fix(oauth): derive oauth.json from state dir

src/config/paths.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+
+import { resolveOAuthDir, resolveOAuthPath } from "./paths.js";
+
+describe("oauth paths", () => {
+  it("prefers CLAWDBOT_OAUTH_DIR over CLAWDBOT_STATE_DIR", () => {
+    const env = {
+      CLAWDBOT_OAUTH_DIR: "/custom/oauth",
+      CLAWDBOT_STATE_DIR: "/custom/state",
+    } as NodeJS.ProcessEnv;
+
+    expect(resolveOAuthDir(env, "/custom/state")).toBe("/custom/oauth");
+    expect(resolveOAuthPath(env, "/custom/state")).toBe(
+      "/custom/oauth/oauth.json",
+    );
+  });
+
+  it("derives oauth path from CLAWDBOT_STATE_DIR when unset", () => {
+    const env = {
+      CLAWDBOT_STATE_DIR: "/custom/state",
+    } as NodeJS.ProcessEnv;
+
+    expect(resolveOAuthDir(env, "/custom/state")).toBe(
+      "/custom/state/credentials",
+    );
+    expect(resolveOAuthPath(env, "/custom/state")).toBe(
+      "/custom/state/credentials/oauth.json",
+    );
+  });
+});

src/config/paths.ts

@@ -1,6 +1,6 @@
 import os from "node:os";
 import path from "node:path";
-
+import { resolveUserPath } from "../utils.js";
 import type { ClawdbotConfig } from "./types.js";
 
 /**
@@ -52,6 +52,32 @@ export const CONFIG_PATH_CLAWDBOT = resolveConfigPath();
 
 export const DEFAULT_GATEWAY_PORT = 18789;
 
+const OAUTH_FILENAME = "oauth.json";
+
+/**
+ * OAuth credentials storage directory.
+ *
+ * Precedence:
+ * - `CLAWDBOT_OAUTH_DIR` (explicit override)
+ * - `CLAWDBOT_STATE_DIR/credentials` (canonical server/default)
+ * - `~/.clawdbot/credentials` (legacy default)
+ */
+export function resolveOAuthDir(
+  env: NodeJS.ProcessEnv = process.env,
+  stateDir: string = resolveStateDir(env, os.homedir),
+): string {
+  const override = env.CLAWDBOT_OAUTH_DIR?.trim();
+  if (override) return resolveUserPath(override);
+  return path.join(stateDir, "credentials");
+}
+
+export function resolveOAuthPath(
+  env: NodeJS.ProcessEnv = process.env,
+  stateDir: string = resolveStateDir(env, os.homedir),
+): string {
+  return path.join(resolveOAuthDir(env, stateDir), OAUTH_FILENAME);
+}
+
 export function resolveGatewayPort(
   cfg?: ClawdbotConfig,
   env: NodeJS.ProcessEnv = process.env,