Greptile Summary

This PR fixes a long-standing gap where ~/.openclaw/.env vars were never included in the installed service environment (LaunchAgent plist, systemd unit, Scheduled Task). The fix adds readStateDirDotEnvVars() in daemon-install-helpers.ts, which reads and parses the .env file from the state dir, filters out dangerous variables (NODE_OPTIONS, LD_PRELOAD, etc.) using the same security policy applied to config env vars, and merges them as the lowest-priority source in buildGatewayInstallPlan. The implementation is clean, the merge priority is clearly documented, and test coverage for new functionality is thorough.

• readStateDirDotEnvVars correctly handles missing files, dangerous vars, empty/whitespace values, and OPENCLAW_STATE_DIR overrides
• The merge order (dotenv → config → auth-profile refs → service env) matches the documented intent and is correctly implemented via spread + Object.assign
• Test isolation concern: The pre-existing buildGatewayInstallPlan tests pass env: {}, which now causes readStateDirDotEnvVars to fall back to the real os.homedir() and attempt to read ~/.openclaw/.env. A developer whose machine has that file would see the strict toEqual assertions fail. The new dotenv-merge tests correctly avoid this by using env: { HOME: tmpDir } — the existing tests should be updated the same way.

Confidence Score: 4/5

• Safe to merge; the production logic is correct and secure, with one test-isolation improvement recommended for existing tests.
• The implementation is correct, the security filtering is consistent with the rest of the codebase, and new tests are comprehensive. The only issue is that pre-existing tests with env: {} now have an implicit dependency on the developer's real ~/.openclaw/.env (via os.homedir() fallback), which could cause non-deterministic local test failures. This is a non-blocking concern that won't affect CI or production.
• Pre-existing buildGatewayInstallPlan tests in src/commands/daemon-install-helpers.test.ts (lines 89–332) should have env: {} updated to use an isolated path.

This is a comment left during a code review.
Path: src/commands/daemon-install-helpers.test.ts
Line: 89-110

Comment:
**Pre-existing tests now read from the real `~/.openclaw/.env`**

The pre-existing `buildGatewayInstallPlan` tests all pass `env: {}`. With this PR, `buildGatewayInstallPlan` now calls `readStateDirDotEnvVars(params.env)`, which internally calls `resolveStateDir({})`. Since no `HOME` (or `OPENCLAW_STATE_DIR`) is set in the empty env object, `resolveStateDir` falls back to `os.homedir()` from the real OS, which means it attempts to read the actual `~/.openclaw/.env` on the developer's machine.

If a developer has that file (a reasonable scenario given the feature being built), the strict `toEqual` assertion below will fail non-deterministically:

```typescript
expect(plan.environment).toEqual({ OPENCLAW_PORT: "3000" });
```

The new `buildGatewayInstallPlan — dotenv merge` tests correctly avoid this by using `env: { HOME: tmpDir }`. The pre-existing tests should be updated similarly (or mock `readStateDirDotEnvVars`) to preserve test isolation. For example:

```typescript
const plan = await buildGatewayInstallPlan({
  env: { HOME: "/nonexistent-home-for-test" },
  port: 3000,
  runtime: "node",
  nodePath: "/custom/node",
});
```

This also applies to the other pre-existing tests at lines 112–127, 129–148, 150–178, 180–203, 205–224, 226–245, 247–271, 273–306, and 308–332.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix: normalize env var keys and isolate ..." | Re-trigger Greptile}

CI failures are unrelated to this PR:

• check-additional: plugin-sdk-api-drift baseline check
• checks-windows shard 1/6: bundled-plugin-metadata.test.ts formatter failure on Windows

Neither involves the files changed here. The daemon-install-helpers tests pass on all platforms.

Landed via temp rebase onto main.

• Gate: pnpm check && pnpm build && pnpm test
• Land commit: d02bcd1
• Merge commit: dd860e7

Thanks @Chevron7Locked!