Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/desktop/main/services/embedded-web-server.ts`:
- Around line 131-147: The code currently joins webRoot with the unsanitized
url.pathname (in the static file handling block) which allows path traversal;
update the logic in the handler that calculates filePath (the section using
path.join(webRoot, url.pathname), fileExists and stat) to first normalize and
sanitize the pathname (e.g. decode URL, remove/nullify any leading "/" and
reject or strip segments containing ".."), then use
path.resolve(path.join(webRoot, sanitizedPath)) and verify the resolved path is
inside webRoot (e.g. by checking that
resolvedPath.startsWith(path.resolve(webRoot) + path.sep) or using path.relative
and ensuring it does not start with ".."); only after that perform
fileExists/stat and fallback to index.html if the path is invalid, non-existent,
or a directory.

In `@apps/desktop/main/services/launchd-manager.ts`:
- Around line 108-134: The catch in stopServiceGracefully currently swallows all
errors from stopService; update it to only treat the "service not running" case
as a no-op and rethrow or surface other errors: in stopServiceGracefully call
stopService(label) inside try/catch, inspect the caught error (e.g., check for a
specific error class or message indicating "not running" from stopService),
return only for that case, and otherwise rethrow or log and throw the original
error so permission/validation errors aren’t silently ignored; reference
stopServiceGracefully and stopService to locate and implement the conditional
error handling.

In `@apps/desktop/main/services/quit-handler.ts`:
- Around line 122-140: The quitWithDecision function currently calls
opts.launchd.stopServiceGracefully (and opts.webServer.close) without catching
errors, so any throw can prevent app.quit; update quitWithDecision to mirror
installLaunchdQuitHandler by wrapping stopServiceGracefully calls in try/catch
(and webServer.close if desired), log or handle errors via
opts.logger/processLogger, and ensure app.quit() is always called (use a finally
block or call app.quit() after catching errors) so the app cannot be left
running in an inconsistent state; reference symbols: quitWithDecision,
opts.launchd.stopServiceGracefully, opts.webServer.close, app.quit, and
installLaunchdQuitHandler for how errors are handled.

In `@scripts/dev-launchd.sh`:
- Around line 14-15: LOG_DIR is pointing to $HOME/.nexu/logs which conflicts
with the design doc; change it to use the repository-local path by setting
LOG_DIR="$REPO_ROOT/.tmp/logs" (matching PLIST_DIR's use of REPO_ROOT), and
ensure any code that creates or writes logs uses LOG_DIR so logs are created
under .tmp/logs inside the repo; update any mkdir or file-write commands that
reference the old path to use the LOG_DIR variable instead.
- Around line 67-70: Update the StandardErrorPath filenames to match the design
docs by changing the controller and openclaw error log names from
"$LOG_DIR/controller.error.log" and "$LOG_DIR/openclaw.error.log" to
"$LOG_DIR/controller.err" and "$LOG_DIR/openclaw.err" respectively; modify the
XML entries that use the StandardErrorPath key (the block around
StandardOutPath/StandardErrorPath in this script) and apply the same change for
openclaw (the analogous block near the openclaw section).
- Around line 36-41: The cleanup() function (which kills the launchctl jobs for
"$DOMAIN/$OPENCLAW_LABEL" and "$DOMAIN/$CONTROLLER_LABEL") is never wired to
signals; add a trap to invoke cleanup on EXIT, SIGINT and SIGTERM so the
services are stopped when the script exits or is interrupted, or if keeping
services running is intentional, remove the unused cleanup() to avoid confusion;
ensure the trap references the existing cleanup symbol and covers at least EXIT,
SIGINT and SIGTERM.
- Line 28: The script currently sets NODE_PATH="${NODE_PATH:-$(which node)}",
which conflicts with Node.js's NODE_PATH; rename this variable to NODE_BIN (e.g.
NODE_BIN="${NODE_BIN:-$(which node)}") and update every usage of NODE_PATH in
the script and in the plist generation code to use NODE_BIN instead so spawned
processes receive the node binary path without affecting module resolution;
search for all references to NODE_PATH and replace them with NODE_BIN (including
any string interpolations passed into generated plist content).

In `@specs/designs/launchd-process-architecture/progress/STATUS.md`:
- Around line 52-67: Update the checklist entries that reference file paths with
the incorrect "/src/" segment: replace
`apps/desktop/src/main/services/launchd-manager.ts`,
`apps/desktop/src/main/services/plist-generator.ts`, and
`apps/desktop/src/main/embedded-web-server.ts` with the actual implementation
paths that omit "/src/" (i.e., `apps/desktop/main/...`) so the TODOs match the
real filenames and locations used by LaunchdManager, plist-generator, and
embedded-web-server.

---

Nitpick comments:
In `@apps/desktop/main/services/embedded-web-server.ts`:
- Around line 17-32: The MIME_TYPES map is missing handlers for source maps and
web manifests; update the MIME_TYPES constant to include ".map" with
"application/json" (or "application/json; charset=utf-8") and ".webmanifest"
with "application/manifest+json" so the embedded web server serves .map and
.webmanifest files with correct content-types (update the MIME_TYPES
Record<string,string> in embedded-web-server.ts).

In `@apps/desktop/main/services/launchd-bootstrap.ts`:
- Around line 212-219: getDefaultPlistDir uses process.cwd() which can vary in
dev; change it to use a stable module-based anchor (e.g., __dirname) or another
explicit repo-root resolver so the dev .tmp/launchd path is deterministic.
Locate getDefaultPlistDir and replace the process.cwd() usage with a directory
derived from __dirname (or a project-root helper) to construct
path.join(<stable-dev-root>, ".tmp", "launchd") while leaving the production
branch unchanged.
- Around line 250-271: The code uses process.cwd() to set repoRoot (in the
launchd-bootstrap.ts path bundle that builds
nodePath/controllerEntryPath/openclawPath/controllerCwd/openclawCwd), which is
fragile depending on launch context; change repoRoot to be derived from the
source file location (e.g., compute it relative to this module using __dirname
or import.meta.url and path.resolve up to the repo root) instead of
process.cwd(), and update any related logic that relies on repoRoot
(controllerEntryPath, openclawPath, controllerCwd, openclawCwd) so paths remain
correct regardless of working directory—mirror the same fix you applied to
getDefaultPlistDir.

In `@apps/desktop/main/services/launchd-manager.ts`:
- Around line 54-60: Replace the plain console calls in the launchd bootstrap
block so logging is structured (use the project's pino/logger) rather than
console.log/warn/error: when stdout is present call logger.info with an object
containing { event: 'launchd.bootstrap', label, stdout }, when stderr call
logger.warn with { event: 'launchd.bootstrap_warning', label, stderr }, and in
the catch block call logger.error with { event: 'launchd.bootstrap_failed',
label, error: err instanceof Error ? err.message : String(err), stack: err
instanceof Error ? err.stack : undefined } so the label, stdout/stderr and error
details are captured as structured fields instead of plain strings; update
imports/usages accordingly where label, stdout, stderr and err are referenced.

In `@apps/desktop/main/services/quit-handler.ts`:
- Around line 113-116: Currently the code calls
app.removeAllListeners("before-quit"), which can remove unrelated listeners;
instead keep a reference to the listener this module adds (e.g., the function
currently registered in this file, locate the listener passed to
app.on("before-quit") or the enclosing function in quit-handler.ts) and call
app.removeListener("before-quit", yourListener) (or app.off) before calling
app.quit(); update the registration to assign the listener to a const (e.g.,
quitHandler) and use that symbol when removing so only this module's handler is
removed.

In `@scripts/dev-launchd.sh`:
- Around line 171-177: The for-loop in scripts/dev-launchd.sh uses an unused
loop variable `i`; change the loop header from `for i in {1..30}` to use a
placeholder like `for _ in {1..30}` to indicate the counter is intentionally
unused, leaving the curl readiness check (`curl -s
"http://127.0.0.1:$CONTROLLER_PORT/api/auth/get-session"`) and the break/sleep
logic unchanged.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/desktop/main/index.ts`:
- Around line 848-861: The launchd path registers a second app "before-quit" and
can run cleanup out of order (and miss installation on bootstrap failure); fix
by consolidating to a single authoritative before-quit flow: stop adding another
app.on("before-quit") inside installLaunchdQuitHandler and instead have
installLaunchdQuitHandler register cleanup callbacks with the existing global
before-quit handler (or expose a registerLaunchdQuitCallback API); also ensure
installLaunchdQuitHandler is invoked reliably (either only after auth/bootstrap
fully succeeds or by setting a launchd-managed flag early and always registering
the centralized handler) so that the cleanup using sleepGuard.dispose,
diagnosticsReporter.flushNow and flushRuntimeLoggers executes only from the
single global before-quit path.
- Around line 843-849: The launchd branch is only gated by
isLaunchdBootstrapEnabled(), so on non-macOS machines NEXU_USE_LAUNCHD=1 will
try runLaunchdColdStart(); change the gating to require both
isLaunchdBootstrapEnabled() and a macOS platform check (process.platform ===
'darwin') before calling runLaunchdColdStart(), update the logColdStart message
accordingly or keep it based on the combined boolean, and ensure
runLaunchdColdStart() is never invoked on Linux/Windows.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/desktop/main/index.ts`:
- Around line 856-861: Duplicate cleanup is running both in the onBeforeQuit
callback passed to installLaunchdQuitHandler and in the global 'before-quit'
handler; remove the double-run by centralizing cleanup in one place: either move
sleepGuard.dispose("launchd-quit"), await diagnosticsReporter?.flushNow(), and
flushRuntimeLoggers() exclusively into the installLaunchdQuitHandler's
onBeforeQuit callback, or keep them only in the global 'before-quit' handler and
wrap that cleanup with if (!launchdResult) (the variable set by
installLaunchdQuitHandler) so the global handler skips cleanup when the launchd
flow handled the quit; update references to sleepGuard.dispose,
diagnosticsReporter.flushNow, flushRuntimeLoggers, installLaunchdQuitHandler,
and the global 'before-quit' handler accordingly.
- Around line 848-862: The issue is that launchdResult may be set by
runLaunchdColdStart()/bootstrapWithLaunchd but if ensureDesktopAuthSession
throws the quit handler never gets installed; fix by installing the launchd quit
handler immediately after bootstrapWithLaunchd/runLaunchdColdStart returns
(i.e., right after launchdResult is assigned and before calling
ensureDesktopAuthSession) using installLaunchdQuitHandler with the same {
launchd: launchdResult.launchd, labels: launchdResult.labels, webServer:
launchdResult.webServer, onBeforeQuit: (...) } block so the handler is present
even if auth fails; alternatively, if you prefer not to install early, ensure
the catch block clears launchdResult = null when the quit handler wasn’t
installed so the before-quit handler won’t assume a handler exists.

In `@scripts/dev-launchd.sh`:
- Around line 222-227: The tail_logs function can call tail with a glob that
fails when no *.log files exist; update tail_logs to defensively check for logs
before calling tail by testing the glob expansion (e.g., set positional params
or an array from "$LOG_DIR"/*.log and verify a file exists) and print a friendly
message or wait/exit if none found; reference the tail_logs function and the
LOG_DIR/*.log glob when making this change.
- Around line 173-181: The loop uses an unused variable and calls curl without a
timeout; change the loop header from using the unused "i" to a throwaway
variable (e.g., "_" in the for loop) to silence SC2034, and add explicit curl
timeout options to the probe (for example --connect-timeout and/or --max-time
and --fail or --silent flags) when calling curl against
"http://127.0.0.1:$CONTROLLER_PORT/api/auth/get-session" so each iteration
cannot hang indefinitely.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/controller/src/runtime/loops.ts`:
- Around line 69-84: The gateway health logic currently never triggers restarts
when the process has a PID or when HTTP errors occur; update the branch handling
result.status !== null and the branch where processAlive is true to increment a
failure counter on params.state (e.g., params.state.gatewayFailureCount) and
call params.processManager?.restartForHealth() once that counter exceeds a short
threshold (or after a timeout), while resetting the counter on success; ensure
you update params.state.gatewayStatus and params.state.lastGatewayError as now,
but add/clear gatewayFailureCount so a wedged-but-alive gateway (HTTP 5xx or
never binding) will be restarted instead of staying stuck in
"starting"/"degraded".

In `@apps/controller/src/runtime/openclaw-process.ts`:
- Around line 73-77: The isAlive() method currently falls back to PID 0 when
child.pid is undefined, causing isProcessAlive(0) to probe the wrong process;
update isAlive() to validate child.pid is a defined positive integer (e.g., pid
> 0) before calling isProcessAlive(this.child.pid), and return false if pid is
missing or non-positive so that non-started/spawn-failed children aren't
reported alive; reference the isAlive method, the child property, child.pid, and
isProcessAlive when making the change.

In `@scripts/dev-launchd.sh`:
- Around line 24-26: The script currently hard-codes CONTROLLER_PORT to 50800;
update it to read the controller port dynamically (the same value desktop sets
at runtime) instead of a fixed default so cleanup/status use the real socket.
Replace the fixed CONTROLLER_PORT="${CONTROLLER_PORT:-50800}" with logic that
loads the runtime configuration or an exported environment variable (e.g. parse
runtimeConfig.ports.controller from the runtime config file or accept
CONTROLLER_PORT from the caller) and propagate that value to the locations
mentioned (lines around the CONTROLLER_PORT assignment, the blocks referenced at
64-68 and in full_cleanup()/status handlers at ~150-166). Ensure full_cleanup()
and status reference this dynamic CONTROLLER_PORT variable so they wait/check
the actual controller socket.

---

Duplicate comments:
In `@apps/desktop/main/index.ts`:
- Around line 857-863: The code currently calls runLaunchdColdStart() based
solely on isLaunchdBootstrapEnabled(); update the gating logic to also require
macOS by checking process.platform === "darwin" (or an equivalent platform
check) before invoking runLaunchdColdStart(), so non-macOS systems fall back to
the orchestrator path; modify the condition around useLaunchd and the call to
runLaunchdColdStart() (and adjust the logColdStart message if needed) to include
the platform check.
- Around line 511-530: After obtaining launchdResult from bootstrapWithLaunchd,
call installLaunchdQuitHandler(...) immediately (using the launchdResult or its
relevant fields) before awaiting ensureDesktopAuthSession so the quit handler is
registered even if ensureDesktopAuthSession rejects; update the
runLaunchdColdStart / launchd startup flow (where launchdResult is created and
where ensureDesktopAuthSession is awaited) to invoke
installLaunchdQuitHandler(launchdResult) right after launchdResult is set and
before any awaits that can throw, and apply the same change in the other launchd
startup block that mirrors this flow.
- Around line 866-875: There are two before-quit paths: the
installLaunchdQuitHandler call is adding an onBeforeQuit that duplicates
teardown (sleepGuard.dispose, diagnosticsReporter.flushNow, flushRuntimeLoggers)
which races with the file's existing centralized before-quit listeners; remove
the onBeforeQuit callback from installLaunchdQuitHandler and instead invoke the
same cleanup (sleepGuard?.dispose("launchd-quit"); await
diagnosticsReporter?.flushNow().catch(() => undefined); flushRuntimeLoggers();)
from the single authoritative before-quit handler already defined in this file
so launchd teardown always follows the central quit flow.

In `@apps/desktop/main/services/quit-handler.ts`:
- Around line 128-145: quitWithDecision currently awaits opts.onBeforeQuit,
opts.webServer.close, and opts.launchd.stopServiceGracefully calls directly so
any rejection prevents reaching app.quit(); wrap the cleanup calls in a
try/catch (or a try/finally) so failures are caught/logged but do not stop
execution, ensuring app.quit() is always invoked (similar behavior to
installLaunchdQuitHandler). Specifically, handle errors from
opts.onBeforeQuit(), opts.webServer.close(), and
opts.launchd.stopServiceGracefully(opts.labels.openclaw/opts.labels.controller)
and then call app.quit() regardless.

In `@scripts/dev-launchd.sh`:
- Around line 181-185: The tail_logs function calls tail -f "$LOG_DIR"/*.log
which fails if no .log files exist; update tail_logs to check for matching log
files before invoking tail: test for any files (e.g. using a glob check like set
-- "$LOG_DIR"/*.log && [ -e "$1" ] or ls "$LOG_DIR"/*.log >/dev/null 2>&1) and
if none are found print a friendly "No logs yet" message (or wait/exit) instead
of calling tail; keep references to tail_logs, LOG_DIR and the tail -f
invocation so the check is placed immediately before that command.

---

Nitpick comments:
In `@apps/desktop/main/services/quit-handler.ts`:
- Around line 80-117: Replace all raw console.log/console.error calls in
quit-handler.ts with the structured runtime logger used elsewhere: accept or use
the injected logger (e.g., opts.logger or the runtime logging helper) and call
logger.info/logger.error with the same messages and error objects for the
onBeforeQuit, webServer.close and launchd.stopServiceGracefully blocks
(including the "Stopping launchd services..." / "Keeping services running in
background" and the per-label stop messages). Ensure the logger is present on
opts (or import the shared runtime logger), update calls around
opts.onBeforeQuit, opts.webServer.close, and opts.launchd.stopServiceGracefully
to pass the error object as a structured field (not concatenated strings) and do
not log any sensitive data or credentials.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@scripts/dev-launchd.sh`:
- Around line 193-198: The tail_logs function currently calls tail -f
"$LOG_DIR"/*.log which will fail if the glob matches nothing; update tail_logs
(referencing tail_logs and LOG_DIR) to first expand the glob into an array or
check for existence (e.g., files=("$LOG_DIR"/*.log) and test [ -e "${files[0]}"
] or similar) and only call tail -f with the file list when at least one log
exists, otherwise print a clear "No logs found in $LOG_DIR" message and return
gracefully.
- Around line 25-26: The script currently hard-codes CONTROLLER_PORT to 50800;
remove that fixed default so the script uses the runtime-selected
CONTROLLER_PORT provided by launchd (i.e. change
CONTROLLER_PORT="${CONTROLLER_PORT:-50800}" to just use the existing
CONTROLLER_PORT environment value or an empty/default-less expansion), and
ensure all references that check/cleanup sockets (the places using
CONTROLLER_PORT and OPENCLAW_PORT later in the script) use that variable rather
than a fixed port; update any socket checks/cleanup/status logic to read from
CONTROLLER_PORT so they target the dynamic launchd-assigned port.

---

Nitpick comments:
In `@scripts/dev-launchd.sh`:
- Around line 29-35: The variables NODE_PATH, CONTROLLER_ENTRY, OPENCLAW_PATH,
OPENCLAW_STATE_DIR and OPENCLAW_CONFIG are defined but never used; either remove
these unused definitions from the script or wire them into the launchd plist
generation so they become authoritative values. Locate the assignments for
NODE_PATH, CONTROLLER_ENTRY, OPENCLAW_PATH, OPENCLAW_STATE_DIR and
OPENCLAW_CONFIG in scripts/dev-launchd.sh and either (A) delete those unused
lines to avoid drift, or (B) reference them when building the plist (e.g.,
populate EnvironmentVariables/<key> or program arguments with
CONTROLLER_ENTRY/OPENCLAW_PATH and set OPENCLAW_CONFIG/OPENCLAW_STATE_DIR where
the runtime expects them) to ensure the script is the single source of truth.