@clawling/clawchat-plugin-openclaw 2026.5.13-dev.2 → 2026.5.14-2

package/dist/index.js

@@ -16,5 +16,12 @@ export default defineChannelPluginEntry({
         registerOpenclawClawlingCommands(api);
         registerClawChatPromptInjection(api);
         registerOpenclawClawlingTools(api);
+        // NOTE: the legacy-rename config migration is intentionally NOT registered
+        // here. The host's setup-migration runner only loads a plugin's SETUP source
+        // (`openclaw.setupEntry`/`runtimeSetupEntry` → setup-entry.ts) and calls its
+        // `register(api)` in "setup-only" mode; registrations made in `registerFull`
+        // (full/tool-discovery modes) are never collected for migrations, and this
+        // gated full-load path doesn't run for the rename scenario anyway. The
+        // migration is wired into setup-entry.ts instead.
     },
 });

package/dist/setup-entry.js

@@ -1,3 +1,33 @@
 import { defineSetupPluginEntry } from "openclaw/plugin-sdk/channel-core";
+import { CHANNEL_ID } from "./src/config.js";
 import { openclawClawlingSetupPlugin } from "./src/channel.setup.js";
-export default defineSetupPluginEntry(openclawClawlingSetupPlugin);
+import { migrateLegacyClawChatChannelConfig } from "./src/config-compat.js";
+/**
+ * Host setup-source `register` hook.
+ *
+ * The OpenClaw setup-migration runner (`setup-registry`) loads this module as
+ * the plugin's setup source (resolved from `package.json` `openclaw.setupEntry`
+ * / `runtimeSetupEntry`), unwraps the default export, and — when that export is
+ * an object exposing a `register` function whose `id` matches the plugin id —
+ * calls `register(api)` in setup-only mode. This is the ONLY ungated path that
+ * collects config migrations for the plugin-rename scenario.
+ *
+ * Mirrors the host's own built-in pattern (e.g. amazon-bedrock setup-api.js:
+ * `api.registerConfigMigration((config) => migrateAmazonBedrockLegacyConfig(config))`).
+ */
+export function register(api) {
+    api.registerConfigMigration?.((config) => migrateLegacyClawChatChannelConfig(config));
+}
+/**
+ * Default export consumed by BOTH host loaders of this setup source:
+ *  - the channel-setup loader unwraps `default` and reads `.plugin`
+ *    (`defineSetupPluginEntry` yields `{ plugin }`);
+ *  - the setup-migration runner unwraps `default` and reads `.register`,
+ *    rejecting it unless `.id` matches the plugin id.
+ * So the default export must carry `plugin`, `id`, and `register` together.
+ */
+export default {
+    ...defineSetupPluginEntry(openclawClawlingSetupPlugin),
+    id: CHANNEL_ID,
+    register,
+};

package/dist/src/api-client.js

@@ -1,5 +1,14 @@
 import { ClawlingApiError, } from "./api-types.js";
 import { CHANNEL_ID } from "./config.js";
+export function buildPluginReportBody(input) {
+    return {
+        device_id: input.deviceId,
+        platform: input.platform,
+        plugin_version: input.pluginVersion,
+        runtime_name: input.runtimeName,
+        runtime_version: input.runtimeVersion,
+    };
+}
 /**
  * §A.0 — decode the access token's `exp` claim locally (base64url-decode the
  * JWT payload segment, read `exp` as epoch seconds). Returns `null` when the
@@ -416,5 +425,14 @@ export function createOpenclawClawlingApiClient(opts) {
             fd.set("file", file);
             return await call("POST", "/v1/files/upload-url", { body: fd });
         },
+        async reportPlugin(input, opts) {
+            const path = opts?.authenticated
+                ? "/v1/agents/me/plugin-report"
+                : "/v1/agents/plugin-report";
+            await call("POST", path, {
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify(buildPluginReportBody(input)),
+            });
+        },
     };
 }

package/dist/src/config-compat.js

@@ -0,0 +1,120 @@
+import { CHANNEL_ID } from "./config.js";
+/**
+ * Compatibility migration for the plugin rename (commit 260044f): the plugin
+ * `id` and channel key changed from the OLD `openclaw-clawchat` to the NEW
+ * `clawchat-plugin-openclaw` (= {@link CHANNEL_ID}).
+ *
+ * Users upgrading from the old version have all their state — channel block
+ * (token/userId/ownerUserId/refreshToken/…), `plugins.allow`,
+ * `plugins.entries`, and `tools.allow`/`tools.alsoAllow` — keyed under the old
+ * id. The new code only reads the new id, so the channel silently fails to
+ * load. This migration moves the old-keyed state onto the new id.
+ *
+ * The function is PURE: it clones the input via `structuredClone` and never
+ * mutates its argument. It is IDEMPOTENT: a config with no old id anywhere
+ * returns an equivalent config with `changes: []`.
+ */
+export const LEGACY_CHANNEL_ID = "openclaw-clawchat";
+export const TARGET_CHANNEL_ID = CHANNEL_ID;
+const BLOCKED_OBJECT_KEYS = new Set(["__proto__", "prototype", "constructor"]);
+function isBlockedObjectKey(key) {
+    return BLOCKED_OBJECT_KEYS.has(key);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyRecord(value) {
+    return isRecord(value) && Object.keys(value).length > 0;
+}
+/**
+ * Copy keys from `source` into `target` only when they are absent/undefined in
+ * `target` (target is more current — never overwrite an existing value).
+ * Recurses into nested records. Skips prototype-pollution keys.
+ */
+function mergeMissing(target, source) {
+    for (const [key, value] of Object.entries(source)) {
+        if (value === undefined || isBlockedObjectKey(key))
+            continue;
+        const existing = target[key];
+        if (existing === undefined) {
+            target[key] = value;
+            continue;
+        }
+        if (isRecord(existing) && isRecord(value))
+            mergeMissing(existing, value);
+    }
+}
+/** Replace `from` → `to` in a string array, preserving order and deduping. */
+function replaceAndDedup(list, from, to) {
+    const out = [];
+    for (const raw of list) {
+        const value = raw === from ? to : raw;
+        if (!out.includes(value))
+            out.push(value);
+    }
+    return out;
+}
+export function migrateLegacyClawChatChannelConfig(config) {
+    const changes = [];
+    if (!isRecord(config))
+        return { config, changes };
+    const next = structuredClone(config);
+    // 1. channels — move/merge the old channel block onto the new id.
+    const channels = next.channels;
+    if (isRecord(channels)) {
+        const oldChannel = channels[LEGACY_CHANNEL_ID];
+        if (isNonEmptyRecord(oldChannel)) {
+            const newChannel = channels[TARGET_CHANNEL_ID];
+            if (!isNonEmptyRecord(newChannel)) {
+                channels[TARGET_CHANNEL_ID] = oldChannel;
+                changes.push(`Moved channel "${LEGACY_CHANNEL_ID}" → "${TARGET_CHANNEL_ID}".`);
+            }
+            else {
+                mergeMissing(newChannel, oldChannel);
+                changes.push(`Merged channel "${LEGACY_CHANNEL_ID}" → "${TARGET_CHANNEL_ID}" (filled missing fields; kept existing values).`);
+            }
+            delete channels[LEGACY_CHANNEL_ID];
+        }
+    }
+    // plugins.* live under a single `plugins` record.
+    const plugins = next.plugins;
+    if (isRecord(plugins)) {
+        // 2. plugins.allow — replace old id with new id (append if missing), dedup.
+        const allow = plugins.allow;
+        if (Array.isArray(allow) && allow.includes(LEGACY_CHANNEL_ID)) {
+            const replaced = replaceAndDedup(allow.filter((v) => typeof v === "string"), LEGACY_CHANNEL_ID, TARGET_CHANNEL_ID);
+            plugins.allow = replaced;
+            changes.push(`Updated plugins.allow: "${LEGACY_CHANNEL_ID}" → "${TARGET_CHANNEL_ID}".`);
+        }
+        // 3. plugins.entries — merge-missing the old entry into the new one.
+        const entries = plugins.entries;
+        if (isRecord(entries)) {
+            const oldEntry = entries[LEGACY_CHANNEL_ID];
+            if (oldEntry !== undefined) {
+                if (isRecord(oldEntry)) {
+                    const newEntry = entries[TARGET_CHANNEL_ID];
+                    if (!isRecord(newEntry)) {
+                        entries[TARGET_CHANNEL_ID] = oldEntry;
+                    }
+                    else {
+                        mergeMissing(newEntry, oldEntry);
+                    }
+                }
+                delete entries[LEGACY_CHANNEL_ID];
+                changes.push(`Merged plugins.entries["${LEGACY_CHANNEL_ID}"] → plugins.entries["${TARGET_CHANNEL_ID}"].`);
+            }
+        }
+    }
+    // 4. tools.allow + tools.alsoAllow — replace old id with new id, dedup.
+    const tools = next.tools;
+    if (isRecord(tools)) {
+        for (const key of ["allow", "alsoAllow"]) {
+            const list = tools[key];
+            if (Array.isArray(list) && list.includes(LEGACY_CHANNEL_ID)) {
+                tools[key] = replaceAndDedup(list.filter((v) => typeof v === "string"), LEGACY_CHANNEL_ID, TARGET_CHANNEL_ID);
+                changes.push(`Updated tools.${key}: "${LEGACY_CHANNEL_ID}" → "${TARGET_CHANNEL_ID}".`);
+            }
+        }
+    }
+    return { config: next, changes };
+}

package/dist/src/plugin-report.js

@@ -0,0 +1,36 @@
+import { createRequire } from "node:module";
+import { createOpenclawClawlingApiClient } from "./api-client.js";
+/** Best-effort read of this plugin's package version; "unknown" on failure. */
+export function resolvePluginVersion() {
+    try {
+        const require = createRequire(import.meta.url);
+        const pkg = require("../package.json");
+        return pkg.version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+/**
+ * Fire one plugin-version report. Best-effort: any failure is logged at debug
+ * and swallowed so it can never block, delay, or crash gateway startup.
+ */
+export async function reportPluginVersionSafe(p) {
+    try {
+        const client = createOpenclawClawlingApiClient({
+            baseUrl: p.baseUrl,
+            mediaBaseUrl: p.mediaBaseUrl,
+            token: p.token,
+        });
+        await client.reportPlugin({
+            deviceId: p.deviceId,
+            platform: "openclaw",
+            pluginVersion: p.pluginVersion,
+            runtimeName: "node",
+            runtimeVersion: process.version,
+        }, { authenticated: p.authenticated });
+    }
+    catch (err) {
+        p.log?.debug?.(`clawchat-plugin-openclaw plugin report failed (authenticated=${p.authenticated}): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}

package/dist/src/reply-dispatcher.js

@@ -259,7 +259,8 @@ export function createOpenclawClawlingReplyDispatcher(options) {
     const { cfg, runtime, account, client, target, replyCtx, inboundMessageId, store, log, } = options;
     const isGroupTarget = target.chatType === "group";
     const outputVisibility = effectiveOutputVisibility(account, target.chatId, target.chatType);
-    const splitFullOutput = outputVisibility === "full" && !isGroupTarget;
+    const splitFullOutput = outputVisibility === "full";
+    const splitNormalBlockOutput = outputVisibility === "normal";
     const ownerDirectTarget = () => {
         const ownerUserId = account.ownerUserId?.trim();
         return ownerUserId ? { chatId: ownerUserId, chatType: "direct" } : null;
@@ -526,12 +527,12 @@ export function createOpenclawClawlingReplyDispatcher(options) {
         return result;
     };
     const emitFullSegment = async (text, urls = []) => {
-        if (outputVisibility !== "full") {
+        if (outputVisibility !== "full" && !splitNormalBlockOutput) {
             appendBufferedText(text);
             appendBufferedUrls(urls);
             return;
         }
-        if (!splitFullOutput) {
+        if (!splitFullOutput && !splitNormalBlockOutput) {
             appendBufferedText(text);
             appendBufferedUrls(urls);
             return;
@@ -599,6 +600,9 @@ export function createOpenclawClawlingReplyDispatcher(options) {
                 if (outputVisibility === "full") {
                     await emitFullSegment(text, urls);
                 }
+                else if (splitNormalBlockOutput) {
+                    await emitFullSegment(text, urls);
+                }
                 else if (outputVisibility === "minimal" || outputVisibility === "normal") {
                     appendBufferedText(text);
                     appendBufferedUrls(urls);
@@ -630,6 +634,12 @@ export function createOpenclawClawlingReplyDispatcher(options) {
                 }
                 const finalText = richFragment && account.richInteractions ? mergeFinalText("") : mergeFinalText(text);
                 const finalUrls = mergeFinalUrls(urls);
+                if (isClawChatNoopResponseText(finalText) &&
+                    !richFragment &&
+                    finalUrls.length === 0) {
+                    log?.info?.(`[${account.accountId}] clawchat-plugin-openclaw final suppressed: no-reply token`);
+                    return;
+                }
                 const mediaFragments = await uploadMediaUrls(finalUrls);
                 const result = await sendStatic(finalText, mediaFragments, richFragment && account.richInteractions ? [richFragment] : [], { recordMessage: true });
                 if (result?.messageId)
@@ -641,12 +651,8 @@ export function createOpenclawClawlingReplyDispatcher(options) {
         onError: (error, info) => {
             const errorText = normalizeReplyErrorText(error);
             log?.error?.(`[${account.accountId}] clawchat-plugin-openclaw ${info.kind} reply failed: ${errorText}`);
-            if (!isGroupTarget && outputVisibility === "full")
+            if (outputVisibility === "full")
                 void emitFullRuntimeText("error", errorText);
-            if (isGroupTarget) {
-                log?.error?.(`[${account.accountId}] clawchat-plugin-openclaw group runtime failure suppressed from ClawChat clients group=${target.chatId}`);
-                return;
-            }
         },
         onIdle: async () => {
             emitTyping(false);
@@ -673,10 +679,10 @@ export function createOpenclawClawlingReplyDispatcher(options) {
         replyOptions: {
             ...base.replyOptions,
             sourceReplyDeliveryMode: "automatic",
-            disableBlockStreaming: true,
+            disableBlockStreaming: !splitNormalBlockOutput,
             suppressDefaultToolProgressMessages: true,
-            allowProgressCallbacksWhenSourceDeliverySuppressed: outputVisibility === "full" ? true : undefined,
-            onReasoningStream: outputVisibility === "full"
+            allowProgressCallbacksWhenSourceDeliverySuppressed: splitFullOutput ? true : undefined,
+            onReasoningStream: splitFullOutput
                 ? async (payload) => {
                     if (consumeTerminalSend("reasoning"))
                         return;
@@ -687,14 +693,14 @@ export function createOpenclawClawlingReplyDispatcher(options) {
                         reasoningText = reasoningText ? `${reasoningText}\n${trimmed}` : trimmed;
                 }
                 : undefined,
-            onToolStart: outputVisibility === "full"
+            onToolStart: splitFullOutput
                 ? async (payload) => {
                     if (consumeTerminalSend("tool-start"))
                         return;
                     await emitFullSegment(formatToolStartSummary(payload));
                 }
                 : undefined,
-            onToolResult: outputVisibility === "full"
+            onToolResult: splitFullOutput
                 ? async (payload) => {
                     if (consumeTerminalSend("tool-result"))
                         return;
@@ -704,7 +710,7 @@ export function createOpenclawClawlingReplyDispatcher(options) {
                     await emitFullRuntimeText("tool result", text, resolveOutboundMediaUrls(payload).filter(Boolean));
                 }
                 : undefined,
-            onItemEvent: outputVisibility === "full"
+            onItemEvent: splitFullOutput
                 ? async (payload) => {
                     if (consumeTerminalSend("item-event"))
                         return;
@@ -713,35 +719,35 @@ export function createOpenclawClawlingReplyDispatcher(options) {
                     await emitFullRuntimeText("progress", summarizeProgressPayload(payload));
                 }
                 : undefined,
-            onPlanUpdate: outputVisibility === "full"
+            onPlanUpdate: splitFullOutput
                 ? async (payload) => {
                     if (consumeTerminalSend("plan-update"))
                         return;
                     await emitFullRuntimeText("plan", summarizeProgressPayload(payload));
                 }
                 : undefined,
-            onCommandOutput: outputVisibility === "full"
+            onCommandOutput: splitFullOutput
                 ? async (payload) => {
                     if (consumeTerminalSend("command-output"))
                         return;
                     await emitFullSegment(formatCommandOutputSummary(payload));
                 }
                 : undefined,
-            onPatchSummary: outputVisibility === "full"
+            onPatchSummary: splitFullOutput
                 ? async (payload) => {
                     if (consumeTerminalSend("patch-summary"))
                         return;
                     await emitFullSegment(formatPatchSummary(payload));
                 }
                 : undefined,
-            onCompactionStart: outputVisibility === "full"
+            onCompactionStart: splitFullOutput
                 ? async () => {
                     if (consumeTerminalSend("compaction-start"))
                         return;
                     await emitFullSegment("[compaction] started");
                 }
                 : undefined,
-            onCompactionEnd: outputVisibility === "full"
+            onCompactionEnd: splitFullOutput
                 ? async () => {
                     if (consumeTerminalSend("compaction-end"))
                         return;

package/dist/src/runtime.js

@@ -2,8 +2,9 @@ import { AckTimeoutError, AuthError, ProtocolError, StateError, TransportError,
 import { waitUntilAbort } from "openclaw/plugin-sdk/channel-lifecycle";
 import { hasControlCommand } from "openclaw/plugin-sdk/command-detection";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
-import { createOpenclawClawlingClient } from "./client.js";
+import { createOpenclawClawlingClient, resolveOpenclawClawlingDeviceId } from "./client.js";
 import { createOpenclawClawlingApiClient } from "./api-client.js";
+import { reportPluginVersionSafe, resolvePluginVersion } from "./plugin-report.js";
 import { ClawlingApiError } from "./api-types.js";
 import { RefreshManager } from "./refresh-manager.js";
 import { CHANNEL_ID, effectiveOutputVisibility, effectiveGroupCommandMode, hasOpenclawClawlingConnectCredentials, } from "./config.js";
@@ -425,6 +426,19 @@ export async function startOpenclawClawlingGateway(params) {
     const accountId = account.accountId;
     const store = resolveConnectionStore(params, runtime);
     log?.info?.(`[${accountId}] clawchat-plugin-openclaw runtime start entered configured=${account.configured} enabled=${account.enabled} hasToken=${Boolean(account.token)} hasUserId=${Boolean(account.userId)} hasOwnerUserId=${Boolean(account.ownerUserId)} websocketUrl=${account.websocketUrl || "(empty)"}`);
+    // Freeze one report device_id for this process; reused for the paired report
+    // so the backend links both to the same row. Imported from ./client.ts.
+    const reportDeviceId = resolveOpenclawClawlingDeviceId(account);
+    const pluginVersion = resolvePluginVersion();
+    void reportPluginVersionSafe({
+        baseUrl: account.baseUrl,
+        mediaBaseUrl: account.mediaBaseUrl,
+        token: "",
+        deviceId: reportDeviceId,
+        pluginVersion,
+        authenticated: false,
+        log,
+    });
     const activationAccount = await waitForActivationCredentials({
         account,
         abortSignal,
@@ -438,6 +452,17 @@ export async function startOpenclawClawlingGateway(params) {
     if (!activationAccount)
         return;
     account = activationAccount.account;
+    // Paired: link the report row via the authenticated endpoint, reusing the
+    // SAME frozen device_id so the backend upserts the existing unpaired row.
+    void reportPluginVersionSafe({
+        baseUrl: account.baseUrl,
+        mediaBaseUrl: account.mediaBaseUrl,
+        token: account.token,
+        deviceId: reportDeviceId,
+        pluginVersion,
+        authenticated: true,
+        log,
+    });
     // §A.0 — fallback expiry source. Prefer the SQLite `activated_at`; null when
     // the credentials came from config (no activation row yet) — in that case the
     // refresh manager relies on the JWT `exp` alone.
@@ -588,9 +613,18 @@ export async function startOpenclawClawlingGateway(params) {
     // The refresh token is not part of the resolved account; source it from
     // SQLite first (authoritative after a rotation) then the config channel
     // section. Kept in a mutable cell so a swap updates it in place.
-    let latestRefreshToken = (activationAccount.source === "sqlite" && store?.getActivationCredentials
-        ? store.getActivationCredentials({ platform: "openclaw", accountId })?.refreshToken
-        : null) ?? readConfigRefreshToken(cfg);
+    // §0/§D — a rotated refresh token threaded across a re-enter wins over the
+    // stores. The config write that persists a rotation uses `afterWrite:{mode:
+    // "none"}`, so the in-memory `cfg` here is the STALE pre-rotation snapshot;
+    // re-reading it (config-sourced agents) would submit an already-consumed
+    // token on the next refresh → spurious 10003 auto-logout.
+    let latestRefreshToken = (typeof params.refreshTokenOverride === "string" && params.refreshTokenOverride.trim()
+        ? params.refreshTokenOverride.trim()
+        : null) ??
+        (activationAccount.source === "sqlite" && store?.getActivationCredentials
+            ? store.getActivationCredentials({ platform: "openclaw", accountId })?.refreshToken
+            : null) ??
+        readConfigRefreshToken(cfg);
     const refreshManager = new RefreshManager({
         baseUrl: account.baseUrl,
         deviceId: refreshDeviceId,
@@ -639,6 +673,7 @@ export async function startOpenclawClawlingGateway(params) {
         ...(params.refreshSetTimer ? { setTimer: params.refreshSetTimer } : {}),
         ...(params.refreshClearTimer ? { clearTimer: params.refreshClearTimer } : {}),
         ...(params.refreshJitter ? { jitter: params.refreshJitter } : {}),
+        ...(params.refreshNow ? { now: params.refreshNow } : {}),
         log,
     });
     // §A.3/§A.4 — carry the single-flight latch + min-interval across re-enters so
@@ -939,6 +974,9 @@ export async function startOpenclawClawlingGateway(params) {
             void startOpenclawClawlingGateway({
                 ...params,
                 account: { ...params.account },
+                // Carry the live refresh token forward (a rotation earlier this lifecycle
+                // leaves the in-memory `cfg` stale; see refreshTokenOverride).
+                ...(latestRefreshToken ? { refreshTokenOverride: latestRefreshToken } : {}),
                 transportBackoffReconnect: true,
                 refreshReconnectDepth: streak.depth,
                 refreshReconnectWindowStartedAt: streak.windowStartedAt,
@@ -976,8 +1014,10 @@ export async function startOpenclawClawlingGateway(params) {
         if (abortSignal.aborted)
             return;
         const streak = nextRefreshReconnectStreak();
-        // Re-enter with the rotated in-memory account; SQLite/config already hold
-        // the rotated pair (persisted before the swap). Reuse the same device id.
+        // Re-enter with the rotated in-memory account. SQLite (if present) holds the
+        // rotated pair, but the in-memory `cfg` is the STALE pre-rotation snapshot
+        // (the config write used `afterWrite:{mode:"none"}`), so a config-sourced
+        // agent must NOT re-read it — thread the live refresh token forward instead.
         await startOpenclawClawlingGateway({
             ...params,
             account: {
@@ -987,6 +1027,7 @@ export async function startOpenclawClawlingGateway(params) {
                 userId: account.userId,
                 ownerUserId: account.ownerUserId,
             },
+            ...(latestRefreshToken ? { refreshTokenOverride: latestRefreshToken } : {}),
             refreshReconnectDepth: streak.depth,
             refreshReconnectWindowStartedAt: streak.windowStartedAt,
             refreshManagerState: managerState,

package/index.ts

@@ -20,5 +20,12 @@ export default defineChannelPluginEntry({
     registerOpenclawClawlingCommands(api);
     registerClawChatPromptInjection(api as unknown as ClawChatPromptInjectionApi);
     registerOpenclawClawlingTools(api);
+    // NOTE: the legacy-rename config migration is intentionally NOT registered
+    // here. The host's setup-migration runner only loads a plugin's SETUP source
+    // (`openclaw.setupEntry`/`runtimeSetupEntry` → setup-entry.ts) and calls its
+    // `register(api)` in "setup-only" mode; registrations made in `registerFull`
+    // (full/tool-discovery modes) are never collected for migrations, and this
+    // gated full-load path doesn't run for the rename scenario anyway. The
+    // migration is wired into setup-entry.ts instead.
   },
 });

package/openclaw.plugin.json

@@ -1,6 +1,13 @@
 {
   "id": "clawchat-plugin-openclaw",
   "kind": "channel",
+  "legacyPluginIds": ["openclaw-clawchat"],
+  "configContracts": {
+    "compatibilityMigrationPaths": [
+      "channels.openclaw-clawchat",
+      "plugins.entries.openclaw-clawchat"
+    ]
+  },
   "channels": ["clawchat-plugin-openclaw"],
   "skills": ["./skills"],
   "activation": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawling/clawchat-plugin-openclaw",
-  "version": "2026.5.13-dev.2",
+  "version": "2026.5.14-2",
   "description": "OpenClaw ClawChat channel plugin",
   "license": "MIT",
   "files": [

package/setup-entry.ts

@@ -1,4 +1,54 @@
+import type { OpenClawConfig } from "openclaw/plugin-sdk/core";
 import { defineSetupPluginEntry } from "openclaw/plugin-sdk/channel-core";
+import { CHANNEL_ID } from "./src/config.ts";
 import { openclawClawlingSetupPlugin } from "./src/channel.setup.ts";
+import { migrateLegacyClawChatChannelConfig } from "./src/config-compat.ts";
 
-export default defineSetupPluginEntry(openclawClawlingSetupPlugin);
+/**
+ * Minimal shape of the host setup-registration api we touch. The host calls
+ * `register(api)` on the SETUP source (this module) in `registrationMode:
+ * "setup-only"`; `registerConfigMigration` is the hook that collects
+ * compatibility migrations (run by `openclaw doctor` / setup). It is optional
+ * here so a host that doesn't expose it can't throw.
+ */
+interface SetupRegisterApi {
+  registerConfigMigration?: (
+    migration: (config: OpenClawConfig) => {
+      config: OpenClawConfig;
+      changes: string[];
+    },
+  ) => void;
+}
+
+/**
+ * Host setup-source `register` hook.
+ *
+ * The OpenClaw setup-migration runner (`setup-registry`) loads this module as
+ * the plugin's setup source (resolved from `package.json` `openclaw.setupEntry`
+ * / `runtimeSetupEntry`), unwraps the default export, and — when that export is
+ * an object exposing a `register` function whose `id` matches the plugin id —
+ * calls `register(api)` in setup-only mode. This is the ONLY ungated path that
+ * collects config migrations for the plugin-rename scenario.
+ *
+ * Mirrors the host's own built-in pattern (e.g. amazon-bedrock setup-api.js:
+ * `api.registerConfigMigration((config) => migrateAmazonBedrockLegacyConfig(config))`).
+ */
+export function register(api: SetupRegisterApi): void {
+  api.registerConfigMigration?.((config) =>
+    migrateLegacyClawChatChannelConfig(config),
+  );
+}
+
+/**
+ * Default export consumed by BOTH host loaders of this setup source:
+ *  - the channel-setup loader unwraps `default` and reads `.plugin`
+ *    (`defineSetupPluginEntry` yields `{ plugin }`);
+ *  - the setup-migration runner unwraps `default` and reads `.register`,
+ *    rejecting it unless `.id` matches the plugin id.
+ * So the default export must carry `plugin`, `id`, and `register` together.
+ */
+export default {
+  ...defineSetupPluginEntry(openclawClawlingSetupPlugin),
+  id: CHANNEL_ID,
+  register,
+};

package/skills/clawchat/SKILL.md

@@ -13,6 +13,7 @@ This skill guides agent behavior for ClawChat-aware tasks. Use the registered Cl
 
 - Use registered ClawChat plugin tools for account/profile, friends, users, moments, comments, reactions, avatar, media, and read-only conversation lookup.
 - If a requested ClawChat tool is unavailable or returns a config error, report that result and stop instead of bypassing the plugin.
+- Use the `/clawchat-output` slash command when the user asks to change how much ClawChat runtime output is shown in the current conversation.
 
 ## OpenClaw CLI
 
@@ -30,6 +31,18 @@ Use `update --force` only when local ClawChat plugin or skill files look corrupt
 
 If `channels add` reports `Unknown channel: clawchat-plugin-openclaw`, use the runtime slash command `/clawchat-activate CODE` after the operator ensures the plugin is loaded.
 
+## Output Visibility
+
+When the user asks to change ClawChat output verbosity, use the runtime slash command for the current conversation. Treat natural-language wording as aliases for the three supported modes:
+
+| User wording | Command |
+| --- | --- |
+| quiet mode, silent mode, minimal output, final-only output, `minimal` | `/clawchat-output minimal` |
+| conversation mode, normal mode, regular mode, default output, `normal` | `/clawchat-output normal` |
+| dev mode, developer mode, verbose mode, full output, `full` | `/clawchat-output full` |
+
+Do not edit config files directly for this request. If the slash command returns an error, report that error instead of claiming the mode changed.
+
 ## Plugin Tool Routing
 
 Tool descriptions are authoritative. These routing hints resolve common ambiguity:

package/src/api-client.ts

@@ -17,6 +17,24 @@ import {
 } from "./api-types.ts";
 import { CHANNEL_ID } from "./config.ts";
 
+export interface PluginReportInput {
+  deviceId: string;
+  platform: string;
+  pluginVersion: string;
+  runtimeName: string;
+  runtimeVersion: string;
+}
+
+export function buildPluginReportBody(input: PluginReportInput): Record<string, string> {
+  return {
+    device_id: input.deviceId,
+    platform: input.platform,
+    plugin_version: input.pluginVersion,
+    runtime_name: input.runtimeName,
+    runtime_version: input.runtimeVersion,
+  };
+}
+
 export interface ApiClientOptions {
   baseUrl: string;
   token: string;
@@ -131,6 +149,15 @@ export interface OpenclawClawlingApiClient {
     filename: string;
     mime?: string;
   }): Promise<AvatarUploadResult>;
+  /**
+   * Report this plugin's version + runtime to member-backend. When
+   * `authenticated`, posts to the agent-JWT self-report endpoint (links the row
+   * to the caller's agent/owner); otherwise the public unpaired endpoint.
+   */
+  reportPlugin(
+    input: PluginReportInput,
+    opts?: { authenticated?: boolean },
+  ): Promise<void>;
 }
 
 /** Backend envelope codes for `POST /v1/auth/refresh` (§0). */
@@ -615,5 +642,14 @@ export function createOpenclawClawlingApiClient(opts: ApiClientOptions): Opencla
       fd.set("file", file);
       return await call<AvatarUploadResult>("POST", "/v1/files/upload-url", { body: fd });
     },
+    async reportPlugin(input, opts): Promise<void> {
+      const path = opts?.authenticated
+        ? "/v1/agents/me/plugin-report"
+        : "/v1/agents/plugin-report";
+      await call<unknown>("POST", path, {
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(buildPluginReportBody(input)),
+      });
+    },
   };
 }

package/src/config-compat.ts

@@ -0,0 +1,154 @@
+import type { OpenClawConfig } from "openclaw/plugin-sdk/core";
+import { CHANNEL_ID } from "./config.ts";
+
+/**
+ * Compatibility migration for the plugin rename (commit 260044f): the plugin
+ * `id` and channel key changed from the OLD `openclaw-clawchat` to the NEW
+ * `clawchat-plugin-openclaw` (= {@link CHANNEL_ID}).
+ *
+ * Users upgrading from the old version have all their state — channel block
+ * (token/userId/ownerUserId/refreshToken/…), `plugins.allow`,
+ * `plugins.entries`, and `tools.allow`/`tools.alsoAllow` — keyed under the old
+ * id. The new code only reads the new id, so the channel silently fails to
+ * load. This migration moves the old-keyed state onto the new id.
+ *
+ * The function is PURE: it clones the input via `structuredClone` and never
+ * mutates its argument. It is IDEMPOTENT: a config with no old id anywhere
+ * returns an equivalent config with `changes: []`.
+ */
+
+export const LEGACY_CHANNEL_ID = "openclaw-clawchat" as const;
+export const TARGET_CHANNEL_ID = CHANNEL_ID;
+
+const BLOCKED_OBJECT_KEYS = new Set(["__proto__", "prototype", "constructor"]);
+
+function isBlockedObjectKey(key: string): boolean {
+  return BLOCKED_OBJECT_KEYS.has(key);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isNonEmptyRecord(value: unknown): value is Record<string, unknown> {
+  return isRecord(value) && Object.keys(value).length > 0;
+}
+
+/**
+ * Copy keys from `source` into `target` only when they are absent/undefined in
+ * `target` (target is more current — never overwrite an existing value).
+ * Recurses into nested records. Skips prototype-pollution keys.
+ */
+function mergeMissing(
+  target: Record<string, unknown>,
+  source: Record<string, unknown>,
+): void {
+  for (const [key, value] of Object.entries(source)) {
+    if (value === undefined || isBlockedObjectKey(key)) continue;
+    const existing = target[key];
+    if (existing === undefined) {
+      target[key] = value;
+      continue;
+    }
+    if (isRecord(existing) && isRecord(value)) mergeMissing(existing, value);
+  }
+}
+
+/** Replace `from` → `to` in a string array, preserving order and deduping. */
+function replaceAndDedup(list: string[], from: string, to: string): string[] {
+  const out: string[] = [];
+  for (const raw of list) {
+    const value = raw === from ? to : raw;
+    if (!out.includes(value)) out.push(value);
+  }
+  return out;
+}
+
+export function migrateLegacyClawChatChannelConfig(config: OpenClawConfig): {
+  config: OpenClawConfig;
+  changes: string[];
+} {
+  const changes: string[] = [];
+  if (!isRecord(config)) return { config, changes };
+
+  const next = structuredClone(config) as Record<string, unknown>;
+
+  // 1. channels — move/merge the old channel block onto the new id.
+  const channels = next.channels;
+  if (isRecord(channels)) {
+    const oldChannel = channels[LEGACY_CHANNEL_ID];
+    if (isNonEmptyRecord(oldChannel)) {
+      const newChannel = channels[TARGET_CHANNEL_ID];
+      if (!isNonEmptyRecord(newChannel)) {
+        channels[TARGET_CHANNEL_ID] = oldChannel;
+        changes.push(
+          `Moved channel "${LEGACY_CHANNEL_ID}" → "${TARGET_CHANNEL_ID}".`,
+        );
+      } else {
+        mergeMissing(newChannel, oldChannel);
+        changes.push(
+          `Merged channel "${LEGACY_CHANNEL_ID}" → "${TARGET_CHANNEL_ID}" (filled missing fields; kept existing values).`,
+        );
+      }
+      delete channels[LEGACY_CHANNEL_ID];
+    }
+  }
+
+  // plugins.* live under a single `plugins` record.
+  const plugins = next.plugins;
+  if (isRecord(plugins)) {
+    // 2. plugins.allow — replace old id with new id (append if missing), dedup.
+    const allow = plugins.allow;
+    if (Array.isArray(allow) && allow.includes(LEGACY_CHANNEL_ID)) {
+      const replaced = replaceAndDedup(
+        allow.filter((v): v is string => typeof v === "string"),
+        LEGACY_CHANNEL_ID,
+        TARGET_CHANNEL_ID,
+      );
+      plugins.allow = replaced;
+      changes.push(
+        `Updated plugins.allow: "${LEGACY_CHANNEL_ID}" → "${TARGET_CHANNEL_ID}".`,
+      );
+    }
+
+    // 3. plugins.entries — merge-missing the old entry into the new one.
+    const entries = plugins.entries;
+    if (isRecord(entries)) {
+      const oldEntry = entries[LEGACY_CHANNEL_ID];
+      if (oldEntry !== undefined) {
+        if (isRecord(oldEntry)) {
+          const newEntry = entries[TARGET_CHANNEL_ID];
+          if (!isRecord(newEntry)) {
+            entries[TARGET_CHANNEL_ID] = oldEntry;
+          } else {
+            mergeMissing(newEntry, oldEntry);
+          }
+        }
+        delete entries[LEGACY_CHANNEL_ID];
+        changes.push(
+          `Merged plugins.entries["${LEGACY_CHANNEL_ID}"] → plugins.entries["${TARGET_CHANNEL_ID}"].`,
+        );
+      }
+    }
+  }
+
+  // 4. tools.allow + tools.alsoAllow — replace old id with new id, dedup.
+  const tools = next.tools;
+  if (isRecord(tools)) {
+    for (const key of ["allow", "alsoAllow"] as const) {
+      const list = tools[key];
+      if (Array.isArray(list) && list.includes(LEGACY_CHANNEL_ID)) {
+        tools[key] = replaceAndDedup(
+          list.filter((v): v is string => typeof v === "string"),
+          LEGACY_CHANNEL_ID,
+          TARGET_CHANNEL_ID,
+        );
+        changes.push(
+          `Updated tools.${key}: "${LEGACY_CHANNEL_ID}" → "${TARGET_CHANNEL_ID}".`,
+        );
+      }
+    }
+  }
+
+  return { config: next as OpenClawConfig, changes };
+}

package/src/plugin-report.ts

@@ -0,0 +1,53 @@
+import { createRequire } from "node:module";
+import { createOpenclawClawlingApiClient } from "./api-client.ts";
+
+/** Best-effort read of this plugin's package version; "unknown" on failure. */
+export function resolvePluginVersion(): string {
+  try {
+    const require = createRequire(import.meta.url);
+    const pkg = require("../package.json") as { version?: string };
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+export interface ReportParams {
+  baseUrl: string;
+  mediaBaseUrl: string;
+  token: string;
+  deviceId: string;
+  pluginVersion: string;
+  authenticated: boolean;
+  log?: { debug?: (msg: string) => void };
+}
+
+/**
+ * Fire one plugin-version report. Best-effort: any failure is logged at debug
+ * and swallowed so it can never block, delay, or crash gateway startup.
+ */
+export async function reportPluginVersionSafe(p: ReportParams): Promise<void> {
+  try {
+    const client = createOpenclawClawlingApiClient({
+      baseUrl: p.baseUrl,
+      mediaBaseUrl: p.mediaBaseUrl,
+      token: p.token,
+    });
+    await client.reportPlugin(
+      {
+        deviceId: p.deviceId,
+        platform: "openclaw",
+        pluginVersion: p.pluginVersion,
+        runtimeName: "node",
+        runtimeVersion: process.version,
+      },
+      { authenticated: p.authenticated },
+    );
+  } catch (err) {
+    p.log?.debug?.(
+      `clawchat-plugin-openclaw plugin report failed (authenticated=${p.authenticated}): ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    );
+  }
+}

package/src/reply-dispatcher.ts

@@ -389,7 +389,8 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
   } = options;
   const isGroupTarget = target.chatType === "group";
   const outputVisibility = effectiveOutputVisibility(account, target.chatId, target.chatType);
-  const splitFullOutput = outputVisibility === "full" && !isGroupTarget;
+  const splitFullOutput = outputVisibility === "full";
+  const splitNormalBlockOutput = outputVisibility === "normal";
   const ownerDirectTarget = () => {
     const ownerUserId = account.ownerUserId?.trim();
     return ownerUserId ? { chatId: ownerUserId, chatType: "direct" as const } : null;
@@ -673,12 +674,12 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
   };
 
   const emitFullSegment = async (text: string, urls: string[] = []): Promise<void> => {
-    if (outputVisibility !== "full") {
+    if (outputVisibility !== "full" && !splitNormalBlockOutput) {
       appendBufferedText(text);
       appendBufferedUrls(urls);
       return;
     }
-    if (!splitFullOutput) {
+    if (!splitFullOutput && !splitNormalBlockOutput) {
       appendBufferedText(text);
       appendBufferedUrls(urls);
       return;
@@ -753,6 +754,8 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
       if (info?.kind === "block") {
         if (outputVisibility === "full") {
           await emitFullSegment(text, urls);
+        } else if (splitNormalBlockOutput) {
+          await emitFullSegment(text, urls);
         } else if (outputVisibility === "minimal" || outputVisibility === "normal") {
           appendBufferedText(text);
           appendBufferedUrls(urls);
@@ -785,6 +788,14 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
         }
         const finalText = richFragment && account.richInteractions ? mergeFinalText("") : mergeFinalText(text);
         const finalUrls = mergeFinalUrls(urls);
+        if (
+          isClawChatNoopResponseText(finalText) &&
+          !richFragment &&
+          finalUrls.length === 0
+        ) {
+          log?.info?.(`[${account.accountId}] clawchat-plugin-openclaw final suppressed: no-reply token`);
+          return;
+        }
         const mediaFragments = await uploadMediaUrls(finalUrls);
         const result = await sendStatic(
           finalText,
@@ -803,13 +814,7 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
       log?.error?.(
         `[${account.accountId}] clawchat-plugin-openclaw ${info.kind} reply failed: ${errorText}`,
       );
-      if (!isGroupTarget && outputVisibility === "full") void emitFullRuntimeText("error", errorText);
-      if (isGroupTarget) {
-        log?.error?.(
-          `[${account.accountId}] clawchat-plugin-openclaw group runtime failure suppressed from ClawChat clients group=${target.chatId}`,
-        );
-        return;
-      }
+      if (outputVisibility === "full") void emitFullRuntimeText("error", errorText);
     },
     onIdle: async () => {
       emitTyping(false);
@@ -833,10 +838,10 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
     replyOptions: {
       ...base.replyOptions,
       sourceReplyDeliveryMode: "automatic",
-      disableBlockStreaming: true,
+      disableBlockStreaming: !splitNormalBlockOutput,
       suppressDefaultToolProgressMessages: true,
-      allowProgressCallbacksWhenSourceDeliverySuppressed: outputVisibility === "full" ? true : undefined,
-      onReasoningStream: outputVisibility === "full"
+      allowProgressCallbacksWhenSourceDeliverySuppressed: splitFullOutput ? true : undefined,
+      onReasoningStream: splitFullOutput
         ? async (payload: ReplyPayload) => {
             if (consumeTerminalSend("reasoning")) return;
             const text = resolvePayloadText(payload);
@@ -845,13 +850,13 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
             if (trimmed) reasoningText = reasoningText ? `${reasoningText}\n${trimmed}` : trimmed;
           }
         : undefined,
-      onToolStart: outputVisibility === "full"
+      onToolStart: splitFullOutput
         ? async (payload) => {
             if (consumeTerminalSend("tool-start")) return;
             await emitFullSegment(formatToolStartSummary(payload));
           }
         : undefined,
-      onToolResult: outputVisibility === "full"
+      onToolResult: splitFullOutput
         ? async (payload: ReplyPayload) => {
             if (consumeTerminalSend("tool-result")) return;
             const text = resolvePayloadText(payload);
@@ -859,38 +864,38 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
             await emitFullRuntimeText("tool result", text, resolveOutboundMediaUrls(payload).filter(Boolean));
           }
         : undefined,
-      onItemEvent: outputVisibility === "full"
+      onItemEvent: splitFullOutput
         ? async (payload: Record<string, unknown>) => {
             if (consumeTerminalSend("item-event")) return;
             if (isToolProgressItem(payload)) return;
             await emitFullRuntimeText("progress", summarizeProgressPayload(payload));
           }
         : undefined,
-      onPlanUpdate: outputVisibility === "full"
+      onPlanUpdate: splitFullOutput
         ? async (payload: Record<string, unknown>) => {
             if (consumeTerminalSend("plan-update")) return;
             await emitFullRuntimeText("plan", summarizeProgressPayload(payload));
           }
         : undefined,
-      onCommandOutput: outputVisibility === "full"
+      onCommandOutput: splitFullOutput
         ? async (payload: Record<string, unknown>) => {
             if (consumeTerminalSend("command-output")) return;
             await emitFullSegment(formatCommandOutputSummary(payload));
           }
         : undefined,
-      onPatchSummary: outputVisibility === "full"
+      onPatchSummary: splitFullOutput
         ? async (payload: Record<string, unknown>) => {
             if (consumeTerminalSend("patch-summary")) return;
             await emitFullSegment(formatPatchSummary(payload));
           }
         : undefined,
-      onCompactionStart: outputVisibility === "full"
+      onCompactionStart: splitFullOutput
         ? async () => {
             if (consumeTerminalSend("compaction-start")) return;
             await emitFullSegment("[compaction] started");
           }
         : undefined,
-      onCompactionEnd: outputVisibility === "full"
+      onCompactionEnd: splitFullOutput
         ? async () => {
             if (consumeTerminalSend("compaction-end")) return;
             await emitFullSegment("[compaction] finished");

package/src/runtime.ts

@@ -13,8 +13,9 @@ import { waitUntilAbort } from "openclaw/plugin-sdk/channel-lifecycle";
 import { hasControlCommand } from "openclaw/plugin-sdk/command-detection";
 import type { OpenClawConfig, PluginRuntime } from "openclaw/plugin-sdk/core";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
-import { createOpenclawClawlingClient } from "./client.ts";
+import { createOpenclawClawlingClient, resolveOpenclawClawlingDeviceId } from "./client.ts";
 import { createOpenclawClawlingApiClient } from "./api-client.ts";
+import { reportPluginVersionSafe, resolvePluginVersion } from "./plugin-report.ts";
 import { ClawlingApiError } from "./api-types.ts";
 import { RefreshManager } from "./refresh-manager.ts";
 import type { OpenclawClawchatMutateConfigFile } from "./login.runtime.ts";
@@ -487,6 +488,20 @@ export interface StartGatewayParams {
    * of resetting on every fresh `RefreshManager`.
    */
   refreshManagerState?: { rejectedToken: string | null; lastAttemptAt: number };
+  /**
+   * Internal — the live (possibly rotated) refresh token, carried across a
+   * §D/§B gateway re-enter. A rotation persists config with `afterWrite:{mode:
+   * "none"}`, so the in-memory `cfg` handed to the re-enter is NOT reloaded and
+   * still holds the pre-rotation refresh token. For a "configured" (config-
+   * sourced) agent the re-enter would otherwise re-read that stale token and
+   * submit an already-consumed refresh token on the next refresh → a spurious
+   * `10003` auto-logout. Threading the live token forward closes that gap.
+   * SQLite-sourced agents are unaffected (their row already holds the rotated
+   * pair), but threading is harmless there too.
+   */
+  refreshTokenOverride?: string;
+  /** Test hook only — clock override for the refresh manager (min-interval / proactive timer). */
+  refreshNow?: () => number;
   /**
    * Internal — set when the current attempt is a plain transport-backoff
    * re-enter (transient/skipped reactive refresh). Carries the current (unchanged)
@@ -641,6 +656,19 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
   log?.info?.(
     `[${accountId}] clawchat-plugin-openclaw runtime start entered configured=${account.configured} enabled=${account.enabled} hasToken=${Boolean(account.token)} hasUserId=${Boolean(account.userId)} hasOwnerUserId=${Boolean(account.ownerUserId)} websocketUrl=${account.websocketUrl || "(empty)"}`,
   );
+  // Freeze one report device_id for this process; reused for the paired report
+  // so the backend links both to the same row. Imported from ./client.ts.
+  const reportDeviceId = resolveOpenclawClawlingDeviceId(account);
+  const pluginVersion = resolvePluginVersion();
+  void reportPluginVersionSafe({
+    baseUrl: account.baseUrl,
+    mediaBaseUrl: account.mediaBaseUrl,
+    token: "",
+    deviceId: reportDeviceId,
+    pluginVersion,
+    authenticated: false,
+    log,
+  });
   const activationAccount = await waitForActivationCredentials({
     account,
     abortSignal,
@@ -653,6 +681,17 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
   });
   if (!activationAccount) return;
   account = activationAccount.account;
+  // Paired: link the report row via the authenticated endpoint, reusing the
+  // SAME frozen device_id so the backend upserts the existing unpaired row.
+  void reportPluginVersionSafe({
+    baseUrl: account.baseUrl,
+    mediaBaseUrl: account.mediaBaseUrl,
+    token: account.token,
+    deviceId: reportDeviceId,
+    pluginVersion,
+    authenticated: true,
+    log,
+  });
   // §A.0 — fallback expiry source. Prefer the SQLite `activated_at`; null when
   // the credentials came from config (no activation row yet) — in that case the
   // refresh manager relies on the JWT `exp` alone.
@@ -828,10 +867,19 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
   // The refresh token is not part of the resolved account; source it from
   // SQLite first (authoritative after a rotation) then the config channel
   // section. Kept in a mutable cell so a swap updates it in place.
+  // §0/§D — a rotated refresh token threaded across a re-enter wins over the
+  // stores. The config write that persists a rotation uses `afterWrite:{mode:
+  // "none"}`, so the in-memory `cfg` here is the STALE pre-rotation snapshot;
+  // re-reading it (config-sourced agents) would submit an already-consumed
+  // token on the next refresh → spurious 10003 auto-logout.
   let latestRefreshToken: string | null =
+    (typeof params.refreshTokenOverride === "string" && params.refreshTokenOverride.trim()
+      ? params.refreshTokenOverride.trim()
+      : null) ??
     (activationAccount.source === "sqlite" && store?.getActivationCredentials
       ? store.getActivationCredentials({ platform: "openclaw", accountId })?.refreshToken
-      : null) ?? readConfigRefreshToken(cfg);
+      : null) ??
+    readConfigRefreshToken(cfg);
 
   const refreshManager = new RefreshManager({
     baseUrl: account.baseUrl,
@@ -881,6 +929,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
     ...(params.refreshSetTimer ? { setTimer: params.refreshSetTimer } : {}),
     ...(params.refreshClearTimer ? { clearTimer: params.refreshClearTimer } : {}),
     ...(params.refreshJitter ? { jitter: params.refreshJitter } : {}),
+    ...(params.refreshNow ? { now: params.refreshNow } : {}),
     log,
   });
   // §A.3/§A.4 — carry the single-flight latch + min-interval across re-enters so
@@ -1216,6 +1265,9 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
       void startOpenclawClawlingGateway({
         ...params,
         account: { ...params.account },
+        // Carry the live refresh token forward (a rotation earlier this lifecycle
+        // leaves the in-memory `cfg` stale; see refreshTokenOverride).
+        ...(latestRefreshToken ? { refreshTokenOverride: latestRefreshToken } : {}),
         transportBackoffReconnect: true,
         refreshReconnectDepth: streak.depth,
         refreshReconnectWindowStartedAt: streak.windowStartedAt,
@@ -1253,8 +1305,10 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
     }
     if (abortSignal.aborted) return;
     const streak = nextRefreshReconnectStreak();
-    // Re-enter with the rotated in-memory account; SQLite/config already hold
-    // the rotated pair (persisted before the swap). Reuse the same device id.
+    // Re-enter with the rotated in-memory account. SQLite (if present) holds the
+    // rotated pair, but the in-memory `cfg` is the STALE pre-rotation snapshot
+    // (the config write used `afterWrite:{mode:"none"}`), so a config-sourced
+    // agent must NOT re-read it — thread the live refresh token forward instead.
     await startOpenclawClawlingGateway({
       ...params,
       account: {
@@ -1264,6 +1318,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
         userId: account.userId,
         ownerUserId: account.ownerUserId,
       },
+      ...(latestRefreshToken ? { refreshTokenOverride: latestRefreshToken } : {}),
       refreshReconnectDepth: streak.depth,
       refreshReconnectWindowStartedAt: streak.windowStartedAt,
       refreshManagerState: managerState,