Problem

openclaw gateway restart shows:

⚠️ Config token differs from service token. The daemon will use the old token after restart.

…even when the two token values are identical.

Root Cause

checkTokenDrift compares serviceToken !== configToken as raw strings. Service-file parsers on Linux (systemd EnvironmentFile/Environment=) and macOS (launchd plist) can return environment-variable values with trailing newlines or spaces. The config token goes through trimToUndefined() inside resolveGatewayCredentialsFromConfig, but the service token extracted in lifecycle-core.ts at line 282 was passed without .trim():

// before — no trim on the service-file value
const serviceToken = command?.environment?.OPENCLAW_GATEWAY_TOKEN;

So "abc123\n" !== "abc123" → false-positive drift detected.

Fix

Two changes:

service-audit.ts: trim both sides inside checkTokenDrift itself, making the function robust regardless of how callers supply the raw values.

lifecycle-core.ts: add .trim() at the extraction site for defence-in-depth (mirrors the existing trim already present in auditGatewayServiceConfig at line 215).

Tests

Two new test cases in service-audit.test.ts:

• "same-token\n" vs "same-token" → null (no drift) ✅
• " same-token " vs "same-token" → null (no drift) ✅

All 24 daemon-cli and service-audit tests pass.

Fixes #26624

Greptile Summary

Fixed false-positive token-mismatch warning in openclaw gateway restart by normalizing whitespace in token comparison. Service-file parsers (systemd EnvironmentFile, launchd plist) can inject trailing newlines or spaces into environment variable values, causing identical tokens to appear different when compared as raw strings.

• Added .trim() to service token extraction in lifecycle-core.ts:282 for defense-in-depth
• Enhanced checkTokenDrift in service-audit.ts to normalize both tokens before comparison using .trim() || undefined pattern
• Added test coverage for trailing newlines and surrounding whitespace scenarios

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The fix is surgical and well-tested: adds .trim() calls to normalize whitespace in token comparison, includes two new test cases covering the specific edge cases (trailing newlines and surrounding spaces), and follows the existing pattern already used elsewhere in the codebase (auditGatewayToken at line 215). The change is defensive, backward-compatible, and directly addresses the reported false-positive warning without introducing new behavior.
• No files require special attention

_{Last reviewed commit: da16723}