fix(daemon): preserve systemd env-file secrets on re-stage

HCL · claude · steipete · commit f8f881f63fab · 2026-05-04T00:34:18.000+01:00
Co-authored-by: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -32,6 +32,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Gateway/systemd: preserve operator-added secrets in the Gateway env file across re-stage while clearing OpenClaw-managed keys (such as `OPENCLAW_GATEWAY_TOKEN`) so a fresh staging value is never shadowed by a stale env-file copy; operator secrets are also retained when the state-dir `.env` is empty. Fixes #76860. Thanks @hclsys.
 - OpenAI/Google Meet: wait for realtime voice `session.updated` before treating the bridge as connected, so Meet joins do not return with audio queued behind an unconfigured realtime session. Thanks @vincentkoc.
 - Plugins/catalog: merge official external catalog descriptors into partial package channel config metadata, so lagging WeCom/Yuanbao manifests keep their own schema while still exposing host-supplied labels and setup text. Thanks @vincentkoc.
 - Plugins/catalog: supplement lagging official external WeCom and Yuanbao npm manifests with channel config descriptors and declared tool contracts from the OpenClaw catalog, so trusted package sweeps no longer fail because external package metadata trails the host contract. Thanks @vincentkoc.
diff --git a/src/commands/configure.daemon.ts b/src/commands/configure.daemon.ts
@@ -116,13 +116,14 @@ export async function maybeInstallDaemon(params: {
           progress.setLabel("Gateway service install blocked.");
           return;
         }
-        const { programArguments, workingDirectory, environment } = await buildGatewayInstallPlan({
-          env: process.env,
-          port: params.port,
-          runtime: daemonRuntime,
-          warn: (message, title) => note(message, title),
-          config: cfg,
-        });
+        const { programArguments, workingDirectory, environment, environmentValueSources } =
+          await buildGatewayInstallPlan({
+            env: process.env,
+            port: params.port,
+            runtime: daemonRuntime,
+            warn: (message, title) => note(message, title),
+            config: cfg,
+          });
 
         progress.setLabel("Installing Gateway service…");
         try {
@@ -132,6 +133,7 @@ export async function maybeInstallDaemon(params: {
             programArguments,
             workingDirectory,
             environment,
+            environmentValueSources,
           });
           progress.setLabel("Gateway service installed.");
         } catch (err) {
diff --git a/src/commands/daemon-install-helpers.test.ts b/src/commands/daemon-install-helpers.test.ts
@@ -838,6 +838,38 @@ describe("buildGatewayInstallPlan — dotenv merge", () => {
     expect(plan.environment.CUSTOM_TOOL_HOME).toBe("/Users/test/.custom-tool");
   });
 
+  it("keeps source metadata for EnvironmentFile-backed preserved vars", async () => {
+    mockNodeGatewayPlanFixture({
+      serviceEnvironment: {
+        HOME: "/from-service",
+        OPENCLAW_PORT: "3000",
+      },
+    });
+
+    const plan = await buildGatewayInstallPlan({
+      env: { HOME: tmpDir },
+      port: 3000,
+      runtime: "node",
+      existingEnvironment: {
+        OPENROUTER_API_KEY: "or-operator-key",
+        CUSTOM_TOOL_HOME: "/Users/test/.custom-tool",
+        OPENCLAW_GATEWAY_TOKEN: "old-token",
+      },
+      existingEnvironmentValueSources: {
+        OPENROUTER_API_KEY: "file",
+        CUSTOM_TOOL_HOME: "inline",
+        OPENCLAW_GATEWAY_TOKEN: "file",
+      },
+    });
+
+    expect(plan.environment.OPENROUTER_API_KEY).toBe("or-operator-key");
+    expect(plan.environmentValueSources?.OPENROUTER_API_KEY).toBe("file");
+    expect(plan.environment.CUSTOM_TOOL_HOME).toBe("/Users/test/.custom-tool");
+    expect(plan.environmentValueSources?.CUSTOM_TOOL_HOME).toBe("inline");
+    expect(plan.environment.OPENCLAW_GATEWAY_TOKEN).toBeUndefined();
+    expect(plan.environmentValueSources?.OPENCLAW_GATEWAY_TOKEN).toBeUndefined();
+  });
+
   it("does not embed auth-profile env refs when the key is already durable", async () => {
     await writeStateDirDotEnv("OPENAI_API_KEY=dotenv-openai\n", {
       stateDir: path.join(tmpDir, ".openclaw"),
diff --git a/src/commands/daemon-install-helpers.ts b/src/commands/daemon-install-helpers.ts
@@ -20,6 +20,7 @@ import {
   writeManagedServiceEnvKeysToEnvironment,
 } from "../daemon/service-managed-env.js";
 import { isNonMinimalServicePathEntry } from "../daemon/service-path-policy.js";
+import type { GatewayServiceEnvironmentValueSource } from "../daemon/service-types.js";
 import {
   isDangerousHostEnvOverrideVarName,
   isDangerousHostEnvVarName,
@@ -40,6 +41,7 @@ type GatewayInstallPlan = {
   programArguments: string[];
   workingDirectory?: string;
   environment: Record<string, string | undefined>;
+  environmentValueSources?: Record<string, GatewayServiceEnvironmentValueSource | undefined>;
 };
 
 let daemonInstallAuthProfileSourceRuntimePromise:
@@ -360,6 +362,22 @@ function collectPreservedExistingServiceEnvVars(
   return preserved;
 }
 
+function readExistingEnvironmentValueSource(params: {
+  existingEnvironmentValueSources?: Record<
+    string,
+    GatewayServiceEnvironmentValueSource | undefined
+  >;
+  normalizedKey: string;
+}): GatewayServiceEnvironmentValueSource | undefined {
+  for (const [rawKey, source] of Object.entries(params.existingEnvironmentValueSources ?? {})) {
+    const key = normalizeEnvVarKey(rawKey, { portable: true })?.toUpperCase();
+    if (key === params.normalizedKey) {
+      return source;
+    }
+  }
+  return undefined;
+}
+
 function resolveGatewayInstallWorkingDirectory(params: {
   env: Record<string, string | undefined>;
   platform: NodeJS.Platform;
@@ -381,8 +399,15 @@ async function buildGatewayInstallEnvironment(params: {
   warn?: DaemonInstallWarnFn;
   serviceEnvironment: Record<string, string | undefined>;
   existingEnvironment?: Record<string, string | undefined>;
+  existingEnvironmentValueSources?: Record<
+    string,
+    GatewayServiceEnvironmentValueSource | undefined
+  >;
   platform: NodeJS.Platform;
-}): Promise<Record<string, string | undefined>> {
+}): Promise<{
+  environment: Record<string, string | undefined>;
+  environmentValueSources: Record<string, GatewayServiceEnvironmentValueSource | undefined>;
+}> {
   const durableEnvironment = collectDurableServiceEnvVars({
     env: params.env,
     config: params.config,
@@ -404,21 +429,47 @@ async function buildGatewayInstallEnvironment(params: {
     authStore: params.authStore,
     warn: params.warn,
   });
+  const preservedExistingEnvironment = collectPreservedExistingServiceEnvVars(
+    params.existingEnvironment,
+    readManagedServiceEnvKeysFromEnvironment(params.existingEnvironment),
+  );
   const environment: Record<string, string | undefined> = {
-    ...collectPreservedExistingServiceEnvVars(
-      params.existingEnvironment,
-      readManagedServiceEnvKeysFromEnvironment(params.existingEnvironment),
-    ),
+    ...preservedExistingEnvironment,
     ...durableEnvironment,
     ...configSecretRefEnvironment,
     ...execSecretRefPassEnvEnvironment,
     ...authProfileEnvironment,
   };
+  const environmentValueSources: Record<string, GatewayServiceEnvironmentValueSource | undefined> =
+    {};
+  for (const rawKey of Object.keys(preservedExistingEnvironment)) {
+    const normalizedKey = normalizeEnvVarKey(rawKey, { portable: true })?.toUpperCase();
+    environmentValueSources[rawKey] = normalizedKey
+      ? (readExistingEnvironmentValueSource({
+          existingEnvironmentValueSources: params.existingEnvironmentValueSources,
+          normalizedKey,
+        }) ?? "inline")
+      : "inline";
+  }
+  for (const key of Object.keys({
+    ...durableEnvironment,
+    ...configSecretRefEnvironment,
+    ...execSecretRefPassEnvEnvironment,
+    ...authProfileEnvironment,
+  })) {
+    environmentValueSources[key] = "inline";
+  }
   const managedServiceEnvKeys = formatManagedServiceEnvKeys(durableEnvironment, {
     omitKeys: Object.keys(params.serviceEnvironment),
   });
   writeManagedServiceEnvKeysToEnvironment(environment, managedServiceEnvKeys);
+  if (environment.OPENCLAW_SERVICE_MANAGED_ENV_KEYS) {
+    environmentValueSources.OPENCLAW_SERVICE_MANAGED_ENV_KEYS = "inline";
+  }
   Object.assign(environment, params.serviceEnvironment);
+  for (const key of Object.keys(params.serviceEnvironment)) {
+    environmentValueSources[key] = "inline";
+  }
   const mergedPath = mergeServicePath(
     params.serviceEnvironment.PATH,
     params.existingEnvironment?.PATH,
@@ -427,8 +478,14 @@ async function buildGatewayInstallEnvironment(params: {
   );
   if (mergedPath) {
     environment.PATH = mergedPath;
+    environmentValueSources.PATH = "inline";
+  }
+  for (const key of Object.keys(environmentValueSources)) {
+    if (!Object.hasOwn(environment, key)) {
+      delete environmentValueSources[key];
+    }
   }
-  return environment;
+  return { environment, environmentValueSources };
 }
 
 export async function buildGatewayInstallPlan(params: {
@@ -444,6 +501,10 @@ export async function buildGatewayInstallPlan(params: {
   /** Full config to extract env vars from (env vars + inline env keys). */
   config?: OpenClawConfig;
   authStore?: AuthProfileStore;
+  existingEnvironmentValueSources?: Record<
+    string,
+    GatewayServiceEnvironmentValueSource | undefined
+  >;
 }): Promise<GatewayInstallPlan> {
   const platform = params.platform ?? process.platform;
   const { devMode, nodePath } = await resolveDaemonInstallRuntimeInputs({
@@ -483,6 +544,17 @@ export async function buildGatewayInstallPlan(params: {
     extraPathDirs: resolveDaemonNodeBinDir(nodePath),
   });
 
+  const { environment, environmentValueSources } = await buildGatewayInstallEnvironment({
+    env: serviceInputEnv,
+    config: params.config,
+    authStore: params.authStore,
+    warn: params.warn,
+    serviceEnvironment,
+    existingEnvironment: params.existingEnvironment,
+    existingEnvironmentValueSources: params.existingEnvironmentValueSources,
+    platform,
+  });
+
   // Lowest to highest: preserved custom vars, durable config, auth env refs, generated service env.
   return {
     programArguments,
@@ -491,15 +563,8 @@ export async function buildGatewayInstallPlan(params: {
       platform,
       workingDirectory,
     }),
-    environment: await buildGatewayInstallEnvironment({
-      env: serviceInputEnv,
-      config: params.config,
-      authStore: params.authStore,
-      warn: params.warn,
-      serviceEnvironment,
-      existingEnvironment: params.existingEnvironment,
-      platform,
-    }),
+    environment,
+    ...(Object.keys(environmentValueSources).length > 0 ? { environmentValueSources } : {}),
   };
 }
 
diff --git a/src/commands/doctor-gateway-daemon-flow.ts b/src/commands/doctor-gateway-daemon-flow.ts
@@ -237,20 +237,22 @@ export async function maybeRepairGatewayDaemon(params: {
           return;
         }
         const port = resolveGatewayPort(params.cfg, process.env);
-        const { programArguments, workingDirectory, environment } = await buildGatewayInstallPlan({
-          env: process.env,
-          port,
-          runtime: daemonRuntime,
-          warn: (message, title) => note(message, title),
-          config: params.cfg,
-        });
+        const { programArguments, workingDirectory, environment, environmentValueSources } =
+          await buildGatewayInstallPlan({
+            env: process.env,
+            port,
+            runtime: daemonRuntime,
+            warn: (message, title) => note(message, title),
+            config: params.cfg,
+          });
         try {
           await service.install({
             env: process.env,
             stdout: process.stdout,
             programArguments,
             workingDirectory,
             environment,
+            environmentValueSources,
           });
         } catch (err) {
           note(`Gateway service install failed: ${String(err)}`, "Gateway");
diff --git a/src/commands/doctor-gateway-services.ts b/src/commands/doctor-gateway-services.ts
@@ -109,6 +109,7 @@ async function buildExpectedGatewayServicePlan(params: {
     runtime: params.runtime,
     nodePath: params.nodePath,
     existingEnvironment: params.command.environment,
+    existingEnvironmentValueSources: params.command.environmentValueSources,
     warn: (message, title) => note(message, title),
     config: params.cfg,
   });
@@ -593,6 +594,7 @@ export async function maybeRepairGatewayServiceConfig(
       programArguments: updatedPlan.programArguments,
       workingDirectory: updatedPlan.workingDirectory,
       environment: updatedPlan.environment,
+      environmentValueSources: updatedPlan.environmentValueSources,
     });
   } catch (err) {
     runtime.error(`Gateway service update failed: ${String(err)}`);
diff --git a/src/commands/onboard-non-interactive/local/daemon-install.ts b/src/commands/onboard-non-interactive/local/daemon-install.ts
@@ -62,20 +62,22 @@ export async function installGatewayDaemonNonInteractive(params: {
     runtime.exit(1);
     return { installed: false };
   }
-  const { programArguments, workingDirectory, environment } = await buildGatewayInstallPlan({
-    env: process.env,
-    port,
-    runtime: daemonRuntimeRaw,
-    warn: (message) => runtime.log(message),
-    config: params.nextConfig,
-  });
+  const { programArguments, workingDirectory, environment, environmentValueSources } =
+    await buildGatewayInstallPlan({
+      env: process.env,
+      port,
+      runtime: daemonRuntimeRaw,
+      warn: (message) => runtime.log(message),
+      config: params.nextConfig,
+    });
   try {
     await service.install({
       env: process.env,
       stdout: process.stdout,
       programArguments,
       workingDirectory,
       environment,
+      environmentValueSources,
     });
   } catch (err) {
     runtime.error(`Gateway service install failed: ${String(err)}`);
diff --git a/src/daemon/service-managed-env.ts b/src/daemon/service-managed-env.ts
@@ -24,6 +24,12 @@ export function isEnvironmentFileOnlySource(
   return source === "file";
 }
 
+export function hasEnvironmentFileSource(
+  source: GatewayServiceEnvironmentValueSource | undefined,
+): boolean {
+  return source === "file" || source === "inline-and-file";
+}
+
 function parseManagedServiceEnvKeys(value: string | undefined): Set<string> {
   const keys = new Set<string>();
   for (const entry of value?.split(",") ?? []) {
diff --git a/src/daemon/service-types.ts b/src/daemon/service-types.ts
@@ -8,6 +8,7 @@ export type GatewayServiceInstallArgs = {
   programArguments: string[];
   workingDirectory?: string;
   environment?: GatewayServiceEnv;
+  environmentValueSources?: Record<string, GatewayServiceEnvironmentValueSource | undefined>;
   description?: string;
 };
 
diff --git a/src/daemon/systemd.test.ts b/src/daemon/systemd.test.ts
diff --git a/src/daemon/systemd.ts b/src/daemon/systemd.ts
