@drakon-systems/multi-clawd 1.9.1 → 1.9.2

package/README.md

@@ -375,7 +375,7 @@ openclaw plugins install (Get-Location).Path
 **Or let your agent install it.** Running an OpenClaw assistant or Claude
 Code on the target machine already? Paste it this and go make coffee:
 
-> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.9.1/SETUP-AGENT.md
+> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.9.2/SETUP-AGENT.md
 > and follow it to set up multi-clawd on this machine. I own a second
 > Claude account — ask me when you need me to log in.
 
@@ -666,9 +666,29 @@ What to know:
 any cooldown, and the live order. `explain` shows the same, and `doctor
 --probe` makes one tiny live call per profile.
 
+## History identity for fresh Claude sessions
+
+OpenClaw only replays a conversation into a **fresh** Claude session when it
+knows which account owns the history. It learns that from an auth profile in
+its own store, and Claude logins aren't OpenClaw profiles, so it used to log
+`cli session history refused across auth boundary: reason=auth-unknown` on
+every turn and start fresh sessions blank.
+
+multi-clawd now stores one identity-only profile per backend
+(`claw1:multi-clawd-identity`, `clawd:multi-clawd-identity`, …) and points the
+backend at it. The profile is a **name, not a credential**: no token, and
+OpenClaw never uses it to log in — `openclaw models status` shows it as
+`missing_credential`, which is correct. Which account runs is decided exactly
+as before. Right after upgrading, each existing conversation resets its Claude
+session once (`cli session reset … reason=auth-profile` in the log). OpenClaw
+binds the owner only when a conversation is born, so conversations that
+already have history keep logging the refusal line until you start a new one
+(`/new`); every session started after the upgrade is covered from its first
+turn. `"historyIdentity": false` turns the feature off.
+
 ## How it works
 
-Three moves, all through the official plugin SDK (details in
+Four moves, all through the official plugin SDK (details in
 [`DESIGN.md`](./DESIGN.md)):
 
 1. **`registerCliBackend`** mirrors the bundled `claude-cli` backend — same
@@ -681,6 +701,9 @@ Three moves, all through the official plugin SDK (details in
 3. **`prepareExecution`** injects that account's own login
    (`CLAUDE_CONFIG_DIR` + `CLAUDE_CODE_OAUTH_TOKEN`) into the child process
    env, after the host's ambient Claude credentials are stripped.
+4. **`defaultAuthProfileId`** names an identity-only auth profile per backend,
+   so OpenClaw's CLI history boundary binds and fresh sessions get the
+   conversation back (see "History identity" above).
 
 ## Legacy issue: idle backend eviction on OpenClaw ≤ 2026.7.1
 

package/dist/history-identity.js

@@ -0,0 +1,91 @@
+export const IDENTITY_PROFILE_SUFFIX = "multi-clawd-identity";
+export const HISTORY_IDENTITY_CONFIG_KEY = "historyIdentity";
+export function identityProfileId(backendId) {
+    return `${backendId}:${IDENTITY_PROFILE_SUFFIX}`;
+}
+export function identityAccountId(backendId) {
+    return `multi-clawd:${backendId}`;
+}
+export function buildIdentityCredential(backendId) {
+    return {
+        type: "oauth",
+        provider: backendId,
+        accountId: identityAccountId(backendId),
+        displayName: `multi-clawd history identity for ${backendId} (a name, not a credential)`,
+        access: "",
+        refresh: "",
+        expires: 1,
+    };
+}
+export function hasIdentity(existing, wanted) {
+    if (!existing || typeof existing !== "object")
+        return false;
+    const cred = existing;
+    return (cred.type === "oauth" &&
+        cred.provider === wanted.provider &&
+        cred.accountId === wanted.accountId &&
+        cred.email === undefined &&
+        cred.clientId === undefined &&
+        cred.enterpriseUrl === undefined &&
+        cred.projectId === undefined);
+}
+export async function ensureIdentityProfiles(backendIds, sdk) {
+    const result = { written: [], kept: [], failed: [] };
+    let profiles;
+    try {
+        profiles = sdk.ensureAuthProfileStore(undefined, { readOnly: true }).profiles;
+    }
+    catch (err) {
+        for (const id of backendIds) {
+            result.failed.push({ profileId: identityProfileId(id), reason: `store read failed: ${errorName(err)}` });
+        }
+        return result;
+    }
+    for (const id of backendIds) {
+        const profileId = identityProfileId(id);
+        const wanted = buildIdentityCredential(id);
+        if (hasIdentity(profiles[profileId], wanted)) {
+            result.kept.push(profileId);
+            continue;
+        }
+        try {
+            await sdk.upsertAuthProfileWithLock({ profileId, credential: wanted });
+            result.written.push(profileId);
+        }
+        catch (err) {
+            result.failed.push({ profileId, reason: `write failed: ${errorName(err)}` });
+        }
+    }
+    return result;
+}
+export function describeEnsureResult(result) {
+    const parts = [];
+    if (result.written.length)
+        parts.push(`stored ${result.written.join(", ")}`);
+    if (result.kept.length)
+        parts.push(`kept ${result.kept.join(", ")}`);
+    for (const f of result.failed)
+        parts.push(`${f.profileId}: ${f.reason}`);
+    return parts.join("; ") || "nothing to do";
+}
+function errorName(err) {
+    if (err instanceof Error)
+        return `${err.name}: ${err.message}`.slice(0, 200);
+    return String(err).slice(0, 200);
+}
+export async function loadProviderAuthSdk() {
+    try {
+        const mod = (await import("openclaw/plugin-sdk/provider-auth"));
+        if (typeof mod.ensureAuthProfileStore !== "function" ||
+            typeof mod.upsertAuthProfileWithLock !== "function") {
+            return undefined;
+        }
+        return {
+            ensureAuthProfileStore: mod.ensureAuthProfileStore,
+            upsertAuthProfileWithLock: mod.upsertAuthProfileWithLock,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/index.js

@@ -25,6 +25,7 @@ import { execFileSync } from "node:child_process";
 import { collectDirectMembers } from "./direct-route.js";
 import { createDirectOrderController, isValidAgentId } from "./direct-sync.js";
 import { createOpenclawRunner } from "./openclaw-runner.js";
+import { HISTORY_IDENTITY_CONFIG_KEY, describeEnsureResult, ensureIdentityProfiles, identityProfileId, loadProviderAuthSdk, } from "./history-identity.js";
 const CLI_FRESH_WATCHDOG_DEFAULTS = {
     noOutputTimeoutRatio: 0.8,
     minMs: 180_000,
@@ -400,6 +401,7 @@ export function buildBackend(account, execMode) {
         resolveExecutionArgs: resolvePoolExecutionArgs,
         sideQuestionToolMode: "disabled",
         ownsNativeCompaction: true,
+        defaultAuthProfileId: identityProfileId(account.id),
         config: {
             command: process.execPath,
             args: [SHIM_PATH, ...BASE_ARGS, ...permissionModeArgs(execMode)],
@@ -552,6 +554,12 @@ export default definePluginEntry({
             api.registerProvider(buildCatalogProvider(normalized));
         }
         registerPoolBackend(api, cfg.pool, accounts, seen, execMode);
+        startHistoryIdentityEnsure({
+            backendIds: [...seen],
+            enabled: cfg[HISTORY_IDENTITY_CONFIG_KEY] !== false,
+            registrationMode: api.registrationMode,
+            logger: api.logger,
+        });
         {
             const logger = api.logger;
             try {
@@ -580,6 +588,50 @@ export default definePluginEntry({
         api.logger.info(`[multi-clawd] registered ${seen.size} backend(s)+provider(s): ${[...seen].join(", ")}`);
     },
 });
+let historyIdentitySdkLoader = loadProviderAuthSdk;
+let historyIdentityPending;
+export function setProviderAuthSdkLoaderForTests(loader) {
+    historyIdentitySdkLoader = loader ?? loadProviderAuthSdk;
+    historyIdentityPending = undefined;
+}
+export function awaitHistoryIdentityEnsure() {
+    return historyIdentityPending ?? Promise.resolve(undefined);
+}
+function startHistoryIdentityEnsure(params) {
+    const { logger } = params;
+    if (params.registrationMode !== undefined && params.registrationMode !== "full")
+        return;
+    if (!params.enabled) {
+        logger.info("[multi-clawd] history identity: disabled by config (historyIdentity: false)");
+        return;
+    }
+    if (params.backendIds.length === 0 || historyIdentityPending)
+        return;
+    const ids = [...params.backendIds];
+    historyIdentityPending = (async () => {
+        try {
+            const sdk = await historyIdentitySdkLoader();
+            if (!sdk) {
+                logger.warn("[multi-clawd] history identity: this OpenClaw does not expose openclaw/plugin-sdk/provider-auth store writers — skipped (CLI history reseed stays auth-unknown)");
+                return undefined;
+            }
+            const result = await ensureIdentityProfiles(ids, sdk);
+            const line = `[multi-clawd] history identity: ${describeEnsureResult(result)}`;
+            if (result.failed.length > 0)
+                logger.warn(line);
+            else
+                logger.info(line);
+            return result;
+        }
+        catch (err) {
+            logger.warn(`[multi-clawd] history identity: ${String(err)}`);
+            return undefined;
+        }
+        finally {
+            historyIdentityPending = undefined;
+        }
+    })();
+}
 function readHealthState(accountId) {
     try {
         return JSON.parse(readFileSync(healthStateFile(accountId), "utf8"));

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "multi-clawd",
   "name": "multi-clawd",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "Register additional Claude Code logins (Max/Pro accounts) as first-class OpenClaw CLI backends for cross-account failover, keeping the full skills/MCP harness on every account.",
   "cliBackends": [
     "claw1",
@@ -205,6 +205,10 @@
           }
         }
       },
+      "historyIdentity": {
+        "type": "boolean",
+        "description": "Store one identity-only OpenClaw auth profile per registered backend id (<id>:multi-clawd-identity — a name, no token) and point the backend's defaultAuthProfileId at it, so OpenClaw's CLI history boundary can bind and a fresh Claude session is reseeded with prior context instead of `cli session history refused across auth boundary: reason=auth-unknown`. Default true. false = no auth-store writes; the reseed refusal stays."
+      },
       "directRoute": {
         "type": "object",
         "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/multi-clawd",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "Multi-account Claude Code failover for OpenClaw — register additional Claude (Max/Pro) logins as first-class CLI backends and keep the full skills/MCP harness across every account. Also imports those accounts' setup tokens into Hermes Agent's Anthropic credential pool.",
   "type": "module",
   "license": "MIT",