@clawling/clawchat-plugin-openclaw 2026.7.2-1 → 2026.7.6-1

package/dist/src/activation-greeting.js

@@ -0,0 +1,34 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+// Worded to make the greeting the single required action. Earlier wording
+// ("ClawChat activation bootstrap: ... do both ...") led some agents to treat
+// it as a setup task and write a `BOOTSTRAP.md` file instead of replying, so
+// no greeting reached the user. Lead with the chat reply, forbid file/tool
+// detours, and keep the profile update strictly optional and secondary.
+const ACTIVATION_BOOTSTRAP_FALLBACK = [
+    "You are now connected to a ClawChat direct conversation with your user.",
+    "Reply now with one short, friendly greeting message in this conversation: introduce yourself and say you are connected and ready.",
+    "Send it as a normal chat reply. Do not write or create any files or notes, and do not call tools just to greet.",
+    "Only if you already have your own profile details (display name, bio, or avatar) may you also call `clawchat_update_account_profile` (use `clawchat_upload_avatar_image` first for a local avatar image); otherwise skip that and just greet.",
+    "Do not ask the user for profile information.",
+].join("\n");
+// Cross-plugin, user-editable override read lazily so edits apply on the next
+// first-load without a restart. Any read failure falls back to the built-in text.
+export function buildActivationBootstrapText(homeDir = os.homedir()) {
+    const greetingPath = path.join(homeDir, "clawchat", "greeting.md");
+    try {
+        const raw = fs.readFileSync(greetingPath);
+        const override = new TextDecoder("utf-8", { fatal: true }).decode(raw).trim();
+        if (override.length > 0) {
+            return override;
+        }
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT") {
+            console.warn(`clawchat.greeting failed to read override ${greetingPath}:`, error);
+        }
+    }
+    return ACTIVATION_BOOTSTRAP_FALLBACK;
+}

package/dist/src/api-client.js

@@ -5,6 +5,7 @@ export function buildPluginReportBody(input) {
         device_id: input.deviceId,
         platform: input.platform,
         plugin_version: input.pluginVersion,
+        agent_version: input.agentVersion,
         runtime_name: input.runtimeName,
         runtime_version: input.runtimeVersion,
     };

package/dist/src/config.js

@@ -207,6 +207,28 @@ function decodeJwtStringClaim(token, claim) {
         return "";
     }
 }
+/**
+ * Resolve the bot-account userId, validated against the token's `sub` claim.
+ *
+ * The WS session authenticates with the access token, so the backend binds the
+ * session to the token's `sub` — that IS the bot's user id for this session.
+ * Unlike ownerUserId (explicit config wins over the `oid` claim), a configured
+ * userId that disagrees with `sub` is always wrong for the session this token
+ * creates, and it silently breaks self-echo detection: with the OWNER's id
+ * here, every owner message is dropped as the bot's own echo (2026-07-02
+ * production incident — a provisioner wrote the owner id into the config). Token
+ * wins; the mismatch is logged. Also derives userId from `sub` when nothing is
+ * configured, mirroring the `oid` fallback above.
+ */
+function resolveUserId(token, configured) {
+    const tokenSub = decodeJwtStringClaim(token, "sub");
+    if (!tokenSub)
+        return configured;
+    if (configured && configured !== tokenSub) {
+        console.warn(`clawchat userId mismatch: configured ${configured} does not equal the access token's sub claim ${tokenSub}; using the token value. A misconfigured userId (e.g. the owner's id) breaks self-echo detection and mention gating — fix the channel userId / CLAWCHAT_USER_ID.`);
+    }
+    return tokenSub;
+}
 function readGroupMode(value) {
     return value === "mention" ? "mention" : "all";
 }
@@ -312,7 +334,7 @@ export function resolveOpenclawClawlingAccount(cfg, env = process.env) {
     const mediaBaseUrl = readOptionalString(channel.mediaBaseUrl) || readEnvString(env, CLAWCHAT_MEDIA_BASE_URL_ENV);
     const token = readOptionalString(channel.token) || readEnvString(env, CLAWCHAT_TOKEN_ENV);
     const agentId = readOptionalString(channel.agentId) || readEnvString(env, CLAWCHAT_AGENT_ID_ENV);
-    const userId = readOptionalString(channel.userId) || readEnvString(env, CLAWCHAT_USER_ID_ENV);
+    const userId = resolveUserId(token, readOptionalString(channel.userId) || readEnvString(env, CLAWCHAT_USER_ID_ENV));
     const ownerUserId = readOptionalString(channel.ownerUserId) ||
         readEnvString(env, CLAWCHAT_OWNER_USER_ID_ENV) ||
         // Fall back to the access token's `oid` (owner) claim. A provisioner may

package/dist/src/plugin-report.js

@@ -53,6 +53,7 @@ export async function reportPluginVersionSafe(p) {
             deviceId: p.deviceId,
             platform: "openclaw",
             pluginVersion: p.pluginVersion,
+            agentVersion: p.agentVersion,
             runtimeName: "node",
             runtimeVersion: process.version,
         }, { authenticated: p.authenticated });

package/dist/src/runtime.js

@@ -4,6 +4,7 @@ import { hasControlCommand } from "openclaw/plugin-sdk/command-detection";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import { createOpenclawClawlingClient, resolveOpenclawClawlingDeviceId } from "./client.js";
 import { createOpenclawClawlingApiClient } from "./api-client.js";
+import { buildActivationBootstrapText } from "./activation-greeting.js";
 import { reportPluginVersionSafe, resolvePluginVersion } from "./plugin-report.js";
 import { ensureLivewareCli } from "./liveware-cli.js";
 import { ClawlingApiError } from "./api-types.js";
@@ -309,20 +310,6 @@ function withClawChatSessionScope(cfg) {
         },
     };
 }
-function buildActivationBootstrapText() {
-    // Worded to make the greeting the single required action. Earlier wording
-    // ("ClawChat activation bootstrap: ... do both ...") led some agents to treat
-    // it as a setup task and write a `BOOTSTRAP.md` file instead of replying, so
-    // no greeting reached the user. Lead with the chat reply, forbid file/tool
-    // detours, and keep the profile update strictly optional and secondary.
-    return [
-        "You are now connected to a ClawChat direct conversation with your user.",
-        "Reply now with one short, friendly greeting message in this conversation: introduce yourself and say you are connected and ready.",
-        "Send it as a normal chat reply. Do not write or create any files or notes, and do not call tools just to greet.",
-        "Only if you already have your own profile details (display name, bio, or avatar) may you also call `clawchat_update_account_profile` (use `clawchat_upload_avatar_image` first for a local avatar image); otherwise skip that and just greet.",
-        "Do not ask the user for profile information.",
-    ].join("\n");
-}
 function buildActivationBootstrapEnvelope(params) {
     const text = buildActivationBootstrapText();
     const now = Date.now();
@@ -574,6 +561,26 @@ function waitForActivationPoll(abortSignal, ms) {
 async function waitForActivationCredentials(params) {
     const { abortSignal, getStatus, setStatus, store, log } = params;
     const accountId = params.account.accountId;
+    // SQLite-first: activation and token rotation persist to the activations
+    // row, so a complete row is the durable credential source of truth even
+    // when channel config/env also carries credentials. Config/env credentials
+    // only bootstrap the no-row case (the caller seeds a row from them).
+    if (store?.getActivationCredentials) {
+        const stored = store.getActivationCredentials({ platform: "openclaw", accountId });
+        if (stored && stored.accessToken !== params.rejectedActivationToken) {
+            log?.info?.(`[${accountId}] clawchat-plugin-openclaw loaded activation credentials from sqlite`);
+            return {
+                source: "sqlite",
+                account: {
+                    ...params.account,
+                    configured: true,
+                    token: stored.accessToken,
+                    userId: stored.userId,
+                    ownerUserId: stored.ownerUserId,
+                },
+            };
+        }
+    }
     if (accountHasConnectCredentials(params.account)) {
         return { account: params.account, source: "configured" };
     }
@@ -647,12 +654,14 @@ export async function startOpenclawClawlingGateway(params) {
     // so the backend links both to the same row. Imported from ./client.ts.
     const reportDeviceId = resolveOpenclawClawlingDeviceId(account);
     const pluginVersion = resolvePluginVersion();
+    const agentVersion = runtime.version ?? "";
     void reportPluginVersionSafe({
         baseUrl: account.baseUrl,
         mediaBaseUrl: account.mediaBaseUrl,
         token: "",
         deviceId: reportDeviceId,
         pluginVersion,
+        agentVersion,
         authenticated: false,
         log,
     });
@@ -693,6 +702,26 @@ export async function startOpenclawClawlingGateway(params) {
     if (!activationAccount)
         return;
     account = activationAccount.account;
+    // Config/env bootstrap seeding: converge on SQLite as the single durable
+    // credential store, so token rotation always has a row to update and the
+    // next startup resolves SQLite-first to the same credentials.
+    if (activationAccount.source === "configured" && store?.upsertActivation) {
+        try {
+            store.upsertActivation({
+                platform: "openclaw",
+                accountId,
+                userId: account.userId,
+                ownerUserId: account.ownerUserId,
+                accessToken: account.token,
+                refreshToken: readConfigRefreshToken(cfg),
+                loginMethod: "config-seed",
+                deviceId: CHANNEL_ID,
+            });
+        }
+        catch (error) {
+            log?.error?.(`[${accountId}] clawchat-plugin-openclaw sqlite credential seed failed; continuing with config credentials: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     // Paired: link the report row via the authenticated endpoint, reusing the
     // SAME frozen device_id so the backend upserts the existing unpaired row.
     void reportPluginVersionSafe({
@@ -701,12 +730,15 @@ export async function startOpenclawClawlingGateway(params) {
         token: account.token,
         deviceId: reportDeviceId,
         pluginVersion,
+        agentVersion,
         authenticated: true,
         log,
     });
-    // §A.0 — fallback expiry source. Prefer the SQLite `activated_at`; null when
-    // the credentials came from config (no activation row yet) — in that case the
-    // refresh manager relies on the JWT `exp` alone.
+    // §A.0 — fallback expiry source. Prefer the SQLite `activated_at`; null for a
+    // configured start even though the seed block above may have just created a
+    // row — this cell only ever queries `store.getActivationCredentials` when
+    // `source === "sqlite"`, so a config-sourced account relies on the JWT `exp`
+    // alone until its next SQLite-first resolution.
     let activatedAtMs = activationAccount.source === "sqlite" && store?.getActivationCredentials
         ? store.getActivationCredentials({ platform: "openclaw", accountId })?.activatedAt ?? null
         : null;
@@ -872,16 +904,16 @@ export async function startOpenclawClawlingGateway(params) {
         getAccessToken: () => account.token,
         getRefreshToken: () => latestRefreshToken,
         persistRotatedTokens: async (tokens) => {
-            // §0 — persist to BOTH stores BEFORE the in-memory swap. A failure in
-            // EITHER store must REJECT so the manager skips the in-memory swap and
-            // treats the refresh as transient (keep the current tokens, back off). Do
-            // NOT swallow the SQLite write error: `rotateActivationTokens` returns
-            // `null` when its internal `write()` caught an exception (a real write
-            // failure), `false` only when no activation row exists yet (config-sourced
-            // agent — legitimately nothing to update). A swallowed write failure must
-            // not leave the SQLite row holding the now-dead refresh token while the
-            // in-memory token is rotated, which would brick a sqlite-sourced agent on
-            // restart.
+            // §0 — persist durably BEFORE the in-memory swap. SQLite is the
+            // startup credential source of truth: when a store is available its
+            // write must succeed or the refresh stays transient (no swap, keep
+            // current tokens, back off). A 0-row UPDATE (`false`) means the
+            // activations row is missing (e.g. cleared out-of-band) rather than a
+            // write failure — self-heal by re-seeding it from the in-memory
+            // identity with the ROTATED pair (mirrors Hermes's seed-on-rotate
+            // §C.2 semantics), then continue exactly as on success. `null` is a
+            // caught write exception and stays transient — that's a real failure,
+            // not a missing row.
             if (store?.rotateActivationTokens) {
                 const rotateResult = store.rotateActivationTokens({
                     platform: "openclaw",
@@ -889,12 +921,42 @@ export async function startOpenclawClawlingGateway(params) {
                     accessToken: tokens.accessToken,
                     refreshToken: tokens.refreshToken,
                 });
-                if (rotateResult === null) {
+                if (rotateResult === false) {
+                    if (!store.upsertActivation) {
+                        throw new Error("clawchat-plugin-openclaw sqlite rotate activation tokens failed");
+                    }
+                    try {
+                        store.upsertActivation({
+                            platform: "openclaw",
+                            accountId,
+                            userId: account.userId,
+                            ownerUserId: account.ownerUserId,
+                            accessToken: tokens.accessToken,
+                            refreshToken: tokens.refreshToken,
+                            loginMethod: "config-seed",
+                            deviceId: refreshDeviceId,
+                        });
+                    }
+                    catch {
+                        throw new Error("clawchat-plugin-openclaw sqlite rotate activation tokens failed");
+                    }
+                }
+                else if (rotateResult === null) {
                     throw new Error("clawchat-plugin-openclaw sqlite rotate activation tokens failed");
                 }
+                // Channel config is a human-readable mirror once SQLite holds the
+                // pair — sync best-effort, never fail the refresh over it.
+                try {
+                    await persistConfigTokens(tokens);
+                }
+                catch (error) {
+                    log?.error?.(`[${accountId}] clawchat-plugin-openclaw config token mirror failed (sqlite already rotated): ${error instanceof Error ? error.message : String(error)}`);
+                }
+                return;
             }
-            // A config write failure rejects out of `mutateConfigFile` and propagates
-            // here, which is what we want — persistence incomplete ⇒ no swap.
+            // No SQLite store available — channel config is the only durable
+            // store, so its write failure must reject and keep the refresh
+            // transient (pre-existing behavior for store-less test transports).
             await persistConfigTokens(tokens);
         },
         swapInMemoryTokens: (tokens) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawling/clawchat-plugin-openclaw",
-  "version": "2026.7.2-1",
+  "version": "2026.7.6-1",
   "description": "OpenClaw ClawChat channel plugin",
   "license": "MIT",
   "author": "CLAWLING PTE. LTD.",

package/src/activation-greeting.ts

@@ -0,0 +1,35 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Worded to make the greeting the single required action. Earlier wording
+// ("ClawChat activation bootstrap: ... do both ...") led some agents to treat
+// it as a setup task and write a `BOOTSTRAP.md` file instead of replying, so
+// no greeting reached the user. Lead with the chat reply, forbid file/tool
+// detours, and keep the profile update strictly optional and secondary.
+const ACTIVATION_BOOTSTRAP_FALLBACK = [
+  "You are now connected to a ClawChat direct conversation with your user.",
+  "Reply now with one short, friendly greeting message in this conversation: introduce yourself and say you are connected and ready.",
+  "Send it as a normal chat reply. Do not write or create any files or notes, and do not call tools just to greet.",
+  "Only if you already have your own profile details (display name, bio, or avatar) may you also call `clawchat_update_account_profile` (use `clawchat_upload_avatar_image` first for a local avatar image); otherwise skip that and just greet.",
+  "Do not ask the user for profile information.",
+].join("\n");
+
+// Cross-plugin, user-editable override read lazily so edits apply on the next
+// first-load without a restart. Any read failure falls back to the built-in text.
+export function buildActivationBootstrapText(homeDir: string = os.homedir()): string {
+  const greetingPath = path.join(homeDir, "clawchat", "greeting.md");
+  try {
+    const raw = fs.readFileSync(greetingPath);
+    const override = new TextDecoder("utf-8", { fatal: true }).decode(raw).trim();
+    if (override.length > 0) {
+      return override;
+    }
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code !== "ENOENT") {
+      console.warn(`clawchat.greeting failed to read override ${greetingPath}:`, error);
+    }
+  }
+  return ACTIVATION_BOOTSTRAP_FALLBACK;
+}

package/src/api-client.ts

@@ -24,6 +24,7 @@ export interface PluginReportInput {
   deviceId: string;
   platform: string;
   pluginVersion: string;
+  agentVersion: string;
   runtimeName: string;
   runtimeVersion: string;
 }
@@ -33,6 +34,7 @@ export function buildPluginReportBody(input: PluginReportInput): Record<string,
     device_id: input.deviceId,
     platform: input.platform,
     plugin_version: input.pluginVersion,
+    agent_version: input.agentVersion,
     runtime_name: input.runtimeName,
     runtime_version: input.runtimeVersion,
   };

package/src/config.ts

@@ -332,6 +332,30 @@ function decodeJwtStringClaim(token: string, claim: string): string {
   }
 }
 
+/**
+ * Resolve the bot-account userId, validated against the token's `sub` claim.
+ *
+ * The WS session authenticates with the access token, so the backend binds the
+ * session to the token's `sub` — that IS the bot's user id for this session.
+ * Unlike ownerUserId (explicit config wins over the `oid` claim), a configured
+ * userId that disagrees with `sub` is always wrong for the session this token
+ * creates, and it silently breaks self-echo detection: with the OWNER's id
+ * here, every owner message is dropped as the bot's own echo (2026-07-02
+ * production incident — a provisioner wrote the owner id into the config). Token
+ * wins; the mismatch is logged. Also derives userId from `sub` when nothing is
+ * configured, mirroring the `oid` fallback above.
+ */
+function resolveUserId(token: string, configured: string): string {
+  const tokenSub = decodeJwtStringClaim(token, "sub");
+  if (!tokenSub) return configured;
+  if (configured && configured !== tokenSub) {
+    console.warn(
+      `clawchat userId mismatch: configured ${configured} does not equal the access token's sub claim ${tokenSub}; using the token value. A misconfigured userId (e.g. the owner's id) breaks self-echo detection and mention gating — fix the channel userId / CLAWCHAT_USER_ID.`,
+    );
+  }
+  return tokenSub;
+}
+
 function readGroupMode(value: unknown): GroupMode {
   return value === "mention" ? "mention" : "all";
 }
@@ -465,7 +489,10 @@ export function resolveOpenclawClawlingAccount(
     readOptionalString(channel.mediaBaseUrl) || readEnvString(env, CLAWCHAT_MEDIA_BASE_URL_ENV);
   const token = readOptionalString(channel.token) || readEnvString(env, CLAWCHAT_TOKEN_ENV);
   const agentId = readOptionalString(channel.agentId) || readEnvString(env, CLAWCHAT_AGENT_ID_ENV);
-  const userId = readOptionalString(channel.userId) || readEnvString(env, CLAWCHAT_USER_ID_ENV);
+  const userId = resolveUserId(
+    token,
+    readOptionalString(channel.userId) || readEnvString(env, CLAWCHAT_USER_ID_ENV),
+  );
   const ownerUserId =
     readOptionalString(channel.ownerUserId) ||
     readEnvString(env, CLAWCHAT_OWNER_USER_ID_ENV) ||

package/src/plugin-report.ts

@@ -46,6 +46,7 @@ export interface ReportParams {
   token: string;
   deviceId: string;
   pluginVersion: string;
+  agentVersion: string;
   authenticated: boolean;
   log?: { debug?: (msg: string) => void };
 }
@@ -66,6 +67,7 @@ export async function reportPluginVersionSafe(p: ReportParams): Promise<void> {
         deviceId: p.deviceId,
         platform: "openclaw",
         pluginVersion: p.pluginVersion,
+        agentVersion: p.agentVersion,
         runtimeName: "node",
         runtimeVersion: process.version,
       },

package/src/runtime.ts

@@ -15,6 +15,7 @@ import type { OpenClawConfig, PluginRuntime } from "openclaw/plugin-sdk/core";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import { createOpenclawClawlingClient, resolveOpenclawClawlingDeviceId } from "./client.ts";
 import { createOpenclawClawlingApiClient } from "./api-client.ts";
+import { buildActivationBootstrapText } from "./activation-greeting.ts";
 import { reportPluginVersionSafe, resolvePluginVersion } from "./plugin-report.ts";
 import { ensureLivewareCli } from "./liveware-cli.ts";
 import { ClawlingApiError } from "./api-types.ts";
@@ -101,6 +102,7 @@ type RuntimeConnectionStore = Pick<
     Pick<
       ClawChatStore,
       | "getActivationCredentials"
+      | "upsertActivation"
       | "rotateActivationTokens"
       | "clearActivationCredentials"
       | "insertMessage"
@@ -456,21 +458,6 @@ function withClawChatSessionScope(cfg: OpenClawConfig): OpenClawConfig {
   };
 }
 
-function buildActivationBootstrapText(): string {
-  // Worded to make the greeting the single required action. Earlier wording
-  // ("ClawChat activation bootstrap: ... do both ...") led some agents to treat
-  // it as a setup task and write a `BOOTSTRAP.md` file instead of replying, so
-  // no greeting reached the user. Lead with the chat reply, forbid file/tool
-  // detours, and keep the profile update strictly optional and secondary.
-  return [
-    "You are now connected to a ClawChat direct conversation with your user.",
-    "Reply now with one short, friendly greeting message in this conversation: introduce yourself and say you are connected and ready.",
-    "Send it as a normal chat reply. Do not write or create any files or notes, and do not call tools just to greet.",
-    "Only if you already have your own profile details (display name, bio, or avatar) may you also call `clawchat_update_account_profile` (use `clawchat_upload_avatar_image` first for a local avatar image); otherwise skip that and just greet.",
-    "Do not ask the user for profile information.",
-  ].join("\n");
-}
-
 function buildActivationBootstrapEnvelope(params: {
   account: ResolvedOpenclawClawlingAccount;
   conversationId: string;
@@ -872,6 +859,28 @@ async function waitForActivationCredentials(params: {
 }): Promise<{ account: ResolvedOpenclawClawlingAccount; source: "configured" | "sqlite" } | null> {
   const { abortSignal, getStatus, setStatus, store, log } = params;
   const accountId = params.account.accountId;
+  // SQLite-first: activation and token rotation persist to the activations
+  // row, so a complete row is the durable credential source of truth even
+  // when channel config/env also carries credentials. Config/env credentials
+  // only bootstrap the no-row case (the caller seeds a row from them).
+  if (store?.getActivationCredentials) {
+    const stored = store.getActivationCredentials({ platform: "openclaw", accountId });
+    if (stored && stored.accessToken !== params.rejectedActivationToken) {
+      log?.info?.(
+        `[${accountId}] clawchat-plugin-openclaw loaded activation credentials from sqlite`,
+      );
+      return {
+        source: "sqlite",
+        account: {
+          ...params.account,
+          configured: true,
+          token: stored.accessToken,
+          userId: stored.userId,
+          ownerUserId: stored.ownerUserId,
+        },
+      };
+    }
+  }
   if (accountHasConnectCredentials(params.account)) {
     return { account: params.account, source: "configured" };
   }
@@ -957,12 +966,14 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
   // so the backend links both to the same row. Imported from ./client.ts.
   const reportDeviceId = resolveOpenclawClawlingDeviceId(account);
   const pluginVersion = resolvePluginVersion();
+  const agentVersion = runtime.version ?? "";
   void reportPluginVersionSafe({
     baseUrl: account.baseUrl,
     mediaBaseUrl: account.mediaBaseUrl,
     token: "",
     deviceId: reportDeviceId,
     pluginVersion,
+    agentVersion,
     authenticated: false,
     log,
   });
@@ -1002,6 +1013,27 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
   });
   if (!activationAccount) return;
   account = activationAccount.account;
+  // Config/env bootstrap seeding: converge on SQLite as the single durable
+  // credential store, so token rotation always has a row to update and the
+  // next startup resolves SQLite-first to the same credentials.
+  if (activationAccount.source === "configured" && store?.upsertActivation) {
+    try {
+      store.upsertActivation({
+        platform: "openclaw",
+        accountId,
+        userId: account.userId,
+        ownerUserId: account.ownerUserId,
+        accessToken: account.token,
+        refreshToken: readConfigRefreshToken(cfg),
+        loginMethod: "config-seed",
+        deviceId: CHANNEL_ID,
+      });
+    } catch (error) {
+      log?.error?.(
+        `[${accountId}] clawchat-plugin-openclaw sqlite credential seed failed; continuing with config credentials: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
   // Paired: link the report row via the authenticated endpoint, reusing the
   // SAME frozen device_id so the backend upserts the existing unpaired row.
   void reportPluginVersionSafe({
@@ -1010,12 +1042,15 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
     token: account.token,
     deviceId: reportDeviceId,
     pluginVersion,
+    agentVersion,
     authenticated: true,
     log,
   });
-  // §A.0 — fallback expiry source. Prefer the SQLite `activated_at`; null when
-  // the credentials came from config (no activation row yet) — in that case the
-  // refresh manager relies on the JWT `exp` alone.
+  // §A.0 — fallback expiry source. Prefer the SQLite `activated_at`; null for a
+  // configured start even though the seed block above may have just created a
+  // row — this cell only ever queries `store.getActivationCredentials` when
+  // `source === "sqlite"`, so a config-sourced account relies on the JWT `exp`
+  // alone until its next SQLite-first resolution.
   let activatedAtMs: number | null =
     activationAccount.source === "sqlite" && store?.getActivationCredentials
       ? store.getActivationCredentials({ platform: "openclaw", accountId })?.activatedAt ?? null
@@ -1208,16 +1243,16 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
     getAccessToken: () => account.token,
     getRefreshToken: () => latestRefreshToken,
     persistRotatedTokens: async (tokens) => {
-      // §0 — persist to BOTH stores BEFORE the in-memory swap. A failure in
-      // EITHER store must REJECT so the manager skips the in-memory swap and
-      // treats the refresh as transient (keep the current tokens, back off). Do
-      // NOT swallow the SQLite write error: `rotateActivationTokens` returns
-      // `null` when its internal `write()` caught an exception (a real write
-      // failure), `false` only when no activation row exists yet (config-sourced
-      // agent — legitimately nothing to update). A swallowed write failure must
-      // not leave the SQLite row holding the now-dead refresh token while the
-      // in-memory token is rotated, which would brick a sqlite-sourced agent on
-      // restart.
+      // §0 — persist durably BEFORE the in-memory swap. SQLite is the
+      // startup credential source of truth: when a store is available its
+      // write must succeed or the refresh stays transient (no swap, keep
+      // current tokens, back off). A 0-row UPDATE (`false`) means the
+      // activations row is missing (e.g. cleared out-of-band) rather than a
+      // write failure — self-heal by re-seeding it from the in-memory
+      // identity with the ROTATED pair (mirrors Hermes's seed-on-rotate
+      // §C.2 semantics), then continue exactly as on success. `null` is a
+      // caught write exception and stays transient — that's a real failure,
+      // not a missing row.
       if (store?.rotateActivationTokens) {
         const rotateResult = store.rotateActivationTokens({
           platform: "openclaw",
@@ -1225,12 +1260,41 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
           accessToken: tokens.accessToken,
           refreshToken: tokens.refreshToken,
         });
-        if (rotateResult === null) {
+        if (rotateResult === false) {
+          if (!store.upsertActivation) {
+            throw new Error("clawchat-plugin-openclaw sqlite rotate activation tokens failed");
+          }
+          try {
+            store.upsertActivation({
+              platform: "openclaw",
+              accountId,
+              userId: account.userId,
+              ownerUserId: account.ownerUserId,
+              accessToken: tokens.accessToken,
+              refreshToken: tokens.refreshToken,
+              loginMethod: "config-seed",
+              deviceId: refreshDeviceId,
+            });
+          } catch {
+            throw new Error("clawchat-plugin-openclaw sqlite rotate activation tokens failed");
+          }
+        } else if (rotateResult === null) {
           throw new Error("clawchat-plugin-openclaw sqlite rotate activation tokens failed");
         }
+        // Channel config is a human-readable mirror once SQLite holds the
+        // pair — sync best-effort, never fail the refresh over it.
+        try {
+          await persistConfigTokens(tokens);
+        } catch (error) {
+          log?.error?.(
+            `[${accountId}] clawchat-plugin-openclaw config token mirror failed (sqlite already rotated): ${error instanceof Error ? error.message : String(error)}`,
+          );
+        }
+        return;
       }
-      // A config write failure rejects out of `mutateConfigFile` and propagates
-      // here, which is what we want — persistence incomplete ⇒ no swap.
+      // No SQLite store available — channel config is the only durable
+      // store, so its write failure must reject and keep the refresh
+      // transient (pre-existing behavior for store-less test transports).
       await persistConfigTokens(tokens);
     },
     swapInMemoryTokens: (tokens) => {