@clawling/clawchat-plugin-openclaw 2026.9.9-1 → 2026.9.11-1

package/dist/src/liveware-sample.js

@@ -378,6 +378,28 @@ export async function startTunnelAgent(opts) {
     await waitForOutput(child, (acc) => parseAgentReady(acc), opts.timeoutMs ?? TUNNEL_START_TIMEOUT_MS, "liveware agent start");
     return { child };
 }
+/** Where the liveware CLI keeps its login state, relative to its `HOME`. */
+const LIVEWARE_CREDENTIAL_DIRNAME = ".clawling";
+/**
+ * True when the liveware CLI has usable cached credentials under `cliHome`.
+ *
+ * Tolerates either shape the CLI might use: a credential file (non-empty) or a
+ * directory (non-empty). Anything unreadable answers "no" — the caller's only
+ * use is deciding whether it is safe to skip a login, and guessing "yes" there
+ * is exactly the failure this check exists to prevent.
+ */
+export async function hasCachedLivewareCredentials(cliHome) {
+    const target = path.join(cliHome, LIVEWARE_CREDENTIAL_DIRNAME);
+    try {
+        const stat = await fs.promises.stat(target);
+        if (stat.isDirectory())
+            return (await fs.promises.readdir(target)).length > 0;
+        return stat.size > 0;
+    }
+    catch {
+        return false;
+    }
+}
 export async function livewareLogin(opts) {
     const execFileFn = opts.execFileFn ?? nodeExecFile;
     await new Promise((resolve, reject) => {
@@ -833,12 +855,14 @@ export class LivewareSampleSupervisor {
         // lifetime. `login` is idempotent; best-effort, so a stale token still falls
         // through to whatever credentials the CLI already has.
         const token = deps.resolveToken();
+        let loggedIn = false;
         if (token) {
             try {
                 await livewareLogin({ livewarePath, token, execFileFn: deps.execFileFn, env: cliEnv });
+                loggedIn = true;
             }
             catch (err) {
-                deps.log?.warn?.(`liveware-sample: relaunch re-login failed; continuing with cached CLI credentials: ${String(err)}`);
+                deps.log?.warn?.(`liveware-sample: relaunch re-login failed; continuing only if the CLI has cached credentials: ${String(err)}`);
             }
             if (this.bailIfStopped())
                 return;
@@ -846,6 +870,20 @@ export class LivewareSampleSupervisor {
         else {
             deps.log?.debug?.("liveware-sample: no token; relaunch without re-login");
         }
+        // Falling through without a fresh login is only safe when the CLI actually
+        // has credentials cached. Since the private-HOME redirect those live in
+        // `<cliHome>/.clawling`, and a first relaunch after upgrading finds that
+        // home EMPTY — the old ones are still under the ambient `$HOME`. Continuing
+        // there makes every tunnelBind/agent call below fail auth, which surfaces as
+        // a confusing tunnel error rather than the credential problem it is, and
+        // burns the whole retry ladder on a state that cannot recover on its own.
+        // Throwing hands it to `startAttempt`'s ladder instead, so the worst case is
+        // a delayed sample rather than a silent auth failure.
+        if (!loggedIn && cliEnv && deps.cliHome) {
+            if (!(await hasCachedLivewareCredentials(deps.cliHome))) {
+                throw new Error(`liveware CLI has no cached credentials under ${deps.cliHome} and no token was available to log in`);
+            }
+        }
         // Kept after the re-login above so the lookup runs against a CLI that is
         // actually authenticated: a pending row's app id came straight from
         // `app create`'s parser and was never confirmed by the liveware side, so

package/dist/src/llm-context-debug.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { resolveStateDirFromEnv } from "./state-paths.js";
 function envEnabled(value) {
     return ["1", "true", "yes", "on"].includes(String(value ?? "").trim().toLowerCase());
 }
@@ -10,7 +11,12 @@ function safeId(value) {
 export function createOpenclawLlmContextDebug(params = {}) {
     const env = params.env ?? process.env;
     const enabled = envEnabled(env.CLAWCHAT_LLM_CONTEXT_DEBUG);
-    const snapshotRoot = path.resolve(env.CLAWCHAT_LLM_CONTEXT_SNAPSHOT_DIR || params.defaultSnapshotRoot || ".clawchat-llm-context-debug");
+    // Default under the per-instance OpenClaw state dir, never the process cwd:
+    // two profiles launched from one directory must not interleave runs and
+    // overwrite each other's `latest.json`.
+    const snapshotRoot = path.resolve(env.CLAWCHAT_LLM_CONTEXT_SNAPSHOT_DIR ||
+        params.defaultSnapshotRoot ||
+        path.join(resolveStateDirFromEnv(env), "clawchat", "llm-context-debug"));
     return {
         enabled,
         captureFullInput: envEnabled(env.CLAWCHAT_LLM_CONTEXT_CAPTURE_FULL_INPUT),

package/dist/src/permission-result.js

@@ -20,16 +20,42 @@
  * The discriminator is `payload.metadata.kind === "permission_result"`.
  */
 import { EVENT } from "./protocol-types.js";
-// Module-level dedup set — `request_id` values are stable backend identifiers.
-// A duplicate receipt (e.g. from WS replay on reconnect) must not re-trigger
-// an agent turn.
-const _seenRequestIds = new Set();
 /**
- * @internal Test helper — reset the dedup set between isolated test runs.
+ * Upper bound on retained `request_id`s per account (FIFO eviction). Mirrors
+ * `createNotifySignalObserver` in `src/ws-alignment.ts`: permission receipts
+ * are rare (one per owner decision), so 512 covers any realistic replay window
+ * while keeping a long-running gateway's memory flat.
+ */
+export const PERMISSION_RESULT_DEDUP_MAX_SEEN = 512;
+// Dedup state partitioned by accountId — `request_id` values are stable backend
+// identifiers scoped to the agent identity that raised the request, so one
+// account's history must never suppress another account's receipt with the
+// same id. A duplicate receipt within one account (e.g. from WS replay on
+// reconnect) must not re-trigger an agent turn.
+const _seenRequestIdsByAccount = new Map();
+function seenRequestIdsFor(accountId) {
+    let entry = _seenRequestIdsByAccount.get(accountId);
+    if (!entry) {
+        entry = { seen: new Set(), order: [] };
+        _seenRequestIdsByAccount.set(accountId, entry);
+    }
+    return entry;
+}
+function markRequestIdSeen(entry, requestId) {
+    entry.seen.add(requestId);
+    entry.order.push(requestId);
+    while (entry.order.length > PERMISSION_RESULT_DEDUP_MAX_SEEN) {
+        const evicted = entry.order.shift();
+        if (evicted !== undefined)
+            entry.seen.delete(evicted);
+    }
+}
+/**
+ * @internal Test helper — reset the dedup state between isolated test runs.
  * Never call this in production code.
  */
 export function _resetPermissionResultDedup() {
-    _seenRequestIds.clear();
+    _seenRequestIdsByAccount.clear();
 }
 function buildOutcomeNote(metadata) {
     const { operation, outcome, reason } = metadata;
@@ -107,8 +133,10 @@ export function buildPermissionResultEnvelope(params) {
     };
 }
 /**
- * Handles a `permission_result` receipt. Deduplicates by `request_id`
- * (idempotent — WS replay on reconnect may deliver the same receipt again).
+ * Handles a `permission_result` receipt. Deduplicates by `request_id` within
+ * the receiving account (idempotent — WS replay on reconnect may deliver the
+ * same receipt again), retaining at most {@link PERMISSION_RESULT_DEDUP_MAX_SEEN}
+ * ids per account (oldest evicted first).
  *
  * An empty/falsy `request_id` is never added to the dedup set — two receipts
  * can legitimately share an empty id, and both must still be rendered — but
@@ -127,9 +155,11 @@ export function buildPermissionResultEnvelope(params) {
 export function handlePermissionResult(metadata, account, ownerConversationId) {
     if (!ownerConversationId)
         return null;
-    if (metadata.request_id && _seenRequestIds.has(metadata.request_id))
-        return null;
-    if (metadata.request_id)
-        _seenRequestIds.add(metadata.request_id);
+    if (metadata.request_id) {
+        const entry = seenRequestIdsFor(account.accountId);
+        if (entry.seen.has(metadata.request_id))
+            return null;
+        markRequestIdSeen(entry, metadata.request_id);
+    }
     return buildPermissionResultEnvelope({ account, metadata, ownerConversationId });
 }

package/dist/src/runtime.js

@@ -12,7 +12,7 @@ import { LivewareSampleSupervisor, } from "./liveware-sample.js";
 import { ClawlingApiError } from "./api-types.js";
 import { RefreshManager } from "./refresh-manager.js";
 import { runOpenclawClawlingLogin, } from "./login.runtime.js";
-import { CHANNEL_ID, effectiveOutputVisibility, effectiveGroupCommandMode, effectiveGroupMode, hasOpenclawClawlingConnectCredentials, resolveOpenclawClawlingAccount, } from "./config.js";
+import { CHANNEL_ID, effectiveOutputVisibility, effectiveGroupCommandMode, effectiveGroupMode, hasOpenclawClawlingConnectCredentials, resolveOpenclawClawlingAccount, CLAWCHAT_REFRESH_TOKEN_ENV, } from "./config.js";
 import { isValidChatId } from "./ws-client.js";
 import { dispatchOpenclawClawlingInbound } from "./inbound.js";
 import { PendingConsentStore, cleanupTombstonedManagedSkills, handleOwnerConsentReply, managedSkillExists, readLocalSkillState, resolveBundledSkillsDir, resolveManagedSkillsDir, runSkillUpdateCheck, } from "./skill-update.js";
@@ -131,11 +131,25 @@ export function classifyHelloFailReason(reason) {
     return "generic";
 }
 /** Read `channels.<CHANNEL_ID>.refreshToken` from a live config, or null. */
-function readConfigRefreshToken(cfg) {
+/**
+ * The refresh token paired with the configured access token. Channel config
+ * `refreshToken` wins. `CLAWCHAT_REFRESH_TOKEN` (declared in the manifest's
+ * `channelEnvVars`) is honoured ONLY when the channel config carries no `token`
+ * of its own — i.e. when the access token itself came from `CLAWCHAT_TOKEN` —
+ * so an env-provisioned pair can rotate, while a login-written config token is
+ * never paired with a stray refresh token left in the environment.
+ */
+function readConfigRefreshToken(cfg, env = process.env) {
     const channels = cfg.channels;
     const channel = isRecord(channels) ? channels[CHANNEL_ID] : undefined;
     const refreshToken = isRecord(channel) ? channel.refreshToken : undefined;
-    return typeof refreshToken === "string" && refreshToken.trim() ? refreshToken.trim() : null;
+    if (typeof refreshToken === "string" && refreshToken.trim())
+        return refreshToken.trim();
+    const configToken = isRecord(channel) ? channel.token : undefined;
+    if (typeof configToken === "string" && configToken.trim())
+        return null;
+    const envRefreshToken = env[CLAWCHAT_REFRESH_TOKEN_ENV];
+    return typeof envRefreshToken === "string" && envRefreshToken.trim() ? envRefreshToken.trim() : null;
 }
 function withFullVerboseDispatchConfig(cfg, agentId) {
     const cfgRecord = cfg;
@@ -445,12 +459,17 @@ export async function maybeAutoActivateFromEnv(params) {
         return params.account;
     if (accountHasConnectCredentials(params.account))
         return params.account;
+    const accountId = params.account.accountId;
+    const stored = params.store?.getActivationCredentials?.({ platform: "openclaw", accountId });
+    if (stored) {
+        params.log?.info?.(`[${accountId}] clawchat-plugin-openclaw ${CONNECT_CODE_ENV} present but a sqlite activation row already holds credentials; not redeeming`);
+        return params.account;
+    }
     if (consumedAutoActivationCodes.has(code))
         return params.account;
     consumedAutoActivationCodes.add(code);
     const runLogin = params.runLogin ?? runOpenclawClawlingLogin;
     const resolveAccount = params.resolveAccount ?? resolveOpenclawClawlingAccount;
-    const accountId = params.account.accountId;
     params.log?.info?.(`[${accountId}] clawchat-plugin-openclaw ${CONNECT_CODE_ENV} present; attempting non-interactive activation`);
     try {
         await runLogin({
@@ -722,6 +741,7 @@ export async function startOpenclawClawlingGateway(params) {
             account,
             accountId,
             connectCode: envConnectCode,
+            store,
             log,
         });
     }

package/dist/src/terminal-send.js

@@ -8,13 +8,28 @@ function key(accountId, chatId, scopeId) {
 export function runWithTerminalClawChatSendScope(scopeId, fn) {
     return terminalSendScope.run(scopeId, fn);
 }
+/**
+ * Drop every marker whose TTL has lapsed. A marker is only otherwise deleted
+ * when the same dispatch scope consumes it, and a scope that never produces a
+ * follow-up reply for that chat (mention sent to another chat, `<clawchat:no-reply/>`,
+ * dispatch failure) leaves it behind; without this sweep the map would grow by
+ * one entry per such turn for the lifetime of the gateway.
+ */
+function sweepExpiredTerminalSends(nowMs) {
+    for (const [recordKey, record] of terminalSends) {
+        if (record.expiresAt <= nowMs)
+            terminalSends.delete(recordKey);
+    }
+}
 export function markTerminalClawChatSend(params) {
     const scopeId = params.scopeId ?? terminalSendScope.getStore();
     if (!scopeId)
         return;
+    const nowMs = params.nowMs ?? Date.now();
+    sweepExpiredTerminalSends(nowMs);
     terminalSends.set(key(params.accountId, params.chatId, scopeId), {
         messageId: params.messageId,
-        expiresAt: (params.nowMs ?? Date.now()) + (params.ttlMs ?? DEFAULT_TTL_MS),
+        expiresAt: nowMs + (params.ttlMs ?? DEFAULT_TTL_MS),
         scopeId,
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawling/clawchat-plugin-openclaw",
-  "version": "2026.9.9-1",
+  "version": "2026.9.11-1",
   "description": "OpenClaw ClawChat channel plugin",
   "license": "MIT",
   "author": "CLAWLING PTE. LTD.",

package/src/liveware-sample.ts

@@ -467,6 +467,28 @@ export async function startTunnelAgent(opts: {
   return { child };
 }
 
+/** Where the liveware CLI keeps its login state, relative to its `HOME`. */
+const LIVEWARE_CREDENTIAL_DIRNAME = ".clawling";
+
+/**
+ * True when the liveware CLI has usable cached credentials under `cliHome`.
+ *
+ * Tolerates either shape the CLI might use: a credential file (non-empty) or a
+ * directory (non-empty). Anything unreadable answers "no" — the caller's only
+ * use is deciding whether it is safe to skip a login, and guessing "yes" there
+ * is exactly the failure this check exists to prevent.
+ */
+export async function hasCachedLivewareCredentials(cliHome: string): Promise<boolean> {
+  const target = path.join(cliHome, LIVEWARE_CREDENTIAL_DIRNAME);
+  try {
+    const stat = await fs.promises.stat(target);
+    if (stat.isDirectory()) return (await fs.promises.readdir(target)).length > 0;
+    return stat.size > 0;
+  } catch {
+    return false;
+  }
+}
+
 export async function livewareLogin(opts: {
   livewarePath: string;
   token: string;
@@ -980,18 +1002,36 @@ export class LivewareSampleSupervisor {
     // lifetime. `login` is idempotent; best-effort, so a stale token still falls
     // through to whatever credentials the CLI already has.
     const token = deps.resolveToken();
+    let loggedIn = false;
     if (token) {
       try {
         await livewareLogin({ livewarePath, token, execFileFn: deps.execFileFn, env: cliEnv });
+        loggedIn = true;
       } catch (err) {
         deps.log?.warn?.(
-          `liveware-sample: relaunch re-login failed; continuing with cached CLI credentials: ${String(err)}`,
+          `liveware-sample: relaunch re-login failed; continuing only if the CLI has cached credentials: ${String(err)}`,
         );
       }
       if (this.bailIfStopped()) return;
     } else {
       deps.log?.debug?.("liveware-sample: no token; relaunch without re-login");
     }
+    // Falling through without a fresh login is only safe when the CLI actually
+    // has credentials cached. Since the private-HOME redirect those live in
+    // `<cliHome>/.clawling`, and a first relaunch after upgrading finds that
+    // home EMPTY — the old ones are still under the ambient `$HOME`. Continuing
+    // there makes every tunnelBind/agent call below fail auth, which surfaces as
+    // a confusing tunnel error rather than the credential problem it is, and
+    // burns the whole retry ladder on a state that cannot recover on its own.
+    // Throwing hands it to `startAttempt`'s ladder instead, so the worst case is
+    // a delayed sample rather than a silent auth failure.
+    if (!loggedIn && cliEnv && deps.cliHome) {
+      if (!(await hasCachedLivewareCredentials(deps.cliHome))) {
+        throw new Error(
+          `liveware CLI has no cached credentials under ${deps.cliHome} and no token was available to log in`,
+        );
+      }
+    }
     // Kept after the re-login above so the lookup runs against a CLI that is
     // actually authenticated: a pending row's app id came straight from
     // `app create`'s parser and was never confirmed by the liveware side, so

package/src/llm-context-debug.ts

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { resolveStateDirFromEnv } from "./state-paths.ts";
 
 export type OpenclawLlmContextVisibility =
   | "full_llm_input"
@@ -60,8 +61,13 @@ export function createOpenclawLlmContextDebug(params: {
 } = {}): OpenclawLlmContextDebug {
   const env = params.env ?? process.env;
   const enabled = envEnabled(env.CLAWCHAT_LLM_CONTEXT_DEBUG);
+  // Default under the per-instance OpenClaw state dir, never the process cwd:
+  // two profiles launched from one directory must not interleave runs and
+  // overwrite each other's `latest.json`.
   const snapshotRoot = path.resolve(
-    env.CLAWCHAT_LLM_CONTEXT_SNAPSHOT_DIR || params.defaultSnapshotRoot || ".clawchat-llm-context-debug",
+    env.CLAWCHAT_LLM_CONTEXT_SNAPSHOT_DIR ||
+      params.defaultSnapshotRoot ||
+      path.join(resolveStateDirFromEnv(env as NodeJS.ProcessEnv), "clawchat", "llm-context-debug"),
   );
 
   return {

package/src/permission-result.ts

@@ -30,17 +30,47 @@ export interface PermissionResultMetadata {
   request_id: string;
 }
 
-// Module-level dedup set — `request_id` values are stable backend identifiers.
-// A duplicate receipt (e.g. from WS replay on reconnect) must not re-trigger
-// an agent turn.
-const _seenRequestIds = new Set<string>();
+/**
+ * Upper bound on retained `request_id`s per account (FIFO eviction). Mirrors
+ * `createNotifySignalObserver` in `src/ws-alignment.ts`: permission receipts
+ * are rare (one per owner decision), so 512 covers any realistic replay window
+ * while keeping a long-running gateway's memory flat.
+ */
+export const PERMISSION_RESULT_DEDUP_MAX_SEEN = 512;
+
+type SeenRequestIds = { seen: Set<string>; order: string[] };
+
+// Dedup state partitioned by accountId — `request_id` values are stable backend
+// identifiers scoped to the agent identity that raised the request, so one
+// account's history must never suppress another account's receipt with the
+// same id. A duplicate receipt within one account (e.g. from WS replay on
+// reconnect) must not re-trigger an agent turn.
+const _seenRequestIdsByAccount = new Map<string, SeenRequestIds>();
+
+function seenRequestIdsFor(accountId: string): SeenRequestIds {
+  let entry = _seenRequestIdsByAccount.get(accountId);
+  if (!entry) {
+    entry = { seen: new Set<string>(), order: [] };
+    _seenRequestIdsByAccount.set(accountId, entry);
+  }
+  return entry;
+}
+
+function markRequestIdSeen(entry: SeenRequestIds, requestId: string): void {
+  entry.seen.add(requestId);
+  entry.order.push(requestId);
+  while (entry.order.length > PERMISSION_RESULT_DEDUP_MAX_SEEN) {
+    const evicted = entry.order.shift();
+    if (evicted !== undefined) entry.seen.delete(evicted);
+  }
+}
 
 /**
- * @internal Test helper — reset the dedup set between isolated test runs.
+ * @internal Test helper — reset the dedup state between isolated test runs.
  * Never call this in production code.
  */
 export function _resetPermissionResultDedup(): void {
-  _seenRequestIds.clear();
+  _seenRequestIdsByAccount.clear();
 }
 
 function buildOutcomeNote(metadata: PermissionResultMetadata): string {
@@ -127,8 +157,10 @@ export function buildPermissionResultEnvelope(params: {
 }
 
 /**
- * Handles a `permission_result` receipt. Deduplicates by `request_id`
- * (idempotent — WS replay on reconnect may deliver the same receipt again).
+ * Handles a `permission_result` receipt. Deduplicates by `request_id` within
+ * the receiving account (idempotent — WS replay on reconnect may deliver the
+ * same receipt again), retaining at most {@link PERMISSION_RESULT_DEDUP_MAX_SEEN}
+ * ids per account (oldest evicted first).
  *
  * An empty/falsy `request_id` is never added to the dedup set — two receipts
  * can legitimately share an empty id, and both must still be rendered — but
@@ -146,11 +178,14 @@ export function buildPermissionResultEnvelope(params: {
  */
 export function handlePermissionResult(
   metadata: PermissionResultMetadata,
-  account: Pick<ResolvedOpenclawClawlingAccount, "userId" | "ownerUserId">,
+  account: Pick<ResolvedOpenclawClawlingAccount, "accountId" | "userId" | "ownerUserId">,
   ownerConversationId: string | null,
 ): Envelope | null {
   if (!ownerConversationId) return null;
-  if (metadata.request_id && _seenRequestIds.has(metadata.request_id)) return null;
-  if (metadata.request_id) _seenRequestIds.add(metadata.request_id);
+  if (metadata.request_id) {
+    const entry = seenRequestIdsFor(account.accountId);
+    if (entry.seen.has(metadata.request_id)) return null;
+    markRequestIdSeen(entry, metadata.request_id);
+  }
   return buildPermissionResultEnvelope({ account, metadata, ownerConversationId });
 }

package/src/runtime.ts

@@ -40,6 +40,7 @@ import {
   hasOpenclawClawlingConnectCredentials,
   resolveOpenclawClawlingAccount,
   type ResolvedOpenclawClawlingAccount,
+  CLAWCHAT_REFRESH_TOKEN_ENV,
 } from "./config.ts";
 import { isValidChatId, type ClawlingChatClient } from "./ws-client.ts";
 import { dispatchOpenclawClawlingInbound, type IngestTurnParams } from "./inbound.ts";
@@ -234,11 +235,23 @@ export function classifyHelloFailReason(
 }
 
 /** Read `channels.<CHANNEL_ID>.refreshToken` from a live config, or null. */
-function readConfigRefreshToken(cfg: OpenClawConfig): string | null {
+/**
+ * The refresh token paired with the configured access token. Channel config
+ * `refreshToken` wins. `CLAWCHAT_REFRESH_TOKEN` (declared in the manifest's
+ * `channelEnvVars`) is honoured ONLY when the channel config carries no `token`
+ * of its own — i.e. when the access token itself came from `CLAWCHAT_TOKEN` —
+ * so an env-provisioned pair can rotate, while a login-written config token is
+ * never paired with a stray refresh token left in the environment.
+ */
+function readConfigRefreshToken(cfg: OpenClawConfig, env: NodeJS.ProcessEnv = process.env): string | null {
   const channels = (cfg as { channels?: Record<string, unknown> }).channels;
   const channel = isRecord(channels) ? channels[CHANNEL_ID] : undefined;
   const refreshToken = isRecord(channel) ? channel.refreshToken : undefined;
-  return typeof refreshToken === "string" && refreshToken.trim() ? refreshToken.trim() : null;
+  if (typeof refreshToken === "string" && refreshToken.trim()) return refreshToken.trim();
+  const configToken = isRecord(channel) ? channel.token : undefined;
+  if (typeof configToken === "string" && configToken.trim()) return null;
+  const envRefreshToken = env[CLAWCHAT_REFRESH_TOKEN_ENV];
+  return typeof envRefreshToken === "string" && envRefreshToken.trim() ? envRefreshToken.trim() : null;
 }
 
 function withFullVerboseDispatchConfig(cfg: OpenClawConfig, agentId: string): OpenClawConfig {
@@ -673,6 +686,13 @@ export interface AutoActivateFromEnvParams {
   accountId: string | null;
   /** The connect code (production: `process.env[CONNECT_CODE_ENV]`). */
   connectCode: string | undefined;
+  /**
+   * Plugin SQLite store. A complete activation row is the durable credential
+   * source of truth (`waitForActivationCredentials` resolves SQLite-first), so
+   * when one exists the env code is skipped — NOT consumed — rather than
+   * re-redeemed on every restart of a container that still carries the code.
+   */
+  store?: Pick<RuntimeConnectionStore, "getActivationCredentials"> | null;
   log?: Log;
   /** Test seam — login implementation. */
   runLogin?: (params: LoginParams) => Promise<void>;
@@ -695,12 +715,19 @@ export async function maybeAutoActivateFromEnv(
   const code = (params.connectCode ?? "").trim();
   if (!code) return params.account;
   if (accountHasConnectCredentials(params.account)) return params.account;
+  const accountId = params.account.accountId;
+  const stored = params.store?.getActivationCredentials?.({ platform: "openclaw", accountId });
+  if (stored) {
+    params.log?.info?.(
+      `[${accountId}] clawchat-plugin-openclaw ${CONNECT_CODE_ENV} present but a sqlite activation row already holds credentials; not redeeming`,
+    );
+    return params.account;
+  }
   if (consumedAutoActivationCodes.has(code)) return params.account;
   consumedAutoActivationCodes.add(code);
 
   const runLogin = params.runLogin ?? runOpenclawClawlingLogin;
   const resolveAccount = params.resolveAccount ?? resolveOpenclawClawlingAccount;
-  const accountId = params.account.accountId;
   params.log?.info?.(
     `[${accountId}] clawchat-plugin-openclaw ${CONNECT_CODE_ENV} present; attempting non-interactive activation`,
   );
@@ -1044,6 +1071,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
       account,
       accountId,
       connectCode: envConnectCode,
+      store,
       log,
     });
   }

package/src/terminal-send.ts

@@ -18,6 +18,19 @@ export function runWithTerminalClawChatSendScope<T>(scopeId: string, fn: () => T
   return terminalSendScope.run(scopeId, fn);
 }
 
+/**
+ * Drop every marker whose TTL has lapsed. A marker is only otherwise deleted
+ * when the same dispatch scope consumes it, and a scope that never produces a
+ * follow-up reply for that chat (mention sent to another chat, `<clawchat:no-reply/>`,
+ * dispatch failure) leaves it behind; without this sweep the map would grow by
+ * one entry per such turn for the lifetime of the gateway.
+ */
+function sweepExpiredTerminalSends(nowMs: number): void {
+  for (const [recordKey, record] of terminalSends) {
+    if (record.expiresAt <= nowMs) terminalSends.delete(recordKey);
+  }
+}
+
 export function markTerminalClawChatSend(params: {
   accountId: string;
   chatId: string;
@@ -28,9 +41,11 @@ export function markTerminalClawChatSend(params: {
 }): void {
   const scopeId = params.scopeId ?? terminalSendScope.getStore();
   if (!scopeId) return;
+  const nowMs = params.nowMs ?? Date.now();
+  sweepExpiredTerminalSends(nowMs);
   terminalSends.set(key(params.accountId, params.chatId, scopeId), {
     messageId: params.messageId,
-    expiresAt: (params.nowMs ?? Date.now()) + (params.ttlMs ?? DEFAULT_TTL_MS),
+    expiresAt: nowMs + (params.ttlMs ?? DEFAULT_TTL_MS),
     scopeId,
   });
 }