fix(daemon): resolve Homebrew Cellar path to stable symlink for gateway install

[scoootscooob]

Summary

• openclaw gateway install writes process.execPath into the LaunchAgent plist. Under Homebrew Node, this resolves to the versioned Cellar path (e.g. /opt/homebrew/Cellar/node/25.7.0/bin/node) which breaks when Homebrew upgrades Node.
• Added resolveStableNodePath() that detects Cellar paths and resolves them to the stable Homebrew symlink (/opt/homebrew/bin/node) which Homebrew updates automatically during upgrades.
• Handles both Apple Silicon (/opt/homebrew/Cellar/...) and Intel Mac (/usr/local/Cellar/...) paths. Falls back gracefully to the original path if the symlink doesn't exist.

Closes #32182

Test plan

• New resolveStableNodePath unit tests (5 cases): Cellar → symlink, Intel Mac Cellar → symlink, missing symlink fallback, non-Cellar passthrough, system path passthrough
• New integration test: resolvePreferredNodePath resolves Cellar execPath to stable symlink
• All 15 runtime-paths tests pass

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR fixes a real-world breakage where openclaw gateway install embeds the versioned Homebrew Cellar path for Node (e.g. /opt/homebrew/Cellar/node/25.7.0/bin/node) into the LaunchAgent plist, causing the daemon to fail after a brew upgrade node. The new resolveStableNodePath helper detects Cellar paths and redirects them to the stable Homebrew symlink (/opt/homebrew/bin/node on Apple Silicon, /usr/local/bin/node on Intel), falling back gracefully when the symlink doesn't exist.

Key concerns:

• Versioned formula mismatch (logic bug): The regex ^(.+?)\/Cellar\/[^/]+\/[^/]+\/bin\/node$ matches any Homebrew formula name, including node@22, node@20, etc. For those formulas, the correct stable path is the keg path (e.g. /opt/homebrew/opt/node@22/bin/node), not <prefix>/bin/node. If a user runs openclaw gateway install with node@22 while the default node formula (a different version) is also linked at /opt/homebrew/bin/node, the function will silently return the wrong Node binary path. Restricting the match to the unversioned node formula — or resolving versioned formulas to their opt keg path — would close this gap.
• Test coverage: There is no test case for the node@22 / versioned-formula scenario described above.

Confidence Score: 3/5

• Safe for users of the default node formula; carries a silent misbehavior risk for users running versioned Homebrew formulas like node@22 alongside the default node.
• The fix correctly addresses the reported Cellar-path breakage for the common case (default node formula). However, the regex over-matches versioned formulas and can substitute a different Node version into the plist without any warning. This is a correctness issue that affects a realistic user configuration, lowering confidence from 5 to 3.
• src/daemon/runtime-paths.ts — specifically the regex in resolveStableNodePath and how it handles versioned Homebrew formulas.

_{Last reviewed commit: 0597772}

[greptile-apps]

_{2 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Incorrect stable path for versioned Homebrew formulas (node@22, node@20, etc.)

The regex captures the prefix before /Cellar/ and always resolves to <prefix>/bin/node. For the default node formula this is correct (/opt/homebrew/bin/node), but for versioned formulas like node@22 the Homebrew-managed stable path is the keg path — e.g. /opt/homebrew/opt/node@22/bin/node — not /opt/homebrew/bin/node.

Problematic scenario: A user runs openclaw gateway install with node@22 as their active runtime (e.g. process.execPath = /opt/homebrew/Cellar/node@22/22.12.0/bin/node) while the default node formula (v24+) is also installed and linked at /opt/homebrew/bin/node. In this case:

1. The regex matches and stablePath becomes /opt/homebrew/bin/node.
2. fs.access succeeds because the default Node binary exists there.
3. The function returns /opt/homebrew/bin/node (pointing to Node 24+) instead of the user's intended Node 22 binary.
4. The plist ends up referencing the wrong Node binary entirely.

A more robust approach would capture the formula name and resolve to the keg path for versioned formulas, or restrict the match to only the unversioned node formula:

// Option A – restrict to the unversioned `node` formula only, letting versioned
// formulas fall back to their original Cellar paths (safe, no false substitution):
const cellarMatch = nodePath.match(/^(.+?)\/Cellar\/node\/[^/]+\/bin\/node$/);

// Option B – resolve versioned formulas to their keg path instead:
const cellarMatch = nodePath.match(/^(.+?)\/Cellar\/(node(?:@\d+)?)\/[^/]+\/bin\/node$/);
if (!cellarMatch) return nodePath;
const [, prefix, formula] = cellarMatch;
const stablePath = formula === "node"
  ? `${prefix}/bin/node`
  : `${prefix}/opt/${formula}/bin/node`;

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/daemon/runtime-paths.ts
Line: 163-167

Comment:
**Incorrect stable path for versioned Homebrew formulas (`node@22`, `node@20`, etc.)**

The regex captures the prefix before `/Cellar/` and always resolves to `<prefix>/bin/node`. For the default `node` formula this is correct (`/opt/homebrew/bin/node`), but for versioned formulas like `node@22` the Homebrew-managed stable path is the keg path — e.g. `/opt/homebrew/opt/node@22/bin/node` — not `/opt/homebrew/bin/node`.

**Problematic scenario:** A user runs `openclaw gateway install` with `node@22` as their active runtime (e.g. `process.execPath` = `/opt/homebrew/Cellar/node@22/22.12.0/bin/node`) while the default `node` formula (v24+) is also installed and linked at `/opt/homebrew/bin/node`. In this case:

1. The regex matches and `stablePath` becomes `/opt/homebrew/bin/node`.
2. `fs.access` succeeds because the *default* Node binary exists there.
3. The function returns `/opt/homebrew/bin/node` (pointing to Node 24+) instead of the user's intended Node 22 binary.
4. The plist ends up referencing the wrong Node binary entirely.

A more robust approach would capture the formula name and resolve to the keg path for versioned formulas, or restrict the match to only the unversioned `node` formula:

```typescript
// Option A – restrict to the unversioned `node` formula only, letting versioned
// formulas fall back to their original Cellar paths (safe, no false substitution):
const cellarMatch = nodePath.match(/^(.+?)\/Cellar\/node\/[^/]+\/bin\/node$/);

// Option B – resolve versioned formulas to their keg path instead:
const cellarMatch = nodePath.match(/^(.+?)\/Cellar\/(node(?:@\d+)?)\/[^/]+\/bin\/node$/);
if (!cellarMatch) return nodePath;
const [, prefix, formula] = cellarMatch;
const stablePath = formula === "node"
  ? `${prefix}/bin/node`
  : `${prefix}/opt/${formula}/bin/node`;
```

How can I resolve this? If you propose a fix, please make it concise.

[steipete]

Landed via temp rebase onto main.

• Gate: pnpm test src/daemon/runtime-paths.test.ts
• Land commit: 9810508
• Merge commit: 8cc5ed845b1683ec399a1ccde56e4433a15495ec

Thanks @scoootscooob!

[steipete]

Correction with final SHAs:

• Gate: pnpm test src/daemon/runtime-paths.test.ts
• Land commit: 9810508
• Merge commit: 4815572

Thanks @scoootscooob!