fix(config): collect GEMINI_API_KEY from system env into managed service keys

Alix-007 · Alix-007 · commit 6d623b8bd02a · 2026-06-23T09:34:05.000+08:00
When GEMINI_API_KEY is set in the system environment but not in the config env section or .env file, it was written as a plaintext literal in the generated systemd service file instead of being managed via OPENCLAW_SERVICE_MANAGED_ENV_KEYS. Add GEMINI_API_KEY (and related GOOGLE_API_KEY, GEMINI_API_KEYS, GEMINI_API_KEY_0) to the list of provider API keys collected from the system environment into durableEnvironment, so they are included in the managed service env keys list. Fixes #95895
diff --git a/src/config/state-dir-dotenv.ts b/src/config/state-dir-dotenv.ts
@@ -127,19 +127,41 @@ export type DurableServiceEnvVarSources = {
   durableEnvironment: Record<string, string>;
 };
 
+/** Provider API key env vars that should be collected from the system environment
+ *  into durableEnvironment when not already present from .env or config.
+ *  Prevents them from being written as plaintext literals in generated service
+ *  files instead of being managed via OPENCLAW_SERVICE_MANAGED_ENV_KEYS (#95895). */
+const PROVIDER_ENV_API_KEYS = [
+  "GEMINI_API_KEY",
+  "GEMINI_API_KEYS",
+  "GEMINI_API_KEY_0",
+  "GOOGLE_API_KEY",
+] as const;
+
 /** Collects durable service env vars from state-dir `.env` and config, preserving each source. */
 export function collectDurableServiceEnvVarSources(params: {
   env: Record<string, string | undefined>;
   config?: OpenClawConfig;
 }): DurableServiceEnvVarSources {
   const stateDirDotEnvEnvironment = readStateDirDotEnvVars(params.env);
   const configEnvironment = collectConfigServiceEnvVars(params.config);
+  // Collect provider API keys from the system environment when not already present
+  // in .env or config. This prevents them from being written as plaintext literals
+  // in generated service files instead of being managed via OPENCLAW_SERVICE_MANAGED_ENV_KEYS.
+  const systemEnvProviderKeys: Record<string, string> = {};
+  for (const key of PROVIDER_ENV_API_KEYS) {
+    const value = params.env[key]?.trim();
+    if (value && !stateDirDotEnvEnvironment[key] && !configEnvironment[key]) {
+      systemEnvProviderKeys[key] = value;
+    }
+  }
   return {
     stateDirDotEnvEnvironment,
     configEnvironment,
     durableEnvironment: {
       ...stateDirDotEnvEnvironment,
       ...configEnvironment,
+      ...systemEnvProviderKeys,
     },
   };
 }
