Summary

openclaw agent --local --json --message "..." writes its full JSON result envelope to stderr instead of stdout, leaving stdout empty. The gateway-mode --json path is unaffected. Confirmed against openclaw 2026.3.28.

Reproduction

```sh openclaw agent --agent <some-local-capable-agent> --local --json
--message "Health check: print 'pong' and stop." \

/tmp/out.txt 2>/tmp/err.txt echo "exit=$?" wc -l /tmp/out.txt /tmp/err.txt jq . /tmp/err.txt | head ```

Expected: stdout contains the JSON envelope; stderr is empty (or contains only diagnostic logs). Actual: stdout is empty (0 lines); stderr contains a few diagnostic log lines followed by the full JSON envelope.

Root cause

In the 2026.3.28 dist:

1. `program-CqrUwYvG.js:115` — when `--json` is detected, the preAction hook calls `routeLogsToStderr()`.
2. `subsystem-CJEvHE2o.js:188-189` — `routeLogsToStderr()` sets `loggingState.forceConsoleToStderr = true`.
3. `subsystem-CJEvHE2o.js:434-440` — `writeConsoleLine()` then routes all `console.log` calls (including plain `log` level) to `process.stderr`. Intent: keep noise out of the JSON on stdout.
4. `subsystem-CJEvHE2o.js:90-105` — the runtime exposes two output paths: `runtime.log()` (which goes through `console.log` → `writeConsoleLine` → now stderr) and `runtime.writeJson()` / `writeStdout()` (which go directly to `process.stdout.write`, bypassing the console interceptor).
5. `subsystem-CJEvHE2o.js:123-129` — the dispatcher `writeRuntimeJson(runtime, value)` correctly prefers `runtime.writeJson` when available. The gateway-mode agent command (`register.agent-D2kkuHjC.js:86-88`) uses this path correctly.
6. `auth-profiles-B5ypC5S-.js:215787-215796` — but the local-mode `agentCommand` does not. It calls: ```js if (opts.json) { runtime.log(JSON.stringify(buildOutboundResultEnvelope({...}), null, 2)); ... } ``` which goes through `console.log` → `writeConsoleLine` → stderr (because `forceConsoleToStderr === true`). This is the bug.

Suggested fix

One-line change at `auth-profiles-B5ypC5S-.js:215787-215796` (or its TypeScript source equivalent — likely `src/agents/cli/local/agent-command.ts` or similar):

```diff

• runtime.log(JSON.stringify(buildOutboundResultEnvelope({

• runtime.writeJson(buildOutboundResultEnvelope({ payloads: normalizedPayloads, meta: result.meta

• }), null, 2));

• })); ```

`runtime.writeJson` already uses `process.stdout.write` directly and is what the gateway-mode path uses. Default pretty-print indent is 2. This makes local-mode match gateway-mode behavior.

Impact

Any consumer that scripts `openclaw agent --local --json` and reads stdout sees empty input and assumes the agent failed silently. In our case this hit a `cliBackends.nemoclaw` config that points the gateway back at openclaw itself for containerized execution — every cron run was producing empty payloads despite the agent succeeding.

Workaround

Local patch that surgically replaces the line: https://github.com/tamakiii/openclaw-workspace/blob/main/patches/openclaw/auth-profiles-fix-local-json-fd.patch (will be live once tamakiii/openclaw-workspace#TBD merges).

Environment

• openclaw `2026.3.28`
• node `v24.14.0`
• linux x86_64