@masons/agent-network 0.5.0 → 0.5.11

package/dist/cli-setup.d.ts

@@ -1,8 +1,13 @@
 /**
- * CLI Setup Path — OAuth 2.0 Device Authorization Grant (RFC 8628).
+ * CLI Login Path — OAuth 2.0 Device Authorization Grant (RFC 8628).
  *
- * Implements `configureInteractive()` hook for OpenClaw's
- * `openclaw channels login --channel agent-network` command.
+ * Implements `login()` hook for OpenClaw's 2026.4.x channel-plugin contract:
+ *     api.registerChannel({ plugin: { ..., auth: { login } } })
+ *
+ * Invoked by `openclaw channels login --channel agent-network`. CLI dispatch
+ * at `dist/channels-cli-Cc40S0aS.js:85` reads `plugin.auth?.login` and throws
+ * `"Channel ... does not support login"` if absent. See WhatsApp + Feishu
+ * bundled extensions for reference implementations of the same contract.
  *
  * Flow:
  *   1. POST {idpBaseUrl}/api/auth/device/code  with client_id + scope
@@ -11,45 +16,61 @@
  *      → handles `expired_token`, `authorization_pending`, `slow_down`
  *   3. POST {apiHost}/runtime/v1/onboard  with Bearer access_token
  *      → list / select existing agent / create new (terminal prompter)
- *   4. Return credentials → OpenClaw CLI persists them to openclaw.json
+ *   4. Persist credentials directly via `writeCredentials()` into
+ *      `openclaw.json`. (The CLI does NOT auto-persist after login returns —
+ *      unlike the legacy `configureInteractive` contract — so the plugin
+ *      owns the file write; see `runChannelLogin` in channels-cli source.)
  *
- * Pre-migration this file existed as a `setup_codes`-based bespoke flow
- * (deleted in fd5568e8). This re-implementation is purely standards-based:
- * the IdP is Better Auth's `deviceAuthorization` plugin, which speaks
- * RFC 8628; the onboard step is a thin MASONS-specific shim that exchanges
- * the user-scope access_token for an agent-scope api_key.
+ * History. Pre-migration this file existed as a `setup_codes`-based bespoke
+ * flow (deleted in fd5568e8). A device-flow re-implementation landed in 0.5.0
+ * under `configureInteractive` mounted at `plugin.setup.configureInteractive`
+ * — but that mount path is not read by any known OpenClaw version (neither
+ * 2026.3.x's top-level `plugin.configureInteractive` nor 2026.4.x's
+ * `plugin.auth.login`). 0.5.1 corrects the mount point and adopts the
+ * 2026.4.x `{cfg, accountId, runtime, verbose, channelInput}` signature.
  *
- * See #1264 for the design rationale (in particular the "single-driver
- * Node semantic" — re-running this flow rotates the api_key and evicts
- * any previously-connected Runtime).
+ * See #1264 for the design rationale (single-driver Node semantic — re-running
+ * this flow rotates the api_key and evicts any previously-connected Runtime).
  */
-interface Prompter {
-    text(label: string, opts?: {
-        default?: string;
-    }): Promise<string>;
-    confirm(label: string): Promise<boolean>;
-    select(label: string, choices: string[]): Promise<string>;
-}
-interface ChannelSetupContext {
-    configured: boolean;
-    label: string;
-    cfg: Record<string, unknown>;
-    runtime: unknown;
-    prompter: Prompter;
-    options: Record<string, unknown>;
+/**
+ * Minimal OpenClaw runtime surface passed to `auth.login`. Exposed as
+ * `defaultRuntime` in `openclaw/dist/runtime-Dx7oeLYq.js` — plugins get
+ * only the output/exit channel, not a prompter (plugins build their own
+ * via @clack/prompts, which is what OpenClaw CLI uses internally too).
+ */
+interface OpenClawRuntime {
+    log(...args: unknown[]): void;
+    error(...args: unknown[]): void;
+    writeStdout(value: string): void;
+    writeJson(value: unknown, space?: number): void;
+    exit(code: number): void;
 }
-type SetupResult = "skip" | {
+/**
+ * Context passed by OpenClaw CLI to `plugin.auth.login`. Matches the call
+ * site at `dist/channels-cli-Cc40S0aS.js:89`:
+ *     await login({ cfg, accountId, runtime, verbose, channelInput });
+ */
+interface AuthLoginContext {
     cfg: Record<string, unknown>;
     accountId?: string;
-};
+    runtime: OpenClawRuntime;
+    verbose?: boolean;
+    channelInput?: string;
+}
 /**
- * Interactive Device Code Flow for OpenClaw CLI.
+ * Channel login hook — invoked by `openclaw channels login --channel agent-network`.
  *
- * Called by `openclaw channels login --channel agent-network` (wired via
- * `setup: { configureInteractive }` on the channel registration in plugin.ts).
+ * Unlike the legacy `configureInteractive` contract (which returned a config
+ * object for the CLI to persist), the 2026.4.x `auth.login` contract returns
+ * void and expects the plugin to persist any config changes itself. We use
+ * `writeCredentials()` in config.ts, which writes `openclaw.json` atomically
+ * and bumps the state-cache generation so Layer B's dynamic context re-reads
+ * on the next turn.
  *
- * Returns `{ cfg, accountId }` — OpenClaw CLI handles writing to openclaw.json.
+ * Errors during device flow or onboarding are surfaced via `ctx.runtime.error`
+ * (not thrown) so OpenClaw CLI doesn't display a stack trace — matches the
+ * WhatsApp/Feishu pattern.
  */
-export declare function configureInteractive(ctx: ChannelSetupContext): Promise<SetupResult>;
+export declare function login(ctx: AuthLoginContext): Promise<void>;
 export {};
 //# sourceMappingURL=cli-setup.d.ts.map

package/dist/cli-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-setup.d.ts","sourceRoot":"","sources":["../src/cli-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAaH,UAAU,QAAQ;IAChB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,UAAU,mBAAmB;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,KAAK,WAAW,GACZ,MAAM,GACN;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AA0XzD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,WAAW,CAAC,CA+CtB"}
+{"version":3,"file":"cli-setup.d.ts","sourceRoot":"","sources":["../src/cli-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAiCH;;;;;GAKG;AACH,UAAU,eAAe;IACvB,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,UAAU,gBAAgB;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAobD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDhE"}

package/dist/cli-setup.js

@@ -1,8 +1,13 @@
 /**
- * CLI Setup Path — OAuth 2.0 Device Authorization Grant (RFC 8628).
+ * CLI Login Path — OAuth 2.0 Device Authorization Grant (RFC 8628).
  *
- * Implements `configureInteractive()` hook for OpenClaw's
- * `openclaw channels login --channel agent-network` command.
+ * Implements `login()` hook for OpenClaw's 2026.4.x channel-plugin contract:
+ *     api.registerChannel({ plugin: { ..., auth: { login } } })
+ *
+ * Invoked by `openclaw channels login --channel agent-network`. CLI dispatch
+ * at `dist/channels-cli-Cc40S0aS.js:85` reads `plugin.auth?.login` and throws
+ * `"Channel ... does not support login"` if absent. See WhatsApp + Feishu
+ * bundled extensions for reference implementations of the same contract.
  *
  * Flow:
  *   1. POST {idpBaseUrl}/api/auth/device/code  with client_id + scope
@@ -11,18 +16,24 @@
  *      → handles `expired_token`, `authorization_pending`, `slow_down`
  *   3. POST {apiHost}/runtime/v1/onboard  with Bearer access_token
  *      → list / select existing agent / create new (terminal prompter)
- *   4. Return credentials → OpenClaw CLI persists them to openclaw.json
+ *   4. Persist credentials directly via `writeCredentials()` into
+ *      `openclaw.json`. (The CLI does NOT auto-persist after login returns —
+ *      unlike the legacy `configureInteractive` contract — so the plugin
+ *      owns the file write; see `runChannelLogin` in channels-cli source.)
  *
- * Pre-migration this file existed as a `setup_codes`-based bespoke flow
- * (deleted in fd5568e8). This re-implementation is purely standards-based:
- * the IdP is Better Auth's `deviceAuthorization` plugin, which speaks
- * RFC 8628; the onboard step is a thin MASONS-specific shim that exchanges
- * the user-scope access_token for an agent-scope api_key.
+ * History. Pre-migration this file existed as a `setup_codes`-based bespoke
+ * flow (deleted in fd5568e8). A device-flow re-implementation landed in 0.5.0
+ * under `configureInteractive` mounted at `plugin.setup.configureInteractive`
+ * — but that mount path is not read by any known OpenClaw version (neither
+ * 2026.3.x's top-level `plugin.configureInteractive` nor 2026.4.x's
+ * `plugin.auth.login`). 0.5.1 corrects the mount point and adopts the
+ * 2026.4.x `{cfg, accountId, runtime, verbose, channelInput}` signature.
  *
- * See #1264 for the design rationale (in particular the "single-driver
- * Node semantic" — re-running this flow rotates the api_key and evicts
- * any previously-connected Runtime).
+ * See #1264 for the design rationale (single-driver Node semantic — re-running
+ * this flow rotates the api_key and evicts any previously-connected Runtime).
  */
+import { cancel, confirm as clackConfirm, select as clackSelect, text as clackText, isCancel, } from "@clack/prompts";
+import { writeCredentials } from "./config.js";
 import { DEFAULT_API_HOST, onboard, PlatformApiError, } from "./platform-client.js";
 // ---------------------------------------------------------------------------
 // Constants
@@ -73,6 +84,14 @@ class DeviceFlowError extends Error {
 }
 class DeviceFlowExpired extends Error {
 }
+/**
+ * User pressed Ctrl+C at any prompter step. Subclass of `DeviceFlowError`
+ * so the existing throw/catch chain still works, but distinguished so the
+ * `login` handler can skip the redundant `runtime.error` call (clack's
+ * `cancel()` already emitted the canonical "cancelled" UI).
+ */
+class CancelError extends DeviceFlowError {
+}
 /**
  * Run the RFC 8628 device flow loop. Returns the access_token on success.
  * On expiration, restarts the loop transparently (user gets a fresh code).
@@ -272,55 +291,107 @@ async function createAgentLoop(platformCfg, accessToken, prompter) {
     }
 }
 // ---------------------------------------------------------------------------
-// Public hook
+// Clack-backed Prompter adapter
+// ---------------------------------------------------------------------------
+/**
+ * Build a Prompter backed by `@clack/prompts` (the same library OpenClaw CLI
+ * uses internally, so the terminal UX is consistent with other channel
+ * plugins). Cancel sentinels (user Ctrl+C) are mapped to `DeviceFlowError`
+ * so the login function can treat cancels as a clean exit condition.
+ */
+function createClackPrompter() {
+    const abortOnCancel = (result) => {
+        if (isCancel(result)) {
+            // Emit clack's canonical cancel UI (bracketed red "cancelled") here so
+            // the user sees a clean exit indicator, then throw `CancelError` so the
+            // outer `login` catch returns silently (avoids printing the same line
+            // twice — UI from `cancel()` + a redundant `runtime.error` afterwards).
+            cancel("Setup cancelled.");
+            throw new CancelError("Setup cancelled by user.");
+        }
+    };
+    return {
+        async text(label) {
+            // `text(label, opts?.default)` previously mapped `opts.default` to clack's
+            // `placeholder` — but clack's `placeholder` is hint-only (not auto-submitted
+            // on empty input), and no current caller passes `opts.default`. Dropped
+            // the mapping until a real default-value need surfaces; revisit by
+            // implementing `clackText({ message, defaultValue })` then.
+            const result = await clackText({ message: label });
+            abortOnCancel(result);
+            return result;
+        },
+        async confirm(label) {
+            const result = await clackConfirm({ message: label });
+            abortOnCancel(result);
+            return result;
+        },
+        async select(label, choices) {
+            // Narrow the generic — we use `string` values throughout the flow.
+            const result = await clackSelect({
+                message: label,
+                options: choices.map((choice) => ({ value: choice, label: choice })),
+            });
+            abortOnCancel(result);
+            return result;
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Public hook — `plugin.auth.login` (OpenClaw 2026.4.x contract)
 // ---------------------------------------------------------------------------
 /**
- * Interactive Device Code Flow for OpenClaw CLI.
+ * Channel login hook — invoked by `openclaw channels login --channel agent-network`.
  *
- * Called by `openclaw channels login --channel agent-network` (wired via
- * `setup: { configureInteractive }` on the channel registration in plugin.ts).
+ * Unlike the legacy `configureInteractive` contract (which returned a config
+ * object for the CLI to persist), the 2026.4.x `auth.login` contract returns
+ * void and expects the plugin to persist any config changes itself. We use
+ * `writeCredentials()` in config.ts, which writes `openclaw.json` atomically
+ * and bumps the state-cache generation so Layer B's dynamic context re-reads
+ * on the next turn.
  *
- * Returns `{ cfg, accountId }` — OpenClaw CLI handles writing to openclaw.json.
+ * Errors during device flow or onboarding are surfaced via `ctx.runtime.error`
+ * (not thrown) so OpenClaw CLI doesn't display a stack trace — matches the
+ * WhatsApp/Feishu pattern.
  */
-export async function configureInteractive(ctx) {
-    const { prompter } = ctx;
+export async function login(ctx) {
     // Channel-level config (`cfg.apiHost`, `cfg.idpBaseUrl`) — both have
     // defaults. Existing values from openclaw.json are preserved on re-run.
     const apiHost = typeof ctx.cfg.apiHost === "string" ? ctx.cfg.apiHost : DEFAULT_API_HOST;
     const idpBaseUrl = typeof ctx.cfg.idpBaseUrl === "string"
         ? ctx.cfg.idpBaseUrl
         : DEFAULT_IDP_BASE_URL;
+    const prompter = createClackPrompter();
     let creds;
     try {
         const accessToken = await deviceCodeFlow(idpBaseUrl, prompter);
         creds = await agentSetup(apiHost, accessToken, prompter);
     }
     catch (err) {
+        if (err instanceof CancelError) {
+            // User pressed Ctrl+C. The clack `cancel()` call inside the prompter
+            // adapter already emitted the cancellation UI; nothing else to print.
+            return;
+        }
         if (err instanceof DeviceFlowError) {
-            // Human-friendly surface — user reads this and re-runs setup.
-            await prompter.text(`${err.message}\n\nPress Enter to exit.`);
-            return "skip";
+            // Device-flow / onboard error with a human-friendly message.
+            // Print and return cleanly — CLI shows nothing else on a return.
+            ctx.runtime.error(err.message);
+            return;
         }
         if (err instanceof PlatformApiError) {
-            await prompter.text(`Onboard failed (HTTP ${err.status} ${err.code}): ${err.message}. ` +
-                "Press Enter to exit.");
-            return "skip";
+            ctx.runtime.error(`Onboard failed (HTTP ${err.status} ${err.code}): ${err.message}`);
+            return;
         }
+        // Unknown error — let CLI surface the stack. Surfaces platform bugs
+        // that aren't covered by our structured error types.
         throw err;
     }
-    // The openclaw.json schema for an account is { connectorUrl, token }
-    // (see config-schema.ts). On the wire the field is called `apiKey` to
-    // disambiguate from "session token" / "JWT" — but locally on disk it's
-    // persisted as `token` for backward compatibility with existing OpenClaw
-    // configs and the channel.resolveAccount() reader at channel.ts:485.
-    return {
-        cfg: {
-            accounts: {
-                default: { connectorUrl: creds.connectorUrl, token: creds.apiKey },
-            },
-            apiHost,
-            idpBaseUrl,
-        },
-        accountId: "default",
-    };
+    // Persist: `openclaw.json` schema for an account is `{connectorUrl, token}`
+    // (see config-schema.ts). On the wire the onboard response field is
+    // `apiKey` to disambiguate from OAuth "session token" / JWT — but locally
+    // on disk it's persisted as `token` for backward compatibility with the
+    // existing `channel.resolveAccount()` reader.
+    await writeCredentials({ connectorUrl: creds.connectorUrl, token: creds.apiKey }, apiHost, idpBaseUrl);
+    ctx.runtime.log(`✓ Connected as @${creds.handle}`);
 }

package/dist/config.d.ts

@@ -160,12 +160,16 @@ export interface NetworkCredentials {
     token: string;
 }
 /**
- * Write credentials + apiHost to `openclaw.json`.
+ * Write credentials + apiHost (+ optional idpBaseUrl) to `openclaw.json`.
  *
- * Atomic: credentials and apiHost are written in a single operation
- * to avoid partial-write race conditions.
+ * Atomic: all fields are written in a single persistConfig() call to avoid
+ * partial-write race conditions.
+ *
+ * `idpBaseUrl` is written only when provided, mirroring `apiHost`'s pattern —
+ * omitted values leave any existing field in place (useful when callers want
+ * to refresh credentials without overriding IdP URL).
  */
-export declare function writeCredentials(creds: NetworkCredentials, apiHost?: string): Promise<void>;
+export declare function writeCredentials(creds: NetworkCredentials, apiHost?: string, idpBaseUrl?: string): Promise<void>;
 /**
  * Write pending connection target handle.
  *

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAiC9B;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAcD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMhC;AAMD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAyCjE;AAkCD;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAMD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAOjE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAMD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,mBAAmB,CAOhE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,IAAI,CAEnE;AAMD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAExD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAO9C;AAMD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,CAE5D;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,eAAe,CAOxD;AAMD,+EAA+E;AAC/E,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAgDD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrE;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CASvD;AAMD;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOvD;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOzD;AAsBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B1E;AAMD,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,cAAc,EAAE,OAAO,CAAC;IACxB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,YAAY,CAAC,CA2BhE;AAMD,uDAAuD;AACvD,wBAAgB,gBAAgB,IAAI,IAAI,CAWvC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAiC9B;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAcD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMhC;AAMD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAyCjE;AAkCD;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAMD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAOjE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAMD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,mBAAmB,CAOhE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,IAAI,CAEnE;AAMD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAExD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAO9C;AAMD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,CAE5D;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,eAAe,CAOxD;AAMD,+EAA+E;AAC/E,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAgDD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrE;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CASvD;AAMD;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOvD;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOzD;AAsBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B1E;AAMD,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,cAAc,EAAE,OAAO,CAAC;IACxB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,YAAY,CAAC,CA2BhE;AAMD,uDAAuD;AACvD,wBAAgB,gBAAgB,IAAI,IAAI,CAWvC"}

package/dist/config.js

@@ -362,12 +362,16 @@ function ensureNetworkSection(config) {
     return channels["agent-network"];
 }
 /**
- * Write credentials + apiHost to `openclaw.json`.
+ * Write credentials + apiHost (+ optional idpBaseUrl) to `openclaw.json`.
  *
- * Atomic: credentials and apiHost are written in a single operation
- * to avoid partial-write race conditions.
+ * Atomic: all fields are written in a single persistConfig() call to avoid
+ * partial-write race conditions.
+ *
+ * `idpBaseUrl` is written only when provided, mirroring `apiHost`'s pattern —
+ * omitted values leave any existing field in place (useful when callers want
+ * to refresh credentials without overriding IdP URL).
  */
-export async function writeCredentials(creds, apiHost) {
+export async function writeCredentials(creds, apiHost, idpBaseUrl) {
     const config = await readConfig();
     const section = ensureNetworkSection(config);
     section.enabled = true;
@@ -384,6 +388,11 @@ export async function writeCredentials(creds, apiHost) {
     if (apiHost) {
         section.apiHost = apiHost;
     }
+    // Write idpBaseUrl if provided (Better Auth IdP URL for device flow).
+    // Added in 0.5.1 alongside the plugin.auth.login hook (#1264 follow-up).
+    if (idpBaseUrl) {
+        section.idpBaseUrl = idpBaseUrl;
+    }
     await persistConfig(config);
     // Update module-level var — deliberate exception to read/write separation,
     // same pattern as clearTargetHandle(). Without this, tools fail with

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAiJA,UAAU,iBAAiB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GAAG,IAAI,CAAC;CACnE;AAED,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;kBAaI,iBAAiB;CAoXhC,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAiJA,UAAU,iBAAiB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GAAG,IAAI,CAAC;CACnE;AAED,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;kBAaI,iBAAiB;CA6XhC,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/plugin.js

@@ -3,7 +3,7 @@
 // NOT imported by index.ts to avoid pulling ws/typebox into Next.js app bundles.
 import pluginManifest from "../openclaw.plugin.json" with { type: "json" };
 import { agentNetworkChannel, consumeIdentityLinkingNudge } from "./channel.js";
-import { configureInteractive } from "./cli-setup.js";
+import { login } from "./cli-setup.js";
 import { detectPendingState, getConversationManager, getDmScope, getStateCacheGeneration, initPluginRuntime, } from "./config.js";
 import { getAgentIdentity } from "./environment-context.js";
 import { ownerNotesQueue } from "./owner-notes.js";
@@ -126,27 +126,33 @@ const plugin = {
         // Register tools FIRST — they must be available even when the channel
         // has no credentials yet.
         registerTools(api);
-        // Channel registration may fail if no credentials are configured yet.
-        // This is expected on first run — the user authorizes via the OAuth
-        // device flow run by `configureInteractive` (CLI command:
-        // `openclaw channels login --channel agent-network`). After credentials
-        // are persisted to openclaw.json, OpenClaw hot-reloads and re-runs
-        // register() — the channel then activates.
+        // Register the agent-network channel. The 2026.4.x contract reads
+        // `plugin.auth?.login` for `openclaw channels login --channel agent-network`
+        // (CLI dispatch in `dist/channels-cli-Cc40S0aS.js:85`). Reference plugins
+        // (WhatsApp, Feishu in the OpenClaw bundle) use the same shape.
         //
-        // `setup: { configureInteractive }` exposes the CLI hook to OpenClaw.
-        // Restored in #1264 after the legacy setup flow was deleted in
-        // fd5568e8 (#1253). The new implementation is RFC 8628 device flow
-        // against Better Auth at the IdP — no MASONS-specific bespoke endpoints.
+        // History: 0.5.0 mounted this hook at `plugin.setup.configureInteractive`
+        // — a path no OpenClaw version reads, so `channels login` never worked.
+        // 0.5.1 corrected the mount point. 0.5.2 surfaces register errors
+        // instead of silently catching them — the previous "cheap guard"
+        // (`catch {}`) hid every kind of register-time failure including the
+        // ones we care about (schema validation, missing modules, IO errors).
+        //
+        // The new contract: log the error visibly AND re-throw, so OpenClaw
+        // surfaces the failure to the user rather than running with an
+        // un-registered channel that mysteriously "doesn't support login".
+        // Per Mingke's review of the 0.5.1 T1 failure (#1264, 2026-04-19).
         try {
             api.registerChannel({
                 plugin: {
                     ...agentNetworkChannel,
-                    setup: { configureInteractive },
+                    auth: { login },
                 },
             });
         }
-        catch {
-            // Silently ignore — channel will be registered after setup + restart.
+        catch (err) {
+            console.error("[@masons/agent-network] api.registerChannel failed — channel will be unavailable:", err);
+            throw err;
         }
         // --- Layer B: Per-turn context injection ---
         // Injects agent network awareness into every LLM turn via before_prompt_build.

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 /** Plugin version — must match package.json. Validated by prepublishOnly. */
-export declare const PLUGIN_VERSION = "0.5.0";
+export declare const PLUGIN_VERSION = "0.5.11";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,eAAO,MAAM,cAAc,UAAU,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,eAAO,MAAM,cAAc,WAAW,CAAC"}

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Plugin version — must match package.json. Validated by prepublishOnly. */
-export const PLUGIN_VERSION = "0.5.0";
+export const PLUGIN_VERSION = "0.5.11";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@masons/agent-network",
-  "version": "0.5.0",
+  "version": "0.5.11",
   "description": "MASONS plugin for OpenClaw — connect your agent to the agent network",
   "license": "MIT",
   "author": "MASONS.ai <hello@masons.ai> (https://masons.ai)",
@@ -58,6 +58,7 @@
     }
   },
   "dependencies": {
+    "@clack/prompts": "^1.2.0",
     "@sinclair/typebox": "^0.34",
     "debug": "^4.4.3",
     "ws": "8.18.3"