@clawling/clawchat-plugin-openclaw 2026.9.10-1 → 2026.9.13-1

package/dist/src/liveware-sample.js

@@ -11,6 +11,8 @@ import net from "node:net";
 import path from "node:path";
 import { DEFAULT_SKILLS_REF, OFFICIAL_SKILLS_BASE } from "./skill-update.js";
 import { livewareCliEnv } from "./liveware-cli.js";
+import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/setup";
+import { normalizeOpenclawClawlingAccountId } from "./config.js";
 export const LIVEWARES_TARGET = "openclaw";
 export const LIVEWARE_SAMPLE_ID = "liveware-sample";
 export const LIVEWARE_SAMPLE_APP_NAME = "Liveware Sample";
@@ -127,6 +129,15 @@ async function localInstallMatches(appDir, entry) {
         return false; // missing / unreadable — treat as "not installed"
     }
 }
+/**
+ * Suffix for the `app.tmp-…` / `app.old-…` staging dirs. The pid keeps two
+ * PROCESSES apart; the account id keeps two supervisors inside ONE process
+ * apart, which share a pid and could otherwise share a staging tree.
+ */
+function stagingSuffix(accountId) {
+    const id = normalizeOpenclawClawlingAccountId(accountId);
+    return id === DEFAULT_ACCOUNT_ID ? `${process.pid}` : `${process.pid}-${id}`;
+}
 /**
  * Download + verify + atomically install the sample under `<sampleRoot>/app`.
  * Preserves USER_DATA_FILES from an existing install. Throws on any failure;
@@ -155,7 +166,8 @@ export async function downloadLivewareSample(opts) {
             await fs.promises.rm(path.join(opts.sampleRoot, name), { recursive: true, force: true }).catch(() => { });
         }
     }
-    const tmpDir = path.join(opts.sampleRoot, `app.tmp-${process.pid}`);
+    const swapSuffix = stagingSuffix(opts.accountId);
+    const tmpDir = path.join(opts.sampleRoot, `app.tmp-${swapSuffix}`);
     await fs.promises.rm(tmpDir, { recursive: true, force: true });
     await fs.promises.mkdir(tmpDir, { recursive: true });
     try {
@@ -182,7 +194,7 @@ export async function downloadLivewareSample(opts) {
         // handle, and doing it first leaves no app/ at all when it fails. Renaming
         // aside puts the new tree in place first and makes the delete best-effort:
         // a leftover app.old-<pid> is swept on the next run, never a broken install.
-        const oldDir = path.join(opts.sampleRoot, `app.old-${process.pid}`);
+        const oldDir = path.join(opts.sampleRoot, `app.old-${swapSuffix}`);
         await fs.promises.rm(oldDir, { recursive: true, force: true }).catch(() => { });
         if (fs.existsSync(appDir)) {
             await withFsSwapRetry(() => fs.promises.rename(appDir, oldDir));
@@ -737,6 +749,7 @@ export class LivewareSampleSupervisor {
         }
         const { version, appDir } = await downloadLivewareSample({
             fetchFn: deps.fetchFn, sampleRoot: deps.sampleRoot, ref: deps.ref,
+            accountId: deps.accountId,
         });
         if (this.bailIfStopped())
             return;
@@ -826,6 +839,7 @@ export class LivewareSampleSupervisor {
         try {
             const dl = await downloadLivewareSample({
                 fetchFn: deps.fetchFn, sampleRoot: deps.sampleRoot, ref: deps.ref,
+                accountId: deps.accountId,
             });
             version = dl.version;
             appDir = dl.appDir;

package/dist/src/llm-context-debug.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { resolveStateDirFromEnv } from "./state-paths.js";
 function envEnabled(value) {
     return ["1", "true", "yes", "on"].includes(String(value ?? "").trim().toLowerCase());
 }
@@ -10,7 +11,12 @@ function safeId(value) {
 export function createOpenclawLlmContextDebug(params = {}) {
     const env = params.env ?? process.env;
     const enabled = envEnabled(env.CLAWCHAT_LLM_CONTEXT_DEBUG);
-    const snapshotRoot = path.resolve(env.CLAWCHAT_LLM_CONTEXT_SNAPSHOT_DIR || params.defaultSnapshotRoot || ".clawchat-llm-context-debug");
+    // Default under the per-instance OpenClaw state dir, never the process cwd:
+    // two profiles launched from one directory must not interleave runs and
+    // overwrite each other's `latest.json`.
+    const snapshotRoot = path.resolve(env.CLAWCHAT_LLM_CONTEXT_SNAPSHOT_DIR ||
+        params.defaultSnapshotRoot ||
+        path.join(resolveStateDirFromEnv(env), "clawchat", "llm-context-debug"));
     return {
         enabled,
         captureFullInput: envEnabled(env.CLAWCHAT_LLM_CONTEXT_CAPTURE_FULL_INPUT),

package/dist/src/login.runtime.js

@@ -2,7 +2,9 @@ import { createInterface } from "node:readline/promises";
 import { createOpenclawClawlingApiClient } from "./api-client.js";
 import { ClawlingApiError } from "./api-types.js";
 import { resolvePluginVersion } from "./plugin-report.js";
-import { CHANNEL_ID, mergeOpenclawClawchatRuntimePluginActivation, mergeOpenclawClawchatToolAllow, resolveOpenclawClawlingAccount, } from "./config.js";
+import { patchOpenclawClawlingAccountSection } from "./account-config-writes.js";
+import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/setup";
+import { CHANNEL_ID, mergeOpenclawClawchatRuntimePluginActivation, mergeOpenclawClawchatToolAllow, normalizeOpenclawClawlingAccountId, readOpenclawClawlingAccountSection, resolveOpenclawClawlingAccount, } from "./config.js";
 import { getClawChatStore } from "./storage.js";
 /**
  * Platform tag sent to `/v1/agents/connect`. Identifies the host of this
@@ -24,8 +26,7 @@ export const AGENT_NOT_FOUND_CODE = 16001;
 /**
  * Thrown when redeeming an invite code would silently replace a live activation.
  *
- * This channel holds exactly one ClawChat identity — `channels.<id>` is a single
- * slot and `listOpenclawClawlingAccountIds()` returns a single account. Because
+ * Each account slot holds exactly one ClawChat identity. Because
  * the stored `user_id` is replayed as a re-pair hint, redeeming a *new* invite
  * code here cannot produce a second agent: the server binds the code to the
  * existing agent, consumes it, creates no second agent and no second contact
@@ -45,9 +46,9 @@ export class ExistingActivationError extends Error {
             "  - RESTORE the identity above (re-pairs that same agent; if it was " +
             "deleted this brings it back with its history): " +
             "/clawchat-activate <CODE> --repair\n" +
-            "  - To run a SECOND agent alongside this one instead, give it its own " +
-            "OpenClaw home:\n" +
-            "      OPENCLAW_HOME=<path> openclaw channels login --channel clawchat-plugin-openclaw");
+            "  - To run a SECOND agent alongside this one instead, activate it as a " +
+            "named account: /clawchat-activate <CODE> --account <name>  (or: openclaw " +
+            "channels add --channel clawchat-plugin-openclaw --account <name> --token <CODE>)");
         this.name = "ExistingActivationError";
         this.userId = userId;
         this.agentId = agentId;
@@ -113,37 +114,30 @@ async function promptActivationIntentFromStdin(runtime, who) {
         rl?.close();
     }
 }
-function buildLoginConfig(cfg, result) {
-    const channels = (cfg.channels ?? {});
-    const existing = (channels[CHANNEL_ID] ?? {});
+function buildLoginConfig(cfg, accountId, result) {
+    const existing = readOpenclawClawlingAccountSection(cfg, accountId);
     const groupMode = existing.groupMode === "mention" || existing.groupMode === "all"
         ? existing.groupMode
         : "all";
     const groupCommandMode = existing.groupCommandMode === "all" || existing.groupCommandMode === "off"
         ? existing.groupCommandMode
         : "owner";
-    const nextSection = {
-        ...existing,
+    const patch = {
         enabled: true,
-        groupMode,
-        groupCommandMode,
+        // Group policy defaults are root-level shared keys; named accounts inherit
+        // them and only carry credentials.
+        ...(accountId === DEFAULT_ACCOUNT_ID ? { groupMode, groupCommandMode } : {}),
         token: result.access_token,
+        // `undefined` deletes the key so a login without a refresh token never
+        // leaves a stale one behind.
+        refreshToken: result.refresh_token ? result.refresh_token : undefined,
         ...(result.agent.id ? { agentId: result.agent.id } : {}),
         userId: result.agent.user_id,
         ownerUserId: result.agent.owner_id,
     };
-    if (result.refresh_token) {
-        nextSection.refreshToken = result.refresh_token;
-    }
-    else {
-        delete nextSection.refreshToken;
-    }
-    return mergeOpenclawClawchatRuntimePluginActivation(mergeOpenclawClawchatToolAllow({
-        ...cfg,
-        channels: { ...channels, [CHANNEL_ID]: nextSection },
-    }));
+    return mergeOpenclawClawchatRuntimePluginActivation(mergeOpenclawClawchatToolAllow(patchOpenclawClawlingAccountSection(cfg, accountId, patch)));
 }
-async function persistLoginConfig(params, result) {
+async function persistLoginConfig(accountId, params, result) {
     if (params.mutateConfigFile) {
         params.runtime.log(`Persisting ClawChat credentials and plugin activation for userId=${result.agent.user_id} ownerUserId=${result.agent.owner_id} with Gateway restart intent.`);
         await params.mutateConfigFile({
@@ -152,7 +146,7 @@ async function persistLoginConfig(params, result) {
                 reason: "clawchat-plugin-openclaw credentials changed",
             },
             mutate(draft) {
-                Object.assign(draft, buildLoginConfig(draft, result));
+                Object.assign(draft, buildLoginConfig(draft, accountId, result));
             },
         });
         params.runtime.log(`ClawChat credentials and plugin activation persisted for userId=${result.agent.user_id} ownerUserId=${result.agent.owner_id}.`);
@@ -160,7 +154,7 @@ async function persistLoginConfig(params, result) {
     }
     if (params.persistConfig) {
         params.runtime.log(`Persisting ClawChat credentials and plugin activation for userId=${result.agent.user_id} ownerUserId=${result.agent.owner_id}.`);
-        await params.persistConfig(buildLoginConfig(params.cfg, result));
+        await params.persistConfig(buildLoginConfig(params.cfg, accountId, result));
         params.runtime.log(`ClawChat credentials and plugin activation persisted for userId=${result.agent.user_id} ownerUserId=${result.agent.owner_id}.`);
         return;
     }
@@ -198,10 +192,11 @@ function readOptionalConnectString(value, fieldName) {
  */
 export async function runOpenclawClawlingLogin(params) {
     const { cfg, runtime } = params;
+    const accountId = normalizeOpenclawClawlingAccountId(params.accountId);
     // `resolveOpenclawClawlingAccount` falls back to the built-in
     // `DEFAULT_BASE_URL` / `DEFAULT_WEBSOCKET_URL` when the operator has not
     // overridden them, so login works without a prior `openclaw channels setup --channel clawchat-plugin-openclaw`.
-    const account = resolveOpenclawClawlingAccount(cfg);
+    const account = resolveOpenclawClawlingAccount(cfg, accountId);
     // Fork before the invite code is even read, so neither branch spends the code
     // before the outcome is settled. "Live" is decided by whether a usable token
     // remains: auto-logout (§C) blanks the tokens but preserves the identity, so a
@@ -315,8 +310,11 @@ export async function runOpenclawClawlingLogin(params) {
             }
             : {}),
     };
-    runtime.log(`Updating config: channels.${CHANNEL_ID}.token=[REDACTED] agentId=${normalizedResult.agent.id || "-"} userId=${normalizedResult.agent.user_id} ownerUserId=${normalizedResult.agent.owner_id}${normalizedResult.refresh_token ? " refreshToken=[REDACTED]" : ""} plugins.entries.${CHANNEL_ID}.enabled=true plugins.allow+=${CHANNEL_ID} …`);
-    await persistLoginConfig(params, normalizedResult);
+    const configPath = accountId === DEFAULT_ACCOUNT_ID
+        ? `channels.${CHANNEL_ID}`
+        : `channels.${CHANNEL_ID}.accounts.${accountId}`;
+    runtime.log(`Updating config: ${configPath}.token=[REDACTED] agentId=${normalizedResult.agent.id || "-"} userId=${normalizedResult.agent.user_id} ownerUserId=${normalizedResult.agent.owner_id}${normalizedResult.refresh_token ? " refreshToken=[REDACTED]" : ""} plugins.entries.${CHANNEL_ID}.enabled=true plugins.allow+=${CHANNEL_ID} …`);
+    await persistLoginConfig(accountId, params, normalizedResult);
     try {
         const store = params.store ??
             getClawChatStore({

package/dist/src/outbound.js

@@ -673,8 +673,8 @@ export const openclawClawlingOutbound = {
     textChunkLimit: 4000,
     ...createAttachedChannelResultAdapter({
         channel: CHANNEL_ID,
-        sendText: async ({ cfg, to, text }) => {
-            const account = resolveOpenclawClawlingAccount(cfg);
+        sendText: async ({ cfg, to, text, accountId }) => {
+            const account = resolveOpenclawClawlingAccount(cfg, accountId);
             const client = getOpenclawClawlingClient(account.accountId) ??
                 (await waitForOpenclawClawlingClient(account.accountId));
             const target = parseOpenclawRecipient(to);
@@ -709,8 +709,8 @@ export const openclawClawlingOutbound = {
                 messageId: result?.messageId ?? messageId,
             };
         },
-        sendMedia: async ({ cfg, to, text, mediaUrl, mediaAccess, mediaLocalRoots, mediaReadFile }) => {
-            const account = resolveOpenclawClawlingAccount(cfg);
+        sendMedia: async ({ cfg, to, text, mediaUrl, mediaAccess, mediaLocalRoots, mediaReadFile, accountId }) => {
+            const account = resolveOpenclawClawlingAccount(cfg, accountId);
             const client = getOpenclawClawlingClient(account.accountId) ??
                 (await waitForOpenclawClawlingClient(account.accountId));
             if (!mediaUrl?.trim()) {

package/dist/src/permission-result.js

@@ -20,16 +20,42 @@
  * The discriminator is `payload.metadata.kind === "permission_result"`.
  */
 import { EVENT } from "./protocol-types.js";
-// Module-level dedup set — `request_id` values are stable backend identifiers.
-// A duplicate receipt (e.g. from WS replay on reconnect) must not re-trigger
-// an agent turn.
-const _seenRequestIds = new Set();
 /**
- * @internal Test helper — reset the dedup set between isolated test runs.
+ * Upper bound on retained `request_id`s per account (FIFO eviction). Mirrors
+ * `createNotifySignalObserver` in `src/ws-alignment.ts`: permission receipts
+ * are rare (one per owner decision), so 512 covers any realistic replay window
+ * while keeping a long-running gateway's memory flat.
+ */
+export const PERMISSION_RESULT_DEDUP_MAX_SEEN = 512;
+// Dedup state partitioned by accountId — `request_id` values are stable backend
+// identifiers scoped to the agent identity that raised the request, so one
+// account's history must never suppress another account's receipt with the
+// same id. A duplicate receipt within one account (e.g. from WS replay on
+// reconnect) must not re-trigger an agent turn.
+const _seenRequestIdsByAccount = new Map();
+function seenRequestIdsFor(accountId) {
+    let entry = _seenRequestIdsByAccount.get(accountId);
+    if (!entry) {
+        entry = { seen: new Set(), order: [] };
+        _seenRequestIdsByAccount.set(accountId, entry);
+    }
+    return entry;
+}
+function markRequestIdSeen(entry, requestId) {
+    entry.seen.add(requestId);
+    entry.order.push(requestId);
+    while (entry.order.length > PERMISSION_RESULT_DEDUP_MAX_SEEN) {
+        const evicted = entry.order.shift();
+        if (evicted !== undefined)
+            entry.seen.delete(evicted);
+    }
+}
+/**
+ * @internal Test helper — reset the dedup state between isolated test runs.
  * Never call this in production code.
  */
 export function _resetPermissionResultDedup() {
-    _seenRequestIds.clear();
+    _seenRequestIdsByAccount.clear();
 }
 function buildOutcomeNote(metadata) {
     const { operation, outcome, reason } = metadata;
@@ -107,8 +133,10 @@ export function buildPermissionResultEnvelope(params) {
     };
 }
 /**
- * Handles a `permission_result` receipt. Deduplicates by `request_id`
- * (idempotent — WS replay on reconnect may deliver the same receipt again).
+ * Handles a `permission_result` receipt. Deduplicates by `request_id` within
+ * the receiving account (idempotent — WS replay on reconnect may deliver the
+ * same receipt again), retaining at most {@link PERMISSION_RESULT_DEDUP_MAX_SEEN}
+ * ids per account (oldest evicted first).
  *
  * An empty/falsy `request_id` is never added to the dedup set — two receipts
  * can legitimately share an empty id, and both must still be rendered — but
@@ -127,9 +155,11 @@ export function buildPermissionResultEnvelope(params) {
 export function handlePermissionResult(metadata, account, ownerConversationId) {
     if (!ownerConversationId)
         return null;
-    if (metadata.request_id && _seenRequestIds.has(metadata.request_id))
-        return null;
-    if (metadata.request_id)
-        _seenRequestIds.add(metadata.request_id);
+    if (metadata.request_id) {
+        const entry = seenRequestIdsFor(account.accountId);
+        if (entry.seen.has(metadata.request_id))
+            return null;
+        markRequestIdSeen(entry, metadata.request_id);
+    }
     return buildPermissionResultEnvelope({ account, metadata, ownerConversationId });
 }

package/dist/src/runtime.js

@@ -6,13 +6,14 @@ import { createOpenclawClawlingClient, resolveOpenclawClawlingDeviceId } from ".
 import { createOpenclawClawlingApiClient } from "./api-client.js";
 import { buildActivationBootstrapText } from "./activation-greeting.js";
 import { reportPluginVersionSafe, resolvePluginVersion } from "./plugin-report.js";
-import path from "node:path";
-import { ensureLivewareCli, livewareCliHomeDir, resolveLivewarePath } from "./liveware-cli.js";
+import { ensureLivewareCli, livewareCliHomeDir, livewareSampleRootDir, resolveLivewarePath, } from "./liveware-cli.js";
 import { LivewareSampleSupervisor, } from "./liveware-sample.js";
 import { ClawlingApiError } from "./api-types.js";
 import { RefreshManager } from "./refresh-manager.js";
 import { runOpenclawClawlingLogin, } from "./login.runtime.js";
-import { CHANNEL_ID, effectiveOutputVisibility, effectiveGroupCommandMode, effectiveGroupMode, hasOpenclawClawlingConnectCredentials, resolveOpenclawClawlingAccount, } from "./config.js";
+import { CHANNEL_ID, effectiveOutputVisibility, effectiveGroupCommandMode, effectiveGroupMode, hasOpenclawClawlingConnectCredentials, normalizeOpenclawClawlingAccountId, readOpenclawClawlingAccountSection, resolveOpenclawClawlingAccount, CLAWCHAT_REFRESH_TOKEN_ENV, } from "./config.js";
+import { patchOpenclawClawlingAccountSection } from "./account-config-writes.js";
+import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/setup";
 import { isValidChatId } from "./ws-client.js";
 import { dispatchOpenclawClawlingInbound } from "./inbound.js";
 import { PendingConsentStore, cleanupTombstonedManagedSkills, handleOwnerConsentReply, managedSkillExists, readLocalSkillState, resolveBundledSkillsDir, resolveManagedSkillsDir, runSkillUpdateCheck, } from "./skill-update.js";
@@ -130,12 +131,26 @@ export function classifyHelloFailReason(reason) {
         return "token-rejected";
     return "generic";
 }
-/** Read `channels.<CHANNEL_ID>.refreshToken` from a live config, or null. */
-function readConfigRefreshToken(cfg) {
-    const channels = cfg.channels;
-    const channel = isRecord(channels) ? channels[CHANNEL_ID] : undefined;
-    const refreshToken = isRecord(channel) ? channel.refreshToken : undefined;
-    return typeof refreshToken === "string" && refreshToken.trim() ? refreshToken.trim() : null;
+/**
+ * The refresh token paired with the account's access token. The account
+ * section's `refreshToken` wins. `CLAWCHAT_REFRESH_TOKEN` is process-wide, so
+ * it is honoured ONLY for the default account and ONLY when that section
+ * carries no `token` of its own (i.e. the access token itself came from
+ * `CLAWCHAT_TOKEN`) — an env-provisioned pair can rotate, while a login-written
+ * token is never paired with a stray refresh token left in the environment.
+ */
+function readConfigRefreshToken(cfg, accountId, env = process.env) {
+    const section = readOpenclawClawlingAccountSection(cfg, accountId);
+    const refreshToken = section.refreshToken;
+    if (typeof refreshToken === "string" && refreshToken.trim())
+        return refreshToken.trim();
+    if (normalizeOpenclawClawlingAccountId(accountId) !== DEFAULT_ACCOUNT_ID)
+        return null;
+    const configToken = section.token;
+    if (typeof configToken === "string" && configToken.trim())
+        return null;
+    const envRefreshToken = env[CLAWCHAT_REFRESH_TOKEN_ENV];
+    return typeof envRefreshToken === "string" && envRefreshToken.trim() ? envRefreshToken.trim() : null;
 }
 function withFullVerboseDispatchConfig(cfg, agentId) {
     const cfgRecord = cfg;
@@ -443,14 +458,25 @@ export async function maybeAutoActivateFromEnv(params) {
     const code = (params.connectCode ?? "").trim();
     if (!code)
         return params.account;
+    // The env var is process-wide: it can only ever describe ONE identity, and
+    // that is the default account. A named account never redeems it.
+    if (normalizeOpenclawClawlingAccountId(params.account.accountId) !== DEFAULT_ACCOUNT_ID) {
+        params.log?.info?.(`[${params.account.accountId}] clawchat-plugin-openclaw ${CONNECT_CODE_ENV} present but ignored: env activation is for the default account only`);
+        return params.account;
+    }
     if (accountHasConnectCredentials(params.account))
         return params.account;
+    const accountId = params.account.accountId;
+    const stored = params.store?.getActivationCredentials?.({ platform: "openclaw", accountId });
+    if (stored) {
+        params.log?.info?.(`[${accountId}] clawchat-plugin-openclaw ${CONNECT_CODE_ENV} present but a sqlite activation row already holds credentials; not redeeming`);
+        return params.account;
+    }
     if (consumedAutoActivationCodes.has(code))
         return params.account;
     consumedAutoActivationCodes.add(code);
     const runLogin = params.runLogin ?? runOpenclawClawlingLogin;
     const resolveAccount = params.resolveAccount ?? resolveOpenclawClawlingAccount;
-    const accountId = params.account.accountId;
     params.log?.info?.(`[${accountId}] clawchat-plugin-openclaw ${CONNECT_CODE_ENV} present; attempting non-interactive activation`);
     try {
         await runLogin({
@@ -470,7 +496,7 @@ export async function maybeAutoActivateFromEnv(params) {
         params.log?.error?.(`[${accountId}] clawchat-plugin-openclaw ${CONNECT_CODE_ENV} activation failed: ${err instanceof Error ? err.message : String(err)}`);
         return params.account;
     }
-    const next = resolveAccount(params.cfg);
+    const next = resolveAccount(params.cfg, accountId);
     params.log?.info?.(`[${accountId}] clawchat-plugin-openclaw ${CONNECT_CODE_ENV} activation succeeded hasToken=${Boolean(next.token)}`);
     return next;
 }
@@ -722,6 +748,7 @@ export async function startOpenclawClawlingGateway(params) {
             account,
             accountId,
             connectCode: envConnectCode,
+            store,
             log,
         });
     }
@@ -749,7 +776,7 @@ export async function startOpenclawClawlingGateway(params) {
                 userId: account.userId,
                 ownerUserId: account.ownerUserId,
                 accessToken: account.token,
-                refreshToken: readConfigRefreshToken(cfg),
+                refreshToken: readConfigRefreshToken(cfg, accountId),
                 loginMethod: "config-seed",
                 deviceId: CHANNEL_ID,
             });
@@ -831,13 +858,16 @@ export async function startOpenclawClawlingGateway(params) {
             // `RuntimeConnectionStore` only `Pick`s a subset of its methods, so widen
             // through the structural `LivewareSampleStoreLike` contract (Task 8/4).
             store: store,
-            sampleRoot: path.join(stateDirForSample ?? "", "clawchat", "liveware-sample"),
+            // Per account: two supervisors in one process otherwise install, swap and
+            // delete inside the SAME `app/` tree. `default` keeps the legacy path.
+            sampleRoot: livewareSampleRootDir(stateDirForSample ?? "", accountId),
             resolveToken: () => account.token ?? "",
             resolveAgentUserId: () => account.userId ?? null,
             resolveLivewarePath: () => resolveLivewarePath(stateDirForSample),
-            // Per-instance HOME for the liveware CLI: its credentials otherwise live
-            // in the host-global `$HOME/.clawling`, which a second profile clobbers.
-            cliHome: livewareCliHomeDir(stateDirForSample),
+            // Per-instance AND per-account HOME for the liveware CLI: its credentials
+            // otherwise live in the host-global `$HOME/.clawling`, which a second
+            // profile — or a second account in this very process — clobbers.
+            cliHome: livewareCliHomeDir(stateDirForSample, accountId),
             cliReady: livewareCliReady,
             listApps: async () => {
                 const client = getConversationApiClient();
@@ -886,7 +916,7 @@ export async function startOpenclawClawlingGateway(params) {
             ? runtimeConfig.mutateConfigFile
             : undefined;
     };
-    // §0/§C.1 — write the channel-config `token`/`refreshToken` keys. `tokens=null`
+    // §0/§C.1 — write the account slot's `token`/`refreshToken` keys. `tokens=null`
     // blanks them (auto-logout); otherwise persists the rotated pair.
     const persistConfigTokens = async (tokens) => {
         const mutateConfigFile = resolveMutateConfigFile();
@@ -897,17 +927,10 @@ export async function startOpenclawClawlingGateway(params) {
         await mutateConfigFile({
             afterWrite: { mode: "none", reason: "clawchat-plugin-openclaw token refresh" },
             mutate(draft) {
-                const channels = (draft.channels ?? {});
-                const existing = (channels[CHANNEL_ID] ?? {});
-                const nextSection = {
-                    ...existing,
+                Object.assign(draft, patchOpenclawClawlingAccountSection(draft, accountId, {
                     token: tokens ? tokens.accessToken : "",
                     refreshToken: tokens ? tokens.refreshToken : "",
-                };
-                Object.assign(draft, {
-                    ...draft,
-                    channels: { ...channels, [CHANNEL_ID]: nextSection },
-                });
+                }));
             },
         });
     };
@@ -996,7 +1019,7 @@ export async function startOpenclawClawlingGateway(params) {
         (activationAccount.source === "sqlite" && store?.getActivationCredentials
             ? store.getActivationCredentials({ platform: "openclaw", accountId })?.refreshToken
             : null) ??
-        readConfigRefreshToken(cfg);
+        readConfigRefreshToken(cfg, accountId);
     const refreshManager = new RefreshManager({
         baseUrl: account.baseUrl,
         deviceId: refreshDeviceId,

package/dist/src/terminal-send.js

@@ -8,13 +8,28 @@ function key(accountId, chatId, scopeId) {
 export function runWithTerminalClawChatSendScope(scopeId, fn) {
     return terminalSendScope.run(scopeId, fn);
 }
+/**
+ * Drop every marker whose TTL has lapsed. A marker is only otherwise deleted
+ * when the same dispatch scope consumes it, and a scope that never produces a
+ * follow-up reply for that chat (mention sent to another chat, `<clawchat:no-reply/>`,
+ * dispatch failure) leaves it behind; without this sweep the map would grow by
+ * one entry per such turn for the lifetime of the gateway.
+ */
+function sweepExpiredTerminalSends(nowMs) {
+    for (const [recordKey, record] of terminalSends) {
+        if (record.expiresAt <= nowMs)
+            terminalSends.delete(recordKey);
+    }
+}
 export function markTerminalClawChatSend(params) {
     const scopeId = params.scopeId ?? terminalSendScope.getStore();
     if (!scopeId)
         return;
+    const nowMs = params.nowMs ?? Date.now();
+    sweepExpiredTerminalSends(nowMs);
     terminalSends.set(key(params.accountId, params.chatId, scopeId), {
         messageId: params.messageId,
-        expiresAt: (params.nowMs ?? Date.now()) + (params.ttlMs ?? DEFAULT_TTL_MS),
+        expiresAt: nowMs + (params.ttlMs ?? DEFAULT_TTL_MS),
         scopeId,
     });
 }