PR #70378: fix(cli): respect OPENCLAW_GATEWAY_TOKEN env var in gateway RPC calls

• Repository: openclaw/openclaw
• Author: hclsys
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/70378

Description (problem / solution / changelog)

Summary

Fixes #70365 (part 1: env-var propagation). The CLI's `callGatewayFromCliRuntime` passed the `--token` flag value through to `callGateway` verbatim, with no fallback to the `OPENCLAW_GATEWAY_TOKEN` env var that the embedded agent and much of the rest of the runtime already read (`src/pairing/setup-code.ts`, `src/cli/qr-cli.ts`, `src/cli/gateway-cli/run.ts`).

Result: when the token lives in env, `openclaw status` and friends hang for ~16s before failing. The documented workaround is to append `--token "$OPENCLAW_GATEWAY_TOKEN"` to every command.

Fix

Add `resolveCliGatewayToken(flagToken)` that falls back to the env var:

1. explicit `--token` flag (unchanged behavior when passed)
2. `OPENCLAW_GATEWAY_TOKEN` env var (new fallback)
3. undefined (unchanged behavior when nothing is set)

Empty-string `--token` is treated as unset so the env fallback still applies — matches how other token-resolver sites in the codebase handle missing values.

Test

4 new regression tests in `src/cli/gateway-rpc.runtime.test.ts` cover: env used when flag absent, flag preferred over env, empty-string flag falls through, both absent ⇒ undefined.

oxlint clean.

Scope note

Part 2 of #70365 (TLS detection for empty `gateway.tls: {}`) is a separate concern in a different file — deliberately scoped out of this PR to keep the diff surgical. Happy to follow up if you'd like both fixed in one land.

Closes #70365 (partial — env propagation only).

Changed files

• src/cli/gateway-rpc.runtime.test.ts (added, +56/-0)
• src/cli/gateway-rpc.runtime.ts (modified, +18/-1)