2026 OpenClaw on remote Mac: install script or npm, loopback gateway, doctor go-live chain

Use Node 22 LTS or Node 24; log node -v first in every bootstrap so CI artifacts prove the runtime line matches your internal standard operating procedure.

Export OPENCLAW_HOME and OPENCLAW_CONFIG_HOME per principal, chmod 700 the tree, and mirror the same PATH inside launchd that your operator shell used when validating openclaw --version. Interactive-only nvm shims are a frequent reason openclaw works in SSH but disappears for the daemon.

Pick exactly one path per golden image and record the semver in your change-management ticket so security reviewers can diff release notes without guessing which binary landed on the host.

Unattended runners should merge stdout and stderr from doctor and validate into one log file the way non-interactive onboard describes so secret scanners never see echoed tokens.

Bind to loopback while learning defaults; the documented local listener sits on 18789. Map OPENCLAW_GATEWAY_TOKEN like a Kubernetes SecretRef into GitHub Actions env:, Azure DevOps secret variables, or plist EnvironmentVariables—never print it to build summaries or Slack.

Probe http://127.0.0.1:18789/v1/health with Authorization: Bearer …; expect HTTP 200 when the token matches and 401 when you omit the header so you know authentication is enforcing before you attach clients.

export OPENCLAW_GATEWAY_TOKEN="$(cat "${RUNNER_TEMP:-/tmp}/gw.token")"

curl -fsS -o /dev/null -w "%{http_code}\n" \
  -H "Authorization: Bearer ${OPENCLAW_GATEWAY_TOKEN}" \
  "http://127.0.0.1:18789/v1/health"

Run openclaw onboard --install-daemon as the service account that will own production traffic, then openclaw gateway status so labels match what observability will scrape.

Reboot during a maintenance window, log back in, and immediately run openclaw gateway status followed by the curl health probe. Green in your shell but red in automation almost always means different OPENCLAW_CONFIG_HOME values between the interactive profile and the plist.

Dashboard workflows for skills belong in skills rollback and doctor; this page stays focused on gateway install acceptance.

Chain with && so failures short-circuit: openclaw doctor, openclaw config validate --config "$OPENCLAW_CONFIG_HOME/openclaw.json", then the bearer curl to 127.0.0.1:18789. Add openclaw gateway status when you need JSON for dashboards; merge streams per status plus doctor CI gate.

#!/usr/bin/env bash
set -euo pipefail
node -v
command -v openclaw
openclaw --version
openclaw doctor && \
  openclaw config validate --config "${OPENCLAW_CONFIG_HOME}/openclaw.json" && \
  curl -fsS -o /dev/null \
    -H "Authorization: Bearer ${OPENCLAW_GATEWAY_TOKEN}" \
    "http://127.0.0.1:18789/v1/health"

Diff stderr against the upstream troubleshooting page that matches your installed semver—wording shifts between minors. Roll back by restoring the last tarball of openclaw.json, reinstalling the prior npm range, and performing a single launchctl unload or load cycle so partial state cannot straddle two configs.

Validate paths: config validate gate.

Should ephemeral PR runners install the daemon? Prefer CLI-only checks so parallel jobs never fight over the same 18789 listener; install launchd only on long-lived remote Mac nodes.

Why loopback first? It keeps accidental LAN exposure off the critical path while you still learn token rotation and plist wiring; widen only when upstream exposure rules and your edge proxy are both ready.

Can validate replace doctor? No—doctor surfaces filesystem and runtime warnings that validate alone will not catch; both commands are cheap compared with an outage.

Where to buy hardware time? Open pricing, complete purchase, and read help if provisioning questions block you.