openclaw - 💡(How to fix) Fix Bug: gateway service env renders Supermemory API key as literal env reference

Summary

On OpenClaw 2026.5.27 (27ae826), the generated gateway LaunchAgent service environment can persist the Supermemory plugin API key as a literal environment reference instead of a resolved value:

export SUPERMEMORY_OPENCLAW_API_KEY='"$SUPERMEMORY_OPENCLAW_KEY"'

The Supermemory plugin then receives the literal string "$SUPERMEMORY_OPENCLAW_KEY" and fails validation because it does not start with sm_.

This is especially visible after openclaw gateway install, openclaw gateway restart, or an OpenClaw update, because the generated service-env wrapper is overwritten and any local runtime workaround is lost.

Environment

• OpenClaw CLI: 2026.5.27 (27ae826)
• Gateway service: LaunchAgent on macOS
• Plugin: @supermemory/[email protected]
• Config shape:

{
  "plugins": {
    "entries": {
      "openclaw-supermemory": {
        "enabled": true,
        "config": {
          "apiKey": "${SUPERMEMORY_OPENCLAW_API_KEY}"
        }
      }
    }
  }
}

Observed behavior

The generated service env contains:

export SUPERMEMORY_OPENCLAW_API_KEY='"$SUPERMEMORY_OPENCLAW_KEY"'

CLI/plugin startup then reports:

[plugins] openclaw-supermemory failed during register ... Error: invalid API key: key must start with sm_ prefix

The generated wrapper is also rewritten to the generic wrapper on service install/restart/update, so a manual wrapper workaround that resolves the key from a secret manager is not durable.

Expected behavior

One of these should happen:

1. Service env rendering should resolve or omit nested env references rather than persisting them as literal quoted strings.
2. The installer should preserve an already-valid durable value source for SUPERMEMORY_OPENCLAW_API_KEY.
3. The Supermemory plugin config schema should support SecretRef/object-style secrets again, so the API key does not need to be converted into a plaintext string or brittle service env value.

Additional notes

Attempting the older SecretRef-style plugin config no longer validates on 2026.5.27; plugins.entries.openclaw-supermemory.config.apiKey is rejected unless it is a string:

plugins.entries.openclaw-supermemory.config.apiKey: invalid config: must be string

Current local workaround:

• Keep apiKey as "${SUPERMEMORY_OPENCLAW_API_KEY}".
• Modify the generated gateway env wrapper to detect the bad literal value and resolve the real key at runtime from the configured secret manager.

That workaround works, but it is overwritten by generated service-env updates.