const args = argv.slice(2);

const commandPath = [];

for (let index = 0; index < args.length && commandPath.length < 3; index += 1) {

const consumed = consumeLauncherRootOptionToken(args, index);

if (consumed > 0) {

index += consumed - 1;

} else if (!args[index] || args[index].startsWith("-")) {

break;

} else {

commandPath.push(args[index]);

}

}

return commandPath.join(" ") === "webhooks gmail run";

// The serving Gateway owns drain and cleanup. Reap a stuck child only in the

// supervisor's exit margin, after that owner has had its full shutdown budget.

// An already-running older macOS launcher can still enforce its shorter timer;

// the serving Gateway retains that cap until it can identify the parent version.

const launcherStopTimeoutMs = resolveLauncherStopTimeoutMs({

platform: process.platform,

foreground: isForegroundGatewayRunArgv(process.argv),

});

const signalExitGraceMs = launcherStopTimeoutMs - respawnSignalForceKillGraceMs;

const stdioIsTerminal = process.stdin.isTTY || process.stdout.isTTY;

const child = spawn(command, args, {

stdio: "inherit",

env,

windowsHide: !stdioIsTerminal,

});

const listeners = new Map();

// Keep signal forwarding and bounded shutdown in sync with src/entry.compile-cache.ts,

// which drives src/process/respawn-child-runner.ts. That runner still holds its own

// copies of the escalation graces and reaps on a fixed short one, so only this

// launcher's deadline is the one the serving Gateway derives.

let signalExitTimer = null;

let signalForceKillTimer = null;

let firstForwardedSignal = null;

let hardKillBackstopStarted = false;

let childExited = false;

const clearEscalation = () => {

if (signalExitTimer) {

clearTimeout(signalExitTimer);

signalExitTimer = null;

}

if (signalForceKillTimer) {

clearTimeout(signalForceKillTimer);

signalForceKillTimer = null;

}

};

const detach = () => {

clearEscalation();

for (const [signal, listener] of listeners) {

process.off(signal, listener);

}

listeners.clear();

};

const forceKillChild = () => {

try {

child.kill(process.platform === "win32" ? "SIGTERM" : "SIGKILL");

} catch {

// Best-effort shutdown fallback.

}

};

const requestChildTermination = () => {

try {

child.kill("SIGTERM");

} catch {

// Best-effort shutdown fallback.

}

signalForceKillTimer = setTimeout(() => {

hardKillBackstopStarted = true;

forceKillChild();

// Completion still belongs to close, after the owned child has been reaped.

}, respawnSignalForceKillGraceMs);

signalForceKillTimer.unref?.();

};

const scheduleParentExit = (signal) => {

firstForwardedSignal ??= signal;

if (signalExitTimer) {

return;

}

signalExitTimer = setTimeout(() => {

requestChildTermination();

}, signalExitGraceMs);

signalExitTimer.unref?.();

};

for (const signal of respawnSignals) {

const listener = () => {

if (childExited) {

return;

}

try {

child.kill(signal);

} catch {

// Best-effort signal forwarding.

}

scheduleParentExit(signal);

};

try {

process.on(signal, listener);

listeners.set(signal, listener);

} catch {

// Unsupported signal on this platform.

}

}

return new Promise((resolve) => {

let failed = false;

child.once("error", (error) => {

failed = true;

process.stderr.write(

`[openclaw] Failed to respawn launcher: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`,

);

});

child.once("exit", () => {

childExited = true;

// The process is gone, but its pipes may still be draining. Keep the

// launcher alive and signal handlers installed until close, without

// escalating against an exited child or changing its recorded outcome.

clearEscalation();

});

child.once("close", (code, signal) => {

detach();

const signalCode = signal && os.constants.signals[signal];

const forwardedSignalExitCode =

!hardKillBackstopStarted && signal === firstForwardedSignal

? signal === "SIGINT"

? 130

: signal === "SIGTERM"

? 143

: undefined

: undefined;

process.exitCode = failed

? 1

: signal

? process.platform === "win32"

? (forwardedSignalExitCode ?? 1)

: signalCode

? 128 + signalCode

: 1

: (code ?? 1);

// Preserve the Unix supervisor contract, but only after child and stdio settlement.

if (!failed && signal && process.platform !== "win32") {

process.kill(process.pid, signal);

}

resolve(true);

});

});

const resolved = resolveRecoveryPath(filename);

if (!resolved) {

return null;

}

try {

const info = statSync(resolved);

return info.isFile() && info.size <= 65_536 ? readFileSync(resolved, encoding) : null;

} catch {

return null;

}

let buffer = readSmallFile(filename, null);

if (!buffer) {

return null;

}

let codePage = 65001;

if (buffer[0] === 0xff && buffer[1] === 0xfe) {

codePage = 1200;

} else if (buffer[0] === 0xfe && buffer[1] === 0xff) {

codePage = 1201;

} else {

if (buffer[0] === 0xef && buffer[1] === 0xbb && buffer[2] === 0xbf) {

buffer = buffer.subarray(3);

}

let end = buffer.indexOf(0x0a);

const preamble = /^@chcp (\d+) >nul\s*$/.exec(

buffer.subarray(0, end < 0 ? buffer.length : end).toString("latin1"),

);

if (preamble) {

codePage = Number(preamble[1]);

buffer = buffer.subarray(end < 0 ? buffer.length : end + 1);

end = buffer.indexOf(0x0a);

}

const marker = /^@rem openclaw-launcher-encoding=(\S+)\s*$/.exec(

buffer.subarray(0, end < 0 ? buffer.length : end).toString("latin1"),

);

if (marker) {

if (!preamble) {

const label = marker[1].toLowerCase();

const numeric = /^cp(\d+)$/.exec(label);

codePage = numeric

? Number(numeric[1])

: Number(

Object.entries(WINDOWS_SERVICE_CODEPAGE_LABELS).find(

([, value]) => value === label,

)?.[0],

);

}

buffer = buffer.subarray(end < 0 ? buffer.length : end + 1);

}

}

const label = WINDOWS_SERVICE_CODEPAGE_LABELS[codePage];

try {

if (label && codePage !== 850 && codePage !== 949) {

const decoder = new TextDecoder(label, { fatal: true });

return decoder.decode(buffer);

}

} catch {

// A missing decoder or invalid byte sequence must not select a guessed path.

}

process.stderr.write(

`openclaw: service script uses code page ${Number.isFinite(codePage) ? codePage : "unknown"}; not decodable here\n`,

);

return null;

try {

return realpathSync(filename);

} catch {

return null;

}

value,

homeDir,

{ allowMissing = false, allowCwd = false, trustedRoot } = {},

) {

const expanded = value?.trim().replace(/^~(?=$|[\\/])/, () => homeDir ?? "~");

if (!expanded || !path.isAbsolute(expanded)) {

return null;

}

const paths = /^(?:[a-zA-Z]:[\\/]|\\\\)/.test(expanded) ? path.win32 : path;

const absolute = paths.resolve(expanded);

const cwd = realNodePath(process.cwd()) ?? process.cwd();

// Trust only the private recovery root when launching from HOME; reject other cwd symlinks.

const trusted =

trustedRoot && path.isAbsolute(trustedRoot) && isPathWithin(absolute, trustedRoot);

const excluded = (filename) =>

!allowCwd && isPathWithin(filename, cwd) && !(trusted && isPathWithin(filename, trustedRoot));

if (excluded(absolute)) {

return null;

}

if (!allowCwd) {

// A final symlink can hide a workspace-owned intermediate directory.

for (let prefix = paths.dirname(absolute); ;) {

if (trusted && !isPathWithin(prefix, trustedRoot)) {

break;

}

const real = realNodePath(prefix);

if (real && excluded(real)) {

return null;

}

const parent = paths.dirname(prefix);

if (parent === prefix) {

break;

}

prefix = parent;

}

}

let existing = absolute;

const missing = [];

for (;;) {

const real = realNodePath(existing);

if (real) {

const resolved = paths.resolve(real, ...missing);

return path.isAbsolute(resolved) && !excluded(resolved) ? resolved : null;

}

if (!allowMissing) {

return null;

}

// An existing dangling symlink or unreadable path is not a creatable suffix.

try {

lstatSync(existing);

return null;

} catch (error) {

if (error?.code !== "ENOENT") {

return null;

}

}

const parent = paths.dirname(existing);

if (parent === existing) {

return null;

}

missing.unshift(paths.basename(existing));

existing = parent;

}

nodePath,

{ allowCwd = false, trustedRoot, env = process.env, acceptVersion } = {},

) {

const resolved = resolveRecoveryPath(nodePath, undefined, { allowCwd, trustedRoot });

if (!resolved || !/^node(?:\.exe)?$/i.test(path.basename(resolved))) {

return false;

}

const probeEnv = { NODE_NO_WARNINGS: "1" };

for (const [key, value] of Object.entries(env)) {

if (/^(SystemRoot|WINDIR|TEMP|TMP|TMPDIR)$/i.test(key)) {

probeEnv[key] = value;

}

}

try {

const result = spawnSync(

resolved,

[

"-e",

`const probe = ${SQLITE_CAPABILITY_PROBE}; process.stdout.write(JSON.stringify({ version: process.versions.node, probe }));`,

],

{

encoding: "utf8",

env: probeEnv,

timeout: 5_000,

killSignal: "SIGKILL",

maxBuffer: 65_536,

windowsHide: true,

stdio: ["ignore", "pipe", "pipe"],

},

);

const details = JSON.parse(result.stdout);

return (

result.status === 0 &&

!nodeRuntimeFailure(details.version, details.probe) &&

(!acceptVersion || acceptVersion(details.version))

);

} catch {

return false;

}

for (const line of text.split(/\r?\n/)) {

const command = line.trimStart().replace(/^@/, "");

let executable = "";

let quoted = false;

// Mirror quoteCmdScriptArg: other Windows path backslashes stay literal.

for (let index = 0; index < command.length; index += 1) {

const char = command[index];

if (char === "\\" && command[index + 1] === '"') {

executable += '"';

index += 1;

} else if (char === '"') {

quoted = !quoted;

} else if (/\s/.test(char) && !quoted) {

break;

} else {

executable += char;

}

}

executable = executable.replace(/\^!/g, "!").replace(/%%/g, "%");

if (

!quoted &&

path.win32.isAbsolute(executable) &&

/^node\.exe$/i.test(path.win32.basename(executable))

) {

return executable;

}

}

return null;

let profile = env.OPENCLAW_PROFILE?.trim();

const args = process.argv.slice(2);

for (let index = 0; index < args.length;) {

const consumed = consumeLauncherRootOptionToken(args, index);

if (!consumed) {

break;

}

if (args[index] === "--dev") {

profile = "dev";

} else if (args[index] === "--profile") {

profile = args[index + 1];

} else if (args[index].startsWith("--profile=")) {

profile = args[index].slice("--profile=".length);

}

index += consumed;

}

const suffix = profile && profile.toLowerCase() !== "default" ? profile : "";

let command;

if (process.platform === "darwin") {

if (!homeDir) {

return null;

}

const label = env.OPENCLAW_LAUNCHD_LABEL?.trim() || `ai.openclaw.${suffix || "gateway"}`;

if (!/^[A-Za-z0-9._-]+$/.test(label)) {

return null;

}

const text = readSmallFile(path.join(homeDir, "Library", "LaunchAgents", `${label}.plist`));

const array = text?.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/)?.[1];

const recordedArgs = [...(array || "").matchAll(/<string>([^<]*)<\/string>/g)].map(

([, value]) =>

value.replace(

/&(amp|lt|gt|quot|apos);/g,

(_, name) => ({ amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" })[name],

),

);

const wrapperIndex = recordedArgs[0] === "/bin/sh" ? 1 : 0;

const generatedWrapper =

recordedArgs[wrapperIndex]?.endsWith(`${label}-env-wrapper.sh`) &&

recordedArgs[wrapperIndex + 1]?.endsWith(`${label}.env`);

command = recordedArgs[generatedWrapper ? wrapperIndex + 2 : 0];

} else if (process.platform === "linux") {

if (!homeDir) {

return null;

}

const name =

env.OPENCLAW_SYSTEMD_UNIT?.trim() || `openclaw-gateway${suffix ? `-${suffix}` : ""}`;

if (!/^[A-Za-z0-9._@-]+$/.test(name)) {

return null;

}

const filename = name.endsWith(".service") ? name : `${name}.service`;

const text = readSmallFile(path.join(homeDir, ".config", "systemd", "user", filename));

const service = text?.split(/^\s*\[Service\]\s*$/m)[1]?.split(/^\s*\[/m)[0];

const executable = service?.match(/^\s*ExecStart=\s*(?:"((?:[^"\\]|\\.)*)"|(\S+))/m);

command = (executable?.[1] ?? executable?.[2])?.replace(/\\(.)/g, "$1");

} else if (process.platform === "win32") {

const scriptName = env.OPENCLAW_TASK_SCRIPT_NAME?.trim() || "gateway.cmd";

if (/[/\\]|\.\./.test(scriptName)) {

return null;

}

const stateDir = resolveRecoveryPath(

env.OPENCLAW_STATE_DIR?.trim() ||

(homeDir && path.join(homeDir, `.openclaw${suffix ? `-${suffix}` : ""}`)),

homeDir,

);

const filename = resolveRecoveryPath(

env.OPENCLAW_TASK_SCRIPT?.trim() || (stateDir && path.join(stateDir, scriptName)),

homeDir,

);

const text = readWindowsServiceScript(filename);

command = text && windowsServiceNode(text);

}

// Service definitions are data. Never execute a shell, service wrapper, or manager shim.

return command && path.isAbsolute(command) && /^node(?:\.exe)?$/i.test(path.basename(command))

? command

: null;

const resolved = resolveRecoveryPath(directory);

if (!resolved) {

return [];

}

try {

return readdirSync(resolved).toSorted().slice(0, 256);

} catch {

return [];

}

let alias = readSmallFile(path.join(root, "alias", "default"))?.trim();

for (let depth = 0; alias && depth < 8; depth += 1) {

if (/^v?\d+(?:\.\d+){0,2}$/.test(alias) || ["node", "stable"].includes(alias)) {

const prefix = alias.replace(/^v/, "");

const version = directoryNames(path.join(root, "versions", "node"))

.filter((name) => /^v\d+\.\d+\.\d+$/.test(name))

.filter(

(name) =>

["node", "stable"].includes(alias) ||

name === `v${prefix}` ||

name.startsWith(`v${prefix}.`),

)

.toSorted((a, b) => b.localeCompare(a, "en", { numeric: true }))[0];

return version ? path.join(root, "versions", "node", version, "bin", "node") : null;

}

if (alias === "lts/*") {

const versions = directoryNames(path.join(root, "alias", "lts"))

.map((name) => readSmallFile(path.join(root, "alias", "lts", name))?.trim())

.filter((value) => value && /^v?\d+\.\d+\.\d+$/.test(value))

.toSorted((a, b) => b.localeCompare(a, "en", { numeric: true }));

alias = versions[0];

} else if (/^(?:lts\/)?[A-Za-z0-9_-]+$/.test(alias)) {

alias = readSmallFile(path.join(root, "alias", alias))?.trim();

} else {

return null;

}

}

return null;

yield [managedServiceNode(homeDir, env), "managed Gateway service"];

const pathKey =

process.platform === "win32"

? Object.keys(env).find((key) => key.toUpperCase() === "PATH") || "PATH"

: "PATH";

const binary = process.platform === "win32" ? "node.exe" : "node";

for (const directory of (env[pathKey] || "").split(path.delimiter)) {

if (path.isAbsolute(directory)) {

yield [path.join(directory, binary), "PATH"];

}

}

for (const candidate of new Set([env.NVM_DIR, homeDir && path.join(homeDir, ".nvm")])) {

const root = resolveRecoveryPath(candidate, homeDir);

if (root) {

yield [resolveNvmDefault(root), "nvm default"];

}

}

for (const candidate of new Set([

env.FNM_DIR,

homeDir && path.join(homeDir, ".fnm"),

homeDir && path.join(homeDir, ".local", "share", "fnm"),

...(process.platform === "darwin" && homeDir

? [path.join(homeDir, "Library", "Application Support", "fnm")]

: []),

])) {

const root = resolveRecoveryPath(candidate, homeDir);

if (root) {

yield [

path.join(

root,

"aliases",

"default",

...(process.platform === "win32" ? [] : ["bin"]),

binary,

),

"fnm default",

];

}

}

for (const candidate of new Set([env.VOLTA_HOME, homeDir && path.join(homeDir, ".volta")])) {

const root = resolveRecoveryPath(candidate, homeDir);

if (!root) {

continue;

}

try {

const version = JSON.parse(readSmallFile(path.join(root, "tools", "user", "platform.json")))

?.node?.runtime;

if (typeof version === "string" && /^\d+\.\d+\.\d+$/.test(version)) {

yield [

path.join(

root,

"tools",

"image",

"node",

version,

...(process.platform === "win32" ? [] : ["bin"]),

binary,

),

"Volta default",

];

}

} catch {

// Missing or incomplete manager metadata does not select a runtime.

}

}

for (const major of [26, 24]) {

for (const prefix of ["/opt/homebrew", "/usr/local"]) {

if (process.platform === "darwin" || process.platform === "linux") {

yield [path.join(prefix, "opt", `node@${major}`, "bin", "node"), `Homebrew node@${major}`];

}

}

}

homeDir,

allowInstall = false,

env = process.env,

acceptVersion,

nodeVersion,

installCommand,

} = {}) {

// userInfo reads the account home without consulting the mutable process environment.

const inheritedHome = env.HOME?.trim() || env.USERPROFILE?.trim();

let accountHome;

if (!inheritedHome || /^~(?=$|[\\/])/.test(inheritedHome)) {

try {

accountHome = os.userInfo().homedir;

} catch {

// Containers may have no account record; independent PATH discovery still works.

}

}

const osHome = resolveRecoveryPath(inheritedHome || accountHome, accountHome, {

allowMissing: true,

allowCwd: true,

});

const recoveryHome = resolveRecoveryPath(

homeDir ?? (env.OPENCLAW_HOME?.trim() || osHome),

osHome,

{ allowMissing: true, allowCwd: true },

);

const recoveryPath = recoveryHome && path.join(recoveryHome, ".openclaw");

const recoveryRoot =

recoveryPath &&

resolveRecoveryPath(recoveryPath, undefined, {

allowMissing: true,

trustedRoot: recoveryPath,

});

const { resolveUpdatedNodeRuntime } = await import("./node-runtime-update.mjs");

let nodePath = recoveryRoot

? await resolveUpdatedNodeRuntime(recoveryRoot, {

allowInstall: false,

env,

acceptVersion,

installCommand,

})

: null;

let reason = "cached OpenClaw runtime";

const currentNode = realNodePath(process.execPath);

if (!nodePath) {

const seen = new Set([currentNode]);

for (const [candidate, source] of availableNodeCandidates(osHome, env)) {

// Only an explicitly named PATH directory may opt into cwd executables.

const target = source === "PATH" ? realNodePath(candidate) : null;

const allowCwd = Boolean(

target && realNodePath(path.dirname(candidate)) === path.dirname(target),

);

const realPath = resolveRecoveryPath(candidate, undefined, { allowCwd });

if (!realPath || seen.has(realPath)) {

continue;

}

seen.add(realPath);

if (isUsableNode(realPath, { allowCwd, env, acceptVersion })) {

nodePath = realPath;

reason = source;

break;