fix: reserve auth CLI root from plugin allowlist gating

src/cli/command-registration-policy.test.ts

@@ -50,6 +50,13 @@ describe("command-registration-policy", () => {
         hasBuiltinPrimary: false,
       }),
     ).toBe(false);
+    expect(
+      shouldSkipPluginCommandRegistration({
+        argv: ["node", "openclaw", "auth", "login"],
+        primary: "auth",
+        hasBuiltinPrimary: false,
+      }),
+    ).toBe(true);
     expect(
       shouldSkipPluginCommandRegistration({
         argv: ["node", "openclaw", "tool", "image_generate"],

src/cli/command-registration-policy.ts

@@ -1,7 +1,7 @@
 import { isTruthyEnvValue } from "../infra/env.js";
 import { resolveCliArgvInvocation } from "./argv-invocation.js";
 
-const RESERVED_NON_PLUGIN_COMMAND_ROOTS = new Set(["tool", "tools"]);
+const RESERVED_NON_PLUGIN_COMMAND_ROOTS = new Set(["auth", "tool", "tools"]);
 
 export function isReservedNonPluginCommandRoot(primary: string | null | undefined): boolean {
   return typeof primary === "string" && RESERVED_NON_PLUGIN_COMMAND_ROOTS.has(primary);

src/cli/run-main.exit.test.ts

@@ -400,6 +400,7 @@ describe("runCli exit behavior", () => {
   });
 
   it.each([
+    ["auth", ["node", "openclaw", "auth", "--help"]],
     ["tool", ["node", "openclaw", "tool", "image_generate"]],
     ["tools", ["node", "openclaw", "tools", "effective"]],
   ])("keeps reserved %s command roots out of plugin command discovery", async (_name, argv) => {

src/cli/run-main.test.ts

@@ -214,12 +214,14 @@ describe("resolveMissingPluginCommandMessage", () => {
   });
 
   it("does not classify reserved non-plugin command roots as plugin allowlist misses", () => {
-    const message = resolveMissingPluginCommandMessage("tool", {
-      plugins: {
-        allow: ["browser"],
-      },
-    });
-    expect(message).toBeNull();
+    for (const root of ["auth", "tool"]) {
+      const message = resolveMissingPluginCommandMessage(root, {
+        plugins: {
+          allow: ["browser"],
+        },
+      });
+      expect(message).toBeNull();
+    }
   });
 
   it("explains that dreaming is a runtime slash command, not a CLI command", () => {