[freeqaz]

Problem

#2988 renamed the sign-in field to Email and its hint to "Use your account email.", but a refused password sign-in still said "Could not sign in. Check your username and password." There is no username field any more (finding 2084).

Change

• The refusal now reads "Could not sign in. Check your email and password." Copy only: no sign-in logic, request or status handling changes. The recovery-only refusal and the 429 / unavailable messages are unchanged.
• tests/browser/console-status-block.test.mjs waits for the new sentence.

Verification

• node --test --test-name-pattern="Notices and the sign-in alert" tests/browser/console-status-block.test.mjs: on main's source, 1 of 3 pass ("an empty alert block stays in the accessibility tree until its refusal arrives" times out waiting for the new sentence); with the change, 3 of 3 pass.
• The touched test pinned 20/20 at 2 CPUs; the full file passes (32/32).
• Open PRs touching console.mjs (feat(console): Settings with Sign out and session facts #2996, feat: share discoverable Driver configuration definitions #2980, Restore the validated Console destination after session expiry #2979, feat(console): show the authorized native Gateway people roster #2596, feat(auth): sign people in to occ with a device code (rfc-0019) #1619, feat(console): stop and delete Agents from the Agents list #2524, feat: assign configured OpenClaw roles to Agent users #906): git merge-tree against this head shows the same conflicted files and hunk counts as against main (no new conflicts).

Screenshots (refused sign-in), before | after:

width	before	after
1440
390

No Storybook story covers the refused sign-in.

Risks

Low. One user-facing string; no doc or story quotes the old text.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR changes the failed password sign-in message from “username” to “email” and updates an existing browser assertion.

Example: A user submits operator@example.com with an incorrect password.

• Before: Could not sign in. Check your username and password.
• After: Could not sign in. Check your email and password.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The focused patch is correct and visually supported, but the repository's required UI evidence is incomplete.
Proof confidence	🦐 gold shrimp (3/6)	Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: A refused sign-in tells users to check a username although the form asks for an email address.
Reason: The collaborator-authored correction aligns the error with the already approved Email label without changing authentication behavior.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it correctly fixes a sign-in copy mismatch still present on current main, with no introduced correctness or security defect found.

Priority: P3
Reviewed head: 89c020607c4f568c8c07bb77ee156794913c0ba9

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: Complete the required visual walkthrough of a refused sign-in using the existing Invalid credentials story or the real console.

Agent review details

How this fits together

The console submits email and password to the authentication API, then maps a refused response to an accessible alert beside the sign-in form.

flowchart LR
  A[Email and password form] --> B[Authentication request]
  B --> C[Authentication API]
  C --> D[Refused response]
  D --> E[Console error mapping]
  E --> F[Accessible sign-in alert]

Loading

Technical review

Best possible solution:

Retain the focused string correction and existing browser coverage.

Do we have a high-confidence way to reproduce the issue?

Current-main source establishes the mismatch, and supplied before screenshots show it at desktop and phone widths; no target code was run during this read-only review.

Is this the best way to solve the issue?

Changing the existing message and updating its existing browser assertion is the smallest complete fix.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6c5bbd6ff8ce.

Provenance checked

• Password refusal copy keeps the original intent (6992337: feat(auth): allow password sign-in only for recovery when external sign-in is configured #723 introduced recovery-only password handling and its separate refusal guidance.)
• Existing browser assertion keeps the original intent (22283f6: test(console): consolidate the console browser tests added since #2903 #2947 consolidated existing browser scenarios while preserving their assertions.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Focused introduced diff: The pinned introduction changes only one production string and its existing browser assertion; request handling and recovery-only behavior remain intact. (apps/controller/src/console/console.mjs:990, 89c020607c4f)
• Current main retains the mismatch: Fetched main labels the input Email but still tells users to check their username after a refused password sign-in. (apps/controller/src/console/console.mjs:990, 6c5bbd6ff8ce)
• Existing browser coverage: The changed assertion follows a real form submission with an incorrect password and retains the test of alert-node continuity in Chromium's accessibility tree. (tests/browser/console-status-block.test.mjs:369, 89c020607c4f)
• Visual evidence inspected: All four downloaded screenshots were inspected: before and after at 1440 and 390 pixels show the exact wording change and readable wrapping. (89c020607c4f)
• Applicable visual verification requirement: Root policy requires screenshots and a short walkthrough video for UI changes; the supplied evidence contains screenshots but no video. (AGENTS.md:454, 89c020607c4f)
• Existing refused-sign-in story: Contrary to the PR body's statement, Pages/Sign in → Invalid credentials already submits a password form against a 401 scenario. (scripts/console-storybook/public/scenarios.mjs:642, 89c020607c4f)

Likely related people:

• freeqaz: Raw commit 6992337 adds apps/controller/src/console/console.mjs:328 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 69923374ecbc; files: apps/controller/src/console/console.mjs)
• kevinlin-openai: Raw commit 3474bb7 adds apps/controller/src/console/console.mjs:148 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 3474bb717fff; files: apps/controller/src/console/console.mjs)

Labels

Label changes:

• add P3: This is a small user-facing wording correction; authentication remains functional.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is a small user-facing wording correction; authentication remains functional.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Complete the refused-sign-in walkthrough and attach the required screenshot and video evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 11:56 PM ET / October 20, 2026, 03:56 UTC.