What

Three small surgical fixes for runtime stability bugs found while diagnosing user reports today. Each is a separate commit so they can be reviewed (or split) independently.

Why

How

Commit 1 — `fix(desktop): always clear launchd disabled override at install time`

Move the `isServiceDisabled` + `enableService` block to the very top of `LaunchdManager.installService`, before the `isRegistered` early-return. `launchctl enable` is idempotent so calling it on every install is safe.

Commit 2 — `fix(controller): sort plugins.allow to prevent spurious gateway restarts`

Change `compilePlugins` to emit `allow` via `Array.from(new Set([...connectedPluginIds, ...platformPluginIds])).sort()` so the output is fully deterministic regardless of input order.

Commit 3 — `fix(controller): trust user model selection under configured BYOK providers`

Pass `configuredProviderKeys` (set of provider keys in `compiled.models.providers`) to `resolveAvailableRuntimeModel`. Add a new rule: trust any `desiredRef` whose provider key is configured. OpenClaw's `resolveModelWithRegistry` has a generic-fallback path that builds a synthetic model entry when `providerConfig` is present, so the request still goes through with the user's chosen model.

Affected areas

• Desktop app (Electron shell)
• Controller (backend / API)

Checklist

• `pnpm typecheck` passes
• `pnpm lint` passes
• `pnpm test` (not run; existing tests don't reference the modified internals — `plugins.allow` test assertions use `toContain` so they remain order-independent)
• `pnpm generate-types` (no API route/schema changes)
• No credentials or tokens in code or logs
• No `any` types introduced

Notes for reviewers

• Each commit is independent and could be cherry-picked or reverted standalone if any one of them needs to be held back.
• Bug feat: end-to-end Slack integration with LiteLLM model provider and config generator fixes #3 is a behavioral change in model resolution: previously the controller would silently downgrade unknown selections to a default; now it forwards them as-is. The downside is that a typo'd model id will now reach OpenClaw and produce an "Unknown model" error there — but that's strictly better than silently picking a different model behind the user's back.
• Bug OpenClaw config generation #1 leaves the existing retry-path `enableService` call at the bottom of `installService` intact. It's now somewhat redundant but harmless and defends against a race where something re-disables the service between the top-of-function check and the bootstrap call.
• The OpenClaw upstream restart logic in `triggerOpenClawRestart` (which is the actual code that fails on `launchctl bootstrap` for sunqingyu's case) is in vendored OpenClaw source. We can't modify it, but bug OpenClaw config generation #1's fix means desktop boot will preemptively clear the disabled flag before OpenClaw ever tries to use it.