/connect with the invite code and persists returned credentials", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      websocketUrl: "wss://ws.example.com/v2/client",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: {
+        id: "ag-1",
+        owner_id: "owner-1",
+        user_id: "agent-123",
+        type: "bot",
+        nickname: "Bot",
+        avatar_url: "",
+        bio: "",
+        visibility: "public",
+        status: "active",
+        platform: "clawchat",
+        created_at: "2026-04-17T00:00:00Z",
+      },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    const persistConfig = vi.fn();
+    const log = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    expect(agentsConnect).toHaveBeenCalledWith({
+      code: "INV-ABC",
+      platform: "openclaw",
+      type: "clawbot",
+    });
+    expect(persistConfig).toHaveBeenCalledTimes(1);
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect((savedCfg.plugins as { allow?: string[] })?.allow).toEqual([CHANNEL_ID]);
+    expect(section.token).toBe("access-tok");
+    expect(section.refreshToken).toBe("refresh-tok");
+    expect(section.userId).toBe("agent-123");
+    expect(section.ownerUserId).toBe("owner-1");
+    expect(section.groupMode).toBe("all");
+    expect(section.groupCommandMode).toBe("owner");
+    // Existing baseUrl and websocketUrl are preserved — agents/connect
+    // does not return them.
+    expect(section.baseUrl).toBe("https://api.example.com");
+    expect(section.websocketUrl).toBe("wss://ws.example.com/v2/client");
+    expect(log).toHaveBeenCalledWith(expect.stringContaining("login succeeded"));
+  });
+
+  it("persists latest activation bootstrap metadata to the sqlite store after config write", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      websocketUrl: "wss://ws.example.com/v2/client",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123", nickname: "Bot" },
+      access_token: "access-plain",
+      refresh_token: "refresh-plain",
+      conversation: { id: "conv-activation" },
+    });
+    const persistConfig = vi.fn();
+    const upsertActivation = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+      store: { upsertActivation },
+    });
+
+    expect(upsertActivation).toHaveBeenCalledTimes(1);
+    expect(persistConfig.mock.invocationCallOrder[0]).toBeLessThan(
+      upsertActivation.mock.invocationCallOrder[0],
+    );
+    expect(upsertActivation).toHaveBeenCalledWith({
+      platform: "openclaw",
+      accountId: "default",
+      userId: "agent-123",
+      ownerUserId: "owner-123",
+      accessToken: "access-plain",
+      refreshToken: "refresh-plain",
+      conversationId: "conv-activation",
+      loginMethod: "login",
+    });
+    expect(upsertActivation.mock.calls[0]![0]).not.toHaveProperty("baseUrl");
+    expect(upsertActivation.mock.calls[0]![0]).not.toHaveProperty("websocketUrl");
+  });
+
+  it("uses the runtime config mutator with restart intent after credential writes", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      websocketUrl: "wss://ws.example.com/v2/client",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123", nickname: "Bot" },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    let mutatedCfg: OpenClawConfig | undefined;
+    const log = vi.fn();
+    const mutateConfigFile = vi.fn(async (params) => {
+      expect(params.afterWrite).toEqual({
+        mode: "restart",
+        reason: "clawchat-plugin-openclaw credentials changed",
+      });
+      const draft = structuredClone(cfg) as OpenClawConfig;
+      await params.mutate(draft, { snapshot: {} as never, previousHash: "before" });
+      mutatedCfg = draft;
+      return { nextConfig: draft } as never;
+    });
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      mutateConfigFile,
+    });
+
+    expect(mutateConfigFile).toHaveBeenCalledTimes(1);
+    const section = (mutatedCfg!.channels as Record<string, Record<string, unknown>>)[
+      CHANNEL_ID
+    ]!;
+    expect(section.token).toBe("access-tok");
+    expect(section.refreshToken).toBe("refresh-tok");
+    expect(section.userId).toBe("agent-123");
+    expect(section.ownerUserId).toBe("owner-123");
+    expect(section.groupMode).toBe("all");
+    expect(section.groupCommandMode).toBe("owner");
+    const plugins = (mutatedCfg! as OpenClawConfig & {
+      plugins: { allow?: string[]; entries: Record<string, Record<string, unknown>> };
+    }).plugins;
+    expect(plugins.allow).toEqual([CHANNEL_ID]);
+    expect(plugins.entries[CHANNEL_ID]?.enabled).toBe(true);
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining("Persisting ClawChat credentials and plugin activation"),
+    );
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining("ClawChat credentials and plugin activation persisted"),
+    );
+  });
+
+  it("preserves other configured channels when persisting ClawChat credentials", async () => {
+    const cfg = {
+      channels: {
+        telegram: {
+          enabled: true,
+          token: "telegram-token",
+        },
+        [CHANNEL_ID]: {
+          baseUrl: "https://api.example.com",
+          websocketUrl: "wss://ws.example.com/v2/client",
+        },
+      },
+    } as unknown as OpenClawConfig;
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    expect(savedCfg.channels?.telegram).toEqual({
+      enabled: true,
+      token: "telegram-token",
+    });
+    expect(savedCfg.channels?.[CHANNEL_ID]).toMatchObject({
+      baseUrl: "https://api.example.com",
+      websocketUrl: "wss://ws.example.com/v2/client",
+      token: "access-tok",
+      userId: "agent-123",
+      ownerUserId: "owner-123",
+      refreshToken: "refresh-tok",
+    });
+  });
+
+  it("enables the channel when login fills a pre-activation disabled skeleton", async () => {
+    const cfg = buildCfg({
+      enabled: false,
+      baseUrl: "https://api.example.com",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.enabled).toBe(true);
+    expect(section.token).toBe("access-tok");
+    expect(section.userId).toBe("agent-123");
+    expect(section.ownerUserId).toBe("owner-123");
+    expect(section.groupMode).toBe("all");
+  });
+
+  it("does not overwrite an explicit mention groupMode during login", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      groupMode: "mention",
+      groupCommandMode: "off",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.groupMode).toBe("mention");
+    expect(section.groupCommandMode).toBe("off");
+  });
+
+  it("does not overwrite per-group groupMode settings during login", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      groupMode: "all",
+      groups: {
+        "group-quiet": { groupMode: "mention" },
+      },
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.groups).toEqual({
+      "group-quiet": { groupMode: "mention" },
+    });
+  });
+
+  it("allows clawchat-plugin-openclaw plugin tools after successful login without replacing policy", async () => {
+    const cfg = {
+      ...buildCfg({ baseUrl: "https://api.example.com" }),
+      tools: {
+        profile: "coding",
+        allow: [],
+        deny: ["exec"],
+        alsoAllow: ["browser"],
+      },
+    } as unknown as OpenClawConfig;
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    expect(savedCfg.tools).toMatchObject({
+      profile: "coding",
+      allow: [],
+      deny: ["exec"],
+      alsoAllow: ["browser", "clawchat-plugin-openclaw"],
+    });
+  });
+
+  it("enables the runtime plugin entry after successful login without replacing plugin config", async () => {
+    const cfg = {
+      ...buildCfg({ baseUrl: "https://api.example.com" }),
+      plugins: {
+        allow: ["browser"],
+        entries: {
+          [CHANNEL_ID]: {
+            enabled: false,
+            config: { keep: true },
+            hooks: { allowConversationAccess: true },
+          },
+        },
+      },
+    } as unknown as OpenClawConfig;
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig & {
+      plugins: { allow?: string[]; entries: Record<string, Record<string, unknown>> };
+    };
+    expect(savedCfg.plugins.allow).toEqual(["browser", "clawchat-plugin-openclaw"]);
+    expect(savedCfg.plugins.entries[CHANNEL_ID]).toEqual({
+      enabled: true,
+      config: { keep: true },
+      hooks: { allowConversationAccess: true },
+    });
+  });
+
+  it("surfaces agents/connect API errors with the kind and message", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockRejectedValue(
+      new ClawlingApiError("api", "invite code expired", { code: 4002 }),
+    );
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "expired",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/agents\/connect failed \(api\): invite code expired/);
+  });
+
+  it("rejects responses that omit required fields", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "", owner_id: "owner-123" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/missing required fields/);
+  });
+
+  it("rejects whitespace-only required agents/connect response fields", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "   ", owner_id: "owner-123" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/missing required fields/);
+  });
+
+  it("rejects whitespace-only agents/connect access tokens", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "   ",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/access_token/);
+  });
+
+  it("rejects agents/connect responses that omit agent owner ids", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/agent\.owner_id/);
+  });
+
+  it("rejects empty returned agent owner ids", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/agent\.owner_id/);
+  });
+
+  it("rejects whitespace-only returned agent owner ids", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "   " },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/missing required fields/);
+  });
+
+  it("rejects whitespace-only activation conversation ids when present", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "t",
+      refresh_token: "r",
+      conversation: { id: "   " },
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/missing required fields/);
+  });
+
+  it("trims persisted agents/connect credentials and activation conversation id", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "  agent-123  ", owner_id: "  owner-123  ", nickname: "Bot" },
+      access_token: "  access-tok  ",
+      refresh_token: "  refresh-tok  ",
+      conversation: { id: "  conv-activation  " },
+    });
+    const persistConfig = vi.fn();
+    const upsertActivation = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "ok",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+      store: { upsertActivation },
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.token).toBe("access-tok");
+    expect(section.refreshToken).toBe("refresh-tok");
+    expect(section.userId).toBe("agent-123");
+    expect(section.ownerUserId).toBe("owner-123");
+    expect(upsertActivation).toHaveBeenCalledWith({
+      platform: "openclaw",
+      accountId: "default",
+      userId: "agent-123",
+      ownerUserId: "owner-123",
+      accessToken: "access-tok",
+      refreshToken: "refresh-tok",
+      conversationId: "conv-activation",
+      loginMethod: "login",
+    });
+  });
+
+  it("does not preserve a stale refresh token when agents/connect returns a blank refresh token", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      refreshToken: "stale-refresh",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "   ",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "ok",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.token).toBe("access-tok");
+    expect(section.userId).toBe("agent-123");
+    expect(section.refreshToken).toBeUndefined();
+  });
+
+  it("persists the config automatically after receiving the token (no further prompts)", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      websocketUrl: "wss://ws.example.com",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { id: "agt-9", user_id: "agent-9", owner_id: "owner-9", nickname: "Nine" },
+      access_token: "ACC-0123456789",
+      refresh_token: "REF-xyz",
+    });
+    const persistCalls: OpenClawConfig[] = [];
+    const logMessages: string[] = [];
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: (m) => logMessages.push(m) },
+      readInviteCode: async () => "INV-AUTO",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig: (next) => {
+        persistCalls.push(next);
+      },
+    });
+    // persistConfig is invoked exactly once with the merged credentials.
+    expect(persistCalls).toHaveLength(1);
+    const section = (persistCalls[0]!.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.token).toBe("ACC-0123456789");
+    expect(section.agentId).toBe("agt-9");
+    expect(section.userId).toBe("agent-9");
+    expect(section.ownerUserId).toBe("owner-9");
+    expect(section.refreshToken).toBe("REF-xyz");
+    // Existing URL fields are preserved.
+    expect(section.baseUrl).toBe("https://api.example.com");
+    expect(section.websocketUrl).toBe("wss://ws.example.com");
+    // Operator-visible log confirms the automatic config write.
+    expect(logMessages.some((m) => /Updating config/.test(m))).toBe(true);
+    expect(logMessages.some((m) => /Config file updated/.test(m))).toBe(true);
+    // Token in logs is redacted.
+    expect(logMessages.every((m) => !m.includes("ACC-0123456789"))).toBe(true);
+    expect(logMessages.every((m) => !m.includes("ACC-") && !m.includes("6789"))).toBe(true);
+  });
+
+  it("login logs don't leak the /agents/connect endpoint path or base URL", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "u", owner_id: "owner-u" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    const logMessages: string[] = [];
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: (m) => logMessages.push(m) },
+      readInviteCode: async () => "INV",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig: vi.fn(),
+    });
+    expect(logMessages.every((m) => !m.includes("/agents/connect"))).toBe(true);
+    expect(logMessages.every((m) => !m.includes(cfg.channels!["clawchat-plugin-openclaw"].baseUrl))).toBe(
+      true,
+    );
+  });
+
+  it("trims the invite code before sending", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "u", owner_id: "owner-u" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "  INV-TRIM  ",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig: vi.fn(),
+    });
+    expect(agentsConnect).toHaveBeenCalledWith({
+      code: "INV-TRIM",
+      platform: "openclaw",
+      type: "clawbot",
+    });
+  });
+});
+
+describe("runOpenclawClawlingLogin (non-interactive via readInviteCode)", () => {
+  it("performs a full login when called with a fixed readInviteCode (programmatic path)", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-7", owner_id: "owner-7", nickname: "Seven" },
+      access_token: "acc-non-interactive",
+      refresh_token: "ref-ni",
+    });
+    const persistConfig = vi.fn();
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: () => {} },
+      readInviteCode: async () => "INV-PROGRAMMATIC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+    expect(agentsConnect).toHaveBeenCalledWith({
+      code: "INV-PROGRAMMATIC",
+      platform: "openclaw",
+      type: "clawbot",
+    });
+    expect(persistConfig).toHaveBeenCalledTimes(1);
+    const section = (persistConfig.mock.calls[0]![0] as OpenClawConfig).channels!
+      ["clawchat-plugin-openclaw"] as Record<string, unknown>;
+    expect(section.token).toBe("acc-non-interactive");
+    expect(section.userId).toBe("agent-7");
+    expect(section.ownerUserId).toBe("owner-7");
+    expect(section.refreshToken).toBe("ref-ni");
+  });
+});