Bug type

Behavior bug (incorrect output/state without crash)

Summary

After updating env.MAIL_API_KEY in ~/.openclaw/openclaw.json and restarting the gateway, the running service still uses the old MAIL_API_KEY from the LaunchAgent plist environment.

Steps to reproduce

1. Ensure OpenClaw gateway is installed as LaunchAgent (~/Library/LaunchAgents/ai.openclaw.gateway.plist).
2. Set env.MAIL_API_KEY in ~/.openclaw/openclaw.json to value A and start gateway.
3. Update env.MAIL_API_KEY in ~/.openclaw/openclaw.json to value B.
4. Restart gateway multiple times (openclaw gateway restart).
5. Check effective env from a session/tool call (printenv MAIL_API_KEY) and check LaunchAgent plist env.

Expected behavior

Gateway restart should reload current ~/.openclaw/openclaw.json env values, and MAIL_API_KEY should become value B without manual LaunchAgent cleanup.

Actual behavior

MAIL_API_KEY remains value A after restart. Investigation shows:

• Config file contains new value (B).
• ~/Library/LaunchAgents/ai.openclaw.gateway.plist still contains old value (A).
• Restarting gateway reuses old LaunchAgent env snapshot, so runtime keeps old value.

OpenClaw version

2026.3.2

Operating system

macOS 14.8.3 (x64)

Install method

npm global / LaunchAgent service

Logs, screenshots, and evidence

$ openclaw --version
2026.3.2

$ openclaw gateway status
Service file: ~/Library/LaunchAgents/ai.openclaw.gateway.plist
Config (cli): ~/.openclaw/openclaw.json
Config (service): ~/.openclaw/openclaw.json
Runtime: running

# Config parse shows NEW key in openclaw.json
$ node -e "const fs=require('fs');const vm=require('vm');const txt=fs.readFileSync(process.env.HOME+'/.openclaw/openclaw.json','utf8');const obj=vm.runInNewContext('('+txt+')');console.log(obj.env.MAIL_API_KEY)"
sk-NEW_REDACTED

# Runtime env still OLD key
$ node -e "console.log(process.env.MAIL_API_KEY || '')"
sk-OLD_REDACTED

# LaunchAgent plist still has OLD key
$ /usr/libexec/PlistBuddy -c 'Print :EnvironmentVariables:MAIL_API_KEY' ~/Library/LaunchAgents/ai.openclaw.gateway.plist
sk-OLD_REDACTED

Impact and severity

Affected: users running gateway via LaunchAgent on macOS and relying on env secrets in config.
Severity: High (blocks credential rotation and causes stale secret usage).
Frequency: 100% reproducible in this setup.
Consequence: external integrations keep using revoked/old credentials, causing task failures and confusing diagnostics.

Additional information

Manual workaround: fully bootout/remove/recreate LaunchAgent plist, then start gateway again. This indicates gateway restart does not reconcile LaunchAgent env from latest config.