mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-20 17:41:33 -06:00
Peter Steinberger
147edf47f3
* fix(auth): keep a retired auth JSON from stranding a migrated store Runtime failed closed with AUTH_PROFILE_MIGRATION_REQUIRED whenever a retired credential file was present, even when the canonical SQLite store already held the agent's profiles. One leftover auth.json therefore made a fully migrated install unusable, and the gateway lifecycle preflight refused start/restart on top of it, so every channel and provider stayed offline until Doctor ran. A legacy file is now only fatal when the canonical store cannot serve credentials. Doctor's importer never overwrites a usable stored credential, so a file sitting beside a populated store is unarchived bytes, not pending migration: runtime logs a one-time warning and keeps serving. An empty store with a credential file still fails closed and never falls through to environment auth. Startup degrades that owner to configured-unavailable instead of refusing to boot, which lets the lifecycle preflight go away. * refactor(secrets): retire the auth-profiles.json vocabulary Auth profiles moved to SQLite, but operator-facing surfaces still named the retired JSON file. The duplicate-agentDir error told operators to copy auth-profiles.json to share credentials, which does nothing and lands the second agent in a migration-required state; `openclaw migrate plan codex` reported a target file that is never created; and the secrets picker labelled candidates with a filename that no longer exists. Renames the SecretTargetConfigFile discriminator to "auth-profile-store" and corrects the operator-facing text, the migrate plan target, and the docs that described the file as a live target. Genuine legacy-filename uses in doctor, the security fixer, and migration fixtures are unchanged. Also deletes resolveSecretPlanTargetByPath and ResolvedSecretPlanTarget from the plugin SDK. They have no callers in core, plugins, or tests, and the symbols are absent from the latest stable tag, so they carry no compatibility obligation and are removed rather than deprecated. Their inline parameter type was the only thing putting the retired filename on the public SDK surface. * improve(wizard): warn about device-code phishing The device-code prompt only warned against sharing the code, and only when an expiry was known. Device-code phishing works the other way around: the attacker starts the login and gets the victim to enter the attacker's code. Codes delivered over a chat channel are the risky case and carry no expiry hint, so the warning is now unconditional and covers received codes, matching the Codex CLI prompt. Also documents the Codex auth handoff: a subscription profile is installed as in-memory external auth rather than persisted, and token refresh is inverted so the refresh token stays in OpenClaw's store. * fix(test): make transcript read-failure injection order-independent server.sessions.compaction-read-errors.test.ts injected its failures with mockRejectedValueOnce, which fails the NEXT call to loadTranscriptEvents globally. Under --isolate=false a shard shares one worker, so any sibling transcript read could consume the one-shot rejection before the compaction RPC issued its own; compaction then ran against the real reader and returned ok, failing three assertions. This shard was already red on main; a prior repair fixed the mock's initialization order but left the call-order dependency. Key the injection on the seeded sessionId instead, so unrelated readers cannot consume it and the re-read case counts only its own session's reads. Also updates two expectations invalidated by this branch: the duplicate-agentDir remediation text, and the plugin SDK export ratchet, shrunk by the two retired secret-plan exports.