Summary

• Problem: openclaw gateway install generates a service plist/unit that misses Nix-managed binaries from PATH. Skills depending on Nix-installed binaries (e.g. aoe, tmux, claude) are reported as blocked at boot.
• Why it matters: Users on Nix/Home Manager cannot use Nix-installed tools through the gateway without manual PATH workarounds.
• What changed: Add addNixProfileBinDirs() to service-env.ts that resolves Nix profile bin directories from NIX_PROFILES (respecting right-to-left precedence) with a ~/.nix-profile/bin fallback when the env var is absent.
• What did NOT change (scope boundary): No changes to gateway install, systemd unit generation, or plist templates. Only the PATH resolution logic is affected.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes [Bug]: openclaw gateway install does not capture Nix (Home Manager) PATH entries in LaunchAgent plist #44402
• Related fix(daemon): add Nix Home Manager PATH support to service environment #44433 (superseded)
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: getMinimalServicePathParts() had no knowledge of Nix profile directories. The LaunchAgent/systemd service PATH is constructed from a static list of known bin dirs, and Nix paths were missing entirely.
• Missing detection / guardrail: No test coverage for Nix profile resolution in the service environment.
• Contributing context (if known): Nix Home Manager symlinks binaries under ~/.nix-profile/bin and sets NIX_PROFILES with a space-separated list of profile paths. The daemon service environment doesn't source shell init scripts, so these paths must be resolved explicitly.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/daemon/service-env.test.ts
• Scenario the test should lock in: Nix profile directories appear in the service PATH with correct precedence (rightmost NIX_PROFILES entry = highest priority), and fallback to ~/.nix-profile/bin when NIX_PROFILES is absent.
• Why this is the smallest reliable guardrail: Unit tests on getMinimalServicePathParts / getMinimalServicePathPartsFromEnv directly validate the PATH resolution without requiring a running gateway or service installation.
• Existing test that already covers this (if any): None before this PR.
• If no new test is added, why not: 7 new tests added.

User-visible / Behavior Changes

• Nix-installed binaries are now discoverable by the gateway service on Linux and macOS.
• hasBinary() checks at boot will find Nix-managed tools without manual PATH configuration.

Diagram (if applicable)

Before:
[gateway boot] -> [service PATH: system + user dirs] -> [Nix binaries missing] -> [skills blocked]

After:
[gateway boot] -> [service PATH: Nix profiles + user + system dirs] -> [Nix binaries found] -> [skills available]

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? No

Repro + Verification

Environment

• OS: Linux or macOS with Nix/Home Manager installed
• Runtime/container: Node 22+
• Model/provider: N/A
• Integration/channel (if any): N/A
• Relevant config (redacted): NIX_PROFILES="/nix/var/nix/profiles/default ~/.nix-profile"

Steps

1. Install Nix with Home Manager
2. Run openclaw gateway install
3. Check openclaw channels status --probe for blocked skills

Expected

• Nix-installed binaries resolve correctly in the service PATH.

Actual

• Before this PR: binaries under ~/.nix-profile/bin are missing from the service PATH.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

7 new unit tests validate the added behavior: fallback (Linux/macOS), two-profile precedence (Linux/macOS), single profile (Linux/macOS), three-profile precedence ordering. No pre-existing tests existed for this code path.

Human Verification (required)

• Verified scenarios: pnpm check (0 warnings, 0 errors), pnpm test scoped to service-env.test.ts (7/7 Nix tests pass).
• Edge cases checked: Three-profile ordering validates that intermediate profiles maintain correct Nix precedence (rightmost = highest priority, verified against NixOS/nix source scripts/nix-profile-daemon.sh.in).
• What you did not verify: End-to-end gateway install on a Nix system.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

4 Codex review comments about NIX_PROFILES precedence are addressed by the latest commit but not yet resolved on GitHub — pending maintainer review.

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No

Risks and Mitigations

• Risk: NIX_PROFILES contains unexpected entries (e.g. non-existent paths).
  • Mitigation: addNonEmptyDir + appendSubdir guard against empty/malformed paths. Non-existent directories in PATH are harmless (skipped by the OS at lookup time).

Key difference from #44433

Uses appendSubdir(profile, "bin") instead of raw template literal ${profile}/bin, consistent with all other env-configured bin dirs in the file, and guards against double /bin paths.