openclaw - 💡(How to fix) Fix addUserForToken failure swallowed — RefreshingAuthProvider returned without a bound user

Related: #83727 (Twitch chat intent error) — same component, different code path. This finding is about addUserForToken rejections being silently caught, which can mask root cause of #83727-class errors.

Severity: high / Confidence: high / Category: bug Triage: confirmed-bug Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18) Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol (https://x.com/bradmillscan/status/2056377217437909178)

Evidence

• extensions/twitch/src/twitch-client.ts:35-51 (createAuthProvider)

await authProvider
        .addUserForToken({...})
        .then(...)
        .catch((err) => {
          this.logger.error(
            `Failed to add user to RefreshingAuthProvider: ${formatErrorMessage(err)}`,
          );
        });

Reasoning

The .catch() block on the addUserForToken chain logs the error and returns undefined, which satisfies the await. Execution continues and authProvider is returned at line 68 even though no user has been bound to it. The subsequent ChatClient will immediately fail to authenticate with an opaque error rather than the clear 'Failed to add user to RefreshingAuthProvider' message. This silently converts a hard setup failure into a delayed, confusing runtime auth error.

Reproduction

Configure an account with clientSecret but supply an invalid/expired accessToken. createAuthProvider logs the error but getClient proceeds to construct and store a ChatClient backed by a user-less RefreshingAuthProvider, which then fails on first send.

Recommendation

Re-throw in the .catch() block, or rewrite with try/catch and re-throw so getClient propagates the failure and does not store a broken client.

Why existing tests miss this

No test exercises createAuthProvider with a failing addUserForToken. The outbound and plugin tests mock sendMessageTwitchInternal / resolveTwitchAccountContext at a higher level and never reach createAuthProvider.

Suggested regression test

Unit-test TwitchClientManager.getClient with a RefreshingAuthProvider mock whose addUserForToken rejects; assert getClient rejects and that this.clients is not populated.

Minimum fix scope

Add throw err; as the last line inside the .catch() callback at twitch-client.ts:47-51.

Standardized clawpatch finding submission. Persistent across v2026.5.12 → v2026.5.18 — not resolved by upgrading. Finding ID: fnd_sig-feat-cli-command-0c715f7406-_1085fe108b.