fix(whatsapp): reconcile post-pair gateway restart without operator.admin (#6413)

OpenClaw's `channels login --channel whatsapp` saves credentials locally and
then asks the running gateway to restart the channel via the `channels.start`
RPC, which is gated behind `operator.admin`. Since #6291 stopped ordinary
in-sandbox argv from inheriting the gateway token, the login runs on device
auth, the device approval policy deliberately never grants `operator.admin`,
and the post-pair restart is denied — credentials are saved but the running
channel keeps its old session ("missing scope: operator.admin").

After a successful token-less WhatsApp login, re-issue that same bounded
`channels.start` as a NemoClaw-owned one-shot authenticated with the gateway
token (read from the mutable config), scoped to a single fixed-argv child and
sent only to NemoClaw's trusted private gateway URL. This mirrors the existing
sessions.reset/delete admin RPC path; it does not auto-approve operator.admin
or reintroduce ambient token auth, preserving the #6291 boundary. A failed or
ambient-token login is left untouched, and reconcile failures downgrade to
host-side recovery guidance without changing the login's exit code.

The WhatsApp login subprocess now also strips an ambient gateway token when the
login targets a caller-supplied (non-trusted) URL, closing a token
exfiltration path, and runs under saved/restored errexit so its exit status is
always captured.

Adds test/repro-6413-whatsapp-postpair-start.test.ts covering the reconcile,
trusted-URL gating, token non-exfiltration (login and reconcile), account-id
handling, and the errexit path.

Signed-off-by: harjoth <harjoth.khara@gmail.com>

Author: harjothkhara

scripts/nemoclaw-start.sh

@@ -3342,6 +3342,103 @@ _nemoclaw_messaging_connect_node_options() {
   done < "/tmp/nemoclaw-messaging-connect-preloads.list"
   printf '%s' "$_nemoclaw_options"
 }
+# Read gateway.auth.token from the mutable OpenClaw config. Mirrors the
+# entrypoint's _read_gateway_token, which is not emitted into this sourced
+# file; keep the JSON5 fallback in sync with it.
+_nemoclaw_whatsapp_gateway_token() {
+  node - "${OPENCLAW_STATE_DIR:-/sandbox/.openclaw}/openclaw.json" <<'NODEWATOKEN'
+const fs = require("fs");
+
+const configPath = process.argv[2];
+
+function loadJson5() {
+  try {
+    const JSON5 = require("/opt/nemoclaw/node_modules/json5");
+    if (JSON5 && typeof JSON5.parse === "function") {
+      return JSON5;
+    }
+  } catch {
+    // Fall through to the caller's empty-token behavior.
+  }
+  return undefined;
+}
+
+try {
+  const text = fs.readFileSync(configPath, "utf8");
+  let cfg;
+  try {
+    cfg = JSON.parse(text);
+  } catch (jsonError) {
+    const JSON5 = loadJson5();
+    if (!JSON5) {
+      throw jsonError;
+    }
+    cfg = JSON5.parse(text);
+  }
+  console.log(cfg?.gateway?.auth?.token || "");
+} catch {
+  console.log("");
+}
+NODEWATOKEN
+}
+# NemoClaw#6413: OpenClaw's `channels login` saves WhatsApp credentials
+# locally and then asks the running gateway to restart the channel through the
+# `channels.start` RPC, which the gateway gates behind `operator.admin`. When
+# the login runs without the ambient gateway token, the client falls back to
+# device auth, the device approval policy deliberately never grants
+# `operator.admin`, and the post-pair restart is denied: credentials are saved
+# but the running channel keeps its old session. Re-issue that same bounded
+# RPC as a NemoClaw-owned one-shot with gateway-token auth after a successful
+# login. The token stays scoped to this single fixed-argv child; per the
+# runtime-env contract, removing the token from ordinary caller argv "is not a
+# secrecy boundary against a command that deliberately reads the file", and
+# this helper is exactly such an owned reader. Auto-approving `operator.admin`
+# for ordinary devices would weaken the reviewed #6291 boundary and is
+# deliberately not done here. Never fails the login: credentials are already
+# saved, so a reconcile failure downgrades to host-side recovery guidance.
+# Removal condition: drop this helper when the pinned OpenClaw lets a local
+# login (re)start its own channel account without `operator.admin`, or ships
+# its own bounded post-login reconcile.
+_nemoclaw_whatsapp_postpair_start() {
+  local _nemoclaw_wa_gateway_url="$1" _nemoclaw_wa_insecure_ws="$2" _nemoclaw_wa_account="$3"
+  local _nemoclaw_wa_token _nemoclaw_wa_params _nemoclaw_wa_call_output
+  # The account id is caller input embedded in JSON params; allowlist it
+  # instead of quoting it (mirrors the approval policy's request-id pattern).
+  # Evaluate the range under the C locale so [A-Za-z0-9._:-] stays ASCII and is
+  # not widened by the caller's LC_COLLATE/LC_CTYPE. Scoped to this function
+  # subshell-style: the assignment cannot leak into the interactive shell
+  # because the helper only runs inside command substitution / the reconcile.
+  local LC_ALL=C
+  case "$_nemoclaw_wa_account" in
+    "") _nemoclaw_wa_params='{"channel":"whatsapp"}' ;;
+    *[!A-Za-z0-9._:-]*)
+      echo "[whatsapp] Credentials saved, but the account id contains unsupported characters, so the" >&2
+      echo "[whatsapp] running gateway was not asked to restart the channel. Exit the sandbox and run" >&2
+      echo "[whatsapp] 'nemoclaw <sandbox> channels status --channel whatsapp' to confirm it reconnects." >&2
+      return 0
+      ;;
+    *) _nemoclaw_wa_params='{"channel":"whatsapp","accountId":"'"$_nemoclaw_wa_account"'"}' ;;
+  esac
+  _nemoclaw_wa_token="$(_nemoclaw_whatsapp_gateway_token)"
+  if [ -z "$_nemoclaw_wa_token" ]; then
+    echo "[whatsapp] Credentials saved, but the gateway token is unavailable in this shell, so the" >&2
+    echo "[whatsapp] running gateway was not asked to restart the channel. Exit the sandbox and run" >&2
+    echo "[whatsapp] 'nemoclaw <sandbox> channels status --channel whatsapp' to confirm it reconnects." >&2
+    return 0
+  fi
+  if _nemoclaw_wa_call_output="$(OPENCLAW_GATEWAY_URL="$_nemoclaw_wa_gateway_url" \
+    OPENCLAW_ALLOW_INSECURE_PRIVATE_WS="$_nemoclaw_wa_insecure_ws" \
+    OPENCLAW_GATEWAY_TOKEN="$_nemoclaw_wa_token" \
+    command openclaw gateway call channels.start --params "$_nemoclaw_wa_params" --json 2>&1)"; then
+    echo "[whatsapp] Restarted the WhatsApp channel on the running gateway with the new credentials." >&2
+  else
+    echo "[whatsapp] Credentials saved, but restarting the channel on the running gateway failed:" >&2
+    printf '%s\n' "$_nemoclaw_wa_call_output" | tail -n 3 | sed 's/^/[whatsapp]   /' >&2
+    echo "[whatsapp] Exit the sandbox and run 'nemoclaw <sandbox> channels status --channel whatsapp'" >&2
+    echo "[whatsapp] to check the channel; re-run the login from a fresh connect shell if it stays down." >&2
+  fi
+  return 0
+}
 openclaw() {
   # NemoClaw#4462: approval calls temporarily drop the gateway URL/port/token
   # so OpenClaw resolves the local loopback gateway and device token. The
@@ -3392,8 +3489,10 @@ openclaw() {
         list | status | "" | -h | --help) ;;
         login)
           _login_channel=""
+          _login_account=""
           _login_help=0
           _prev_arg_was_channel_flag=0
+          _prev_arg_was_account_flag=0
           _seen_login_subcommand=0
           for _arg in "$@"; do
             if [ "$_seen_login_subcommand" = "0" ]; then
@@ -3405,13 +3504,24 @@ openclaw() {
               _prev_arg_was_channel_flag=0
               continue
             fi
+            if [ "$_prev_arg_was_account_flag" = "1" ]; then
+              _login_account="$_arg"
+              _prev_arg_was_account_flag=0
+              continue
+            fi
             case "$_arg" in
               --channel)
                 _prev_arg_was_channel_flag=1
                 ;;
               --channel=*)
                 _login_channel="${_arg#--channel=}"
                 ;;
+              --account)
+                _prev_arg_was_account_flag=1
+                ;;
+              --account=*)
+                _login_account="${_arg#--account=}"
+                ;;
               -h | --help)
                 _login_help=1
                 ;;
@@ -3482,16 +3592,47 @@ openclaw() {
             # injecting them again here covers non-connect shells. Runtime
             # preload modules are idempotent, so a double --require is harmless.
             _nemoclaw_connect_node_options="$(_nemoclaw_messaging_connect_node_options)"
-            if [ -n "$_nemoclaw_connect_node_options" ]; then
-              OPENCLAW_GATEWAY_URL="$_nemoclaw_whatsapp_gateway_url" \
-                OPENCLAW_ALLOW_INSECURE_PRIVATE_WS="$_nemoclaw_whatsapp_insecure_ws" \
-                NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }$_nemoclaw_connect_node_options" \
-                command openclaw "$@"
-            else
-              OPENCLAW_GATEWAY_URL="$_nemoclaw_whatsapp_gateway_url" \
-                OPENCLAW_ALLOW_INSECURE_PRIVATE_WS="$_nemoclaw_whatsapp_insecure_ws" \
-                command openclaw "$@"
+            # The shared gateway token (ambient in connect shells; see the
+            # runtime env at OPENCLAW_GATEWAY_TOKEN) must never reach a
+            # caller-selected gateway. NemoClaw injects its trusted private URL
+            # as NEMOCLAW_OPENCLAW_GATEWAY_URL; the login tolerates a
+            # caller-supplied OPENCLAW_GATEWAY_URL override, so classify whether
+            # this login is aimed at the trusted URL. Only the trusted URL may
+            # carry the token — for the login itself and for the reconcile.
+            _nemoclaw_whatsapp_trusted_url="${NEMOCLAW_OPENCLAW_GATEWAY_URL:-}"
+            _nemoclaw_whatsapp_url_is_trusted=0
+            if [ -n "$_nemoclaw_whatsapp_trusted_url" ] &&
+              [ "$_nemoclaw_whatsapp_gateway_url" = "$_nemoclaw_whatsapp_trusted_url" ]; then
+              _nemoclaw_whatsapp_url_is_trusted=1
+            fi
+            # Whether the login could authenticate with the gateway token (only
+            # when it is both present and pointed at the trusted URL). If so,
+            # OpenClaw's own post-pair `channels.start` succeeds and no NemoClaw
+            # reconcile is needed; otherwise that restart is denied for lack of
+            # operator.admin and NemoClaw reconciles it below (NemoClaw#6413).
+            _nemoclaw_whatsapp_login_had_token=0
+            if [ "$_nemoclaw_whatsapp_url_is_trusted" = "1" ] && [ -n "${OPENCLAW_GATEWAY_TOKEN:-}" ]; then
+              _nemoclaw_whatsapp_login_had_token=1
             fi
+            # Run the login with errexit disabled so its exit status is always
+            # captured (and the post-login guidance/reconcile always runs) even
+            # when the caller shell has `set -e`; mirrors the devices-approve
+            # and configure-guard branches. Restored before returning.
+            _nemoclaw_whatsapp_login_errexit=0
+            case $- in *e*) _nemoclaw_whatsapp_login_errexit=1 ;; esac
+            set +e
+            (
+              # A non-trusted (caller-selected) target must not receive the
+              # shared gateway token; strip it so the login there falls back to
+              # device auth, matching the #6291 WhatsApp-login boundary.
+              [ "$_nemoclaw_whatsapp_url_is_trusted" = "1" ] || builtin unset OPENCLAW_GATEWAY_TOKEN
+              export OPENCLAW_GATEWAY_URL="$_nemoclaw_whatsapp_gateway_url"
+              export OPENCLAW_ALLOW_INSECURE_PRIVATE_WS="$_nemoclaw_whatsapp_insecure_ws"
+              if [ -n "$_nemoclaw_connect_node_options" ]; then
+                export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }$_nemoclaw_connect_node_options"
+              fi
+              command openclaw "$@"
+            )
             _whatsapp_login_exit=$?
             if [ "$_whatsapp_login_exit" -ne 0 ]; then
               echo "" >&2
@@ -3500,7 +3641,22 @@ openclaw() {
               echo "issue, not a QR-size issue — the QR above rendered independently of the gateway." >&2
               echo "[whatsapp] Re-run 'openclaw channels login --channel whatsapp' to retry. If it keeps" >&2
               echo "closing, exit the sandbox and run 'nemoclaw <sandbox> channels status --channel whatsapp'." >&2
+            elif [ "$_nemoclaw_whatsapp_url_is_trusted" != "1" ]; then
+              # Login targeted a caller-supplied gateway URL rather than
+              # NemoClaw's injected private URL; the token was withheld above,
+              # and the reconcile must not send it there either.
+              echo "[whatsapp] Credentials saved. The channel was not auto-restarted because pairing used a" >&2
+              echo "[whatsapp] custom gateway URL; exit the sandbox and run" >&2
+              echo "[whatsapp] 'nemoclaw <sandbox> channels status --channel whatsapp' to confirm it reconnects." >&2
+            elif [ "$_nemoclaw_whatsapp_login_had_token" = "1" ]; then
+              : # Login authenticated with the gateway token, so its own
+                # post-pair channels.start already restarted the channel; a
+                # second restart would only bounce the freshly started session.
+            else
+              _nemoclaw_whatsapp_postpair_start "$_nemoclaw_whatsapp_trusted_url" \
+                "$_nemoclaw_whatsapp_insecure_ws" "$_login_account"
             fi
+            [ "$_nemoclaw_whatsapp_login_errexit" = "1" ] && set -e
             return $_whatsapp_login_exit
           fi
           ;;