@openclaw/buzz 2026.9.1-beta.1 → 2026.9.2

package/dist/secret-contract-DNuqbK64.js

@@ -0,0 +1,50 @@
+import { a as resolveBuzzAccountConfig } from "./types-CeupBG0P.js";
+import { collectSecretInputAssignment, createChannelSecretTargetRegistryEntries, getChannelRecord, isRecord } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+//#region extensions/buzz/src/secret-contract.ts
+const fields = ["privateKey", "authTag"];
+const secretTargetRegistryEntries = createChannelSecretTargetRegistryEntries({
+	channelKey: "buzz",
+	account: fields,
+	channel: fields
+});
+function collectRuntimeConfigAssignments(params) {
+	const root = getChannelRecord(params.config, "buzz");
+	if (!root) return;
+	const collect = (accountId, account, rootIdentity = false) => {
+		const resolved = resolveBuzzAccountConfig({
+			cfg: params.config,
+			accountId
+		});
+		const active = resolved.config.enabled !== false && (!rootIdentity || resolved.allowEnv);
+		const configPath = rootIdentity ? "channels.buzz" : resolved.configPath;
+		for (const field of fields) collectSecretInputAssignment({
+			value: account[field],
+			path: `${configPath}.${field}`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active,
+			inactiveReason: "Buzz identity is disabled or replaced by accounts.default.",
+			owner: {
+				ownerKind: "account",
+				ownerId: `buzz:${accountId}`,
+				requiredForGateway: false,
+				disposition: "isolate",
+				contract: resolved.config
+			},
+			apply: (value) => {
+				account[field] = value;
+			}
+		});
+	};
+	collect("default", root, true);
+	if (isRecord(root.accounts)) {
+		for (const [accountId, account] of Object.entries(root.accounts).toSorted(([a], [b]) => a.localeCompare(b))) if (isRecord(account)) collect(accountId, account);
+	}
+}
+const channelSecrets = {
+	secretTargetRegistryEntries,
+	collectRuntimeConfigAssignments
+};
+//#endregion
+export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };

package/dist/secret-contract-api.js

@@ -1,2 +1,2 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-D19RiJv_.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-DNuqbK64.js";
 export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/setup-plugin-api.js

@@ -1,5 +1,5 @@
-import { i as resolveBuzzAccount, o as resolveDefaultBuzzAccountId, r as listBuzzAccountIds } from "./types-BN_HOsnq.js";
-import { a as BuzzConfigSchema, n as buzzSetupContract, t as buzzSetupWizard } from "./setup-surface-BvQgEJ7O.js";
+import { c as BuzzConfigSchema, i as resolveBuzzAccount, r as listBuzzAccountIds, s as resolveDefaultBuzzAccountId } from "./types-CeupBG0P.js";
+import { n as buzzSetupContract, t as buzzSetupWizard } from "./setup-surface-DDUmAluL.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 //#region extensions/buzz/src/channel.setup.ts
 const buzzSetupPlugin = {
@@ -18,7 +18,10 @@ const buzzSetupPlugin = {
 		chatTypes: ["group"],
 		threads: true
 	},
-	reload: { configPrefixes: ["channels.buzz"] },
+	reload: {
+		configPrefixes: ["channels.buzz"],
+		accountScopedRestart: true
+	},
 	configSchema: BuzzConfigSchema,
 	setupContract: buzzSetupContract,
 	setupWizard: buzzSetupWizard,

package/dist/{setup-surface-BvQgEJ7O.js → setup-surface-DDUmAluL.js}

@@ -1,36 +1,10 @@
-import { a as resolveBuzzPublicKey, f as parseBuzzTarget, i as resolveBuzzAccount, n as decodeBuzzPrivateKey, s as BUZZ_CHANNEL_ID_PATTERN } from "./types-BN_HOsnq.js";
-import { a as parseBuzzRoomMembershipEvent, c as parseBuzzAuthTag, l as openBuzzRelaySubscription, s as connectAuthenticatedBuzzRelaySession, t as BUZZ_ROOM_MEMBERSHIP_KIND, u as queryBuzzRelaySnapshot } from "./room-membership-DSAkyE0a.js";
-import { GroupPolicySchema, MarkdownConfigSchema, buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
-import { buildSecretInputSchema } from "openclaw/plugin-sdk/secret-input";
-import { z } from "zod";
+import { a as resolveBuzzAccountConfig, i as resolveBuzzAccount, l as BUZZ_CHANNEL_ID_PATTERN, m as parseBuzzTarget, n as decodeBuzzPrivateKey, o as resolveBuzzPublicKey, r as listBuzzAccountIds } from "./types-CeupBG0P.js";
+import { c as openBuzzRelaySubscription, i as parseBuzzRoomMembershipEvent, l as queryBuzzRelaySnapshot, o as connectAuthenticatedBuzzRelaySession, s as parseBuzzAuthTag, t as BUZZ_ROOM_MEMBERSHIP_KIND, u as isNewerBuzzRevision } from "./room-membership-a8IHfdgL.js";
 import { generateSecretKey, nip19 } from "nostr-tools";
 import { sleep } from "openclaw/plugin-sdk/runtime-env";
 import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
-import { DEFAULT_ACCOUNT_ID, applyAccountNameToChannelSection, hasConfiguredSecretInput as hasConfiguredSecretInput$1, patchTopLevelChannelConfigSection, runSingleChannelSecretStep } from "openclaw/plugin-sdk/setup";
-import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1 } from "openclaw/plugin-sdk/setup-runtime";
+import { patchScopedAccountConfig, patchTopLevelChannelConfigSection, promptAccountId, runSingleChannelSecretStep } from "openclaw/plugin-sdk/setup";
 import { isIP } from "node:net";
-//#region extensions/buzz/src/config-schema.ts
-const BuzzGroupConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	requireMention: z.boolean().optional(),
-	groupPolicy: GroupPolicySchema.optional(),
-	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional()
-}).strict();
-const BuzzConfigSchema = buildChannelConfigSchema(z.object({
-	name: z.string().optional(),
-	enabled: z.boolean().optional(),
-	configWrites: z.boolean().optional(),
-	responsePrefix: z.string().optional(),
-	markdown: MarkdownConfigSchema,
-	relayUrl: z.string().url().and(z.string().regex(/^[wW][sS][sS]?:\/\//, "Buzz relay URL must use ws:// or wss://")).optional(),
-	privateKey: buildSecretInputSchema().optional(),
-	authTag: buildSecretInputSchema().optional(),
-	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
-	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
-	groups: z.record(z.string().regex(BUZZ_CHANNEL_ID_PATTERN, "Buzz group key must be a channel UUID"), BuzzGroupConfigSchema).optional(),
-	defaultTo: z.string().optional()
-}).strict());
-//#endregion
 //#region extensions/buzz/src/room-membership-notification.ts
 const BUZZ_MEMBER_ADDED_NOTIFICATION_KIND = 44100;
 const BUZZ_MEMBER_REMOVED_NOTIFICATION_KIND = 44101;
@@ -126,7 +100,13 @@ async function discoverBuzzRoomsOnRelay(params) {
 	for (const event of metadataEvents) {
 		const roomId = tagValue(event, "d")?.toLowerCase();
 		const current = roomId ? latestMetadata.get(roomId) : void 0;
-		if (event.kind !== METADATA_KIND || event.pubkey.toLowerCase() !== params.relayPublicKey || !roomId || !roomIds.includes(roomId) || current && (current.created_at > event.created_at || current.created_at === event.created_at && current.id <= event.id)) continue;
+		if (event.kind !== METADATA_KIND || event.pubkey.toLowerCase() !== params.relayPublicKey || !roomId || !roomIds.includes(roomId) || !isNewerBuzzRevision({
+			createdAt: event.created_at,
+			eventId: event.id
+		}, current ? {
+			createdAt: current.created_at,
+			eventId: current.id
+		} : void 0)) continue;
 		latestMetadata.set(roomId, event);
 	}
 	return roomIds.flatMap((id) => {
@@ -176,10 +156,25 @@ function validRelayUrl(value) {
 		return false;
 	}
 }
-function resolveComparableCurrentKey(cfg) {
-	const configured = cfg.channels?.buzz?.privateKey;
+function patchBuzzAccountConfig(params) {
+	const { accountId, allowEnv } = resolveBuzzAccountConfig(params);
+	return patchScopedAccountConfig({
+		...params,
+		accountId,
+		channelKey: "buzz",
+		scopeDefaultToAccounts: !allowEnv,
+		ensureChannelEnabled: false,
+		ensureAccountEnabled: false
+	});
+}
+function resolveComparableCurrentKey(cfg, accountId) {
+	const { config, allowEnv } = resolveBuzzAccountConfig({
+		cfg,
+		accountId
+	});
+	const configured = config.privateKey;
 	if (configured !== void 0) return typeof configured === "string" ? configured.trim() || void 0 : void 0;
-	return process.env.BUZZ_PRIVATE_KEY?.trim() || void 0;
+	return allowEnv ? process.env.BUZZ_PRIVATE_KEY?.trim() || void 0 : void 0;
 }
 function isSameBuzzIdentity(currentKey, nextKey) {
 	if (!currentKey || !nextKey) return false;
@@ -216,16 +211,22 @@ const buzzSetupContract = defineChannelSetupContract({
 		}
 	},
 	adapter: {
-		applyAccountName: ({ cfg, accountId, name }) => applyAccountNameToChannelSection({
+		configPromotion: "preserve-root",
+		resolveAccountId: ({ cfg, accountId }) => resolveBuzzAccountConfig({
+			cfg,
+			accountId
+		}).accountId,
+		applyAccountName: ({ cfg, accountId, name }) => name?.trim() ? patchBuzzAccountConfig({
 			cfg,
-			channelKey: "buzz",
 			accountId,
-			name
-		}),
-		validateInput: ({ accountId, input }) => {
-			if (accountId !== DEFAULT_ACCOUNT_ID$1) return "Buzz currently supports only the default account.";
+			patch: { name: name.trim() }
+		}) : cfg,
+		validateInput: ({ cfg, accountId, input }) => {
 			if (!validRelayUrl(input.relayUrl)) return "Buzz requires --relay-url with a ws:// or wss:// URL.";
-			if (input.useEnv) return null;
+			if (input.useEnv) return resolveBuzzAccountConfig({
+				cfg,
+				accountId
+			}).allowEnv ? null : "Buzz --use-env is only supported for the root default identity; use an explicit private key or SecretRef for this account.";
 			const privateKey = input.privateKey?.trim();
 			if (!privateKey) return "Buzz requires --private-key or --use-env.";
 			try {
@@ -235,22 +236,18 @@ const buzzSetupContract = defineChannelSetupContract({
 			}
 			return null;
 		},
-		applyAccountConfig: ({ cfg, input }) => {
-			const keepAuthTag = isSameBuzzIdentity(resolveComparableCurrentKey(cfg), input.useEnv ? process.env.BUZZ_PRIVATE_KEY?.trim() : input.privateKey?.trim());
-			const { privateKey: _privateKey, authTag, ...existing } = cfg.channels?.buzz ?? {};
-			return {
-				...cfg,
-				channels: {
-					...cfg.channels,
-					buzz: {
-						...existing,
-						enabled: true,
-						relayUrl: input.relayUrl?.trim(),
-						...keepAuthTag && authTag !== void 0 ? { authTag } : {},
-						...input.useEnv ? {} : { privateKey: input.privateKey?.trim() }
-					}
+		applyAccountConfig: ({ cfg, accountId, input }) => {
+			return patchBuzzAccountConfig({
+				cfg,
+				accountId,
+				clearFields: ["privateKey", ...isSameBuzzIdentity(resolveComparableCurrentKey(cfg, accountId), input.useEnv ? process.env.BUZZ_PRIVATE_KEY?.trim() : input.privateKey?.trim()) ? [] : ["authTag"]],
+				patch: {
+					enabled: true,
+					...input.name?.trim() ? { name: input.name.trim() } : {},
+					relayUrl: input.relayUrl?.trim(),
+					...input.useEnv ? {} : { privateKey: input.privateKey?.trim() }
 				}
-			};
+			});
 		}
 	}
 });
@@ -454,13 +451,6 @@ async function verifyBuzzAfterSetup(params) {
 //#endregion
 //#region extensions/buzz/src/setup-surface.ts
 const channel = "buzz";
-function patchBuzzConfig(cfg, patch) {
-	return patchTopLevelChannelConfigSection({
-		cfg,
-		channel,
-		patch
-	});
-}
 function validateRelayUrl(value) {
 	try {
 		const url = new URL(value.trim());
@@ -476,10 +466,6 @@ function isRemoteInsecureRelayUrl(value) {
 	const isLoopback = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || isIpv4Loopback;
 	return url.protocol === "ws:" && !isLoopback;
 }
-function isBuzzSetupConfigured(cfg) {
-	const buzzConfig = cfg.channels?.buzz;
-	return Boolean((buzzConfig?.relayUrl?.trim() || process.env.BUZZ_RELAY_URL?.trim()) && (hasConfiguredSecretInput$1(buzzConfig?.privateKey, cfg.secrets?.defaults) || process.env.BUZZ_PRIVATE_KEY?.trim()));
-}
 async function promptRelayUrl(params) {
 	while (true) {
 		const relayUrl = (await params.prompter.text({
@@ -509,35 +495,53 @@ async function resolveRelayUrl(params) {
 		prompter: params.prompter
 	});
 }
-function resolvedConfiguredKey(cfg) {
-	const value = cfg.channels?.buzz?.privateKey;
-	return typeof value === "string" && value.trim() ? value.trim() : void 0;
-}
-function resolvedCurrentKey(cfg) {
-	return cfg.channels?.buzz?.privateKey === void 0 ? process.env.BUZZ_PRIVATE_KEY?.trim() || void 0 : resolvedConfiguredKey(cfg);
+async function resolveSetupCredential(params) {
+	const { config, configPath, allowEnv } = resolveBuzzAccountConfig(params);
+	const { resolveConfiguredSecretInputWithFallback } = await import("openclaw/plugin-sdk/secret-input-runtime");
+	const resolved = await resolveConfiguredSecretInputWithFallback({
+		config: params.cfg,
+		env: process.env,
+		value: config[params.field],
+		path: `${configPath}.${params.field}`,
+		unresolvedReasonStyle: "detailed",
+		readFallback: allowEnv ? () => params.field === "privateKey" ? process.env.BUZZ_PRIVATE_KEY : process.env.BUZZ_AUTH_TAG : void 0
+	});
+	if (resolved.unresolvedRefReason) throw new Error(`${resolved.unresolvedRefReason} Make the secret available and rerun Buzz setup.`);
+	return resolved.value;
 }
 async function resolvePrivateKey(params) {
-	const hasExistingIdentity = hasConfiguredSecretInput$1(params.cfg.channels?.buzz?.privateKey, params.cfg.secrets?.defaults) || Boolean(process.env.BUZZ_PRIVATE_KEY?.trim());
-	const currentPrivateKey = resolvedCurrentKey(params.cfg);
-	if (hasExistingIdentity) {
-		const resolvedPrivateKey = currentPrivateKey;
-		if (resolvedPrivateKey) decodeBuzzPrivateKey(resolvedPrivateKey);
+	const { allowEnv } = resolveBuzzAccountConfig(params);
+	const currentPrivateKey = await resolveSetupCredential({
+		...params,
+		field: "privateKey"
+	});
+	if (currentPrivateKey) {
+		decodeBuzzPrivateKey(currentPrivateKey);
 		return {
 			cfg: params.cfg,
-			resolvedPrivateKey
+			resolvedPrivateKey: currentPrivateKey
 		};
 	}
 	if (params.secretInputMode !== "ref") {
-		let privateKey = params.generatedPrivateKeys.get(params.prompter);
+		let accountKeys = params.generatedPrivateKeys.get(params.prompter);
+		if (!accountKeys) {
+			accountKeys = /* @__PURE__ */ new Map();
+			params.generatedPrivateKeys.set(params.prompter, accountKeys);
+		}
+		let privateKey = accountKeys.get(params.accountId);
 		if (!privateKey) {
 			privateKey = nip19.nsecEncode(params.generate());
-			params.generatedPrivateKeys.set(params.prompter, privateKey);
+			accountKeys.set(params.accountId, privateKey);
 		}
 		return {
-			cfg: patchBuzzConfig(params.cfg, {
-				enabled: true,
-				privateKey,
-				authTag: void 0
+			cfg: patchBuzzAccountConfig({
+				cfg: params.cfg,
+				accountId: params.accountId,
+				patch: {
+					enabled: true,
+					privateKey
+				},
+				clearFields: ["authTag"]
 			}),
 			resolvedPrivateKey: privateKey
 		};
@@ -550,36 +554,31 @@ async function resolvePrivateKey(params) {
 		secretInputMode: params.secretInputMode,
 		accountConfigured: false,
 		hasConfigToken: false,
-		allowEnv: true,
-		envValue: process.env.BUZZ_PRIVATE_KEY,
+		allowEnv,
+		envValue: allowEnv ? process.env.BUZZ_PRIVATE_KEY : void 0,
 		envPrompt: "Use BUZZ_PRIVATE_KEY?",
 		keepPrompt: "Keep the existing Buzz bot private key?",
 		inputPrompt: "Buzz bot private key (nsec or 64-character hex)",
-		preferredEnvVar: "BUZZ_PRIVATE_KEY",
-		applyUseEnv: (cfg) => {
-			const envPrivateKey = process.env.BUZZ_PRIVATE_KEY?.trim();
-			const keepAuthTag = isSameBuzzIdentity(currentPrivateKey, envPrivateKey);
-			const { privateKey: _privateKey, authTag, ...buzz } = cfg.channels?.buzz ?? {};
-			return {
-				...cfg,
-				channels: {
-					...cfg.channels,
-					buzz: {
-						...buzz,
-						enabled: true,
-						...keepAuthTag && authTag !== void 0 ? { authTag } : {}
-					}
-				}
-			};
-		},
-		applySet: (cfg, value, resolvedValue) => patchBuzzConfig(cfg, {
-			enabled: true,
-			privateKey: value,
-			...isSameBuzzIdentity(currentPrivateKey, resolvedValue) ? {} : { authTag: void 0 }
+		...allowEnv ? { preferredEnvVar: "BUZZ_PRIVATE_KEY" } : {},
+		applyUseEnv: (cfg) => patchBuzzAccountConfig({
+			cfg,
+			accountId: params.accountId,
+			patch: { enabled: true },
+			clearFields: ["privateKey", "authTag"]
+		}),
+		applySet: (cfg, value) => patchBuzzAccountConfig({
+			cfg,
+			accountId: params.accountId,
+			patch: {
+				enabled: true,
+				privateKey: value
+			},
+			clearFields: ["authTag"]
 		})
 	});
-	const resolvedPrivateKey = secretStep.resolvedValue ?? (secretStep.action === "keep" ? resolvedConfiguredKey(secretStep.cfg) ?? currentPrivateKey : void 0);
-	if (resolvedPrivateKey) decodeBuzzPrivateKey(resolvedPrivateKey);
+	const resolvedPrivateKey = secretStep.resolvedValue;
+	if (!resolvedPrivateKey) throw new Error("Buzz bot private key could not be resolved. Make the secret available and rerun setup.");
+	decodeBuzzPrivateKey(resolvedPrivateKey);
 	return {
 		cfg: secretStep.cfg,
 		resolvedPrivateKey
@@ -589,37 +588,34 @@ async function promptRooms(params) {
 	if (params.rooms.length === 1) return [params.rooms[0].id];
 	const configuredRooms = new Set(params.configuredRoomIds);
 	const preservedRoomIds = params.rooms.map((room) => room.id).filter((roomId) => configuredRooms.has(roomId));
-	return await params.prompter.multiselect({
-		message: "Select authorized Buzz rooms",
-		options: params.rooms.map((room) => ({
-			value: room.id,
-			label: room.name,
-			hint: room.about ?? room.id
-		})),
-		initialValues: preservedRoomIds.length > 0 ? preservedRoomIds : params.rooms.map((room) => room.id)
-	});
-}
-function pauseBuzzSetup(cfg) {
-	return {
-		cfg: patchBuzzConfig(cfg, { enabled: false }),
-		completion: "paused"
-	};
+	while (true) {
+		const roomIds = await params.prompter.multiselect({
+			message: "Select authorized Buzz rooms",
+			options: params.rooms.map((room) => ({
+				value: room.id,
+				label: room.name,
+				hint: room.about ?? room.id
+			})),
+			initialValues: preservedRoomIds.length > 0 ? preservedRoomIds : params.rooms.map((room) => room.id)
+		});
+		if (roomIds.length > 0) return roomIds;
+		await params.prompter.note("Select at least one authorized room, or go back to leave setup.", "Buzz room selection required");
+	}
 }
 async function noteBuzzAccessInstructions(params) {
-	const npub = params.publicKey ? nip19.npubEncode(params.publicKey) : "<BOT_PUBLIC_KEY>";
-	const hex = params.publicKey ?? "<64_CHAR_BOT_PUBLIC_KEY>";
+	const npub = nip19.npubEncode(params.publicKey);
 	await params.prompter.note([
 		...params.discoveryError ? [`Status: ${params.discoveryError}`, ""] : [],
 		`Relay: ${params.relayUrl}`,
 		`Bot npub: ${npub}`,
-		`Bot hex public key: ${hex}`,
+		`Bot hex public key: ${params.publicKey}`,
 		"",
 		"Run as the existing human room owner/admin:",
-		`buzz channels add-member --channel <ROOM_UUID> --pubkey ${hex} --role bot`,
+		`buzz channels add-member --channel <ROOM_UUID> --pubkey ${params.publicKey} --role bot`,
 		"",
 		"OpenClaw is waiting for Buzz to confirm the Bot role automatically.",
 		"Local `just dev` needs no separate community-member step.",
-		`Closed relay only: first run buzz-admin add-member --pubkey ${hex} --role member.`,
+		`Closed relay only: first run buzz-admin add-member --pubkey ${params.publicKey} --role member.`,
 		"Never paste that human private key into OpenClaw."
 	].join("\n"), "Buzz room access required");
 }
@@ -632,10 +628,11 @@ function createBuzzSetupWizard(dependencies = {}) {
 	const generatedPrivateKeys = /* @__PURE__ */ new WeakMap();
 	return {
 		channel,
-		getStatus: async ({ cfg }) => {
-			const buzzConfig = cfg.channels?.buzz;
-			const configured = isBuzzSetupConfigured(cfg);
-			const enabled = buzzConfig?.enabled !== false;
+		getStatus: async ({ cfg, accountOverrides }) => {
+			const { configured, enabled } = resolveBuzzAccount({
+				cfg,
+				accountId: accountOverrides.buzz
+			});
 			const status = !configured ? "needs relay URL and bot identity" : enabled ? "configured" : "configured but disabled";
 			return {
 				channel,
@@ -644,20 +641,47 @@ function createBuzzSetupWizard(dependencies = {}) {
 				selectionHint: status
 			};
 		},
-		configure: async ({ cfg, prompter, options }) => {
-			const existingBuzzConfig = cfg.channels?.buzz;
-			const hasExistingAccessConfig = existingBuzzConfig?.groupPolicy !== void 0 || existingBuzzConfig?.groupAllowFrom !== void 0 || existingBuzzConfig?.groups !== void 0;
-			const useFreshAccessDefaults = !isBuzzSetupConfigured(cfg) && !hasExistingAccessConfig;
+		configure: async ({ cfg, prompter, options, accountOverrides, shouldPromptAccountIds }) => {
+			let accountId = resolveBuzzAccountConfig({
+				cfg,
+				accountId: accountOverrides.buzz
+			}).accountId;
+			if (shouldPromptAccountIds && !accountOverrides.buzz?.trim()) accountId = await promptAccountId({
+				cfg,
+				prompter,
+				label: "Buzz",
+				currentId: accountId,
+				listAccountIds: listBuzzAccountIds,
+				defaultAccountId: accountId
+			});
+			const { config: existingBuzzConfig } = resolveBuzzAccountConfig({
+				cfg,
+				accountId
+			});
+			const rootPolicy = cfg.channels?.buzz;
+			const rawAccount = rootPolicy?.accounts?.[accountId];
+			const hasExistingAccessConfig = rootPolicy?.groupPolicy !== void 0 || rootPolicy?.groupAllowFrom !== void 0 || rawAccount?.groupPolicy !== void 0 || rawAccount?.groupAllowFrom !== void 0 || existingBuzzConfig.groups !== void 0;
+			const existingAccount = resolveBuzzAccount({
+				cfg,
+				accountId
+			});
+			const useFreshAccessDefaults = !existingAccount.configured && !hasExistingAccessConfig;
+			const configuredRelayUrl = existingAccount.relayUrl;
 			const relayUrl = await resolveRelayUrl({
-				configuredValue: existingBuzzConfig?.relayUrl?.trim() || process.env.BUZZ_RELAY_URL?.trim(),
+				configuredValue: configuredRelayUrl,
 				prompter
 			});
-			let next = patchBuzzConfig(cfg, {
-				enabled: true,
-				relayUrl
+			let next = patchBuzzAccountConfig({
+				cfg,
+				accountId,
+				patch: {
+					enabled: true,
+					relayUrl
+				}
 			});
 			const identity = await resolvePrivateKey({
 				cfg: next,
+				accountId,
 				prompter,
 				secretInputMode: options?.secretInputMode,
 				generate,
@@ -666,15 +690,14 @@ function createBuzzSetupWizard(dependencies = {}) {
 			});
 			next = identity.cfg;
 			const privateKey = identity.resolvedPrivateKey;
-			let publicKey;
-			if (privateKey) publicKey = resolveBuzzPublicKey(privateKey);
-			if (!privateKey) {
-				await prompter.note("OpenClaw cannot resolve the configured private-key reference during setup, so room access cannot be verified. The relay URL and identity reference will be saved with Buzz disabled. Make the secret available and rerun setup.", "Buzz setup paused");
-				return pauseBuzzSetup(next);
-			}
+			const publicKey = resolveBuzzPublicKey(privateKey);
 			let discoveredRooms = [];
 			let discoveryError;
-			const authTag = resolveBuzzAccount({ cfg: next }).authTag;
+			const authTag = await resolveSetupCredential({
+				cfg: next,
+				accountId,
+				field: "authTag"
+			});
 			const discoverAuthorizedRooms = async () => {
 				try {
 					const rooms = await discoverRooms({
@@ -725,17 +748,13 @@ function createBuzzSetupWizard(dependencies = {}) {
 				progress.stop(discoveredRooms.length > 0 ? "Buzz room access confirmed" : "Buzz room access not found");
 				if (discoveredRooms.length === 0 && discoveryError) await prompter.note(discoveryError, "Buzz room access not ready");
 			}
-			const configuredGroups = cfg.channels?.buzz?.groups ?? {};
+			const configuredGroups = existingBuzzConfig.groups ?? {};
 			const roomIds = await promptRooms({
 				rooms: discoveredRooms,
 				configuredRoomIds: Object.keys(configuredGroups),
 				prompter
 			});
-			if (roomIds.length === 0) {
-				await prompter.note("No rooms were selected. Relay URL and bot identity will be saved with Buzz disabled.", "Buzz setup paused");
-				return pauseBuzzSetup(next);
-			}
-			const existingDefault = cfg.channels?.buzz?.defaultTo;
+			const existingDefault = existingBuzzConfig.defaultTo;
 			const defaultTo = roomIds.length === 1 ? roomIds[0] : await prompter.select({
 				message: "Choose the default Buzz room target",
 				options: roomIds.map((roomId) => {
@@ -747,35 +766,43 @@ function createBuzzSetupWizard(dependencies = {}) {
 				}),
 				initialValue: existingDefault && roomIds.includes(existingDefault) ? existingDefault : roomIds[0]
 			});
-			next = patchBuzzConfig(next, {
-				...useFreshAccessDefaults ? {
-					groupPolicy: "open",
-					groupAllowFrom: void 0
-				} : {},
-				groups: Object.fromEntries(roomIds.map((roomId) => [roomId, {
-					...configuredGroups[roomId],
-					enabled: configuredGroups[roomId]?.enabled ?? true,
-					requireMention: configuredGroups[roomId]?.requireMention ?? !useFreshAccessDefaults
-				}])),
-				defaultTo
+			next = patchBuzzAccountConfig({
+				cfg: next,
+				accountId,
+				patch: {
+					...useFreshAccessDefaults ? {
+						groupPolicy: "open",
+						groupAllowFrom: void 0
+					} : {},
+					groups: Object.fromEntries(roomIds.map((roomId) => [roomId, {
+						...configuredGroups[roomId],
+						enabled: configuredGroups[roomId]?.enabled ?? true,
+						requireMention: configuredGroups[roomId]?.requireMention ?? !useFreshAccessDefaults
+					}])),
+					defaultTo
+				}
 			});
 			options?.onPostWriteHook?.({
 				channel,
-				accountId: DEFAULT_ACCOUNT_ID,
+				accountId,
 				run: async ({ runtime }) => await verifyAfterWrite({
-					accountId: DEFAULT_ACCOUNT_ID,
+					accountId,
 					target: defaultTo,
 					runtime
 				})
 			});
 			return {
 				cfg: next,
-				accountId: DEFAULT_ACCOUNT_ID
+				accountId
 			};
 		},
-		disable: (cfg) => patchBuzzConfig(cfg, { enabled: false })
+		disable: (cfg) => patchTopLevelChannelConfigSection({
+			cfg,
+			channel,
+			patch: { enabled: false }
+		})
 	};
 }
 const buzzSetupWizard = createBuzzSetupWizard();
 //#endregion
-export { BuzzConfigSchema as a, startBuzzRoomMembershipNotifications as i, buzzSetupContract as n, discoverBuzzRooms as r, buzzSetupWizard as t };
+export { startBuzzRoomMembershipNotifications as i, buzzSetupContract as n, discoverBuzzRooms as r, buzzSetupWizard as t };