@workclaw/openclaw-workchat 1.0.0 → 1.0.4

package/src/auth/bind-agent.ts

@@ -1,70 +1,52 @@
-import { logger } from "../util/logger.js";
-
-/**
- * Persist the (userId, agentId) -> account binding into
- * channels.openclaw-workchat.accounts of openclaw.json so inbound
- * AGENT_MESSAGE frames route to the right account and outbound sends find
- * the agent.
- *
- * Weixin-style model: no dedicated sub-agent, no explicit binding — the
- * account routes to the main agent via the channel's default binding the
- * desktop configSync maintains (and the gateway's default-agent fallback).
- * Credentials are never written here; they arrive via
- * WORKCHAT_API_KEY / WORKCHAT_APP_SECRET env injection.
- *
- * Shared by the binding listener (login-qr wait path) and the monitor's
- * INIT_AGENT / AGENT_CREATED handling (process-message).
- */
-export async function bindAgentToAccount(
-  accountId: string,
-  agentId: string,
-  userId?: string,
-): Promise<void> {
-  const { loadConfig, writeConfigFile } = await import("openclaw/plugin-sdk/config-runtime");
-  const raw = loadConfig() as Record<string, any>;
-  const channels = (raw.channels ?? {}) as Record<string, any>;
-  const section = (channels["openclaw-workchat"] ?? {}) as Record<string, any>;
-  const accounts = { ...(section.accounts ?? {}) };
-
-  accounts[accountId] = {
-    ...(accounts[accountId] ?? {}),
-    enabled: true,
-    agentId,
-    ...(userId ? { userId } : {}),
-  };
-
-  const updated = {
-    ...raw,
-    channels: {
-      ...channels,
-      "openclaw-workchat": {
-        ...section,
-        accounts,
-        ...(userId && !section.userId ? { userId } : {}),
-        channelConfigUpdatedAt: new Date().toISOString(),
-      },
-    },
-  } as Record<string, any>;
-
-  await writeConfigFile(updated as import("openclaw/plugin-sdk").OpenClawConfig);
-
-  // Persist the binding user in the framework allowFrom store so command
-  // authorization has an explicit source of truth (the inbound path also
-  // falls back to the account's userId, but writing it keeps parity with the
-  // zhixiaotu reference plugin).
-  if (userId) {
-    try {
-      const { registerUserInFrameworkStore } = await import("./pairing.js");
-      await registerUserInFrameworkStore({ accountId, userId });
-    } catch (err) {
-      logger.warn(`bindAgentToAccount: allowFrom registration failed: ${String(err)}`);
-    }
-  }
-
-  logger.info(
-    `bindAgentToAccount: accountId=${accountId} agentId=${agentId} userId=${userId || "(none)"} (apiKey NOT written — env-injected)`,
-  );
-}
-
-/** Alias used by the binding listener path. */
-export const bindAgentToAccountFromBinding = bindAgentToAccount;
+import { logger } from "../util/logger.js";
+
+/**
+ * Complete the binding on the plugin side.
+ *
+ * The account payload (agentId/userId) lives exclusively in the plugin's
+ * private state dir (`state/openclaw-workchat/accounts/`) — weixin-style. The
+ * caller (binding listener / monitor INIT_AGENT handling) persists it via
+ * saveWorkChatAccount + registerWorkChatAccountId before calling this.
+ *
+ * This function only bumps `channelConfigUpdatedAt` in openclaw.json so the
+ * gateway reloads config from disk and restarts the channel with the fresh
+ * private-dir account data. Writing account entries into
+ * channels.openclaw-workchat.accounts here would race the desktop configSync
+ * (which rebuilds that field) and orphan the credentials/
+ * <account>-allowFrom.json files — the gateway's startup migration treats
+ * those as a fatal unresolved state.
+ */
+export async function bindAgentToAccount(
+  accountId: string,
+  agentId: string,
+  userId?: string,
+): Promise<void> {
+  // Persist the binding user in the framework allowFrom store so command
+  // authorization has an explicit source of truth (the inbound path also
+  // falls back to the account's userId, but writing it keeps parity with the
+  // zhixiaotu reference plugin).
+  if (userId) {
+    try {
+      const { registerUserInFrameworkStore } = await import("./pairing.js");
+      await registerUserInFrameworkStore({ accountId, userId });
+    } catch (err) {
+      logger.warn(`bindAgentToAccount: allowFrom registration failed: ${String(err)}`);
+    }
+  }
+
+  // Trigger the channel hot reload; account data itself stays in the private
+  // state dir (already persisted by the caller before this runs).
+  try {
+    const { triggerWorkChatChannelReload } = await import("./accounts.js");
+    await triggerWorkChatChannelReload();
+  } catch (err) {
+    logger.warn(`bindAgentToAccount: channel reload trigger failed: ${String(err)}`);
+  }
+
+  logger.info(
+    `bindAgentToAccount: accountId=${accountId} agentId=${agentId} userId=${userId || "(none)"} (private-dir only; apiKey NOT written — env-injected)`,
+  );
+}
+
+/** Alias used by the binding listener path. */
+export const bindAgentToAccountFromBinding = bindAgentToAccount;

package/src/auth/login-qr-terminal.ts

@@ -1,16 +1,16 @@
-/**
- * Terminal QR display for the CLI `openclaw channels login` flow.
- * Mirrors the weixin plugin's displayQRCode: render with qrcode-terminal when
- * available, always fall back to printing the raw link.
- */
-export async function displayQRCode(qrcodeUrl: string): Promise<void> {
-  try {
-    const qrterm = await import("qrcode-terminal");
-    qrterm.default.generate(qrcodeUrl, { small: true });
-    process.stdout.write(`若二维码未能显示或无法使用，你可以访问以下链接以继续：\n`);
-    process.stdout.write(`${qrcodeUrl}\n`);
-  } catch {
-    process.stdout.write(`若二维码未能显示或无法使用，你可以访问以下链接以继续：\n`);
-    process.stdout.write(`${qrcodeUrl}\n`);
-  }
-}
+/**
+ * Terminal QR display for the CLI `openclaw channels login` flow.
+ * Mirrors the weixin plugin's displayQRCode: render with qrcode-terminal when
+ * available, always fall back to printing the raw link.
+ */
+export async function displayQRCode(qrcodeUrl: string): Promise<void> {
+  try {
+    const qrterm = await import("qrcode-terminal");
+    qrterm.default.generate(qrcodeUrl, { small: true });
+    process.stdout.write(`若二维码未能显示或无法使用，你可以访问以下链接以继续：\n`);
+    process.stdout.write(`${qrcodeUrl}\n`);
+  } catch {
+    process.stdout.write(`若二维码未能显示或无法使用，你可以访问以下链接以继续：\n`);
+    process.stdout.write(`${qrcodeUrl}\n`);
+  }
+}