Summary

openclaw agent startup calls fs.mkdirSync(dir, { recursive: true }) without an explicit mode argument. On Linux, this defaults to 755 via the process umask, resetting ~/.openclaw from 700 to 755.

The doctor in doctor-state-integrity-Dup_jTAf.js detects this and applies chmodSync(stateDir, 448) (chmod 700), but only on certain CLI entrypoints — not during security audit or any path that does not trigger the doctor.

Reproduction

1. chmod 700 ~/.openclaw (confirm it is 700)
2. openclaw agent --agent main --message "test" (or any agent invocation)
3. stat ~/.openclaw — mode is now 755

Expected

~/.openclaw stays 700 after agent startup

Actual

~/.openclaw is reset to 755

Workaround

Add chmod 700 ~/.openclaw after any script that calls openclaw agent.

Suggested fix

Pass { recursive: true, mode: 0o700 } to fs.mkdirSync when creating the state directory, or run the doctor normalization on all CLI entrypoints including security audit.