Upgrade openclaw to 4.9 (#804)

tests/unit/openclaw-auth.test.ts

@@ -426,6 +426,68 @@ describe('sanitizeOpenClawConfig', () => {
     expect(moonshot).not.toHaveProperty('apiKey');
     expect(moonshot.baseUrl).toBe('https://api.moonshot.cn/v1');
   });
+
+  it('mirrors telegram default account credentials to top level during sanitize', async () => {
+    await writeOpenClawJson({
+      channels: {
+        telegram: {
+          enabled: true,
+          defaultAccount: 'default',
+          accounts: {
+            default: {
+              botToken: 'telegram-token',
+              enabled: true,
+            },
+          },
+          proxy: 'socks5://127.0.0.1:7891',
+        },
+      },
+    });
+
+    const { sanitizeOpenClawConfig } = await import('@electron/utils/openclaw-auth');
+    await sanitizeOpenClawConfig();
+
+    const result = await readOpenClawJson();
+    const channels = result.channels as Record<string, Record<string, unknown>>;
+    const telegram = channels.telegram;
+    // telegram is NOT in the exclude set, so credentials are mirrored to top level
+    expect(telegram.proxy).toBe('socks5://127.0.0.1:7891');
+    expect(telegram.botToken).toBe('telegram-token');
+  });
+
+  it('strips accounts/defaultAccount from dingtalk (strict-schema channel) during sanitize', async () => {
+    await writeOpenClawJson({
+      channels: {
+        dingtalk: {
+          enabled: true,
+          defaultAccount: 'default',
+          accounts: {
+            default: {
+              clientId: 'dt-client-id-nested',
+              clientSecret: 'dt-secret-nested',
+              enabled: true,
+            },
+          },
+          clientId: 'dt-client-id',
+          clientSecret: 'dt-secret',
+        },
+      },
+    });
+
+    const { sanitizeOpenClawConfig } = await import('@electron/utils/openclaw-auth');
+    await sanitizeOpenClawConfig();
+
+    const result = await readOpenClawJson();
+    const channels = result.channels as Record<string, Record<string, unknown>>;
+    const dingtalk = channels.dingtalk;
+    // dingtalk's strict schema rejects accounts/defaultAccount — they must be stripped
+    expect(dingtalk.enabled).toBe(true);
+    expect(dingtalk.accounts).toBeUndefined();
+    expect(dingtalk.defaultAccount).toBeUndefined();
+    // Top-level credentials must be preserved
+    expect(dingtalk.clientId).toBe('dt-client-id');
+    expect(dingtalk.clientSecret).toBe('dt-secret');
+  });
 });
 
 describe('syncProviderConfigToOpenClaw', () => {