Gateway doesnt work in background - only works when terminal is open

[solar holly]

Gateway doesnt work when i only run 'openclaw gateway start'. it says it runs but agent doesnt work. if i leave a terminal window open using 'openclaw gateway' (no "start") then the agent works fine. Here is the error log from today:

If the gateway is supervised, stop it with: openclaw gateway stop
2026-02-13T03:00:33.072Z Port 18789 is already in use.
2026-02-13T03:00:33.073Z - pid 41697 aisandbox: openclaw-gateway (127.0.0.1:18789)
2026-02-13T03:00:33.073Z - Gateway already running locally. Stop it (openclaw gateway stop) or use a different port.
2026-02-13T03:00:33.077Z Gateway service appears loaded. Stop it first.
2026-02-13T03:00:33.078Z Tip: openclaw gateway stop
2026-02-13T03:00:33.078Z Or: launchctl bootout gui/$UID/ai.openclaw.gateway
2026-02-13T03:00:43.928Z Gateway failed to start: gateway already running (pid 41697); lock timeout after 5000ms

2026-02-12T19:01:49.042-08:00 Or: launchctl bootout gui/$UID/ai.openclaw.gateway
2026-02-13T03:01:55.326Z [imessage] imsg rpc: failed to parse permissionDenied(path: "/Users/aisandbox/Library/Messages/chat.db", underlying: authorization denied (code: 23)): Unexpected token 'p', "permission"... is not valid JSON
2026-02-13T03:01:55.856Z [imessage] imsg rpc: failed to parse permissionDenied(path: "/Users/aisandbox/Library/Messages/chat.db", underlying: authorization denied (code: 23)): Unexpected token 'p', "permission"... is not valid JSON

2026-02-13T03:01:57.939Z [imessage] imsg rpc: failed to parse permissionDenied(path: "/Users/aisandbox/Library/Messages/chat.db", underlying:
2026-02-13T03:22:26.942Z [imessage] imsg rpc not ready after 30000ms (Error: imsg rpc exited (code 1))
2026-02-13T03:22:26.945Z [imessage] [default] channel exited: imsg rpc not ready (Error: imsg rpc exited (code 1))

[junior trail]

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

[gaunt mango]

Your log is basically showing two separate problems:

1) openclaw gateway start didn’t actually start a gateway

This part:

• Port 18789 is already in use
• Gateway already running locally (pid …)
• Gateway failed to start: gateway already running … lock timeout

…means you already had a Gateway process bound to 127.0.0.1:18789, so the “start” command refused to launch a second one.

Rule of thumb: you can run either

• openclaw gateway (foreground, tied to the terminal), or
• the supervised background service (openclaw gateway start),
  but not both at the same time on the same port.

What to do:

openclaw gateway status
openclaw gateway stop
openclaw gateway start
openclaw gateway status

If you want the background/supervised one permanently, make sure it’s installed:

openclaw gateway install
openclaw gateway restart

2) Your background service is choking on iMessage permissions

These lines:

• authorization denied (code: 23) on .../Library/Messages/chat.db

• imsg rpc not ready ... exited (code 1)

…are macOS TCC permissions (Full Disk Access / Automation). Common gotcha: it works in Terminal (because Terminal has the permission), but fails under launchd (different process context).

Fix options:

Option A — you don’t need iMessage

Disable it in config and restart the gateway:

{ channels: { imessage: { enabled: false } } }

Option B — you do need iMessage

Give Full Disk Access (+ Automation → Messages) to the actual binaries launchd runs.

Useful to locate them:

which openclaw
which imsg

Docs (exact checklist + why launchd differs):
https://docs.openclaw.ai/channels/imessage

Quick next step (so we can see what’s really running)

Please paste:

openclaw --version
openclaw gateway status --deep

Also, on macOS the launchd stdout/err log is typically here (handy if openclaw logs --follow can’t attach yet):

• /tmp/openclaw/openclaw-gateway.log

[solar holly]

there was no log file there. also under automation in settings under terminal, messages, reminders, and notes are enabled.

here is pasted from those commands:
aisandbox@Agents-Mac-mini ~ % openclaw --version
2026.2.12
aisandbox@Agents-Mac-mini ~ % openclaw gateway status --deep

🦞 OpenClaw 2026.2.12 (f9e444d) — If it's repetitive, I'll automate it; if it's hard, I'll bring jokes and a rollback plan.

│
◇
Service: LaunchAgent (loaded)
File logs: /tmp/openclaw/openclaw-2026-02-12.log
Command: /opt/homebrew/Cellar/node@22/22.22.0/bin/node /opt/homebrew/lib/node_modules/openclaw/dist/index.js gateway --port 18789
Service file: ~/Library/LaunchAgents/ai.openclaw.gateway.plist
Service env: OPENCLAW_GATEWAY_PORT=18789

Config (cli): ~/.openclaw/openclaw.json
Config (service): ~/.openclaw/openclaw.json

Gateway: bind=loopback (127.0.0.1), port=18789 (service args)
Probe target: ws://127.0.0.1:18789
Dashboard: http://127.0.0.1:18789/
Probe note: Loopback-only gateway; only local clients can connect.

Runtime: running (pid 1658, state active)
RPC probe: ok

Listening: 127.0.0.1:18789
Troubles: run openclaw status
Troubleshooting: https://docs.openclaw.ai/troubleshooting
aisandbox@Agents-Mac-mini ~ %

[gaunt mango]

Good news: that gateway status --deep output means the LaunchAgent background gateway is running and reachable:

• Runtime: running …
• RPC probe: ok
• log file is /tmp/openclaw/openclaw-2026-02-12.log (daily rolling file)

So the problem is almost certainly not “gateway didn’t start” anymore — it’s that something the agent/channel needs works in your interactive Terminal environment, but not under launchd.

1) No “gateway.log” is expected here

Older instructions mention /tmp/openclaw/openclaw-gateway.log, but your build is using the daily file. Check it like:

tail -n 200 /tmp/openclaw/openclaw-2026-02-12.log
# or
openclaw logs --follow

Docs: https://docs.openclaw.ai/gateway/logging

2) If you’re using iMessage: Terminal Automation permission isn’t enough

Your earlier log had:

authorization denied ... /Users/.../Library/Messages/chat.db

That’s Full Disk Access, and it must be granted to the actual binaries launchd runs, not just Terminal.

From your status, launchd runs this exact Node binary:

/opt/homebrew/Cellar/node@22/22.22.0/bin/node

If iMessage is enabled, add at least these to System Settings → Privacy & Security → Full Disk Access:

• /opt/homebrew/Cellar/node@22/22.22.0/bin/node
• imsg (usually /opt/homebrew/bin/imsg or wherever which imsg points)

Then restart:

openclaw gateway restart

iMessage docs (has the exact TCC checklist): https://docs.openclaw.ai/channels/imessage

3) If the agent fails only in background: it’s often missing API keys under launchd

When you run openclaw gateway in a Terminal, it inherits your shell env. Under launchd, it usually does not, so model keys that are only in .zshrc/exported in Terminal won’t exist.

Fix: put provider keys into ~/.openclaw/.env (don’t paste them in Discord).

Example (Anthropic):

cat >> ~/.openclaw/.env <<'EOF'

ANTHROPIC_API_KEY=...
EOF
openclaw gateway restart

Quick “tell me which it is”

Can you paste the output of these two?

openclaw status
openclaw channels status --probe

And if you can, run openclaw logs --follow, reproduce “agent doesn’t work” once, and paste the first obvious error line (redact tokens). That’ll make it immediately clear whether this is iMessage TCC vs missing model auth vs routing/pairing.

[solar holly]

here is output from the 2 commands. also i cannot add node since its mach-0 and imsg is bourne again script. wont let me add to full disk access.

isandbox@Agents-Mac-mini ~ % openclaw status

OpenClaw status

│ Dashboard │ http://127.0.0.1:18789/
│ OS │ macos 26.2 (arm64) · node 22.22.0
│ Tailscale │ off
│ Channel │ stable (default)
│ Update │ pnpm · npm latest 2026.2.12 │
│ Gateway │ local · ws://127.0.0.1:18789 (local loopback) · reachable 32ms · auth token · Agents-Mac-mini.local │
│ │ (192.168.5.59) app unknown macos 26.2 │
│ Gateway service │ LaunchAgent installed · loaded · running (pid 1658, state active) │
│ Node service │ LaunchAgent not installed │
│ Agents │ 1 · 1 bootstrapping · sessions 1 · default main active 44m ago │
│ Memory │ 0 files · 0 chunks · dirty · sources memory · plugin memory-core · vector ready · fts ready · cache │
│ │ on (0) │
│ Probes │ skipped (use --deep) │
│ Events │ none │
│ Heartbeat │ 30m (main) │
│ Sessions │ 1 active · default gemini-2.5-flash (1049k ctx) · ~/.openclaw/agents/main/sessions/sessions.json │

Security audit
Summary: 0 critical · 1 warn · 1 info
WARN Reverse proxy headers are not trusted
gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client c…
Fix: Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.
Full report: openclaw security audit
Deep probe: openclaw security audit --deep

Channels
┌──────────┬─────────┬────────┬────────────────────────────────────────────────────────────────────────────────────────────┐
│ Channel │ Enabled │ State │ Detail │
├──────────┼─────────┼────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ WhatsApp │ ON │ OK │ linked · [phone] · auth 8m ago · accounts 1 │
│ iMessage │ ON │ WARN │ configured · gateway: Channel error: imsg rpc not ready (Error: imsg rpc exited (code 1)) │
└──────────┴─────────┴────────┴────────────────────────────────────────────────────────────────────────────────────────────┘

Sessions
┌─────────────────────────────────────────────────────────────────┬────────┬─────────┬──────────────────┬──────────────────┐
│ Key │ Kind │ Age │ Model │ Tokens │
├─────────────────────────────────────────────────────────────────┼────────┼─────────┼──────────────────┼──────────────────┤
│ agent:main:main │ direct │ 44m ago │ gemini-2.5-flash │ 113k/1049k (11%) │
└─────────────────────────────────────────────────────────────────┴────────┴─────────┴──────────────────┴──────────────────┘

OpenClaw status

│ Dashboard │ http://127.0.0.1:18789/ │
│ OS │ macos 26.2 (arm64) · node 22.22.0 │
│ Tailscale │ off │
│ Channel │ stable (default)
│ Update │ pnpm · npm latest 2026.2.12 │
│ Gateway │ local · ws://127.0.0.1:18789 (local loopback) · reachable 22ms · auth token · Agents-Mac-mini.local │
│ │ (192.168.5.59) app unknown macos 26.2 │
│ Gateway service │ LaunchAgent installed · loaded · running (pid 1658, state active) │
│ Node service │ LaunchAgent not installed │
│ Agents │ 1 · 1 bootstrapping · sessions 1 · default main active 44m ago │
│ Memory │ 0 files · 0 chunks · dirty · sources memory · plugin memory-core · vector ready · fts ready · cache │
│ │ on (0) │
│ Probes │ skipped (use --deep) │
│ Events │ none │
│ Heartbeat │ 30m (main) │
│ Sessions │ 1 active · default gemini-2.5-flash (1049k ctx) · ~/.openclaw/agents/main/sessions/sessions.json │

Security audit
Summary: 0 critical · 1 warn · 1 info
WARN Reverse proxy headers are not trusted
gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client c…
Fix: Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.
Full report: openclaw security audit
Deep probe: openclaw security audit --deep

│ Channel │ Enabled │ State │ Detail │
├──────────┼─────────┼────────┼────────────────────────────────────────────────────────────────────────────────────────────┤
│ WhatsApp │ ON │ OK │ linked · [phone] · auth 8m ago · accounts 1 │
│ iMessage │ ON │ WARN │ configured · gateway: Channel error: imsg rpc not ready (Error: imsg rpc exited (code 1)) │
└──────────┴─────────┴────────┴────────────────────────────────────────────────────────────────────────────────────────────┘

Sessions
┌─────────────────────────────────────────────────────────────────┬────────┬─────────┬──────────────────┬──────────────────┐
│ Key │ Kind │ Age │ Model │ Tokens │
├─────────────────────────────────────────────────────────────────┼────────┼─────────┼──────────────────┼──────────────────┤
│ agent:main:main │ direct │ 44m ago │ gemini-2.5-flash │ 113k/1049k (11%) │
└─────────────────────────────────────────────────────────────────┴────────┴─────────┴──────────────────┴──────────────────┘

also my api keys are in .env

[gaunt mango]

If your keys are in “.env” but the background LaunchAgent still can’t run the agent, the two most common gotchas are:

1) It has to be ~/.openclaw/.env (not a project .env)

Launchd won’t reliably run in the same working directory as your Terminal, so a local ./.env often gets ignored. OpenClaw does load the global fallback:

• ~/.openclaw/.env

Can you sanity-check this (don’t paste the contents):

ls -la ~/.openclaw/.env

And paste:

openclaw models status

That output will tell us if the gateway process is actually seeing credentials (without leaking them).

2) iMessage is still the smoking gun here (Full Disk Access, not Automation)

Your earlier log errors were Messages DB permission denied (chat.db). Having Automation → Messages enabled for Terminal is not enough.

Because your LaunchAgent runs:
/opt/homebrew/Cellar/node@22/22.22.0/bin/node ... openclaw ...

…you must grant Full Disk Access to the Node binary (and imsg if enabled), otherwise iMessage will fail when started in the background.

To confirm whether this is what’s making it “feel dead”, paste:

openclaw channels status --probe
openclaw status

If channels status --probe shows iMessage not ready / exited, that’s exactly why it works when you run it from Terminal (Terminal has TCC grants) but not under launchd.

Also: your log file does exist, just not the name you expected

From your --deep output, it’s:
/tmp/openclaw/openclaw-2026-02-12.log

Try:

openclaw logs --follow
# or
tail -n 200 /tmp/openclaw/openclaw-2026-02-12.log

Paste the first clear error you see right after you reproduce the “agent doesn’t work” case.

[solar holly]

aisandbox@Agents-Mac-mini ~ % openclaw models status

🦞 OpenClaw 2026.2.12 (f9e444d) — iMessage green bubble energy, but for everyone.

Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/main/agent
Default : google/gemini-2.5-flash
Fallbacks (0) : -
Image model : -
Image fallbacks (0): -
Aliases (1) : gemini -> google/gemini-2.5-flash
Configured models (1): google/gemini-2.5-flash

Auth overview
Auth store : ~/.openclaw/agents/main/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): google (1)

• google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=1, api_key=0) | google:default=token:AIzaSyBb...JWK_BeXA

OAuth/token status

• google
  • google:default static

aisandbox@Agents-Mac-mini ~ % openclaw channels status --probe

🦞 OpenClaw 2026.2.12 (f9e444d) — Your messages, your servers, your control.

│
◇
Gateway reachable.

• WhatsApp default: enabled, configured, linked, running, connected, dm:pairing, allow:[phone]
• iMessage default: enabled, configured, stopped, works, error:imsg rpc not ready (Error: imsg rpc exited (code 1))

Warnings:

• imessage default: Channel error: imsg rpc not ready (Error: imsg rpc exited (code 1))
• Run: openclaw doctor

Tip: status --deep adds gateway health probes to status output (requires a reachable gateway).
aisandbox@Agents-Mac-mini ~ %

aisandbox@Agents-Mac-mini ~ % openclaw channels status --probe

🦞 OpenClaw 2026.2.12 (f9e444d) — Your messages, your servers, your control.

│
◇
Gateway reachable.

• WhatsApp default: enabled, configured, linked, running, connected, dm:pairing, allow:[phone]
• iMessage default: enabled, configured, stopped, works, error:imsg rpc not ready (Error: imsg rpc exited (code 1))

Warnings:

• imessage default: Channel error: imsg rpc not ready (Error: imsg rpc exited (code 1))
• Run: openclaw doctor

If the gateway is supervised, stop it with: openclaw gateway stop
2026-02-12T19:01:49.036-08:00 Port 18789 is already in use.
2026-02-12T19:01:49.037-08:00 - pid 41697 aisandbox: openclaw-gateway (127.0.0.1:18789)
2026-02-12T19:01:49.037-08:00 - Gateway already running locally. Stop it (openclaw gateway stop) or use a different port.
2026-02-12T19:01:49.041-08:00 Gateway service appears loaded. Stop it first.
2026-02-12T19:01:49.041-08:00 Tip: openclaw gateway stop
2026-02-12T19:01:49.042-08:00 Or: launchctl bootout gui/$UID/ai.openclaw.gateway
2026-02-13T03:01:55.326Z [imessage] imsg rpc: failed to parse permissionDenied(path: "/Users/aisandbox/Library/Messages/chat.db", underlying: authorization denied (code: 23)): Unexpected token 'p', "permission"... is not valid JSON

[gaunt mango]

That log snippet explains the whole “works only when Terminal is open” behavior.

A) The port messages are just you trying to start a second gateway

These lines:

• Port 18789 is already in use
• Gateway already running locally…
• Gateway service appears loaded

…happen when you run foreground openclaw gateway while the LaunchAgent is already running (or vice-versa). Pick one mode:

• background: openclaw gateway stop && openclaw gateway start
• foreground: openclaw gateway stop first, then openclaw gateway --verbose

B) The real “agent doesn’t work in background” culprit is iMessage permissions

This is the important one:

authorization denied (code: 23) ... /Users/aisandbox/Library/Messages/chat.db

That means the iMessage channel cannot start under launchd, so if you’re talking to the agent via iMessage, it’ll look “dead” when running as a service.

Automation being enabled for Terminal.app doesn’t help launchd runs. You need Full Disk Access in the launchd context.

Do this:

1. System Settings → Privacy & Security → Full Disk Access
   Add (at least) these executables:

• the Node binary your service runs (from your gateway status --deep):
  /opt/homebrew/Cellar/node@22/22.22.0/bin/node
• your imsg binary (paste what this returns):

  which imsg
  

2. Restart:

openclaw gateway restart

3. Confirm iMessage is actually up:

openclaw channels status --probe

If you don’t care about iMessage right now, quickest proof is to disable iMessage in ~/.openclaw/openclaw.json and restart the gateway—if everything suddenly “works in background”, that’s 100% the issue.

Docs (this exact TCC pitfall): https://docs.openclaw.ai/channels/imessage

---

One more thing: you said “API keys are in .env” — can you confirm it’s ~/.openclaw/.env (global fallback), not a random working dir .env?