PR #69425: daemon: honor OPENCLAW_WRAPPER in LaunchAgent ProgramArguments (#69400)

• Repository: openclaw/openclaw
• Author: sk7n4k3d
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/69425

Description (problem / solution / changelog)

Fixes #69400.

Summary

Teach resolveCliProgramArguments (the helper that builds macOS LaunchAgent / systemd ProgramArguments for openclaw gateway and openclaw node run services) to honor an OPENCLAW_WRAPPER environment variable. When set to an existing regular file, the resolver emits [<wrapper>, <gateway|node args...>] instead of [<node|bun>, <cli-entrypoint>, <args...>], so secrets-manager shims (Doppler, SOPS, 1Password CLI, sudo/run-as helpers) survive openclaw update / reinstall without manually repatching the generated plist.

Unset or invalid paths (missing file, directory, socket, etc.) transparently fall back to the existing Node/Bun entrypoint resolution, so this is a strict opt-in.

Why

Operators using a launchd service plus a secrets-wrapper binary currently have to re-edit /Library/LaunchAgents/ai.openclaw.gateway.plist after every upgrade because openclaw service install regenerates ProgramArguments from resolveCliProgramArguments and drops the wrapper shim. See the reproduction in #69400.

Implementation

• src/daemon/program-args.ts: add WRAPPER_ENV_KEY = "OPENCLAW_WRAPPER" plus resolveWrapperProgramArgs(params, env). It trims the env value, resolves the absolute path, fs.stats it, verifies isFile(), and only then returns the shortened programArguments. Any failure (unset/empty env, missing path, non-file) returns null and the existing resolver runs.
• resolveCliProgramArguments calls the wrapper resolver before any runtime/dev-mode branch. All existing runtime preferences (auto, node, bun, dev) remain unchanged when the wrapper is not active.
• src/daemon/program-args.test.ts: three regression tests (honor wrapper, ignore when missing, ignore when not a file), gated by process.env.OPENCLAW_WRAPPER within try/finally so they don't leak state. Added fsMocks.stat to the existing vi.hoisted mock pattern.

Operator example

<!-- ~/Library/LaunchAgents/ai.openclaw.gateway.plist -->
<key>EnvironmentVariables</key>
<dict>
  <key>OPENCLAW_WRAPPER</key>
  <string>/opt/homebrew/bin/openclaw-doppler</string>
</dict>

openclaw service install (and any subsequent openclaw update) will now keep emitting ProgramArguments = [/opt/homebrew/bin/openclaw-doppler, gateway, --port, 18789].

Verification

• pnpm test src/daemon/program-args.test.ts → 9/9 (6 pre-existing + 3 new).
• Full pnpm tsgo:all hits pre-existing failures in src/security/skill-scanner.test.ts on origin/main, unrelated to this change (verified by stashing and rerunning on bare upstream).

Notes

• Backwards compatible: no existing plist/systemd unit is rewritten; the feature only kicks in when the env var is explicitly set by the operator.
• The wrapper is expected to exec the real node/bun + CLI entry with the args it receives. This PR deliberately doesn't prescribe the wrapper contents — that's operator territory.
• AI-assisted contribution.

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/daemon/program-args.test.ts (modified, +81/-0)
• src/daemon/program-args.ts (modified, +27/-0)