@newbase-clawchat/openclaw-clawchat 2026.5.12-2 → 2026.5.12-21

package/src/login.runtime.test.ts

@@ -30,7 +30,7 @@ describe("runOpenclawClawlingLogin", () => {
   it("works with no prior setup (baseUrl / websocketUrl default built-in)", async () => {
     const cfg = buildCfg({}); // empty section — resolver provides defaults
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "u" },
+      agent: { user_id: "u", owner_id: "owner-u" },
       access_token: "t",
       refresh_token: "r",
     });
@@ -106,6 +106,9 @@ describe("runOpenclawClawlingLogin", () => {
     expect(section.token).toBe("access-tok");
     expect(section.refreshToken).toBe("refresh-tok");
     expect(section.userId).toBe("agent-123");
+    expect(section.ownerUserId).toBe("owner-1");
+    expect(section.groupMode).toBe("all");
+    expect(section.groupCommandMode).toBe("owner");
     // Existing baseUrl and websocketUrl are preserved — agents/connect
     // does not return them.
     expect(section.baseUrl).toBe("https://api.example.com");
@@ -113,13 +116,54 @@ describe("runOpenclawClawlingLogin", () => {
     expect(log).toHaveBeenCalledWith(expect.stringContaining("login succeeded"));
   });
 
+  it("persists latest activation bootstrap metadata to the sqlite store after config write", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      websocketUrl: "wss://ws.example.com/v2/client",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123", nickname: "Bot" },
+      access_token: "access-plain",
+      refresh_token: "refresh-plain",
+      conversation: { id: "conv-activation" },
+    });
+    const persistConfig = vi.fn();
+    const upsertActivation = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+      store: { upsertActivation },
+    });
+
+    expect(upsertActivation).toHaveBeenCalledTimes(1);
+    expect(persistConfig.mock.invocationCallOrder[0]).toBeLessThan(
+      upsertActivation.mock.invocationCallOrder[0],
+    );
+    expect(upsertActivation).toHaveBeenCalledWith({
+      platform: "openclaw",
+      accountId: "default",
+      userId: "agent-123",
+      ownerUserId: "owner-123",
+      conversationId: "conv-activation",
+      loginMethod: "login",
+    });
+    expect(upsertActivation.mock.calls[0]![0]).not.toHaveProperty("accessToken");
+    expect(upsertActivation.mock.calls[0]![0]).not.toHaveProperty("refreshToken");
+    expect(upsertActivation.mock.calls[0]![0]).not.toHaveProperty("baseUrl");
+    expect(upsertActivation.mock.calls[0]![0]).not.toHaveProperty("websocketUrl");
+  });
+
   it("uses the runtime config mutator with restart intent after credential writes", async () => {
     const cfg = buildCfg({
       baseUrl: "https://api.example.com",
       websocketUrl: "wss://ws.example.com/v2/client",
     });
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "agent-123", nickname: "Bot" },
+      agent: { user_id: "agent-123", owner_id: "owner-123", nickname: "Bot" },
       access_token: "access-tok",
       refresh_token: "refresh-tok",
     });
@@ -151,6 +195,9 @@ describe("runOpenclawClawlingLogin", () => {
     expect(section.token).toBe("access-tok");
     expect(section.refreshToken).toBe("refresh-tok");
     expect(section.userId).toBe("agent-123");
+    expect(section.ownerUserId).toBe("owner-123");
+    expect(section.groupMode).toBe("all");
+    expect(section.groupCommandMode).toBe("owner");
     const plugins = (mutatedCfg! as OpenClawConfig & {
       plugins: { allow?: string[]; entries: Record<string, Record<string, unknown>> };
     }).plugins;
@@ -178,7 +225,7 @@ describe("runOpenclawClawlingLogin", () => {
       },
     } as unknown as OpenClawConfig;
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "agent-123" },
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
       access_token: "access-tok",
       refresh_token: "refresh-tok",
     });
@@ -202,6 +249,7 @@ describe("runOpenclawClawlingLogin", () => {
       websocketUrl: "wss://ws.example.com/v2/client",
       token: "access-tok",
       userId: "agent-123",
+      ownerUserId: "owner-123",
       refreshToken: "refresh-tok",
     });
   });
@@ -212,7 +260,7 @@ describe("runOpenclawClawlingLogin", () => {
       baseUrl: "https://api.example.com",
     });
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "agent-123" },
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
       access_token: "access-tok",
       refresh_token: "refresh-tok",
     });
@@ -231,6 +279,65 @@ describe("runOpenclawClawlingLogin", () => {
     expect(section.enabled).toBe(true);
     expect(section.token).toBe("access-tok");
     expect(section.userId).toBe("agent-123");
+    expect(section.ownerUserId).toBe("owner-123");
+    expect(section.groupMode).toBe("all");
+  });
+
+  it("does not overwrite an explicit mention groupMode during login", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      groupMode: "mention",
+      groupCommandMode: "off",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.groupMode).toBe("mention");
+    expect(section.groupCommandMode).toBe("off");
+  });
+
+  it("does not overwrite per-group groupMode settings during login", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      groupMode: "all",
+      groups: {
+        "group-quiet": { groupMode: "mention" },
+      },
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "refresh-tok",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "INV-ABC",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.groups).toEqual({
+      "group-quiet": { groupMode: "mention" },
+    });
   });
 
   it("allows openclaw-clawchat plugin tools after successful login without replacing policy", async () => {
@@ -244,7 +351,7 @@ describe("runOpenclawClawlingLogin", () => {
       },
     } as unknown as OpenClawConfig;
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "agent-123" },
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
       access_token: "access-tok",
       refresh_token: "refresh-tok",
     });
@@ -282,7 +389,7 @@ describe("runOpenclawClawlingLogin", () => {
       },
     } as unknown as OpenClawConfig;
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "agent-123" },
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
       access_token: "access-tok",
       refresh_token: "refresh-tok",
     });
@@ -326,7 +433,7 @@ describe("runOpenclawClawlingLogin", () => {
   it("rejects responses that omit required fields", async () => {
     const cfg = buildCfg({ baseUrl: "https://api.example.com" });
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "" },
+      agent: { user_id: "", owner_id: "owner-123" },
       access_token: "t",
       refresh_token: "r",
     });
@@ -341,13 +448,185 @@ describe("runOpenclawClawlingLogin", () => {
     ).rejects.toThrow(/missing required fields/);
   });
 
+  it("rejects whitespace-only required agents/connect response fields", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "   ", owner_id: "owner-123" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/missing required fields/);
+  });
+
+  it("rejects whitespace-only agents/connect access tokens", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "   ",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/access_token/);
+  });
+
+  it("rejects agents/connect responses that omit agent owner ids", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/agent\.owner_id/);
+  });
+
+  it("rejects empty returned agent owner ids", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "" },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/agent\.owner_id/);
+  });
+
+  it("rejects whitespace-only returned agent owner ids", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "   " },
+      access_token: "t",
+      refresh_token: "r",
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/missing required fields/);
+  });
+
+  it("rejects whitespace-only activation conversation ids when present", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "t",
+      refresh_token: "r",
+      conversation: { id: "   " },
+    });
+    await expect(
+      runOpenclawClawlingLogin({
+        cfg,
+        runtime: { log: vi.fn() },
+        readInviteCode: async () => "ok",
+        apiClientFactory: () => makeApiClient({ agentsConnect }),
+        persistConfig: vi.fn(),
+      }),
+    ).rejects.toThrow(/missing required fields/);
+  });
+
+  it("trims persisted agents/connect credentials and activation conversation id", async () => {
+    const cfg = buildCfg({ baseUrl: "https://api.example.com" });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "  agent-123  ", owner_id: "  owner-123  ", nickname: "Bot" },
+      access_token: "  access-tok  ",
+      refresh_token: "  refresh-tok  ",
+      conversation: { id: "  conv-activation  " },
+    });
+    const persistConfig = vi.fn();
+    const upsertActivation = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "ok",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+      store: { upsertActivation },
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.token).toBe("access-tok");
+    expect(section.refreshToken).toBe("refresh-tok");
+    expect(section.userId).toBe("agent-123");
+    expect(section.ownerUserId).toBe("owner-123");
+    expect(upsertActivation).toHaveBeenCalledWith({
+      platform: "openclaw",
+      accountId: "default",
+      userId: "agent-123",
+      ownerUserId: "owner-123",
+      conversationId: "conv-activation",
+      loginMethod: "login",
+    });
+  });
+
+  it("does not preserve a stale refresh token when agents/connect returns a blank refresh token", async () => {
+    const cfg = buildCfg({
+      baseUrl: "https://api.example.com",
+      refreshToken: "stale-refresh",
+    });
+    const agentsConnect = vi.fn().mockResolvedValue({
+      agent: { user_id: "agent-123", owner_id: "owner-123" },
+      access_token: "access-tok",
+      refresh_token: "   ",
+    });
+    const persistConfig = vi.fn();
+
+    await runOpenclawClawlingLogin({
+      cfg,
+      runtime: { log: vi.fn() },
+      readInviteCode: async () => "ok",
+      apiClientFactory: () => makeApiClient({ agentsConnect }),
+      persistConfig,
+    });
+
+    const savedCfg = persistConfig.mock.calls[0]![0] as OpenClawConfig;
+    const section = (savedCfg.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
+    expect(section.token).toBe("access-tok");
+    expect(section.userId).toBe("agent-123");
+    expect(section.refreshToken).toBeUndefined();
+  });
+
   it("persists the config automatically after receiving the token (no further prompts)", async () => {
     const cfg = buildCfg({
       baseUrl: "https://api.example.com",
       websocketUrl: "wss://ws.example.com",
     });
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "agent-9", nickname: "Nine" },
+      agent: { id: "agt-9", user_id: "agent-9", owner_id: "owner-9", nickname: "Nine" },
       access_token: "ACC-0123456789",
       refresh_token: "REF-xyz",
     });
@@ -366,7 +645,9 @@ describe("runOpenclawClawlingLogin", () => {
     expect(persistCalls).toHaveLength(1);
     const section = (persistCalls[0]!.channels as Record<string, Record<string, unknown>>)[CHANNEL_ID]!;
     expect(section.token).toBe("ACC-0123456789");
+    expect(section.agentId).toBe("agt-9");
     expect(section.userId).toBe("agent-9");
+    expect(section.ownerUserId).toBe("owner-9");
     expect(section.refreshToken).toBe("REF-xyz");
     // Existing URL fields are preserved.
     expect(section.baseUrl).toBe("https://api.example.com");
@@ -376,12 +657,13 @@ describe("runOpenclawClawlingLogin", () => {
     expect(logMessages.some((m) => /Config file updated/.test(m))).toBe(true);
     // Token in logs is redacted.
     expect(logMessages.every((m) => !m.includes("ACC-0123456789"))).toBe(true);
+    expect(logMessages.every((m) => !m.includes("ACC-") && !m.includes("6789"))).toBe(true);
   });
 
   it("login logs don't leak the /agents/connect endpoint path or base URL", async () => {
     const cfg = buildCfg({ baseUrl: "https://api.example.com" });
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "u" },
+      agent: { user_id: "u", owner_id: "owner-u" },
       access_token: "t",
       refresh_token: "r",
     });
@@ -402,7 +684,7 @@ describe("runOpenclawClawlingLogin", () => {
   it("trims the invite code before sending", async () => {
     const cfg = buildCfg({ baseUrl: "https://api.example.com" });
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "u" },
+      agent: { user_id: "u", owner_id: "owner-u" },
       access_token: "t",
       refresh_token: "r",
     });
@@ -425,7 +707,7 @@ describe("runOpenclawClawlingLogin (non-interactive via readInviteCode)", () =>
   it("performs a full login when called with a fixed readInviteCode (programmatic path)", async () => {
     const cfg = buildCfg({ baseUrl: "https://api.example.com" });
     const agentsConnect = vi.fn().mockResolvedValue({
-      agent: { user_id: "agent-7", nickname: "Seven" },
+      agent: { user_id: "agent-7", owner_id: "owner-7", nickname: "Seven" },
       access_token: "acc-non-interactive",
       refresh_token: "ref-ni",
     });
@@ -447,6 +729,7 @@ describe("runOpenclawClawlingLogin (non-interactive via readInviteCode)", () =>
       ["openclaw-clawchat"] as Record<string, unknown>;
     expect(section.token).toBe("acc-non-interactive");
     expect(section.userId).toBe("agent-7");
+    expect(section.ownerUserId).toBe("owner-7");
     expect(section.refreshToken).toBe("ref-ni");
   });
 });

package/src/login.runtime.ts

@@ -8,6 +8,7 @@ import {
   mergeOpenclawClawchatToolAllow,
   resolveOpenclawClawlingAccount,
 } from "./config.ts";
+import { getClawChatStore, type ClawChatStore } from "./storage.ts";
 
 /**
  * Platform tag sent to `/v1/agents/connect`. Identifies the host of this
@@ -43,6 +44,10 @@ export interface LoginParams {
   mutateConfigFile?: OpenclawClawchatMutateConfigFile;
   /** Test-only config persistence override. */
   persistConfig?: (cfg: OpenClawConfig) => Promise<void> | void;
+  /** Test/runtime override for best-effort activation persistence. */
+  store?: Pick<ClawChatStore, "upsertActivation">;
+  /** Optional database path resolved by the host runtime. */
+  dbPath?: string;
 }
 
 /**
@@ -73,14 +78,26 @@ async function promptInviteCodeFromStdin(runtime: {
 function buildLoginConfig(cfg: OpenClawConfig, result: AgentConnectResult): OpenClawConfig {
   const channels = (cfg.channels ?? {}) as Record<string, unknown>;
   const existing = (channels[CHANNEL_ID] ?? {}) as Record<string, unknown>;
+  const groupMode = existing.groupMode === "mention" || existing.groupMode === "all"
+    ? existing.groupMode
+    : "all";
+  const groupCommandMode = existing.groupCommandMode === "all" || existing.groupCommandMode === "off"
+    ? existing.groupCommandMode
+    : "owner";
   const nextSection: Record<string, unknown> = {
     ...existing,
     enabled: true,
+    groupMode,
+    groupCommandMode,
     token: result.access_token,
+    ...(result.agent.id ? { agentId: result.agent.id } : {}),
     userId: result.agent.user_id,
+    ownerUserId: result.agent.owner_id,
   };
   if (result.refresh_token) {
     nextSection.refreshToken = result.refresh_token;
+  } else {
+    delete nextSection.refreshToken;
   }
   return mergeOpenclawClawchatRuntimePluginActivation(
     mergeOpenclawClawchatToolAllow({
@@ -96,7 +113,7 @@ async function persistLoginConfig(
 ): Promise<void> {
   if (params.mutateConfigFile) {
     params.runtime.log(
-      `Persisting ClawChat credentials and plugin activation for userId=${result.agent.user_id} with Gateway restart intent.`,
+      `Persisting ClawChat credentials and plugin activation for userId=${result.agent.user_id} ownerUserId=${result.agent.owner_id} with Gateway restart intent.`,
     );
     await params.mutateConfigFile({
       afterWrite: {
@@ -108,18 +125,18 @@ async function persistLoginConfig(
       },
     });
     params.runtime.log(
-      `ClawChat credentials and plugin activation persisted for userId=${result.agent.user_id}.`,
+      `ClawChat credentials and plugin activation persisted for userId=${result.agent.user_id} ownerUserId=${result.agent.owner_id}.`,
     );
     return;
   }
 
   if (params.persistConfig) {
     params.runtime.log(
-      `Persisting ClawChat credentials and plugin activation for userId=${result.agent.user_id}.`,
+      `Persisting ClawChat credentials and plugin activation for userId=${result.agent.user_id} ownerUserId=${result.agent.owner_id}.`,
     );
     await params.persistConfig(buildLoginConfig(params.cfg, result));
     params.runtime.log(
-      `ClawChat credentials and plugin activation persisted for userId=${result.agent.user_id}.`,
+      `ClawChat credentials and plugin activation persisted for userId=${result.agent.user_id} ownerUserId=${result.agent.owner_id}.`,
     );
     return;
   }
@@ -127,8 +144,26 @@ async function persistLoginConfig(
   throw new Error("openclaw-clawchat: mutateConfigFile is required to persist login credentials");
 }
 
+function requireConnectString(value: unknown, fieldName: string): string {
+  if (typeof value !== "string") {
+    throw new Error(`agents/connect response missing required fields (${fieldName})`);
+  }
+  const trimmed = value.trim();
+  if (!trimmed) {
+    throw new Error(`agents/connect response missing required fields (${fieldName})`);
+  }
+  return trimmed;
+}
+
+function readOptionalConnectString(value: unknown, fieldName: string): string | undefined {
+  if (value == null) {
+    return undefined;
+  }
+  return requireConnectString(value, fieldName);
+}
+
 /**
- * Run the invite-code credential exchange used by `/clawchat-login`,
+ * Run the invite-code credential exchange used by `/clawchat-activate`,
  * `openclaw channels add --channel openclaw-clawchat --token <invite-code>`,
  * and `openclaw channels login --channel openclaw-clawchat`:
  *   1. Read the existing channel section; require `baseUrl` to be set so we
@@ -178,29 +213,63 @@ export async function runOpenclawClawlingLogin(params: LoginParams): Promise<voi
     throw err;
   }
 
-  if (!result?.access_token || !result?.agent?.user_id) {
-    throw new Error(
-      `agents/connect response missing required fields (access_token / agent.user_id): ${JSON.stringify(result)}`,
-    );
+  const accessToken = requireConnectString(result?.access_token, "access_token");
+  const agentUserId = requireConnectString(result?.agent?.user_id, "agent.user_id");
+  const ownerUserId = requireConnectString(result?.agent?.owner_id, "agent.owner_id");
+  const agentId = readOptionalConnectString(result?.agent?.id, "agent.id");
+
+  let conversationId: string | null = null;
+  if (result?.conversation != null) {
+    conversationId = requireConnectString(result.conversation.id, "conversation.id");
   }
 
-  const tokenPreview = redactToken(result.access_token);
+  const normalizedResult: AgentConnectResult = {
+    ...result,
+    access_token: accessToken,
+    refresh_token: typeof result?.refresh_token === "string" ? result.refresh_token.trim() : "",
+    agent: {
+      ...result.agent,
+      ...(agentId ? { id: agentId } : {}),
+      owner_id: ownerUserId,
+      user_id: agentUserId,
+    },
+    ...(conversationId
+      ? {
+          conversation: {
+            ...result.conversation,
+            id: conversationId,
+          },
+        }
+      : {}),
+  };
+
   runtime.log(
-    `Updating config: channels.${CHANNEL_ID}.token=${tokenPreview} userId=${result.agent.user_id}${
-      result.refresh_token ? " refreshToken=***" : ""
+    `Updating config: channels.${CHANNEL_ID}.token=[REDACTED] agentId=${normalizedResult.agent.id || "-"} userId=${normalizedResult.agent.user_id} ownerUserId=${normalizedResult.agent.owner_id}${
+      normalizedResult.refresh_token ? " refreshToken=[REDACTED]" : ""
     } plugins.entries.${CHANNEL_ID}.enabled=true plugins.allow+=${CHANNEL_ID} …`,
   );
-  await persistLoginConfig(params, result);
+  await persistLoginConfig(params, normalizedResult);
+  try {
+    const store =
+      params.store ??
+      getClawChatStore({
+        ...(params.dbPath ? { dbPath: params.dbPath } : {}),
+        log: { error: runtime.log },
+      });
+    store.upsertActivation({
+      platform: "openclaw",
+      accountId: account.accountId,
+      userId: normalizedResult.agent.user_id,
+      ownerUserId: normalizedResult.agent.owner_id,
+      conversationId: normalizedResult.conversation?.id ?? null,
+      loginMethod: "login",
+    });
+  } catch {
+    runtime.log("openclaw-clawchat sqlite activation persistence failed; login continues.");
+  }
   runtime.log(`Config file updated.`);
 
   runtime.log(
-    `openclaw-clawchat login succeeded (user_id=${result.agent.user_id}, nickname=${result.agent.nickname || "-"}).`,
+    `openclaw-clawchat login succeeded (user_id=${normalizedResult.agent.user_id}, owner_user_id=${normalizedResult.agent.owner_id}, nickname=${normalizedResult.agent.nickname || "-"}).`,
   );
 }
-
-/** Shortens a token for display logs without revealing the full secret. */
-function redactToken(token: string): string {
-  if (!token) return "(empty)";
-  if (token.length <= 8) return "***";
-  return `${token.slice(0, 4)}…${token.slice(-4)}`;
-}