fix: write auth profiles to multi-agent path during onboarding

- Onboarding now writes auth profiles under ~/.clawdbot/agents/main/agent so the gateway sees credentials on first start.
- Hardened onboarding test to ignore legacy env vars.

Thanks @minghinmatthewlam!

src/agents/agent-scope.ts

@@ -53,3 +53,12 @@ export function resolveAgentDir(cfg: ClawdbotConfig, agentId: string) {
   const root = resolveStateDir(process.env, os.homedir);
   return path.join(root, "agents", id, "agent");
 }
+
+/**
+ * Resolve the agent directory for the default agent without requiring config.
+ * Used by onboarding when writing auth profiles before config is fully set up.
+ */
+export function resolveDefaultAgentDir(): string {
+  const root = resolveStateDir(process.env, os.homedir);
+  return path.join(root, "agents", DEFAULT_AGENT_ID, "agent");
+}

src/commands/onboard-auth.test.ts

@@ -36,9 +36,10 @@ describe("writeOAuthCredentials", () => {
     delete process.env.CLAWDBOT_OAUTH_DIR;
   });
 
-  it("writes auth-profiles.json under CLAWDBOT_STATE_DIR/agent", async () => {
+  it("writes auth-profiles.json under CLAWDBOT_STATE_DIR/agents/main/agent", async () => {
     tempStateDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-oauth-"));
     process.env.CLAWDBOT_STATE_DIR = tempStateDir;
+    // Even if legacy env vars are set, onboarding should write to the multi-agent path.
     process.env.CLAWDBOT_AGENT_DIR = path.join(tempStateDir, "agent");
     process.env.PI_CODING_AGENT_DIR = process.env.CLAWDBOT_AGENT_DIR;
 
@@ -50,8 +51,11 @@ describe("writeOAuthCredentials", () => {
 
     await writeOAuthCredentials("anthropic", creds);
 
+    // Now writes to the multi-agent path: agents/main/agent
     const authProfilePath = path.join(
       tempStateDir,
+      "agents",
+      "main",
       "agent",
       "auth-profiles.json",
     );
@@ -64,5 +68,12 @@ describe("writeOAuthCredentials", () => {
       access: "access-token",
       type: "oauth",
     });
+
+    await expect(
+      fs.readFile(
+        path.join(tempStateDir, "agent", "auth-profiles.json"),
+        "utf8",
+      ),
+    ).rejects.toThrow();
   });
 });

src/commands/onboard-auth.ts

@@ -1,4 +1,5 @@
 import type { OAuthCredentials, OAuthProvider } from "@mariozechner/pi-ai";
+import { resolveDefaultAgentDir } from "../agents/agent-scope.js";
 import { upsertAuthProfile } from "../agents/auth-profiles.js";
 import type { ClawdbotConfig } from "../config/config.js";
 
@@ -6,6 +7,8 @@ export async function writeOAuthCredentials(
   provider: OAuthProvider,
   creds: OAuthCredentials,
 ): Promise<void> {
+  // Write to the multi-agent path so gateway finds credentials on startup
+  const agentDir = resolveDefaultAgentDir();
   upsertAuthProfile({
     profileId: `${provider}:${creds.email ?? "default"}`,
     credential: {
@@ -13,10 +16,13 @@ export async function writeOAuthCredentials(
       provider,
       ...creds,
     },
+    agentDir,
   });
 }
 
 export async function setAnthropicApiKey(key: string) {
+  // Write to the multi-agent path so gateway finds credentials on startup
+  const agentDir = resolveDefaultAgentDir();
   upsertAuthProfile({
     profileId: "anthropic:default",
     credential: {
@@ -24,6 +30,7 @@ export async function setAnthropicApiKey(key: string) {
       provider: "anthropic",
       key,
     },
+    agentDir,
   });
 }