Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: gateway install --force does not remove embedded service token in 2026.4.21 [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#70612•Fetched 2026-04-24 05:55:44
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Author
PhluttrPhluttr
Participants
PhluttrPhluttr
Timeline (top)
labeled ×2

Version: 2026.4.21 (f788c88) Steps: run openclaw gateway install --force Expected: plist contains no literal secret <string> values, only OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough Actual: plist contains both — passthrough list AND literal embedded values for DISCORD_TOKEN, OPENCLAW_GATEWAY_TOKEN, TAVILY_API_KEY, OPENROUTER_API_KEY, OLLAMA_CLOUD_API_KEY

Root Cause

Version: 2026.4.21 (f788c88) Steps: run openclaw gateway install --force Expected: plist contains no literal secret <string> values, only OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough Actual: plist contains both — passthrough list AND literal embedded values for DISCORD_TOKEN, OPENCLAW_GATEWAY_TOKEN, TAVILY_API_KEY, OPENROUTER_API_KEY, OLLAMA_CLOUD_API_KEY

Fix Action

Fixed

PR fix notes

PR #70968: fix(gateway): remove literal managed env values from install plan

Description (problem / solution / changelog)

Summary

  • openclaw gateway install --force embeds literal secret values (DISCORD_TOKEN, OPENCLAW_GATEWAY_TOKEN, etc.) in the macOS LaunchAgent plist alongside OPENCLAW_SERVICE_MANAGED_ENV_KEYS
  • At runtime loadRuntimeDotEnvFile skips loading .env values when process.env[key] !== undefined, so stale plist values persist after .env changes
  • This PR removes literal values of managed keys from the install plan environment — only the OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough list is kept, so the gateway loads fresh values from .env at startup

Fixes #70612

Test plan

  • Updated daemon-install-helpers.test.ts — all 4 affected test cases now verify managed keys have no literal values in the plist environment
  • pnpm test src/commands/daemon-install-helpers.test.ts — 13/13 pass
  • pnpm check — lint, type-check, import cycle checks all pass

Changed files

  • src/commands/daemon-install-helpers.test.ts (modified, +19/-10)
  • src/commands/daemon-install-helpers.ts (modified, +12/-0)
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Version: 2026.4.21 (f788c88) Steps: run openclaw gateway install --force Expected: plist contains no literal secret <string> values, only OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough Actual: plist contains both — passthrough list AND literal embedded values for DISCORD_TOKEN, OPENCLAW_GATEWAY_TOKEN, TAVILY_API_KEY, OPENROUTER_API_KEY, OLLAMA_CLOUD_API_KEY

Steps to reproduce

  1. Start from OpenClaw 2026.4.21 (f788c88) installed via npm/pnpm at /opt/homebrew/lib/node_modules/openclaw.
  2. Have gateway.auth.token configured as SecretRef-managed in ~/.openclaw/openclaw.json, and have OPENCLAW_GATEWAY_TOKEN (and other secrets: DISCORD_TOKEN, TAVILY_API_KEY, OPENROUTER_API_KEY, OLLAMA_CLOUD_API_KEY) set in ~/.openclaw/.env.
  3. Run: openclaw gateway install --force
  4. Observe stdout: "gateway.auth.token is SecretRef-managed; install will not persist a resolved token in service environment."
  5. Run: grep -B1 -A3 "OPENCLAW_GATEWAY_TOKEN" ~/Library/LaunchAgents/ai.openclaw.gateway.plist
  6. Observe: plist contains literal <string>VALUE</string> entries for OPENCLAW_GATEWAY_TOKEN, DISCORD_TOKEN, TAVILY_API_KEY, OPENROUTER_API_KEY, and OLLAMA_CLOUD_API_KEY, in addition to the OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough list.
  7. Run: openclaw gateway status
  8. Observe warning: "Gateway service embeds OPENCLAW_GATEWAY_TOKEN and should be reinstalled. (Run openclaw gateway install --force to remove embedded service token.)" — i.e., the command the installer recommends is the command that just failed to remove the embedded token.

Expected: step 6 shows only the OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough list with no literal secret <string> values; step 8 shows no embed warning. Actual: literal secret values remain embedded; warning persists across repeated --force invocations.

Repro is deterministic: reproduced twice in one session on macOS (Mac mini M4, 24GB), and a third time after openclaw update (which was a no-op: 2026.4.21 → 2026.4.21).

Expected behavior

After openclaw gateway install --force completes, /Library/LaunchAgents/ai.openclaw.gateway.plist contains no literal <string> values for any SecretRef-managed or .env-sourced secret (OPENCLAW_GATEWAY_TOKEN, DISCORD_TOKEN, TAVILY_API_KEY, OPENROUTER_API_KEY, OLLAMA_CLOUD_API_KEY). The plist references these secrets only by name via the OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough list, and the gateway daemon resolves their values at runtime from the configured SecretRef source (/.openclaw/.env). openclaw gateway status reports no "embeds OPENCLAW_GATEWAY_TOKEN" warning and no "Service config looks out of date or non-standard" warning.

Actual behavior

After openclaw gateway install --force completes, ~/Library/LaunchAgents/ai.openclaw.gateway.plist contains both:

  1. The OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough list naming the secrets: <key>OPENCLAW_SERVICE_MANAGED_ENV_KEYS</key> <string>DISCORD_TOKEN,OLLAMA_CLOUD_API_KEY,OPENCLAW_GATEWAY_TOKEN,OPENROUTER_API_KEY,TAVILY_API_KEY</string>

  2. Literal <key>/<string> pairs embedding the resolved secret values, e.g.: <key>OPENCLAW_GATEWAY_TOKEN</key> <string><resolved token value></string> <key>TAVILY_API_KEY</key> <string>tvly-dev-<resolved value></string> (and equivalent entries for DISCORD_TOKEN, OPENROUTER_API_KEY, OLLAMA_CLOUD_API_KEY)

openclaw gateway status continues to report: "Service config looks out of date or non-standard." "Service config issue: Gateway service embeds OPENCLAW_GATEWAY_TOKEN and should be reinstalled. (Run openclaw gateway install --force to remove embedded service token.)"

The warning persists across repeated openclaw gateway install --force invocations and across an openclaw update run (no-op, 2026.4.21 → 2026.4.21). The installer's own stdout — "install will not persist a resolved token in service environment" — is contradicted by the plist contents it writes. Gateway functionality is unaffected; runtime, connectivity probe, and port binding are all healthy.

OpenClaw version

2026.4.21 (build f788c88)

Operating system

MacOS Tahoe 26.4.1

Install method

No response

Model

NOT_ENOUGH_INFO The bug is in the installer / plist-writing code path, which is independent of any LLM. No model was "under test" for this defect — the failing component is openclaw gateway install --force, not an agent inference call. If the bug report form requires a model field anyway, it should be marked N/A or the field should be omitted. If you meant something different by "effective model under test" (e.g., the primary model your agent would have been using at the time of the crash), the memory notes the primary as gpt-5.4 via openai-codex OAuth with a documented fallback chain — but that's not what caused or reproduces this bug.

Provider / routing chain

Primary: gpt-5.4 via openai-codex OAuth

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

TL;DR

The issue can be fixed by modifying the openclaw gateway install --force command to correctly remove embedded secret tokens from the plist file.

Guidance

  • Review the openclaw gateway install --force command to ensure it is correctly configured to remove embedded secret tokens.
  • Verify that the OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough list is correctly populated with the secret names.
  • Check the plist file (~/Library/LaunchAgents/ai.openclaw.gateway.plist) for any remaining literal secret values after running the openclaw gateway install --force command.
  • Consider manually editing the plist file to remove any embedded secret tokens if the command is not working as expected.

Example

No code snippet is provided as the issue is related to the configuration and behavior of the openclaw gateway install --force command.

Notes

The issue is specific to the openclaw gateway install --force command and the plist file it generates. The problem is not related to the model or provider setup.

Recommendation

Apply a workaround by manually editing the plist file to remove embedded secret tokens if the openclaw gateway install --force command is not working as expected. This is because the command is not correctly removing the embedded tokens, and manual intervention is required to resolve the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

After openclaw gateway install --force completes, /Library/LaunchAgents/ai.openclaw.gateway.plist contains no literal <string> values for any SecretRef-managed or .env-sourced secret (OPENCLAW_GATEWAY_TOKEN, DISCORD_TOKEN, TAVILY_API_KEY, OPENROUTER_API_KEY, OLLAMA_CLOUD_API_KEY). The plist references these secrets only by name via the OPENCLAW_SERVICE_MANAGED_ENV_KEYS passthrough list, and the gateway daemon resolves their values at runtime from the configured SecretRef source (/.openclaw/.env). openclaw gateway status reports no "embeds OPENCLAW_GATEWAY_TOKEN" warning and no "Service config looks out of date or non-standard" warning.

#api#model save/load#optimization#mixed precision#training loop

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: gateway install --force does not remove embedded service token in 2026.4.21 [1 pull requests, 1 participants]