OpenClaw bug report: gateway install inlines .env secrets into systemd unit while doctor flags inline OPENCLAW_GATEWAY_TOKEN as stale

Summary

On Linux/systemd user installs, openclaw gateway install in OpenClaw 2026.3.23-2 writes secrets from ~/.openclaw/.env directly into ~/.config/systemd/user/openclaw-gateway.service as inline Environment=... lines.

In the same build, openclaw doctor / service audit flags an inline OPENCLAW_GATEWAY_TOKEN as stale/non-standard and recommends:

openclaw gateway install --force

That appears internally inconsistent, because reinstall uses the same installer path that serializes the service environment into the unit.

Environment

• OpenClaw version: 2026.3.23-2
• Installed from npm package [email protected]
• OS: Linux
• Supervisor: systemd user service
• Date observed: 2026-03-25

Symptoms

openclaw doctor / status reported:

• Service config looks out of date or non-standard.
• Service config issue: Gateway service embeds OPENCLAW_GATEWAY_TOKEN and should be reinstalled.
• Run openclaw gateway install --force to remove embedded service token.

Actual installed unit contained:

• Environment=OPENCLAW_GATEWAY_TOKEN=...
• many other inline secret Environment= lines sourced from ~/.openclaw/.env

At the same time, a drop-in also existed:

• ~/.config/systemd/user/openclaw-gateway.service.d/env.conf
• containing EnvironmentFile=%h/.openclaw/.env

So the live setup had both:

1. inline secrets in the main unit
2. an EnvironmentFile drop-in

Repro

1. Put gateway token and provider API keys in ~/.openclaw/.env
2. Configure gateway auth to use ${OPENCLAW_GATEWAY_TOKEN} in openclaw.json
3. Run:

openclaw gateway install

4. Inspect:

systemctl --user cat openclaw-gateway.service

5. Observe inline Environment=OPENCLAW_GATEWAY_TOKEN=... in the main unit
6. Run:

openclaw doctor --non-interactive

7. Observe doctor warns that embedded OPENCLAW_GATEWAY_TOKEN should be removed via reinstall

Expected behavior

One of these should be true:

1. The installer should prefer EnvironmentFile=%h/.openclaw/.env and avoid serializing secrets into the main systemd unit.
2. Or doctor should not recommend reinstall as a fix if reinstall will reproduce the same inline-token layout.

Actual behavior

• Installer path persists .env values into the main unit as inline Environment=...
• Audit path treats inline OPENCLAW_GATEWAY_TOKEN as stale/non-standard and recommends reinstall
• Result: reinstall advice appears to point back to the same behavior

Relevant code paths in 2026.3.23-2

Installer side:

• dist/gateway-install-token-De_pFluK.js
  • buildGatewayInstallPlan(...)
• dist/io-y3Az_Onx.js
  • collectDurableServiceEnvVars(...)
  • readStateDirDotEnvVars(...)
• dist/systemd-bGhJCG6J.js
  • renderEnvLines(...)
  • buildSystemdUnit(...)
  • installSystemdService(...)

Observed behavior:

• collectDurableServiceEnvVars(...) reads ~/.openclaw/.env
• buildGatewayInstallPlan(...) includes those env vars in the generated service environment
• installSystemdService(...) writes them into the main unit as inline Environment=... lines

Audit side:

• dist/systemd-hints-DvBn5bxv.js
  • auditGatewayToken(...)
  • readEmbeddedGatewayToken(...)

Observed behavior:

• if OPENCLAW_GATEWAY_TOKEN is present inline in the parsed service environment and not marked as file-sourced, doctor emits:
  • Gateway service embeds OPENCLAW_GATEWAY_TOKEN and should be reinstalled.

Local workaround that worked

Manual cleanup of the main unit:

1. Keep the non-secret service lines in ~/.config/systemd/user/openclaw-gateway.service
2. Remove inline secret Environment= lines from the main unit
3. Keep ~/.config/systemd/user/openclaw-gateway.service.d/env.conf with:

[Service]
EnvironmentFile=%h/.openclaw/.env

4. Reload and restart:

systemctl --user daemon-reload
systemctl --user restart openclaw-gateway.service

After that:

• gateway stayed running
• merged unit still had EnvironmentFile=%h/.openclaw/.env
• openclaw doctor --non-interactive completed without the embedded-token warning

Impact

• Secrets are copied into the main systemd unit file
• Service backups such as openclaw-gateway.service.bak also retain secrets
• Doctor guidance is misleading because reinstall may recreate the flagged state

Suggested fix

Preferred:

• On Linux/systemd, persist secrets via EnvironmentFile=%h/.openclaw/.env only, not inline Environment= lines in the main unit

Minimum:

• Align doctor/audit recommendations with actual installer behavior
• Do not recommend reinstall as a fix unless reinstall produces a non-inline-token result

Notes

• This was observed on the latest stable npm release available on 2026-03-25: 2026.3.23-2
• GitHub prerelease 2026.3.24-beta.1 existed on 2026-03-25, but no release note found for this specific issue