fix(setup): restore gateway reload mode through stdin

[SebTardif]

What Problem

Restoring gateway.reload.mode wrapped the value in POSIX single quotes and still sent the script through bash -c. wsl.exe expands $NAME before bash starts, so a reload mode of $PATH writes the Windows PATH into the gateway config.

Why

The quotes do not apply to the wsl.exe expansion.

User Impact

The restore script now uses inputViaStdin true. The single quotes stay. wsl.exe argv is -d distro -- bash -s, so the username and reload mode are not in the argument vector.

Evidence

Red: RestoreReloadMode_PipesScriptAndKeepsUserAndModeOutOfWslArgv failed because InputViaStdin was false. Green: setup-engine tests 1192 passed. The host wsl --version UTF-16 test failed and does not touch this script. .\build.ps1 passed.

Required proof pools

• windows-wsl-gateway-e2e: wizard reload-mode restore changed.

Validation

• .\build.ps1 passed.
• Setup-engine tests: 1192 passed. One unrelated wsl --version decode test failed on this host.

Closeout

Run on 2026-09-23 on this Windows host, head fcb859d.

• Shared: Passed 4093, Failed 0, Skipped 32, Total 4125.
• Tray: Passed 3059, Failed 5, Total 3064. The five failures are the same source-contract checks on four unrelated heads (1488, 1489, 1490, 1491), so they are not this stdin change:
  • ChatVoiceDialogs_RouteDisabledTtsCapabilityToPermissions_AndPreserveFallbackForMissingSetup
  • DebugPage_CopySpecificCards_HaveCopyGlyph_NotChevron_AndFeedback
  • SetupCodeEntry_ClearsStaleSshTunnelFields
  • CapabilitiesReview_PendingAvailabilityIsEscapedByToggleNotByBypassingContinue
  • CapabilitiesReview_SeparatesReasonActionFromDisabledOptions

Real Behavior Proof

The recorded invocation has inputViaStdin true and the reload mode is absent from the wsl argv.

Not verified: no live wsl.exe restore. WSL2 cannot start on this machine because VirtualizationFirmwareEnabled is false.

Maintainer integration closeout (2026-09-24)

The original head fcb859d0ff7813657260587a4f4336403f53a90b is unchanged. Its two-file patch was applied to current main (0e45bb6730259bddd7a59527bd8d0dca8b4358d7) in an isolated detached checkout. The resulting tree 33600265db29c381441b883ddcbf59718f453b13 exactly matches git merge-tree --write-tree; no patch repair or author-history rewrite was needed.

• ./build.ps1: passed on Windows ARM64 with .NET SDK 10.0.401.
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore: 4,104 passed, 35 skipped, 0 failed.
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore: 3,072 passed, 0 failed. This supersedes the author's older five local source-contract failures for the current-main integration tree.
• dotnet test ./tests/OpenClaw.SetupEngine.Tests/OpenClaw.SetupEngine.Tests.csproj --no-restore: 1,193 passed, 1 skipped, 0 failed, including RestoreReloadMode_PipesScriptAndKeepsUserAndModeOutOfWslArgv.
• Exact-head hosted Setup and connect E2E: 37 passed, 6 skipped, including the non-skipped real WSL wizard reload restore on Gateway 2026.9.5. Exact-head hosted Tray and Setup CI and CI Gate passed.

The local machine still cannot provide live WSL proof; no MXC proof or Gateway 2026.9.6 result is claimed. The hosted changed-path WSL proof and the independent current-main ARM64 integration floor are both green.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 23, 2026, 5:05 PM ET / 21:05 UTC (Revision 2).

ClawSweeper review

What this changes

The setup wizard sends the script that restores the gateway reload setting through WSL standard input and adds a regression test for keeping script values out of process arguments.

Regression provenance

Possible regression — probable (reviewed change; reproduction). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 3 items remain

This focused repair remains necessary: current main and the latest release still use the WSL argument path. No introduced correctness defect was found. Later exact-head WSL evidence strengthens the proof, but the required Tray validation still reports five failures whose disposition needs maintainer confirmation.

Priority: P2
Reviewed head: fcb859d0ff7813657260587a4f4336403f53a90b
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The small repair has meaningful exact-head WSL evidence and no identified patch defect; the reported Tray baseline failures still need a merge disposition.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (linked_artifact): The changed setup owner restores reload mode through the production WSL command runner. A collaborator reports a non-skipped exact-head real-WSL wizard setup E2E with successful recovery and a failing regression when the production line alone is reverted; the matching GitHub E2E check succeeded. Raw run logs could not be fetched in this review environment. No stored-data format changes are introduced.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The changed setup owner restores reload mode through the production WSL command runner. A collaborator reports a non-skipped exact-head real-WSL wizard setup E2E with successful recovery and a failing regression when the production line alone is reverted; the matching GitHub E2E check succeeded. Raw run logs could not be fetched in this review environment. No stored-data format changes are introduced.
Evidence reviewed	8 items	Introduced repair: The pinned PR delta selects standard-input transport for the reload restoration call and adds a 93-line recording-runner test. Production transport: The existing command runner maps standard-input mode to bash -s and supplies the script as stdin; its process runner writes and closes that input. Documented mechanism: Repository guidance documents WSL expansion of dollar-prefixed text in command arguments before Bash interprets quoting, and recommends standard input for scripts containing Bash variables.
Findings	None	None.
Security	None	None.

How this fits together

Windows setup temporarily disables gateway reload while onboarding runs. Afterward, the setup engine restores the configured mode through WSL, restarts the gateway, and verifies its health and ownership.

flowchart TD
  A[Onboarding finishes] --> B[Configured reload mode]
  B --> C[Quoted restoration script]
  C --> D[WSL standard input]
  D --> E[Gateway config command]
  E --> F[Restart and verify gateway]

Loading

Decision needed

Question	Recommendation
Can the five reported Tray source-contract failures be accepted as independently established baseline failures for this PR, or must the required suite pass before merge?	Accept verified baseline: Record the cross-head baseline evidence and allow this focused repair to proceed through normal merge checks.

Why: Repository policy requires successful closeout validation, while the PR reports the same failures on unrelated heads and its exact-head CI checks pass; the review cannot authorize an exception.

Before merge

• Resolve merge risk (P1) - The required Tray validation reports five failing source-contract checks. They are reported as unrelated baseline failures, but no maintainer disposition of that exception is recorded.
• Complete next step (P2) - Record maintainer acceptance of the five verified baseline Tray failures, or obtain a passing required Tray run before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	production +2/-1, tests +93/-0	Production growth selects an existing transport; the added test checks the invocation contract.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Keep the existing reload-restoration lifecycle and quoted value, use the established WSL standard-input transport, and land it with a recorded disposition of the Tray failures.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep the existing reload-restoration lifecycle and quoted value, use the established WSL standard-input transport, and land it with a recorded disposition of the Tray failures.

Do we have a high-confidence way to reproduce the issue?

Yes at the source level: current main sends a script containing $PATH through the documented WSL argument path. A collaborator also reports an exact-head real-WSL regression that fails when the production change is reverted.

Is this the best way to solve the issue?

Yes. Selecting the existing standard-input transport is a narrow repair that preserves quoting, retry timing, restart, and ownership checks.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against fb8b9e736f74.

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a bounded setup repair with no evidence of a widespread current outage.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The changed setup owner restores reload mode through the production WSL command runner. A collaborator reports a non-skipped exact-head real-WSL wizard setup E2E with successful recovery and a failing regression when the production line alone is reverted; the matching GitHub E2E check succeeded. Raw run logs could not be fetched in this review environment. No stored-data format changes are introduced.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed setup owner restores reload mode through the production WSL command runner. A collaborator reports a non-skipped exact-head real-WSL wizard setup E2E with successful recovery and a failing regression when the production line alone is reverted; the matching GitHub E2E check succeeded. Raw run logs could not be fetched in this review environment. No stored-data format changes are introduced.

Evidence

What I checked:

• Introduced repair: The pinned PR delta selects standard-input transport for the reload restoration call and adds a 93-line recording-runner test. (src/OpenClaw.SetupEngine/SetupWizardRunner.cs:661, fcb859d0ff78)
• Production transport: The existing command runner maps standard-input mode to bash -s and supplies the script as stdin; its process runner writes and closes that input. (src/OpenClaw.SetupEngine/CommandRunner.cs:394, fcb859d0ff78)
• Documented mechanism: Repository guidance documents WSL expansion of dollar-prefixed text in command arguments before Bash interprets quoting, and recommends standard input for scripts containing Bash variables. (docs/WSL_EXE_ARGV_PITFALL.md:5, fcb859d0ff78)
• Still needed on main: Fetched current main still calls reload restoration without standard-input mode; the latest release tag has the same invocation. (src/OpenClaw.SetupEngine/SetupWizardRunner.cs:656, fb8b9e736f74)
• Release comparison: Release v2026.9.4 also retains the argument-vector restoration call. (src/OpenClaw.SetupEngine/SetupWizardRunner.cs:656, 3c43751b2bac)
• Exact-head WSL proof: A collaborator reports that the exact PR head passed a non-skipped real-WSL setup E2E wizard path and that reverting only the production line made the regression fail. The matching GitHub setup-and-connect E2E check succeeded; its raw log was unavailable through this review environment. (tests/OpenClaw.E2ETests/Setup/E2ESetupFixture.cs:350, fcb859d0ff78)

Likely related people:

• Scott Hanselman: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• karkarl: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Record a maintainer disposition for the five reported Tray baseline failures.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-23T02:23:30.953Z sha fcb859d :: needs real behavior proof before merge. :: none

[karkarl]

Global triage: TAKE. Take confidence 92%; recommendation confidence 90%; effort extra-small; risk low.

Reviewed exact head fcb859d0ff78. This is the documented stdin fix for WSL argv expansion. Exact-head real-WSL setup E2E ran the non-skipped wizard path, and the regression goes red when only the production line is reverted. Before merge, add required Shared and Tray closeout results to the body and fix the literal `n in Validation. Follow-up: migrate remaining PATH-prefix argv calls consistently and avoid duplicating CommandRunner argv construction in the test.

[SebTardif]

Head fcb859d has the Shared and Tray closeout in the body. Shared: 4093 passed, 0 failed, 32 skipped. Tray: 3059 passed, 5 failed. Those five source-contract failures are the same on 1488, 1489, 1490, and 1491.

The Validation section does not contain a literal backtick-n. The recorded reload invocation has inputViaStdin true, and the reload mode is absent from the wsl argv. A live wsl.exe restore was not run on this host.