name: "rejects mixed secret flags and file flags",

files: { token: "tok_file\n" },

args: (tokenFile: string) => ["--token", "tok_inline", "--token-file", tokenFile],

expected: /Use either --token or --token-file/,

expected: /Use either --token .*--token-file for Gateway token\./,

},

{

name: "rejects mixed password flags and file flags",

"--password-file",

passwordFile,

],

expected: /Use either --password or --password-file/,

expected: /Use either --passw.*d .*--password-file for Gateway password\./,

},

])("$name", async ({ files, args, expected }) => {

await withTempSecretFiles("openclaw-acp-cli-", files, async ({ tokenFile, passwordFile }) => {

).rejects.toThrow("__exit__:1");

expect(gatherDaemonStatus).not.toHaveBeenCalled();

expect(runtimeErrors.join("\n")).toContain("--require-rpc cannot be used with --no-probe");

expect(runtimeErrors[0]).toBe(

"Gateway status failed: --require-rpc needs probing enabled. Remove --no-probe or drop --require-rpc.",

);

});

});

await runDevicesCommand(["rotate", "--device", " ", "--role", "main"]);

expect(callGateway).not.toHaveBeenCalled();

expect(runtime.error).toHaveBeenCalledWith("--device and --role required");

expect(runtime.error).toHaveBeenCalledWith(

"--device and --role are required. Run openclaw devices list to choose a paired device.",

);

expect(runtime.exit).toHaveBeenCalledWith(1);

});

});

setDefaultModel: true,

}),

).rejects.toThrow(

'Auth choice "openai-codex-import" is no longer supported. Use "openai-codex" instead.',

'Auth choice "openai-codex-import" is no longer supported. Use "openai-codex" instead, or run openclaw onboard to choose interactively.',

);

} finally {

spy.mockRestore();

setDefaultModel: true,

}),

).rejects.toThrow(

'Auth choice "legacy\\u001b[31mchoice" is no longer supported. Use "modern\\nchoice" instead.',

'Auth choice "legacy\\u001b[31mchoice" is no longer supported. Use "modern\\nchoice" instead, or run openclaw onboard to choose interactively.',

);

} finally {

spy.mockRestore();