fix: use OpenClaw session APIs for account routing (v3.10.3)

[dorukardahan]

Summary

Fixes: ZeroAPI detected openclaw-agent.sqlite (auth/cache/memory state) and incorrectly concluded the session backend was non-JSON, causing account/profile routing to be skipped on OpenClaw v2026.7.1-2 where sessions are still stored in sessions.json.

Root cause

ZeroAPI's session-auth.ts probed for the agents/<id>/agent/openclaw-agent.sqlite file and its SQLite header. If found, it returned session_store_non_json_backend and skipped the auth-profile override persistence — even though OpenClaw v2026.7.1-2 uses this SQLite database for auth/cache/memory state while session entries remain in JSON.

This meant: when an agent had an auth SQLite DB (which is normal), ZeroAPI silently disabled account routing instead of writing the session entry.

Fix

Removed all file-name/header-based backend detection. ZeroAPI now uses OpenClaw's public, storage-neutral session API (patchSessionEntry) to persist auth-profile overrides, which correctly targets sessions.json on v2026.7.1-2 and SQLite session tables on newer builds — without ZeroAPI needing to know which backend is active.

Key changes:

• plugin/session-auth.ts: Rewritten to use createSessionEntryPatcher() which delegates to the host's public API. No raw file reads/writes, no SQLite probing, no backend guessing. Fail-closed on missing session key, missing entry, store error, or user-pinned override.
• plugin/index.ts: Integrated patchSessionEntry from openclaw/plugin-sdk/session-store-runtime into the hook flow. User-pinned overrides (authProfileOverrideSource: "user") are preserved; only ZeroAPI-managed overrides ("auto" / legacy "zeroapi") are updated or cleared.
• Tests: 13 session-auth + 6 plugin-entry regression tests covering JSON layout, SQLite layout, fail-closed paths, user-pin preservation, and legacy source normalization.
• CI matrix (.github/workflows/test.yml): Three-lane OpenClaw compatibility — 2026.5.2 (minimum host, legacy JSON API), 2026.7.1-2 (stable, JSON + auth SQLite), 2026.8.1-beta.1 (SQLite session architecture). Each lane runs host smoke with exact npm integrity pins.
• ClawHub workflow: Replaced deprecated --dangerously-force-unsafe-install (no-op) with exact-version + clean-scan verification gate. No risk acknowledgement flag used.

Compatibility

OpenClaw version	Session store	ZeroAPI behavior
2026.5.2 (min host)	sessions.json	Legacy resolveStorePath + updateSessionStoreEntry
2026.7.1-2 (stable)	sessions.json + auth SQLite	patchSessionEntry → JSON store
2026.8.1-beta.1 (prerelease)	SQLite session tables	patchSessionEntry → SQLite accessor

All three lanes verified with exact-host smoke tests using synthetic fixtures.

What this does NOT do

• No session migration (JSON → SQLite or vice versa)
• No raw SQLite queries or writes
• No raw sessions.json reads/writes
• No JSONL transcript parsing
• No private/config file access

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 625be01cba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 82bbceb44e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".