@workclaw/openclaw-workchat 1.0.3 → 1.0.5

package/index.js

@@ -279,7 +279,8 @@ __export(accounts_exports, {
   listIndexedWorkChatAccountIds: () => listIndexedWorkChatAccountIds,
   listWorkChatAccountIds: () => listWorkChatAccountIds,
   loadWorkChatAccount: () => loadWorkChatAccount,
-  pruneStaleWorkChatAccounts: () => pruneStaleWorkChatAccounts,
+  migrateLegacyDefaultWorkChatAccount: () => migrateLegacyDefaultWorkChatAccount,
+  pruneOtherWorkChatAccounts: () => pruneOtherWorkChatAccounts,
   registerWorkChatAccountId: () => registerWorkChatAccountId,
   removeWorkChatAccountBinding: () => removeWorkChatAccountBinding,
   resolveWorkChatAccount: () => resolveWorkChatAccount,
@@ -296,6 +297,9 @@ function resolveAccountIndexPath() {
   return path4.join(resolveWorkChatStateDir(), "accounts.json");
 }
 function listIndexedWorkChatAccountIds() {
+  return readAccountIndex();
+}
+function readAccountIndex() {
   const filePath = resolveAccountIndexPath();
   try {
     if (!fs3.existsSync(filePath)) return [];
@@ -306,19 +310,23 @@ function listIndexedWorkChatAccountIds() {
     return [];
   }
 }
-function registerWorkChatAccountId(accountId) {
-  const dir = resolveWorkChatStateDir();
-  fs3.mkdirSync(dir, { recursive: true });
-  const existing = listIndexedWorkChatAccountIds();
-  if (existing.includes(accountId)) return;
-  fs3.writeFileSync(resolveAccountIndexPath(), JSON.stringify([...existing, accountId], null, 2), "utf-8");
+async function updateAccountIndex(mutator) {
+  const run = indexUpdateChain.then(() => {
+    const filePath = resolveAccountIndexPath();
+    fs3.mkdirSync(path4.dirname(filePath), { recursive: true });
+    const updated = mutator(readAccountIndex());
+    fs3.writeFileSync(filePath, JSON.stringify(updated, null, 2), "utf-8");
+  });
+  indexUpdateChain = run.then(() => void 0, () => void 0);
+  await run;
 }
-function unregisterWorkChatAccountId(accountId) {
-  const existing = listIndexedWorkChatAccountIds();
-  const updated = existing.filter((id) => id !== accountId);
-  if (updated.length !== existing.length) {
-    fs3.writeFileSync(resolveAccountIndexPath(), JSON.stringify(updated, null, 2), "utf-8");
-  }
+async function registerWorkChatAccountId(accountId) {
+  await updateAccountIndex(
+    (ids) => ids.includes(accountId) ? ids : [...ids, accountId]
+  );
+}
+async function unregisterWorkChatAccountId(accountId) {
+  await updateAccountIndex((ids) => ids.filter((id) => id !== accountId));
 }
 function resolveAccountsDir() {
   return path4.join(resolveWorkChatStateDir(), "accounts");
@@ -355,14 +363,14 @@ function saveWorkChatAccount(accountId, update) {
   } catch {
   }
 }
-function clearWorkChatAccount(accountId) {
+async function clearWorkChatAccount(accountId) {
   const filePath = resolveAccountPath(accountId);
   try {
     if (fs3.existsSync(filePath)) fs3.unlinkSync(filePath);
   } catch (err) {
     logger.warn(`clearWorkChatAccount: failed to remove ${filePath}: ${String(err)}`);
   }
-  unregisterWorkChatAccountId(accountId);
+  await unregisterWorkChatAccountId(accountId);
 }
 async function removeWorkChatAccountBinding(accountId) {
   clearWorkChatAccount(accountId);
@@ -373,40 +381,62 @@ async function removeWorkChatAccountBinding(accountId) {
     logger.warn(`removeWorkChatAccountBinding: allowFrom cleanup failed: ${String(err)}`);
   }
   try {
-    const { loadConfig, writeConfigFile } = await import("openclaw/plugin-sdk/config-runtime");
-    const cfg = loadConfig();
-    const channels = cfg.channels ?? {};
-    const section = channels["openclaw-workchat"];
-    if (section?.accounts?.[accountId] !== void 0) {
-      const accounts = { ...section.accounts ?? {} };
-      delete accounts[accountId];
-      await writeConfigFile({
-        ...cfg,
-        channels: {
-          ...channels,
-          "openclaw-workchat": { ...section, accounts }
-        }
-      });
-    }
+    await triggerWorkChatChannelReload();
   } catch (err) {
-    logger.warn(`removeWorkChatAccountBinding: config cleanup failed: ${String(err)}`);
+    logger.warn(`removeWorkChatAccountBinding: channel reload trigger failed: ${String(err)}`);
   }
 }
-async function pruneStaleWorkChatAccounts(keepAgentId) {
+async function pruneOtherWorkChatAccounts(keepAccountId) {
+  const keep = keepAccountId.trim();
   const removed = [];
   for (const accountId of listIndexedWorkChatAccountIds()) {
-    const data = loadWorkChatAccount(accountId);
-    const storedAgentId = data?.agentId?.trim();
-    if (storedAgentId && storedAgentId !== keepAgentId) {
-      await removeWorkChatAccountBinding(accountId);
-      removed.push(accountId);
-      logger.info(
-        `pruneStaleWorkChatAccounts: removed account=${accountId} agent=${storedAgentId} (superseded by agent=${keepAgentId})`
-      );
-    }
+    if (accountId === keep) continue;
+    await removeWorkChatAccountBinding(accountId);
+    removed.push(accountId);
+    logger.info(
+      `pruneOtherWorkChatAccounts: removed account=${accountId} (superseded by ${keep})`
+    );
   }
   return removed;
 }
+async function migrateLegacyDefaultWorkChatAccount() {
+  const ids = listIndexedWorkChatAccountIds();
+  if (!ids.includes("default")) return false;
+  const data = loadWorkChatAccount("default");
+  const agentId = data?.agentId?.trim();
+  if (!agentId) return false;
+  const targetId = `agent-${agentId}`;
+  if (!ids.includes(targetId)) {
+    saveWorkChatAccount(targetId, { ...data });
+  }
+  try {
+    const { readFrameworkAllowFromList: readFrameworkAllowFromList2, registerUserInFrameworkStore: registerUserInFrameworkStore2 } = await Promise.resolve().then(() => (init_pairing(), pairing_exports));
+    for (const userId of readFrameworkAllowFromList2("default")) {
+      await registerUserInFrameworkStore2({ accountId: targetId, userId });
+    }
+  } catch (err) {
+    logger.warn(`migrateLegacyDefaultWorkChatAccount: allowFrom move failed: ${String(err)}`);
+  }
+  await updateAccountIndex((existing) => {
+    const next = existing.filter((id) => id !== "default" && id !== targetId);
+    next.push(targetId);
+    return next;
+  });
+  try {
+    fs3.rmSync(path4.join(resolveWorkChatStateDir(), "accounts", "default.json"), { force: true });
+  } catch {
+  }
+  try {
+    const { clearFrameworkAllowFromList: clearFrameworkAllowFromList2 } = await Promise.resolve().then(() => (init_pairing(), pairing_exports));
+    clearFrameworkAllowFromList2("default");
+  } catch (err) {
+    logger.warn(`migrateLegacyDefaultWorkChatAccount: allowFrom cleanup failed: ${String(err)}`);
+  }
+  logger.info(
+    `migrateLegacyDefaultWorkChatAccount: renamed default -> ${targetId} (agent=${agentId})`
+  );
+  return true;
+}
 function listWorkChatAccountIds(_cfg) {
   return listIndexedWorkChatAccountIds();
 }
@@ -456,12 +486,14 @@ async function triggerWorkChatChannelReload() {
     logger.warn(`triggerWorkChatChannelReload: failed to update config: ${String(err)}`);
   }
 }
+var indexUpdateChain;
 var init_accounts = __esm({
   "src/auth/accounts.ts"() {
     "use strict";
     init_types();
     init_state_dir();
     init_logger();
+    indexUpdateChain = Promise.resolve();
   }
 });
 
@@ -26883,30 +26915,6 @@ __export(bind_agent_exports, {
   bindAgentToAccountFromBinding: () => bindAgentToAccountFromBinding
 });
 async function bindAgentToAccount(accountId, agentId, userId) {
-  const { loadConfig, writeConfigFile } = await import("openclaw/plugin-sdk/config-runtime");
-  const raw = loadConfig();
-  const channels = raw.channels ?? {};
-  const section = channels["openclaw-workchat"] ?? {};
-  const accounts = { ...section.accounts ?? {} };
-  accounts[accountId] = {
-    ...accounts[accountId] ?? {},
-    enabled: true,
-    agentId,
-    ...userId ? { userId } : {}
-  };
-  const updated = {
-    ...raw,
-    channels: {
-      ...channels,
-      "openclaw-workchat": {
-        ...section,
-        accounts,
-        ...userId && !section.userId ? { userId } : {},
-        channelConfigUpdatedAt: (/* @__PURE__ */ new Date()).toISOString()
-      }
-    }
-  };
-  await writeConfigFile(updated);
   if (userId) {
     try {
       const { registerUserInFrameworkStore: registerUserInFrameworkStore2 } = await Promise.resolve().then(() => (init_pairing(), pairing_exports));
@@ -26915,8 +26923,14 @@ async function bindAgentToAccount(accountId, agentId, userId) {
       logger.warn(`bindAgentToAccount: allowFrom registration failed: ${String(err)}`);
     }
   }
+  try {
+    const { triggerWorkChatChannelReload: triggerWorkChatChannelReload2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
+    await triggerWorkChatChannelReload2();
+  } catch (err) {
+    logger.warn(`bindAgentToAccount: channel reload trigger failed: ${String(err)}`);
+  }
   logger.info(
-    `bindAgentToAccount: accountId=${accountId} agentId=${agentId} userId=${userId || "(none)"} (apiKey NOT written \u2014 env-injected)`
+    `bindAgentToAccount: accountId=${accountId} agentId=${agentId} userId=${userId || "(none)"} (private-dir only; apiKey NOT written \u2014 env-injected)`
   );
 }
 var bindAgentToAccountFromBinding;
@@ -27159,28 +27173,27 @@ async function handleListenerFrame(sessionKey, data, ws) {
   if (result.type !== "init_agent") return;
   const eventData = result.eventData;
   if (!eventData) return;
-  const agentId = String(eventData.id ?? eventData.agentId ?? "");
+  const agentId = String(eventData.id ?? eventData.agentId ?? "").trim();
   if (!agentId) return;
-  const userId = String(eventData.futureId ?? eventData.userId ?? "");
+  const userId = String(eventData.futureId ?? eventData.userId ?? "").trim();
   const entry = bindingListeners.get(sessionKey);
   if (entry) entry.done = true;
-  const isRebind = listIndexedWorkChatAccountIds().length > 0;
+  const accountId = `agent-${agentId}`;
   try {
-    const { pruneStaleWorkChatAccounts: pruneStaleWorkChatAccounts2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
-    const removed = await pruneStaleWorkChatAccounts2(agentId);
+    const { pruneOtherWorkChatAccounts: pruneOtherWorkChatAccounts2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
+    const removed = await pruneOtherWorkChatAccounts2(accountId);
     if (removed.length > 0) {
-      logger.info(`binding listener: pruned stale account(s): ${removed.join(", ")}`);
+      logger.info(`binding listener: pruned previous account(s): ${removed.join(", ")}`);
     }
   } catch (err) {
     logger.error(`binding listener: rebind cleanup failed: ${String(err)}`);
   }
-  const accountId = isRebind ? `agent-${agentId}` : "default";
   try {
     saveWorkChatAccount(accountId, {
       agentId,
       ...userId ? { userId } : {}
     });
-    registerWorkChatAccountId(accountId);
+    await registerWorkChatAccountId(accountId);
     const { bindAgentToAccountFromBinding: bindAgentToAccountFromBinding2 } = await Promise.resolve().then(() => (init_bind_agent(), bind_agent_exports));
     await bindAgentToAccountFromBinding2(accountId, agentId, userId);
     logger.info(`binding listener: account=${accountId} agent=${agentId} persisted`);
@@ -27875,31 +27888,30 @@ function emitWorkChatMessageSent2(params) {
 async function handleAgentLifecycleEvent(frameType, result, deps) {
   const eventData = result.eventData;
   if (!eventData) return;
-  const agentId = String(eventData.id ?? eventData.agentId ?? "");
+  const agentId = String(eventData.id ?? eventData.agentId ?? "").trim();
   if (!agentId) {
     logger.warn(`${frameType}: missing agent id, ignoring`);
     return;
   }
-  const userId = String(eventData.futureId ?? eventData.userId ?? "");
+  const userId = String(eventData.futureId ?? eventData.userId ?? "").trim();
   logger.info(`${frameType}: agentId=${agentId} userId=${userId ? "present" : "missing"}`);
   deps.log(`${frameType}: agentId=${agentId}`);
-  const isRebind = listWorkChatAccountIdsCount() > 0;
+  const { completeWorkChatBinding: completeWorkChatBinding2 } = await Promise.resolve().then(() => (init_login_qr(), login_qr_exports));
+  const accountId = frameType === "init_agent" ? `agent-${agentId}` : deps.accountId;
   try {
-    const removed = await pruneStaleWorkChatAccounts(agentId);
+    const removed = await pruneOtherWorkChatAccounts(accountId);
     if (removed.length > 0) {
-      deps.log(`rebind: removed stale account(s): ${removed.join(", ")}`);
+      deps.log(`rebind: removed previous account(s): ${removed.join(", ")}`);
     }
   } catch (err) {
     logger.error(`rebind cleanup failed: ${String(err)}`);
   }
-  const { completeWorkChatBinding: completeWorkChatBinding2 } = await Promise.resolve().then(() => (init_login_qr(), login_qr_exports));
-  const accountId = frameType === "init_agent" ? isRebind ? `agent-${agentId}` : "default" : deps.accountId;
   try {
     saveWorkChatAccount(accountId, {
       agentId,
       ...userId ? { userId } : {}
     });
-    registerWorkChatAccountId(accountId);
+    await registerWorkChatAccountId(accountId);
     const { bindAgentToAccount: bindAgentToAccount2 } = await Promise.resolve().then(() => (init_bind_agent(), bind_agent_exports));
     await bindAgentToAccount2(accountId, agentId, userId);
     logger.info(`${frameType}: bound agent to account accountId=${accountId}`);
@@ -27921,9 +27933,6 @@ async function handleAgentLifecycleEvent(frameType, result, deps) {
     void notifyAgentCreatedStatus(deps.apiOpts, agentId);
   }
 }
-function listWorkChatAccountIdsCount() {
-  return listIndexedWorkChatAccountIds().length;
-}
 function loadCreateTypingCallbacks() {
   createTypingCallbacksPromise ??= (async () => {
     for (const specifier of ["openclaw/plugin-sdk/channel-runtime", "openclaw/plugin-sdk/channel-message"]) {
@@ -29561,6 +29570,7 @@ import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-sch
 
 // src/channel.ts
 init_accounts();
+init_types();
 init_login_qr();
 init_send();
 init_logger();
@@ -29737,11 +29747,13 @@ var workchatPlugin = {
     loginWithQrStart: async ({ accountId, force, verbose }) => {
       const { loadConfig } = await import("openclaw/plugin-sdk/config-runtime");
       const cfg = loadConfig();
-      const account = resolveWorkChatAccount(cfg, accountId ?? "default");
+      const requestedAccountId = accountId?.trim() || listWorkChatAccountIds(cfg)[0];
+      const existing = requestedAccountId ? resolveWorkChatAccount(cfg, requestedAccountId) : void 0;
+      const section = cfg.channels?.["openclaw-workchat"];
       const result = await startWorkChatLoginWithQr({
-        baseUrl: account.baseUrl,
-        appKey: account.appKey,
-        appSecret: account.appSecret
+        baseUrl: existing?.baseUrl || section?.baseUrl || DEFAULT_BASE_URL,
+        appKey: existing?.appKey || section?.appKey?.trim() || void 0,
+        appSecret: existing?.appSecret || section?.appSecret?.trim() || void 0
       });
       return {
         qrDataUrl: result.qrcodeUrl,
@@ -29848,6 +29860,9 @@ function assertHostCompatibility(hostVersion) {
   );
 }
 
+// index.ts
+init_accounts();
+
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -49584,6 +49599,9 @@ var openclaw_workchat_default = {
   configSchema: buildChannelConfigSchema(WorkChatConfigSchema),
   register(api) {
     assertHostCompatibility(api.runtime?.version);
+    void migrateLegacyDefaultWorkChatAccount().catch((err) => {
+      console.error("[openclaw-workchat] legacy default account migration failed:", err);
+    });
     api.registerChannel({ plugin: workchatPlugin });
   }
 };

package/index.ts

@@ -3,6 +3,7 @@ import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-sch
 
 import { workchatPlugin } from "./src/channel.js";
 import { assertHostCompatibility } from "./src/compat.js";
+import { migrateLegacyDefaultWorkChatAccount } from "./src/auth/accounts.js";
 import { WorkChatConfigSchema } from "./src/config/config-schema.js";
 
 export default {
@@ -14,6 +15,12 @@ export default {
     // Fail-fast: reject incompatible host versions before any side-effects.
     assertHostCompatibility(api.runtime?.version);
 
+    // Rename legacy `default` accounts to the agent-scoped key before the
+    // channel starts enumerating accounts (one-way, idempotent).
+    void migrateLegacyDefaultWorkChatAccount().catch(err => {
+      console.error("[openclaw-workchat] legacy default account migration failed:", err);
+    });
+
     api.registerChannel({ plugin: workchatPlugin });
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workclaw/openclaw-workchat",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "type": "module",
   "description": "OpenClaw WorkChat channel plugin: QR binding + WebSocket messaging with the WorkChat open platform",
   "license": "MIT",

package/src/auth/accounts.ts

@@ -21,6 +21,10 @@ function resolveAccountIndexPath(): string {
 
 /** Returns all accountIds registered via binding QR. */
 export function listIndexedWorkChatAccountIds(): string[] {
+  return readAccountIndex();
+}
+
+function readAccountIndex(): string[] {
   const filePath = resolveAccountIndexPath();
   try {
     if (!fs.existsSync(filePath)) return [];
@@ -32,22 +36,43 @@ export function listIndexedWorkChatAccountIds(): string[] {
   }
 }
 
+/**
+ * Serialize index mutations inside the plugin process. All writers (binding
+ * registration, rebind pruning, legacy migration) run in this one process;
+ * the shared promise chain guarantees read-modify-write never interleaves.
+ */
+let indexUpdateChain: Promise<void> = Promise.resolve();
+
+/**
+ * Read-modify-write the account index. Mutations are serialized in-process
+ * (see indexUpdateChain); the framework file lock is not used because the
+ * index is only ever written by this plugin process, and the lock sidecar
+ * behaves inconsistently under test-runner module isolation.
+ */
+async function updateAccountIndex(
+  mutator: (ids: string[]) => string[],
+): Promise<void> {
+  const run = indexUpdateChain.then(() => {
+    const filePath = resolveAccountIndexPath();
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const updated = mutator(readAccountIndex());
+    fs.writeFileSync(filePath, JSON.stringify(updated, null, 2), "utf-8");
+  });
+  // Keep the chain alive even when a mutation fails.
+  indexUpdateChain = run.then(() => undefined, () => undefined);
+  await run;
+}
+
 /** Add accountId to the persistent index (no-op if already present). */
-export function registerWorkChatAccountId(accountId: string): void {
-  const dir = resolveWorkChatStateDir();
-  fs.mkdirSync(dir, { recursive: true });
-  const existing = listIndexedWorkChatAccountIds();
-  if (existing.includes(accountId)) return;
-  fs.writeFileSync(resolveAccountIndexPath(), JSON.stringify([...existing, accountId], null, 2), "utf-8");
+export async function registerWorkChatAccountId(accountId: string): Promise<void> {
+  await updateAccountIndex(ids =>
+    ids.includes(accountId) ? ids : [...ids, accountId],
+  );
 }
 
 /** Remove accountId from the persistent index. */
-export function unregisterWorkChatAccountId(accountId: string): void {
-  const existing = listIndexedWorkChatAccountIds();
-  const updated = existing.filter(id => id !== accountId);
-  if (updated.length !== existing.length) {
-    fs.writeFileSync(resolveAccountIndexPath(), JSON.stringify(updated, null, 2), "utf-8");
-  }
+export async function unregisterWorkChatAccountId(accountId: string): Promise<void> {
+  await updateAccountIndex(ids => ids.filter(id => id !== accountId));
 }
 
 // ---------------------------------------------------------------------------
@@ -115,14 +140,14 @@ export function saveWorkChatAccount(
 }
 
 /** Remove all files associated with an account. */
-export function clearWorkChatAccount(accountId: string): void {
+export async function clearWorkChatAccount(accountId: string): Promise<void> {
   const filePath = resolveAccountPath(accountId);
   try {
     if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
   } catch (err) {
     logger.warn(`clearWorkChatAccount: failed to remove ${filePath}: ${String(err)}`);
   }
-  unregisterWorkChatAccountId(accountId);
+  await unregisterWorkChatAccountId(accountId);
 }
 
 /**
@@ -141,45 +166,33 @@ export async function removeWorkChatAccountBinding(accountId: string): Promise<v
     logger.warn(`removeWorkChatAccountBinding: allowFrom cleanup failed: ${String(err)}`);
   }
 
+  // Account entries no longer live in openclaw.json (weixin-style private-dir
+  // ownership), so there is no shared config to clean up here — the channel
+  // reload bump below lets the gateway drop the removed account.
   try {
-    const { loadConfig, writeConfigFile } = await import("openclaw/plugin-sdk/config-runtime");
-    const cfg = loadConfig();
-    const channels = (cfg.channels ?? {}) as Record<string, any>;
-    const section = channels["openclaw-workchat"];
-    if (section?.accounts?.[accountId] !== undefined) {
-      const accounts = { ...(section.accounts ?? {}) };
-      delete accounts[accountId];
-      await writeConfigFile({
-        ...cfg,
-        channels: {
-          ...channels,
-          "openclaw-workchat": { ...section, accounts },
-        },
-      } as import("openclaw/plugin-sdk").OpenClawConfig);
-    }
+    await triggerWorkChatChannelReload();
   } catch (err) {
-    logger.warn(`removeWorkChatAccountBinding: config cleanup failed: ${String(err)}`);
+    logger.warn(`removeWorkChatAccountBinding: channel reload trigger failed: ${String(err)}`);
   }
 }
 
 /**
- * Remove every registered account whose stored agentId differs from
- * `keepAgentId` (rebind cleanup). Returns the removed accountIds.
- * `default` is normalized: if it holds a foreign agentId it is removed too;
- * the surviving binding keeps whatever account key it was registered under.
+ * Remove every registered account other than `keepAccountId` (rebind cleanup).
+ * One active agent per host: a completed binding owns the agent-scoped key
+ * `agent-${agentId}`, and every other account — a previous agent, or a legacy
+ * `default` registered by older plugin versions even for the SAME agent — is
+ * removed so a re-scan can never leave duplicate accounts behind.
  */
-export async function pruneStaleWorkChatAccounts(keepAgentId: string): Promise<string[]> {
+export async function pruneOtherWorkChatAccounts(keepAccountId: string): Promise<string[]> {
+  const keep = keepAccountId.trim();
   const removed: string[] = [];
   for (const accountId of listIndexedWorkChatAccountIds()) {
-    const data = loadWorkChatAccount(accountId);
-    const storedAgentId = data?.agentId?.trim();
-    if (storedAgentId && storedAgentId !== keepAgentId) {
-      await removeWorkChatAccountBinding(accountId);
-      removed.push(accountId);
-      logger.info(
-        `pruneStaleWorkChatAccounts: removed account=${accountId} agent=${storedAgentId} (superseded by agent=${keepAgentId})`,
-      );
-    }
+    if (accountId === keep) continue;
+    await removeWorkChatAccountBinding(accountId);
+    removed.push(accountId);
+    logger.info(
+      `pruneOtherWorkChatAccounts: removed account=${accountId} (superseded by ${keep})`,
+    );
   }
   return removed;
 }
@@ -222,6 +235,62 @@ type WorkChatSectionConfig = WorkChatAccountConfig & {
   channelConfigUpdatedAt?: string;
 };
 
+/**
+ * One-time migration for accounts registered by older plugin versions under
+ * the `default` key: rename them to the agent-scoped key `agent-${agentId}`.
+ * Moves the account data file and the framework allowFrom credentials so no
+ * orphaned files remain (the gateway startup migration treats orphaned
+ * allowFrom files as a fatal unresolved state). Idempotent — a no-op once no
+ * `default` account exists. Runs once at plugin registration (see index.ts),
+ * before any binding listener can start, so it cannot interleave with
+ * concurrent binding writes (register/unregister hold the index file lock).
+ */
+export async function migrateLegacyDefaultWorkChatAccount(): Promise<boolean> {
+  const ids = listIndexedWorkChatAccountIds();
+  if (!ids.includes("default")) return false;
+  const data = loadWorkChatAccount("default");
+  const agentId = data?.agentId?.trim();
+  if (!agentId) return false;
+  const targetId = `agent-${agentId}`;
+
+  // 1. Persist the agent-scoped copy (unless it already exists — the
+  //    agent-scoped file is the newer binding when both are present).
+  if (!ids.includes(targetId)) {
+    saveWorkChatAccount(targetId, { ...data });
+  }
+  // 2. Move the framework allowFrom credentials to the new key.
+  try {
+    const { readFrameworkAllowFromList, registerUserInFrameworkStore } = await import("./pairing.js");
+    for (const userId of readFrameworkAllowFromList("default")) {
+      await registerUserInFrameworkStore({ accountId: targetId, userId });
+    }
+  } catch (err) {
+    logger.warn(`migrateLegacyDefaultWorkChatAccount: allowFrom move failed: ${String(err)}`);
+  }
+  // 3. Register the new key and drop the legacy one, both under the index
+  //    file lock so a concurrent binding cannot be lost.
+  await updateAccountIndex(existing => {
+    const next = existing.filter(id => id !== "default" && id !== targetId);
+    next.push(targetId);
+    return next;
+  });
+  try {
+    fs.rmSync(path.join(resolveWorkChatStateDir(), "accounts", "default.json"), { force: true });
+  } catch {
+    // Best-effort data file cleanup; the index above is authoritative.
+  }
+  try {
+    const { clearFrameworkAllowFromList } = await import("./pairing.js");
+    clearFrameworkAllowFromList("default");
+  } catch (err) {
+    logger.warn(`migrateLegacyDefaultWorkChatAccount: allowFrom cleanup failed: ${String(err)}`);
+  }
+  logger.info(
+    `migrateLegacyDefaultWorkChatAccount: renamed default -> ${targetId} (agent=${agentId})`,
+  );
+  return true;
+}
+
 /** List accountIds from the index file (written at binding). */
 export function listWorkChatAccountIds(_cfg: OpenClawConfig): string[] {
   return listIndexedWorkChatAccountIds();

package/src/auth/bind-agent.ts

@@ -1,53 +1,26 @@
 import { logger } from "../util/logger.js";
 
 /**
- * Persist the (userId, agentId) -> account binding into
- * channels.openclaw-workchat.accounts of openclaw.json so inbound
- * AGENT_MESSAGE frames route to the right account and outbound sends find
- * the agent.
+ * Complete the binding on the plugin side.
  *
- * Weixin-style model: no dedicated sub-agent, no explicit binding — the
- * account routes to the main agent via the channel's default binding the
- * desktop configSync maintains (and the gateway's default-agent fallback).
- * Credentials are never written here; they arrive via
- * WORKCHAT_API_KEY / WORKCHAT_APP_SECRET env injection.
+ * The account payload (agentId/userId) lives exclusively in the plugin's
+ * private state dir (`state/openclaw-workchat/accounts/`) — weixin-style. The
+ * caller (binding listener / monitor INIT_AGENT handling) persists it via
+ * saveWorkChatAccount + registerWorkChatAccountId before calling this.
  *
- * Shared by the binding listener (login-qr wait path) and the monitor's
- * INIT_AGENT / AGENT_CREATED handling (process-message).
+ * This function only bumps `channelConfigUpdatedAt` in openclaw.json so the
+ * gateway reloads config from disk and restarts the channel with the fresh
+ * private-dir account data. Writing account entries into
+ * channels.openclaw-workchat.accounts here would race the desktop configSync
+ * (which rebuilds that field) and orphan the credentials/
+ * <account>-allowFrom.json files — the gateway's startup migration treats
+ * those as a fatal unresolved state.
  */
 export async function bindAgentToAccount(
   accountId: string,
   agentId: string,
   userId?: string,
 ): Promise<void> {
-  const { loadConfig, writeConfigFile } = await import("openclaw/plugin-sdk/config-runtime");
-  const raw = loadConfig() as Record<string, any>;
-  const channels = (raw.channels ?? {}) as Record<string, any>;
-  const section = (channels["openclaw-workchat"] ?? {}) as Record<string, any>;
-  const accounts = { ...(section.accounts ?? {}) };
-
-  accounts[accountId] = {
-    ...(accounts[accountId] ?? {}),
-    enabled: true,
-    agentId,
-    ...(userId ? { userId } : {}),
-  };
-
-  const updated = {
-    ...raw,
-    channels: {
-      ...channels,
-      "openclaw-workchat": {
-        ...section,
-        accounts,
-        ...(userId && !section.userId ? { userId } : {}),
-        channelConfigUpdatedAt: new Date().toISOString(),
-      },
-    },
-  } as Record<string, any>;
-
-  await writeConfigFile(updated as import("openclaw/plugin-sdk").OpenClawConfig);
-
   // Persist the binding user in the framework allowFrom store so command
   // authorization has an explicit source of truth (the inbound path also
   // falls back to the account's userId, but writing it keeps parity with the
@@ -61,8 +34,17 @@ export async function bindAgentToAccount(
     }
   }
 
+  // Trigger the channel hot reload; account data itself stays in the private
+  // state dir (already persisted by the caller before this runs).
+  try {
+    const { triggerWorkChatChannelReload } = await import("./accounts.js");
+    await triggerWorkChatChannelReload();
+  } catch (err) {
+    logger.warn(`bindAgentToAccount: channel reload trigger failed: ${String(err)}`);
+  }
+
   logger.info(
-    `bindAgentToAccount: accountId=${accountId} agentId=${agentId} userId=${userId || "(none)"} (apiKey NOT written — env-injected)`,
+    `bindAgentToAccount: accountId=${accountId} agentId=${agentId} userId=${userId || "(none)"} (private-dir only; apiKey NOT written — env-injected)`,
   );
 }
 

package/src/auth/login-qr.ts

@@ -293,7 +293,6 @@ import { buildPongFrame } from "../messaging/inbound.js";
 import {
   saveWorkChatAccount,
   registerWorkChatAccountId,
-  listIndexedWorkChatAccountIds,
 } from "./accounts.js";
 
 const bindingListeners = new Map<string, { ws: WebSocket; done: boolean }>();
@@ -388,46 +387,42 @@ async function handleListenerFrame(sessionKey: string, data: string, ws: WebSock
 
   const eventData = result.eventData;
   if (!eventData) return;
-  const agentId = String(eventData.id ?? eventData.agentId ?? "");
+  const agentId = String(eventData.id ?? eventData.agentId ?? "").trim();
   if (!agentId) return;
-  const userId = String(eventData.futureId ?? eventData.userId ?? "");
+  const userId = String(eventData.futureId ?? eventData.userId ?? "").trim();
 
   const entry = bindingListeners.get(sessionKey);
   if (entry) entry.done = true;
 
-  // Rebind detection must happen BEFORE pruning empties the index: if any
-  // account existed, this scan replaces it. The QR login flow force-stops the
-  // channel (marked manually-stopped in the gateway), and a reused account id
-  // would stay stopped after reload — so a rebind always registers under a
-  // FRESH agent-scoped key instead of reusing `default`.
-  const isRebind = listIndexedWorkChatAccountIds().length > 0;
+  // One active agent per host (mirrors handleAgentLifecycleEvent): every
+  // binding registers under the agent-scoped key `agent-${agentId}`. The QR
+  // login flow force-stops the channel (marked manually-stopped in the
+  // gateway), and a reused account id would stay stopped after reload — the
+  // fresh agent-scoped key plus the channel reload restarts it.
+  const accountId = `agent-${agentId}`;
 
-  // Rebind semantics (mirrors handleAgentLifecycleEvent): a re-scan replaces
-  // the previously bound agent, so drop accounts bound to other agentIds
-  // before registering this one.
+  // A re-scan replaces the previously bound agent: drop every OTHER
+  // registered account (including a same-agent legacy `default`) before
+  // registering this one.
   try {
-    const { pruneStaleWorkChatAccounts } = await import("./accounts.js");
-    const removed = await pruneStaleWorkChatAccounts(agentId);
+    const { pruneOtherWorkChatAccounts } = await import("./accounts.js");
+    const removed = await pruneOtherWorkChatAccounts(accountId);
     if (removed.length > 0) {
-      logger.info(`binding listener: pruned stale account(s): ${removed.join(", ")}`);
+      logger.info(`binding listener: pruned previous account(s): ${removed.join(", ")}`);
     }
   } catch (err) {
     logger.error(`binding listener: rebind cleanup failed: ${String(err)}`);
   }
 
-  // First bound agent becomes the `default` account; a rebind gets a fresh
-  // agent-scoped key (see isRebind note above).
-  const accountId = isRebind
-    ? `agent-${agentId}`
-    : "default";
-
   try {
     saveWorkChatAccount(accountId, {
       agentId,
       ...(userId ? { userId } : {}),
     });
-    registerWorkChatAccountId(accountId);
-    // Bind agent into openclaw.json accounts (routing) — no apiKey ever written.
+    await registerWorkChatAccountId(accountId);
+    // Complete the binding: account data is already in the private state
+    // dir; this call registers the allowFrom user and triggers the channel
+    // hot reload.
     const { bindAgentToAccountFromBinding } = await import("./bind-agent.js");
     await bindAgentToAccountFromBinding(accountId, agentId, userId);
     logger.info(`binding listener: account=${accountId} agent=${agentId} persisted`);

package/src/channel.ts

@@ -5,6 +5,7 @@ import {
   listWorkChatAccountIds,
   resolveWorkChatAccount,
 } from "./auth/accounts.js";
+import { DEFAULT_BASE_URL } from "./api/types.js";
 import {
   startWorkChatLoginWithQr,
   waitForWorkChatLogin,
@@ -205,13 +206,24 @@ export const workchatPlugin: ChannelPlugin<ResolvedWorkChatAccount> = {
       // The gateway adapter has no cfg in scope here — read the live config
       // from disk (the gateway's own config, same file triggerWorkChatChannelReload
       // writes to) so the ${WORKCHAT_API_KEY} placeholder is resolved by the host.
+      // Account ids are always agent-scoped (`agent-${agentId}`); an explicit
+      // accountId targets that account, otherwise fall back to the first
+      // registered one. A first-time bind (empty index) still resolves an
+      // account-like view of the shared channel credentials — the QR flow
+      // only consumes baseUrl/appKey/appSecret.
       const { loadConfig } = await import("openclaw/plugin-sdk/config-runtime");
       const cfg = loadConfig() as OpenClawConfig;
-      const account = resolveWorkChatAccount(cfg, accountId ?? "default");
+      const requestedAccountId = accountId?.trim() || listWorkChatAccountIds(cfg)[0];
+      const existing = requestedAccountId
+        ? resolveWorkChatAccount(cfg, requestedAccountId)
+        : undefined;
+      const section = cfg.channels?.["openclaw-workchat"] as
+        | { baseUrl?: string; appKey?: string; appSecret?: string }
+        | undefined;
       const result: WorkChatQrStartResult = await startWorkChatLoginWithQr({
-        baseUrl: account.baseUrl,
-        appKey: account.appKey,
-        appSecret: account.appSecret,
+        baseUrl: existing?.baseUrl || section?.baseUrl || DEFAULT_BASE_URL,
+        appKey: existing?.appKey || section?.appKey?.trim() || undefined,
+        appSecret: existing?.appSecret || section?.appSecret?.trim() || undefined,
       });
       return {
         qrDataUrl: result.qrcodeUrl,

package/src/messaging/process-message.ts

@@ -12,7 +12,7 @@ import {
   registerWorkChatAccountId,
   saveWorkChatAccount,
   triggerWorkChatChannelReload,
-  pruneStaleWorkChatAccounts,
+  pruneOtherWorkChatAccounts,
   removeWorkChatAccountBinding,
 } from "../auth/accounts.js";
 import type { ResolvedWorkChatAccount } from "../auth/accounts.js";
@@ -79,48 +79,41 @@ async function handleAgentLifecycleEvent(
   const eventData = result.eventData;
   if (!eventData) return;
 
-  const agentId = String(eventData.id ?? eventData.agentId ?? "");
+  const agentId = String(eventData.id ?? eventData.agentId ?? "").trim();
   if (!agentId) {
     logger.warn(`${frameType}: missing agent id, ignoring`);
     return;
   }
-  const userId = String(eventData.futureId ?? eventData.userId ?? "");
+  const userId = String(eventData.futureId ?? eventData.userId ?? "").trim();
 
   logger.info(`${frameType}: agentId=${agentId} userId=${userId ? "present" : "missing"}`);
   deps.log(`${frameType}: agentId=${agentId}`);
 
-  // Rebind detection must happen BEFORE pruning empties the index (see the
-  // matching note in the binding listener): a rebind always registers under a
-  // FRESH agent-scoped key so the gateway restarts it — the QR login flow
-  // force-stops the channel with a manual-stop mark, and a reused account id
-  // would stay stopped after the config reload.
-  const isRebind = listWorkChatAccountIdsCount() > 0;
+  // One active agent per host: every binding (first scan included) registers
+  // under the agent-scoped key `agent-${agentId}`, and every OTHER registered
+  // account is removed before persisting. A reused account id would also stay
+  // stopped after the QR flow's manual-stop mark, so rebinds always land on
+  // the fresh key and the gateway restarts it via the channel reload below.
+  const { completeWorkChatBinding } = await import("../auth/login-qr.js");
+  const accountId = frameType === "init_agent"
+    ? `agent-${agentId}`
+    : deps.accountId;
 
-  // Rebind semantics: one active agent per host. Before persisting the new
-  // binding, remove every registered account bound to a different agent
-  // (a re-scan creates a new platform agent; the old one is deleted there).
   try {
-    const removed = await pruneStaleWorkChatAccounts(agentId);
+    const removed = await pruneOtherWorkChatAccounts(accountId);
     if (removed.length > 0) {
-      deps.log(`rebind: removed stale account(s): ${removed.join(", ")}`);
+      deps.log(`rebind: removed previous account(s): ${removed.join(", ")}`);
     }
   } catch (err) {
     logger.error(`rebind cleanup failed: ${String(err)}`);
   }
 
-  // The bound agent becomes the account: `default` for the primary install,
-  // or a fresh agent-scoped key on rebind.
-  const { completeWorkChatBinding } = await import("../auth/login-qr.js");
-  const accountId = frameType === "init_agent"
-    ? (isRebind ? `agent-${agentId}` : "default")
-    : deps.accountId;
-
   try {
     saveWorkChatAccount(accountId, {
       agentId,
       ...(userId ? { userId } : {}),
     });
-    registerWorkChatAccountId(accountId);
+    await registerWorkChatAccountId(accountId);
     // Bind the account to the incoming agent for message routing. agentId
     // comes from the event; userId (futureId) is the WorkChat user.
     const { bindAgentToAccount } = await import("../auth/bind-agent.js");
@@ -149,10 +142,6 @@ async function handleAgentLifecycleEvent(
   }
 }
 
-function listWorkChatAccountIdsCount(): number {
-  return listIndexedWorkChatAccountIds().length;
-}
-
 // Typing-indicator helper versions: the host renamed the subpath between
 // releases (2026.3.x exports openclaw/plugin-sdk/channel-runtime, 2026.8.x
 // exports openclaw/plugin-sdk/channel-message). Load whichever resolves —