fix: recursively repair weixin state ownership after login

lib/channel/weixin.js

@@ -48,11 +48,24 @@ function _resolveStateDir() {
   return path.join('/home/sts', '.openclaw');
 }
 
-function _ensureStsOwnership(filePath) {
+function _ensureStsOwnership(targetPath, recursive = false) {
   try {
-    execFileSync('chown', ['sts:sts', filePath], { stdio: 'ignore' });
+    const args = [];
+    if (recursive) args.push('-R');
+    args.push('sts:sts', targetPath);
+    execFileSync('chown', args, { stdio: 'ignore' });
   } catch (err) {
-    log.warn('weixin', `chown sts:sts failed for ${filePath}: ${err.message}`);
+    log.warn('weixin', `chown${recursive ? ' -R' : ''} sts:sts failed for ${targetPath}: ${err.message}`);
+  }
+}
+
+function _ensureWeixinStateOwnership() {
+  const statePath = _resolveWeixinStateDir();
+  try {
+    if (!fs.existsSync(statePath)) return;
+    _ensureStsOwnership(statePath, true);
+  } catch (err) {
+    log.warn('weixin', `ensure weixin state ownership failed for ${statePath}: ${err.message}`);
   }
 }
 
@@ -87,7 +100,6 @@ function _registerAccountId(accountId) {
   if (existing.includes(accountId)) return;
   const indexPath = _resolveAccountIndexPath();
   fs.writeFileSync(indexPath, JSON.stringify([...existing, accountId], null, 2), 'utf8');
-  _ensureStsOwnership(indexPath);
 }
 
 function _loadAccount(accountId) {
@@ -119,7 +131,6 @@ function _saveAccount(accountId, update) {
   };
   const filePath = _resolveAccountPath(accountId);
   fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf8');
-  _ensureStsOwnership(filePath);
   try { fs.chmodSync(filePath, 0o600); } catch (_) {}
   return filePath;
 }
@@ -135,7 +146,6 @@ function _clearStaleAccountsForUserId(currentAccountId, userId) {
       const existing = _listIndexedAccountIds();
       const indexPath = _resolveAccountIndexPath();
       fs.writeFileSync(indexPath, JSON.stringify(existing.filter(x => x !== id), null, 2), 'utf8');
-      _ensureStsOwnership(indexPath);
     }
   }
 }
@@ -298,6 +308,9 @@ function login({ callId, timeout = 180, botType = DEFAULT_BOT_TYPE, emit }) {
       finished = true;
       log.error('weixin', `callId=${callId} login error: ${err.message}`);
       emit({ action: 'finish', event: 'failed', code: 500, message: err.message });
+    })
+    .finally(() => {
+      _ensureWeixinStateOwnership();
     });
 
   return { abort };

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "clawd",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clawd",
-      "version": "1.5.1",
+      "version": "1.5.2",
       "license": "MIT",
       "dependencies": {
         "ssh2": "^1.17.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawd",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Claw Box daemon - connects local Linux box to claw.cutos.ai via WebSocket",
   "main": "lib/client.js",
   "bin": {