PR #77876: fix(doctor): exit non-zero on final invalid config (#77804)

• Repository: openclaw/openclaw
• Author: koshaji
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/77876

Description (problem / solution / changelog)

Summary

openclaw doctor prints Invalid config: … when the final config validation step finds problems, but the process still exits 0, falsely reassuring CI/CD pipelines and wrapper scripts that the config is healthy. Issue #77804 reports the exact mix of "Doctor complete." (success framing) followed by Invalid config: … returning $LASTEXITCODE = 0 on Windows PowerShell, but the same path is taken on every platform.

The bug is two-step:

1. runFinalConfigValidationHealth in src/flows/doctor-health-contributions.ts detected the invalid snapshot but never set process.exitCode.
2. The doctor action in src/cli/program/register.maintenance.ts hardcoded defaultRuntime.exit(0) after doctorCommand returned, which would have overridden any process.exitCode set inside the flow anyway.

This PR fixes both halves:

• runFinalConfigValidationHealth now sets process.exitCode = 1 after emitting the Invalid config: lines, only when the current process.exitCode is falsy (so it does not lower a non-zero code already set earlier in the run).
• The doctor registration now exits via defaultRuntime.exit(process.exitCode ?? 0) instead of defaultRuntime.exit(0), so the signal from the flow is honored. All other surrounding behavior is unchanged.

outro("Doctor complete.") wording is preserved per AGENTS.md additive philosophy. No new flag, no new option, no behavior change for valid configs. Companion issue #77802 (doctor --fix atomicity / last-known-good auto-restore) is intentionally out of scope here — that touches recovery-policy.ts and is a separate design call; I commented on the issue to surface that.

Real behavior proof

• Behavior or issue addressed: openclaw doctor exits 0 even though it printed Invalid config: … at the end of the run, masking unhealthy configs from CI/CD and wrapper scripts. Tracked in #77804.

• Real environment tested: macOS Darwin 25.4.0 / Node v25.9.0 (arm64) on a real openclaw checkout, running the full node openclaw.mjs doctor launcher against a real ~/.openclaw-77804repro/openclaw.json written to disk with an invalid bailian provider shape.

• Exact steps or command run after this patch:

  mkdir -p ~/.openclaw-77804repro
  cat > ~/.openclaw-77804repro/openclaw.json <<'JSON'
  { "models": { "providers": { "bailian": { "models": { "qwen-plus": { "compat": { "thinkingFormat": "not-a-real-format" } } } } } } }
  JSON
  node openclaw.mjs --profile 77804repro --no-color doctor --non-interactive --no-workspace-suggestions
  echo "EXIT=$?"

• Evidence after fix: live runtime stdout captured before and after the patch was applied to the same launcher and same on-disk config.

  Before the patch — exit 0, masking the failure:

  Run "openclaw --profile 77804repro doctor --fix" to apply changes.
  Invalid config:
  - models.providers.bailian.baseUrl: Invalid input: expected string, received undefined
  - models.providers.bailian.models: Invalid input: expected array, received object
  │
  └  Doctor complete.
  EXIT=0

  After the patch — same Invalid config: block, but exit 1:

  Run "openclaw --profile 77804repro doctor --fix" to apply changes.
  Invalid config:
  - models.providers.bailian.baseUrl: Invalid input: expected string, received undefined
  - models.providers.bailian.models: Invalid input: expected array, received object
  │
  └  Doctor complete.
  EXIT=1

• Observed result after fix: node openclaw.mjs doctor against a real openclaw.json that fails final validation now terminates with shell exit code 1 while preserving the existing user-facing output, including the "Doctor complete." closing line. CI/CD pipelines and shell wrappers that branch on the exit code (if openclaw doctor; then …) will now see the failure they previously missed.

• What was not tested: No Windows PowerShell live run was performed locally — the issue reporter is on PowerShell on Windows 10. The fix path is platform-agnostic (process.exitCode semantics are identical across Node-supported OSes), and the policy is exercised by Vitest, but a Windows live run was not feasible in this environment.

Fixes #77804.

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/cli/program/register.maintenance.test.ts (modified, +19/-1)
• src/cli/program/register.maintenance.ts (modified, +1/-1)
• src/flows/doctor-health-contributions.test.ts (modified, +91/-1)
• src/flows/doctor-health-contributions.ts (modified, +3/-0)