openclaw - 💡(How to fix) Fix Gateway `update.run` handoff: child `openclaw update` exits with uv_cwd ENOENT, LaunchAgent left in bootout state

Summary

When the Gateway processes an update.run RPC, the spawned openclaw update --yes child inherits a cwd inside ~/.openclaw/tmp/openclaw-update-run-handoff-XXX/. The Gateway then SIGUSR1-exits to allow the supervisor to respawn. The temp directory is cleaned during that window, so a subsequent process.cwd() in the child fails:

ENOENT: process.cwd failed with error no such file or directory,
the current working directory was likely removed without changing
the working directory, uv_cwd

The child exits with code 1 after it has already called launchctl bootout gui/501/ai.openclaw.gateway but before it can bootstrap the LaunchAgent back. Result: LaunchAgent permanently unloaded, Gateway dead, no agent traffic until manual recovery.

Reproduced twice in 48h on the same machine while upgrading 2026.5.20 → 2026.5.22.

Evidence (from ~/.openclaw/tmp/openclaw-update-run-handoff-*/handoff.log)

starting managed update command: openclaw update --yes --timeout 1800
managed update command pid=83975
[restart] killing 1 stale gateway process(es) before restart: 83972
Stopped LaunchAgent: gui/501/ai.openclaw.gateway
Your OpenClaw config was written by version 2026.5.22, but this command is running 2026.5.20.
[openclaw] Reason: ENOENT: process.cwd failed with error no such file or directory,
  the current working directory was likely removed without changing the working directory, uv_cwd
managed update command exited code=1 signal=null

Post-failure state:

• launchctl print gui/501/ai.openclaw.gateway → not loaded
• Gateway dead; no recovery without manual launchctl bootstrap

Environment

• OpenClaw 2026.5.20 → 2026.5.22
• macOS 25.4.0 (Darwin), npm-managed install at /opt/homebrew/lib/node_modules/openclaw/
• LaunchAgent: ~/Library/LaunchAgents/ai.openclaw.gateway.plist

Suggested fixes

1. Spawn the update child with cwd set to a stable directory (e.g. ~/.openclaw or /), not the per-run temp handoff dir.
2. Wrap process.cwd() callers in try/catch for ENOENT during the update flow.
3. Make LaunchAgent restoration unconditional — even when the update child exits non-zero, the supervisor (or a post-exit hook) must bootstrap the LaunchAgent back. The current failure mode silently strands the service.

Workaround

Run updates from a normal terminal: openclaw update --yes. Avoid the in-band update.run until fixed.