openclaw - 💡(How to fix) Fix Backup --verify fails with double manifest.json when TMPDIR is inside backup source path

Problem

When running openclaw backup create --verify --output ~/Backups, verification fails with:

Expected exactly one backup manifest entry, found 2

Root Cause

OpenClaw sets TMPDIR to ~/.openclaw/tmp for macOS launchd services (in src/daemon/service-env.ts):

function resolveServiceTmpDir(env, platform) {
  if (platform === "darwin") {
    try {
      return path.join(resolveGatewayStateDir(env), "tmp");  // → ~/.openclaw/tmp
    } catch {
      return env.TMPDIR?.trim() || os.tmpdir();
    }
  }
}

When backing up ~/.openclaw, the temp manifest.json is placed inside a backup source path. Tar recursive traversal includes it twice:

1. Explicitly passed to tar.c as an argument
2. Via recursive walk of ~/.openclaw (which includes ~/.openclaw/tmp)

Both copies remap to <archiveRoot>/manifest.json, causing verification to fail.

Expected Behavior

chooseBackupTempRoot() in src/infra/backup-create.ts should detect TMPDIR inside the asset and use fallback to path.dirname(outputPath). However, this fallback logic does not work as expected.

Environment

• macOS (Darwin 25.4.0 arm64)
• OpenClaw running as launchd service
• TMPDIR: /Users/arlen8411/.openclaw/tmp
• Backup asset: state: ~/.openclaw
• Output: ~/Backups

Workaround

Running backup without --verify works. Alternatively, override TMPDIR:

TMPDIR=/tmp openclaw backup create --verify --output ~/Backups

Suggested Fix

Either:

1. Ensure chooseBackupTempRoot() fallback works correctly
2. Or exclude TMPDIR-derived temp paths from tar traversal when they overlap with assets
3. Or use system temp directory for backup operations specifically