From d3af6cba7d7c142a1ac34b294048032e9b42ec74 Mon Sep 17 00:00:00 2001
From: support <support@cutos.ai>
Date: Sat, 13 Jun 2026 15:17:18 +0800
Subject: [PATCH] fix: recursively repair weixin state ownership after login

---
 lib/channel/weixin.js | 25 +++++++++++++++++++------
 package-lock.json     |  4 ++--
 package.json          |  2 +-
 3 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/lib/channel/weixin.js b/lib/channel/weixin.js
index ba89493..1b7beb0 100644
--- a/lib/channel/weixin.js
+++ b/lib/channel/weixin.js
@@ -48,11 +48,24 @@ function _resolveStateDir() {
   return path.join('/home/sts', '.openclaw');
 }
 
-function _ensureStsOwnership(filePath) {
+function _ensureStsOwnership(targetPath, recursive = false) {
   try {
-    execFileSync('chown', ['sts:sts', filePath], { stdio: 'ignore' });
+    const args = [];
+    if (recursive) args.push('-R');
+    args.push('sts:sts', targetPath);
+    execFileSync('chown', args, { stdio: 'ignore' });
   } catch (err) {
-    log.warn('weixin', `chown sts:sts failed for ${filePath}: ${err.message}`);
+    log.warn('weixin', `chown${recursive ? ' -R' : ''} sts:sts failed for ${targetPath}: ${err.message}`);
+  }
+}
+
+function _ensureWeixinStateOwnership() {
+  const statePath = _resolveWeixinStateDir();
+  try {
+    if (!fs.existsSync(statePath)) return;
+    _ensureStsOwnership(statePath, true);
+  } catch (err) {
+    log.warn('weixin', `ensure weixin state ownership failed for ${statePath}: ${err.message}`);
   }
 }
 
@@ -87,7 +100,6 @@ function _registerAccountId(accountId) {
   if (existing.includes(accountId)) return;
   const indexPath = _resolveAccountIndexPath();
   fs.writeFileSync(indexPath, JSON.stringify([...existing, accountId], null, 2), 'utf8');
-  _ensureStsOwnership(indexPath);
 }
 
 function _loadAccount(accountId) {
@@ -119,7 +131,6 @@ function _saveAccount(accountId, update) {
   };
   const filePath = _resolveAccountPath(accountId);
   fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf8');
-  _ensureStsOwnership(filePath);
   try { fs.chmodSync(filePath, 0o600); } catch (_) {}
   return filePath;
 }
@@ -135,7 +146,6 @@ function _clearStaleAccountsForUserId(currentAccountId, userId) {
       const existing = _listIndexedAccountIds();
       const indexPath = _resolveAccountIndexPath();
       fs.writeFileSync(indexPath, JSON.stringify(existing.filter(x => x !== id), null, 2), 'utf8');
-      _ensureStsOwnership(indexPath);
     }
   }
 }
@@ -298,6 +308,9 @@ function login({ callId, timeout = 180, botType = DEFAULT_BOT_TYPE, emit }) {
       finished = true;
       log.error('weixin', `callId=${callId} login error: ${err.message}`);
       emit({ action: 'finish', event: 'failed', code: 500, message: err.message });
+    })
+    .finally(() => {
+      _ensureWeixinStateOwnership();
     });
 
   return { abort };
diff --git a/package-lock.json b/package-lock.json
index 0b4afbb..72c8e4d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "clawd",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clawd",
-      "version": "1.5.1",
+      "version": "1.5.2",
       "license": "MIT",
       "dependencies": {
         "ssh2": "^1.17.0",
diff --git a/package.json b/package.json
index 8a7de6d..4bda3c1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "clawd",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Claw Box daemon - connects local Linux box to claw.cutos.ai via WebSocket",
   "main": "lib/client.js",
   "bin": {