Greptile Summary

This PR fixes gateway restart in non-systemd environments by adding native /proc-based socket inspection before falling back to lsof/ss, recognising bare openclaw-gateway process titles as valid gateway processes, and threading the resolved probe auth through the post-restart health checks so auth-protected gateways report healthy after SIGUSR1.

Confidence Score: 4/5

PR is safe to merge; both findings are non-blocking style issues with no impact on correctness.

No P0 or P1 issues found. Two P2 findings: dead code in the isGatewayArgv return expression, and a redundant double-read of config/auth on the unmanaged restart path. Core logic for /proc inspection, ss fallback, and auth threading looks correct and is well-tested.

src/infra/gateway-process-argv.ts (dead code on line 67), src/cli/daemon-cli/lifecycle.ts (duplicate config/auth resolution)

This is a comment left during a code review.
Path: src/infra/gateway-process-argv.ts
Line: 67

Comment:
**Dead code: `|| isGatewayBinary` is always `false` here**

`isGatewayBinary` is computed at lines 43–45 and consumed by the early-return guard at lines 47–49. Any execution that reaches line 67 has already established that `isGatewayBinary === false`, making the trailing `|| isGatewayBinary` unreachable and misleading.

```suggestion
  return exe.endsWith("/openclaw") || exe === "openclaw";
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/cli/daemon-cli/lifecycle.ts
Line: 200-206

Comment:
**Duplicate config read and auth resolution on the unmanaged restart path**

When `restartGatewayWithoutServiceManager` is taken (lines 218–222), `assertUnmanagedGatewayRestartEnabled` (lines 82–109) already calls `readBestEffortConfig()` and `resolveDaemonProbeAuth` independently to build the pre-SIGUSR1 probe auth. This outer block then repeats the same two async calls to produce `restartProbeAuth` for the post-restart health check. Because the same config file is read twice and the same auth resolution module is loaded twice, any latency or transient error is doubled on the hot path.

Passing `restartProbeAuth` (or the resolved `cfg`) into `restartGatewayWithoutServiceManager` → `assertUnmanagedGatewayRestartEnabled` would let both steps share a single resolution.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix gateway restart outside systemd" | Re-trigger Greptile}

Follow-up pushed for review comments: removed the dead branch in \ and collapsed unmanaged restart config/auth lookup to a single shared resolution path in . Re-ran targeted tests and \ ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND  No package.json (or package.yaml, or package.json5) was found in "/config"..

Follow-up pushed for review comments.

Changes:

• removed the dead isGatewayBinary tail branch in src/infra/gateway-process-argv.ts
• collapsed unmanaged restart config/auth lookup to a single shared resolution path in src/cli/daemon-cli/lifecycle.ts
• added a regression test that asserts the unmanaged restart path only resolves config/probe auth once

Verification:

• pnpm test src/cli/daemon-cli/lifecycle.test.ts src/cli/daemon-cli/restart-health.test.ts src/infra/gateway-process-argv.test.ts src/infra/gateway-processes.test.ts src/infra/restart-stale-pids.test.ts src/infra/restart.test.ts
• pnpm build

Addressed the review follow-ups in commit 684b027577.

Updated:

• removed the dead isGatewayBinary tail branch in src/infra/gateway-process-argv.ts
• collapsed unmanaged restart config/auth lookup to one shared resolution path in src/cli/daemon-cli/lifecycle.ts
• added a regression test that asserts the unmanaged restart path only resolves config/probe auth once

Re-verified with:

• pnpm test src/cli/daemon-cli/lifecycle.test.ts src/cli/daemon-cli/restart-health.test.ts src/infra/gateway-process-argv.test.ts src/infra/gateway-processes.test.ts src/infra/restart-stale-pids.test.ts src/infra/restart.test.ts
• pnpm build

Codex review: needs real behavior proof before merge. Reviewed July 3, 2026, 5:50 AM ET / 09:50 UTC.

Summary
The PR adds Linux /proc and ss listener discovery, accepts bare openclaw-gateway argv for verified signaling, and threads resolved probe auth into unmanaged restart health checks.

PR surface: Source +254, Tests +176. Total +430 across 10 files.

Reproducibility: yes. source-level: current main and v2026.6.11 still reject the reported bare openclaw-gateway argv shape. I did not run a live no-systemd/no-lsof container flow in this read-only review.

Review metrics: 1 noteworthy metric.

• Listener discovery backends: 2 added: Linux /proc inode scan and ss fallback. Both new backends can produce signal targets, so maintainers need explicit proof that they preserve existing process-exclusion safety before merge.

Root-cause cluster
Relationship: canonical
Canonical: #72224
Summary: This PR remains the canonical open candidate for the shared non-systemd gateway listener discovery and bare openclaw-gateway argv gaps, but it is not merge-ready.

Members:

• fixed_by_candidate: gateway restart should handle non-systemd background gateway processes #72223 - The PR body uses closing syntax for the same non-systemd restart listener gap, and the issue is already closed in favor of this implementation path.
• fixed_by_candidate: openclaw gateway stop returns 'Gateway service disabled' without killing a foreground-launched gateway #72948 - Reporter evidence ties the foreground-stop no-op to the same bare openclaw-gateway argv verifier gap changed by this PR.
• partial_overlap: fix(restart): silently skip lsof stale-pid scan when lsof not installed #76352 - This issue concerns the same lsof-unavailable restart surface, but its warning-classification request is narrower than this PR's listener discovery and argv fix.
• adjacent_distinct: fix(restart): skip unavailable lsof in initial scan #76364 - That open PR targets unavailable-lsof warning classification and does not replace this PR's listener discovery, argv, or probe-auth changes.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🧂 unranked krab
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Rebase or recreate the branch on current main so the merge result is reviewable.
• [P1] Fix protected-PID exclusions and the lifecycle mock type failure, then rerun focused gateway tests plus check-test-types.
• Attach redacted current-head Linux no-systemd/no-lsof terminal output or logs proving unmanaged restart works.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body has a text claim of local container verification but no current-head terminal output, redacted logs, recording, or linked artifact showing the changed real behavior after the fix. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

• [P1] GitHub reports the branch as conflicting/dirty, so a rebase or recreated branch is needed before the actual merge result is reviewable.
• [P1] The new /proc and ss listener backends need to preserve current main's protected-PID exclusion or a live protected gateway process can be signaled during cleanup/restart.
• [P1] check-test-types currently fails on the added lifecycle probe-auth mock type.
• [P1] The external PR still has only a text claim of local container verification, not current-head redacted terminal output, logs, recording, or a linked artifact.

Maintainer options:

1. Refresh and prove before merge (recommended)
   Rebase or recreate the branch on current main, thread protected-PID exclusions through /proc, ss, lsof, and Windows discovery, fix the type failure, then require redacted real Linux runtime proof.
2. Carry a maintainer replacement
   If the contributor branch remains conflicting or proof cannot be supplied, maintainers can carry the useful argv, listener-discovery, and auth changes into a narrow replacement branch with source credit.
3. Pause the source branch
   If nobody can refresh and prove the real non-systemd flow, keep the linked issues open and close or pause this PR as an unsafe landing candidate.

Next step before merge

• [P1] Manual review and contributor action are needed because the external PR is conflicting and missing real behavior proof; automation cannot supply the contributor's runtime proof.

Security
Cleared: No dependency, workflow, secret, package-publishing, or supply-chain surface is changed; process-signaling safety is covered as a functional availability blocker.

Review findings

• [P1] Preserve protected PID exclusions in new backends — src/infra/restart-stale-pids.ts:261
• [P1] Widen the probe-auth test mock type — src/cli/daemon-cli/lifecycle.test.ts:56-57

+1 from independent reproduction — flagging this PR also fixes #72948 (gateway stop foreground no-op), not just the restart side.

I retested #72948 against [email protected] in an isolated install yesterday and posted a root-cause writeup on the foreground-stop side. The src/infra/gateway-process-argv.ts change in this PR matches that analysis exactly — moving the allowGatewayBinary short-circuit ahead of the "gateway" token guard, accepting both openclaw-gateway and */openclaw-gateway. The new regression test (["openclaw-gateway"] with allowGatewayBinary: true → true) is precisely the production argv shape Linux produces when the spawned child sets process.title.

Independent reproduction (same fix path, different symptom)

Setup on Ubuntu 24.04, no systemd / no service manager:

mkdir -p /tmp/openclaw-stop-test && cd /tmp/openclaw-stop-test
npm install [email protected]
export PATH="$PWD/node_modules/.bin:$PATH"

# Terminal A
openclaw gateway run --dev --port 38789

# Terminal B
ss -ltnp | grep 38789       # listener present
openclaw gateway stop        # prints "Gateway service disabled."
ss -ltnp | grep 38789       # still bound

Confirmed the verifier was the load-bearing piece via:

xxd /proc/$(pgrep -f openclaw-gateway | head -1)/cmdline
# 00000000: 6f70 656e 636c 6177 2d67 6174 6577 6179  openclaw-gateway
# 00000010: 0000 0000 0000 0000 0000 ...

process.title overwrites /proc/<pid>/cmdline to a single null-terminated entry, so parseProcCmdline returns ["openclaw-gateway"] — no "gateway" token, the early return at the token guard fires, and the opt-in allowGatewayBinary branch was unreachable. Your reordering fixes both the restart path (this PR's primary target, #72223) and the foreground stop path (#72948) in one change.

Two notes for whoever reviews

1. Branch is currently mergeable_state: dirty — looks like main has moved a lot since 2026-04-26 (≈2,300 commits). A rebase would unblock CI / merge.
2. Could the PR description add Closes #72948 (or Fixes #72948) alongside Closes #72223? It would let the foreground-stop bug auto-close on merge and give maintainers one less thing to manually thread.

Happy to retest end-to-end against the rebased branch (Linux + container, no systemd) once it's green and re-confirm both #72223 and #72948 reproduce-then-resolve. Just ping me here.

Branch refreshed again.

Current state:

• rebuilt PR branch cleanly from current main
• force-updated PR to a single focused commit: f4e47b78d2
• PR diff is now back to the intended 10 gateway lifecycle/process files only
• dependency-graph/package-manifest drift is gone from the PR diff
• branch is now 0 behind current main

Local verification on this clean branch:

• node scripts/run-vitest.mjs src/cli/daemon-cli/lifecycle.test.ts src/cli/daemon-cli/restart-health.test.ts src/infra/gateway-process-argv.test.ts src/infra/gateway-processes.test.ts src/infra/restart-stale-pids.test.ts src/infra/restart.test.ts
• pnpm build

I did not rerun a containerized no-systemd/no-lsof smoke in this environment, so that remains the only proof gap called out from the earlier review thread.

@myagizmaktav thanks for the PR. ClawSweeper is still waiting on real behavior proof before this can move forward.

Useful proof can be a screenshot, short video, terminal output, copied live output, linked artifact, or redacted logs that show the changed behavior after the fix. Please redact private tokens, phone numbers, private endpoints, customer data, and anything else sensitive.

Once proof is added to the PR body or a comment, ClawSweeper or a maintainer can re-check it.

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix gateway restart outside systemd This is item 1/1 in the current shard. Shard 10/22.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.