@drakon-systems/multi-clawd 1.9.2 → 1.9.4

package/README.md

@@ -375,7 +375,7 @@ openclaw plugins install (Get-Location).Path
 **Or let your agent install it.** Running an OpenClaw assistant or Claude
 Code on the target machine already? Paste it this and go make coffee:
 
-> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.9.2/SETUP-AGENT.md
+> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.9.4/SETUP-AGENT.md
 > and follow it to set up multi-clawd on this machine. I own a second
 > Claude account — ask me when you need me to log in.
 
@@ -666,29 +666,9 @@ What to know:
 any cooldown, and the live order. `explain` shows the same, and `doctor
 --probe` makes one tiny live call per profile.
 
-## History identity for fresh Claude sessions
-
-OpenClaw only replays a conversation into a **fresh** Claude session when it
-knows which account owns the history. It learns that from an auth profile in
-its own store, and Claude logins aren't OpenClaw profiles, so it used to log
-`cli session history refused across auth boundary: reason=auth-unknown` on
-every turn and start fresh sessions blank.
-
-multi-clawd now stores one identity-only profile per backend
-(`claw1:multi-clawd-identity`, `clawd:multi-clawd-identity`, …) and points the
-backend at it. The profile is a **name, not a credential**: no token, and
-OpenClaw never uses it to log in — `openclaw models status` shows it as
-`missing_credential`, which is correct. Which account runs is decided exactly
-as before. Right after upgrading, each existing conversation resets its Claude
-session once (`cli session reset … reason=auth-profile` in the log). OpenClaw
-binds the owner only when a conversation is born, so conversations that
-already have history keep logging the refusal line until you start a new one
-(`/new`); every session started after the upgrade is covered from its first
-turn. `"historyIdentity": false` turns the feature off.
-
 ## How it works
 
-Four moves, all through the official plugin SDK (details in
+Three moves, all through the official plugin SDK (details in
 [`DESIGN.md`](./DESIGN.md)):
 
 1. **`registerCliBackend`** mirrors the bundled `claude-cli` backend — same
@@ -701,9 +681,6 @@ Four moves, all through the official plugin SDK (details in
 3. **`prepareExecution`** injects that account's own login
    (`CLAUDE_CONFIG_DIR` + `CLAUDE_CODE_OAUTH_TOKEN`) into the child process
    env, after the host's ambient Claude credentials are stripped.
-4. **`defaultAuthProfileId`** names an identity-only auth profile per backend,
-   so OpenClaw's CLI history boundary binds and fresh sessions get the
-   conversation back (see "History identity" above).
 
 ## Legacy issue: idle backend eviction on OpenClaw ≤ 2026.7.1
 

package/dist/account-identity.js

@@ -1,10 +1,11 @@
-export function identityFilePath(account, io) {
-    const dir = !account.native && account.configDir ? io.expandHome(account.configDir) : io.defaultConfigDir;
-    if (!dir)
-        return undefined;
+export function identityFilePaths(account, io) {
     if (account.oauthTokenFile || account.oauthTokenRef)
-        return undefined;
-    return `${dir.replace(/\/+$/, "")}/.claude.json`;
+        return [];
+    const file = (dir) => `${dir.replace(/\/+$/, "")}/.claude.json`;
+    if (!account.native && account.configDir)
+        return [file(io.expandHome(account.configDir))];
+    const candidates = [io.homeDir ? file(io.homeDir) : undefined, io.defaultConfigDir ? file(io.defaultConfigDir) : undefined];
+    return [...new Set(candidates.filter((c) => Boolean(c)))];
 }
 export function formatPlan(oauthAccount) {
     const tier = typeof oauthAccount.organizationRateLimitTier === "string"
@@ -47,14 +48,15 @@ export function parseIdentityFile(text) {
         email: str("emailAddress"),
         organizationName: str("organizationName"),
         plan: formatPlan(account),
+        profileFetchedAt: typeof account.profileFetchedAt === "number" ? account.profileFetchedAt : undefined,
     };
     if (!identity.accountUuid && !identity.email)
         return undefined;
     return identity;
 }
 export function resolveAccountIdentity(account, io) {
-    const path = identityFilePath(account, io);
-    if (!path) {
+    const paths = identityFilePaths(account, io);
+    if (paths.length === 0) {
         return {
             accountId: account.id,
             status: "unknown",
@@ -63,28 +65,41 @@ export function resolveAccountIdentity(account, io) {
                 : "no config dir to read",
         };
     }
-    let text;
-    try {
-        text = io.readFile(path);
-    }
-    catch {
-        return {
-            accountId: account.id,
-            status: "unknown",
-            reason: `no readable ${path} — this account has never completed a login here`,
-            source: path,
-        };
-    }
-    const identity = parseIdentityFile(text);
-    if (!identity) {
-        return {
+    let best;
+    const problems = [];
+    for (const path of paths) {
+        let text;
+        try {
+            text = io.readFile(path);
+        }
+        catch {
+            problems.push(`no readable ${path}`);
+            continue;
+        }
+        const identity = parseIdentityFile(text);
+        if (!identity) {
+            problems.push(`${path} carries no oauthAccount record`);
+            continue;
+        }
+        const candidate = {
             accountId: account.id,
-            status: "unknown",
-            reason: `${path} carries no oauthAccount record`,
+            status: "resolved",
             source: path,
+            ...identity,
         };
+        if (!best || (candidate.profileFetchedAt ?? 0) > (best.profileFetchedAt ?? 0))
+            best = candidate;
     }
-    return { accountId: account.id, status: "resolved", source: path, ...identity };
+    if (best)
+        return best;
+    return {
+        accountId: account.id,
+        status: "unknown",
+        reason: problems.length === 1
+            ? `${problems[0]} — this account has never completed a login here`
+            : `${problems.join("; ")} — this account has never completed a login here`,
+        source: paths[0],
+    };
 }
 export function maskEmail(email) {
     const at = email.lastIndexOf("@");

package/dist/chain-audit.js

@@ -271,6 +271,8 @@ export function auditSessionOverrides(sessions, poolConfigured, opts = {}) {
         const source = entry.modelOverrideSource;
         if (typeof source !== "string" || source === "auto")
             continue;
+        if (source === "default" && !entry.modelOverride)
+            continue;
         const provider = entry.providerOverride ?? entry.modelProvider;
         const model = entry.modelOverride;
         if (!provider || !model) {

package/dist/index.js

@@ -25,7 +25,6 @@ import { execFileSync } from "node:child_process";
 import { collectDirectMembers } from "./direct-route.js";
 import { createDirectOrderController, isValidAgentId } from "./direct-sync.js";
 import { createOpenclawRunner } from "./openclaw-runner.js";
-import { HISTORY_IDENTITY_CONFIG_KEY, describeEnsureResult, ensureIdentityProfiles, identityProfileId, loadProviderAuthSdk, } from "./history-identity.js";
 const CLI_FRESH_WATCHDOG_DEFAULTS = {
     noOutputTimeoutRatio: 0.8,
     minMs: 180_000,
@@ -401,7 +400,6 @@ export function buildBackend(account, execMode) {
         resolveExecutionArgs: resolvePoolExecutionArgs,
         sideQuestionToolMode: "disabled",
         ownsNativeCompaction: true,
-        defaultAuthProfileId: identityProfileId(account.id),
         config: {
             command: process.execPath,
             args: [SHIM_PATH, ...BASE_ARGS, ...permissionModeArgs(execMode)],
@@ -554,12 +552,6 @@ export default definePluginEntry({
             api.registerProvider(buildCatalogProvider(normalized));
         }
         registerPoolBackend(api, cfg.pool, accounts, seen, execMode);
-        startHistoryIdentityEnsure({
-            backendIds: [...seen],
-            enabled: cfg[HISTORY_IDENTITY_CONFIG_KEY] !== false,
-            registrationMode: api.registrationMode,
-            logger: api.logger,
-        });
         {
             const logger = api.logger;
             try {
@@ -588,50 +580,6 @@ export default definePluginEntry({
         api.logger.info(`[multi-clawd] registered ${seen.size} backend(s)+provider(s): ${[...seen].join(", ")}`);
     },
 });
-let historyIdentitySdkLoader = loadProviderAuthSdk;
-let historyIdentityPending;
-export function setProviderAuthSdkLoaderForTests(loader) {
-    historyIdentitySdkLoader = loader ?? loadProviderAuthSdk;
-    historyIdentityPending = undefined;
-}
-export function awaitHistoryIdentityEnsure() {
-    return historyIdentityPending ?? Promise.resolve(undefined);
-}
-function startHistoryIdentityEnsure(params) {
-    const { logger } = params;
-    if (params.registrationMode !== undefined && params.registrationMode !== "full")
-        return;
-    if (!params.enabled) {
-        logger.info("[multi-clawd] history identity: disabled by config (historyIdentity: false)");
-        return;
-    }
-    if (params.backendIds.length === 0 || historyIdentityPending)
-        return;
-    const ids = [...params.backendIds];
-    historyIdentityPending = (async () => {
-        try {
-            const sdk = await historyIdentitySdkLoader();
-            if (!sdk) {
-                logger.warn("[multi-clawd] history identity: this OpenClaw does not expose openclaw/plugin-sdk/provider-auth store writers — skipped (CLI history reseed stays auth-unknown)");
-                return undefined;
-            }
-            const result = await ensureIdentityProfiles(ids, sdk);
-            const line = `[multi-clawd] history identity: ${describeEnsureResult(result)}`;
-            if (result.failed.length > 0)
-                logger.warn(line);
-            else
-                logger.info(line);
-            return result;
-        }
-        catch (err) {
-            logger.warn(`[multi-clawd] history identity: ${String(err)}`);
-            return undefined;
-        }
-        finally {
-            historyIdentityPending = undefined;
-        }
-    })();
-}
 function readHealthState(accountId) {
     try {
         return JSON.parse(readFileSync(healthStateFile(accountId), "utf8"));

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "multi-clawd",
   "name": "multi-clawd",
-  "version": "1.9.2",
+  "version": "1.9.4",
   "description": "Register additional Claude Code logins (Max/Pro accounts) as first-class OpenClaw CLI backends for cross-account failover, keeping the full skills/MCP harness on every account.",
   "cliBackends": [
     "claw1",
@@ -205,10 +205,6 @@
           }
         }
       },
-      "historyIdentity": {
-        "type": "boolean",
-        "description": "Store one identity-only OpenClaw auth profile per registered backend id (<id>:multi-clawd-identity — a name, no token) and point the backend's defaultAuthProfileId at it, so OpenClaw's CLI history boundary can bind and a fresh Claude session is reseeded with prior context instead of `cli session history refused across auth boundary: reason=auth-unknown`. Default true. false = no auth-store writes; the reseed refusal stays."
-      },
       "directRoute": {
         "type": "object",
         "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/multi-clawd",
-  "version": "1.9.2",
+  "version": "1.9.4",
   "description": "Multi-account Claude Code failover for OpenClaw — register additional Claude (Max/Pro) logins as first-class CLI backends and keep the full skills/MCP harness across every account. Also imports those accounts' setup tokens into Hermes Agent's Anthropic credential pool.",
   "type": "module",
   "license": "MIT",

package/scripts/doctor.mjs

@@ -288,13 +288,17 @@ const { summarizeWindowUsage, classifyAccountHealth } = await importDist("health
   "summarizeWindowUsage",
   "classifyAccountHealth",
 ]);
+// "cli", like the chain audits: resolving WHICH login backs an account is
+// doctor's own diagnostic, not a description of the running plugin's
+// behaviour. Asking the installed copy meant a fix to the resolver could not
+// take effect until the plugin itself was reinstalled — so the CLI reported a
+// bug it had already been taught not to make.
 const { resolveAccountIdentity, describeIdentity, findDuplicateLogins, maskEmail } =
-  await importDist("account-identity.js", [
-    "resolveAccountIdentity",
-    "describeIdentity",
-    "findDuplicateLogins",
-    "maskEmail",
-  ]);
+  await importDist(
+    "account-identity.js",
+    ["resolveAccountIdentity", "describeIdentity", "findDuplicateLogins", "maskEmail"],
+    "cli",
+  );
 const { decideStickySelection } = await importDist("sticky.js", ["decideStickySelection"]);
 const io = {
   readFile: (p) => readFileSync(expandHome(p), "utf8"),
@@ -322,6 +326,7 @@ const identityIo = {
   defaultConfigDir: process.env.CLAUDE_CONFIG_DIR
     ? expandHome(process.env.CLAUDE_CONFIG_DIR)
     : join(HOME, ".claude"),
+  homeDir: HOME,
 };
 const accounts = pluginConfig.accounts ?? [];
 const identities = [];
@@ -334,7 +339,7 @@ for (const account of accounts) {
   const identity = resolveAccountIdentity(account, identityIo);
   identities.push(identity);
   const source = account.native
-    ? `native login, ${identityIo.defaultConfigDir}`
+    ? `native login, ${identity.source ?? identityIo.defaultConfigDir}`
     : account.configDir
       ? `config dir ${account.configDir}`
       : account.oauthTokenFile